On Thu, 26 May 2016 17:23:21 -0500 (CDT) David B Funk wrote: > FWIW, > There's a varient of that in the "KAM.cf" ruleset from March of this > year. (Look for __KAM_BADPHP1, which is meta'ed into KAM_BADPHP) > > It doesn't hit a lot of stuff (only 0.08% ) but does have a high S/O > (0.9984) in my mail stream (over the last 2 months).
Are those numbers for KAM_BADPHP or __KAM_BADPHP1? It's meta'ed with header __KAM_BADPHP2 X-Source-Args =~ /css.php/i I'm not seeing anything with that combination.
