spamassassin-users October 2010 archive
Main Archive Page > Month Archives  > spamassassin-users archives
spamassassin-users: Need more combination rules

Need more combination rules

From: Marc Perkel <marc_at_nospam>
Date: Sat Oct 02 2010 - 14:40:29 GMT

  Many times rules that don't score high, when combined, are often
nearly 100% accurate. Here's an example.

I am <surname>
Large sum of money

And you could throw in "private email" as an enhancement.

SA could catch a lot more spam with more combined rules.

Spam is a business model. The spam contains a story that has all the
necessary elements to get money from suckers. Consider the following spam:

"I am Mrs Elizabeth Etters, a devoted Christian. I have a
foundation/Estate uncompleted {valued at GBP 2.1 million Pounds } and
need you to help me finish it because of my health, Everything is
available. Please contact me for more details on my private thank you."

Breaking down the message.

I am someone you don't know. (Introduction) I am a Christian. (so trust
me) I have a lot of money. I am desperate. (so you can get my money) I
have a private contact. (So when I get shut down for spamming you can
still contact me.)

First - makes me wonder if we can create a script to generate false
replies to waste these spammers time. That would be a fun project.

But - getting to the point. If we had rules the broke the message down
into broad concepts like "stranger, Christian, with lots of money" and
created combo rules, I think we could get nearly 100% on this kind of spam.