{"id":136,"date":"2003-08-05T17:35:54","date_gmt":"2003-08-05T21:35:54","guid":{"rendered":"http:\/\/www.tradermike.net\/movethecrowd\/2003\/08\/my_spam_filter\/"},"modified":"2003-08-05T17:35:54","modified_gmt":"2003-08-05T21:35:54","slug":"my_spam_filter","status":"publish","type":"post","link":"http:\/\/www.michaelseneadza.com\/blog\/2003\/08\/05\/my_spam_filter\/","title":{"rendered":"My Spam Filter"},"content":{"rendered":"

I finally<\/a> turned on SAProxy<\/a>, the spam filter in the Bloomba<\/a> email program. It’s working well so far, although a few legit messages have gotten marked as spam. A very cool feature of the filtering engine (SpamAssassin<\/a>) is that it tells you why it flagged certain messages. As you’ll see, failing one of the filters assigns a certain number of points to the message. Once the point threshold is hit the message is marked as spam. Here are some of the rules\/filters (from the Bayesian filter) that it uses:
\n<\/p>\n

FROM_ENDS_IN_NUMS (0.7 points) From: ends in numbers ** in one case this was actually from a legit address<\/b>
\nSEARCH_ENGINE_PROMO (1.5 points) BODY: Discusses search engine listings ** this was actually from a legit address<\/b>
\nHTML_10_20 (1.4 points) BODY: Message is 10% to 20% HTML
\nFORGED_YAHOO_RCVD (2.3 points) ‘From’ yahoo.com does not match ‘Received’ headers ** this was actually from a legit address<\/b>
\nNO_REAL_NAME (0.8 points) From: does not include a real name
\nHTML_80_90 (0.5 points) BODY: Message is 80% to 90% HTML
\n<\/b>HTML_IMAGE_RATIO_02 (0.5 points) BODY: HTML has a low ratio of text to image area
\nHTML_IMAGE_ONLY_02 (1.9 points) BODY: HTML has images with 0-200 bytes of words
\nVERY_SUSP_RECIPS (2.2 points) Very similar addresses in recipient list **we’ve all seen this done<\/b>
\nADDR_NUMS_AT_BIGSITE (0.6 points) Uses an address with lots of numbers, at a big ISP
\nFROM_WEBMAIL_ENDS_IN_NUMS6 (1.5 points) From address is webmail, and ends in lots of numbers **deadly combo!<\/b>
\nEARN_MONEY (1.0 points) BODY: Message talks about earning money ** always a warning sign<\/b>
\nEXCUSE_19 (0.6 points) BODY: Claims you opted-in or registered **I want to see the whole list of excuses \ud83d\ude42<\/b>
\nOPT_IN (0.5 points) BODY: Talks about opting in (lowercase version)
\nSAVE_BUCKS (0.0 points) BODY: Save $$$ **Nuff said!<\/b>
\nEXCUSE_1 (0.0 points) BODY: Gives a lame excuse<\/b> about why you were sent this spam
\nEXCUSE_3 (0.1 points) BODY: Claims you can be removed from the list<\/b>
\nREMOVE_FROM_LIST (0.0 points) BODY: To be removed from list
\nTARGETED (2.8 points) BODY: Targeted Traffic \/ Email Addresses
\nFOR_FREE (0.6 points) BODY: No such thing as a free lunch(1)<\/b>
\nEMAIL_MARKETING (0.0 points) BODY: Talks about email marketing
\nOPT_IN_CAPS (0.2 points) BODY: Talks about opting in (capitalized version)
\nLINES_OF_YELLING (0.0 points) BODY: A WHOLE LINE OF YELLING DETECTED
\nLINES_OF_YELLING_2 (0.0 points) BODY: 2 WHOLE LINES OF YELLING DETECTED
\nLINES_OF_YELLING_3 (0.0 points) BODY: 3 WHOLE LINES OF YELLING DETECTED<\/b>
\nREMOVE_PAGE (0.3 points) URI: URL of page called “remove”
\nSUBJ_ALL_CAPS (1.1 points) Subject is all capitals<\/b>
\nAS_SEEN_ON (1.9 points) BODY: As seen on national TV!<\/b>
\nONLY_COST (0.0 points) BODY: Only $$$
\nMLM (0.8 points) BODY: Multi Level Marketing mentioned
\nEARN_MONEY (1.0 points) BODY: Message talks about earning money
\nONE_TIME (0.0 points) BODY: One Time Rip Off<\/b>
\nJODY (2.9 points) BODY: Contains “My wife, Jody” testimonial ** Is Jody that popular???<\/b>
\nBANG_MONEY (0.7 points) BODY: Talks about money with an exclamation!<\/b>
\nBULK_EMAIL (1.6 points) BODY: Talks about bulk email **talk about a dead give-away<\/b>
\nORDER_REPORT (2.9 points) BODY: Order a report from someone
\nSENT_IN_COMPLIANCE (4.3 points) BODY: Claims compliance with spam regulations
\nFINANCIAL (4.3 points) BODY: Financial Freedom<\/b>
\nSECTION_301 (1.7 points) BODY: Claims compliance with spam regulations
\nINVALUABLE_MARKETING (2.9 points) BODY: Invaluable <\/b>marketing information
\nDONT_DELETE (0.0 points) BODY: Don’t delete me! Nooooo!!!!<\/b>
\nRISK_FREE (0.9 points) BODY: Risk free.<\/b> Suuurreeee….
\nCOPY_ACCURATELY (2.9 points) BODY: Common pyramid scheme phrase<\/b> (1)
\nINITIAL_INVEST (2.7 points) BODY: Requires Initial Investment<\/b>
\nHTML_FONT_COLOR_RED (0.1 points) BODY: HTML font color is red<\/b>
\nHTML_FONT_BIG (0.3 points) BODY: FONT Size +2 and up or 3 and up<\/b>
\nHTML_SHOUTING5 (0.0 points) BODY: HTML has very strong “shouting” markup<\/b>
\nCASHCASHCASH<\/b> (0.0 points) Contains at least 3 dollar signs in a row\n<\/p><\/blockquote>\n

Somebody should make a filter for all those messages (hoaxes & other nonsense) that people forward to all of their friends. Rule #1 for that filter would be if the messages says ‘forward this to everyone you know’ flag it.<\/p>\n","protected":false},"excerpt":{"rendered":"

I finally turned on SAProxy, the spam filter in the Bloomba email program. It’s working well so far, although a few legit messages have gotten marked as spam. A very cool feature of the filtering engine (SpamAssassin) is that it tells you why it flagged certain messages. As you’ll see, failing one of the filters… Continue reading My Spam Filter<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","footnotes":""},"categories":[7],"tags":[],"jetpack_featured_media_url":"","jetpack-related-posts":[{"id":220,"url":"http:\/\/www.michaelseneadza.com\/blog\/2003\/10\/15\/james_sengs_bayesian_filter_for_fighting_blog_spam\/","url_meta":{"origin":136,"position":0},"title":"James Seng’s Bayesian Filter for Fighting Blog Spam","date":"October 15, 2003","format":false,"excerpt":"Let me first say that James Seng is the man! A few days ago he provided the world with his excellent CAPTCHA-based spam solution for Movable Type blogs. Now he's created another spam blocker which uses a Bayesian filter. This new filter works on TrackBacks too. I like the idea\u2026","rel":"","context":"In "Blogging"","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":414,"url":"http:\/\/www.michaelseneadza.com\/blog\/2004\/11\/14\/comment_spammers_are_wilding_out\/","url_meta":{"origin":136,"position":1},"title":"Comment Spammers are Wilding Out","date":"November 14, 2004","format":false,"excerpt":"I just took a look at my MT-Blacklist statistics and was shocked by what I saw. A couple of weeks ago I noticed an increase in the amount of comment spam that was slipping by the blacklist. So I decided to add some items of my own to the filter.\u2026","rel":"","context":"In "Blogging"","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":238,"url":"http:\/\/www.michaelseneadza.com\/blog\/2003\/11\/02\/loving_my_spam_filter\/","url_meta":{"origin":136,"position":2},"title":"Loving My Spam Filter","date":"November 2, 2003","format":false,"excerpt":"I'm really liking the way that MT-Bayesian is working out. Not only is it catching spam, but it's also filtering out the ignorant comments that we all get every so often. You know the type -- those comments in which every other word is a curse word, and the rest\u2026","rel":"","context":"In "Blogging"","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":446,"url":"http:\/\/www.michaelseneadza.com\/blog\/2005\/01\/31\/interview_with_a_link_comment_spammer\/","url_meta":{"origin":136,"position":3},"title":"Interview with a Link \/ Comment Spammer","date":"January 31, 2005","format":false,"excerpt":"The Register interviewed a link spammer who revealed some of his methods and motivation. The bottom line -- spammers can make up to seven figure incomes from some simple computer code. Some key points: For even a semi-competent programmer, writing programs that will link-spam vulnerable websites and blogs is pretty\u2026","rel":"","context":"In "Blogging"","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":237,"url":"http:\/\/www.michaelseneadza.com\/blog\/2003\/11\/01\/yahoo_mail_spam_explosion\/","url_meta":{"origin":136,"position":4},"title":"Yahoo! Mail Spam Explosion","date":"November 1, 2003","format":false,"excerpt":"Is it just me or is everybody else getting bombarded with spam on their Yahoo! Mail accounts? It seems like ever since they announced their 'new spam measures' the spam has at least doubled. I'm now getting about 200 spams a day. Every time I go into my account I\u2026","rel":"","context":"In "Internet"","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":316,"url":"http:\/\/www.michaelseneadza.com\/blog\/2004\/04\/25\/yahoo_swings_back_at_googles_gmail\/","url_meta":{"origin":136,"position":5},"title":"Yahoo! Swings Back at Google’s GMail","date":"April 25, 2004","format":false,"excerpt":"Yahoo has changed their e-mail policies so that spam now longer counts as part of a user's allotted storage space...","rel":"","context":"In "Internet"","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"_links":{"self":[{"href":"http:\/\/www.michaelseneadza.com\/blog\/wp-json\/wp\/v2\/posts\/136"}],"collection":[{"href":"http:\/\/www.michaelseneadza.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.michaelseneadza.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.michaelseneadza.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.michaelseneadza.com\/blog\/wp-json\/wp\/v2\/comments?post=136"}],"version-history":[{"count":0,"href":"http:\/\/www.michaelseneadza.com\/blog\/wp-json\/wp\/v2\/posts\/136\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.michaelseneadza.com\/blog\/wp-json\/wp\/v2\/media?parent=136"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.michaelseneadza.com\/blog\/wp-json\/wp\/v2\/categories?post=136"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.michaelseneadza.com\/blog\/wp-json\/wp\/v2\/tags?post=136"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}