You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2014/07/11 04:52:06 UTC
svn commit: r1609616 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Fri Jul 11 02:52:06 2014
New Revision: 1609616
URL: http://svn.apache.org/r1609616
Log:
various rule tweaks
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1609616&r1=1609615&r2=1609616&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Fri Jul 11 02:52:06 2014
@@ -1166,9 +1166,10 @@ score EMAIL_URI_PHISH 4.00 #
describe EMAIL_URI_PHISH Email account phishing using web form
tflags EMAIL_URI_PHISH publish # Force publication - very good S/O, hits mainly <= 3 points
-meta SYSADMIN __SYSADMIN && !ALL_TRUSTED && !__ANY_TEXT_ATTACH && !__DKIM_EXISTS && !__LCL__ENV_AND_HDR_FROM_MATCH
+meta SYSADMIN __SYSADMIN && !ALL_TRUSTED && !__ANY_TEXT_ATTACH && !__DKIM_EXISTS && !__LCL__ENV_AND_HDR_FROM_MATCH && !__MSGID_OK_DIGITS
describe SYSADMIN Supposedly from your IT department
score SYSADMIN 3.500 # limit
+tflags SYSADMIN publish
# suggested by MPerkel on the users list 11/10/2012
uri __URI_PROTO_MC /^(?!(?-i:(?:[Hh]ttps?|HTTPS?):))https?:/i
@@ -1361,7 +1362,7 @@ meta __HEXHASH_2 __HEXHASH
meta __HEXHASH_3 __HEXHASHWORD_S2EU > 2
meta __HEXHASH_4 __HEXHASHWORD_S2EU > 3
#meta __HEXHASH_5 __HEXHASHWORD_S2EU > 4
-meta HEXHASH_WORD (__HEXHASHWORD_S2EU > 1) && !ALL_TRUSTED && !__DKIM_EXISTS && !__BUGGED_IMG && !__RP_MATCHES_RCVD && !__LCL__ENV_AND_HDR_FROM_MATCH && !__FSL_TO_COMMON_ROLE && !__LYRIS_EZLM_REMAILER && !__THREADED && !__HDRS_LCASE && !__MSGID_HEXISH
+meta HEXHASH_WORD (__HEXHASHWORD_S2EU > 1) && !ALL_TRUSTED && !__DKIM_EXISTS && !__BUGGED_IMG && !__RP_MATCHES_RCVD && !__LCL__ENV_AND_HDR_FROM_MATCH && !__FSL_TO_COMMON_ROLE && !__LYRIS_EZLM_REMAILER && !__THREADED && !__HDRS_LCASE && !__MSGID_HEXISH && !__RDNS_SHORT
describe HEXHASH_WORD Multiple instances of word + hexadecimal hash
score HEXHASH_WORD 3.000 # limit
tflags HEXHASH_WORD publish
@@ -1555,7 +1556,7 @@ ifplugin Mail::SpamAssassin::Plugin::Rep
endif
-body NUM_FREE /\d+free/i
+body NUM_FREE /\b\d+free/i
describe NUM_FREE Number + free
# seen in spam (malware?) 07/2014