RE: SARE_FORGED_EBAY fp/question

[Gary Smith]

Title: SARE_FORGED_EBAY fp/question

Under the SARE rule anything from ebay.com with a link of (something ebay.com) hits the rule.  It should be changed to @ebay.com for the From.  This would make more sense and reduce the FP’s.     header   __RCVD_EBAY           Received =~ /(?:email)[EMAIL PROTECTED]/i header   __FROM_EBAY           >From =~ /ebay\.com/i uri      __URI_EBAY            /ebay\.com/i   Gary Wayne Smith     From: Gary Smith [mailto:[EMAIL PROTECTED] Sent: Tuesday, July 13, 2004 4:16 PM To: [EMAIL PROTECTED] Subject: SARE_FORGED_EBAY fp/question   Hello, I have an email that ends with granitebay.com.  It’s coming in as a forged ebay fp in SARE. X-Spam-Level: ************************************************** X-Spam-Status: Yes, hits=91.3 required=4.8 tests=BAYES_00,HTML_50_60,         HTML_MESSAGE,SARE_FORGED_EBAY autolearn=no version=2.63 X-Spam-Report:         *  0.1 HTML_MESSAGE BODY: HTML included in message         *  0.1 HTML_50_60 BODY: Message is 50% to 60% HTML         *  -11 BAYES_00 BODY: Bayesian spam probability is 0 to 1%         *      [score: 0.0000]         *  102 SARE_FORGED_EBAY Message appears to be forged, (ebay.com) What’s the best way to approach this or is this a SARE problem? Gary Wayne Smith