Bug 3861 - Boundary rule with doubled NextPart in string
Summary: Boundary rule with doubled NextPart in string
Status: RESOLVED WONTFIX
Alias: None
Product: Spamassassin
Classification: Unclassified
Component: Rules (show other bugs)
Version: 3.0.0
Hardware: Other other
: P5 normal
Target Milestone: Undefined
Assignee: SpamAssassin Developer Mailing List
URL:
Whiteboard:
Keywords: triage
Depends on:
Blocks:
 
Reported: 2004-10-03 12:05 UTC by Bob Menschel
Modified: 2005-04-28 10:38 UTC (History)
0 users


Attachment Type Modified Status Actions Submitter/CLA Status
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Bob Menschel 2004-10-03 12:05:38 UTC 
Rule hits over 2% of spam here, no ham. 

header   SARE_BOUNDARY_NP2 Content-Type =~ /boundary=".*_NextPart_.*_NextPart_/
describe SARE_BOUNDARY_NP2 Content type boundary used in spam and viruses
score    SARE_BOUNDARY_NP2 4.000
#hist    SARE_BOUNDARY_NP2 Created by Bob Menschel May 31 2004
#counts  SARE_BOUNDARY_NP2 1118s/0h of 68491 corpus (41115s/27376h RM) 09/18/04
Comment 1 Bob Menschel 2005-04-06 21:49:23 UTC 
NEEDSMC
Comment 2 Auto-Mass-Checker 2005-04-28 16:28:19 UTC 
# [automatically generated by automc: start]
# DONEMC 1: completed request from comment 1

  0.000   0.0000   0.0000    0.500   0.46    4.00  T_MC_SARE_BOUNDARY_NP2_b3861_c0

above freqs using data from "/home/automc/corpus/html/DETAILS.new" as of Thu Apr 28 16:28:16 2005:

T_MC_SARE_BOUNDARY_NP2_b3861_c0 = SARE_BOUNDARY_NP2 from bug 3861 comment 0
full freqs: http://bugzilla.spamassassin.org/ruleqa?rule=T_MC_SARE_BOUNDARY_NP2_b3861_c0&date=20050428
# ham results used: ham-bzoetekouw.log ham-cthielen.log ham-parkerm.log ham-quinlan.log ham-rODbegbie.log ham-theo.log
# spam results used: spam-bzoetekouw.log spam-cthielen.log spam-parkerm.log spam-quinlan.log spam-rODbegbie.log spam-theo.log
 456579   350293   106286    0.767   0.00    0.00  (all messages)
100.000  76.7212  23.2788    0.767   0.00    0.00  (all messages as %)
# [automatically generated by automc: end]
Comment 3 Bob Menschel 2005-04-28 18:38:47 UTC 
My most recent personal mass-check gives only one email hit (spam) to
SARE_BOUNDARY_NP2. 

Spammers have moved on.