svn commit: r1883773 - /spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf

[jh...@apache.org]

Author: jhardin
Date: Tue Nov 24 05:08:31 2020
New Revision: 1883773

URL: http://svn.apache.org/viewvc?rev=1883773&view=rev
Log:
More phishing tuning

Modified:
    spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf

Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1883773&r1=1883772&r2=1883773&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Tue Nov 24 05:08:31 2020
@@ -1269,16 +1269,17 @@ meta        __EMAIL_PHISH_MANY   (__WEBM
 meta        UPGRADE_MAILBOX      __UPGR_MAILBOX && __HTML_FONT_LOW_CONTRAST_MINFP 
 describe    UPGRADE_MAILBOX      Upgrade your mailbox! (phishing?)
 
-body        __ACCESS_SUSPENDED   /\b(?:(?:access|account) (?:suspension|has been (?:temporar(?:il)?y )(?:suspended|blocked|locked))|suspend (?:you from|your) access(?:ing)?|suspen(?:sion|se|ded) notice)\b/i
+body        __ACCESS_SUSPENDED   /\b(?:(?:access|account|e?-?mails) (?:suspension|(?:has|have) (?:been )?(?:temporar(?:il)?y (?:been )?)?(?:suspended|blocked|locked))|suspend (?:you from|your) access(?:ing)?|suspen(?:sion|se|ded) notice)\b/i
 tflags      __ACCESS_SUSPENDED   multiple maxhits=2
 body        __ACCESS_RESTORE     /\bto (?:(?:restore|regain) access|(?:remove|uplift) (?:the|this) suspens|continue using your (?:account|online|mailbox)|zugreifen wiederhergestellt)/i
 body        __ACCESS_REVOKE      /(?:(?:temporary|permanent) (?:de-?activation|removal) of your (?:\w{1,30} )?(?:access|account)|Ihre Kreditkarte wird gesperrt)/i
-body        __VERIFY_ACCOUNT     /(?:confirm|updated?|verify) (?:your|the) (?:(?:account|current|billing|personal|online)? ?(?:records?|information|account|identity|access|data|login)|"?[^\@\s]+\@\S+"? (?:account|mail ?box)|confirm verification|verify k?now|Ihre Angaben .berpr.ft und best.tigt)/i
+body        __VERIFY_ACCOUNT     /(?:confirm|updated?|verif(?:y|ied)) (?:your|the) (?:(?:account|current|billing|personal|online)? ?(?:records?|information|account|identity|access|data|login)|"?[^\@\s]+\@\S+"? (?:account|mail ?box)|confirm verification|verify k?now|Ihre Angaben .berpr.ft und best.tigt)/i
+tflags      __VERIFY_ACCOUNT     multiple maxhits=2
 body        __FAILED_LOGINS      /unsuc+es+ful log-?[io]n at+empts/i
 body        __ACCOUNT_REACTIV    /(?:(?:account|access) (?:has been )?(?:successfully )?(?:reviewed and )?re-?(?:activat(?:ion|ed)|new(?:al|ed))|(?:unlock|re-?activate|restore|recover) (?:your|the|this) (?:account|access))/i
 body        __SECURITY_DEPT      /\bsecurity dep(?:artmen)?t\b/i
 body        __ACCOUNT_ERROR      /\b(?:your account (?:is|appears to be) (?:incorrect|missing|in error|invalid))\b/i
-body        __ACCOUNT_DISRUPT    /\b(?:ensure (?:that )?your (?:account|access) is not (?:disrupted|suspended|interrupted)|(?:avoid|incoming) (?:[a-z]+ ){0,5}e?-?mails? (?:from )?being rejected|avoid (?:account|e?-?mail(?: ?box)?) (?:shut ?down|suspension|locking|termination|expiration))\b/i
+body        __ACCOUNT_DISRUPT    /\b(?:ensure (?:that )?your (?:account|access) is not (?:disrupted|suspended|interrupted)|(?:avoid|incoming) (?:[a-z]+ ){0,5}e?-?mails? (?:from )?being rejected|avoid (?:account|e?-?mail(?: ?box)? )?(?:shut ?down|suspension|locking|termination|expiration))\b/i
 tflags      __ACCOUNT_DISRUPT    multiple maxhits=2
 body        __ACCOUNT_UPGRADE    /\b(?:upgrade (?:of )your (?:account|access)|your (?:access|account) is[\w\s]{0,40}being upgraded|Weiter zur Aktualisierung)\b/i
 body        __ACCOUNT_SECURE     /\b(?:make your (?:"?[^\@\s]+\@\S+"? |e-?mail )?account more secure|Ihre Kreditkarte weist einige Sicherheitsprobleme)\b/i