Sent: Friday, December 06, 2002 7:48 AM
Subject: RE: [SAtalk] 2.50CVS false positives
4. For possible use in meta rules, their messages always match
CTYPE_JUST_HTML and WEB_BUGS, usually SUPERLONG_LINE and JAVASCRIPT, and not
much else.
I ran one of these through 2.50CVS and it does a bit bette
> This looks like the bunch mgm was talking about. I have *no* spam from
> these guys, unfortunately.
I keep being surprised by the difference between different people's spam.
They account for nearly 10% of my spam...
> - catching the wierd "letters-numbers-letters-numbers.com" format they
>
This looks like the bunch mgm was talking about. I have *no* spam from
these guys, unfortunately.
I would suggest some rules like this:
- catching the wierd "letters-numbers-letters-numbers.com" format they
use for their domains
- the use of , a non-std HTML tag.
- this message-id f
> This example is a prime example, and really pretty amazing in the score:
That's another one of the DailyPromotions spams we've been talking about.
You may want to try the custom rules I posted a few minutes ago. Here are my
results on your message with 2.43 and the custom rules:
SPAM: Star
At 21:46 12/05/2002 -0500, Theo Van Dinter wrote:
On Thu, Dec 05, 2002 at 05:51:46PM -0800, Tomki wrote:
> That's the list of hits that you got when you tested that email?
Yep.
> I don't see the score you got.
Well, I see you're using 2.50 ... Did you install 2.50 or are you just
testing again
On Thu, Dec 05, 2002 at 05:51:46PM -0800, Tomki wrote:
> That's the list of hits that you got when you tested that email?
Yep.
> I don't see the score you got.
Well, I see you're using 2.50 ... Did you install 2.50 or are you just
testing against 2.50? If you installed it; 1) I wouldn't do tha
That's the list of hits that you got when you tested that email?
I don't see the score you got.
is this with personalized tweaking of the rules?
The problem I have with doing that is that I'm setting up spamassassin for
individual users who do not have shell access to modify their
settings... so
On Thu, Dec 05, 2002 at 04:16:08PM -0800, Tomki wrote:
> It's getting pretty bad... still a lot better than with anything else in
> my experience, granted, but the number of false negatives really is rising.
>
> This example is a prime example, and really pretty amazing in the score:
Y 5 1:<1p
It's getting pretty bad... still a lot better than with anything else in
my experience, granted, but the number of false negatives really is rising.
This example is a prime example, and really pretty amazing in the score:
Received: from spoon.alink.net (spoon.sv-server1.alink.net [207.135.64.
