Thanks for your response! My server is in EC2, and it appears that URIBL blanketly refuses requests from there. I set up a caching DNS server locally and tried routing my request through that, it was still rejected. Too many spammers using EC2 I guess.
As for your other suggestion, isn't that the point of Bayesian filtering? I keep getting similar messages, training my bayes db on them, and then more get through. "Kris Deugau [via SpamAssassin]" <ml-node+s1065346n107092...@n5.nabble.com> wrote: > > >Owen Mehegan wrote: >> Posted this to the wrong/no list (via Nabble) yesterday... >> >> I've seen an uptick in false negatives lately, and the spam that is >getting >> through is all the same stuff repeatedly. If anyone would be willing >to run >> these samples through their filters and let me know if they get >better >> hits, I would appreciate it. There are three at >> http://nerdnetworks.org/spam/ > >(spam4.txt is inaccessible) > >I notice URIBL_BLOCKED hits; check that you're either using your own >resolver with less than 100K messages/day, or that you're properly set >up for datafeed. Or just disable the uribl.com rules. (We found that >while they were usefully increasing our overall catch rate, the >increase >was not worth the cost of the datafeed [it came out to somewhere >between >one and five dollars a spam for the ones that the uribl.com hit was key >in getting the message tagged], so we disabled the rules.) > >Beyond that.... I've started creating very simple rules targeting the >Subject and From: name in this type of spam, along with extracting the >relay IP and URIs for local DNSBLs. It's moderately effective once >I've >confirmed enough volume for any given Subject or name to feel it's >worth >creating a rule... > >-kgd > > > > >_______________________________________________ >If you reply to this email, your message will be added to the >discussion below: >http://spamassassin.1065346.n5.nabble.com/Uptick-in-false-negatives-filter-check-tp107090p107092.html > >To unsubscribe from Uptick in false negatives - filter check?, visit >http://spamassassin.1065346.n5.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=107090&code=b3dlbkBuZXJkbmV0d29ya3Mub3JnfDEwNzA5MHwyMDgxOTQ3Njg5 -- Sent from Kaiten Mail. Please excuse my brevity. -- View this message in context: http://spamassassin.1065346.n5.nabble.com/Uptick-in-false-negatives-filter-check-tp107090p107096.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
