false positive?

[Steve Thomas]

On Tue, Aug 12, 2003 at 10:16:19AM -0500, mikea is rumored to have said:
>
> This rule triggers on data like "msn.com" or "cs.com" followed by a
> left parenthesis. I suppose that this rule is designed to catch spam
> with a "Received:" header falsely claiming to be from one of those
> ISPs, and that none of them ever appears as a bare <foo>.com for <foo>
> in the rule above, but rather as <something>.<foo>.com.
>
> I've seen it trigger falsely a few times, but not a whole lot.

I have an account @lycos.com which forwards to my regular e-mail. Every message that gets forwarded hits on this rule, which pushes most non-spam messages over the edge. I guess I'll go open a bugzilla report on it...


--
"Manuscript: something submitted in haste and returned at leisure."
- Oliver Herford (1863-1935)