{"id":383,"date":"2008-06-22T13:55:40","date_gmt":"2008-06-22T11:55:40","guid":{"rendered":"http:\/\/daniel.haxx.se\/blog\/?p=383"},"modified":"2008-06-22T13:56:06","modified_gmt":"2008-06-22T11:56:06","slug":"my-best-spam-rules-right-now","status":"publish","type":"post","link":"https:\/\/daniel.haxx.se\/blog\/2008\/06\/22\/my-best-spam-rules-right-now\/","title":{"rendered":"My best spam rules right now"},"content":{"rendered":"

I’ve already before mentioned my antispam setup<\/a>, but today I just ran a little check on my “hispam” mailbox (the spams with so high spam points that I never even bother to check them for false positives), 43MB of 7900+ spams (received during ~40 hours), to see which ones of my own handicrafted rules that get triggered the most. I use a set of 40+ custom spamassassin<\/a> rules to help it trigger more mails as spam, since some of the very short mails seem to be hard to catch otherwise, and some of the mails are in many ways looking like mail I would normally get.<\/p>\n

Anyway, my top-10 rules are:<\/p>\n

    \n
  1. 1624 6.0 DS_BODY_DRUGBRAND\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 BODY: mentions drug brand<\/li>\n
  2. 1428 6.0 DS_SUBJECT_DRUGBRAND\u00c2\u00a0\u00c2\u00a0 Subject mentions drug brand<\/li>\n
  3. 828 6.0 DS_FROM_HAXX\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 spoofed haxx.se address<\/li>\n
  4. 769 4.0 DS_BODY_DISCOUNT\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0 BODY: mentions percent discount<\/li>\n
  5. 745 4.0 DS_SUBJECT_DISCOUNT\u00c2\u00a0\u00c2\u00a0 subject mentions percent discount<\/li>\n
  6. 415 2.1 DS_TO_OWNER\u00c2\u00a0\u00c2\u00a0 To contains -owner<\/li>\n
  7. 200 6.0 DS_BODY_NODOCTOR\u00c2\u00a0 BODY: mentions “no doctor”<\/li>\n
  8. 195 2.0 DS_MAILER_THEBAT\u00c2\u00a0 sent with the bat<\/li>\n
  9. 189 6.0 DS_BODY_DESIGNBRANDS\u00c2\u00a0 BODY: mentions designer brand(s)<\/li>\n
  10. 158 3.0 DS_BODY_REPLICAS\u00c2\u00a0 BODY: speaks of replicas<\/li>\n<\/ol>\n

    The first number is number of hits. The second is the “spam points” I assign a match. Then there’s the name of the rule and my description for it. The “spam points” can best be seen relative to the other rules, as what makes a single mail a spam in the end involves multiple factors that aren’t shown here.<\/p>\n","protected":false},"excerpt":{"rendered":"

    I’ve already before mentioned my antispam setup, but today I just ran a little check on my “hispam” mailbox (the spams with so high spam points that I never even bother to check them for false positives), 43MB of 7900+ spams (received during ~40 hours), to see which ones of my own handicrafted rules that … Continue reading My best spam rules right now<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16,6],"tags":[38,39],"class_list":["post-383","post","type-post","status-publish","format-standard","hentry","category-mail","category-floss","tag-spam","tag-spamassassin"],"_links":{"self":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts\/383","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/comments?post=383"}],"version-history":[{"count":0,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts\/383\/revisions"}],"wp:attachment":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/media?parent=383"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/categories?post=383"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/tags?post=383"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}