You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2019/02/13 21:53:21 UTC
svn commit: r1853535 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Wed Feb 13 21:53:21 2019
New Revision: 1853535
URL: http://svn.apache.org/viewvc?rev=1853535&view=rev
Log:
Tuning Bitcoin extortion rules to respond to spammer changes
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1853535&r1=1853534&r2=1853535&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Wed Feb 13 21:53:21 2019
@@ -1954,9 +1954,9 @@ ifplugin Mail::SpamAssassin::Plugin::Rep
replace_rules __MY_MALWARE
body __PAY_ME /\s(?:<P><A><Y>\s<M><E>|(?:(?:<S><E><N><D>|<T><R><A><N><S><M><I><T>|<G><I><V><E>)\s<M><E>|<T><R><A><N><S><F><E><R>\s<T><H><E>\s<A><M><O><U><N><T>\s<O><F>|<I>\s<W><A><N><T>|<D><E><N>\s<B><E><T><R><A><G>\s<V><O><N>)\s(?:[\d,'.]+\s?(?:<U><S><D>?|<E><U><R>?(?:<O><S>)?)|<B><I><T><C><O><I><N>)|<M><A><K><E>\s<T><H><E>\s<P><A><Y><M><E><N><T>)[\s\.,]/i
replace_rules __PAY_ME
- body __YOUR_PASSWORD /\s<Y><O><U><R>\s<P><A><S><S><W><O><R><D>/i
+ body __YOUR_PASSWORD /\s<Y><O><U><R>\s(?:<P><A><S><S><W><O><R><D>|<P><S><W><D>\s)/i
replace_rules __YOUR_PASSWORD
- body __YOUR_WEBCAM /\s(?:<F><R><O><M>|<Y><O><U><R>)\s(?:<S><C><R><E><E><N>\s<A><N><D>\s)?(?:<W><E><B>[-\s]?|<F><R><O><N><T>[-\s]?)<C><A><M>/i
+ body __YOUR_WEBCAM /\s(?:<F><R><O><M>|<Y><O><U><R>)\s(?:(?:<S><C><R><E><E><N>|<D><E><S><K><T><O><P>)\s<A><N><D>\s|<O><W><N>\s)?(?:<W><E><B>[-\s]?|<F><R><O><N><T>[-\s]?)<C><A><M>/i
replace_rules __YOUR_WEBCAM
body __YOUR_ONAN /\s<Y><O><U><R>?\s(?:<M><A><S><T>(?:<U>|<R>){2}<B><A><T><I>(?:<O><N>|<N><G>)|<O><N><A><N><I><S><M>|<S><O><L><I><T><A><R><Y>\s<S><E><X>|<H><A><N><D>\s<F><U><C><K><I><N><G>)/i
replace_rules __YOUR_ONAN
@@ -1970,8 +1970,8 @@ else
body __MY_VICTIM /\b(?:hi|hello),?(?:\smy)?\s(?:victim|prey)\b/i
body __MY_MALWARE /\b(?:(?:I\s(?:put|set\s?up|installed)\sa\s|my\s(?:personal\s)?)(?:malware|virus|spy\s?ware|trojan|program\srecorded)|application[^\.]{1,30}(?:enable[sd]|allows)\sme\sto\s(?:access|control)|I\s(?:contaminated|infected|hacked|toxified|poisoned)\syour\s(?:machine|computer|gadget|(?:smart\s?)?phone|device)|Anwendung\s[^\.]{1,50}\sich\sauf\salle\sIhre\sdarauf\sgespeicherten\sDateien\szugreifen\skann)\b/i
body __PAY_ME /\b(?:pay\sme|(?:(?:send|transmit|give)\sme|transfer\sthe\samount\sof|I\swant|den\sbetrag\svon)\s(?:[\d,'.]+\s?(?:usd?|eur?(?:os)?)|bitcoin)|make\sthe\spayment)\b/i
- body __YOUR_PASSWORD /\byour\spassword\b/i
- body __YOUR_WEBCAM /\b(?:from|your)\s(?:screen\sand\s)?(?:web[-\s]?|front[-\s]?)cam\b/i
+ body __YOUR_PASSWORD /\byour\s(?:password|pswd)\b/i
+ body __YOUR_WEBCAM /\b(?:from|your)\s(?:(?:screen|desktop)\sand\s|own\s)?(?:web[-\s]?|front[-\s]?)cam\b/i
body __YOUR_ONAN /\byour?\s(?:mast[ur]{2}bati(?:on|ng)|onanism|solitary\ssex|hand\sfucking)\b/i
body __YOUR_PERSONAL /\b(?:your\s(?:personal|social\scontact)\s(?:info(?:rmation)?|data)|all\syour\sfiles)\b/i
body __HOURS_DEADLINE /\b(?:(?:give\syou|you\s(?:will\s)?have(?:\sonly|\sjust)?)(?:\sthe\slast)?\s\d+\s?(?:hours?|hr(?:\s?s)?)|(?:by|to|until|before)\sthe\send\sof\sthe\s(?:work(?:ing)?\s)?day|Ich\sgebe\sIhnen\s\d+\sStunden|\d+\shours?\sbefore\s(?:sending|releasing|exposing|publishing))\b/i