jdow wrote:
> From: "Dallas Engelken" <[EMAIL PROTECTED]>
>
>> On Tue, 2006-01-31 at 07:37 -0600, DAve wrote:
>>> And mine, note that these are *post* MailScanner and RBLs, which are
>>> running on my mail gateways. By the time SA gets the mail I've pruned
>>> anywhere from 45% to 75% of the messages, depending on the day.
>>>
>>> TOP SPAM RULES FIRED
>>> RANK RULE NAME COUNT %OFRULES %OFMAIL %OFSPAM %OFHAM
>>> 1 URIBL_BLACK 162360 8.88 55.25 88.86 2.10
>>
>> is that 2% ham hits really missed spam or are you having false positives
>> due to URIBL_BLACK??
>
> I am inclined to think there are a very few false positives, one every
> couple thousand or so. Spam that manages to sail through, here, do not
> seem to get marked with any BL rules as a general rule. That is why it
> scores 3.0 rather than a higher number. {^_-}
I personally have a higher-than 1 in every 500 FP rate from URIBL_BLACK.
# grep URIBL_BLACK maillog |wc -l
3992
# grep URIBL_BLACK maillog |grep BSP_TRUSTED |wc -l
9
Most of those come from hits against emails sent by ediets.com's subscriber
services. While this site is heavily ad laden, it is a subscriber service.
