spamassassin-users October 2010 archive
Main Archive Page > Month Archives  > spamassassin-users archives
spamassassin-users: Re: Spam US$350,000 not tripped

Re: Spam US$350,000 not tripped

From: Ned Slider <ned_at_nospam>
Date: Wed Oct 20 2010 - 05:26:12 GMT
To: users@spamassassin.apache.org

On 19/10/10 22:56, Karsten Bräckelmann wrote:
> On Tue, 2010-10-19 at 22:41 +0100, Ned Slider wrote:
>> On 19/10/10 22:34, Dennis German wrote:
>>> I am surprised this plain text spam did not trip for US$350,000
>>> sa 3.2.4
>
> Uhm, a generic amount of money on it's own is not a sign of spam. You
> know, some people do deal with and talk about money...
>
>> It hits a stack of rules here (some are my own scoring) - looks like
>> it's time to upgrade to SA 3.3.1.
>
>> * 6.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
>> * [score: 0.9999]
>> * 25 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
>> * [148.208.170.3 listed in bb.barracudacentral.org]
>
> Seriously? Or is that a score typo in your cf files?
>

I did say above "some are my own scoring". I've been evaluating BRBL to
see if it's a candidate to use at the smtp level and need to identify
possible false positives. Giving it a ridiculously high score ensures
any hits end up in quarantine where I can examine. No FPs of note yet.
I've also tweaked the Basian scoring for my own preferences. I still see
a fair amount of spam caught by Bayes alone and manually train Bayes
with confirmed ham/spam only. I have high confidence in my Bayesian
setup and whitelisting invariably catches any potential FP hits.

In general, I wouldn't recommend users tweak the default scoring too much.