I found Bart's results interesting, so I asked him for a copy of it and ran
it over my caught spam for the last 15 days. I'll include my results below.
I find this quite interesting, beucase it gives and example of how
ineffective some of the rules have become. (NIGERIAN_SCAM, for example)
Perhaps it's time to remove some of these rules in the interest of speeding
processing up?
Dan.
---
707647 total spams, 320 rules hit
CLICK_BELOW => 472428 (66.76%)
NO_REAL_NAME => 314231 (44.41%)
CTYPE_JUST_HTML => 302429 (42.74%)
CLICK_HERE_LINK => 288433 (40.76%)
PLING => 236316 (33.39%)
BIG_FONT => 222208 (31.40%)
FROM_ENDS_IN_NUMS => 193570 (27.35%)
REMOVE_PAGE => 169220 (23.91%)
NORMAL_HTTP_TO_IP => 162027 (22.90%)
WEB_BUGS => 137483 (19.43%)
SUBJ_HAS_SPACES => 114416 (16.17%)
EXCUSE_3 => 106043 (14.99%)
FROM_HAS_MIXED_NUMS => 99698 (14.09%)
MAILTO_LINK => 97283 (13.75%)
MSG_ID_ADDED_BY_MTA_2 => 93937 (13.27%)
SUBJ_HAS_UNIQ_ID => 92795 (13.11%)
REMOVE_SUBJ => 87044 (12.30%)
SUPERLONG_LINE => 79913 (11.29%)
BASE64_ENC_TEXT => 79841 (11.28%)
LINES_OF_YELLING => 73029 (10.32%)
FORGED_YAHOO_RCVD => 67532 (9.54%)
REMOVE_IN_QUOTES => 66214 (9.36%)
INVALID_DATE_TZ_ABSURD => 59985 (8.48%)
NO_OBLIGATION => 58861 (8.32%)
UNSUB_PAGE => 53082 (7.50%)
VIAGRA => 49997 (7.07%)
ONE_HUNDRED_PC_FREE => 49208 (6.95%)
MAILTO_WITH_SUBJ => 49182 (6.95%)
SUBJ_ALL_CAPS => 45797 (6.47%)
EXCUSE_6 => 45396 (6.42%)
GUARANTEE => 45228 (6.39%)
EXCUSE_16 => 44371 (6.27%)
OPT_IN => 43097 (6.09%)
DEAR_SOMEBODY => 42028 (5.94%)
MAILTO_TO_REMOVE => 41070 (5.80%)
MAY_BE_FORGED => 38755 (5.48%)
EXCUSE_14 => 38017 (5.37%)
FORGED_HOTMAIL_RCVD => 37976 (5.37%)
SUBJ_ENDS_IN_Q_MARK => 37668 (5.32%)
HTML_WITH_BGCOLOR => 36803 (5.20%)
COPYRIGHT_CLAIMED => 35745 (5.05%)
FOR_FREE => 35532 (5.02%)
FAKED_UNDISC_RECIPS => 35219 (4.98%)
EXCUSE_1 => 33880 (4.79%)
MAILTO_TO_SPAM_ADDR => 33344 (4.71%)
HTTP_WITH_EMAIL_IN_URL => 32588 (4.61%)
PLING_PLING => 32577 (4.60%)
SUBJ_HAS_Q_MARK => 32479 (4.59%)
SUBJ_REMOVE => 31285 (4.42%)
HTTP_USERNAME_USED => 31181 (4.41%)
A_HREF_TO_REMOVE => 30152 (4.26%)
FROM_AND_TO_SAME => 29537 (4.17%)
EXCUSE_7 => 28301 (4.00%)
INVALID_MSGID => 26941 (3.81%)
FRONTPAGE => 26875 (3.80%)
LINES_OF_YELLING_2 => 26374 (3.73%)
DIFFERENT_REPLY_TO => 26117 (3.69%)
CALL_FREE => 25851 (3.65%)
PORN_10 => 25736 (3.64%)
A_HREF_TO_UNSUB => 24744 (3.50%)
NO_COST => 23712 (3.35%)
MORTGAGE_RATES => 22907 (3.24%)
ONE_HUNDRED_PC_GUAR => 22300 (3.15%)
TO_MALFORMED => 22260 (3.15%)
JAVASCRIPT => 21166 (2.99%)
TO_EMPTY => 20311 (2.87%)
FREE_MONEY => 20096 (2.84%)
FREE_CONSULTATION => 19600 (2.77%)
INVALID_DATE_ODD_MONTH => 19230 (2.72%)
INVALID_DATE_NO_TZ => 18484 (2.61%)
MAILTO_WITH_SUBJ_REMOVE => 18407 (2.60%)
ADVERT_CODE => 18404 (2.60%)
AS_SEEN_ON => 18116 (2.56%)
US_DOLLARS_3 => 18040 (2.55%)
GREAT_OFFER => 17758 (2.51%)
UNDISC_RECIPS => 16483 (2.33%)
FOR_JUST_SOME_AMT => 16027 (2.26%)
LINES_OF_YELLING_3 => 15719 (2.22%)
PORN_4 => 15688 (2.22%)
SLIGHTLY_UNSAFE_JAVASCRIPT => 15373 (2.17%)
BUGGY_CGI => 15007 (2.12%)
PORN_3 => 14811 (2.09%)
EMAIL_MARKETING => 14380 (2.03%)
CASINO => 14113 (1.99%)
AOL_USERS_LINK => 14010 (1.98%)
DIRECT_EMAIL => 13928 (1.97%)
PORN_11 => 13848 (1.96%)
REALLY_UNSAFE_JAVASCRIPT => 13847 (1.96%)
REMOVAL_INSTRUCTIONS => 13758 (1.94%)
WORK_AT_HOME => 13757 (1.94%)
SMTPD_IN_RCVD => 13223 (1.87%)
DATE_IN_FUTURE => 13141 (1.86%)
REPLY_REMOVE_SUBJECT => 11158 (1.58%)
GAPPY_TEXT => 10952 (1.55%)
SECTION_301 => 10693 (1.51%)
ALL_NATURAL => 10656 (1.51%)
SUSPICIOUS_CC_RECIPS => 10534 (1.49%)
DEAR_FRIEND => 10301 (1.46%)
LINE_OF_YELLING => 10262 (1.45%)
FROM_NAME_EQ_FROM_ADDR => 10025 (1.42%)
BILL_1618 => 9589 (1.36%)
VERY_SUSP_CC_RECIPS => 9491 (1.34%)
EXCUSE_10 => 9337 (1.32%)
RESISTANCE_IS_FUTILE => 9243 (1.31%)
HTTP_ESCAPED_HOST => 9059 (1.28%)
HOME_EMPLOYMENT => 8928 (1.26%)
CASHCASHCASH => 8805 (1.24%)
MSGID_HAS_NO_AT => 8642 (1.22%)
PORN_12 => 8409 (1.19%)
ALL_CAPS_SUBJECT => 8363 (1.18%)
UNSUB_SCRIPT => 8326 (1.18%)
MONEY_BACK => 8310 (1.17%)
X_PRIORITY_HIGH => 8096 (1.14%)
SUSPICIOUS_RECIPS => 7890 (1.11%)
VERY_SUSP_RECIPS => 7827 (1.11%)
OPPORTUNITY => 7766 (1.10%)
PROFITS => 7737 (1.09%)
RISK_FREE => 7492 (1.06%)
ASCII_FORM_ENTRY => 7478 (1.06%)
FOR_INSTANT_ACCESS => 7070 (1.00%)
THIS_AINT_SPAM => 6789 (0.96%)
CLICK_TO_REMOVE_2 => 6756 (0.95%)
A_HREF_TO_OPT_OUT => 6270 (0.89%)
BULK_EMAIL => 6042 (0.85%)
SENT_IN_COMPLIANCE => 5902 (0.83%)
CBYI => 5578 (0.79%)
ONE_TIME_MAILING => 5439 (0.77%)
MSG_ID_ADDED_BY_MTA => 5233 (0.74%)
FORM_W_MAILTO_ACTION => 5200 (0.73%)
AMAZING => 4946 (0.70%)
HR_3113 => 4766 (0.67%)
EXCUSE_12 => 4720 (0.67%)
UCE_MAIL_ACT => 4709 (0.67%)
FORGED_EUDORAMAIL_RCVD => 4681 (0.66%)
MSGID_SPAMSIGN_1 => 4440 (0.63%)
EXCUSE_15 => 4409 (0.62%)
WEIRD_PORT => 4170 (0.59%)
X_EM_VER_PRESENT => 4170 (0.59%)
EARN_PER_WEEK => 4048 (0.57%)
FROM_STARTS_WITH_NUMS => 3992 (0.56%)
MONEY_MAKING => 3978 (0.56%)
LIMITED_TIME_ONLY => 3978 (0.56%)
KNOWN_BAD_DIALUPS => 3959 (0.56%)
SOCIAL_SEC_NUMBER => 3956 (0.56%)
JODY => 3886 (0.55%)
STRONG_BUY => 3851 (0.54%)
SUBJ_2_CREDIT => 3748 (0.53%)
YOUR_INCOME => 3734 (0.53%)
WE_HONOR_ALL => 3465 (0.49%)
X_MSMAIL_PRIORITY_HIGH => 3459 (0.49%)
SEE_FOR_YOURSELF => 3358 (0.47%)
EXCUSE_17 => 3324 (0.47%)
COPY_ACCURATELY => 3293 (0.47%)
DOMAIN_BODY => 3264 (0.46%)
WANTS_CREDIT_CARD => 3248 (0.46%)
TO_NO_USER => 3209 (0.45%)
SUBJ_MISSING => 3125 (0.44%)
PENNIES_A_DAY => 3017 (0.43%)
TO_UNSUB_REPLY => 2828 (0.40%)
NONEXISTENT_CHARSET => 2711 (0.38%)
EXCUSE_13 => 2711 (0.38%)
CALL_NOW => 2621 (0.37%)
SUBJ_FULL_OF_8BITS => 2597 (0.37%)
COPY_DVDS => 2571 (0.36%)
PENIS_ENLARGE2 => 2484 (0.35%)
PORN_13 => 2307 (0.33%)
FORGED_RCVD_FOUND => 2289 (0.32%)
LARGE_HEX => 2209 (0.31%)
TO_LOCALPART_EQ_REAL => 2190 (0.31%)
FULL_REFUND => 2168 (0.31%)
ASKS_BILLING_ADDRESS => 2148 (0.30%)
ORDER_STATUS => 2117 (0.30%)
RATWARE => 2099 (0.30%)
PRINT_FORM_SIGNATURE => 1978 (0.28%)
URI_IS_POUND => 1949 (0.28%)
PORN_9 => 1941 (0.27%)
WE_HATE_SPAM => 1908 (0.27%)
INVALID_DATE => 1873 (0.26%)
TONER => 1867 (0.26%)
READ_TO_END => 1838 (0.26%)
FROM_MALFORMED => 1826 (0.26%)
NUMERIC_HTTP_ADDR => 1796 (0.25%)
CHECK_OR_MONEY_ORDER => 1703 (0.24%)
NEW_DOMAIN_EXTENSIONS => 1700 (0.24%)
PARA_A_2_C_OF_1618 => 1692 (0.24%)
EXCUSE_4 => 1670 (0.24%)
NO_QS_ASKED => 1645 (0.23%)
FROM_NO_USER => 1596 (0.23%)
PORN_1 => 1580 (0.22%)
BILLION_DOLLARS => 1579 (0.22%)
MIME_NULL_BLOCK => 1545 (0.22%)
HTML_EMBEDS => 1452 (0.21%)
MASS_EMAIL => 1387 (0.20%)
FAKED_IP_IN_RCVD => 1337 (0.19%)
MISSING_HEADERS => 1334 (0.19%)
PRODUCED_AND_SENT_OUT => 1328 (0.19%)
BE_AMAZED => 1214 (0.17%)
ROUND_THE_WORLD => 1209 (0.17%)
IMPOTENCE => 1201 (0.17%)
LOTS_OF_CC_LINES => 1163 (0.16%)
TO_BE_REMOVED_REPLY => 1095 (0.15%)
CHARSET_FARAWAY => 1067 (0.15%)
DOMAIN_SUBJECT => 1045 (0.15%)
CHARSET_FARAWAY_HEADERS => 1039 (0.15%)
NO_EXPERIENCE => 1031 (0.15%)
FORGED_JUNO_RCVD => 1011 (0.14%)
RELAYING_FRAME => 957 (0.14%)
GENTLE_FEROCITY => 891 (0.13%)
VJESTIKA => 889 (0.13%)
ADDRESSES_ON_CD => 885 (0.13%)
PORN_7 => 872 (0.12%)
REPLY_TO_EMPTY => 870 (0.12%)
DONT_DELETE => 869 (0.12%)
KIFF => 840 (0.12%)
FORGED_GW05_RCVD => 826 (0.12%)
MICRO_CAP_WARNING => 822 (0.12%)
STOCK_PICK => 809 (0.11%)
FRIEND_AT_PUBLIC => 794 (0.11%)
PORN_6 => 775 (0.11%)
US_DOLLARS => 671 (0.09%)
THE_FOLLOWING_FORM => 647 (0.09%)
INCREASE_TRAFFIC => 642 (0.09%)
PURE_PROFIT => 620 (0.09%)
INCREASE_SALES => 609 (0.09%)
NO_CATCH => 590 (0.08%)
S_1618 => 565 (0.08%)
PLEASE_READ => 550 (0.08%)
US_DOLLARS_2 => 541 (0.08%)
PENIS_ENLARGE => 540 (0.08%)
STOCK_ALERT => 538 (0.08%)
FROM_MISSING => 530 (0.07%)
HTTP_CTRL_CHARS_HOST => 527 (0.07%)
SERIOUS_ONLY => 523 (0.07%)
REMOVE_SCRIPT => 501 (0.07%)
NOT_INTENDED => 497 (0.07%)
NIGERIAN_SCAM_3 => 447 (0.06%)
MONSTERHUT => 418 (0.06%)
NIGERIAN_SCAM_2 => 416 (0.06%)
COMMUNIGATE => 413 (0.06%)
EXCUSE_2 => 334 (0.05%)
ONCE_IN_LIFETIME => 322 (0.05%)
USER_IN_BLACKLIST => 315 (0.04%)
TAKE_ACTION_NOW => 306 (0.04%)
UNNEEDED_HTML_ENCODING => 296 (0.04%)
JAVASCRIPT_URI => 247 (0.03%)
WWW_CLIK4YOU_COM => 232 (0.03%)
REAL_THING => 230 (0.03%)
X_PMFLAGS_PRESENT => 227 (0.03%)
URGENT_BIZ => 224 (0.03%)
TRACKER_ID => 161 (0.02%)
ONLINE_BIZ_OPS => 158 (0.02%)
NO_DISSAPOINTMENT => 152 (0.02%)
INVESTOR_SPEC_SHEET => 119 (0.02%)
SIGNATURE_DELIM => 118 (0.02%)
EXCUSE_11 => 117 (0.02%)
SPAM_FORM_RETURN => 112 (0.02%)
GAPPY_SUBJECT => 111 (0.02%)
AUTO_EMAIL_REMOVAL => 109 (0.02%)
TRACE_BY_SSN => 100 (0.01%)
YOU_HAVE_BEEN_SELECTED => 98 (0.01%)
HTTP_NUMBER_WORD => 97 (0.01%)
USER_IN_WHITELIST_TO => 91 (0.01%)
SAFEGUARD_NOTICE => 90 (0.01%)
IN_REP_TO => 84 (0.01%)
PORN_2 => 81 (0.01%)
EJACULATION => 79 (0.01%)
PREST_NON_ACCREDITED => 78 (0.01%)
FREE_PRIORITY_MAIL => 72 (0.01%)
X_MAILER_GIBBERISH => 42 (0.01%)
NIGERIAN_SCAM_4 => 39 (0.01%)
Q_FOR_SELLER => 38 (0.01%)
INTL_EXEC_GUILD => 36 (0.01%)
SPAM_FORM => 36 (0.01%)
PORN_8 => 33 (0.00%)
WWW_AUTOREMOVE_COM => 29 (0.00%)
NO_SELLING => 27 (0.00%)
EXCUSE_18 => 26 (0.00%)
ITS_EFFECTIVE => 21 (0.00%)
BAD_HELO_WARNING => 18 (0.00%)
MANY_FROMS => 18 (0.00%)
IN_ACCORDANCE_WITH_LAWS => 18 (0.00%)
MDAEMON_2_7_4 => 16 (0.00%)
CHARSET_FARAWAY_BODY => 11 (0.00%)
STAINLESS_STEEL => 9 (0.00%)
YR_MEMBERSHIP_EXCH => 9 (0.00%)
BADTRANS_WORM => 8 (0.00%)
REMOVE_ES_01 => 5 (0.00%)
LONG_NUMERIC_HTTP_ADDR => 5 (0.00%)
FROM_BTAMAIL => 4 (0.00%)
EXCUSE_ES_01 => 4 (0.00%)
REMOVE_ES_03 => 4 (0.00%)
SHORT_RECEIVED_LINE => 3 (0.00%)
WWW_REMOVEYOU_COM => 2 (0.00%)
GREEN_EXCUSE_1 => 2 (0.00%)
BUGZILLA_BUG => 2 (0.00%)
SEXY_PICS => 2 (0.00%)
FREQ_SPAM_PHRASE => 2 (0.00%)
GREEN_EXCUSE_2 => 2 (0.00%)
SIRCAM_SIGNATURE => 1 (0.00%)
NIGERIAN_SCAM => 1 (0.00%)
SHOES_GUY => 1 (0.00%)
DATE_MISSING => 1 (0.00%)
MAJORDOMO => 1 (0.00%)
PGP_SIGNATURE => 1 (0.00%)
USER_IN_WHITELIST => 1 (0.00%)
POST_IN_RCVD => 1 (0.00%)
SPAM_PHRASES_020 => 1 (0.00%)
_______________________________________________________________
Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: [EMAIL PROTECTED]
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
