At Fri Sep 19 22:49:39 2003, Carl R. Friend wrote: > body UNMONITORED_EMAIL /unmonitored e-mail address/i > describe UNMONITORED_EMAIL States that the address is not monitored > > score UNMONITORED_EMAIL 3.7 > > Yes, I know that the 3.7 for "UNMONITORED_EMAIL" seems a wee on > the high side, but I really can't imagine a human using that syntax > in an inter-personal e-mail unless he's talking about filtering > rules (and there you have a chicken-and-egg problem). > > For what it's worth, I've looked a _real_ notes from MS, and this > week's says that there's a hoax going around and it's not from them. > The wording and grammar are quire different from that of the worm.
I'm pretty sure that I've seen legitimate mail from MS in the past that uses wording that's at least similar to "Do not reply to this message, it is sent from an unmonitored e-mail address". I'd expect that's why that text is included. Of course, I can't find any examples at the moment. If that text does occur in some legitimate communications from MS (security bulletins, newsletters, etc), there's a significant risk of FPs with a score of 3.7, unless those messages are whitelisted. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see http://counter.li.org | mirror it ;)" - Linus Torvalds _\_V ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
