On 03.03.16 16:54, RW wrote:
>RCVD_NUMERIC_HELO is an independent deep check and overlaps heavily
>with either FSL_* rule.
On Thu, 3 Mar 2016 17:59:33 +0100
Matus UHLAR - fantomas wrote:
I wouldn't say so, at least on my system.
% zcat /var/log/mail*.gz | cat - /var/log/mail /var/log/mail.1 | grep
RCVD_NUMERIC_HELO | grep -c FSL_HELO_BARE_IP 5
% zcat /var/log/mail*.gz | cat - /var/log/mail /var/log/mail.1 | grep
RCVD_NUMERIC_HELO | grep -vc FSL_HELO_BARE_IP 36
On 03.03.16 17:53, RW wrote:
That probably because in mailing lists you can have RCVD_NUMERIC_HELO
on its own.
What do you get the other way around? FSL_HELO_BARE_IP without
RCVD_NUMERIC_HELO.
Ok, filtered a bit more
1x FSL_HELO_BARE_IP (also hit RCVD_NUMERIC_HELO)
14x RCVD_NUMERIC_HELO
that doesn't tell much about proper score, but they don't overlap ;-)
--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
WinError #99999: Out of error messages.
