Flashlight spam (and others)

[Dino Edwards]

The fact that you had to set BAYES_00 to -4 tells me that you have a problem with ham being tagged as spam which points to a bayes training issue. You are right, without the -4 you would still only have a score of 4.3 but you would had been almost there. I hope you are not training your spam filter with that BAYES_00 set like that, because if you are, you are effectively telling your bayes that EVERY email is ham. Below I have included two X-Spam Reports from flashlight spam to two different users. As you can see, in both the BAYES_99 is hitting.

I suggest, you delete your bayes database, remove the BAYES_00 -4 and start training again. You are going to need a couple of hundred ham and a couple hundred spam before it becomes trained. 


X-Spam-Flag: YES
X-Spam-Score: 14.625
X-Spam-Level: **************
X-Spam-Status: Yes, score=14.625 tag=-999 tag2=3.6 kill=12
	tests=[BAYES_99=3.5, DCC_CHECK=1.1, DIGEST_MULTIPLE=0.293,
	HTML_MESSAGE=0.001, NO_DNS_FOR_FROM=0.001, PYZOR_CHECK=1.392,
	RCVD_IN_SBL_CSS=3.335, RDNS_NONE=0.793, T_REMOTE_IMAGE=0.01,
	URIBL_BLACK=1.7, URIBL_DBL_SPAM=2.5] autolearn=disabled

--------------------------------------------------------------------------------------------------------------

X-Spam-Flag: YES
X-Spam-Score: 11.93
X-Spam-Level: ***********
X-Spam-Status: Yes, score=11.93 tag=-999 tag2=3.6 kill=12 tests=[BAYES_99=3.5,
	BAYES_999=0.2, HTML_MESSAGE=0.001, PYZOR_CHECK=1.392,
	RCVD_IN_SBL_CSS=3.335, RDNS_NONE=0.793, SPF_PASS=-0.001,
	T_REMOTE_IMAGE=0.01, URIBL_BLACK=1.7, URI_TRY_USME=1]
	autolearn=disabled

-----Original Message-----
From: amavis-users [mailto:amavis-users-bounces+dino.edwards=mydirectmail.net at amavis.org] On Behalf Of @lbutlr
Sent: Sunday, December 18, 2016 12:42 AM
To: amavis-users at amavis.org
Subject: Re: Flashlight spam (and others)


> On Dec 17, 2016, at 10:40 AM, Dino Edwards <dino.edwards at mydirectmail.net> wrote:
> 
> Am I looking at this right? Does BAYES_00 assign a score of -4 on these messages?

Yes. BAYES_00 is normally extremely effective at passing ham.

But note that the spam passed even WITHOUT BAYES_00

> X-Spam-Status: No, score=0.3 required=5.0 tests=BAYES_00,DCC_CHECK,DKIM_SIGNED,
> 	HTML_IMAGE_ONLY_24,HTML_MESSAGE,MIME_HEADER_CTYPE_ONLY,RDNS_NONE,
> 	T_DKIM_INVALID,T_REMOTE_IMAGE autolearn=no autolearn_force=no version=3.4.1