Jacking up scores based on addy?

[Steve Lake <st...@raiden.net>]

	Hi all.  Got a question.  I've got a couple addresses I monitor for mail 
that only get like 1-2 legitimate mails out of every thousand or so, but I 
need those emails, but at the same time I'd like to either raise the values 
on inbound mail to just those addresses so that they score higher, or lower 
the threshold for marking them as spam without changing it for the 
others.  These are all delivered to the same mailbox, but they have a 
different external email address as I'm monitoring several different ones 
off one local mailbox.

	So, say user1, user2, and user3 @ mydomain.com are three of the addresses 
I monitor for example off this box that are spam pits, but need to be 
monitored for legitimate mail.  So is someguy, someguy2, and somedept @ 
mydomain.com which are accounts that hardly get any spam and do a lot of 
legitimate traffic.  Is there some way to set the first three so that they 
get treated differently by SA than the last 3 in how they're scored?  Most 
legit email I've found that comes through tends to score 1.5 or below, and 
some into considerable negative numbers while spam getting through scores 
about 2.5 and higher.  Is there a way to do this based just on the TO: field?

Re: Jacking up scores based on addy?

[jdow <jd...@earthlink.net>]

From: "Loren Wilton" <lw...@earthlink.net>

> I *think* what you are asking is, of you get mail to deadacct@mydomain.com
> you want it to be biased upward a bit, but mail to goodacct@mydomain.com
> won't be?
>
> There is no convenient way you can multiply the spam scores to get them to
> hit harder on some accounts.  But you can pretty trivially apply a fixed
> bias for some accounts, IF you trust the To: address.
>
> header    MY_BIAS    To =~ /\bdeadacct\@mydomain\.com\b/i
> score        MY_BIAS    2
> describe    MY_BIAS    Give old accounts a helping hand toward spam

And if this is not quite what you want you can apply meta rules to
the problem.

meta MY_BAD    MY_BIAS_SITE && MILDLY_BAD_RULE
score MY_BAD   2

meta MY_GOOD   MY_BIAS_SITE2 && NORMALLY_BAD_RULE
score MY_GOOD  -3

{^_^}

Re: Jacking up scores based on addy?

[Loren Wilton <lw...@earthlink.net>]

I *think* what you are asking is, of you get mail to deadacct@mydomain.com
you want it to be biased upward a bit, but mail to goodacct@mydomain.com
won't be?

There is no convenient way you can multiply the spam scores to get them to
hit harder on some accounts.  But you can pretty trivially apply a fixed
bias for some accounts, IF you trust the To: address.

header    MY_BIAS    To =~ /\bdeadacct\@mydomain\.com\b/i
score        MY_BIAS    2
describe    MY_BIAS    Give old accounts a helping hand toward spam

Obviously this also makes it more likely that ham will FP as spam for those
accounts, since this is kinda a "mini blacklist" for the accounts.  So you
will have to be really careful with the score to not lose legit mail to
these accounts.

You might be better off just trying to sharpen up the rules in general.. You
can probably get things down to around 1 spam leaking thru for every 500 or
so arriving.

        Loren