SpamAssassin Rules Collection

[Matt Kettler]

At 05:05 PM 12/2/2004, Andy Norris wrote:
>Please feel free to email me directly if this is going to possibly flood
>the list.. :^)
>
>But I am getting quite a bit of spam coming through, and I was wondering if
>anyone who has a super setup might share with me their list of rules files
>for SpamAssassin so we might get closer to a spam-free world on our server.

I'm currently using 2.64 with:
         Bayes (including daily training from spamtraps), DCC and razor 2.61
         antidrug.cf (included in 3.0)
         Mail::SpamCopURI (included in 3.0)
         70_sare_random.cf
         70_sare_specific.cf
         evilnumbers.cf
         fvgt.cf (old, limited scope version of tripwire for subject lines)

A blackholes.us list:

         header RCVD_IN_CHINA_KR         eval:check_rbl('countrycnkr',
'cn-kr.blackholes.us.')
         describe RCVD_IN_CHINA_KR       Received from China or Korea
         tflags  RCVD_IN_CHINA_KR        net
         score RCVD_IN_CHINA_KR          2.5

Some EVI specific comp rules (ie: mentioning various phrases specific to
our industry knocks off a half point each)

Some odds-and ends custom little rules I'm still testing such as these:

         body L_LOTTO_COORDINATOR /\b(?:Lottery|Winning|award|prize)
Co\-?ordinator\b/i
         score L_LOTTO_COORDINATOR        2.0

         header LOCAL_LOTTERY_FROM       From =~ /(lottery|lotto)\w{0,10}\@\w/i
         score LOCAL_LOTTERY_FROM        1.0

         body L_INTERNATIONAL_LOTTO      /\bINTERNATIONAL LOTTERY\b/i
         score L_INTERNATIONAL_LOTTO     1.0

         body L_WINNING_NOTICE           /\bWINNING NOTIFICATION\b/
         score L_WINNING_NOTICE          1.0



>Is SpamCop included in SpamAssassin 3.0.1? Is there something special I
>need to do in MailScanner to turn this on?

Well, SpamCop, which is a DNSBL, has been included in SA for a very long
time.. since 2.0 at least. It's been on by default since SA 2.60.

Now the Spamcop-sourced URIBL that Surbl.org set up is included in SA as of
3.0.0. And that's on by default.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!