You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2012/11/18 20:55:07 UTC
svn commit: r1410970 - in /spamassassin/trunk/rulesrc/sandbox/jhardin:
20_lotsa_money.cf 20_misc_testing.cf
Author: jhardin
Date: Sun Nov 18 19:55:06 2012
New Revision: 1410970
URL: http://svn.apache.org/viewvc?rev=1410970&view=rev
Log:
Add rules for "compensation" and google docs URIs
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf?rev=1410970&r1=1410969&r2=1410970&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf Sun Nov 18 19:55:06 2012
@@ -201,6 +201,10 @@ body __FRAUD /\b(?:de)?frau
meta UN_NO_ML __UN && !__VIA_ML && !__UNSUB_LINK && !__COMMENT_EXISTS
describe UN_NO_ML United Nations not via mailing list
tflags UN_NO_ML nopublish
+
+meta COMPENSATION __COMPENSATION && (__TO_NO_ARROWS_R || __FROM_RUNON) && !__DOS_HAS_LIST_UNSUB && !__HAS_X_LOOP && !__HAS_ERRORS_TO && !__UNSUB_LINK && !__OPERA_MID_NON_OP && !__FB_S_STOCK
+describe COMPENSATION "Compensation"
+score COMPENSATION 1.50 # limit
body __TRUNK_BOX /\b(?:(?:trunk|metallic|proof|security|consignment)\sbox(?:es)?|sealed\ssafe)\b/i
body __COURIER /\bcourier\s(?:company|service)\b/i
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1410970&r1=1410969&r2=1410970&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Sun Nov 18 19:55:06 2012
@@ -979,6 +979,10 @@ meta GOOGLE_DOCS_PHISH (__GOOG
describe GOOGLE_DOCS_PHISH E-mail account phishing via a Google Docs form
score GOOGLE_DOCS_PHISH 2.00 # limit, until reviewed
+meta URI_GOOGLE_DOCS __URI_GOOGLE_DOC && !__DKIM_EXISTS && !__TO_EQ_FROM_DOM && !__DOS_REF_TODAY && !__DOS_BODY_FRI && !__DOS_BODY_WED && !__freemail_safe_fwd && !__TO_EQ_FROM_DOM && !__HAS_ERRORS_TO
+describe URI_GOOGLE_DOCS URI for Google Docs, common in phishing
+score URI_GOOGLE_DOCS 1.00 # limit
+
meta __EMAIL_URI_PHISH __HAS_ANY_URI && !__URI_GOOGLE_DOC && __EMAIL_PHISH
meta EMAIL_URI_PHISH __EMAIL_URI_PHISH
score EMAIL_URI_PHISH 2.00 # limit