spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From John Hardin <jhar...@impsec.org>
Subject Re: New type of SPAM aggression
Date Tue, 12 Feb 2019 17:15:49 GMT
On Tue, 12 Feb 2019, Rupert Gallagher wrote:

> Let see if the mail arrives with the correct escaping this time.
>
> body  __HAS_URI /(http|https):\/\//
> tflags __HAS_URI multiple
> meta   TMU ( _HAS_URI > 10 )
> describe TMU Too many URIs (>10)
> score TMU 5.0

How about:

   uri     __HAS_URI   /^http/i
   tflags  __HAS_URI   multiple, maxhits=11
   etc.


> As rightly noted, the same link is counted twice, for text and html bodies when they
are present. However, my corpus has more of the odd type, where the text and the html parts
are different: if you switch from text to html you read a different message for the same email.
Those who fill their emails with lots of useless pics get the spam rating they deserve, so
I intentionally count all links.
>
> I feel more than generous with 5+5 links, but if you want more, or less, you can easily
change to fit your local policy.

-- 
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@impsec.org    FALaholic #11174     pgpk -a jhardin@impsec.org
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   The world has enough Mouse Clicking System Engineers.
                                                        -- Dave Pooser
-----------------------------------------------------------------------
  Today: Abraham Lincoln's and Charles Darwin's 210th Birthdays

Mime
View raw message