You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2018/05/25 19:01:41 UTC
svn commit: r1832268 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Fri May 25 19:01:41 2018
New Revision: 1832268
URL: http://svn.apache.org/viewvc?rev=1832268&view=rev
Log:
Tuning __UNICODE_OBFU_URI_DOM to respond to spammer changes
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1832268&r1=1832267&r2=1832268&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Fri May 25 19:01:41 2018
@@ -2259,7 +2259,7 @@ describe HDR_ORDER_FTSDMCXX_DIRECT He
score HDR_ORDER_FTSDMCXX_DIRECT 2.500 # limit
tflags HDR_ORDER_FTSDMCXX_DIRECT publish
-body __UNICODE_OBFU_URI_DOM /[0-9a-z]{3,10}(?:\xe3\x80\x82|\xe7\x82\xb9)(?:com|net|info|biz|cn)\b/i
+body __UNICODE_OBFU_URI_DOM /[0-9a-z]{3,10}(?:\xe3\x80\x82|\xe7\x82\xb9)(?:c[o0]m|net|inf[o0]|biz|cn)\b/i
meta UNICODE_OBFU_DOM_NO_BODY __UNICODE_OBFU_URI_DOM && __EMPTY_BODY
score UNICODE_OBFU_DOM_NO_BODY 3.750 # limit
describe UNICODE_OBFU_DOM_NO_BODY Unicode/chinese obfuscated domain + no body