On 03/11/2012 06:47 AM, [email protected] wrote:
On 03/11, Axb wrote:
Guys,
At the moment, after last sa-update:
score RCVD_IN_XBL 0 0.724 0 0.375 # n=0 n=2
is amazingly low.
last net masscheck shows
0 43.3599 0.0133 1.000 0.97 0.00 RCVD_IN_XBL
(http://ruleqa.spamassassin.org/20120310-r1299162-n/RCVD_IN_XBL/detail)
(darxus& llanga corpus poisoned?)
One of my two is a notification from livejournal.com that my girlfriend
posted to her lj. The other is a post to a yahoo group for a local goth
club night, to which I have been subscribed for a while.
as the second best ranking rule, shouldn't this this score be raised
quite a bit, to at least 1.7?
There are a number of reasons for the score generator to come up with this
result.
agreed, and that doesn't mean it's 100% accurate.
score RCVD_IN_SBL 0 2.596 0 0.141 # n=0 n=2
with a ranking of 0.85
Cannot imagine what HAM is hitting SBL unless its IPs listed due to
419s or llanga& darxus' corpus have snowshow in their ham corpus
(See http://ruleqa.spamassassin.org/20120310-r1299162-n/RCVD_IN_SBL/detail)
I have 29 hams that hit this. In reverse chronological order:
Looks like 18 are livejournal.com. 11 are notifications that there were
updates to the thread
http://www.diyelectriccar.com/forums/showthread.php?t=53001 which I had
subscribed to.
So, all of my hams hitting both of these rules are legit hams, where the
blacklists had false positives. I am very confident that none of them were
just exquisitely faked.
Could you please check if any of those IPs are still listed ?
(especially XBL)
If they aren't, then it's "reuse" which is causing the issue.
reuse RCVD_IN_XBL
reuse RCVD_IN_SBL
Unless we want to trust stale data, I think this should be removed for a
number of BLs which have short lived listings.
Axb
