[Spambayes] Duplicate messages handled differently...?
Kenneth Sole
sole at soleassociates.com
Wed Jan 26 14:55:32 CET 2005
Hi Tony, and others,
Well, it did not take long to have the opportunity to check the
"clues." I just received two messages (an eBay phishing spam). One
moved to my review folder, the other to my spam folder. The messages
appeared identical, and so as per your suggestion, I checked the
"clues."
To my surprise, they appear identical as well...
With apologies for the detail, they are included below. I have snipped
the Message Stream etc.
Here are the clues for the message that want to Review:
Combined Score: 100% (1)
Internal ham score (*H*): 1.66533e-015
Internal spam score (*S*): 1
# ham trained on: 132
# spam trained on: 648
121 Significant Tokens
token spamprob #ham #spam
'clicking' 0.129738 5 3
'bi:protect your' 0.154726 4 3
'bi:for more' 0.177298 9 9
'reply' 0.233493 21 31
'address' 0.240901 24 37
'from:addr:support' 0.256002 2 3
'proto:https' 0.295606 5 10
'using' 0.304795 15 32
'review' 0.310693 6 13
'bi:and choose' 0.316934 1 2
'bi:below click' 0.316934 1 2
'bi:internet explorer' 0.316934 1 2
'web' 0.318722 11 25
'not' 0.325615 79 187
'has' 0.356189 38 103
'bi:visit our' 0.363156 4 11
'use' 0.3721 20 58
'from' 0.372421 67 195
'bi:link the' 0.391515 1 3
'have' 0.393714 70 223
'header:Reply-To:1' 0.626312 21 173
'bi:to:2**0 x-mailer:none' 0.678836 31 322
'bi:url:com url:images' 0.687905 2 22
'bi:header:Subject:1 proto:http' 0.688141 26 282
'url:i' 0.733383 1 14
'yourself' 0.818139 1 23
'bi:access and' 0.908163 0 2
'bi:any page.' 0.908163 0 2
'bi:browser (e.g.' 0.908163 0 2
'bi:cannot answered.' 0.908163 0 2
'bi:dear paypal' 0.908163 0 2
'bi:e-mail. mail' 0.908163 0 2
'bi:flagged accounts' 0.908163 0 2
'bi:for assistance,' 0.908163 0 2
'bi:here verify' 0.908163 0 2
'bi:info make' 0.908163 0 2
'bi:information file' 0.908163 0 2
'bi:information thank' 0.908163 0 2
'bi:log your' 0.908163 0 2
'bi:never provide' 0.908163 0 2
'bi:open new' 0.908163 0 2
'bi:password email.' 0.908163 0 2
'bi:preferences here.' 0.908163 0 2
'bi:receive email' 0.908163 0 2
'bi:require all' 0.908163 0 2
'bi:safe paypal' 0.908163 0 2
'bi:safely and' 0.908163 0 2
'bi:secure server' 0.908163 0 2
'bi:skip:n 10 plain' 0.908163 0 2
'bi:system part' 0.908163 0 2
'bi:team _____' 0.908163 0 2
'bi:team please' 0.908163 0 2
'bi:text instead' 0.908163 0 2
'bi:the "help"' 0.908163 0 2
'bi:the hyperlink' 0.908163 0 2
'bi:this must' 0.908163 0 2
'bi:time, please' 0.908163 0 2
'bi:tips dear' 0.908163 0 2
'bi:type the' 0.908163 0 2
'bi:url:23 url:12' 0.908163 0 2
'bi:url:com proto:https' 0.908163 0 2
'bi:url:en_us url:images' 0.908163 0 2
'bi:url:gif paypal' 0.908163 0 2
'bi:url:securitytips proto:http' 0.908163 0 2
'bi:verify their' 0.908163 0 2
'bi:website your' 0.908163 0 2
'bi:your password' 0.908163 0 2
'flagged' 0.908163 0 2
'footer' 0.908163 0 2
'fraud,' 0.908163 0 2
'html,' 0.908163 0 2
'measures.' 0.908163 0 2
'netscape)' 0.908163 0 2
'paypal!' 0.908163 0 2
'pp478' 0.908163 0 2
'randomly' 0.908163 0 2
'subject:PayPal' 0.908163 0 2
'url:)' 0.908163 0 2
'url:bg_clk' 0.908163 0 2
'url:prefs-noti' 0.908163 0 2
'url:scr' 0.908163 0 2
'url:securitytips' 0.908163 0 2
'webform' 0.908163 0 2
'bi:ask you' 0.934783 0 3
'bi:our security' 0.934783 0 3
'bi:paypal email' 0.934783 0 3
'bi:paypal will' 0.934783 0 3
'bi:sure you' 0.934783 0 3
'bi:the paypal' 0.934783 0 3
'bi:url:images url:paypal' 0.934783 0 3
'bi:url:www url:paypal' 0.934783 0 3
'bi:your paypal' 0.934783 0 3
'fraudulent' 0.934783 0 3
'from:addr:paypal.com' 0.934783 0 3
'from:name:paypal' 0.934783 0 3
'protecting' 0.934783 0 3
'url:206' 0.934783 0 3
'url:email_logo' 0.934783 0 3
'url:en_us' 0.934783 0 3
'url:pixel' 0.934783 0 3
'url:webscr' 0.934783 0 3
'websites.' 0.934783 0 3
'bi:enter your' 0.949438 0 4
'bi:only you' 0.949438 0 4
'bi:sent this' 0.949438 0 4
'bi:url:us proto:http' 0.949438 0 4
'member,' 0.949438 0 4
'securely' 0.949438 0 4
'url:64' 0.949438 0 4
'url:logo' 0.949438 0 4
'bi:access the' 0.958716 0 5
'bi:update your' 0.965116 0 6
'bi:with us.' 0.965116 0 6
'routine' 0.965116 0 6
'bi:account and' 0.973373 0 8
'subject:Account' 0.97619 0 9
'account,' 0.978469 0 10
'bi:your information' 0.978469 0 10
'url' 0.980349 0 11
'bi:your account' 0.983271 0 13
'message-id:@hotmail.com' 0.984429 0 14
and here are the clues for the message that went to the spam folder:
Combined Score: 100% (1)
Internal ham score (*H*): 1.66533e-015
Internal spam score (*S*): 1
# ham trained on: 132
# spam trained on: 648
121 Significant Tokens
token spamprob #ham #spam
'clicking' 0.129738 5 3
'bi:protect your' 0.154726 4 3
'bi:for more' 0.177298 9 9
'reply' 0.233493 21 31
'address' 0.240901 24 37
'from:addr:support' 0.256002 2 3
'proto:https' 0.295606 5 10
'using' 0.304795 15 32
'review' 0.310693 6 13
'bi:and choose' 0.316934 1 2
'bi:below click' 0.316934 1 2
'bi:internet explorer' 0.316934 1 2
'web' 0.318722 11 25
'not' 0.325615 79 187
'has' 0.356189 38 103
'bi:visit our' 0.363156 4 11
'use' 0.3721 20 58
'from' 0.372421 67 195
'bi:link the' 0.391515 1 3
'have' 0.393714 70 223
'header:Reply-To:1' 0.626312 21 173
'bi:to:2**0 x-mailer:none' 0.678836 31 322
'bi:url:com url:images' 0.687905 2 22
'bi:header:Subject:1 proto:http' 0.688141 26 282
'url:i' 0.733383 1 14
'yourself' 0.818139 1 23
'bi:access and' 0.908163 0 2
'bi:any page.' 0.908163 0 2
'bi:browser (e.g.' 0.908163 0 2
'bi:cannot answered.' 0.908163 0 2
'bi:dear paypal' 0.908163 0 2
'bi:e-mail. mail' 0.908163 0 2
'bi:flagged accounts' 0.908163 0 2
'bi:for assistance,' 0.908163 0 2
'bi:here verify' 0.908163 0 2
'bi:info make' 0.908163 0 2
'bi:information file' 0.908163 0 2
'bi:information thank' 0.908163 0 2
'bi:log your' 0.908163 0 2
'bi:never provide' 0.908163 0 2
'bi:open new' 0.908163 0 2
'bi:password email.' 0.908163 0 2
'bi:preferences here.' 0.908163 0 2
'bi:receive email' 0.908163 0 2
'bi:require all' 0.908163 0 2
'bi:safe paypal' 0.908163 0 2
'bi:safely and' 0.908163 0 2
'bi:secure server' 0.908163 0 2
'bi:skip:n 10 plain' 0.908163 0 2
'bi:system part' 0.908163 0 2
'bi:team _____' 0.908163 0 2
'bi:team please' 0.908163 0 2
'bi:text instead' 0.908163 0 2
'bi:the "help"' 0.908163 0 2
'bi:the hyperlink' 0.908163 0 2
'bi:this must' 0.908163 0 2
'bi:time, please' 0.908163 0 2
'bi:tips dear' 0.908163 0 2
'bi:type the' 0.908163 0 2
'bi:url:23 url:12' 0.908163 0 2
'bi:url:com proto:https' 0.908163 0 2
'bi:url:en_us url:images' 0.908163 0 2
'bi:url:gif paypal' 0.908163 0 2
'bi:url:securitytips proto:http' 0.908163 0 2
'bi:verify their' 0.908163 0 2
'bi:website your' 0.908163 0 2
'bi:your password' 0.908163 0 2
'flagged' 0.908163 0 2
'footer' 0.908163 0 2
'fraud,' 0.908163 0 2
'html,' 0.908163 0 2
'measures.' 0.908163 0 2
'netscape)' 0.908163 0 2
'paypal!' 0.908163 0 2
'pp478' 0.908163 0 2
'randomly' 0.908163 0 2
'subject:PayPal' 0.908163 0 2
'url:)' 0.908163 0 2
'url:bg_clk' 0.908163 0 2
'url:prefs-noti' 0.908163 0 2
'url:scr' 0.908163 0 2
'url:securitytips' 0.908163 0 2
'webform' 0.908163 0 2
'bi:ask you' 0.934783 0 3
'bi:our security' 0.934783 0 3
'bi:paypal email' 0.934783 0 3
'bi:paypal will' 0.934783 0 3
'bi:sure you' 0.934783 0 3
'bi:the paypal' 0.934783 0 3
'bi:url:images url:paypal' 0.934783 0 3
'bi:url:www url:paypal' 0.934783 0 3
'bi:your paypal' 0.934783 0 3
'fraudulent' 0.934783 0 3
'from:addr:paypal.com' 0.934783 0 3
'from:name:paypal' 0.934783 0 3
'protecting' 0.934783 0 3
'url:206' 0.934783 0 3
'url:email_logo' 0.934783 0 3
'url:en_us' 0.934783 0 3
'url:pixel' 0.934783 0 3
'url:webscr' 0.934783 0 3
'websites.' 0.934783 0 3
'bi:enter your' 0.949438 0 4
'bi:only you' 0.949438 0 4
'bi:sent this' 0.949438 0 4
'bi:url:us proto:http' 0.949438 0 4
'member,' 0.949438 0 4
'securely' 0.949438 0 4
'url:64' 0.949438 0 4
'url:logo' 0.949438 0 4
'bi:access the' 0.958716 0 5
'bi:update your' 0.965116 0 6
'bi:with us.' 0.965116 0 6
'routine' 0.965116 0 6
'bi:account and' 0.973373 0 8
'subject:Account' 0.97619 0 9
'account,' 0.978469 0 10
'bi:your information' 0.978469 0 10
'url' 0.980349 0 11
'bi:your account' 0.983271 0 13
'message-id:@hotmail.com' 0.984429 0 14
Might you have any further insight into this situation?
Sincere thanks,
--
Kenneth
Sole & Associates, Inc.
Box 292
Durham, New Hampshire 03824
Voice: 603-659-3169
Fax: 603-659-2248
Email: sole at soleAssociates.com
URL: http://www.soleAssociates.com
PGP:
http://wwwkeys.ch.pgp.net:11371/pks/lookup?op=get&search=0xE17941C6
-----Original Message-----
From: Tony Meyer [mailto:tameyer at ihug.co.nz]
Sent: Tuesday, January 25, 2005 9:04 PM
To: 'Kenneth Sole'; spambayes at python.org
Subject: RE: [Spambayes] Duplicate messages handled differently...?
> I have noticed that I very frequently receive two identical
> messages and that one of them is moved to my Spam folder
> while the other is moved to my Review folder.
>
> This is no great inconvenience, but I am perplexed by this
> aspect of Spambayes.
To answer this we (or you) really need to see the clues for the
message.
Next time this happens (before you do any training on the messages)
select
them and choose "Show spam clues for this message" from the SpamBayes
menu.
That will pop up a message with the clues for the selected message.
If you examine the clues, you'll probably be able to see the
difference (and
so hopefully understand why and what to do about it), but if you're
stuck,
feel free to forward a copy on to the list and we'll give it a go.
=Tony.Meyer
--
Please always include the list (spambayes at python.org) in your replies
(reply-all), and please don't send me personal mail about SpamBayes.
http://www.massey.ac.nz/~tameyer/writing/reply_all.html explains this.
More information about the Spambayes
mailing list