Spam tagging g in subject doubled up?

[@lbutlr]

On 29 Oct 2016, at 00:54, Admin Beckspaced <admin at beckspaced.com> wrote:
> maybe you just have a typo with the starting and closing sign

No, that was a “smart” substitution by my mail client. A wrong quote there would break amavisd.conf entirely, not simply result in double subject tags.

I can’t find where that *Spam* Subject tag is set; I’ve searched every file in and under /usr/local/etc/ & /etc and the only match is in amavisd.cong.sample and that is “***Spam***”.

I also cannot find where amavisd’s bayes files are. 

(I’ve been told they are in /var/spool/amavis/.spamassassin, but these files do not get updated). The user vscan that runs amavis has a home folder at /var/maiad/ but that .spamassassin folder is empty.

Here are headers from a message this morning:

Return-Path: <JulieThompson at points.rewardspecialnewestupdates.com>
X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on mail.covisp.net
X-Spam-Flag: YES
X-Spam-Level: *******
X-Spam-Status: Yes, score=7.7 required=5.0 tests=AWL,BAYES_50,DCC_CHECK,
	HTML_MESSAGE,MIME_HTML_ONLY,RCVD_IN_SBL_CSS,RDNS_NONE,T_REMOTE_IMAGE,
	URIBL_BLACK,URIBL_DBL_SPAM autolearn=no autolearn_force=no version=3.4.1
X-Spam-Report: 
	*  1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
	*      [URIs: rewardspecialnewestupdates.com]
	*  2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
	*      [URIs: rewardspecialnewestupdates.com]
	*  3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
	*      [74.63.211.2 listed in zen.spamhaus.org]
	*  0.0 HTML_MESSAGE BODY: HTML included in message
	*  0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
	*  0.5 BAYES_50 BODY: Bayes spam probability is 40 to 60%
	*      [score: 0.5000]
	*  1.1 DCC_CHECK Detected as bulk mail by DCC (dcc-servers.net)
	*  0.8 RDNS_NONE Delivered to internal network by a host with no rDNS
	*  0.0 T_REMOTE_IMAGE Message contains an external image
	* -2.9 AWL AWL: Adjusted score from AWL reputation of From: address
X-Original-To: *munged*@covisp.net
Delivered-To: *munged*@covisp.net
Received: from mail.covisp.net (localhost [127.0.0.1])
	by mail.covisp.net (Postfix) with ESMTP id 3t5kc31svSzKYNT
	for <*munged*@covisp.net>; Sat, 29 Oct 2016 09:11:31 -0600 (MDT)
X-Virus-Scanned: amavisd-new at covisp.net
Received: from mail.covisp.net ([127.0.0.1])
	by mail.covisp.net (mail.covisp.net [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id JDWHHusubPy8; Sat, 29 Oct 2016 09:11:30 -0600 (MDT)
Received: from points.rewardspecialnewestupdates.com (unknown [74.63.211.2])
	by mail.covisp.net (Postfix) with ESMTP id 3t5kc21QrCzKXnG
	for <*munged*@covisp.net>; Sat, 29 Oct 2016 09:11:30 -0600 (MDT)
Date: Sat, 29 Oct 2016 08:12:48 -0700
Subject: (Spam? 07.7) *Spam* 8.057:Attn: Amazon-Shopper - Your Bonus-Points are About
	to-Expire! Redeem-Now - #13777386847
Content-Transfer-Encoding: 8bit
From: AmazonReward <AmazonReward at rewardspecialnewestupdates.com>


-- 
Don't congratulate yourself too much, or berate yourself either. You
choices are half chance; so are everybody else's.