You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by gb...@apache.org on 2022/03/31 15:55:03 UTC
svn commit: r1899445 - /spamassassin/trunk/rulesrc/sandbox/gbechis/20_misc.cf
Author: gbechis
Date: Thu Mar 31 15:55:03 2022
New Revision: 1899445
URL: http://svn.apache.org/viewvc?rev=1899445&view=rev
Log:
match a recurring spam pattern
Modified:
spamassassin/trunk/rulesrc/sandbox/gbechis/20_misc.cf
Modified: spamassassin/trunk/rulesrc/sandbox/gbechis/20_misc.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/gbechis/20_misc.cf?rev=1899445&r1=1899444&r2=1899445&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/gbechis/20_misc.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/gbechis/20_misc.cf Thu Mar 31 15:55:03 2022
@@ -69,3 +69,9 @@ meta GB_FAKE_RF_SHORT
describe GB_FAKE_RF_SHORT Fake reply or forward with url shortener
score GB_FAKE_RF_SHORT 2.000 # limit
tflags GB_FAKE_RF_SHORT publish
+
+rawbody __GB_REGEX_BR /{\:REGEX\:\((<br>){1,3}\|(<br>){1,3}/
+meta GB_REGEX_BR_SPOOF ( __GB_REGEX_BR && PDS_FROMNAME_SPOOFED_EMAIL && __ANY_TEXT_ATTACH_DOC )
+describe GB_REGEX_BR_SPOOF Office document from spoofed email
+score GB_REGEX_BR_SPOOF 2.000 # limit
+# tflags GB_REGEX_BR_SPOOF publish