Index: rulesrc/sandbox/khopesh/20_khop_general.cf =================================================================== --- rulesrc/sandbox/khopesh/20_khop_general.cf (revision 901396) +++ rulesrc/sandbox/khopesh/20_khop_general.cf (working copy) @@ -35,6 +35,7 @@ # renamed from KHOP_NO_FQDN meta KHOP_HELO_BOT __HELO_NO_DOMAIN && KHOP_BOTNET_2 describe KHOP_HELO_BOT Suspect botnet sender claims no domain name +tflags KHOP_HELO_BOT nopublish #score KHOP_HELO_BOT 0.5 # 20090603 header __NAME_IS_EMAIL From:raw =~ /\w\@[\w.-]+\.\w\w+["'`]*\s*<\w+\@\w/ Index: rules/active.list =================================================================== --- rules/active.list (revision 901396) +++ rules/active.list (working copy) @@ -323,9 +323,6 @@ KB_RATWARE_OUTLOOK_MID # good enough -KHOP_HELO_BOT - -# good enough LIVEFILESTORE # good enough