On 06/01/05 20:50, Craig Jackson wrote:
Hi,
I created these tests which I find very accurate for detecting spam and
so thought I'd let the list have a view. Lots of numbers or consonants
in the reply-to usually bodes ill.
Good point about the reply-to, thanks!
header REPLY_TO_NUMS_CJ Reply-To =~ /[0-9]{6,}/
score REPLY_TO_NUMS_CJ 5.000
header RET_PATH_NUMS_CJ Return-path =~ /[0-9]{6,}/
score RET_PATH_NUMS_CJ 5.000
header REPLY_TO_CONSON_CJ Reply-To =~ /[bcdfghjklmnpqrstvwxyz]{5,}.*@/i
score RET_PATH_CONSON_CJ 5.000
header RET_PATH_CONSON_CJ Return-path =~ /[bcdfghjklmnpqrstvwxyz]{5,}.*@/i
score RET_PATH_CONSON_CJ 5.000
I'd suggest to remove the y there. Shouldn' that be Return-Path instead
of Return-path ?
Speaking of Return-Paths, have you checked your rules against mailing
list software (ezmlm?!) envelope sender adresses? IIRC, they slightly
resemble what you are trying to match ...
Regards,
wolfgang
