| Main Archive Page > Month Archives > spamassassin-dev archives |
Re: RCVD_IN_XBL score
From: <darxus_at_nospam>Date: Sun Mar 11 2012 - 05:47:10 GMT
To: dev@spamassassin.apache.org
On 03/11, Axb wrote:
>
> Guys,
>
> At the moment, after last sa-update:
>
> score RCVD_IN_XBL 0 0.724 0 0.375 # n=0 n=2
>
> is amazingly low.
>
> last net masscheck shows
> 0 43.3599 0.0133 1.000 0.97 0.00 RCVD_IN_XBL
> (http://ruleqa.spamassassin.org/20120310-r1299162-n/RCVD_IN_XBL/detail)
> (darxus & llanga corpus poisoned?)
One of my two is a notification from livejournal.com that my girlfriend
posted to her lj. The other is a post to a yahoo group for a local goth
club night, to which I have been subscribed for a while.
> as the second best ranking rule, shouldn't this this score be raised
> quite a bit, to at least 1.7?
There are a number of reasons for the score generator to come up with this
result.
> score RCVD_IN_SBL 0 2.596 0 0.141 # n=0 n=2
> with a ranking of 0.85
>
> Cannot imagine what HAM is hitting SBL unless its IPs listed due to
> 419s or llanga & darxus' corpus have snowshow in their ham corpus
>
> (See http://ruleqa.spamassassin.org/20120310-r1299162-n/RCVD_IN_SBL/detail)
I have 29 hams that hit this. In reverse chronological order:
Looks like 18 are livejournal.com. 11 are notifications that there were
updates to the thread
http://www.diyelectriccar.com/forums/showthread.php?t=53001 which I had
subscribed to.
So, all of my hams hitting both of these rules are legit hams, where the
blacklists had false positives. I am very confident that none of them were
just exquisitely faked.
-- "Force, my friends, is violence; the supreme authority from which all other authority is derived." - Michael Ironside, Starship Troopers http://www.ChaosReigns.com