Karsten Bräckelmann wrote: > On Tue, 2009-02-24 at 17:59 +0100, Per Jessen wrote: >> Karsten Bräckelmann wrote: > >> Yeah, I guess I was in a hurry - but actually, they barely hit >> anything, >> only DKIM_SIGNED and DKIM_VERIFIED. I've added my own rule: >> >> uri PJ_GOOGLEGRP_DODGYURI m'www\.google\.com/.*\.\..*/group/'i > >> which catches some, but none of the examples. > > It *does* catch your examples 1, 2, 3 and 6. Moreover with your score > of 4, that makes it identified spam. > > * 4.0 PJ_GOOGLEGRP_DODGYURI URI: PJ_GOOGLEGRP_DODGYURI > * 2.2 TVD_SPACE_RATIO BODY: TVD_SPACE_RATIO >
My bad - I must have corrected that rule in between not catching those spams and reporting it here - you're right, those examples would have scored. As for TVD_SPACE_RATIO, I've had to disable it, it caused me far too many FPs. I've not had time to look into why. /Per Jessen, Zürich
