Re: BAYES_00 BODY. Negative score?
please spamassassin -D bayes -t file.eml 2>/tmp/z and in /tmp/z you will have the score assigned to the "tokens"... from those points you will understand what created the different totals. If you can you may relearn all the messages, both ham and spam, with the tip suggested a couple of days ago, removing all the headers. It may lower points to some spam but probably it's better.. On Sat, Feb 18, 2023 at 3:37 PM joe a wrote: > On 2/17/2023 10:41 PM, Loren Wilton wrote: > >> They receive wildly different BAYES scores. > >> * -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% > >> * [score: 0.0002] > >> * 2.2 BAYES_20 BODY: Bayes spam probability is 5 to 20% > >> * [score: 0.0881] > > > > This looks like you have per-user Bayes databases, and the messaage type > > has been trained differently in each. > > > > Also, it looks like there are per-user rules, since BAYES_50 has a > > normal score of 0.2, and there is no reason BAYES_20 (indicating much > > less spammy) should have a score of 2.2. > > > > Per-user is not setup. > > This morning I sent the message again, with users reversed in the TO: > field and the scores are identical. This may prove nothing as I > thoughtlessly added the high score message to my "HAM" folder and it was > processed. > > While the scores are identical the X-Spam-Report lists them in different > order, while X-Spam-Status shows them identically, "RCVD_IN_MSPIKE_H2 > RBL" being listed near the top in one and near the bottom in the other. > > Perhaps that is meaningless, but it pings my curiosity. > > > > >
Re: BAYES_00 BODY. Negative score?
On 2/17/2023 10:41 PM, Loren Wilton wrote: They receive wildly different BAYES scores. * -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% * [score: 0.0002] * 2.2 BAYES_20 BODY: Bayes spam probability is 5 to 20% * [score: 0.0881] This looks like you have per-user Bayes databases, and the messaage type has been trained differently in each. Also, it looks like there are per-user rules, since BAYES_50 has a normal score of 0.2, and there is no reason BAYES_20 (indicating much less spammy) should have a score of 2.2. Per-user is not setup. This morning I sent the message again, with users reversed in the TO: field and the scores are identical. This may prove nothing as I thoughtlessly added the high score message to my "HAM" folder and it was processed. While the scores are identical the X-Spam-Report lists them in different order, while X-Spam-Status shows them identically, "RCVD_IN_MSPIKE_H2 RBL" being listed near the top in one and near the bottom in the other. Perhaps that is meaningless, but it pings my curiosity.
Re: BAYES_00 BODY. Negative score?
On 2/17/2023 8:24 PM, joe a wrote: Did a simple test today sending an email from a gmail account to two email accounts on my system. The only difference was the email address, both were on the same "To:" line in the composed messages. They receive wildly different BAYES scores. as was mentioned, they were apparently tested under different user. I want to add, that multiple similar messages can have invisible differences which can result into different BAYES results. Just this week I noticed (at least) two phishing waves, training one e-mail resulted into pushing other e-mails' scores up to BAYES_999, while other still had BAYES_50 or BAYES_80. Simply, we need more training. On 17.02.23 23:46, Jared Hall wrote: Try rattling off another Gmail message, but this time switch the two Email addresses on the "To:" line around. Maybe a case where only the first Email address is looked at by SA? if needed, scan the same mail under different user, if possible. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Microsoft dick is soft to do no harm
