Importance of IP addresses in lexer

[Boris 'pi' Piwinger]

Tom Anderson <tanderso at oac-design.com> wrote:

>>            | size kb | fp |  fn
>> TTE        |  1916   |  2 |  83
>> TTE (noip) |  1844   |  2 |  71
>> TTE (subn) |  1892   |  2 |  76
>> full       | 13616   |  2 | 184
>> full (noip)| 12652   |  2 | 182
>> full (subn)| 14236   |  3 | 185
>
>I wonder if perhaps this effect is caused by spammers using fake IPs in
>fake received lines.  

I really cannot answer this. But for most of the received
lines that won't be the case. And this does not help enough
in my test.

>They could insert a well-known hammy proxy such as
>from one of the major ISPs.  

That might not qualify as hammy.

>I'm currently working on a program which will strip out fake received
>lines and also fake helo fields (among other things) before bogofilter
>gets it.  It may be that IPs are beneficial, but only if you use real
>ones. 

Could be, but that becomes to expensive
(computational-wise).

pi