Hi, >> Here's an example: >> >> http://pastebin.com/h9JwTQ9T >> >> The score is very low. Does someone have an idea of other >> characteristics that I can flag on? >> > Hits for me on this: > Sanesecurity.Junk.22048.UNOFFICIAL FOUND
Ah, very good. I think that might be what I'm missing. How are you implementing this? From here? http://www.sanesecurity.co.uk/download_scripts_linux.htm Or are you using the clamav SA plugin-in? I'm using amavisd with clam-0.96 and sa-3.2.5. > 9.0 RELAYCOUNTRY_FR Relayed through France > 5.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net I wish I could use scores like that :-) Might as well just block all of \.fr at smtp time for that matter :-) Poor France :( Thanks, Alex
