I recently received a FP complaint on a message that hit FREEMAIL_REPLY. The FP complaint is not in a format that would be useful for posting, but I don't believe that's going to be necessary.
Here's what happened:some_u...@comcast.net saves a web page and sends it as an e-mail attachment to my customer. The attached web page includes a reference to a yahoo.com e-mail address.
I believe the intent of FREEMAIL_REPLY was to catch phishing scams that come from one freemail address, but ask you to reply to another. In that case, a score of 1.9 seems almost generous. Yet in my case, where the second freemail address is contained in an attachment, that score may be a little high. Should FREEMAIL_REPLY really be looking in attachments, or should there be a second rule that deals with this specific case?
-- /Jason
smime.p7s
Description: S/MIME Cryptographic Signature
