Wolfgang Zeikat wrote:
On 06/01/05 20:50, Craig Jackson wrote:
Hi,
I created these tests which I find very accurate for detecting spam
and so thought I'd let the list have a view. Lots of numbers or
consonants in the reply-to usually bodes ill.
Good point about the reply-to, thanks!
header REPLY_TO_NUMS_CJ Reply-To =~ /[0-9]{6,}/
score REPLY_TO_NUMS_CJ 5.000
header RET_PATH_NUMS_CJ Return-path =~ /[0-9]{6,}/
score RET_PATH_NUMS_CJ 5.000
header REPLY_TO_CONSON_CJ Reply-To =~ /[bcdfghjklmnpqrstvwxyz]{5,}.*@/i
score RET_PATH_CONSON_CJ 5.000
header RET_PATH_CONSON_CJ Return-path =~
/[bcdfghjklmnpqrstvwxyz]{5,}.*@/i
score RET_PATH_CONSON_CJ 5.000
I'd suggest to remove the y there. Shouldn' that be Return-Path instead
Yes, you might be right. Many names end in consonants-y followed by
consonants in the last name: e.g. [EMAIL PROTECTED]
Also, it might be good to throw in a ~ and a * which are usually part of
spam.
