Title: SARE_FORGED_EBAY fp/question

Under the SARE rule anything from ebay.com with a link of (something ebay.com) hits the rule.  It should be changed to @ebay.com for the From.  This would make more sense and reduce the FP’s.

 

 

header   __RCVD_EBAY           Received =~ /(?:email)[EMAIL PROTECTED]/i
header   __FROM_EBAY           >From =~ /ebay\.com/i
uri      __URI_EBAY            /ebay\.com/i
 
Gary Wayne Smith

 

 


From: Gary Smith [mailto:[EMAIL PROTECTED]
Sent: Tuesday, July 13, 2004 4:16 PM
To: [EMAIL PROTECTED]
Subject: SARE_FORGED_EBAY fp/question

 

Hello,

I have an email that ends with granitebay.com.  It’s coming in as a forged ebay fp in SARE.

X-Spam-Level: **************************************************

X-Spam-Status: Yes, hits=91.3 required=4.8 tests=BAYES_00,HTML_50_60,

        HTML_MESSAGE,SARE_FORGED_EBAY autolearn=no version=2.63

X-Spam-Report:

        *  0.1 HTML_MESSAGE BODY: HTML included in message

        *  0.1 HTML_50_60 BODY: Message is 50% to 60% HTML

        *  -11 BAYES_00 BODY: Bayesian spam probability is 0 to 1%

        *      [score: 0.0000]

        *  102 SARE_FORGED_EBAY Message appears to be forged, (ebay.com)

What’s the best way to approach this or is this a SARE problem?

Gary Wayne Smith

Reply via email to