spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From J4K <ju...@klunky.co.uk>
Subject Re: improving the score for specific types of spam
Date Wed, 13 Jul 2011 12:06:52 GMT
On 07/13/2011 01:23 PM, Martin Gregorie wrote:
> On Wed, 2011-07-13 at 09:44 +0200, Geert Mak wrote:
>> recently we had two specific types of spam getting very low score
>> (about 3) and going through -
>>
>> a) one was about Armbanduhren (wrist watches in German) or
>> Edelarmbanduhren (luxury wrist watches) - all in that direction.
>>
>> b) the other was about all kind of Job offers
>>
>> as i could not figure out how to increase their score in spamassassin
>> and as they had repeatable keywords which are usually not in our
>> correspondence, i currently process them on postfix level with a small
>> header_checks and body_checks regex.
>>
>> does somebody know a way to improve spamassassin so that the score for
>> these specific types of spam (which are quite massive the last months
>> in Austria)?
>>
> I'd write a private rule for each type of spam, along the lines of:
>
> describe PRIVATE_RULE German language wrist watch spam
> body     __PR1        /(Armbanduhren|Edelarmbanduhren)/i
> uri      __PR2        /www\..*\.de/
> meta     PRIVATE_RULE (__PR1 && __PR2)
> score    PRIVATE_RULE 5.5
>
> The basic principle is that the first 'body' subrule(s) match words that
> mark this sort of spam and the second 'uri' subrule detects URLs for the
> shop being advertised. It might be very specific, or even less specific
> that my example, e.g. /^www/
>
> There's a hidden assumption with this type of rule that the
> *combination* of the words and matching URIs is always spam but things
> that match the subrules can legitimately appear in ham provided they
> don't both appear. 
>
> Each rule of this type needs to be carefully tested and tuned to suit
> your particular mail stream.
>
>
> Martin
Hi,

    I put this in to deter the wealth of job advertisments we get:

describe PRIVATE_RULE1 English language job opportunity
body     __PR1        /(Employment opportunity|Job offer match, respond
to apply|Employment you've been searching|Job opportunity|Career
opportunity inside|Position opening in your area|Work offer
inside|Vacancy - apply online|Job ad - see details! Sent through  Search
engine|Get a New Job Today|Working Part Time)/i
uri      __PR2       
/^(au-joblists.com|europ-joblist.com|gb-totaljob.com|uk-joblists.com|us-joblists.com)/i
meta     PRIVATE_RULE1 (__PR1 && __PR2)
score    PRIVATE_RULE1 5.5

The URLs are typically email addresses e.g fred@europ-joblist.com. Would
this rule work.  spamassassin --lint did not complain.




S

Mime
View raw message