I just received a mistagged-ham report from a customer showing two stock
rules hit on a legitimate email from ING Direct - total score was 6.4,
even with -3.5 from BAYES_00. I've asked if I can pass the message on
for analysis.
Stock scores:
score TVD_PH_SUBJ_ACCOUNTS_POST 2.602 2.607 2.497 3.099 # n=2
score TVD_SUBJ_ACC_NUM 0.001 2.199 2.199 2.198 # n=1
I've dropped them down like so:
score TVD_PH_SUBJ_ACCOUNTS_POST 1.1 1.1 1.0 1.5
score TVD_SUBJ_ACC_NUM 0.001 1.199 1.199 1.198 # n=1
The full set of hits (mostly stock rules, the ones that aren't have low
advisory scores):
Content analysis details: (6.4 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
1.0 SUBJ_YOUR_DEBT Subject contains "Your Bills" or similar
2.2 TVD_SUBJ_ACC_NUM Subject has spammy looking monetary reference
3.1 TVD_PH_SUBJ_ACCOUNTS_POST TVD_PH_SUBJ_ACCOUNTS_POST
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.1 PERSONAL_INFO_11 BODY: PERSONAL_INFO_11
-3.5 BAYES_00 BODY: Bayes spam probability is 0 to 1%
[score: 0.0000]
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.1 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of
words
0.0 TO_EQ_FM_HTML_ONLY To == From and HTML only
0.0 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX
1.7 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX
-kgd
