* Jonathan Nichols wrote (15/02/07 05:19):
Maciej Friedel wrote:
On 02/14/07 Jonathan wrote:
http://www.pbp.net/~jnichols/spam2.txt
0.0 BOTNET_NORDNS IP address has no PTR record
0.1 HTML_50_60 BODY: Message is 50% to 60% HTML
0.0 HTML_MESSAGE BODY: HTML included in message
1.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
[score: 0.5002]
5.0 BOTNET The submitting mail server looks like part of a Botnet
i think botnet is a good idea
maciek
I thought botnet was unstable.. is it working ok now?
It's not (in my experience) unstable. It's excellent. But the default
score of 5 is way too high. It gets a lot of false positives, especially
(again, in my experience) from small mail-order operations who don't
understand dns (Exchange users, I rather uncharitably assume). I score
botnet at 2 and I'm very happy with it.
I reckon better network tests are the future of spam filtering, now that
spammers are sending blocks of text from Harry Potter books along with
undetectable URLs containing spaces etc.
Chris
