Hi, >> Hi, this rule hit a citibank.com email. Adding 1.8 points simply for >> the phrase "your account security" does not seem reasonable. >> >> Apr 24 20:13:18.660 [28524] dbg: rules: ran body rule TVD_PH_SEC >> ======> got hit: "your account security" > > What *else* hit? What was the final total score?
It also hit a secondary RBL for an IP that it shouldn't have, as well as bayes00 and hostkarma_bl, totaling 5.044, making it spam. The IP that was hit was 52.40.63.1, mta1b3.c1-t.msyscloud.com. I would have included that initially, but I figured any one phrase shouldn't be enough to add more than 50% of the points with one rule... In the last hour while going through other quarantined emails, I've discovered a few others: * 1.5 SUBJ_ALL_CAPS Subject is all capitals This one was from an email with an account number in the subject. Apr 24 20:40:33.583 [7613] dbg: rules: ran body rule LOW_PRICE ======> got hit: "Lowest Price" This added 1.5 points to an email discussing reservation pricing, making it spam. Apr 24 21:06:31.842 [17649] dbg: rules: ran body rule FUZZY_XPILL ======> got hit: "х файлах" This added 2.8 points to a legitimate email in Russian. Apparently that resembles "xanax"
