Re: TVD_RCVD_SINGLE hitting

2019-05-24 Thread John Hardin
On Fri, 24 May 2019, Matus UHLAR - fantomas wrote: On Thu, 23 May 2019, Matus UHLAR - fantomas wrote: I see. This is another case where local clients hit bunch of rules designed to catch remote bots. I'm thinking if I should disable the rule or if it's better to re-write it only to match on

Re: TVD_RCVD_SINGLE hitting

2019-05-24 Thread Matus UHLAR - fantomas
On Thu, 23 May 2019, Matus UHLAR - fantomas wrote: I see. This is another case where local clients hit bunch of rules designed to catch remote bots. I'm thinking if I should disable the rule or if it's better to re-write it only to match on remote (untrusted) hosts. On 23.05.19 14:09, John Ha

Re: TVD_RCVD_SINGLE hitting

2019-05-23 Thread John Hardin
On Thu, 23 May 2019, Matus UHLAR - fantomas wrote: I see. This is another case where local clients hit bunch of rules designed to catch remote bots. I'm thinking if I should disable the rule or if it's better to re-write it only to match on remote (untrusted) hosts. Probably the latter. For a

Re: TVD_RCVD_SINGLE hitting

2019-05-23 Thread Matus UHLAR - fantomas
On Thu, 23 May 2019 19:52:41 +0200 Matus UHLAR - fantomas wrote: >> On 22.05.19 09:34, John Hardin wrote: >> >I'm surprised it's still present - the masscheck corpus spam/ham >> >is > >> >It could probably be safely removed if there's any question about >> >it. >On Thu, 23 May 2019 16:59:01 +02

Re: TVD_RCVD_SINGLE hitting

2019-05-23 Thread RW
On Thu, 23 May 2019 19:52:41 +0200 Matus UHLAR - fantomas wrote: > >> On 22.05.19 09:34, John Hardin wrote: > >> >I'm surprised it's still present - the masscheck corpus spam/ham > >> >is > > > >> >It could probably be safely removed if there's any question about > >> >it. > > >On Thu, 23

Re: TVD_RCVD_SINGLE hitting

2019-05-23 Thread Matus UHLAR - fantomas
On 22.05.19 09:34, John Hardin wrote: >I'm surprised it's still present - the masscheck corpus spam/ham is >It could probably be safely removed if there's any question about >it. On Thu, 23 May 2019 16:59:01 +0200 Matus UHLAR - fantomas wrote: well, the score is still high: score TVD_RCVD_

Re: TVD_RCVD_SINGLE hitting

2019-05-23 Thread RW
On Thu, 23 May 2019 16:50:22 +0100 RW wrote: > On Thu, 23 May 2019 16:59:01 +0200 > Matus UHLAR - fantomas wrote: > > > > On 22.05.19 09:34, John Hardin wrote: > > >I'm surprised it's still present - the masscheck corpus spam/ham > > >is > > > >It could probably be safely removed if there'

Re: TVD_RCVD_SINGLE hitting

2019-05-23 Thread RW
On Thu, 23 May 2019 16:59:01 +0200 Matus UHLAR - fantomas wrote: > On 22.05.19 09:34, John Hardin wrote: > >I'm surprised it's still present - the masscheck corpus spam/ham is > >It could probably be safely removed if there's any question about > >it. > > well, the score is still high: > >

Re: TVD_RCVD_SINGLE hitting

2019-05-23 Thread Matus UHLAR - fantomas
anyone has idea what exactly is TVD_RCVD_SINGLE supposed to catch? According to description: describe TVD_RCVD_SINGLEĀ  Message was received from localhost however, according to the RE: header TVD_RCVD_SINGLE Received =~ /^from\s+(?!localhost)[^\s.a-z0-9-]+\s/ it will catch any helo hostnames

Re: TVD_RCVD_SINGLE hitting

2019-05-22 Thread RW
On Wed, 22 May 2019 09:34:18 -0700 (PDT) John Hardin wrote: > On Wed, 22 May 2019, Alex Woick wrote: > > > It seems the rule is some degenerated relict of a once even more > > complicated rule. > > I'm surprised it's still present - the masscheck corpus spam/ham is > zero/zero: That's proba

Re: TVD_RCVD_SINGLE hitting

2019-05-22 Thread Bill Cole
On 22 May 2019, at 12:34, John Hardin wrote: On Wed, 22 May 2019, Alex Woick wrote: The description is strangely wrong. It seems the person who created the description didn't understand what the rule does. He probably wasn't the rule creator. Or the rule was changed to the opposite without u

Re: TVD_RCVD_SINGLE hitting

2019-05-22 Thread John Hardin
On Wed, 22 May 2019, Alex Woick wrote: The description is strangely wrong. It seems the person who created the description didn't understand what the rule does. He probably wasn't the rule creator. Or the rule was changed to the opposite without updating the description. The rule itself is als

Re: TVD_RCVD_SINGLE hitting

2019-05-22 Thread Alex Woick
The description is strangely wrong. It seems the person who created the description didn't understand what the rule does. He probably wasn't the rule creator. Or the rule was changed to the opposite without updating the description. The rule itself is also somewhat strange, because (?!localhost)