You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2011/02/26 19:10:47 UTC
svn commit: r1074891 - in /spamassassin/trunk/rulesrc/sandbox/jhardin:
20_lotsa_money.cf 20_misc_testing.cf 20_tbird_image_spam.cf
Author: jhardin
Date: Sat Feb 26 18:10:47 2011
New Revision: 1074891
URL: http://svn.apache.org/viewvc?rev=1074891&view=rev
Log:
More FP avoidance
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
spamassassin/trunk/rulesrc/sandbox/jhardin/20_tbird_image_spam.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf?rev=1074891&r1=1074890&r2=1074891&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf Sat Feb 26 18:10:47 2011
@@ -233,8 +233,8 @@ body __FRAUD_PTX /\b(?:ass?ass?inat(?:ed
body __FRAUD_XWW /\b(?:honest(?:ly)?\sco(?:-?operat(?:e|ion)|llaborat(?:e|ion))|ehrliche\szusammenarbeit)\b/i
body __FRAUD_IOV /\b(?:no risks?|risk-? *free|free of risks?|100% safe|v.llig Risikofrei ist)\b/i
-meta RISK_FREE __FRAUD_IOV && !__UNSUB_LINK && !__VIA_ML && !__HTML_LINK_IMAGE
-describe RISK_FREE No risk
+meta RISK_FREE __FRAUD_IOV && !__UNSUB_LINK && !__VIA_ML && !__HTML_LINK_IMAGE && !__SUBSCRIPTION_INFO && !__HS_SUBJ_RE_FW
+describe RISK_FREE No risk!
#meta MONEY_FRAUD LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH + __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __F
OUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX + __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + LOTTO_AGENT_FM + LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 1) && !__VIA_ML && !__HAS_THREAD_INDEX
#score MONEY_FRAUD 0.25
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1074891&r1=1074890&r2=1074891&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Sat Feb 26 18:10:47 2011
@@ -76,7 +76,8 @@ header __FROM_RUNON Fro
meta FROM_MISSP_SPF_FAIL (__FROM_RUNON && SPF_FAIL)
tflags FROM_MISSP_SPF_FAIL net
-meta FROM_MISSP_EH_MATCH (__FROM_RUNON && __ENV_AND_HDR_FROM_MATCH) && !__RCD_RDNS_MTA_MESSY && !__UNSUB_LINK && !__COMMENT_EXISTS
+meta __FROM_MISSP_EH_MATCH __FROM_RUNON && __ENV_AND_HDR_FROM_MATCH
+meta FROM_MISSP_EH_MATCH __FROM_MISSP_EH_MATCH && !__RCD_RDNS_MTA_MESSY && !__UNSUB_LINK && !__COMMENT_EXISTS && !__TO___LOWER
describe FROM_MISSP_EH_MATCH From misspaced, matches envelope
meta FROM_MISSP_URI (__FROM_RUNON && __HAS_ANY_URI) && !__NOT_SPOOFED && !__RCD_RDNS_MTA_MESSY && !MISSING_MIMEOLE && !__COMMENT_EXISTS && !__REPTO_QUOTE
@@ -204,7 +205,7 @@ header SUBJ_RE_CLNCLN Subje
describe SUBJ_RE_CLNCLN Subject RE::
uri __MANY_SUBDOM m;^https?://(?:[^\./]{1,30}\.){6};
-meta MANY_SUBDOM __MANY_SUBDOM && !__JM_REACTOR_DATE && !__UNSUB_LINK && !__VIA_ML
+meta MANY_SUBDOM __MANY_SUBDOM && !__JM_REACTOR_DATE && !__UNSUB_LINK && !__VIA_ML && !NO_RELAYS && !__UPPERCASE_URI
describe MANY_SUBDOM Lots and lots of subdomain parts in a URI
# by request of Benny Pedersen <me...@junc.org> on the users list 10/9/2009
@@ -508,10 +509,10 @@ describe FROM_ONE_CHAR Bogus
# 12-letter domain names, suggested by Len Conrad on the users list
#header RCVD_12LTRDOM Received =~ /[(\s.][a-z]{12}\./
#tflags RCVD_12LTRDOM nopublish
-header RPATH_12LTRDOM Return-Path =~ /\@[a-z]{12}\./
-tflags RPATH_12LTRDOM nopublish
+header __RPATH_12LTRDOM Return-Path =~ /\@[a-z]{12}\./
+#tflags RPATH_12LTRDOM nopublish
header __FROM_12LTRDOM_1 From =~ /\@[a-z]{12}\./
-meta FROM_12LTRDOM __FROM_12LTRDOM_1 && !__VIA_ML && !__TO___LOWER && !__FS_SUBJ_RE && !__RCD_RDNS_MAIL_MESSY && !__freemail_safe && !__RCVD_IN_DNSWL && !__UNSUB_LINK
+meta FROM_12LTRDOM __FROM_12LTRDOM_1 && !__VIA_ML && !__TO___LOWER && !__FS_SUBJ_RE && !__RCD_RDNS_MAIL_MESSY && !__freemail_safe && !__RCVD_IN_DNSWL && !__UNSUB_LINK && !NO_RELAYS && !__UNUSABLE_MSGID && !DATE_IN_PAST_96_XX
#tflags FROM_12LTRDOM nopublish
#uri URI_12LTRDOM m,://(?:[^./]+\.)*[a-z]{12}\.[^./]+/,
#tflags URI_12LTRDOM nopublish
@@ -584,3 +585,6 @@ tflags NSL_TO_ENDS_COMMA nopub
body CN_B2B_SPAMMER /We are a China[-\s]based/i
describe CN_B2B_SPAMMER Chinese company introducing itself
+# __ version of khopesh UPPERCASE_URI, for use in metas
+uri __UPPERCASE_URI /^[^:A-Z]+[A-Z]/
+
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_tbird_image_spam.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_tbird_image_spam.cf?rev=1074891&r1=1074890&r2=1074891&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_tbird_image_spam.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_tbird_image_spam.cf Sat Feb 26 18:10:47 2011
@@ -33,23 +33,28 @@ meta TO_NO_BRKTS_HTML_IMG __TO_
score TO_NO_BRKTS_HTML_IMG 0.20
describe TO_NO_BRKTS_HTML_IMG To: misformatted and HTML and one image
-meta TO_NO_BRKTS_HTML_ONLY __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && MIME_HTML_ONLY && !__MIME_QP && !__MSGID_JAVAMAIL && !__HAS_X_MAILER && !__HAS_REPLY_TO && !__CTYPE_CHARSET_QUOTED && !__SUBJECT_ENCODED_B64 && !__VIA_ML && !__MSGID_BEFORE_RECEIVED
+meta __TO_NO_BRKTS_HTML_ONLY __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && MIME_HTML_ONLY
+meta TO_NO_BRKTS_HTML_ONLY __TO_NO_BRKTS_HTML_ONLY && !__MIME_QP && !__MSGID_JAVAMAIL && !__HAS_X_MAILER && !__HAS_REPLY_TO && !__CTYPE_CHARSET_QUOTED && !__SUBJECT_ENCODED_B64 && !__VIA_ML && !__MSGID_BEFORE_RECEIVED && !__MIME_BASE64 && !__RCD_RDNS_MAIL_MESSY
score TO_NO_BRKTS_HTML_ONLY 0.20
describe TO_NO_BRKTS_HTML_ONLY To: misformatted and HTML only
-meta TO_NO_BRKTS_DYNIP __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && RDNS_DYNAMIC && !__NAME_IS_EMAIL && !__MSGID_OK_HEX && !__HAS_X_MAILER && !__MIME_QP && !__UNSUB_LINK && !__THREADED && !__HAVE_BOUNCE_RELAYS && !__VIA_ML && !__DOS_RELAYED_EXT
+meta __TO_NO_BRKTS_DYNIP __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && RDNS_DYNAMIC
+meta TO_NO_BRKTS_DYNIP __TO_NO_BRKTS_DYNIP && !__NAME_IS_EMAIL && !__MSGID_OK_HEX && !__HAS_X_MAILER && !__MIME_QP && !__UNSUB_LINK && !__THREADED && !__HAVE_BOUNCE_RELAYS && !__VIA_ML && !__DOS_RELAYED_EXT
describe TO_NO_BRKTS_DYNIP To: misformatted and dynamic rDNS
tflags TO_NO_BRKTS_DYNIP publish
-meta TO_NO_BRKTS_NORDNS __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && RDNS_NONE && !__MANY_RECIPS && !__FROM_RUNON && !__VIA_ML && !__TO___LOWER && !ALL_TRUSTED && !__TO_EQ_FROM_DOM && !__DOS_REF_TODAY && (__HDRS_LCASE > 1)
+meta __TO_NO_BRKTS_NORDNS __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && RDNS_NONE
+meta TO_NO_BRKTS_NORDNS __TO_NO_BRKTS_NORDNS && !__MANY_RECIPS && !__FROM_RUNON && !__VIA_ML && !__TO___LOWER && !ALL_TRUSTED && !__TO_EQ_FROM_DOM && !__DOS_REF_TODAY && (__HDRS_LCASE > 1)
score TO_NO_BRKTS_NORDNS 0.20
describe TO_NO_BRKTS_NORDNS To: misformatted and no rDNS
-meta TO_NO_BRKTS_NORDNS_HTML __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && RDNS_NONE && MIME_HTML_ONLY && !__MIME_QP && !__MSGID_JAVAMAIL && !__REPLYTO_EXISTS && !__MSGID_BEFORE_RECEIVED && !__VIA_ML && !__UA_MUTT && !__FROM_FREEMAIL && !__HAS_X_MAILER && !__COMMENT_EXISTS && !__HTML_LENGTH_384 && !__MIME_BASE64
+meta __TO_NO_BRKTS_NORDNS_HTML __TO_NO_BRKTS_HTML_ONLY && RDNS_NONE
+meta TO_NO_BRKTS_NORDNS_HTML __TO_NO_BRKTS_NORDNS_HTML && !__MIME_QP && !__MSGID_JAVAMAIL && !__REPLYTO_EXISTS && !__MSGID_BEFORE_RECEIVED && !__VIA_ML && !__UA_MUTT && !__FROM_FREEMAIL && !__HAS_X_MAILER && !__COMMENT_EXISTS && !__HTML_LENGTH_384 && !__MIME_BASE64 && !__UPPERCASE_URI && !__TO___LOWER
score TO_NO_BRKTS_NORDNS_HTML 0.20
describe TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only
-meta TO_NO_BRKTS_MSFT __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && (__ANY_OUTLOOK_MUA || __HAS_MIMEOLE || __MIMEOLE_MS)
+meta __TO_NO_BRKTS_MSFT __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && (__ANY_OUTLOOK_MUA || __HAS_MIMEOLE || __MIMEOLE_MS)
+meta TO_NO_BRKTS_MSFT __TO_NO_BRKTS_MSFT && !__VIA_ML && !__LYRIS_EZLM_REMAILER
describe TO_NO_BRKTS_MSFT To: misformatted and supposed Microsoft tool
score TO_NO_BRKTS_MSFT 0.20
@@ -61,7 +66,8 @@ meta TO_NO_BRKTS_DIRECT __TO
describe TO_NO_BRKTS_DIRECT To: misformatted and direct-to-MX
tflags TO_NO_BRKTS_DIRECT publish
-meta TO_NO_BRKTS_NOTLIST __TO_NO_ARROWS_R && !__VIA_ML && !__UNUSABLE_MSGID && !__THREADED && !__SUBJ_RE && !__MIME_QP && !__COMMENT_EXISTS && !__RCD_RDNS_MAIL_MESSY && !__CTYPE_MULTIPART_ALT && !__MANY_RECIPS && !__DOS_RELAYED_EXT && !__HAS_MIMEOLE && !__THREAD_INDEX_GOOD && !__IMS_MSGID && !__RCD_RDNS_MTA_MESSY && !__MSGID_OK_HOST && !__BOUNCE_RPATH_NULL && !__BOUNCE_STAT_FAIL && !__BOUNCE_CTYPE && !ALL_TRUSTED && !__FB_DO_NOT_REPLY && !__NOT_SPOOFED && !__DEAL && !__FH_HAS_XPRIORITY
+meta __TO_NO_BRKTS_NOTLIST __TO_NO_ARROWS_R && !__VIA_ML
+meta TO_NO_BRKTS_NOTLIST __TO_NO_BRKTS_NOTLIST && !__UNUSABLE_MSGID && !__THREADED && !__SUBJ_RE && !__MIME_QP && !__COMMENT_EXISTS && !__RCD_RDNS_MAIL_MESSY && !__CTYPE_MULTIPART_ALT && !__MANY_RECIPS && !__DOS_RELAYED_EXT && !__HAS_MIMEOLE && !__THREAD_INDEX_GOOD && !__IMS_MSGID && !__RCD_RDNS_MTA_MESSY && !__MSGID_OK_HOST && !__BOUNCE_RPATH_NULL && !__BOUNCE_STAT_FAIL && !__BOUNCE_CTYPE && !ALL_TRUSTED && !__FB_DO_NOT_REPLY && !__NOT_SPOOFED && !__DEAL && !__FH_HAS_XPRIORITY && !__RPATH_12LTRDOM && !__MIME_BASE64 && !__UPPERCASE_URI && !__TO___LOWER
describe TO_NO_BRKTS_NOTLIST To: misformatted and not a mailing list