You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2021/01/05 21:37:07 UTC
svn commit: r1885173 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Tue Jan 5 21:37:07 2021
New Revision: 1885173
URL: http://svn.apache.org/viewvc?rev=1885173&view=rev
Log:
Tune bitcoin obfuscation rules
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1885173&r1=1885172&r2=1885173&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Tue Jan 5 21:37:07 2021
@@ -1917,7 +1917,7 @@ ifplugin Mail::SpamAssassin::Plugin::Rep
describe FUZZY_CLICK_HERE Obfuscated "click here"
tflags FUZZY_CLICK_HERE publish
- body FUZZY_BITCOIN /<B>(?!itcoin)<I><T>[-\s]?<C><O><I><N>/i
+ body FUZZY_BITCOIN /<B>(?!it[-\s]?coin)<I><T>[-\s]?<C><O><I><N>/i
replace_rules FUZZY_BITCOIN
describe FUZZY_BITCOIN Obfuscated "Bitcoin"
tflags FUZZY_BITCOIN publish
@@ -1984,7 +1984,7 @@ describe BITCOIN_XPRIO Bitc
score BITCOIN_XPRIO 2.500 # limit
# bitcoin obfuscation - tip o' the hat to Steve Zinski on the users list, with a little cleanup
-body __BTC_OBFU_2 /\b\W{0,10}b(?!itcoin)\W{0,10}i\W{0,10}t\W{0,10}c\W{0,10}o\W{0,10}i\W{0,10}n\W{0,10}\b/i
+body __BTC_OBFU_2 /\b\W{0,10}b(?!it[-\s]?coin)\W{0,10}i\W{0,10}t\W{0,10}c\W{0,10}o\W{0,10}i\W{0,10}n\W{0,10}\b/i
body __BTC_OBFU_3 /\b\W{0,10}b(?!tc\b)\W{0,10}t\W{0,10}c\W{0,10}\b/i
# seen in sloppy spam