On 04/11/2018 11:14 AM, Matus UHLAR - fantomas wrote:
On 04/10/2018 03:49 PM, Motty Cruz wrote:
I apologize here is the email headers and body
https://pastebin.com/bgXrfKaQ
On 10.04.18 16:28, David Jones wrote:
Content analysis details: (16.0 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
4.2 RCVD_IN_IVMBL_LASTEXTERNAL RBL: No description available.
[178.62.193.238 listed in sip.invaluement.com]
5.2 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 0.9996]
3.2 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 0.9996]
1.2 ENA_RELAY_IN Relayed through India
0.0 MISSING_MIME_HB_SEP BODY: Missing blank line between MIME
header and
body
2.2 ENA_RELAY_NOT_US Relayed from outside the US and not on
whitelists
0.0 ENA_BAD_SPAM Spam hitting really bad rules.
Since most ofthose rules are 3rd party and other have tuned scores, it's
quite expected that the mail scored 3.5.
(BAYES_999 was apparently not hit, it would score 3.7 then).
we sometimes must accept that a FP appears.
otherwise, there would be no spam and no discussion here :-)
If you read between the lines above there are two points:
1. the IVM RBL is awesome and well worth it's low price
2. if you follow my practice by whitelist_auth as many sender's based on
their envelope-from address, then you can aggressively train your Bayes
DB based on the content and not the sender to get maximum results.
I don't train every piece of junk or UCE as spam in my Bayes DB. Some
senders just need to be reported to Spamcop and blacklist_from because
their content looks just like ham. I bet many Bayes DBs out there are
"confused" by improper training. I train ham first then spam second so
similar content will go toward the spam classification since most of the
trusted senders are already covered by a whitelist_auth entry.
Never let end users decide the ham/spam Bayes training either. They
don't understand and will mark anything they don't want at that
particular moment as spam even if they signed up for it a few hours/days
ago.
--
David Jones
