On Tue, 2010-04-27 at 02:16 -0400, Alex wrote:
> Hi,
>
> >> Here's an example:
> >>
> >> http://pastebin.com/h9JwTQ9T
> >>
> >> The score is very low. Does someone have an idea of other
> >> characteristics that I can flag on?
> >>
> > Hits for me on this:
> > Sanesecurity.Junk.22048.UNOFFICIAL FOUND
>
> Ah, very good. I think that might be what I'm missing. How are you
> implementing this? From here?
>
> http://www.sanesecurity.co.uk/download_scripts_linux.htm
>
> Or are you using the clamav SA plugin-in?
Using clamav-milter ahead of SA with Postfix with SANE but any
implementation that uses clam/sane will do the same.
>
> I'm using amavisd with clam-0.96 and sa-3.2.5.
>
> > 9.0 RELAYCOUNTRY_FR Relayed through France
> > 5.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
>
> I wish I could use scores like that :-)
>
> Might as well just block all of \.fr at smtp time for that matter :-)
> Poor France :(
I mostly do....... au revoir Le France....
>
> Thanks,
> Alex
