distill <[EMAIL PROTECTED]> writes:
> I've been receiving these "msnbc.com - BREAKING NEWS" spams recently. I've
> made sure that all of those spams (over 40 of them) are manually trained to
> be spam. SpamAssassin does filter out those messages about 75% of the time.
> However, even after this careful manual training some of those spams are
> still getting through (my score threshold is now 4.4). I get the feeling
> that the training doesn't have any effect. Is there something wrong or is
> SpamAssassin just incapable of learning this? The msnbc spams are almost
> identical to eachother with lots of words, so I would imagine this should be
> an easy task.
On your message I also got:
* 3.0 URIBL_BLACK Contains an URL listed in the URIBL blacklist
* [URIs: planetahd.com]
* 1.9 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
* [URIs: planetahd.com]
but not the received ones of course. You didn't get this, but I see
that on uribl planetahd.com was listed at 0826Z today.
> Also I'd like to ask about the RCVD_IN-tags: Is it possible/probable that if
> there are more than one of those tags present, for example
> "RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SORBS_WEB", that the message in fact could
> still be ham?
I'm not sure what you're asking. If you mean
"If I get a message where both RCVD_IN_BL_SPAMCOP_NET and
RCVD_IN_SORBS_WEB fire, is there any chance the message is still ham?"
I'd say yes. Those blacklists probably have overlapping listing
critieria, and certainly two lists listing something is at least a bit
stronger than one, but not absolute.
I have edited my scores file to increase MIME_HTML_ONLY and if I were
you would increase HTML_TAG_BALANCE_BODY as well (probably 1 point
each), unless you find lots of ham hits on these.
