Re: TVD_PH_SEC score problem

2017-04-24 Thread nobs
It happened again. This is a kind of a recursion bomb ;-) Am 25.04.2017 um 03:35 schrieb Alex: > Pkte Regelname Beschreibung > -- -- > 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was > b

Re: TVD_PH_SEC score problem

2017-04-24 Thread Bill Cole
On 24 Apr 2017, at 21:35, Alex wrote: Hi, Hi, this rule hit a citibank.com email. Adding 1.8 points simply for the phrase "your account security" does not seem reasonable. Apr 24 20:13:18.660 [28524] dbg: rules: ran body rule TVD_PH_SEC ==> got hit: "your account security" What *else* h

Re: TVD_PH_SEC score problem

2017-04-24 Thread John Hardin
On Mon, 24 Apr 2017, Alex wrote: Hi, Hi, this rule hit a citibank.com email. Adding 1.8 points simply for the phrase "your account security" does not seem reasonable. Apr 24 20:13:18.660 [28524] dbg: rules: ran body rule TVD_PH_SEC ==> got hit: "your account security" What *else* hit? W

Re: TVD_PH_SEC score problem

2017-04-24 Thread Alex
Hi, >> Hi, this rule hit a citibank.com email. Adding 1.8 points simply for >> the phrase "your account security" does not seem reasonable. >> >> Apr 24 20:13:18.660 [28524] dbg: rules: ran body rule TVD_PH_SEC >> ==> got hit: "your account security" > > What *else* hit? What was the final tot

Re: TVD_PH_SEC score problem

2017-04-24 Thread John Hardin
On Mon, 24 Apr 2017, Alex wrote: Hi, this rule hit a citibank.com email. Adding 1.8 points simply for the phrase "your account security" does not seem reasonable. Apr 24 20:13:18.660 [28524] dbg: rules: ran body rule TVD_PH_SEC ==> got hit: "your account security" What *else* hit? What wa

TVD_PH_SEC score problem

2017-04-24 Thread Alex
Hi, this rule hit a citibank.com email. Adding 1.8 points simply for the phrase "your account security" does not seem reasonable. Apr 24 20:13:18.660 [28524] dbg: rules: ran body rule TVD_PH_SEC ==> got hit: "your account security" Thanks, Alex

Re: Writing a rule to match a header name and value

2017-04-24 Thread John Hardin
On Mon, 24 Apr 2017, Geoff Soper wrote: I'm trying to write a rule that matches both the name of a header and its value. I've had no luck so far, can somebody point out my mistake? My current attempt is: header __GS_PHP_ORIG ALL =~ /^X-PHP-Originating-Script: [0 -9]+:(Mailer|Sendmai

Writing a rule to match a header name and value

2017-04-24 Thread Geoff Soper
I'm trying to write a rule that matches both the name of a header and its value. I've had no luck so far, can somebody point out my mistake? My current attempt is: header __GS_PHP_ORIG ALL =~ /^X-PHP-Originating-Script: [0 -9]+:(Mailer|Sendmail|Api).php/i An example line is: X-PHP-Or