Hello Fred, Thomas,
Saturday, January 17, 2004, 12:53:45 PM, you wrote:
>> FYI -- I'm noticing SPAMs which contain ONLY an image are not being
>> filtered at all. ...
F> Try this out for size, they are a few custom rules I have created myself.
F> # Catch Image ONLY spams!
F> rawbody __FVGT_rb_HTML_HAS_AHREF eval:html_tag_exists('a')
F> rawbody __FVGT_rb_HTML_HAS_IMG eval:html_tag_exists('img')
F> full __FVGT_rb_HTML_LEN_80_375 /<(?:html|body).{80,375}<\/(?:body|html)>/is
F> full __FVGT_rb_A_THEN_IMG /<a.{12,155}<img/is
F> meta FVGT_m_IMAGE_ONLY_SPAM (__FVGT_rb_HTML_LEN_80_375 &&
__FVGT_rb_HTML_HAS_AHREF && __FVGT_rb_HTML_HAS_IMG && __FVGT_rb_A_THEN_IMG)
F> describe FVGT_m_IMAGE_ONLY_SPAM Short HTML message with IMG and A HREF
F> score FVGT_m_IMAGE_ONLY_SPAM 3.5
Good rules. My mass-check reports
> FVGT_m_IMAGE_ONLY_SPAM -- 4202s/5h of 92209 corpus (74874s/17335h) 01/17/04
The five ham were all posted from yahoo.com webmail October 24 and 25 of
2002. Looks like Yahoo had a bug in their web interface back then. Or
maybe it was a user error (all five were from the same person).
No ham matches in the last year.
Interestingly, I already had a copy of this rule in my custom rule set
from an earlier posting, except it used
> full __FVGT_rb_HTML_LEN_80_275 /<(html|body).{80,275}<\/(body|html)>/is
instead of 80,375, and also
> full __FVGT_rb_A_THEN_IMG /<a.{12,95}<img/is
instead of 12,155.
That rule scores fewer spam, and does not match these five ham: 2658s/0h of 87289
corpus (70035s/17254h)
Bob Menschel
-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
