I was just thinking that most (95%) of our legitimate email comes in during office hours (8am - 7pm GMT) and a lot of spam comes in overnight (probably when the spammers in the rest of the world wake up and start doing business). So I was wondering if there was any way SpamAssassin could evaluate the time an email was received and give it a score accordingly? Not that it's too important. SA gets 99% of our spam as it is; there's just the odd one that slips through every so often.
It *could* yes.. however, this would require writing a plugin, and not just a rule.
I've seen this exact same suggestion made many times on the list. MANY times.
Let's face it, it might be handy for you, but for those of us who subscribe to global mailing lists, like this one, it's more-or-less useless. What's off-hours for me in the eastern US are on-hours for Justin in Ireland. Dan Q seems to be out on the west coast of the US.
As far as I can tell, time-based filtering is really geographic filtering. At that point, you might as well better off using blackholes.us.
Looking at my MRTG graphs, spam-rate is pretty much a constant here. The "spam caught" graph increases at a nearly perfectly linear rate, resetting at midnight and creates a nice, very triangular, very regular sawtooth pattern in the weekly graph. Thus, at least here at my site, there's no rate of change for spam.
Ham rate on the other hand does seem to increase during "extended business hours" of my local timezone. But not dramaticaly. It seems to go up about 50% between 8am and 7pm EST. However, I'd venture to guess the ham rate increase is almost entirely due to geography.
