You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Jean-Paul Natola <jn...@familycareintl.org> on 2007/07/18 15:41:22 UTC
spam scoring -2.6
Hi all,
I'm getting creamed with these spams but they are getting through due to;
-2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
[score: 0.0005]
Why is this happening?
Jean-Paul Natola
Network Administrator
Information Technology
Family Care International
588 Broadway Suite 503
New York, NY 10012
Phone:212-941-5300 xt 36
Fax: 212-941-5563
Mailto: Jnatola@Familycareintl.org
Re: spam scoring -2.6
Posted by ram <ra...@netcore.co.in>.
On Wed, 2007-07-18 at 09:41 -0400, Jean-Paul Natola wrote:
> Hi all,
>
> I'm getting creamed with these spams but they are getting through due to;
>
>
> -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> [score: 0.0005]
>
> Why is this happening?
>
I think that is more than obvious The bayes DB has gone crazy. This
happens to me too.
I would suggest nuke your DB and run sa-learn again
You could try expiring tokens regulary
Thanks
Ram
RE: spam scoring -2.6
Posted by "John D. Hardin" <jh...@impsec.org>.
On Wed, 18 Jul 2007, Jean-Paul Natola wrote:
> -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> 1.8 MISSING_SUBJECT Missing Subject: header
> 2.3 EMPTY_MESSAGE Message appears to have no textual parts and no
> Subject: text
> 1.0 TVD_PDF_FINGER01 Mail matches standard pdf spam fingerprint
Yeah. PDF spams.
You'll have to train some PDF spams into bayes for it to work against
them. Most of the headers on them (the only content Bayes has to work
with given the lack of a body or subject) do look legit.
Basically, training on them lets bayes learn about things like the
suspicius user-agent header and the .pdf attachment MIME header bits.
You should only need to do a handful of the smaller ones.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Where We Want You To Go Today 07/05/07: Microsoft patents in-OS
adware architecture incorporating spyware, profiling, competitor
suppression and delivery confirmation (U.S. Patent #20070157227)
-----------------------------------------------------------------------
6 days until The 38th anniversary of Apollo 11 landing on the Moon
RE: spam scoring -2.6
Posted by Jean-Paul Natola <jn...@familycareintl.org>.
Jean-Paul Natola wrote:
> Hi all,
>
> I'm getting creamed with these spams but they are getting
> through due to;
>
>
> -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> [score: 0.0005]
>
> Why is this happening?
This only says that Bayes doesn't think the email looks like spam so points
are subtracted.
What other information can you give about the spam that you receive? (Like
the full email headers?)
Content analysis details: (4.3 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
-2.6 BAYES_00 BODY: Bayesian spam probability is 0 to
1%
[score: 0.0005]
0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in
abuse.rfc-ignorant.org
1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?208.180.135.80>]
1.8 MISSING_SUBJECT Missing Subject: header
2.3 EMPTY_MESSAGE Message appears to have no textual parts
and no
Subject: text
1.0 TVD_PDF_FINGER01 Mail matches standard pdf spam fingerprint
Return-Path: ccq@zonnet.nl
X-OriginalArrivalTime: 18 Jul 2007 13:36:07.0980 (UTC)
FILETIME=[98AB46C0:01C7C940]
--------------000102010208070406000602
Content-Type: text/plain; charset=iso-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
--------------000102010208070406000602
Content-Type: application/pdf;
name="log.pdf"
Content-Transfer-Encoding: base64
Content-Disposition: inline;
filename="log.pdf"
--------------000102010208070406000602--
RE: spam scoring -2.6
Posted by Rob Sterenborg <R....@netsourcing.nl>.
Jean-Paul Natola wrote:
> Hi all,
>
> I'm getting creamed with these spams but they are getting
> through due to;
>
>
> -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> [score: 0.0005]
>
> Why is this happening?
This only says that Bayes doesn't think the email looks like spam so points are subtracted.
What other information can you give about the spam that you receive? (Like the full email headers?)
Grts,
Rob
Re: spam scoring -2.6
Posted by "John D. Hardin" <jh...@impsec.org>.
On Wed, 18 Jul 2007, Jean-Paul Natola wrote:
> I'm getting creamed with these spams but they are getting through
> due to;
>
> -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> [score: 0.0005]
>
> Why is this happening?
Well, most likely two causes: (1) your bayes is mistrained, or (2) the
spams contain sufficient text that looks like your legitimate message
traffic.
I'll repost the questions I posted here a bit ago in response to a
similar question:
(0) Does the text in the low-scoring spam, apart from the commercial
pitch, look like legitimate message traffic that you would expect at
your site? (e.g. if you're in the medical profession, it contains a
lot of text about medical topics.)
(1) How often does this happen?
(2) How big is your bayes database? (use "sa-learn --dump magic")
(3) How are you training your bayes database? Autolearn? Or manual?
(4) If manual, do you keep your corpus around after you've trained it?
(5) If manual, do you let nontechnical users train it without review?
Finally, have you installed any of the SARE rules from
www.rulesemporium.com? While not "fixing" a low bayes score, they may
counteract it when bayes gets fooled.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Where We Want You To Go Today 07/05/07: Microsoft patents in-OS
adware architecture incorporating spyware, profiling, competitor
suppression and delivery confirmation (U.S. Patent #20070157227)
-----------------------------------------------------------------------
6 days until The 38th anniversary of Apollo 11 landing on the Moon