[IMail Forum] Very odd Statistical filter action

[Dave Riddle]

An email came into the server this morning that the statistical filter 
quarantined as being spam.  The person that sent the email followed the 
directions in our bounce message so we checked the message and redirected 
it to its destination. So far so good.

Now we generally check the spam log to find out why a message gets caught 
(if it is not obvious) and this time it was really odd!

The log shows the filter triggered on the following:

04:09 08:41 SMTP(c1870294020c3cba) performing statistical analysis
04:09 08:41 SMTP(c1870294020c3cba) The following words were used to compute 
the probability email is spam
04:09 08:41 SMTP(c1870294020c3cba)   word = northernmost, probability = 
0.990000
04:09 08:41 SMTP(c1870294020c3cba)   word = fictive, probability = 0.990000
04:09 08:41 SMTP(c1870294020c3cba)   word = colloquy, probability = 0.990000
04:09 08:41 SMTP(c1870294020c3cba)   word = shutoff, probability = 0.990000
04:09 08:41 SMTP(c1870294020c3cba)   word = anion, probability = 0.990000
04:09 08:41 SMTP(c1870294020c3cba)   word = butyrate, probability = 0.990000
04:09 08:41 SMTP(c1870294020c3cba)   word = locution, probability = 0.990000
04:09 08:41 SMTP(c1870294020c3cba)   word = gesticulate, probability = 0.990000
04:09 08:41 SMTP(c1870294020c3cba)   word = faust, probability = 0.990000
04:09 08:41 SMTP(c1870294020c3cba)   word = tempestuous, probability = 0.990000
04:09 08:41 SMTP(c1870294020c3cba)   word = goldeneye, probability = 0.990000
04:09 08:41 SMTP(c1870294020c3cba)   word = directrices, probability = 0.990000
04:09 08:41 SMTP(c1870294020c3cba)   word = aerodynamic, probability = 0.990000
04:09 08:41 SMTP(c1870294020c3cba)   word = eleazar, probability = 0.990000
04:09 08:41 SMTP(c1870294020c3cba)   word = chromatogram, probability = 
0.990000
04:09 08:41 SMTP(c1870294020c3cba) probability email is spam 1.000000: 
email is spam

However, the email that was examined did not have ANY of those words in 
it!  That includes looking at the email as displayed or doing a View Source 
on the email and looking through the HTML.

Anyone seen this type of behavior before?

Running 8.1HF1

To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/