A misclassified message caused me to look at the FRT_OPPORTUN1 and
FRT_OPPORTUN2 rules. I think they are much too aggressive. Here is
the summary from a false positive.
Content analysis details: (5.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.6 RCVD_IN_NJABL_PROXY RBL: NJABL: sender is an open proxy
[80.178.151.75 listed in combined.njabl.org]
2.7 ROUND_THE_WORLD_LOCAL Received: says mail sent around the world
(HELO)
2.7 FRT_OPPORTUN2 BODY: ReplaceTags: Oppertun (2)
1.0 FRT_OPPORTUN1 BODY: ReplaceTags: Oppertun (1)
-2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
[score: 0.0078]
Wow! If someone sends a message and misspells oppportunity by using
three letter p's instead of two then they get tagged for 3.7 points!
I think that is way too agressive. Scan this message to observe the
problem.
FRT_OPPORTUN1 and FRT_OPPORTUN2 add up to 3.7 points. Let's look at
those rules.
body FRT_OPPORTUN1 /<inter SP2><post P2>(?!opportun)<O><P><P><O><R><T><U><N>/I
body FRT_OPPORTUN2 /<inter W0><post P2>(?!opportun)<O><P><P><O><R><T><U><N>/I
Huh? How are those rules matching? I am missing something. That
can't the right rule that is being hit here. Can someone educate me
as to what is happening here?
I am running spamassassin 3.2.1 with a current sa-update.
Thanks
Bob
