Kevin Peuhkurinen wrote:
Would you mind emailing me that L_RCVD_IN_MANY rule you have?
It was originally taken from the Nov2 rule set on Chris Santerre's site (http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm), but I'm not sure where it wound up. The original is attributed to "Slaven B."
meta L_RCVD_IN_MANY ( RCVD_IN_BL_SPAMCOP_NET + RCVD_IN_SBL + RCVD_IN
_SORBS + RCVD_IN_NJABL + RCVD_IN_DYNABLOCK + RCVD_IN_DSBL + RCVD_IN_NJABL_SPAM +
RCVD_IN_NJABL_PROXY + RCVD_IN_RFCI + RCVD_IN_OPM + RCVD_IN_SORBS_HTTP + RAZOR2_
CHECK) > 2
describe L_RCVD_IN_MANY Message received in more than 2 RBLs
score L_RCVD_IN_MANY 3.0
It's getting a LOT of work lately. :)
- Bob
