Hello Anthony,

Tuesday, January 6, 2004, 7:54:13 AM, you wrote:

>> > header XMAILERBOGUS             X-Mailer =~ /^[^A-Z0-9]*$/
>> > describe XMAILERBOGUS           X-Mailer header has NO uppercase
>> letters, NO numbers... How do you expect me to believe that
>> > score XMAILERBOGUS              0.5
>>
>> It seems to work fine - hits all those bayes-buster spams. However, it
>> also hits messages with no X-Mailer header at all - which I suspect
>> may lead to FPs. To exclude this, I've changed it to:

AM> Heh. That's happened with both of my rules so far. Thanks for the help

>> header local_XMAILER_BOGUS   X-Mailer =~ /^[a-z][^A-Z0-9]*$/

header   XMAILERBOGUS  X-Mailer =~ /^[a-z][^A-Z0-9]*$/
describe XMAILERBOGUS  X-Mailer header has NO uppercase letters, NO numbers... How do 
you expect me to believe that
score    XMAILERBOGUS  0.5

XMAILERBOGUS -- 396s/5h of 85945 corpus (70035s/15910h)
XMAILERBOGUS -- suggested score (with 9.0 required): 1.56000

Ham matches:
# XMAILERBOGUS="mail.com\n"
# XMAILERBOGUS="mail.com\n"
# XMAILERBOGUS="mail.com\n"
# XMAILERBOGUS="ubersmith (http://www.ubersmith.com/)\n"
# XMAILERBOGUS="a script\n"

Mail.com is a free webmail service (among other things), used by my
grandson.  Emails are from 2001 and 2002 -- looks like they stopped using
this form of x-mailer header by 2003. Most recent header from him is
> X-Mailer: MIME-tools 5.41 (Entity 5.404)

X-Mailer: ubersmith (http://www.ubersmith.com/)
was used by drak.net when I last queried them about web hosting.

X-Mailer: a script
was used by macromedia.com in an auto-confirmation to me after a
dreamweaver download Feb 2003.

Bob Menschel




-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Reply via email to