On Tuesday, December 21, 2004, 8:57:00 AM, System wrote: SA> on 12/21/04 8:21 AM, Pete McNeil wrote:
>> The second possibility is that we've skipped the message for some >> safety reason (trying to avoid false positives) though it seems >> unlikely in this case. >> >> Once I see it I will be able to tell more. SA> Would adding "direct to spam" in the subject make these types of messages SA> any more meaningful/important to you guys? No. We would never see that really - or at least we wouldn't treat it differently. I scanned the message and identified why this case happened: Match RULE 13102-060: User Submission, 829 days, 1.0189933100 NAME: casinobar\.com CODE: casinobar\.com No prior False Positive Reports. The rule for this content is very old (there is a new one now as well). This is a domain that the spammers have started to re-use again after having dropped it for a while. They are doing this more and more. At the time the message was getting through on your system, the rule strength was below your threshold, so the rule was not active in your system. On our system the message was being screened out because there was already a rule in place for it. We have recently made some changes to the rule strength analysis engine that should largely mitigate this scenario in the future by more rapidly driving reactivated rules into a higher rule strength. I'm working on some new mechanisms to further accelerate this process. Thanks! _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
