Inline below....
> -----Original Message-----
> From: Robert Menschel [mailto:[EMAIL PROTECTED]
> Sent: Sunday, January 18, 2004 11:02 PM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] Re: [RD] Offered Rules
>
>
> Here's my next set of possible rules for submission to the
> SpamAssassin
> distribution set.
>
> URI rules may tend to be more transient than other types of
> rules, since
> it's so easy for spammers to change domain names. I'm
> therefore including
> only those that hit at least 0.15% of my spam. Well, the
> pillsavings rule
> has hit several domains over several months, so that one I'll keep in,
> though it's not quite 0.15%. Ditto the href= rule.
>
> Feedback and/or mass-checks on these before formal submission are
> invited.
>
> Bob Menschel
>
>
*snip URI rules*
This is just my opinion, but I dislike putting temp rules into a distro.
Things like Paris, Hilton, Saddam playing cards, and URIs. I think a distro
could be around much longer then any of this temp things. So many people
would be wasteing CPU cycles and memory.
Some ISPs use 2.4x still. If that had a rule for the OJ simpsons case and
they had a few 1000 users........ :)
I'm still trying to figure out how I'm going to expire domains in bigevil!
>
> uri RM_up_hrefinuri /href=/i
> describe RM_up_hrefinuri link includes href within code
> score RM_up_hrefinuri 3.000 # 106s/0h of 92209
> corpus (74874s/17335h) 01/17/04
>
> uri RE_uwd_DefaultAsp /\/default\.asp\?id\=/i
> describe RE_uwd_DefaultAsp Contains a likely spammer
> default.asp link.
> score RE_uwd_DefaultAsp 4.500 # type=spamp -
> 1137s/0h of 92209 corpus (74874s/17335h) 01/17/04
>
> uri RM_uwd_defaultN /\/default\d{1,5}\.htm/i
> describe RM_uwd_defaultN text points to
> sequentially numbered "default" page
> score RM_uwd_defaultN 3.000 # 1322s/2h of 92209
> corpus (74874s/17335h) 01/17/04
> # ham: 1999 (1),
> 2003: http://movies.fantasticfactory.com/dagon/default8.htm
> in ToS email.
>
>
> uri RM_uwd_UnsubscribePHP /unsubscribe\.php/i
> describe RM_uwd_UnsubscribePHP text uri to unsubscribe link
> score RM_uwd_UnsubscribePHP 3.000 # 236s/0h of 92209
> corpus (74874s/17335h) 01/17/04
>
These last four rules are SURPRISING! I would never have guessed those
results! Looks good!
--Chris
-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
