(note: I modified my razor logging and I did a little check one day... of a chunk of 10702 emails, 1985 had cf of 0 or above (ie: marked as spam by default). Of those 1275 had a cf of 100 (the max). 81 emails were in the single-digit cf range. 59 in the 10's range, 168 in the 20's, 59 in the 30's. I run with a min cf of 11 and haven't seen too many absurd matches since that change. YMMV.).
I'm guessing that someone has a mis-configured spamtrap that they wound up bouncing one of these messages to. There seems to be a lot of misconfigured spamtraps out there...
Razor2 uses ephemeral sigs by default, which only hashes some subset of the body of the email. ie: bytes 50-200, then later it might be 120-900.
This prevents the simple "pad the end with garbage bytes" approach that spammers use to avoid being matched by Razor 1. Since most of this email is a standard form, the likelihood of all majordomo authentication needed messages matching the same ephemeral sig is very high, unless the ephemeral subset of the moment happens to include the very small section of the mail that actually changes.
At 05:06 PM 12/12/2002 -0800, Jonathan Nichols wrote:
Entertaining. The majordomo result from my re-subscription to the Postfix mailing list was flagged - and listed in Razor.How'd it get into Razor?
-------------------------------------------------------
This sf.net email is sponsored by:
With Great Power, Comes Great Responsibility Learn to use your power at OSDN's High Performance Computing Channel
http://hpc.devchannel.org/
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
