On 2006-11-03 14:43, James Wilkinson wrote: > Tim wrote: >> Another mitigating factor is the domain name that you post from. >> Certain top-level-domains get red flagged as being more likely to be >> spam, simply by the name, regardless of content. e.g. Spamassassin, >> IGNORANTLY, does that with .biz and .info TLDs. I say that with such >> venom because in the years that I've been on the internet, and in the >> thousands of spam that I've received, I've noticed about seven spams >> that came with .biz TLDs in them. > > Hmm. > > Having a maildir folder with over 11000 spams in it, I can test this > fairly easily. > $ ls | xargs egrep -l 'http://[A-Z@xxxxxxxx]*\.biz[^[email protected]]' | wc -l > 252 > $ ls | xargs egrep -l 'http://[A-Z@xxxxxxxx]*\.info[^[email protected]]' | wc -l > 761 > In other words, a bit over 2% of my spam includes a (relatively > well-formed) .biz URL, and well over 6% of it includes an .info URL. > > That, of course, is on the set of spam the spammers were kind enough to > send me. > > I understand that the reason SpamAssassin *does* flag up those e-mails > with a .biz or .info TLD is simply that across their set of spam and > non-spam, it does turn into a useful indicator. > > James. > I don't quite understand what the http:// bit does in your command. That checks for URLs embedded in the mail but Tim was talking about TLDs where the mail originated. Of my 37414 collected spams, 5018 or about 13.4% (supposedly) came from a .biz domain and 164 (0.4%) from a .info domain. Of the 22249 hams, the numbers were 4 and 10 (0.02% and 0.04%) respectively. This is looking at the From headers. -- Sjoerd Mullender
Attachment:
signature.asc
Description: OpenPGP digital signature
