On Tue, 8 Jun 2004, Dimitrios wrote:
> I've attached a spam email which got -2.1 score. Quite amazing that
> it also passed my baysian database and all tests!!
>
> Please take a look at it and let me know what you think.
Why is that amazing? Based upon the training done at your site,
your local Bayes thinks that message is Very 'hammy' (0% spam)
and so assigns it a -5.6 score.
I ran that message thru my SA and got similar scores but got
50% on Bayes (IE it has -no- idea how to interpret that message
as we don't get much Greek here. ;) So it got 0 points from Bayes
and the other rules kicked in:
Content analysis details: (4.9 points, 6.0 required, autolearn=no)
pts rule name description
---- ---------------------- ------------------------------------------
0.3 RATWR7a_MESSID Message-ID has ratware pattern (12hex$8hex$8hex@)
0.8 L_T_COMBINED Destination email address suggests this is spam
0.0 BAYES_50 BODY: Bayesian spam probability is 50 to 56%
[score: 0.5220]
0.1 HTML_FONTCOLOR_BLUE BODY: HTML font color is blue
0.1 HTML_MESSAGE BODY: HTML included in message
1.0 JUSTIFIED_TEXT BODY: Body uses 74 char wide, justified text
2.6 DATE_IN_FUTURE_96_XX Date: is 96 hours or more after Received: date
It hit some locally added rules but still not enough to drive it into
'spam' land.
So it looks like that spammer did a good job of hiding their message.
Feed it to your Bayes as 'spam' and write some local rules to hit on
the various spam-parts of the message.
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
