You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2016/02/05 05:31:07 UTC
svn commit: r1728597 - in /spamassassin/trunk/rulesrc/sandbox/jhardin:
20_lotsa_money.cf 20_misc_testing.cf
Author: jhardin
Date: Fri Feb 5 04:31:07 2016
New Revision: 1728597
URL: http://svn.apache.org/viewvc?rev=1728597&view=rev
Log:
more rule tweaking
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf?rev=1728597&r1=1728596&r2=1728597&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf Fri Feb 5 04:31:07 2016
@@ -161,8 +161,8 @@ body __FIFTY_FIFTY /\b(?:50|fifty
meta SHARE_50_50 (__SHARE_IT || __AGREED_RATIO) && __FIFTY_FIFTY
describe SHARE_50_50 Share the money 50/50
-body EMRCP /\bExcess Maximum Return Capital Profit\b/i
-describe EMRCP "Excess Maximum Return Capital Profit" Fidelity scam
+body EMRCP /\bExcess (?:Maximum )?Return Capital (?:Profits?|Funds?)\b/i
+describe EMRCP "Excess Maximum Return Capital Profit" scam
meta LUCRATIVE __LUCRATIVE && !ALL_TRUSTED && !__ANY_TEXT_ATTACH && !__REPLYTO_EXISTS && !__LCL__ENV_AND_HDR_FROM_MATCH
describe LUCRATIVE Make lots of money!
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1728597&r1=1728596&r2=1728597&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Fri Feb 5 04:31:07 2016
@@ -738,7 +738,7 @@ describe IMAGESHACK_URI
#describe DYNDNS_URIS Has multiple dyndns.org URIs
uri __BITLY_URI /\/\/bit\.ly\//i
-meta BITLY_URI __BITLY_URI && !__HDR_CASE_REVERSED && !__HAS_SENDER && !__HAS_CAMPAIGNID && !__DOS_HAS_LIST_UNSUB && !__HAS_ERRORS_TO && !__MAIL_LINK && !__MSGID_JAVAMAIL && !__ENV_AND_HDR_FROM_MATCH && !__THREADED && !__IMG_VIA_BITLY
+meta BITLY_URI __BITLY_URI && !__HDR_CASE_REVERSED && !__HAS_SENDER && !__HAS_CAMPAIGNID && !__DOS_HAS_LIST_UNSUB && !__HAS_ERRORS_TO && !__MAIL_LINK && !__MSGID_JAVAMAIL && !__ENV_AND_HDR_FROM_MATCH && !__THREADED && !__USING_VERP1 && !__IMG_VIA_BITLY
describe BITLY_URI URI contains bit.ly
score BITLY_URI 3.000 # limit
tflags BITLY_URI publish
@@ -2163,7 +2163,7 @@ header __FROM_WORDY F
#header __FROM_WORDY_3 From:addr =~ /(?:(?:[A-Z][A-Za-z]+|or|&)\.){2,}[A-Z][A-Za-z]+\@/
meta __FROM_WORDY_SONLY __FROM_WORDY && (__KHOP_NO_FULL_NAME || __CTYPE_HTML || __TO_EQ_FROM_DOM_2 || __HTML_IMG_ONLY || FREEMAIL_FORGED_REPLYTO )
-meta FROM_WORDY __FROM_WORDY_SONLY && !__LCL__ENV_AND_HDR_FROM_MATCH
+meta FROM_WORDY __FROM_WORDY_SONLY && !__LCL__ENV_AND_HDR_FROM_MATCH && !__HAS_TNEF && !__USING_VERP1
describe FROM_WORDY From address looks like a sentence
tflags FROM_WORDY publish