On Thu, Dec 05, 2002 at 05:04:28PM -0700, Michael Moncur wrote:
> Actually 6 out of the 14 messages in your corpus are from these people. They
> frequently change URLs so it's hard to recognize them. But they all have the
> same sparse format and similar URLs that match some of the rules I posted.
> They tend to be affiliate spam - the URLs redirect you to a legitimate
> business (such as Columbia House) using an affiliate code that makes them
> money.
>
> They also tend to match the CTYPE_JUST_HTML and WEB_BUGS rules, both of
> which have near-zero scores in 2.43. I raise the score on both of those
> locally because they don't cause false positives for me.
>
> These folks are serious spammers. They even register each of the domain
> names to look legit. Look up findhsm-list-cluster-182-643.com or any of the
> others, they're all registered to Daily Promotions. (It's a shame a WHOIS
> lookup would be expensive, or this would make an excellent eval test.)
>
> From: MyChoice <[EMAIL PROTECTED]>
> Subject: Keep your partner coming back for more.
Would a "domain contains many numbers" test help?
header DOMAIN_NUMS From =~ /(\d\S?){5}/
--
Duncan Findlay
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
