Nice rule. I think I'll use that myself on mine as well :) Thanks,
Daz > -----Original Message----- > From: Bob George [mailto:[EMAIL PROTECTED] > Sent: 24 March 2004 15:00 > To: Kevin Peuhkurinen > Cc: [EMAIL PROTECTED] > Subject: Re: A new (?) type of Spam > > > Kevin Peuhkurinen wrote: > > > Would you mind emailing me that L_RCVD_IN_MANY rule you have? > > It was originally taken from the Nov2 rule set on Chris > Santerre's site > (http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm ), but I'm not sure where it wound up. The original is attributed to "Slaven B." meta L_RCVD_IN_MANY ( RCVD_IN_BL_SPAMCOP_NET + RCVD_IN_SBL + RCVD_IN _SORBS + RCVD_IN_NJABL + RCVD_IN_DYNABLOCK + RCVD_IN_DSBL + RCVD_IN_NJABL_SPAM + RCVD_IN_NJABL_PROXY + RCVD_IN_RFCI + RCVD_IN_OPM + RCVD_IN_SORBS_HTTP + RAZOR2_ CHECK) > 2 describe L_RCVD_IN_MANY Message received in more than 2 RBLs score L_RCVD_IN_MANY 3.0 It's getting a LOT of work lately. :) - Bob
