You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2009/09/22 17:12:04 UTC
svn commit: r817690 - in /spamassassin/trunk/rulesrc/sandbox/jhardin:
20_lotsa_money.cf 20_misc_testing.cf
Author: jhardin
Date: Tue Sep 22 15:12:03 2009
New Revision: 817690
URL: http://svn.apache.org/viewvc?rev=817690&view=rev
Log:
tweak lotsa_money, add some more testing rules
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf?rev=817690&r1=817689&r2=817690&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf Tue Sep 22 15:12:03 2009
@@ -7,7 +7,7 @@
body __LOTSA_MONEY_01 /(?:[Ss][Uu][Mm]\s[Oo][Ff]\s|<CURRENCY>\s?)\s?\d[\d.,\sO]{5,20}[\dO]/
body __LOTSA_MONEY_02 /\d[\d.,\sO]{5,20}[\dO]\s?(?:<CURRENCY>|Pounds)\b/
body __LOTSA_MONEY_03 /(?:[Ss][Uu][Mm]\s[Oo][Ff]\s|<CURRENCY>\s?)\d(?:[\d.,\sO]{0,5})?(?:[Mm](?:[Ii][Ll])?\b|[Mm][Ii][Ll]+(?:[Ii][Oo]|<O>)[Nn]|[Hh][Uu][Nn][Dd][RrEe]+[DdTt]|[Tt][Hh][Oo][Uu][Ss][Aa][Nn][Dd]|[Tt][Aa][Uu][Ss][Ee][Nn][Dd])/
- body __LOTSA_MONEY_04 /(?:million(?!s)|mill<O>n|hundred(?!s)[^\.]{1,25}thousand(?!s)|cents?[^\.]{1,25}mille|hundert[^\.]{1,30}tausend|ientos?[^\.]{1,20}mil)[^\.\$]{0,50}(?:(?:U\.?\s?S\.?\s?(?:A\.?\s?)?|united\sstates?|canad(?:ian|a)\s)?dollars?|USD|GBP|<GB_UK>\spounds?|(?:<GB_UK>\s)?pounds?\ssterling|(?:d'\s?)?euros?)\b/i
+ body __LOTSA_MONEY_04 /(?:million(?!s)|mill<O>n|hundred(?!s)[^\.]{1,25}thousand(?!s)|cents?[^\.]{1,25}mille|hundert[^\.]{1,30}tausend|ientos?[^\.]{1,20}mil)[^\.\$]{0,50}(?:(?:U\.?\s?S\.?\s?(?:A\.?\s?)?|united\s?states?|canad(?:ian|a)\s)?dollars?|USD|GBP|<GB_UK>\spounds?|(?:<GB_UK>\s)?pounds?\ssterling|(?:d'\s?)?euros?)\b/i
replace_rules __LOTSA_MONEY_00 __LOTSA_MONEY_01 __LOTSA_MONEY_02 __LOTSA_MONEY_03 __LOTSA_MONEY_04
meta LOTS_OF_MONEY (__LOTSA_MONEY_00 || __LOTSA_MONEY_01 || __LOTSA_MONEY_02 || __LOTSA_MONEY_03 || __LOTSA_MONEY_04)
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=817690&r1=817689&r2=817690&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Tue Sep 22 15:12:03 2009
@@ -63,7 +63,8 @@
describe MAILER_EQ_ORG X-Mailer: same as Organization:
# observed in UCE 9/2009
-header __HDRS_LCASE ALL =~ /\n(?:Reply-to|Message-id|Content-type|X-MSMail-priority|from|subject|to|Disposition-notification-to):/sm
+#header __HDRS_LCASE ALL =~ /\n(?:Reply-to|Message-id|Content-type|X-MSMail-priority|from|subject|to|Disposition-notification-to):/sm
+header __HDRS_LCASE ALL =~ /\n(?:Message-id|Content-type|X-MSMail-priority|from|subject|to|Disposition-notification-to):/sm
tflags __HDRS_LCASE multiple
meta HDRS_LCASE __HDRS_LCASE > 1
describe HDRS_LCASE Odd capitalization of multiple message headers
@@ -115,4 +116,24 @@
score RVW_ATTCH_FREEMAIL 1.0
endif
+body END_FUTURE_EMAILS /\bend future emails\b/i
+score END_FUTURE_EMAILS 0.25
+describe END_FUTURE_EMAILS Unsubscribe
+
+body AD_COMPLAINTS /\bcomplaints about this ad+\b/i
+score AD_COMPLAINTS 1.0
+describe AD_COMPLAINTS Complain about this spam
+
+# observed in bank phishing 09/2009
+rawbody MISQ_HTML /<\w{1,20}[^>]{1,30}=[^"][^">]{1,30}"/
+describe MISQ_HTML Unbalanced quotes in HTML tag
+
+# observed in bank phishing 09/2009
+uri WIKI_IMG m,^https?://[^/]+wiki[mp]edia\.org/.+\.(?:png|gif|jpe?g),i
+describe WIKI_IMG Image from wikipedia
+
+# observed in spam 09/2009
+header SUBJ_RE_CLNCLN Subject =~ /^\s*RE::/
+describe SUBJ_RE_CLNCLN Subject RE::
+