On 6/7/2011 10:34 AM, Bowie Bailey wrote:
On 6/6/2011 9:02 PM, Morgan Bishop wrote:
I'm new to all of this and I'm not sure if training with sa-learn is
having any effect as this SPAM still scores the same and bayes thinks
it's probably less than 1% SPAM (BAYES_00). I'm run a small vanity
domain for friends and family so there isn't exactly a ton of training
going on, but I'm sure I'm doing it right as most Bayes is 95-99% for
legitimate SPAM, and 0-5% for HAM. I only training on mail I've
personally made sure is HAM and SPAM, and in fact, these e-mails are
the only 1% probability I get for legitimate SPAM.
I've attached an example below. There is an HTML component as well,
but other than markup it is idential. My thinking is there should be
some way to write a rule checking words against a dictionary, but it
sounds like an expensive filter process-wise. This poor user gets
about 10 of these mails a day.
<spam sample removed>
Please upload the full email including all headers (and your X-Spam
headers, if possible) to pastebin.com and send us the link. We will be
able to give you much better suggestions if we can see the full headers,
HTML, etc.
Here's a complete mail for the new user having problems.
http://pastebin.com/YrKGGmvD
Here's the identical mail forwarded to my long lived account.
http://pastebin.com/JDArUj85
As you can see, the new account does not have a Bayes score while my
account does.
I set up a new mail account for my father just for Hotmail to forward
to. The only hit this SPAM is getting is for the new account is the
generic freemail hit since it's forwarded from hotmail. In Bayes status
(X-Spam-Bayes) there is an empty summary (_TOKENSUMMARY_). I assume
this is because Bayes is not running since there are less than 200
SPAM/HAM messages for new account kreg...@morg.org?
However, In my case Bayes runs and sees enough spammy tokens for the
Bayes Spam probability to be 99%, which is better than before where it
was reported as HAM (BAYES_00). Even still, the message is not scored
high enough to be marked as SPAM and I'm worried that increasing the
BAYES_99 score will mess up a fairly good spam configuration - most of
the accounts on my domain see very little false positives and a lot of
times a BAYES_99 score will bump a message just under the SPAM threshold
for first time HAM keeping it from becoming a false-positive. Thus,
even if I wait for the SPAM and HAM to trickle in to this new account
for Bayes to start running on kreg...@morg.org, as things are I do not
think it will work without extra tweaking somewhere.
Hope that makes sense:)
