You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@spamassassin.apache.org by Justin Mason <jm...@jmason.org> on 2008/01/25 11:28:28 UTC

Re: RuleQA - dnswl.org rules

Matthias Leisi writes:
> Hi,
> 
> I went through the RuleQA looking for potential issues with dnswl.org
> data, and I found some candidates here:
> 
> http://ruleqa.spamassassin.org/20080124-r614819-n/RCVD_IN_DNSWL_MED?mclog=spam-bb-jm

yep, a spam; a phish, specifically, coming via:

        * -4.0 RCVD_IN_DNSWL_MED RBL: Sender listed at http://www.dnswl.org/,
        *      medium trust
        *      [212.76.62.164 listed in list.dnswl.org]

Received hdrs look like that's a botnet-infected machine.

--j.

Re: RuleQA - dnswl.org rules

Posted by Theo Van Dinter <fe...@apache.org>.

On Fri, Jan 25, 2008 at 10:28:28AM +0000, Justin Mason wrote:
> yep, a spam; a phish, specifically, coming via:
[...]
> Received hdrs look like that's a botnet-infected machine.

Ditto.

        * -0.0 RCVD_IN_DNSWL_MED RBL: Sender listed at http://www.dnswl.org/,
        *      medium trust
        *      [65.118.208.21 listed in list.dnswl.org]

-- 
Randomly Selected Tagline:
"Euler's Identity ...  the Sine/Cosine thing..."   - Instructor Dean