| Main Archive Page > Month Archives > spamassassin-users archives |
Re: URIBL_PH_SURBL
From: Ned Slider <ned_at_nospam>Date: Thu Dec 01 2011 - 14:47:49 GMT
To: users@spamassassin.apache.org
On 01/12/11 08:29, Tom Kinghorn wrote:
> Good morning list.
>
> could someone possibly explain how the scoring for ph.surbl.org works?
>
> I see the following in my spam logs
>
> spam-1DSMgl4+-YFV.gz: TO_NO_BRKTS_HTML_ONLY=1.258, URIBL_PH_SURBL=0.001]
> spam-1DSMgl4+-YFV.gz: * 0.0 URIBL_PH_SURBL Contains an URL listed in the PH
> SURBL blocklist
>
>
> Why does the ph.surbl.org score so low?
>
> I see the rule is defined as
>
> urirhssub URIBL_PH_SURBL multi.surbl.org. A 8
> body URIBL_PH_SURBL eval:check_uridnsbl('URIBL_PH_SURBL')
> describe URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist
> tflags URIBL_PH_SURBL net
> reuse URIBL_PH_SURBL
>
> how does this work?
>
> Thanks
>
> Tom
>
and the score is defined in 50_scores.cf:
score URIBL_PH_SURBL 0 0.001 0 0.610 # n=0 n=2
These 4 scores are defined as local, net, with bayes, with bayes+net.
Net means you have network tests enabled, local means you don't have
network tests enabled.
So because you are showing a score of 0.001, you appear to be using the
"net" score set - network tests enabled but no bayes. If you were using
"net" and bayes, then this rule would have scored 0.610.
You can over ride scores locally in local.cf if you want.
The scores are automatically generated based on nightly masschecks
http://wiki.apache.org/spamassassin/NightlyMassCheck
This is obviously dependent upon people contributing data for their spam
and ham.