> -----Original Message-----
> From: Matt Kettler [mailto:[EMAIL PROTECTED]]
> Sent: Wednesday, February 15, 2006 6:27 PM
> To: users@spamassassin.apache.org
> Subject: Over-scoring of SURBL lists...
>
>
> All this hubub about not filtering the list has made me come
> to a realization.
>
> The SURBL URIBLs are collectively massively over-scored in SA 3.1.0.
>
> The problem lies in the SURBL lists, over time, become
> largely redundant with
> one another. A URI may be first listed by one or another of
> the SURBL lists, as
> each has their own feeds, but if it's really used in spam run
> it will quickly
> get listed in 3 or more of them.
>
> Take for example this ONE uri that was posted to the list:
> checpri *MUNGED*.com
>
> This is currently listed in SC, JP, and AB on SURBL.
> score URIBL_AB_SURBL 0 3.306 0 3.812
> score URIBL_JP_SURBL 0 3.360 0 4.087
> score URIBL_SC_SURBL 0 3.600 0 4.498
>
> In a set3 configuration that's 12.397 points, just for having
> ONE URI in the
> message. I don't know about you, but it strikes me as rather
> excessive.
I'll chime in here finally. Why run so many???
mutli.uribl.com and multi.surbl.org
Thats really all you need. There was a thread not to long ago where people traded off rule hit rates, and the common theme was URIBL and SURBL hitting the tops with Bayes. Running more then these two lists is overkill if you ask me.
Even running those two lists, the scores should be set so that even if both rules hit, the score still isn't over you threshold. Just under it.
--Chris
