You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by fe...@apache.org on 2006/04/09 03:03:00 UTC
svn commit: r392650 -
/spamassassin/rules/trunk/sandbox/felicity/70_phishing.cf
Author: felicity
Date: Sat Apr 8 18:02:58 2006
New Revision: 392650
URL: http://svn.apache.org/viewcvs?rev=392650&view=rev
Log:
rework the phishing stuff a little
Modified:
spamassassin/rules/trunk/sandbox/felicity/70_phishing.cf
Modified: spamassassin/rules/trunk/sandbox/felicity/70_phishing.cf
URL: http://svn.apache.org/viewcvs/spamassassin/rules/trunk/sandbox/felicity/70_phishing.cf?rev=392650&r1=392649&r2=392650&view=diff
==============================================================================
--- spamassassin/rules/trunk/sandbox/felicity/70_phishing.cf (original)
+++ spamassassin/rules/trunk/sandbox/felicity/70_phishing.cf Sat Apr 8 18:02:58 2006
@@ -106,47 +106,15 @@
# this rule. though the two rules are very similar and could definitely share
# code. if promoted, the two should get merged together to backup both rules.
-body T_HTTPS_HTTP_MISMATCH_1 eval:check_https_http_mismatch('1')
-body T_HTTPS_HTTP_MISMATCH_2 eval:check_https_http_mismatch('2')
-body T_HTTPS_HTTP_MISMATCH_3 eval:check_https_http_mismatch('3')
-body T_HTTPS_HTTP_MISMATCH_4 eval:check_https_http_mismatch('4')
-body T_HTTPS_HTTP_MISMATCH_5 eval:check_https_http_mismatch('5')
-
body T_HTTPS_HTTP_MISMATCH_1_10 eval:check_https_http_mismatch('1','10')
-body T_HTTPS_HTTP_MISMATCH_2_10 eval:check_https_http_mismatch('2','10')
-body T_HTTPS_HTTP_MISMATCH_3_10 eval:check_https_http_mismatch('3','10')
-body T_HTTPS_HTTP_MISMATCH_4_10 eval:check_https_http_mismatch('4','10')
-body T_HTTPS_HTTP_MISMATCH_5_10 eval:check_https_http_mismatch('5','10')
+body T_HTTPS_HTTP_MISMATCH_11_15 eval:check_https_http_mismatch('11','15')
+body T_HTTPS_HTTP_MISMATCH_11_20 eval:check_https_http_mismatch('11','20')
body T_HTTPS_HTTP_MISMATCH_1_11 eval:check_https_http_mismatch('1','11')
-body T_HTTPS_HTTP_MISMATCH_2_11 eval:check_https_http_mismatch('2','11')
-body T_HTTPS_HTTP_MISMATCH_3_11 eval:check_https_http_mismatch('3','11')
-body T_HTTPS_HTTP_MISMATCH_4_11 eval:check_https_http_mismatch('4','11')
-body T_HTTPS_HTTP_MISMATCH_5_11 eval:check_https_http_mismatch('5','11')
-
body T_HTTPS_HTTP_MISMATCH_1_12 eval:check_https_http_mismatch('1','12')
-body T_HTTPS_HTTP_MISMATCH_2_12 eval:check_https_http_mismatch('2','12')
-body T_HTTPS_HTTP_MISMATCH_3_12 eval:check_https_http_mismatch('3','12')
-body T_HTTPS_HTTP_MISMATCH_4_12 eval:check_https_http_mismatch('4','12')
-body T_HTTPS_HTTP_MISMATCH_5_12 eval:check_https_http_mismatch('5','12')
-
body T_HTTPS_HTTP_MISMATCH_1_13 eval:check_https_http_mismatch('1','13')
-body T_HTTPS_HTTP_MISMATCH_2_13 eval:check_https_http_mismatch('2','13')
-body T_HTTPS_HTTP_MISMATCH_3_13 eval:check_https_http_mismatch('3','13')
-body T_HTTPS_HTTP_MISMATCH_4_13 eval:check_https_http_mismatch('4','13')
-body T_HTTPS_HTTP_MISMATCH_5_13 eval:check_https_http_mismatch('5','13')
-
body T_HTTPS_HTTP_MISMATCH_1_14 eval:check_https_http_mismatch('1','14')
-body T_HTTPS_HTTP_MISMATCH_2_14 eval:check_https_http_mismatch('2','14')
-body T_HTTPS_HTTP_MISMATCH_3_14 eval:check_https_http_mismatch('3','14')
-body T_HTTPS_HTTP_MISMATCH_4_14 eval:check_https_http_mismatch('4','14')
-body T_HTTPS_HTTP_MISMATCH_5_14 eval:check_https_http_mismatch('5','14')
-
body T_HTTPS_HTTP_MISMATCH_1_15 eval:check_https_http_mismatch('1','15')
-body T_HTTPS_HTTP_MISMATCH_2_15 eval:check_https_http_mismatch('2','15')
-body T_HTTPS_HTTP_MISMATCH_3_15 eval:check_https_http_mismatch('3','15')
-body T_HTTPS_HTTP_MISMATCH_4_15 eval:check_https_http_mismatch('4','15')
-body T_HTTPS_HTTP_MISMATCH_5_15 eval:check_https_http_mismatch('5','15')
endif
@@ -163,6 +131,11 @@
header T_TVD_PH_FROM_ADMI From:addr =~ /admin\@/i
header T_TVD_PH_FROM_SECU From:addr =~ /secure\@/i
+meta __TVD_PH_FROM_ANY T_TVD_PH_FROM_ACCO || T_TVD_PH_FROM_CUST || T_TVD_PH_FROM_SUPP || T_TVD_PH_FROM_SERV || T_TVD_PH_FROM_BILL || T_TVD_PH_FROM_NOTI || T_TVD_PH_FROM_ADMI || T_TVD_PH_FROM_SECU
+meta T_TVD_PH_FROM_SUBJ_GOOD __TVD_PH_FROM_ANY && T_TVD_PH_SUBJ_GOOD
+meta T_TVD_PH_FROM_SUBJ_GOOD2 __TVD_PH_FROM_ANY && T_TVD_PH_SUBJ_GOOD2
+
+
header T_TVD_PH_SUBJ_00 Subject =~ /\brewards? survey\b/i
header T_TVD_PH_SUBJ_02 Subject =~ /\byour payment has been sent\b/i
@@ -216,82 +189,5 @@
header T_TVD_PH_SUBJ_58 Subject =~ /\bbilling service\b/i
header T_TVD_PH_SUBJ_59 Subject =~ /\bquestion from (?:\w+ )*member\b/i
-# 0.039 0.0488 0.0034 0.936 0.54 0.01 T_TVD_PH_SUBJ_57
-# 0.024 0.0290 0.0022 0.928 0.51 0.01 T_TVD_PH_SUBJ_13
-# 0.011 0.0131 0.0011 0.921 0.49 0.01 T_TVD_PH_SUBJ_49
-# 0.031 0.0377 0.0034 0.918 0.53 0.01 T_TVD_PH_SUBJ_27
-# 0.007 0.0087 0.0011 0.886 0.48 0.01 T_TVD_PH_SUBJ_33
-# 0.007 0.0081 0.0011 0.879 0.48 0.01 T_TVD_PH_SUBJ_40
-# 0.006 0.0070 0.0011 0.862 0.47 0.01 T_TVD_PH_SUBJ_09
-# 0.189 0.2279 0.0369 0.861 0.62 0.01 T_TVD_PH_SUBJ_26_2
-# 0.005 0.0058 0.0011 0.838 0.47 0.01 T_TVD_PH_SUBJ_45
-# 0.009 0.0104 0.0022 0.824 0.48 0.01 T_TVD_PH_SUBJ_11
-# 0.405 0.4783 0.1208 0.798 0.61 0.01 T_TVD_PH_SUBJ_26
-# 0.005 0.0061 0.0022 0.732 0.47 0.01 T_TVD_PH_SUBJ_14
-# 0.017 0.0180 0.0112 0.617 0.48 0.01 T_TVD_PH_SUBJ_18
-# 0.000 0.0000 0.0000 0.500 0.46 0.01 T_TVD_PH_SUBJ_60
-# 0.000 0.0000 0.0000 0.500 0.46 0.01 T_TVD_PH_SUBJ_53
-# 0.000 0.0000 0.0000 0.500 0.46 0.01 T_TVD_PH_SUBJ_51
-# 0.000 0.0000 0.0000 0.500 0.46 0.01 T_TVD_PH_SUBJ_34
-# 0.001 0.0009 0.0011 0.438 0.46 0.01 T_TVD_PH_SUBJ_23
-# 0.019 0.0142 0.0358 0.284 0.44 0.01 T_TVD_PH_SUBJ_01
-# 0.015 0.0038 0.0559 0.063 0.38 0.01 T_TVD_PH_SUBJ_28
-# 0.005 0.0000 0.0257 0.000 0.42 0.01 T_TVD_PH_SUBJ_55
-#header T_TVD_PH_SUBJ_01 Subject =~ /\byour payments?\b/i
-#header T_TVD_PH_SUBJ_09 Subject =~ /\bupdate (?:\w+ )*cards?\b/i
-#header T_TVD_PH_SUBJ_11 Subject =~ /\b(?:re-?)?activate (?:\w+ )*accounts?\b/i
-#header T_TVD_PH_SUBJ_13 Subject =~ /\baddress (?:\w+ )*accounts?\b/i
-#header T_TVD_PH_SUBJ_14 Subject =~ /\binfo(?:rmation)? (?:\w+ )*accounts?\b/i
-#header T_TVD_PH_SUBJ_18 Subject =~ /\bpassword changed?\b/i
-#header T_TVD_PH_SUBJ_23 Subject =~ /^welcome to (?:\w+ )+online$/i
-#header T_TVD_PH_SUBJ_26 Subject =~ /\byour (?:\w+ )*accounts?\b/i
-#header T_TVD_PH_SUBJ_26_2 Subject =~ /^your account|\byour (?:\w+ )+accounts?\b/i
-#header T_TVD_PH_SUBJ_27 Subject =~ /\bcheck (?:\w+ )*accounts?\b/i
-#header T_TVD_PH_SUBJ_28 Subject =~ /\breceipt (?:\w+ )*payments?\b/i
-#header T_TVD_PH_SUBJ_33 Subject =~ /^important notice\b/i
-#header T_TVD_PH_SUBJ_34 Subject =~ /^important notice (?:\w+)*accounts?\b/i
-#header T_TVD_PH_SUBJ_40 Subject =~ /\bsecurity center\b/i
-#header T_TVD_PH_SUBJ_45 Subject =~ /\bconfirm (?:\w+ )*accounts?\b/i
-#header T_TVD_PH_SUBJ_49 Subject =~ /\baccounts? (?:\w+)*verif(?:y|ication)\b/i
-#header T_TVD_PH_SUBJ_51 Subject =~ /\bcards? (?:\w+)*suspen(?:d|ded|sion)?\b/i
-#header T_TVD_PH_SUBJ_53 Subject =~ /\bupgrad(?:ing|ed?) (?:\w+)*security\b/i
-#header T_TVD_PH_SUBJ_55 Subject =~ /\breceipt of payment\b/i
-#header T_TVD_PH_SUBJ_57 Subject =~ /\bcustomer (?:service|support)\b/i
-#header T_TVD_PH_SUBJ_60 Subject =~ /\binternational invoice\b/i
-
-meta T_TVD_PH_SUBJ_ANY T_TVD_PH_SUBJ_30 || T_TVD_PH_SUBJ_05 || T_TVD_PH_SUBJ_20 || T_TVD_PH_SUBJ_21 || T_TVD_PH_SUBJ_29 || T_TVD_PH_SUBJ_00 || T_TVD_PH_SUBJ_44 || T_TVD_PH_SUBJ_25 || T_TVD_PH_SUBJ_16 || T_TVD_PH_SUBJ_52 || T_TVD_PH_SUBJ_59 || T_TVD_PH_SUBJ_04 || T_TVD_PH_SUBJ_02 || T_TVD_PH_SUBJ_54 || T_TVD_PH_SUBJ_15 || T_TVD_PH_SUBJ_10 || T_TVD_PH_SUBJ_22 || T_TVD_PH_SUBJ_38 || T_TVD_PH_SUBJ_07 || T_TVD_PH_SUBJ_08 || T_TVD_PH_SUBJ_56 || T_TVD_PH_SUBJ_24 || T_TVD_PH_SUBJ_06 || T_TVD_PH_SUBJ_39 || T_TVD_PH_SUBJ_19 || T_TVD_PH_SUBJ_31 || T_TVD_PH_SUBJ_41 || T_TVD_PH_SUBJ_42 || T_TVD_PH_SUBJ_17 || T_TVD_PH_SUBJ_61 || T_TVD_PH_SUBJ_50 || T_TVD_PH_SUBJ_43 || T_TVD_PH_SUBJ_36 || T_TVD_PH_SUBJ_48 || T_TVD_PH_SUBJ_37 || T_TVD_PH_SUBJ_47 || T_TVD_PH_SUBJ_12 || T_TVD_PH_SUBJ_58 || T_TVD_PH_SUBJ_46
-
-meta T_TVD_PH_SUBJ_GOOD T_TVD_PH_SUBJ_30 || T_TVD_PH_SUBJ_05 || T_TVD_PH_SUBJ_25 || T_TVD_PH_SUBJ_44 || T_TVD_PH_SUBJ_16 || T_TVD_PH_SUBJ_59 || T_TVD_PH_SUBJ_29 || T_TVD_PH_SUBJ_20 || T_TVD_PH_SUBJ_21 || T_TVD_PH_SUBJ_10 || T_TVD_PH_SUBJ_24 || T_TVD_PH_SUBJ_38 || T_TVD_PH_SUBJ_61 || T_TVD_PH_SUBJ_07 || T_TVD_PH_SUBJ_52 || T_TVD_PH_SUBJ_54 || T_TVD_PH_SUBJ_04 || T_TVD_PH_SUBJ_56 || T_TVD_PH_SUBJ_00 || T_TVD_PH_SUBJ_50 || T_TVD_PH_SUBJ_47 || T_TVD_PH_SUBJ_22 || T_TVD_PH_SUBJ_08 || T_TVD_PH_SUBJ_15 || T_TVD_PH_SUBJ_02 || T_TVD_PH_SUBJ_41 || T_TVD_PH_SUBJ_42 || T_TVD_PH_SUBJ_39 || T_TVD_PH_SUBJ_19 || T_TVD_PH_SUBJ_31 || T_TVD_PH_SUBJ_17 || T_TVD_PH_SUBJ_06 || T_TVD_PH_SUBJ_36 || T_TVD_PH_SUBJ_12 || T_TVD_PH_SUBJ_48 || T_TVD_PH_SUBJ_37 || T_TVD_PH_SUBJ_43 || T_TVD_PH_SUBJ_46 || T_TVD_PH_SUBJ_58
-
-
-header T_TVD_PH_SUBJ_S_01 Subject =~ /\bpayments?\b/i
-header T_TVD_PH_SUBJ_S_02 Subject =~ /\bprofile\b/i
-header T_TVD_PH_SUBJ_S_03 Subject =~ /\baccounts?\b/i
-header T_TVD_PH_SUBJ_S_04 Subject =~ /\baccess\b/i
-header T_TVD_PH_SUBJ_S_05 Subject =~ /\bcredit\b/i
-header T_TVD_PH_SUBJ_S_06 Subject =~ /\bcards?\b/i
-header T_TVD_PH_SUBJ_S_07 Subject =~ /\bverif(?:y|ication)\b/i
-header T_TVD_PH_SUBJ_S_08 Subject =~ /\b(?:re-?)activate\b/i
-header T_TVD_PH_SUBJ_S_09 Subject =~ /\blimit(?:ed|ations)?\b/i
-header T_TVD_PH_SUBJ_S_10 Subject =~ /\bun-?usual\b/i
-header T_TVD_PH_SUBJ_S_11 Subject =~ /\bsuspen(?:d|ded|sion)\b/i
-header T_TVD_PH_SUBJ_S_12 Subject =~ /\bnotif(?:y|ication)\b/i
-header T_TVD_PH_SUBJ_S_13 Subject =~ /\breport\b/i
-header T_TVD_PH_SUBJ_S_14 Subject =~ /\bconfirm\b/i
-header T_TVD_PH_SUBJ_S_15 Subject =~ /\bsecure\b/i
-header T_TVD_PH_SUBJ_S_16 Subject =~ /\brecords?\b/i
-header T_TVD_PH_SUBJ_S_17 Subject =~ /\binfo(?:rmation)?\b/i
-header T_TVD_PH_SUBJ_S_18 Subject =~ /\bbilling\b/i
-header T_TVD_PH_SUBJ_S_19 Subject =~ /\bbank(?:ing)?\b/i
-header T_TVD_PH_SUBJ_S_20 Subject =~ /\bsecur(?:e|ity)\b/i
-header T_TVD_PH_SUBJ_S_21 Subject =~ /\breceipt\b/i
-header T_TVD_PH_SUBJ_S_22 Subject =~ /\brestore\b/i
-header T_TVD_PH_SUBJ_S_23 Subject =~ /\binvoice\b/i
-
-meta T_TVD_PH_SUBJ_S_1 (T_TVD_PH_SUBJ_S_03 || T_TVD_PH_SUBJ_S_04 || T_TVD_PH_SUBJ_S_17||T_TVD_PH_SUBJ_S_16) && (T_TVD_PH_SUBJ_S_07 || T_TVD_PH_SUBJ_S_08 || T_TVD_PH_SUBJ_S_11 || T_TVD_PH_SUBJ_S_22|| T_TVD_PH_SUBJ_S_02 || T_TVD_PH_SUBJ_S_19)
-
-
-meta T_TVD_PH_FROM_ANY T_TVD_PH_FROM_ACCO || T_TVD_PH_FROM_CUST || T_TVD_PH_FROM_SUPP || T_TVD_PH_FROM_SERV || T_TVD_PH_FROM_BILL || T_TVD_PH_FROM_NOTI || T_TVD_PH_FROM_ADMI || T_TVD_PH_FROM_SECU
-meta T_TVD_PH_FROM_SUBJ_ANY T_TVD_PH_FROM_ANY && T_TVD_PH_SUBJ_ANY
-meta T_TVD_PH_FROM_SUBJ_GOOD T_TVD_PH_FROM_ANY && T_TVD_PH_SUBJ_GOOD
-meta T_TVD_PH_FROM_SUBJ_S_1 T_TVD_PH_FROM_ANY && T_TVD_PH_SUBJ_S_1
+meta T_TVD_PH_SUBJ_GOOD T_TVD_PH_SUBJ_00 || T_TVD_PH_SUBJ_02 || T_TVD_PH_SUBJ_04 || T_TVD_PH_SUBJ_05 || T_TVD_PH_SUBJ_06 || T_TVD_PH_SUBJ_07 || T_TVD_PH_SUBJ_08 || T_TVD_PH_SUBJ_10 || T_TVD_PH_SUBJ_12 || T_TVD_PH_SUBJ_15 || T_TVD_PH_SUBJ_16 || T_TVD_PH_SUBJ_17 || T_TVD_PH_SUBJ_19 || T_TVD_PH_SUBJ_20 || T_TVD_PH_SUBJ_21 || T_TVD_PH_SUBJ_22 || T_TVD_PH_SUBJ_24 || T_TVD_PH_SUBJ_25 || T_TVD_PH_SUBJ_29 || T_TVD_PH_SUBJ_30 || T_TVD_PH_SUBJ_31 || T_TVD_PH_SUBJ_36 || T_TVD_PH_SUBJ_37 || T_TVD_PH_SUBJ_38 || T_TVD_PH_SUBJ_39 || T_TVD_PH_SUBJ_41 || T_TVD_PH_SUBJ_42 || T_TVD_PH_SUBJ_43 || T_TVD_PH_SUBJ_44 || T_TVD_PH_SUBJ_46 || T_TVD_PH_SUBJ_47 || T_TVD_PH_SUBJ_48 || T_TVD_PH_SUBJ_50 || T_TVD_PH_SUBJ_52 || T_TVD_PH_SUBJ_54 || T_TVD_PH_SUBJ_56 || T_TVD_PH_SUBJ_58 || T_TVD_PH_SUBJ_59 || T_TVD_PH_SUBJ_61
+meta T_TVD_PH_SUBJ_GOOD2 T_TVD_PH_SUBJ_00 || T_TVD_PH_SUBJ_02 || T_TVD_PH_SUBJ_04 || T_TVD_PH_SUBJ_05 || T_TVD_PH_SUBJ_06 || T_TVD_PH_SUBJ_07 || T_TVD_PH_SUBJ_08 || T_TVD_PH_SUBJ_10 || T_TVD_PH_SUBJ_12 || T_TVD_PH_SUBJ_15 || T_TVD_PH_SUBJ_16 || T_TVD_PH_SUBJ_17 || T_TVD_PH_SUBJ_19 || T_TVD_PH_SUBJ_20 || T_TVD_PH_SUBJ_21 || T_TVD_PH_SUBJ_22 || T_TVD_PH_SUBJ_24 || T_TVD_PH_SUBJ_25 || T_TVD_PH_SUBJ_29 || T_TVD_PH_SUBJ_31 || T_TVD_PH_SUBJ_36 || T_TVD_PH_SUBJ_37 || T_TVD_PH_SUBJ_38 || T_TVD_PH_SUBJ_39 || T_TVD_PH_SUBJ_41 || T_TVD_PH_SUBJ_42 || T_TVD_PH_SUBJ_43 || T_TVD_PH_SUBJ_44 || T_TVD_PH_SUBJ_46 || T_TVD_PH_SUBJ_47 || T_TVD_PH_SUBJ_48 || T_TVD_PH_SUBJ_50 || T_TVD_PH_SUBJ_52 || T_TVD_PH_SUBJ_54 || T_TVD_PH_SUBJ_56 || T_TVD_PH_SUBJ_58 || T_TVD_PH_SUBJ_59 || T_TVD_PH_SUBJ_61