You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2021/01/26 19:02:06 UTC
svn commit: r1885918 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Tue Jan 26 19:02:06 2021
New Revision: 1885918
URL: http://svn.apache.org/viewvc?rev=1885918&view=rev
Log:
Expose rule for scoring, fix mistake, other tweaks
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1885918&r1=1885917&r2=1885918&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Tue Jan 26 19:02:06 2021
@@ -3560,14 +3560,21 @@ tflags UNDISC_FREEM p
header __REPTO_LONG Reply-To:addr =~ /[a-z]{25,}\d*@/i
-# new spam pattern, is this enough to detect?
-uri __IMGUR_IMG m,^https?://i\.imgur\.com/[a-z0-9]{7}\.(?:png|jpe?g)$,i
+# content+respond+unsub texts as free hosted images
+uri __IMGUR_IMG m,^https?://i\.imgur\.com/[a-z0-9]{7}\.(?:png|gif|jpe?g)$,i
tflags __IMGUR_IMG multiple maxhits=5
meta __IMGUR_IMG_3 __IMGUR_IMG == 3
+meta HOSTED_IMG_MULTI_PUB_01 __IMGUR_IMG_3 && !__DATE_LOWER
+describe HOSTED_IMG_MULTI_PUB_01 Multiple hosted images at public site
+score HOSTED_IMG_MULTI_PUB_01 3.000 # limit
+tflags HOSTED_IMG_MULTI_PUB_01 publish
-body __OBFU_UNSUB_UL /(?:click_here|remove_your|our_emails|this_list)/
+body __OBFU_UNSUB_UL /(?:click_here|remove_your|our_emails|this_list|to_unsubscribe)/
+
+# observed in some phish/419 spams
+header __HAS_MAIL_REPLY_TO exists:Mail-Reply-To
ifplugin Mail::SpamAssassin::Plugin::FreeMail
- header __freemail_mailreplyto eval:check_freemail_replyto('Mail-Reply-To')
+ header __freemail_mailreplyto eval:check_freemail_header('Mail-Reply-To')
endif