You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2011/10/02 23:15:23 UTC
svn commit: r1178255 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Sun Oct 2 21:15:22 2011
New Revision: 1178255
URL: http://svn.apache.org/viewvc?rev=1178255&view=rev
Log:
More changes per bug 6660
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1178255&r1=1178254&r2=1178255&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Sun Oct 2 21:15:22 2011
@@ -470,13 +470,18 @@ describe __NSL_ORIG_FROM_41
# Catch spam injected from 41.0.0.0/8 (Africa, incl S.Africa)
# Ned Slider, SAU list, 3/11/2010
-header __NSL_RCVD_FROM_41 Received =~ /[([]41\./
+# consider using khop __RCVD_VIA_AFRINIC_E instead
+#header __NSL_RCVD_FROM_41 Received =~ /[([]41\./
+header __NSL_RCVD_FROM_41 X-Spam-Relays-External =~ / ip=41\./
describe __NSL_RCVD_FROM_41 Received from 41.0.0.0/8
# some metas with the above, maybe reduce FPs
ifplugin Mail::SpamAssassin::Plugin::FreeMail
- meta __FROM_41_FREEMAIL (__NSL_ORIG_FROM_41 || __NSL_RCVD_FROM_41) && (FREEMAIL_FROM || FREEMAIL_REPLYTO)
+ meta __FROM_41_FREEMAIL (__NSL_ORIG_FROM_41 || __NSL_RCVD_FROM_41) && (FREEMAIL_FROM || FREEMAIL_REPLYTO) && !__THREADED
describe __FROM_41_FREEMAIL Sent from Africa + freemail provider
+
+# meta __FROM_AFR_FREEMAIL __RCVD_VIA_AFRINIC_E && (FREEMAIL_FROM || FREEMAIL_REPLYTO) && !__THREADED
+# describe __FROM_AFR_FREEMAIL Sent from Africa + freemail provider
endif
# More from Ned