The base rules in this set aren't bounded at the front. I got a false positive* on FVGT_m_FORGED_EBAY from a site called azurebay.com.
For now I've dropped the scores to 1.0 until I have a chance to do further testing, and put \b at the beginning of each ebay rule. (I figure duplicates with paypal or citibank are less likely). * I won't say for sure that it wasn't spam, because it would have scored 6.5 even without this ruleset and showed up in both Razor and DCC. However, it definitely wasn't pretending to be from eBay, so the score of 110 (I assume to counteract whitelisting) is a bit excessive. -- Kelson Vibber SpeedGate Communications, <www.speed.net>
