 tim another area for potentially fruitful study it s clear that the highest value indicators usually appear early in msgs and for spam there s an actual reason for that advertising has to strive to get your attention early so for example if we only bothered to tokenize the first NUMBER of a msg would results get worse neil schemenauer spammers could exploit this including a large mime part at the beginning of the message in pratice that would probably work fine note that URL s current tokenizer only looks at decoded text mime sections or raw message text if no mime exists spammers could put megabytes of other crap before that and it wouldn t even be looked at except that the email package has to parse non text parts well enough to skip over them and tokens for the most interesting parts of content type disposition transfer encoding decorations are generated for all mime sections schemes that remain ignorant of mime are vulnerable to spammers putting arbitrary amounts of nice text in the preamble area after the headers and before the first mime section which most mail readers don t display but which appear first in the file so are latched on to by graham s scoring scheme but i don t worry about clever spammers i ve seen no evidence that they exist NUMBER NUMBER wink even if they do the open source zoo is such that no particular scheme will gain dominance and there s no percentage for spammers in trying to fool just one scheme even if they did for the kind of scheme we re using here they can t know what nice text is not unless they pay a lot of attention to the spam targets and highly tailor their messages to each different one at that point they d be doing targeted marketing and the cost of the game to them would increase enormously if you re out to make a quick buck you don t waste a second on hard targets ly y rs tim 