You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2012/11/24 02:39:52 UTC
svn commit: r1413113 - in /spamassassin/trunk/rulesrc/sandbox/jhardin:
20_advance_fee_reevolved.cf 20_lotsa_money.cf
Author: jhardin
Date: Sat Nov 24 01:39:51 2012
New Revision: 1413113
URL: http://svn.apache.org/viewvc?rev=1413113&view=rev
Log:
More FP avoidance in 419 rules
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_advance_fee_reevolved.cf
spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_advance_fee_reevolved.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_advance_fee_reevolved.cf?rev=1413113&r1=1413112&r2=1413113&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_advance_fee_reevolved.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_advance_fee_reevolved.cf Sat Nov 24 01:39:51 2012
@@ -28,7 +28,7 @@ meta __ADVANCE_FEE_2_NEW (__AFRICA
#describe ADVANCE_FEE_2_NEW Appears to be advance fee fraud (Nigerian 419)
meta __ADVANCE_FEE_3_NEW (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + LOTTO_AGENT_RPLY + __LOTTO_DEPT + __LOTTO_RELATED + LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET + __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT + U
NCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOU_WON > 2) && !__THREAD_INDEX_GOOD
-meta ADVANCE_FEE_3_NEW __ADVANCE_FEE_3_NEW && !__HTML_LINK_IMAGE && !__TAG_EXISTS_CENTER && !__COMMENT_EXISTS && !__VIA_ML && !__THREADED && !__UNSUB_LINK && !__UPPERCASE_URI && !__SURVEY
+meta ADVANCE_FEE_3_NEW __ADVANCE_FEE_3_NEW && !__HTML_LINK_IMAGE && !__TAG_EXISTS_CENTER && !__COMMENT_EXISTS && !__VIA_ML && !__THREADED && !__UNSUB_LINK && !__UPPERCASE_URI && !__SURVEY && !__HAS_SENDER && !__HAS_X_LOOP
describe ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
score ADVANCE_FEE_3_NEW 3.5 # limit
@@ -43,15 +43,15 @@ describe ADVANCE_FEE_5_NEW Appears to
# if large sums of money are involved...
meta __ADVANCE_FEE_2_NEW_MONEY LOTS_OF_MONEY && __ADVANCE_FEE_2_NEW
-meta ADVANCE_FEE_2_NEW_MONEY __ADVANCE_FEE_2_NEW_MONEY && !__DOS_HAS_LIST_UNSUB && !__TAG_EXISTS_CENTER && !__LYRIS_EZLM_REMAILER && !__COMMENT_EXISTS && !__UNSUB_LINK && !__VIA_ML && !__HTML_LINK_IMAGE && !__HDRS_LCASE && !__NAME_EQ_EMAIL && !__URI_MAILTO_MANY && !__RP_MATCHES_RCVD
+meta ADVANCE_FEE_2_NEW_MONEY __ADVANCE_FEE_2_NEW_MONEY && !__DOS_HAS_LIST_UNSUB && !__TAG_EXISTS_CENTER && !__LYRIS_EZLM_REMAILER && !__COMMENT_EXISTS && !__UNSUB_LINK && !__VIA_ML && !__HTML_LINK_IMAGE && !__HDRS_LCASE && !__NAME_EQ_EMAIL && !__URI_MAILTO_MANY && !__RP_MATCHES_RCVD && !__THREADED && !__HAS_SENDER && !__HAS_X_LOOP
describe ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
meta __ADVANCE_FEE_3_NEW_MONEY LOTS_OF_MONEY && __ADVANCE_FEE_3_NEW
-meta ADVANCE_FEE_3_NEW_MONEY __ADVANCE_FEE_3_NEW_MONEY && !__HTML_LINK_IMAGE && !__UPPERCASE_URI && !__UNSUB_LINK && !__VIA_ML && !__THREADED
+meta ADVANCE_FEE_3_NEW_MONEY __ADVANCE_FEE_3_NEW_MONEY && !__HTML_LINK_IMAGE && !__UPPERCASE_URI && !__UNSUB_LINK && !__VIA_ML && !__THREADED && !__HAS_SENDER && !__HAS_X_LOOP
describe ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
meta __ADVANCE_FEE_4_NEW_MONEY LOTS_OF_MONEY && __ADVANCE_FEE_4_NEW
-meta ADVANCE_FEE_4_NEW_MONEY __ADVANCE_FEE_4_NEW_MONEY && !__HTML_LINK_IMAGE && !__TAG_EXISTS_CENTER
+meta ADVANCE_FEE_4_NEW_MONEY __ADVANCE_FEE_4_NEW_MONEY && !__HTML_LINK_IMAGE && !__TAG_EXISTS_CENTER && !__HAS_SENDER && !__HAS_X_LOOP
describe ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
meta __ADVANCE_FEE_5_NEW_MONEY LOTS_OF_MONEY && __ADVANCE_FEE_5_NEW
@@ -61,11 +61,11 @@ describe ADVANCE_FEE_5_NEW_MONEY Adv
# if you fill in a form...
meta __ADVANCE_FEE_2_NEW_FORM __FILL_THIS_FORM && __ADVANCE_FEE_2_NEW
-meta ADVANCE_FEE_2_NEW_FORM __ADVANCE_FEE_2_NEW_FORM && !__COMMENT_EXISTS && !__THREADED && !__HTML_LINK_IMAGE && !__HDRS_LCASE
+meta ADVANCE_FEE_2_NEW_FORM __ADVANCE_FEE_2_NEW_FORM && !__COMMENT_EXISTS && !__THREADED && !__HTML_LINK_IMAGE && !__HDRS_LCASE && !__DOS_HAS_LIST_UNSUB && !__HAS_SENDER && !__HAS_X_LOOP
describe ADVANCE_FEE_2_NEW_FORM Advance Fee fraud and a form
meta __ADVANCE_FEE_3_NEW_FORM __FILL_THIS_FORM && __ADVANCE_FEE_3_NEW
-meta ADVANCE_FEE_3_NEW_FORM __ADVANCE_FEE_3_NEW_FORM && !__HTML_LINK_IMAGE
+meta ADVANCE_FEE_3_NEW_FORM __ADVANCE_FEE_3_NEW_FORM && !__HTML_LINK_IMAGE && !__THREADED && !__HAS_SENDER && !__HAS_X_LOOP
describe ADVANCE_FEE_3_NEW_FORM Advance Fee fraud and a form
meta __ADVANCE_FEE_4_NEW_FORM __FILL_THIS_FORM && __ADVANCE_FEE_4_NEW
@@ -79,11 +79,11 @@ describe ADVANCE_FEE_5_NEW_FORM Adva
# if large sums of money and a form are involved...
meta __ADVANCE_FEE_2_NEW_FRM_MNY __FILL_THIS_FORM && LOTS_OF_MONEY && __ADVANCE_FEE_2_NEW
-meta ADVANCE_FEE_2_NEW_FRM_MNY __ADVANCE_FEE_2_NEW_FRM_MNY && !__HTML_LINK_IMAGE && !__HDRS_LCASE
+meta ADVANCE_FEE_2_NEW_FRM_MNY __ADVANCE_FEE_2_NEW_FRM_MNY && !__HTML_LINK_IMAGE && !__HDRS_LCASE && !__DOS_HAS_LIST_UNSUB && !__THREADED && !__HAS_SENDER && !__HAS_X_LOOP
describe ADVANCE_FEE_2_NEW_FRM_MNY Advance Fee fraud form and lots of money
meta __ADVANCE_FEE_3_NEW_FRM_MNY __FILL_THIS_FORM && LOTS_OF_MONEY && __ADVANCE_FEE_3_NEW
-meta ADVANCE_FEE_3_NEW_FRM_MNY __ADVANCE_FEE_3_NEW_FRM_MNY && !__HTML_LINK_IMAGE
+meta ADVANCE_FEE_3_NEW_FRM_MNY __ADVANCE_FEE_3_NEW_FRM_MNY && !__HTML_LINK_IMAGE && !__THREADED && !__HAS_SENDER && !__HAS_X_LOOP
describe ADVANCE_FEE_3_NEW_FRM_MNY Advance Fee fraud form and lots of money
meta __ADVANCE_FEE_4_NEW_FRM_MNY __FILL_THIS_FORM && LOTS_OF_MONEY && __ADVANCE_FEE_4_NEW
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf?rev=1413113&r1=1413112&r2=1413113&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf Sat Nov 24 01:39:51 2012
@@ -203,7 +203,7 @@ meta UN_NO_ML __UN && !__VIA
describe UN_NO_ML United Nations not via mailing list
tflags UN_NO_ML nopublish
-meta COMPENSATION __COMPENSATION && (__TO_NO_ARROWS_R || __FROM_RUNON) && !__DOS_HAS_LIST_UNSUB && !__HAS_X_LOOP && !__HAS_ERRORS_TO && !__UNSUB_LINK && !__OPERA_MID_NON_OP && !__FB_S_STOCK
+meta COMPENSATION __COMPENSATION && (__TO_NO_ARROWS_R || __FROM_RUNON) && !__DOS_HAS_LIST_UNSUB && !__HAS_X_LOOP && !__HAS_ERRORS_TO && !__UNSUB_LINK && !__OPERA_MID_NON_OP && !__FB_S_STOCK && !__COMMENT_EXISTS && !__NOT_SPOOFED
describe COMPENSATION "Compensation"
score COMPENSATION 1.50 # limit