You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jm...@apache.org on 2006/06/30 20:01:16 UTC
svn commit: r418346 - /spamassassin/rules/trunk/sandbox/jm/20_basic.cf
Author: jm
Date: Fri Jun 30 11:01:16 2006
New Revision: 418346
URL: http://svn.apache.org/viewvc?rev=418346&view=rev
Log:
spammer has stopped using this pattern
Modified:
spamassassin/rules/trunk/sandbox/jm/20_basic.cf
Modified: spamassassin/rules/trunk/sandbox/jm/20_basic.cf
URL: http://svn.apache.org/viewvc/spamassassin/rules/trunk/sandbox/jm/20_basic.cf?rev=418346&r1=418345&r2=418346&view=diff
==============================================================================
--- spamassassin/rules/trunk/sandbox/jm/20_basic.cf (original)
+++ spamassassin/rules/trunk/sandbox/jm/20_basic.cf Fri Jun 30 11:01:16 2006
@@ -4,7 +4,17 @@
header HELO_IPNNN_ORG X-Spam-Relays-Untrusted =~ / helo=ip\d{2,3}\.[^\.]+\.org /
header HELO_IPNNN_BIZ X-Spam-Relays-Untrusted =~ / helo=ip\d{2,3}\.[^\.]+\.biz /
-uri LINK_L_PHP m,/l.php\?\d,
-
header MID_DEGREES Message-ID =~ /^<\d{14}\.[A-F0-9]{10}\@[A-Z0-9]+>$/
+
+
+# from Clifton
+# Been seeing broken message IDs for a long time, e.g. Message-Id: <KKdj[20
+# usually/always? associated with an empty message. Suspect broken spamware.
+header TT_MSGID_TRUNC Message-Id =~ /^\s*<?[^<>\s]+\[\d+$/
+describe TT_MSGID_TRUNC Scora: Message-Id ends after left-bracket + digits
+
+# Just saw one or two broken Xrefs in similar form, e.g. Xref: KKdj[20
+# associated with an empty message. Suspect broken spamware.
+header TT_XREF_TRUNC Xref =~ /^\s*<?[^<>\s]+\[\d+$/
+describe TT_XREF_TRUNC Scora: Xref ends after left-bracket + digits