You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by fe...@apache.org on 2006/04/11 06:57:12 UTC
svn commit: r393144 -
/spamassassin/rules/trunk/sandbox/felicity/70_phishing.cf
Author: felicity
Date: Mon Apr 10 21:57:11 2006
New Revision: 393144
URL: http://svn.apache.org/viewcvs?rev=393144&view=rev
Log:
work around phishing rule fp
Modified:
spamassassin/rules/trunk/sandbox/felicity/70_phishing.cf
Modified: spamassassin/rules/trunk/sandbox/felicity/70_phishing.cf
URL: http://svn.apache.org/viewcvs/spamassassin/rules/trunk/sandbox/felicity/70_phishing.cf?rev=393144&r1=393143&r2=393144&view=diff
==============================================================================
--- spamassassin/rules/trunk/sandbox/felicity/70_phishing.cf (original)
+++ spamassassin/rules/trunk/sandbox/felicity/70_phishing.cf Mon Apr 10 21:57:11 2006
@@ -117,19 +117,25 @@
# 0.180 0.2165 0.0000 1.000 0.86 0.01 T_TVD_PH_SUBJ_URGENT
header TVD_PH_SUBJ_ACCOUNTS_PRE Subject =~ /\baccounts? (?:[a-z_,-]+ )*(?:record[a-z]*|suspen[a-z]+|notif(?:y|ication)|security|updated?)\b/i
header TVD_PH_SUBJ_SEC_MEASURES Subject =~ /\bsecurity (?:[a-z_,-]+ )*measures?\b/i
-header TVD_PH_SUBJ_UPDATE Subject =~ /\bupdate (?:[a-z_,-]+ )*(?:accounts?|access|credit|records?|info(?:rmation)?)\b/i
+header TVD_PH_SUBJ_UPDATE Subject =~ /\bupdate (?:[a-z_,-]+ )*(?:access|credit|records?|info(?:rmation)?)\b/i
header TVD_PH_SUBJ_URGENT Subject =~ /^urgent(?:[\s\W]*$|.{1,40}(?:alert|response|assistance|proposal|reply|warning|noti(?:ce|fication)|greeting|matter))/i
header TVD_PH_SUBJ_ACCOUNTS_POST Subject =~ /\b(?:(?:re-?)?activat[a-z]*|secure|verify|restore|flagged|limited|unusual|report|notif(?:y|ication)|suspen(?:d|ded|sion)) (?:[a-z_,-]+ )*accounts?\b/i
+
########################################################################
# Look for lesser matched REs and meta them together
# 0.251 0.3023 0.0000 1.000 1.00 0.01 T_TVD_PH_SUBJ_META
-meta TVD_PH_SUBJ_META __TVD_PH_BODY_01 || __TVD_PH_SUBJ_00 || __TVD_PH_SUBJ_02 || __TVD_PH_SUBJ_04 || __TVD_PH_SUBJ_15 || __TVD_PH_SUBJ_17 || __TVD_PH_SUBJ_18 || __TVD_PH_SUBJ_19 || __TVD_PH_SUBJ_29 || __TVD_PH_SUBJ_31 || __TVD_PH_SUBJ_36 || __TVD_PH_SUBJ_37 || __TVD_PH_SUBJ_38 || __TVD_PH_SUBJ_39 || __TVD_PH_SUBJ_41 || __TVD_PH_SUBJ_52 || __TVD_PH_SUBJ_54 || __TVD_PH_SUBJ_56 || __TVD_PH_SUBJ_58 || __TVD_PH_SUBJ_59 || __TVD_PH_SUBJ_ACCESS_POST
+meta TVD_PH_SUBJ_META __TVD_PH_BODY_01 || __TVD_PH_SUBJ_00 || __TVD_PH_SUBJ_01 || __TVD_PH_SUBJ_02 || __TVD_PH_SUBJ_04 || __TVD_PH_SUBJ_15 || __TVD_PH_SUBJ_17 || __TVD_PH_SUBJ_18 || __TVD_PH_SUBJ_19 || __TVD_PH_SUBJ_29 || __TVD_PH_SUBJ_31 || __TVD_PH_SUBJ_36 || __TVD_PH_SUBJ_37 || __TVD_PH_SUBJ_38 || __TVD_PH_SUBJ_39 || __TVD_PH_SUBJ_41 || __TVD_PH_SUBJ_52 || __TVD_PH_SUBJ_54 || __TVD_PH_SUBJ_56 || __TVD_PH_SUBJ_58 || __TVD_PH_SUBJ_59 || __TVD_PH_SUBJ_ACCESS_POST
body __TVD_PH_BODY_01 /\baccount .{0,20}placed? [io]n restricted status/i
header __TVD_PH_SUBJ_00 Subject =~ /\brewards? survey\b/i
+
+# avoid FP by requiring at least one word between the words, makes it not able
+# to be part of TVD_PH_SUBJ_UPDATE which doesn't require a word in between
+header __TVD_PH_SUBJ_01 Subject =~ /\bupdate (?:[a-z_,-]+ )+accounts?\b/i
+
header __TVD_PH_SUBJ_02 Subject =~ /\byour payment has been sent\b/i
header __TVD_PH_SUBJ_04 Subject =~ /\baccounts? profile\b/i
header __TVD_PH_SUBJ_15 Subject =~ /\binvestment for (?:[a-z_,-]+ )*to(?:morrow|day)\b/i