On Sun, 2008-11-02 at 22:36 -0500, Micah Anderson wrote: > Joseph Brennan <[EMAIL PROTECTED]> writes: > > >> Reply-to: [EMAIL PROTECTED] > > > > > > First pass: > > > > header LOCAL_REPLYTO_LIVE Reply-to =~ /[EMAIL PROTECTED]/ > > score LOCAL_REPLYTO_LIVE 8.0 > > > > Maybe scoring 8.0 for one thing scares you, but I haven't seen this > > fp in a couple of months. > > Is live.com a legitimate email sender? It looks microsoft related. If I > set it to 8, then any mail from that address is surely to get caught as > spam, which may not be the right thing depending on other potential > legitimate addresses sending from that domain. > The latest pharmacy scam to get through my filters has a URI that matches: ^http:.*\.spaces\.live\.com\/$
in its body but the From: header identifies a completely unrelated address. Would a rule that tags messages with this From and URI combo be useful or would it generate too many FPs? Martin