You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2010/01/30 19:51:06 UTC
svn commit: r904845 - in /spamassassin/trunk/rulesrc/sandbox/jhardin:
20_lotsa_money.cf 20_misc_testing.cf 20_tbird_image_spam.cf
Author: jhardin
Date: Sat Jan 30 18:51:06 2010
New Revision: 904845
URL: http://svn.apache.org/viewvc?rev=904845&view=rev
Log:
Minor rule tweaks; Look for URI in FROM comment text
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
spamassassin/trunk/rulesrc/sandbox/jhardin/20_tbird_image_spam.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf?rev=904845&r1=904844&r2=904845&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf Sat Jan 30 18:51:06 2010
@@ -117,7 +117,7 @@
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
replace_tag PERCENT \b(?:\d\d|ten|[a-z]+teen|(?:twen|thir|fou?r)ty(?:-?[a-z]+)?)\s?(?:%|percent)
- body __PCT_FOR_YOU_1 /<PERCENT>[\s)]+(?:of\s[\w\s]{0,35}?)?(?:for|to|as)\syour?/i
+ body __PCT_FOR_YOU_1 /<PERCENT>[\s)]{0,3}(?:of\s[\w\s]{0,35}?)?(?:for|to|as)\syour?/i
body __PCT_FOR_YOU_2 /\b(?:give|offer)\syou\s<PERCENT>/i
body __PCT_FOR_YOU_3 /\byour?\s(?!can)[\w\s]{6,20}?(?:(?:share|entitle|assist|comp[ea]nsate|reward|renumerate|deduct|account|tage)[\w\s]{1,25}?)?\s(?<!by\s)(?<!up\sto\s)<PERCENT>/i
body __PCT_OF_PMTS /<PERCENT>[\s)]+(?:of\s[\w\s]{0,35}?)?of\s(?:the\s)?(?:payments?|remittances?|chec(?:k|que)s?)/i
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=904845&r1=904844&r2=904845&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Sat Jan 30 18:51:06 2010
@@ -115,6 +115,7 @@
rawbody RUNON_SHY /(?:\­){3}/i
describe RUNON_SHY Repeating soft hyphens
score RUNON_SHY 0.1
+tflags RUNON_SHY nopublish
# Seen all too often
header LAZY_LISTWASHING To =~ /\@(?:example\.com|example\.domain|your\.domain|some\.domain|domain\.dom|somewhere\.tld|somewhere\.com|your\.?domain\.com|your\.favorite\.machine)\b/i
@@ -146,7 +147,7 @@
score FREEMAIL_RVW_ATTCH 1.0
endif
-body END_FUTURE_EMAILS /\bend future emails\b/i
+body END_FUTURE_EMAILS /\bend future (?:email|alert)s?\b/i
score END_FUTURE_EMAILS 0.50
describe END_FUTURE_EMAILS Unsubscribe
@@ -157,6 +158,7 @@
# observed in bank phishing 09/2009
rawbody MISQ_HTML /<\w{2,20}[^>=]{1,30}=[^"][^">]{1,30}[^=]"[\s>]/
describe MISQ_HTML Unbalanced quotes in HTML tag
+tflags MISQ_HTML nopublish
# observed in bank phishing 09/2009
uri WIKI_IMG m,^https?://[^/]+wiki[mp]edia\.org/.+\.(?:png|gif|jpe?g),i
@@ -199,6 +201,7 @@
header TO_EQ_FROM ALL =~ /\nFrom:[^\n<]{0,80}<?([^\n\s>]+)>?\n(?:[^\n]{1,100}\n)*To:[^\n]+\1/ism
describe TO_EQ_FROM To: same as From:
score TO_EQ_FROM 0.001
+tflags TO_EQ_FROM nopublish
# Evaluate ReturnPath and blacklist collisions
@@ -231,4 +234,7 @@
tflags __RP_SAFE_ANBREP_L3 net nopublish
tflags __RP_CERTIFIED_ANBREP_L3 net nopublish
+# a URI in the From comment text, to bypass URIBL checks
+# simplistic URI format for now
+header FROM_URI From =~ /".*www\.\S+\.(?:com|net|info|biz|org).*"/i
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_tbird_image_spam.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_tbird_image_spam.cf?rev=904845&r1=904844&r2=904845&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_tbird_image_spam.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_tbird_image_spam.cf Sat Jan 30 18:51:06 2010
@@ -19,8 +19,8 @@
# Additional meta spotted by Alex Broens. Still might FP on legit mail with
# manually typed addresses or undisclosed recipients.
-header __TO_UNDISCLOSED To =~ /undisclosed-recipients:/i
-header __TO_NO_ARROWS_R To !~ />$/
+header __TO_UNDISCLOSED To =~ /(?:undisclosed-recipients|destinataires inconnus):/i
+header __TO_NO_ARROWS_R To !~ /(?:>$|>,)/
meta FORGED_TBIRD_IMG_ARROW __FORGED_TBIRD_IMG && __TO_NO_ARROWS_R && !__TO_UNDISCLOSED