svn commit: rev 6845 - incubator/spamassassin/trunk/rules

[qu...@apache.org]

Author: quinlan
Date: Mon Feb 23 22:48:19 2004
New Revision: 6845

Modified:
   incubator/spamassassin/trunk/rules/70_testing.cf
Log:
add some T_RCVD_DOUBLE_IP variants


Modified: incubator/spamassassin/trunk/rules/70_testing.cf
==============================================================================
--- incubator/spamassassin/trunk/rules/70_testing.cf	(original)
+++ incubator/spamassassin/trunk/rules/70_testing.cf	Mon Feb 23 22:48:19 2004
@@ -441,6 +441,13 @@
 header T_RCVD_DOUBLE_IP		Received =~ /from \[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\] by \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} with HTTP;/
 describe T_RCVD_DOUBLE_IP	Bulk email fingerprint (double IP) found
 
+# variants - go crazy, whoo!
+header T_RCVD_DOUBLE_IP_2	Received =~ /from \[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\] by \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} with/
+header T_RCVD_DOUBLE_IP_3	Received =~ /from \[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\] by \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/
+header T_RCVD_DOUBLE_IP_4	Received =~ /\b(?:from|by)\b.{1,2}\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b.{1,2}\b(?:by|from)\b.{1,2}\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/i
+header T_RCVD_DOUBLE_IP_5	Received =~ /\b(?:from|by)\b.{1,2}\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?<!127\.0\.0\.1)\b.{1,2}\b(?:by|from)\b.{1,2}\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?<!127\.0\.0\.1)\b/i
+header T_RCVD_DOUBLE_IP_6	Received =~ /\b\w+\b.{1,2}\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?<!127\.0\.0\.1)\b.{1,2}\b\w+\b.{1,2}\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?<!127\.0\.0\.1)\b/i
+
 header T_MIME_BOUND_DIGITS15	Content-Type =~ /boundary=\"\d{15,}\"/
 describe T_MIME_BOUND_DIGITS15	MIME boundary contains all digits