ietf
[Top] [All Lists]

Re: Dan Bernstein and FREE PORN!!!

2003-01-11 08:55:13
The get a report 
like this telling them what to avoid:
X-Spam-Report:         20 hits, 12 required;
  *  1.0 -- Subject: contains a question mark
  *  1.5 -- BODY: Asks you to click below
  *  2.0 -- URI: Includes a link to send a mail with a subject
  *  2.0 -- BODY: Includes a URL link to send an email
  *  3.5 -- Forged yahoo.com 'Received:' header found
  *  0.9 -- From and To the same address
  *  1.1 -- BODY: No experience needed!
  *  1.6 -- BODY: Contains "Casino"
  *  5.0 -- Message text disguised using base-64 encoding
  *  2.0 -- Received via a relay in ipwhois.rfc-ignorant.org
          [RBL check: found 11.194.228.204.ipwhois.rfc-ignorant.org., type:
127.0.0.6]

Or you could get a report like this, telling me that you *failed* to
disguise your message as spam:

X-Hammie-Disposition: No; 0.03
X-Hammie-Debug: '*H*': 0.98; '*S*': 0.04; '2.0': 0.02; 'bunch': 0.02;
  'subject:': 0.02; 'asks': 0.03; 'wrote': 0.04; '1.5': 0.04; 'rejected': 0.05;
  "i'd": 0.06; 'mentioned': 0.06; '1.1': 0.07; 'ray': 0.07; 'encoding': 0.07;
  'expected': 0.07; '(to': 0.07; 'points': 0.09; 'header': 0.09; 'mark': 0.09;
  'looks': 0.09; 'disguised': 0.09; 'rejected.': 0.09; 'skip:~20': 0.09;
  'group.': 0.10; "shouldn't": 0.10; "i'm": 0.13; 'skip:x 10': 0.13;
  'body:': 0.16; 'skip:1 40': 0.16; 'relay': 0.16; 'keith': 0.16;
  'forged': 0.16; '3.5': 0.16; "doesn't": 0.16; 'type:': 0.17;
  'problem.': 0.18; 'contribute': 0.19; '5.0': 0.19; 'filter': 0.20;
  'reasonable': 0.20; 'address.': 0.81; 'exactly': 0.81; 'addresses': 0.82;
  'link': 0.83; 'posters': 0.84; 'bogus': 0.84; 'subject:PORN': 0.84;
  'trap': 0.84; 'offer': 0.86; 'lay': 0.87; 'below': 0.89; 'click': 0.90;
  'notified': 0.91; 'method': 0.91; 'email name:support': 0.95;
  'videos,': 0.96; 'needed!': 0.97; 'subject:FREE': 0.99

Note that while there were several spam clues in that message (including
both "FREE" and "PORN" in the subject and "support" in the email
address), there weren't *enough* spam clues to offset the legitimate
message clues in the same text.

(Thanks to the guys at the spambayes project for an excellent filter :-)

-- 
Harald Koch     <chk(_at_)pobox(_dot_)com>



<Prev in Thread] Current Thread [Next in Thread>