On 2/19/2018 12:20 PM, John Hardin wrote:
Are those getting hits on SPOOFED_FREEM_REPTO_CHN?

No, not seeing that one. After enough training I eventually see it land in Bayes. The RBLs are starting to flag it.

X-Spam-Status: Yes, score=5.7 required=5.0 tests=BAYES_99,BAYES_999,
    FREEMAIL_FROM,RCVD_IN_BRBL_LASTEXT autolearn=no version=3.3.1

The subject and body are offering "image editing". The From is forged. But the Reply-to is consistent.

Reply via email to