Hi Ernie,

It looks like Josh was able to get a copy of the message and was able to 
forward it to [log in to unmask]

I could speculate on why this particular message tripped the spam 
threshold, but I'm not sure it would be helpful, as we're not likely to 
get confirmation.  The more complicated spam filtering gets, the more 
machine learning that gets involved in the process, the less human 
understanding of "why" we can arrive at.

I will report this message up to Proofpoint (that's what happens with 
all the false positives that go to [log in to unmask]), and they'll use it 
to retrain their classifiers.  Hopefully that means less of this 
particular author's style will get tagged as spam in the future.


On 4/20/20 10:09 AM, Ernest Buford wrote:
> A subscriber had a post to flagged as spam this morning, 
> triggering an “approval required” email to the list owner (me). 
> Headers on the forwarded message were difficult to examine (Outlook 
> would not display them, but I can see them when I save and open the 
> original message in Apple Mail), and determining why it was flagged 
> also proves challenging. This appears to be the relevant header section:
> X-Proofpoint-Spam-Details: ⁨rule=puremessage_like_spam 
> policy=puremessage_like score=99 priorityscore=308 mlxscore=99 
> lowpriorityscore=0 phishscore=0 clxscore=178 malwarescore=0 
> bulkscore=0 impostorscore=0 spamscore=99 mlxlogscore=-202 adultscore=0 
> suspectscore=1 classifier=spam adjust=0 reason=mlx scancount=1 
> engine=8.12.0-2003020000 definitions=main-2004200103⁩
> What takes this particular post over the spammy edge? The author is a 
> gifted writer, who has been posting near daily journals – what he 
> describes as “sort of an analgesic against the Covid quarantine”. 
> Today’s message (like a similar message from 2 days ago) has the date 
> and location in the Subject line (“April 20, 2020: …”), and the body 
> begins with the time (“5:33 a.m.”). Is it something special about 
> today’s date, or did he just hit upon the wrong combination of numbers 
> and punctuation to make the email appear to be spam?
> Ernie
Jim Lawson
HPC/Linux sysadmin
Systems Architecture & Administration
Enterprise Technology Services
University of Vermont
Burlington, VT USA