Matthias Leisi writes: > Hi, > > I went through the RuleQA looking for potential issues with dnswl.org > data, and I found some candidates here: > > http://ruleqa.spamassassin.org/20080124-r614819-n/RCVD_IN_DNSWL_MED?mclog=spam-bb-jm
yep, a spam; a phish, specifically, coming via:
* -4.0 RCVD_IN_DNSWL_MED RBL: Sender listed at http://www.dnswl.org/,
* medium trust
* [212.76.62.164 listed in list.dnswl.org]
Received hdrs look like that's a botnet-infected machine.
--j.
