Hi Ernie,

It looks like Josh was able to get a copy of the message and was able to forward it to [log in to unmask]

I could speculate on why this particular message tripped the spam threshold, but I'm not sure it would be helpful, as we're not likely to get confirmation.  The more complicated spam filtering gets, the more machine learning that gets involved in the process, the less human understanding of "why" we can arrive at. 

I will report this message up to Proofpoint (that's what happens with all the false positives that go to [log in to unmask]), and they'll use it to retrain their classifiers.  Hopefully that means less of this particular author's style will get tagged as spam in the future.


On 4/20/20 10:09 AM, Ernest Buford wrote:
[log in to unmask]">

A subscriber had a post to list.uvm.edu flagged as spam this morning, triggering an “approval required” email to the list owner (me). Headers on the forwarded message were difficult to examine (Outlook would not display them, but I can see them when I save and open the original message in Apple Mail), and determining why it was flagged also proves challenging. This appears to be the relevant header section:


X-Proofpoint-Spam-Details: ⁨rule=puremessage_like_spam policy=puremessage_like score=99 priorityscore=308 mlxscore=99 lowpriorityscore=0 phishscore=0 clxscore=178 malwarescore=0 bulkscore=0 impostorscore=0 spamscore=99 mlxlogscore=-202 adultscore=0 suspectscore=1 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2003020000 definitions=main-2004200103⁩


What takes this particular post over the spammy edge? The author is a gifted writer, who has been posting near daily journals – what he describes as “sort of an analgesic against the Covid quarantine”. Today’s message (like a similar message from 2 days ago) has the date and location in the Subject line (“April 20, 2020: …”), and the body begins with the time (“5:33 a.m.”). Is it something special about today’s date, or did he just hit upon the wrong combination of numbers and punctuation to make the email appear to be spam?



Jim Lawson
HPC/Linux sysadmin
Systems Architecture & Administration
Enterprise Technology Services
University of Vermont
Burlington, VT USA