Mailing-List: contact dev-help@spamassassin.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: pass (athena.apache.org: domain of mkettler_sa@verizon.net
 designates 206.46.173.19 as permitted sender)
Message-id: <4B083DAE.2020904@verizon.net>
Date: Sat, 21 Nov 2009 14:21:18 -0500
From: Matt Kettler <mkettler_sa@verizon.net>
User-Agent: Thunderbird 2.0.0.23 (Windows/20090812)
MIME-version: 1.0
To: Joao Gouveia <joao.gouveia@anubisnetworks.com>
Cc: dev@spamassassin.apache.org
Subject: Re: Strange ham corpus?
References: <1258828897.21880.73.camel@localhost>
In-reply-to: <1258828897.21880.73.camel@localhost>
Content-type: text/plain; charset=UTF-8
Content-transfer-encoding: 7bit

Joao Gouveia wrote:
> (resending this, used a wrong email account ..)
>
> Hi, 
>
> I was checking for FPs in our RBL, and noticed that most of them are
> hitting on a ham corpus that doesn't look very hammy to me:
>
> http://ruleqa.spamassassin.org/20091121-r882858-n/T_RCVD_IN_ANBREP_L3?mclog=ham-net-nbebout
>
> The scores are a bit strange (so are the rules being hit). Is this
> really supposed to be ham?
>
>   
I have to admit, this does look like a spam corpus.

Of  77 messages
62 hit RAZOR2_CF_RANGE_51_100.
49 hit URIBL_BLACK
45 hit T_URIBL_META_SURBL_ANY
26 hit RCVD_IN_XBL
25 hit various JM_SOUGHT rules.

Given the broad diversity of fairly reliable spam indicators all
matching heavily on this mail, this is either a spam corpus, or a corpus
of email from "shady" companies that do lots of spamming, but the corpus
maintainer actually subscribed to them.