You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2020/09/11 17:35:26 UTC
svn commit: r1881644 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Fri Sep 11 17:35:26 2020
New Revision: 1881644
URL: http://svn.apache.org/viewvc?rev=1881644&view=rev
Log:
Add a couple of metas for evaluation
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1881644&r1=1881643&r2=1881644&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Fri Sep 11 17:35:26 2020
@@ -1912,6 +1912,8 @@ meta BITCOIN_MALF_HTML HTML
describe BITCOIN_MALF_HTML Bitcoin + malformed HTML
score BITCOIN_MALF_HTML 3.500 # limit
+meta __BITCOIN_XPRIO __XPRIO && (__BITCOIN || __BITCOIN_ID)
+
# bitcoin obfuscation - tip o' the hat to Steve Zinski on the users list, with a little cleanup
body __BTC_OBFU_2 /\b\W{0,10}b(?!itcoin)\W{0,10}i\W{0,10}t\W{0,10}c\W{0,10}o\W{0,10}i\W{0,10}n\W{0,10}\b/i
body __BTC_OBFU_3 /\b\W{0,10}b(?!tc\b)\W{0,10}t\W{0,10}c\W{0,10}\b/i
@@ -3054,6 +3056,8 @@ describe URI_DOTEDU H
score URI_DOTEDU 2.000 # limit
tflags URI_DOTEDU publish
+meta __URI_DOTEDU_LONG __URI_DOTEDU && __LONGLINE
+
meta __URI_DOTEDU_ENTITY __URI_DOTEDU && __AC_HTML_ENTITY_BONANZA_SHRT_RAW
meta URI_DOTEDU_ENTITY __URI_DOTEDU_ENTITY && !__SUBSCRIPTION_INFO
describe URI_DOTEDU_ENTITY Via .edu MTA + suspicious HTML content