This looks worrying. I have it at 2.2 pts, and not caused any false positives, but still, odd. Or is it? I know it is a SPAM indicator but a bulk indicator.
But it is triggered for example by some mailing list posts which are genuine and not bulk. Is someone trying to poison DCC? sa-stats: Email: 967 Autolearn: 683 AvgScore: 12.63 AvgScanTime: 11.85 sec Spam: 501 Autolearn: 408 AvgScore: 32.08 AvgScanTime: 9.91 sec Ham: 466 Autolearn: 275 AvgScore: -8.27 AvgScanTime: 13.95 sec Time Spent Running SA: 3.18 hours Time Spent Processing Spam: 1.38 hours Time Spent Processing Ham: 1.81 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 BAYES_99 494 51.09 98.60 0.00 2 DCC_CHECK 482 60.19 96.21 21.46 3 RAZOR2_CHECK 482 49.95 96.21 0.21 4 RAZOR2_CF_RANGE_51_100 480 49.64 95.81 0.00 5 DIGEST_MULTIPLE 472 48.91 94.21 0.21 6 RCVD_IN_BRBL_RELAY 466 50.16 93.01 4.08 7 BOTNET 463 47.88 92.42 0.00 8 URIBL_BLACK 450 46.85 89.82 0.64 9 URIBL_SBL 448 46.33 89.42 0.00 10 RAZOR2_CF_RANGE_E8_51_100 448 46.33 89.42 0.00 11 HTML_MESSAGE 443 52.12 88.42 13.09 12 URIBL_JP_SURBL 378 39.09 75.45 0.00 13 URIBL_WS_SURBL 324 33.51 64.67 0.00 14 URIBL_AB_SURBL 305 31.54 60.88 0.00 15 RCVD_IN_BL_SPAMCOP_NET 297 31.02 59.28 0.64 16 RDNS_NONE 286 29.58 57.09 0.00 17 MIME_HTML_ONLY 273 29.89 54.49 3.43 18 RAZOR2_CF_RANGE_E4_51_100 201 20.79 40.12 0.00 19 URIBL_OB_SURBL 175 18.10 34.93 0.00 20 URI_HEX 137 14.48 27.35 0.64 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 BAYES_00 422 43.64 0.00 90.56 2 AWL 318 35.06 4.19 68.24 3 RCVD_IN_DNSWL_LOW 131 13.55 0.00 28.11 4 DCC_CHECK 100 60.19 96.21 21.46 5 RCVD_IN_DNSWL_HI 84 8.69 0.00 18.03 6 DKIM_SIGNED 79 9.31 2.20 16.95 7 RCVD_IN_DNSWL_MED 70 7.34 0.20 15.02 8 HTML_MESSAGE 61 52.12 88.42 13.09 9 DKIM_VERIFIED 39 4.03 0.00 8.37 10 RCVD_IN_BRBL_RELAY 19 50.16 93.01 4.08 11 MIME_HTML_ONLY 16 29.89 54.49 3.43 12 MIME_HTML_MOSTLY 13 1.34 0.00 2.79 13 MIME_QP_LONG_LINE 13 2.17 1.60 2.79 14 USER_IN_DKIM_WHITELIST 12 1.24 0.00 2.58 15 HABEAS_ACCREDITED_SOI 8 0.83 0.00 1.72 16 OBFUSCATING_COMMENT 8 0.83 0.00 1.72 17 MPART_ALT_DIFF 8 0.83 0.00 1.72 18 RCVD_IN_BSP_TRUSTED 8 0.83 0.00 1.72 19 SARE_UNI 8 3.72 5.59 1.72 20 SARE_SPEC_LEO_LINE03a 8 0.83 0.00 1.72 ----------------------------------------------------------------------
