Re: Phishing rules?
Joseph Brennan <email@example.com> writes:
>> Reply-to: [email]firstname.lastname@example.org[/email][/color]
> First pass:
> header LOCAL_REPLYTO_LIVE Reply-to =~ /\@live\.com/
> score LOCAL_REPLYTO_LIVE 8.0
> Maybe scoring 8.0 for one thing scares you, but I haven't seen this
> fp in a couple of months.[/color]
Is live.com a legitimate email sender? It looks microsoft related. If I
set it to 8, then any mail from that address is surely to get caught as
spam, which may not be the right thing depending on other potential
legitimate addresses sending from that domain.
Or perhaps nothing but spam comes from live.com? I dont know anything