Importance of IP addresses in lexer

[Tom Anderson]

On Fri, 2004-03-19 at 13:20, Boris 'pi' Piwinger wrote:
>            | size kb | fp |  fn
> TTE        |  1916   |  2 |  83
> TTE (noip) |  1844   |  2 |  71
> TTE (subn) |  1892   |  2 |  76
> full       | 13616   |  2 | 184
> full (noip)| 12652   |  2 | 182
> full (subn)| 14236   |  3 | 185

I wonder if perhaps this effect is caused by spammers using fake IPs in
fake received lines.  They could insert a well-known hammy proxy such as
from one of the major ISPs.  This could dominate an otherwise mostly
neutral email and give a false negative.

I'm currently working on a program which will strip out fake received
lines and also fake helo fields (among other things) before bogofilter
gets it.  It may be that IPs are beneficial, but only if you use real
ones. 

Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://www.bogofilter.org/pipermail/bogofilter/attachments/20040320/7a93716c/attachment.sig>