On 5/17/07, Duncan Hill <[EMAIL PROTECTED]> wrote:
Hi Duncan,
thank you for your reply.
Hint: grep is your friend when searching your rule files.
From the FVGT ruleset (Fred):
header FH_HOST_EQ_D_D_D_D X-Spam-Relays-Untrusted =~ /^[^\]]+
rdns=[^ ]+\d{1,3}[^0-9]\d{1,3}[^0-9]\d{1,3}[^0-9]\d{1,3}[^ ]+ /
describe FH_HOST_EQ_D_D_D_D Host starts with d-d-d-d
score FH_HOST_EQ_D_D_D_D 0.665
Yep, 'Host starts with d-d-d-d' is also in wiki description too, I see it...
Below a session header positive to FH_HOST_EQ_D_D_D_D test.
Which is FH_HOST_EQ_D_D_D_D host in these headers?
####################
Delivered-To: [EMAIL PROTECTED]
Received: by 10.114.47.13 with SMTP id u13cs67834wau;
Tue, 15 May 2007 16:05:56 -0700 (PDT)
Received: by 10.90.25.3 with SMTP id 3mr7096331agy.1179270355960;
Tue, 15 May 2007 16:05:55 -0700 (PDT)
Return-Path: <[EMAIL PROTECTED]>
Received: from mail.foo.bar (adsl-144-8.38-151.net24.it [151.38.8.144])
by mx.google.com with ESMTP id 13si1739896wrl.2007.05.15.16.05.52;
Tue, 15 May 2007 16:05:55 -0700 (PDT)
Received-SPF: neutral (google.com: 151.38.8.144 is neither permitted
nor denied by best guess record for domain of [EMAIL PROTECTED])
Received: by mail.foo.bar (Postfix, from userid 30)
id 62815178C9; Wed, 16 May 2007 01:05:50 +0200 (CEST)
Date: Wed, 16 May 2007 01:05:50 +0200
To: [EMAIL PROTECTED]
From: info <[EMAIL PROTECTED]>
Subject: xxx
X-Priority: 3
X-Mailer: PHPMailer
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="iso-8859-1"
Message-Id: <[EMAIL PROTECTED]>
####################
Thank you,
-f
