---------- Forwarded message ---------- Date: Wed, 14 Jul 2004 09:42:58 -0500 From: Dallas L. Engelken dallase@nmgi.com To: spamassassin-users@incubator.apache.org Subject: Top Rule Hits on Pre2 in the last 16 hours
Just FYI, my pre2 results after upgrading yesterday.
5 of the 6 top hitters are URIBL! DCC, Razor and Pyzor still hanging in there at ~1%... And a big pat on the back to Bob (SARE ninja) for the LONGWORDS.
Email: 55473 Autolearn: 9744 AvgScore: 3.82 AvgScanTime: 1.85 sec Spam: 16157 Autolearn: 8723 AvgScore: 12.77 AvgScanTime: 3.66 sec Ham: 39316 Autolearn: 1021 AvgScore: 0.14 AvgScanTime: 1.11 sec
TOP SPAM RULES FIRED ------------------------------------------------------------ RANK RULE NAME COUNT PERCENT ------------------------------------------------------------ -> 1 URIBL_WS_SURBL 13057 5.36% -> 2 URIBL_SBL 12907 5.30% 3 HTML_MESSAGE 11136 4.57% -> 4 URIBL_SC_SURBL 11060 4.54% -> 5 URIBL_OB_SURBL 10728 4.40% -> 6 URIBL_AB_SURBL 7981 3.28% 7 LONGWORDS 7947 3.26% 8 MPART_ALT_DIFF 6186 2.54% 9 MIME_HTML_NO_CHARSET 5507 2.26% 10 FORGED_RCVD_HELO 5196 2.13% 11 MIME_MISSING_BOUNDARY 4987 2.05% 12 MIME_HTML_MOSTLY 4565 1.87% 13 INFO_TLD 4192 1.72% 14 NO_REAL_NAME 4102 1.68% 15 BIZ_TLD 3984 1.64% 16 MIME_HTML_ONLY 3717 1.53% 17 RCVD_IN_NJABL_DUL 3660 1.50% 18 HTML_20_30 3099 1.27% 19 DCC_CHECK 3018 1.24% 20 RAZOR2_CF_RANGE_51_100 2972 1.22% 21 RAZOR2_CHECK 2965 1.22% 22 AWL 2852 1.17% 23 HTML_FONT_BIG 2740 1.12% 24 DIGEST_MULTIPLE 2292 0.94% 25 PYZOR_CHECK 2262 0.93% 26 CLICK_BELOW 1919 0.79% 27 HTML_IMAGE_ONLY_12 1918 0.79% 28 HTML_30_40 1869 0.77% 29 LINES_OF_YELLING 1737 0.71% 30 HTML_LINK_CLICK_HERE 1591 0.65% 31 MIME_BOUND_DD_DIGITS 1583 0.65% 32 HTML_80_90 1566 0.64% 33 HTML_FONT_TINY 1549 0.64% 34 HTML_FONT_SIZE_TINY 1525 0.63% 35 HTML_70_80 1498 0.61% 36 MONEY_BACK 1301 0.53% 37 HTML_FONT_SIZE_LARGE 1255 0.52% 38 DRUGS_ERECTILE 1247 0.51% 39 SATIS_GUAR 1191 0.49% 40 MSGID_DOLLARS 1189 0.49% ------------------------------------------------------------
William Stearns wrote:
TOP SPAM RULES FIRED
RANK RULE NAME COUNT PERCENT
-> 1 URIBL_WS_SURBL 13057 5.36% -> 2 URIBL_SBL 12907 5.30%
does sbl.spamhaus.org work with Mail-SpamAssassin-SpamCopURI? The few spam (uri) domains I've checked don't seem to return records.
On Thursday, July 15, 2004, 2:21:49 AM, Robert Brooks wrote:
William Stearns wrote:
TOP SPAM RULES FIRED
RANK RULE NAME COUNT PERCENT
-> 1 URIBL_WS_SURBL 13057 5.36% -> 2 URIBL_SBL 12907 5.30%
does sbl.spamhaus.org work with Mail-SpamAssassin-SpamCopURI? The few spam (uri) domains I've checked don't seem to return records.
sbl is not really intended to be used with message body URI checkers like SpamCopURI or urirhsbl, but it may get a few hits since I think Spamhaus may include a few spam URI domains in SBL. But the results will probably not be too useful or productive, since it's not an intended use of sbl.spamhaus.org.
Another unintended use is to check SURBLs against message headers (envelope senders, etc.). That too reportedly produces a few hits, but the results are not too overwhelming, given that most of the entries in SURBLs will match message bodies significantly better.
Perhaps Bill can explain in more detail what his results above mean.
Jeff C.