Joseph Brennan wrote:
>
>
> The control node turned off the switch at 05:00 EST. They were still
> rolling in during the 04:00 hour but the last one was at 04:54. The
> customer's paid time on the botnet may have ended.
>
So far, we saw the last one at 2028UTC 14Dec.
/Per Jessen, Zürich
Loren Wilton wrote:
>> So it doesn't happen that often. I did try writing an SA header rule
>> for these first, but it appears that SA strips out 'X-Spam-Flag'
>> headers out before the rules are run.
>
> SA Strips out X-Spam-* on the assumption that it previously added
> them. Previous to 3.0 it
