# # "SPAMtag" filter rules... # # Uses procmail weighted scoring and marks suspected articles (originating # from outside Cisco) with a '[SPAM]' tag in the subject heading, as well # as a header 'X-SPAM' # # Default location for "formail" # :0 * FORMAIL ?? ^^^^ { FORMAIL=/usr/bin/formail } # REQUIRED; be able to handle the long rule below (else procmail dumps core) # LINEBUF=32776 # PATTERN MATCHING # # Procmail weighted "scoring technique" used to analyze body text of # email to spot spam which cannot be spotted by analyzing the headers # of the spam -- spam sent from throwaway accounts or "whackamole" # spam. # # The first recipe sets the email's default score at negative 1000 -- # only if the cumulative "score" of header and body string "hits", or # recipes which result in a match, equals or exceeds 1000 will the # email be tagged as probable spam. # # The numbers between the "*" at the beginning of each condition and # the start of the actual condition represent the score given to a # match for that condition. The first number represents the score # for the first match. The second number, after the caret "^", represents # the exponent used to calculate the score for a second and subsequent # matches. # # For example, a scoring formula of 100^1 means that the first match is # given a score of 100, and subsequent matches are modified by an exponent, # or "power", of one. Since any number to the first power equals itself, # this means that each match for this recipe will be given a score of 100. # Ten such matches will result in a score of 1000, which (unless other # recipes reduced this score) would cause the Spam Bouncer to classify this # particular piece of email as probable spam and divert it to the BLOCKFOLDER. # # A scoring formula of 300^.5 means that the first match is given a score # of 300; the second of 300^.5, which is 150; the third a score of 300^(.5*2), # which is 75, and so on. The cumulative score would be 300+150+75.... # A recipe of this type weighs first mention of the suspect word or phrase # more heavily than subsequent mentions, and thus avoids classifying email # as spam based solely on the presence of a single suspect word or phrase # since the cumulative score for any number of matches can never exceed a # certain maximum number. # # A scoring formula of 50^2, on the other hand, weighs the first occurrence # of a suspect word or phrase relatively lightly, but subsequent mentions # ever more heavily. This is useful for catching spam based on common spam # keywords which may appear once or twice in non-spam email, but frequently # appear many times in the text of a spam email. # # A scoring formula of 300^0 weighs the first occurrence of a suspect # word or phrase at 300, and ignores subsequent matches. This is useful # for tests for a typical spam phrase in the Subject: header, where the # phrase will not appear twice -- it speeds up processing. # # For more information on how Procmail Scoring works, consult the Procmail # scoring manual on your system by typing "man procmailsc". # :0 BHhf #* ^X-SMAP-Received-From: outside #* !^Subject: Cisco Headlines, * !^From:.*Open Class Daemon * !^From:.*Shuman * !^From:.*Carlberg * !^From:.*@vtext\.com * !^From:.*Foster * !^From:.*Hanson * !^From:.*bidconfirm@ebay.com * !^From:.*outbidnotice@ebay.com * !^From: aw-confirm@ebay.com * !^From:.*@internic\.net * !^From:.*discoverinteractive@discoverfinancial.com * !^TO.*@internic\.net #* !^- ?--.*(f|F)orwarded message #* !^forwarded message: #* !^-----BEGIN PGP SIGNED MESSAGE----- * -1000^0 * 500^0 ^TO.*(friend|hello|winner|professional|hardcore|([0-9][0-9]*\.?@)) * 600^0 ^Message-ID: <> * 1000^0 ^Subject: The Greatest Dental Plan \$2-\$3/week... * 1000^0 ^Subject:.*Findout About Anyone Fast * 500^0 ^From:.*@UNKOWN\.EXTERNAL\.SENDER * 500^0 ^From:.*@yahoo.com * 500^0 ^From:.*@hotmail.com * 500^0 ^From:.*tshirtnews * 1000^0 ^To:.*undisclosed-recipients * -50^1.5 case * -200^1 (close|open)-par * -200^1 def(const|group|un|var) * -50^1.5 define * -100^1 java * -100^1 loadable * -100^1 module * -200^1 regexp * -200^1 science fiction * -200^1 sci-fi * -100^1.5 spam * -50^1.5 syntax * -50^1.5 variable * 300^0 ^Received:.*[^0-9a-z](ix\.netcom\.(ca|com|uk)[^\.]|\ prodigy\.(com|net)[^\.]|\ sprynet\.(com|net)[^\.]) * 200^1 ^Subject: .*\$ * 200^1 ^Subject: .*! * 300^0 ^Subject: .*[:;%\|][-=]?[>\)D] * 300^0 ^Subject: .*hello * 200^1 ^<|