Help from you all: We've setup the following individual filters for major banks that are phising scams (and ebay.com)
Do you see any problems with using the following (we mark as SPAM at weight 70): HEADERS END NOTCONTAINS wellsfargo.com BODY 0 CONTAINS .wellsfargo.com SUBJECT 30 CONTAINS account REVDNS 50 NOTENDSWITH .wellsfargo.com #Give weight back for users that forward or use reply for REAL email from wellsfargo.com SUBJECT -40 STARTSWITH re: SUBJECT -40 STARTSWITH fwd: SUBJECT -40 STARTSWITH fw: Citibank uses different REVDNS from what we've noticed. The envelope from is "generally" @citibank.com and the REVDNS is .ssmb.com OR .citibank.com or .citicorp.com How do you all deal with this? Same with SearsCard.com... they are also Citibank and coming from ssmb.com --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
