Hello Kelson,
Tuesday, April 19, 2005, 11:13:57 AM, you wrote:
K> Spotted this one in a message that only scored about 2.5. It was
K> image-only spam with word salad below, and the link was...unorthodox, to
K> say the least: ...
The rule I've tested which seems to hit the most spam is
rawbody SARE_HTML_MLINE_HTTP m'(?!https?:
?//)h[^a-z:>]{0,4}t[^a-z>]{0,4}t[^a-z>]{0,4}p[^s:>]{0,4}:[^/>]{0,4}/[^/]{0,4}/'is
describe SARE_HTML_MLINE_HTTP MULTI-line http
score SARE_HTML_MLINE_HTTP 0.500
#hist SARE_HTML_MLINE_HTTP Bob Menschel, Apr 11 2005
#counts SARE_HTML_MLINE_HTTP 30s/26h of 300658 corpus (126413s/174245h
RM) 04/17/05
but as you can see from that counts line, it hits a lot of ham as
well. I'm working on improving its performance.
Bob Menschel
