On 29/03/11 16:38, Adam Katz wrote:
On 03/28/2011 10:41 PM, Ned Slider wrote:
NSL_RCVD_FROM_USER=1.226,
Personally I score this rule way up and would have no hesitation
with outright blocking at smtp level - it's as good an indication of
spam as I've ever seen. Scoring at 6pts here and never seen a FP.
This is a good illustration of our corpus not being strong enough; the
current stats make that rule look useless since its lowest-scoring match
is seven points and it hits 0.0278% of all spam< 10 points.
Furthermore, it has 99% overlap with FORGED_MUA_OUTLOOK, which hits far
more spam while maintaining a very low ham hit rate.
http://ruleqa.spamassassin.org/20110321/NSL_RCVD_FROM_USER/detail
Quickly grepping one of my corpus of 1307 spam I see 379 hits (~29%).
I've never seen it hit a ham. This is on a corpus of confirmed spam
collected after the easy stuff (bots etc) has been pre-filtered
(greylisting, spamhaus, RBLs etc). FORGED_MUA_OUTLOOK hits 39% on the
same corpus.
I've watched the scoring over time and it does seem to fluctuate
significantly (~ 1.2 to 3.5), I guess as old spam gets removed from the
auto-scoring corpus and new spam enters, so the score fluctuates with
the type of spam being seen. That said, it's still a hugely reliable rule.
