You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jm...@apache.org on 2006/11/17 18:19:48 UTC
svn commit: r476220 - /spamassassin/rules/trunk/sandbox/jm/20_basic.cf
Author: jm
Date: Fri Nov 17 09:19:48 2006
New Revision: 476220
URL: http://svn.apache.org/viewvc?view=rev&rev=476220
Log:
RATWARE_RCVD_LC_ESMTP3, RATWARE_RCVD_LC_ESMTP4, aimed at 'with esmtp' lines
Modified:
spamassassin/rules/trunk/sandbox/jm/20_basic.cf
Modified: spamassassin/rules/trunk/sandbox/jm/20_basic.cf
URL: http://svn.apache.org/viewvc/spamassassin/rules/trunk/sandbox/jm/20_basic.cf?view=diff&rev=476220&r1=476219&r2=476220
==============================================================================
--- spamassassin/rules/trunk/sandbox/jm/20_basic.cf (original)
+++ spamassassin/rules/trunk/sandbox/jm/20_basic.cf Fri Nov 17 09:19:48 2006
@@ -174,8 +174,6 @@
body __HAS_ANY_EMAIL /\w@\S+\.\w/
meta SB_GIF_AND_NO_URIS (__ANY_IMAGE_ATTACH&&!__HAS_ANY_URI&&!__HAS_ANY_EMAIL)
-header RATWARE_RCVD_LC_ESMTP2 Received =~ /from (?:unknown|\d+\.\d+\.\d+\.\d+)\s+\(HELO\s+\S+\)\s+by\s+\S+\s+with\s+(?:esmtp|local|smtp);\s/
-
meta JM_RCVD_FROM_2 (JM_RCVD_FROM && __ENV_AND_HDR_FROM_MATCH)
header MOLE_28001106 X-MimeOLE =~ /^Produced By Microsoft MimeOLE V6\.00\.2800\.1106$/
@@ -194,9 +192,15 @@
# compare with AXB_FAKETZ, GMD_FAKETZ
header L_SPAM_TOOL_13 Date =~ /\s[+-]\d(?![2358]45)\d[124-9]\d$/
+# "Tora" spam
header __MAILER_OL_6626 X-Mailer =~ /^Microsoft Outlook, Build 10\.0\.6626$/
header __MOLE_2962 X-MimeOLE =~ /^Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2962$/
header __NAKED_TO To =~ /^[^\s<>]+\@[^\s<>]+$/
meta JM_TORA_XM (__MAILER_OL_6626 && __MOLE_2962 && __NAKED_TO)
+# try a couple of rules to catch --
+# /home/jm/Mail/Spam2/303: by jmason.org with esmtp (;4OZ*/H/)>7. 4.2-+*)
+# /home/jm/Mail/Spam2/152: by smtp8.reportorial.net with esmtp (reportorial 8.71 #1 (reportorial))
+header RATWARE_RCVD_LC_ESMTP3 Received =~ / by \S+ with esmtp \([a-z]+ /
+header RATWARE_RCVD_LC_ESMTP4 Received =~ / by \S+ with esmtp \([^a-z ]{6,} /