I received a false positive that hits DOMAIN_RATIO. It is an "image only" type message from AOL. The only domain in the body is in the Content-ID in the img src. Has anyone else seen similar FPs?

The message is attached, with irrelevant personal info removed.

Stuart Johnston
Return-Path: <[EMAIL PROTECTED]>
Received: from [EMAIL PROTECTED]
        by imo-m21.mx.aol.com (mail_out_v37_r3.8.) id l.146.3b935de4 (18403)
         for <[EMAIL PROTECTED]>; Mon, 3 Jan 2005 18:37:31 -0500 (EST)
From: [EMAIL PROTECTED]
Message-ID: <[EMAIL PROTECTED]>
Date: Mon, 3 Jan 2005 18:37:31 EST
Subject: curtis
To: [EMAIL PROTECTED]
MIME-Version: 1.0
Content-Type: multipart/related; boundary="part1_146.3b935de4.2f0b313b_boundary"
X-Mailer: 9.0 for Windows sub 5038
X-Spam-Status: Yes, hits=7.72 tagged_above=0 required=6.31
 tests=ADDR_NUMS_AT_BIGSITE, BAYES_50, DOMAIN_RATIO, HTML_90_100,
 HTML_IMAGE_ONLY_04, HTML_MESSAGE, MIME_HTML_MOSTLY, MIME_QP_LONG_LINE,
 MPART_ALT_DIFF, NO_REAL_NAME
X-Spam-Level: +++++++
X-Spam-Flag: YES
X-Spam-Report: Spam detection software, running on the system 
"gateway.ebby.com", has
 identified this incoming email as possible spam.  The original message
 has been attached to this so you can view it (if it isn't spam) or label
 similar future email.  If you have any questions, see
 the administrator of that system for details. Content preview:  [...] 
 Content analysis details:   (7.7 points, 5.0 required)
 pts rule name              description
 ---- ---------------------- --------------------------------------------------
 0.0 NO_REAL_NAME           From: does not include a real name
 0.1 ADDR_NUMS_AT_BIGSITE   Uses an address with lots of numbers, at a big ISP
 3.2 DOMAIN_RATIO           BODY: Message body mentions many internet domains
 0.0 HTML_90_100            BODY: Message is 90% to 100% HTML
 1.0 MIME_HTML_MOSTLY       BODY: Multipart message mostly text/html MIME
 0.0 HTML_MESSAGE           BODY: HTML included in message
 0.0 BAYES_50               BODY: Bayesian spam probability is 40 to 60%
                            [score: 0.4798]
 0.1 MPART_ALT_DIFF         BODY: HTML and text parts are different
 3.3 HTML_IMAGE_ONLY_04     BODY: HTML: images with 0-400 bytes of words
 0.0 MIME_QP_LONG_LINE      RAW: Quoted-printable line longer than 76 chars


--part1_146.3b935de4.2f0b313b_boundary
Content-Type: multipart/alternative; boundary="146.3b935de4_alt_bound"


--146.3b935de4_alt_bound
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit



--146.3b935de4_alt_bound
Content-Type: text/html; charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

<HTML><HEAD><META charset=3DUS-ASCII http-equiv=3DContent-Type content=3D"te=
xt/html; charset=3DUS-ASCII"></HEAD>
<BODY style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial; BACKGROUND-COLOR: #fffff=
f"><IMG SRC=3D"cid:[EMAIL PROTECTED]"  height=3D360 width=3D480 ID=
=3D"MA1.1104795411" DATASIZE=3D"62791"></BODY></HTML>

--146.3b935de4_alt_bound--

--part1_146.3b935de4.2f0b313b_boundary
Content-ID: <[EMAIL PROTECTED]>
Content-Type: image/jpeg; name="curtis13.jpg"
Content-Disposition: inline
Content-Transfer-Encoding: base64

iVBORw0KGgoAAAANSUhEUgAAAHwAAAAjCAMAAABhGJ6uAAABg1BMVEV/f3/+AG/9AE/+ADWt
APzLAP79AMv+AOP+ABr+BgbkAP+OAPxwAP2iA2D+GQFYBG/9MwH/6ACriwhQAPxwA5VzBhcH
BgcOAPovAP3uzwGkA48QAW4GADb8SwCsBBb7YwCuSgYTDw6OAisLAIoNALwzBFCNBRXdAG7c
A6pWBhONAsNGAqR3A0BxVQyNagqnAjqsAsNPKwaEOAnJAtoyDgLkASRyKQTHBxHQATfVUgKa
Hgv6+ffKLgP8kQA4AdTRsgVmAs3q6OWWk4ZtaVt8fWXgA+NDQ0NYBDe+uqlRUEvv7+/kBQvm
HwQhISGvrJVfX18uLi1wcG/2ZiCNjnP8yKP+8+ONjIajl5GXl5XTdwT0qwGam5vsuJvPz8/c
18jLx8Cwr67nkmbf4N/+AK76APr95e39qla/v7/039CDgoFrLTONkJD7mSLqZ2Hxyl7KcjPN
ilfVtEDWkvOXZWVfeJJheZIpUnoRP24FN2hEZocGOGk2W4H9/v8bR3Q8YIMAM2b+AI73D2vX
AAAAAXRSTlMAQObYZgAAAAFiS0dEAIgFHUgAAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElN
RQfUBw0BDBi7Kk05AAAGVElEQVR42sVW53PaZhzWXoAkhsQWiD3NMMNgA8Z2cPBM4oxmOEkj
XdN9117v+hH96X1enLbx9Yvd2qmOl3Ucz+991iuK+uf1kPq/rm3q4+WXAzu9hrW9pA4+Uudf
DH1lv/2M8rfUw+eLK+KffZG9r+x3f364fPv+4eLhNkWNJp1Mdkd/cu/w71er1cWn93t7Bxcv
5pQlG/JxX5ZL6UzmzdP75eAU8Ms53pw9en9+djGnGLbF5BimJMvqWE+Puk8mP27fG/qlCfhH
HyjqaPnDV/tzyik7AccLMAxrSHLpWNX1wctXr36+L/jHQF+Zb6n5cv90vudqriaKwC/TYICV
jsfpdGZwoqcz94M+J9yvVvvL0+V8j9M4no+4othwyh5N05Yky4YkyWoVQ3x7H/BHizW8+fho
zz+t+3wazz8Q3YQgOA2aYfs0RLBkeTiACe9l+xe/rfHPC9F8OLwLfK7mum7bcTyvgdViGAsZ
sCxV7755eqcbPzqCo9+Za/hVPlqIhcNFX4Tj+IQrChVRFA7hAQYZYNnhUFatzrM7zOCHxdJe
2KePDq7wzSTBn/r9uzyvKJqitMW1B1seXS4jBmlEMJv55pu7qbrHX71eLpaPKOrXZPL3q/0X
otFYLOn3kYvTeAUerAiCEPDKQ0mukhYYTCYvB6PJq/9GwvaL/Rfn+88XBxTFRfy70eQV/CpZ
iIH/1NoCXAQZUEgKWzR9CAcaqt47VlV9p4saIFH8+l8G/fLs7OD14vU59atb4zV/eBrLf8JP
wX/RGPDrfliQ4zaVhuAUBaeyxbBVkoGSrqezLUkqZbOTfyPD5fw5jpS97/aOKKciuEXO54Pa
4dQn/6WSRIF8bDoN++FCGEBx3YTjHSIIOZaVJMOjAyVw0LFk9aT79M2t7X52Qe2BdabsOEWl
zXNcmyuG84XUJwLMVJQwEJtCAbQQpwHedYkHPboBI2whBTgQtlDH6k439Muz+W1UX1DU/keK
ko8Z+lBIiK67qWi+Ogjw/ykAKMin1iEIh/0+jo/gAXxBgxEwA+HBIGVEdBiVVH3800+3KVms
b9MSW/XKFQfhjigIeg0613eLfw2wyhfyICHsx2BF9MBm3ccV0cUBFBLc4JQDEMLCCAxe5du2
8Y5qsUyA9gJeQEwoSkLheZig7p9+NoAJG0ajBTCwCxrIDBpZwE9UQELOWXei1zK6T0aD24Cb
mREOEpbNMQ3AiwlRdDWF/DkYmCb/HmCVSuWjyeiaBT9ZER9+QrwIEjCHmGhh6/LJeIjzsFe1
xvaN4LMDfazKVZCXc3C0O0JAdGvwOF9DCsJTrWiuPp8hWSBpKJBG9tdJH6wdyWsCNl9uERcY
AXI4jUOz3k3gR5NsOquPZYmmcah6AQEWFDECx+Ovazzn89e11LURTDJELIlOysfCdYxRRC+7
kQcwZKPtCkKlG5yF4sHZzbb/cpIdpXXQbzBXDgAHAtjUFDxF+LbCR3hfuxYpplbXL6iRXB+M
fl8eoYjUwQL/fTwUCgbJCjZvBN972Z1AfkuS2D5Db+FEuaIgsdYhIbZdpegqmzVSfBqmKBbt
61OYhUIhT/r5+3i8GSQruAH4Wedm5mu+2tD1qioPJSlHOKBBAO7wvDLxghAQiB3FNh95oPBw
BA89oEmknk9d48PuNJvxeGgWjAM6DvzQDb3fszMZor96LJMRSjhP6BZ58lpkEjycyqZbE8TK
A6UmukrbdRVUg8b5NiGMsqlFtKJtXtmj19sIzULBjY14sHfT7GWz3Uw3o3fhAFUuSf0+7mqH
fXZrTYUBP5YrIu53EoIYcQRRE7AwhFLDB0S1jSGaQcL2DJtudnqrXscOzW4Vfio76mQyg7S+
o1ZVaaziPC/JkoU6ZNHoUIGmWxACRDQ8zzkUNyEJvWamgq5ux+H0+Cy4AdWDTZgvdPvTz7bN
bDeb7qX1QXqs6+MTFX1gHEuSBRVYdov2GgxNQxraIPFI9FGV+BL2EJvgG5I347B8/HYbv85C
1x50qC7EgBvAxclAVS2GaSEYZboBQENCP9IBhi4bMthhmRxxRxxSA7sZCnXu5ObL7FF2r9dN
ZwfpHZhgoJ/kcKjKknECQqQS5igbw2HVsCS7THudWTO0YdvU3V+m2ZD7Zm9gl/q5jmHYvapp
VKtWqUqZdtUGpGman//+D5Sma5XYAO2BAAAAAElFTkSuQmCC

--part1_146.3b935de4.2f0b313b_boundary--

Reply via email to