Hello list,

one of my users received this message:
http://pastebin.com/m2d3ad435

and it scored like that:
X-Spam-Status: Yes, score=12.501 tagged_above=-999 required=5
tests=[BAYES_00=-2.599, DATE_IN_PAST_12_24=0.992, EXTRA_MPART_TYPE=1,
HTML_MESSAGE=0.001, INVALID_DATE=1.245, MIME_QP_LONG_LINE=1.396,
MY_CID_AND_ARIAL2=1.46, MY_CID_AND_CLOSING=1.6, MY_CID_AND_STYLE=1.54,
MY_CID_ARIAL2_CLOSING=1.63, MY_CID_ARIAL_STYLE=1.58,
PART_CID_STOCK=1.635, SA2DNSBLC=0.001, T_TVD_FW_GRAPHIC_ID1=0.01,
URI_SPACE=1.01]

12.5 points is a lot. And again the message was from VDE and 70_sare_stocks
hit at it. Is 70_sare_stocks still useful?

My rankings from today:
%4.38 MY_CID_AND_STYLE=1.54
%2.89 MY_CID_AND_ARIAL2=1.46
%2.89 MY_CID_ARIAL_STYLE=1.58
<%1.0 MY_CID_AND_CLOSING=1.6
<%1.0 MY_CID_ARIAL2_CLOSING=1.63

I suppose the problem is that MY_CID_ARIAL_STYLE is a subset of
MY_CID_AND_STYLE. Also is MY_CID_ARIAL_STYLE a subset of MY_CID_AND_ARIAL2.
And MY_CID_AND_CLOSING is a subset of MY_CID_ARIAL2_CLOSING which is a subset
of MY_CID_ARIAL_STYLE.

That seams complicated. I try to present it in some kind of a tree:
MY_CID_AND_STYLE MY_CID_AND_ARIAL2 MY_CID_AND_CLOSING
| | |
+---MY_CID_ARIAL_STYLE---+---MY_CID_ARIAL2_CLOSING---+


So, if one of the rules in the second level fire, then at least two other
rules will also fire and the message get approx. 4.5 points. Isn't that too
much?

Any comments or suggestions are welcome.

Greetings
Stefan

PS: BTW: Shouldn't MY_CID_ARIAL_STYLE be labeled MY_CID_ARIAL2_STYLE ?!

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQBJEM/DBiHtkFOLX+gRAqX/AJ9yupQ3uVqQDBcAJMV0wwkW2PYa3ACfeSyq
tg1uJK8wQ/+CX/LBjNSKAbM=
=Ofac
-----END PGP SIGNATURE-----