https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7336
--- Comment #6 from Mark London <[email protected]> --- (In reply to John Hardin from comment #5) > (In reply to Mark London from comment #4) > > I searched my logs, and could only find a single > > case of ADVANCE_FEE_3_NEW_MONEY hitting at the same time as > > ADVANCE_FEE_3_NEW_MONEY. > > I expect you meant AF2 and AF3 hitting at the same time. That overlap was > fixed a long time ago, you should not be seeing it at all. How up-to-date > are your rules? > > Again, are you willing to provide FP samples? Privately if they aren't > suitable for adding to the bugzilla. Sorry I mean to say that I could find only one single case of ADVANCE_FEE_3_NEW_MONEY hitting at the same time as LOTTO_AGENT. ADVANCE_FEE_3_NEW_MONEY hit this message with a resume, because LOTS_OF_MONEY was present. Also, because __ADVANCE_FEE_3_NEW hit, because it's score was > 2. The 3 hits that caused _ADVANCE_FEE_3_NEW to occur, were LOTTO_AGENT, __DEAL (financial transaction), and __FRAUD_IRT (Dear Sir). Those 3 made the score > 2. LOTTO_AGENT only hit 75 out of about 90000 spam messages in my log. 61 of those messages had FILL_THIS_FORM 55 of those messages had US_DOLLARS_3 43 of those messages had FROM_MISSP_REPLYTO 35 of those messages had YOU_WON 28 of those messages had FROM_MISSP_USER 26 of those messages had DEAR_BENEFICIARY 12 of those messages had FREEMAIL_FORGED_REPLYTO If I filter out all of the LOTTO_AGENT spam messages that had either US_DOLLARS_3 or FILL_THIS_FORM, I get only get 4 spam messages. So those 2 rules are knew for LOTTO_AGENT being likely to be a spam. For the 4 that didn't hit those 2 rules: 3 of those had FREEMAIL_FORGED_REPLYTO The 4th had DEAR_BENEFICIARY and HK_RANDOM_FROM It seems to me, given the low amounts of hits for LOTTO_AGENT, it's score should be dependent on other rules, such as FILL_THIS_FORM or US_DOLLARS_3. Personally, I have a lot of rules dependent on the size of the message. A resume is a fairly large file, while spam like the ones that LOTTO_AGENT are likely to hit, tend to be small. IMHO. FWIW, What is 73_sandbox_manual_scores.cf? I see that ADVANCE_FEE_3_NEW_MONEY has a lower score there, if I comment out a line. -- You are receiving this mail because: You are the assignee for the bug.
