[update phishing]
log 1 fail = Feb 14 06:29:39 hostname update.bad.phishing.sites: Phishing bad sites list updated
rule = 3752
alert = 0
decoder =