Under the SARE rule
anything from ebay.com with a link of (something ebay.com) hits the
rule. It should be changed to @ebay.com for the From. This would
make more sense and reduce the FP�s.
header __RCVD_EBAY Received =~ /(?:email)[EMAIL PROTECTED]/i
header __FROM_EBAY >From =~ /ebay\.com/i
uri __URI_EBAY /ebay\.com/i
Gary Wayne Smith
From: Gary
Smith [mailto:[EMAIL PROTECTED]
Sent: Tuesday, July 13, 2004 4:16
PM
To:
[EMAIL PROTECTED]
Subject: SARE_FORGED_EBAY
fp/question
Hello,
I
have an email that ends with granitebay.com. It�s coming in as a forged
ebay fp in SARE.
X-Spam-Level:
**************************************************
X-Spam-Status: Yes, hits=91.3
required=4.8 tests=BAYES_00,HTML_50_60,
HTML_MESSAGE,SARE_FORGED_EBAY
autolearn=no version=2.63
X-Spam-Report:
* 0.1 HTML_MESSAGE BODY:
HTML included in message
* 0.1 HTML_50_60 BODY:
Message is 50% to 60% HTML
* -11 BAYES_00 BODY:
Bayesian spam probability is 0 to 1%
*
[score: 0.0000]
* 102 SARE_FORGED_EBAY
Message appears to be forged, (ebay.com)
What�s the best way to approach
this or is this a SARE problem?
Gary Wayne
Smith
