01 · Detects
Adaptive Detection
→ MORE
No static filter. No manual rule tuning.
ICN learns continuously from delivery outcomes, sender behaviour, and network feedback. Drift and anomalies are detected before they cause damage.
An adaptive delivery decision system that controls, optimises, and stabilises email flows in real time — fully automated, with no manual intervention.
ICN evaluates every inbound message and writes the result into the mail header. From there you filter on your own mail server — for example with Sieve — deciding what goes where. You stay in control.
Four headers are provided for filtering. Three of them use a star scale from one to ten — the more stars, the higher the risk. Clean messages carry no header at all.
| Header | Meaning | Value |
|---|---|---|
X-ICN-Level |
Overall risk of the message across all checks. The primary measure for general sorting. | ★ 1–10 |
X-ICN-BEC-Level |
Suspicion of targeted fraud (CEO fraud, fake bank details, fraudulent payment requests). | ★ 1–10 |
X-ICN-Spam-Level |
Classic spam score derived from content and reputation checks. | ★ 1–10 |
X-ICN-Quarantine |
Only present when ICN has classified the message as quarantine. Contains the reason. | present / absent |
***** (5 stars) matches at 5 or more stars —
because a message with 8 stars contains the 5-star substring.
This lets you conveniently filter "from level X upwards".
Copy the rules into your Sieve script and adjust the threshold and
target folder as needed. The examples use :contains —
which matches "this star count or higher".
Moves clearly identified spam into a junk folder.
Highlights potential fraud attempts — routed to a warning folder instead of the inbox so they stand out.
Everything ICN has quarantined lands in a dedicated folder for later review.
Finer sorting by overall risk: high risk to quarantine, medium to a review folder, the rest delivered normally.
X-ICN-Spam-Level. Your "from X stars" rules simply won't
fire — the message stays in the inbox. Exactly as intended.
Rule order matters: using stop after filing a message
prevents subsequent rules from acting on it again. Put your strictest
rules (quarantine, BEC) at the top.
In addition to the filter headers, ICN writes further X-ICN-*
headers containing detailed information (authentication, reputation,
scoring). These are intended for transparency and traceability — they do
not need to be evaluated for filtering purposes.