On 07/13/2011 01:23 PM, Martin Gregorie wrote:
> On Wed, 2011-07-13 at 09:44 +0200, Geert Mak wrote:
>> recently we had two specific types of spam getting very low score
>> (about 3) and going through -
>>
>> a) one was about Armbanduhren (wrist watches in German) or
>> Edelarmbanduhren (luxury wrist watches) - all in that direction.
>>
>> b) the other was about all kind of Job offers
>>
>> as i could not figure out how to increase their score in spamassassin
>> and as they had repeatable keywords which are usually not in our
>> correspondence, i currently process them on postfix level with a small
>> header_checks and body_checks regex.
>>
>> does somebody know a way to improve spamassassin so that the score for
>> these specific types of spam (which are quite massive the last months
>> in Austria)?
>>
> I'd write a private rule for each type of spam, along the lines of:
>
> describe PRIVATE_RULE German language wrist watch spam
> body __PR1 /(Armbanduhren|Edelarmbanduhren)/i
> uri __PR2 /www\..*\.de/
> meta PRIVATE_RULE (__PR1 && __PR2)
> score PRIVATE_RULE 5.5
>
> The basic principle is that the first 'body' subrule(s) match words that
> mark this sort of spam and the second 'uri' subrule detects URLs for the
> shop being advertised. It might be very specific, or even less specific
> that my example, e.g. /^www/
>
> There's a hidden assumption with this type of rule that the
> *combination* of the words and matching URIs is always spam but things
> that match the subrules can legitimately appear in ham provided they
> don't both appear.
>
> Each rule of this type needs to be carefully tested and tuned to suit
> your particular mail stream.
>
>
> Martin
Hi,
I put this in to deter the wealth of job advertisments we get:
describe PRIVATE_RULE1 English language job opportunity
body __PR1 /(Employment opportunity|Job offer match, respond
to apply|Employment you've been searching|Job opportunity|Career
opportunity inside|Position opening in your area|Work offer
inside|Vacancy - apply online|Job ad - see details! Sent through Search
engine|Get a New Job Today|Working Part Time)/i
uri __PR2
/^(au-joblists.com|europ-joblist.com|gb-totaljob.com|uk-joblists.com|us-joblists.com)/i
meta PRIVATE_RULE1 (__PR1 && __PR2)
score PRIVATE_RULE1 5.5
The URLs are typically email addresses e.g f...@europ-joblist.com. Would
this rule work. spamassassin --lint did not complain.
S
