Hi,
I received two identical emails to two different email addresses in the
space of a few minutes that are both covered by a single instance of
SpamAssassin, and one of them was deemed to be spam, and the other not.
This in it of itself wouldn't be a massive issue were it not for the fact
that the scores do not tally up.
(I have attached both emails to this message)
The first mail (ham), the SA test matches returned were:
X-Spam-Status: No, hits=3.8 required=5.0
tests=FROM_HAS_UNDERLINE_NUMS,HTML_70_80,HTML_IMAGE_ONLY_02,
HTML_IMAGE_RATIO_02,HTML_WITH_BGCOLOR,MIME_HTML_ONLY,
PRIORITY_NO_NAME
version=2.50
The second mail (spam) had the following SA test matches:
X-Spam-Status: Yes, hits=6.0 required=5.0
tests=BAYES_60,FROM_HAS_UNDERLINE_NUMS,HTML_70_80,
HTML_IMAGE_ONLY_02,HTML_IMAGE_RATIO_02,HTML_WITH_BGCOLOR,
MIME_HTML_ONLY,NO_REAL_NAME,PRIORITY_NO_NAME
version=2.50
Aside from the sender name, both emails appear are 100% identical, and bave
the exact same SA matches except for the BAYES_60 (1.2 points) match in the
spam-tagged mail. I can only presume that the Bayesian filter "learnt"
something from the "ham-spam" email, which is a "good thing".
Nothing wrong here, except for the fact that 3.8 + 1.2 != 6.0.
So, can anyone see what's gone wrong here?
According to the full output from SA, the following scores were applied:
NO_REAL_NAME (1.0 points) From: does not include a real name
HTML_70_80 (0.3 points) BODY: Message is 70% to 80% HTML
BAYES_60 (1.2 points) BODY: Bayesian classifier says spam
probability is 60 to 70%
[score: 0.6165]
HTML_WITH_BGCOLOR (0.1 points) BODY: HTML mail with non-white background
HTML_IMAGE_RATIO_02 (0.5 points) BODY: HTML has a low ratio of text to
image area
HTML_IMAGE_ONLY_02 (1.5 points) BODY: HTML has images with 0-200 bytes of
words
FROM_HAS_UNDERLINE_NUMS (0.7 points) From: contains an underline and
numbers/letters
MIME_HTML_ONLY (0.1 points) Message only has text/html MIME parts
PRIORITY_NO_NAME (0.6 points) Message has priority setting, but no
X-Mailer
The score minus the BAYES_60 score should be 4.8, but its being reported as
3.8 in the non-spam-tagged email.
Anyone have any ideas?
Daz
--- Begin Message ---
This mail is probably spam. The original message has been attached
along with this report, so you can recognize or block similar unwanted
mail in future. See http://spamassassin.org/tag/ for more details.
Content preview: [EMAIL PROTECTED] rx
URI:http://www.uniplanplus.com/dental.html
URI:http://www.uniplanplus.com/htmlemail/dental-email.gif [...]
Content analysis details: (6.00 points, 5 required)
NO_REAL_NAME (1.0 points) From: does not include a real name
HTML_70_80 (0.3 points) BODY: Message is 70% to 80% HTML
BAYES_60 (1.2 points) BODY: Bayesian classifier says spam
probability is 60 to 70%
[score: 0.6165]
HTML_WITH_BGCOLOR (0.1 points) BODY: HTML mail with non-white background
HTML_IMAGE_RATIO_02 (0.5 points) BODY: HTML has a low ratio of text to
image area
HTML_IMAGE_ONLY_02 (1.5 points) BODY: HTML has images with 0-200 bytes of
words
FROM_HAS_UNDERLINE_NUMS (0.7 points) From: contains an underline and
numbers/letters
MIME_HTML_ONLY (0.1 points) Message only has text/html MIME parts
PRIORITY_NO_NAME (0.6 points) Message has priority setting, but no
X-Mailer
The original message did not contain plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
--- Begin Message ---
Title: rx
--- End Message ---
--- End Message ---
--- Begin Message ---
Title: rx
--- End Message ---
