HI Scott,
It looks to me like you only score the black and not the grey or red listings.
The config I have, which would have come from someone else or the default
because I’ve never tried tweaking inv-uribl, scores black and red but not grey.
I’m thinking of scoring grey with a small score but I was waiting to see
response on the list such as yours.
Thanks,
Ben
From: Scott Fisher
Sent: Wednesday, April 06, 2011 6:50 AM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] How do you read the Inv-Uribl log file?
The 127.0.0.4 is a gray listing for the uribl. I personally don’t score the
gray result because of too many false positives.
<!--URI LIST 2-->
<add key="URIBL_List2" value="multi.uribl.com" />
<add key="URIBL_Weight_List2" value="0" />
<!-- BitValue_2 = comes from black.uribl.org -->
<!-- BitValue_4 = comes from grey.uribl.org -->
<add key="Enable_Custom_Bitmask_Values_URIBL_List2" value="true" />
<add key="URI_Bitmask_BitValue_1_Weight_URIBL_List2" value="0" />
<add key="URI_Bitmask_BitValue_2_Weight_URIBL_List2" value="75" />
<add key="URI_Bitmask_BitValue_4_Weight_URIBL_List2" value="0" />
<add key="URI_Bitmask_BitValue_8_Weight_URIBL_List2" value="0" />
<add key="URI_Bitmask_BitValue_16_Weight_URIBL_List2" value="0" />
<add key="URI_Bitmask_BitValue_32_Weight_URIBL_List2" value="0" />
<add key="URI_Bitmask_BitValue_64_Weight_URIBL_List2" value="0" />
<add key="URI_Bitmask_BitValue_128_Weight_URIBL_List2" value="0" />
-----Original Message-----
From: Imail Admin [mailto:imailad...@bcwebhost.net]
Sent: Tuesday, April 05, 2011 7:34 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] How do you read the Inv-Uribl log file?
So I'm still looking at ways to make Inv-Uribl more effective. I'm getting a
lot of spam that gets through my system with relatively marginal score so I'm
looking at the Inv-Uribl log. Here are the lines for a message that I would
consider to be obviously spam, yet came through Inv-Uribl as "Clean":
2011-03-31 02:53:09.343 2011-03-31 02:53:12.484
D:\IMail\spool\proc\work\D5d0b028c0000100f.smd netcontentinc.com 127.0.0.4 URI
from message body found in multi.uribl.com [4] [Total Weight=0]
2011-03-31 02:53:09.343 2011-03-31 02:53:12.953
D:\IMail\spool\proc\work\D5d0b028c0000100f.smd Resolved netcontentinc.com to
207.65.119.238 [Total Weight=0]
2011-03-31 02:53:09.343 2011-03-31 02:53:12.953
D:\IMail\spool\proc\work\D5d0b028c0000100f.smd Resolved avantresources.com to
216.139.251.42 [Total Weight=0]
2011-03-31 02:53:09.343 2011-03-31 02:53:12.953
D:\IMail\spool\proc\work\D5d0b028c0000100f.smd Resolved bcwebhost.net to
173.164.65.196 [Total Weight=0]
Did I miss something here that should have triggered a score (additional spam
weight in Declude)?
Thanks,
Ben
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe,
just send an E-mail to imail...@declude.com, and type "unsubscribe
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe,
just send an E-mail to imail...@declude.com, and type "unsubscribe
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
