You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2017/10/14 20:30:16 UTC
svn commit: r1812206 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Sat Oct 14 20:30:16 2017
New Revision: 1812206
URL: http://svn.apache.org/viewvc?rev=1812206&view=rev
Log:
add SPOOFED_FREEM_REPTO_RUS
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1812206&r1=1812205&r2=1812206&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Sat Oct 14 20:30:16 2017
@@ -1472,20 +1472,20 @@ uri __URI_WPINCLUDES_L m,/wp-inc
#uri __URI_WP_WHITELIST m,/wp-content/plugins/civicrm/,i
meta URI_WP_HACKED (__URI_WPCONTENT || __URI_WPINCLUDES) && !__VIA_ML && !__HAS_ERRORS_TO && !__RCD_RDNS_SMTP && !__THREADED && !ALL_TRUSTED && !__NOT_SPOOFED
describe URI_WP_HACKED URI for compromised WordPress site, possible malware
-score URI_WP_HACKED 3.000 # limit
+score URI_WP_HACKED 3.500 # limit
tflags URI_WP_HACKED publish
uri __URI_WPDIRINDEX m,/wp-(?:content|includes)/.*/$,i
meta URI_WP_DIRINDEX __URI_WPDIRINDEX
describe URI_WP_DIRINDEX URI for compromised WordPress site, possible malware
-score URI_WP_DIRINDEX 3.000 # limit
+score URI_WP_DIRINDEX 3.500 # limit
tflags URI_WP_DIRINDEX publish
# this has some overlap with URI_WP_HACKED
uri __PS_TEST_LOC_WP m;/(?:wp-content/plugins|wp-content/themes|wp-includes|modules/mod_wdbanners|includes/|google_recommends|mt-static|data/module)/.{1,128}(?!\.gif|\.jpg|\.png|\.bmp|\.ico|\.pdf)[^?]{4}(?:\?[^?]{1,5})?$;i
meta URI_WP_HACKED_2 (__PS_TEST_LOC_WP && !URI_WP_HACKED) && !__TO_EQ_FROM && !__THREADED
describe URI_WP_HACKED_2 URI for compromised WordPress site, possible malware
-score URI_WP_HACKED_2 2.000 # limit
+score URI_WP_HACKED_2 2.500 # limit
tflags URI_WP_HACKED_2 publish
@@ -2046,6 +2046,13 @@ describe SPOOFED_FREEM_REPTO_CHN
score SPOOFED_FREEM_REPTO_CHN 3.500
tflags SPOOFED_FREEM_REPTO_CHN publish
+header __REPTO_RUS_FREEM Reply-To =~ /\@mail\.ru/i
+
+meta SPOOFED_FREEM_REPTO_RUS (__SPOOFED_FREEM_REPTO || FORGED_YAHOO_RCVD) && __REPTO_RUS_FREEM
+describe SPOOFED_FREEM_REPTO_RUS Forged freemail sender with Russian freemail reply-to
+score SPOOFED_FREEM_REPTO_RUS 3.500
+tflags SPOOFED_FREEM_REPTO_RUS publish
+
meta SPOOFED_FREEM_REPTO __SPOOFED_FREEM_REPTO && !__THREADED
describe SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
score SPOOFED_FREEM_REPTO 2.500