Here's a stab at some rules that attempt to detect messages from mailing
lists. "List-Unsubscribe", "X-Original-Date" and "Errors-To" might all be
from the same mailing list software, in which case they'd be redundant.
----------------
# Only look for 7 bit chars between square brackets, because a lot
# of spam with 8 bit chars in the subject would match this rule
header ELIST_1 Subject =~ /\[[\000-\177]{2,20}\]/
describe ELIST_1 Subject has something between square brackets
header ELIST_2 List-Unsubscribe =~ /./
describe ELIST_2 List-Unsubscribe field exists
header ELIST_3 X-Original-Date =~ /./
describe ELIST_3 X-Original-Date field exists
header ELIST_4 Errors-To =~ /./
describe ELIST_4 Errors-To field exists
header ELIST_5 Precedence =~ /bulk/i
describe ELIST_5 Prescendce is bulk
score ELIST_1 -2.0
score ELIST_2 -2.0
score ELIST_3 -2.0
score ELIST_4 -2.0
score ELIST_5 -2.0
--
Visit http://dmoz.org, the world's | Give a man a match, and he'll be warm
largest human edited web directory. | for a minute, but set him on fire, and
| he'll be warm for the rest of his life.
[EMAIL PROTECTED] ICQ: 132152059 |
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
