> in 70_sare_spoof.cf some scores are set to 104.
> What is the reason to set such high scores? (I know how to lower them)
The spoof rules are to catch forgeries for things like Paypal and Ebay and
various banks. These are things that people might have whitelisted with a
simple whitelist command. Whitelisting by default gives a score of -100.
These phish checks have not, so far as we know, hit any FPs recently. If
you have some examples, we would dearly like to see them.
Since these aren't known to FP, and since many phish look somewhat
convincing to a nieve user, we felt it was best to override any possible
simple whitelist on the name of the sender.
Loren
