[Copfilter] Copy of quarantined email - *** SPAM *** [8.9/8.0] Bayes spam and ham out of proportion

2010-04-29 Thread babedh-d...@biggdog.biz
I've been running spamassassin for years. I am using auto-learn with very conservative thresholds. However, after several years of usage my spam database is about three time larger than my ham database and I am starting to see false positives. Is there a way how to "shrink" the spam database? T

[Copfilter] Copy of quarantined email - *** SPAM *** [8.9/7.0] Re: Filtering zip spam

2010-04-29 Thread babedh-d...@biggdog.biz
Hi, > Alex, does Bayes understand/check INSIDE zips, at least for file > properties?  If not, then it is inherently limited (just in this I'm not sure if you're asking me rhetorically here. I really don't know. Is it enough that bayes finds the encoded string as the attachment, and matches that a

[Copfilter] Copy of quarantined email - *** SPAM *** [8.9/7.0] Re: How many Froms?

2010-04-28 Thread babedh-d...@biggdog.biz
On Wed, 28 Apr 2010, Frank Heydlauf wrote: > Hi, > > On Wed, Apr 28, 2010 at 08:05:27PM +0100, Martin Gregorie wrote: [snip..] > >> Or could I just use a rule like: > >> > >> header From =~ /\...@.*\@/ > > This regex matches i.e. > > From: u...@example.com > > which is a common "auto expansion" o

[Copfilter] Copy of quarantined email - *** SPAM *** [8.9/7.0] ING Direct mail FPing on TVD_ rules

2010-04-28 Thread babedh-d...@biggdog.biz
I just received a mistagged-ham report from a customer showing two stock rules hit on a legitimate email from ING Direct - total score was 6.4, even with -3.5 from BAYES_00. I've asked if I can pass the message on for analysis. Stock scores: score TVD_PH_SUBJ_ACCOUNTS_POST 2.602 2.607 2.497 3.