Re: FREEMAIL_REPLY

[Jason Bertoch]

On 2010/03/22 12:26 PM, John Hardin wrote:

On Mon, 22 Mar 2010, Jason Bertoch wrote:

Should FREEMAIL_REPLY really be looking in attachments

Sure. Just looking at the presence of freemail domains, there's nothing
to distinguish the mail you got an FP report on from 419 spams that put
the pitch and reply address in an attachment.

What else hit on that message?

--
/Jason

I understand the benefit of looking in attachments, but wonder if it would make a difference in masscheck results to separate the two cases. The message also hit on FREEMAIL_ENVFROM_END_DIGIT, BAYES_50, and MPART_ALT_DIFF pushing the score to 5.1. I posted a question about scoring of FREEMAIL_ENVFROM_END_DIGIT directly to the dev list as I didn't feel it made much sense here.

smime.p7s
Description: S/MIME Cryptographic Signature