You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by bi...@apache.org on 2022/02/16 15:16:30 UTC
svn commit: r1898129 - /spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf
Author: billcole
Date: Wed Feb 16 15:16:30 2022
New Revision: 1898129
URL: http://svn.apache.org/viewvc?rev=1898129&view=rev
Log:
Suspect URI host, maybe good TLDs in bad list
Modified:
spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf
Modified: spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf?rev=1898129&r1=1898128&r2=1898129&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf Wed Feb 16 15:16:30 2022
@@ -68,3 +68,17 @@ header SCC_ISEMM_LID_1 X-Mailer-LID =~
score SCC_ISEMM_LID_1 2.0 #limit
tflags SCC_ISEMM_LID_1 publish
+# TESTING a few domains that are in our "suspicious" list but are known to have some good senders
+describe T_SCC_TLD_SPACE From domain in *.space
+header T_SCC_TLD_SPACE From =~ /<[^ @]+@[^ @>]+\.space>/
+
+describe T_SCC_TLD_ONLINE From domain in *.online
+header T_SCC_TLD_ONLINE From =~ /<[^ @]+@[^ @>]+\.online>/
+
+describe T_SCC_TLD_XYZ From domain in *.xyz
+header T_SCC_TLD_XYZ From =~ /<[^ @]+@[^ @>]+\.xyz>/
+
+describe T_SCC_URL_NOTIONSITE has a notion.site URL
+uri T_SCC_URL_NOTIONSITE /https?:\/\/[^ ]*\.notion.site/
+tflags T_SCC_URL_NOTIONSITE multiple maxhits=5
+