On Tue, 14 May 2019 15:35:43 +0200 Matus UHLAR - fantomas wrote: > On 14.05.19 06:18, cyflhn wrote: > >but what about this one "FREEMAIL_FORGED_REPLYTO". why it got 2.1 > >score? > > this is standard rule where mail pretending to come from one freemail > service really comes from another freemail service.
It's based on a freemail Reply-To with a *non*-freemail From address. It's a common pattern seen in fraud spams where a disposable account is used for receiving replies.
