spamassassin-users June 2010 archive
Main Archive Page > Month Archives  > spamassassin-users archives
spamassassin-users: Re: unable to find logic behind spamassassin

Re: unable to find logic behind spamassassin rule

From: Bowie Bailey <Bowie_Bailey_at_nospam>
Date: Mon Jun 21 2010 - 19:39:04 GMT
To: users@spamassassin.apache.org

Michael Scheidell wrote:
> On 6/21/10 3:25 PM, Sharma, Ashish wrote:
>> Hi,
>>
>> I have the latest version of spamassassin, I am unable to find the
>> logic behind the following rule and it's high spam score.
>>
>> MANY_SPAN_IN_TEXT 3.099
>>
>>
>> Can anybody give a reason?
>>
>>
> grep MANY_SPAN_IN_TEXT *
> 72_active.cf:##{ MANY_SPAN_IN_TEXT
> 72_active.cf:meta MANY_SPAN_IN_TEXT (__SPAN_BEG_TEXT > 4)
> && (__SPAN_END_TEXT > 4)
> 72_active.cf:describe MANY_SPAN_IN_TEXT Many <SPAN> tags
> embedded within text
> 72_active.cf:##} MANY_SPAN_IN_TEXT
> 72_scores.cf:score MANY_SPAN_IN_TEXT 1.862 2.398
> 1.862 2.398

72_active.cf:rawbody __SPAN_BEG_TEXT /[a-z]{2}<(?i:span)\s/
72_active.cf:tflags __SPAN_BEG_TEXT multiple
72_active.cf:rawbody __SPAN_END_TEXT /[^;>]<\/(?i:span)>[a-z]{3}/
72_active.cf:tflags __SPAN_END_TEXT multiple

In other words, the message has more than 4 <span> tags and more than 4
</span> tags. The scores are generated automatically based on the fact
that this pattern matches much more often on spam messages than on ham
messages. If it is causing problems for you, you can override the score
in your local.cf file like this:

score MANY_SPAN_IN_TEXT 1.0

Use whatever score you want. A score of 0 will disable the rule.

-- Bowie