> -----Original Message-----
> On Tuesday, 5. February 2008 18:15:24 you wrote:
> > I used to have higher SA scores for 95-100% spam confidence.
> >
> > However, I found that I could not increase the score very much.
> > Occasionally, I would get a false positive for a blank
> email, no text with
> > a few HTML tags and just attachments. The Razor database regularly
> > contains data that indicates that a blank email is 100%
> known spam. There
> > was no way to prevent the false positive because the
> whitelist feature for
> > hash values was removed. I also tried combining scores for
> messages with a
> > small amount of text and positive razor hits, but that
> allows too much
> > spam.
>
> Hmm, that would be a little show stopper.
>
> What did the other tests of SpamAssassin report for such mails?
> I can imagine they report it as spam, too.
>
> Thomas
Here is an example of the SpamAssassin report for a blank email with Word
attachment:
pts rule name description
---- ---------------------- -----------------------------------------
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
0.1 HTML_90_100 BODY: Message is 90 HTML
-2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1
[cf: 100]
6.1 RAZOR2_CF_RANGE_91_100 Razor2 gives confidence between 91 and 100
[cf: 100]
1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level
above 50%
[cf: 100]
1.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
-1.5 RAZOR2_IGNORE Message in RAZOR2 and has very little text
-----
The RAZOR2_CF_RANGE_91_100 and RAZOR2_IGNORE were my custom RAZOR rules. I
could not get RAZOR2_IGNORE consistently to recognize when to ignore the
RAZOR2_CF_RANGE_91_100 results.
meta RAZOR2_IGNORE RAZOR2_CHECK + HTML_90_100 > 1
describe RAZOR2_IGNORE Message in RAZOR2 and has very little text
tflags RAZOR2_IGNORE net
meta RAZOR2_IGNORE2 RAZOR2_CHECK + MIME_HTML_MOSTLY > 1
describe RAZOR2_IGNORE2 Message in RAZOR2 and has very little text2
tflags RAZOR2_IGNORE2 net
full RAZOR2_CF_RANGE_00_01 eval:check_razor2_range('','00','01')
tflags RAZOR2_CF_RANGE_00_01 net
describe RAZOR2_CF_RANGE_00_01 Razor2 gives confidence between 00 and 01
full RAZOR2_CF_RANGE_02_10 eval:check_razor2_range('','02','10')
tflags RAZOR2_CF_RANGE_02_10 net
describe RAZOR2_CF_RANGE_02_10 Razor2 gives confidence between 02 and 10
full RAZOR2_CF_RANGE_11_50 eval:check_razor2_range('','11','50')
tflags RAZOR2_CF_RANGE_11_50 net
describe RAZOR2_CF_RANGE_11_50 Razor2 gives confidence between 11 and 50
full RAZOR2_CF_RANGE_51_90 eval:check_razor2_range('','51','90')
tflags RAZOR2_CF_RANGE_51_90 net
describe RAZOR2_CF_RANGE_51_90 Razor2 gives confidence between 51 and 90
full RAZOR2_CF_RANGE_91_100 eval:check_razor2_range('','91','100')
tflags RAZOR2_CF_RANGE_91_100 net
describe RAZOR2_CF_RANGE_91_100 Razor2 gives confidence between 91 and 100
Jim
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Razor-users mailing list
Razor-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/razor-users
