David Goldsmith wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Jim Maul wrote:
David Goldsmith wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Here is how this message scored:
X-Spam-DCC: PacNet-SG: iceman11.giac.net 1358; Body=65 Fuz1=65 Fuz2=51
X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on
iceman11.giac.net
X-Spam-Level: ***
X-Spam-Status: No, score=4.0 required=5.0 tests=BAYES_99,HTML_90_100,
HTML_MESSAGE,MIME_HEADER_CTYPE_ONLY,MIME_HTML_ONLY,PLING_PLING
autolearn=no
version=3.1.8
X-Spam-Pyzor: Reported 0 times.
X-Spam-Report:
* 0.1 HTML_90_100 BODY: Message is 90% to 100% HTML
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.0000]
* 0.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
* 0.0 MIME_HEADER_CTYPE_ONLY 'Content-Type' found without
required MIME
* headers
* 0.3 PLING_PLING Subject has lots of exclamation marks
Here is a URL for the message:
http://members.cox.net/dgoldsmi/spam/lowscore02a.eml
Maybe I just got "lucky" and was an early recipient of it. None of the
message hash sites have seen it enough yet to assign points.
Does this message break 5.0 points for anyone?
Yep -
Content analysis details: (9.8 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
1.1 HTML_IMAGE_RATIO_04 BODY: HTML has a low ratio of text to image
area
0.1 HTML_MESSAGE BODY: HTML included in message
5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
[score: 1.0000]
0.3 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
2.2 MIME_HEADER_CTYPE_ONLY 'Content-Type' found without required MIME
headers
0.7 PLING_PLING Subject has lots of exclamation marks
Still rocking SA 2.64 with incredible results ;)
-Jim
Ok, so my SA 3.1.8 install with the latest rules via sa-update has:
# grep HTML_IMAGE_RATIO_04 *
20_html_tests.cf:body HTML_IMAGE_RATIO_04
eval:html_image_ratio('0.002','0.004')
20_html_tests.cf:describe HTML_IMAGE_RATIO_04 HTML has a low ratio of
text to image area
50_scores.cf:score HTML_IMAGE_RATIO_04 0.877 0 1.057 0
but it apparently does not trip this.
We both have MIME_HTML_ONLY, MIME_HEADER_CTYPE_ONLY and PLING_PLING but
you have higher scores for all three.
I have HTML_MESSAGE and HTML_90_100 which correlate to your HTML_MESSAGE
rule and score.
You have a higher BAYES_99 score.
Your scores for MIME_HTML_ONLY, MIME_HEADER_CTYPE_ONLY, PLING_PLING and
BAYES_99 -- are they the default values from SA 2.64 or have you
increased them?
I have increased my bayes scores because of the high accuracy of my
bayes database. BAYES_99 alone is enough to push spam over my 5.0
threshold. All other scores are stock for 2.64.
-Jim
