You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2021/01/15 17:53:29 UTC
svn commit: r1885528 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Fri Jan 15 17:53:29 2021
New Revision: 1885528
URL: http://svn.apache.org/viewvc?rev=1885528&view=rev
Log:
More SUBJ_OBFU_PUNCT tuning; add rule for evaluation
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1885528&r1=1885527&r2=1885528&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Fri Jan 15 17:53:29 2021
@@ -1111,13 +1111,13 @@ header __XM_EC_MESSENGER X-Mai
#meta XM_EC_MESSENGER __XM_EC_MESSENGER
#describe XM_EC_MESSENGER eC-Messenger bulk mail service
-header __SUBJ_OBFU_PUNCT Subject =~ /(?:[-~`"!@\#$%^&*()_+={}|\\\/?<>,.:;][a-z][-~`"!@\#$%^&*()_+={}|\\\/?<>,.:;\s]|[a-z][~`"!@\#$%^&*()_+={}|\\?<>,.:;][a-z])/i
+header __SUBJ_OBFU_PUNCT Subject =~ /(?:[-~`"!@\#$%^&*()_+={}|\\\/?<>,.:;][a-z][-~`"!@\#$%^&*()_+={}|\\\/?<>,.:;\s]|(?:[a-z][~`"!@\#$%^&*()_+={}|\\?<>,.:;][a-z](?![a-z])))/i
tflags __SUBJ_OBFU_PUNCT multiple maxhits=4
meta __SUBJ_OBFU_PUNCT_NOEM __SUBJ_OBFU_PUNCT && !__SUBJ_HAS_ANY_EMAIL
-meta SUBJ_OBFU_PUNCT_FEW __SUBJ_OBFU_PUNCT > 1 && !SUBJ_OBFU_PUNCT_MANY && !__SUBJ_HAS_ANY_EMAIL && !__THREADED && !__HAS_X_MAILING_LIST && !__TVD_MIME_ATT
+meta SUBJ_OBFU_PUNCT_FEW __SUBJ_OBFU_PUNCT > 1 && !SUBJ_OBFU_PUNCT_MANY && !__SUBJ_HAS_ANY_EMAIL && !__TOUSR_IN_SUBJ && !__THREADED && !__HAS_X_MAILING_LIST && !__TVD_MIME_ATT
describe SUBJ_OBFU_PUNCT_FEW Possible punctuation-obfuscated message subject
score SUBJ_OBFU_PUNCT_FEW 0.500 # limit
-meta SUBJ_OBFU_PUNCT_MANY __SUBJ_OBFU_PUNCT > 2 && !__SUBJ_HAS_ANY_EMAIL && !__THREADED && !__HAS_X_MAILING_LIST && !__TVD_MIME_ATT
+meta SUBJ_OBFU_PUNCT_MANY __SUBJ_OBFU_PUNCT > 2 && !__SUBJ_HAS_ANY_EMAIL && !__TOUSR_IN_SUBJ && !__THREADED && !__HAS_X_MAILING_LIST && !__TVD_MIME_ATT
describe SUBJ_OBFU_PUNCT_MANY Punctuation-obfuscated message subject
score SUBJ_OBFU_PUNCT_MANY 2.000 # limit
@@ -3518,4 +3518,6 @@ score URI_FIREBASEAPP 3
tflags URI_FIREBASEAPP publish
+# seen in a few spams
+body __BTC_MLM /Block[-\s]?chain network marketing/i