On top of what Brandon said... Feed bayes. It's your friend. Bayes may not have reached the spam/ham min threshold but it doesn't stop you from teaching it. If you teach it enough then you'll hit the threshold fairly quick. I think there are a couple places that you can also download some mboxes or spam ready to import. Gary
________________________________ From: jdow [mailto:[EMAIL PROTECTED] Sent: Wed 6/23/2004 3:33 PM To: [EMAIL PROTECTED] Subject: Re: is this a good idea? From: "Brandon Kuczenski" <[EMAIL PROTECTED]> > Lately I've been getting spams with very low (or zero) scores, written in > plain-text grammatical english, with no technical errors in the headers, > clean routing chains and valid DNS records (afaik) as the originators. > My setup is SA 2.63 with razor, no bayes (yet -- not enough spams), a > couple SARE rules and others (complete list at end of message). Since > I've been getting the same messages every day for about a week (they all > started the same day, too.....) I've written custom rules which search the > body for refifast.biz and gozealgaming.com and add large scores to them. Usually I feed these to sa-learn. There is enough distinguishing "stuff" in them that Bayes soon classifies these as spam reliably. It has taken several months of training on such misses and handfuls of ham to get where I am now with the help of the Ninjas. It's a rare day I see even one spam out of about 1000 messages coming through my personal mailbox. That is down from maybe one or two a day for a month or two. Spam is a dynamic thing. There's no sitting back and saying, "I got you now my uglies!" They just keep coming at you. If you start generating rules it can be fun to try to get your marksmanship up as you trap shoot them down. {^_^}
