Sanesecurity.Phishing.Cur.162 is too lose. It triggered on someone's signature which contained a link to their home page, so it matched ...http://{-50}/~ then their address in the following line was in Halifax in Canada which matched the rest of the signature. Tony. -- f.anthony.n.finch <dot@xxxxxxxx> http://dotat.at/ GERMAN BIGHT HUMBER: SOUTHWEST 5 TO 7. MODERATE OR ROUGH. SQUALLY SHOWERS. MODERATE OR GOOD.