You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2015/12/18 18:36:38 UTC
svn commit: r1720829 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Fri Dec 18 17:36:38 2015
New Revision: 1720829
URL: http://svn.apache.org/viewvc?rev=1720829&view=rev
Log:
add GOOG_REDIR_HTML_ONLY
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1720829&r1=1720828&r2=1720829&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Fri Dec 18 17:36:38 2015
@@ -1940,13 +1940,20 @@ meta URI_ONLY_MSGID_MALF
describe URI_ONLY_MSGID_MALF URI only + malformed message ID
tflags URI_ONLY_MSGID_MALF publish
-meta GOOG_REDIR_SHORT __GOOG_REDIR && __KAM_BODY_LENGTH_LT_512
+# These may be a bit risky, the masscheck ham corpus may not
+# reflect how often these are legit in Real Life...
+meta GOOG_REDIR_SHORT __GOOG_REDIR && __LCL__KAM_BODY_LENGTH_LT_512
describe GOOG_REDIR_SHORT Google redirect to obscure spamvertised website + short message
tflags GOOG_REDIR_SHORT publish
meta GOOG_REDIR_NORDNS __GOOG_REDIR && RDNS_NONE
describe GOOG_REDIR_NORDNS Google redirect to obscure spamvertised website + no rDNS
+meta GOOG_REDIR_HTML_ONLY (__GOOG_REDIR && MIME_HTML_ONLY) && !RDNS_NONE && !__LCL__KAM_BODY_LENGTH_LT_512
+describe GOOG_REDIR_HTML_ONLY Google redirect to obscure spamvertised website + HTML only
+score GOOG_REDIR_HTML_ONLY 2.000 # limit
+
+
# low S/O, apparently lots of invisible ham...
rawbody __STY_INVIS /\bstyle\s*=(?:3d)?\s*"\s*(?:visibility\s*:\s*hidden\s*;|display\s*:\s*none\s*;|background\s*:)/i