The log says one thing and the analyzer says another. Here's what the log says (Prob:0.11941 => ham): ----------------------------------- Jan-19-12 11:26:01 id-32699-00984 176.53.113.168 <[email protected]> to: [email protected] [monitoring] -- Blocked Country TR -- [RE Meet Beautiful Adoring Russian Women Today]; Jan-19-12 11:26:08 id-32699-00984 [DNSBL] 176.53.113.168 <[email protected]> to: [email protected] [scoring] (DNSBL: neutral, 176.53.113.168 listed in (blackholes.five-ten-sg.com<-127.0.0.9; )); Jan-19-12 11:26:08 id-32699-00984 176.53.113.168 <[email protected]> to: [email protected] ClamAV: scanned 8424 bytes in message - OK ; Jan-19-12 11:26:08 id-32699-00984 176.53.113.168 <[email protected]> to: [email protected] Bayesian [scoring] - Prob: 0.11941 => ham; Jan-19-12 11:26:09 id-32699-00984 [MessageOK] 176.53.113.168 <[email protected]> to: [email protected] message ok [RE Meet Beautiful Adoring Russian Women Today]; ----------------------------------
I pasted the full email (header and body) into the analyzer. Here's what the Analyzer says (Spam probability:0.9766): ----------------------------------- General Hints: analyze is restricted to a maximum length of 4954 bytes Connecting IP: '176.53.113.168' Connecting HELO: ervu168.coursereal.info sender and reply addresses: From: [email protected] recipient addresses: To: [email protected] Feature Matching: * SPF-check returned OK for 176.53.113.168 -> , ervu168.coursereal.info * URIBL check: 'failed' * URIBL result: 'URIBL failed: 'coursereal.info'(multi.surbl.org )' * 176.53.113.168 is in PB Black: score:6, last event - DNSBLneutral * 176.53.113.168 is in RBLCache: inserted as not ok at 202012-01-19 11:26:08:00 , listed by blackholes.five-ten-sg.com{127.0.0.9} * 176.53.113.168 is in CountryCache: status=changed to black country, data=TR, , * 176.53.113 has a Griplist value of 0.8 Bayesian Analysis: Bad Words Bad Prob Good Words Good Prob Totals: 0.0011 0.9457 0.9317 0.8846 0.8458 0.7178 0.7178 0.3564 0.6320 0.3810 0.6036 0.4040 Spam Probability: probability: 0.9766 --------------------------------------------- So, why is it reported as ham in the log, but spam in the analyze? Kind Regards, Brett ------------------------------------------------------------------------------ Keep Your Developer Skills Current with LearnDevNow! The most comprehensive online learning library for Microsoft developers is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3, Metro Style Apps, more. Free future releases when you subscribe now! http://p.sf.net/sfu/learndevnow-d2d _______________________________________________ Assp-test mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-test
