Where does BOOST=4 come from

Getting a false positive and trying to tell where it's coming from.  In the X-spam-status header I see this:

AM:BOOST=4,

 

But I don't know what's causing it.  Googling it implied it was from soft black/whitelisting, but both those lists are empty:

My config has:

 

$MYHOME   = '/home/amavis';

@whitelist_sender_maps = read_hash("$MYHOME/white.lst");

@blacklist_sender_maps = read_hash("$MYHOME/black.lst");

 

Both of those file are empty.

 

Trying to figure out how to whitelist this message, remove it's BOOST.  Postfix, spamassassin, amavisd setup.

 

 

Sample sanitized header:

 

 

Received: from localhost (server [127.0.0.1])

            by host.myserver.com (Postfix) with ESMTP id 6698F47C066

            for <[email protected]>; Fri, 19 Jun 2020 07:40:46 -0500 (CDT)

X-Envelope-From: 

            <01000172cc9859b4-bfd7d980-918b-47a5-8ddb-7a1010251c17-000000@amazonses.com>

X-Envelope-To: <[email protected]>

X-Envelope-To-Blocked: <[email protected]>

X-Quarantine-ID: <KgnQt+S7iDJb>

X-Spam-Flag: YES

X-Spam-Score: 7.637

X-Spam-Level: *******

X-Spam-Status: Yes, score=3.637+4 tag=-999 tag2=5 kill=5 tests=[AM:BOOST=4,

            BAYES_00=-1.9, DCC_CHECK=3.2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1,

            DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001,

            MIME_HTML_ONLY=0.1, MPART_ALT_DIFF=0.79, RCVD_IN_DNSWL_NONE=-0.0001,

            SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no

Authentication-Results: host.myserver.com (amavisd-new); dkim=pass

            [email protected]

Authentication-Results: host.myserver.com (amavisd-new); dkim=pass

            [email protected]

Received: from host.myserver.com ([127.0.0.1])

            by localhost (host.myserver.com [127.0.0.1]) (amavisd-new, port 10024)

            with ESMTP id KgnQt+S7iDJb for <[email protected]>;

            Fri, 19 Jun 2020 07:40:42 -0500 (CDT)

Received: from a45-6.smtp-out.amazonses.com (a45-6.smtp-out.amazonses.com [54.240.45.6])

            by host.myserver.com (Postfix) with ESMTP id 1482E47C06E

            for <[email protected]>; Fri, 19 Jun 2020 07:40:39 -0500 (CDT)

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

            s=4aqwcm4cthtcxpw5amkq34vbpxkeu3of; d=mailsender.sentinelone.net;

            t=1592570436;

            h=Content-Type:MIME-Version:From:To:CC:Subject:Date:Message-ID;

            bh=CJuVXyyQhlHFqbzbsMCKE08Eew3h1G5drC9oXm4ri6M=;

            b=VILuXpOdwhkT74BaBoD3sPMMMjm5QTah38hd6yADtFlFN/Rw8/xJb4RRp0peq+5o

            NppsDFWzqVNu1ZEIBMZLOoTTIHtt14qZh+i6q9NkfuteqLKvEo9mbxfFnvffD9RLO20

            CMq2xLr41RSodtuoRM6SbHKYup2VP3EgDcVNyWik=

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

            s=224i4yxa5dv7c2xz3womw6peuasteono; d=amazonses.com; t=1592570436;

            h=Content-Type:MIME-Version:From:To:CC:Subject:Date:Message-ID:Feedback-ID;

            bh=CJuVXyyQhlHFqbzbsMCKE08Eew3h1G5drC9oXm4ri6M=;

            b=G7htp+IVbtPuo8NmQ66oOmzJ7Vp7PYIkFMjGHL0kW6pruPdRp9wDBMdsrrMr8Ofu

            Nbd9AIXCh6EwneeP2wWdg2Sl4aU9PEwtLIn94e7tep2ZdIWl0+KiJ2W7+J/ObrHNCwK

            RWw2lzLi75C8w7SC4ocJCtRTDXRQodbGvVkR9LC8=

Content-Type: multipart/related; boundary="===============5832875303154978121=="

MIME-Version: 1.0

From: "SentinelOne" <[email protected]>