Re: Spam PDF

From: arni <mail(at)arni.name>
Date: Wed Jun 27 2007 - 10:39:31 EDT

Robert Schetterer schrieb:
> arni schrieb:
>

>>> aymond
>>>       
>> as i said several times on this maillist now, i've never had any of
>> these mails get through, here is how the current ones score:
>>
>>     

> you are in a luck,
> you are a "late reciever" of that spam, so it was detected
> by others before ( look at your headers )
> but it wasnt detected by i.e a plain pdf_spam rule/solution
> ( like fuzzy_ocr etc )
> this is what i am looking for

>
>

I looked for the lowest scoring email of the past 2 days (dont save them longer), this is the one:

X-Spam-Status: Yes, score=10.7 required=5.0 tests=BAYES_99,DCC_CHECK,

	DKIM_POLICY_SIGNSOME,HTML_MESSAGE,LOGINHASH1,LOGINHASH2,MIME_HTML_MOSTLY
	autolearn=no version=3.2.0
X-Spam-Report: 
	*  5.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
	*      [score: 1.0000]
	*  0.0 DKIM_POLICY_SIGNSOME Domain Keys Identified Mail: policy says domain
	*       signs some mails
	*  0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
	*  0.0 HTML_MESSAGE BODY: HTML included in message
	*  1.5 LOGINHASH2 BODY: mail has been classified as spam @ unknown company,
	*       Germany
	*  1.5 LOGINHASH1 BODY: mail has been classified as spam @ LogIn&Solutions
	*      AG, Germany
	*  2.2 DCC_CHECK Listed in DCC (
http://rhyolite.com/anti-spam/dcc/)

Note that already a well trained BAYES can take these mails out on its own on my system.

If you find your bayes to score really acurate then its a good idea to increase the scores. For me bayes is fed from 2 spamtrap addresses with around 50 pieces of the finest spam every day. Doing this, bayes scores BAYES_99 on 99.5% of my remaining spam - i hardly ever see it score below BAYES_80 and thats just great.

So maybe training bayes better or increasing the score will put and end to this for you.

arni Received on Wed Jun 27 10:40:07 2007