Is PDS_TONAME_EQ_TOLOCAL_SHORT new?

classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

Is PDS_TONAME_EQ_TOLOCAL_SHORT new?

Mark London
Is PDS_TONAME_EQ_TOLOCAL_SHORT new?  I see it hitting real emails here, but hitting no spam emails.  Thanks.

- Mark

Sent from my iPhone
Reply | Threaded
Open this post in threaded view
|

Re: Is PDS_TONAME_EQ_TOLOCAL_SHORT new?

RW-15
On Wed, 30 Oct 2019 14:09:11 -0400
Mark London wrote:

> Is PDS_TONAME_EQ_TOLOCAL_SHORT new?  I see it hitting real emails
> here, but hitting no spam emails.  Thanks.

It's one of several rules based on __PDS_TONAME_EQ_TOLOCAL, which is
looking for To headers that look like this:

  To: foo <[hidden email]>

A problem with this is that such headers look unprofessional, and so
are likely to be underrepresented in a ham corpus dominated by
corporate mail.
Reply | Threaded
Open this post in threaded view
|

Re: Is PDS_TONAME_EQ_TOLOCAL_SHORT new?

Antony Stone
On Wednesday 30 October 2019 at 20:23:37, RW wrote:

> On Wed, 30 Oct 2019 14:09:11 -0400
>
> Mark London wrote:
> > Is PDS_TONAME_EQ_TOLOCAL_SHORT new?  I see it hitting real emails
> > here, but hitting no spam emails.  Thanks.
>
> It's one of several rules based on __PDS_TONAME_EQ_TOLOCAL, which is
> looking for To headers that look like this:
>
>   To: foo <[hidden email]>
>
> A problem with this is that such headers look unprofessional, and so
> are likely to be underrepresented in a ham corpus dominated by
> corporate mail.

Pardon my ignorance, but what is "unprofessional" about this?

Is it the fact that "foo" is just a single word, rather than "forename
surname", or is it just that "foo" on its own matches the username in
"[hidden email]"?

I have plenty of "professional" contacts (mainly in small businesses) where
they use first names only, and also plenty of examples such as "Helpdesk
<[hidden email]>" and "Accounts <[hidden email]>" which are
perfectly legitimate.


Thanks in advance for any explanation,


Antony.

--
"The problem with television is that the people must sit and keep their eyes
glued on a screen; the average American family hasn't time for it."

 - New York Times, following a demonstration at the 1939 World's Fair.

                                                   Please reply to the list;
                                                         please *don't* CC me.
Reply | Threaded
Open this post in threaded view
|

Re: Is PDS_TONAME_EQ_TOLOCAL_SHORT new?

RW-15
On Wed, 30 Oct 2019 20:45:56 +0100
Antony Stone wrote:

> On Wednesday 30 October 2019 at 20:23:37, RW wrote:
>
> > On Wed, 30 Oct 2019 14:09:11 -0400
> >
> > Mark London wrote:  
> > > Is PDS_TONAME_EQ_TOLOCAL_SHORT new?  I see it hitting real emails
> > > here, but hitting no spam emails.  Thanks.  
> >
> > It's one of several rules based on __PDS_TONAME_EQ_TOLOCAL, which is
> > looking for To headers that look like this:
> >
> >   To: foo <[hidden email]>
> >
> > A problem with this is that such headers look unprofessional, and so
> > are likely to be underrepresented in a ham corpus dominated by
> > corporate mail.  
>
> Pardon my ignorance, but what is "unprofessional" about this?

Call it non-corporate if you prefer.


> I have plenty of "professional" contacts (mainly in small businesses)
> where they use first names only,

People like that are unlikely to have their mail handled by an
organization that contributes to mass checks.


>  and also plenty of examples such as
> "Helpdesk <[hidden email]>" and "Accounts
> <[hidden email]>"

The scored rule requires a short body length, which is most likely to
occur on a person to person email (and one without a lengthy
disclaimer). A helpdesk query could be short, but there are few large
contributors to mass checks, so it's hit and miss whether there's
anything like that. The fact that 51k hits on __PDS_TONAME_EQ_TOLOCAL
translate into only 59 hits on PDS_TONAME_EQ_TOLOCAL_SHORT suggests not.



> which are perfectly legitimate.

It's not about legitimacy.