You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2013/02/12 23:35:53 UTC
svn commit: r1445419 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Tue Feb 12 22:35:53 2013
New Revision: 1445419
URL: http://svn.apache.org/r1445419
Log:
TBIRD_SPOOF too dangerous
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1445419&r1=1445418&r2=1445419&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Tue Feb 12 22:35:53 2013
@@ -251,9 +251,10 @@ header __TB_MIME_BDRY_NO_Z Con
meta TBIRD_SUSP_MIME_BDRY __MUA_TBIRD && __TB_MIME_BDRY_NO_Z
describe TBIRD_SUSP_MIME_BDRY Unlikely Thunderbird MIME boundary
-meta TBIRD_SPOOF __MUA_TBIRD && !__HAS_IN_REPLY_TO && !__HAS_X_REF && !__THREADED && !__VIA_ML && !__NOT_SPOOFED && !__HAS_SENDER && !__HAS_ERRORS_TO && !__HAS_X_BEEN_THERE && !__RP_MATCHES_RCVD && !ALL_TRUSTED && !__TO_EQ_FROM_DOM && !__RCD_RDNS_MAIL_MESSY && !__MIME_BASE64 && !__S25R_1
-describe TBIRD_SPOOF Claims Thunderbird mail client but looks suspicious
-score TBIRD_SPOOF 2.00 # limit
+# too dangerous even if it has a good S/O and hits >20% of spam in masschecks
+#meta TBIRD_SPOOF __MUA_TBIRD && !__HAS_IN_REPLY_TO && !__HAS_X_REF && !__THREADED && !__VIA_ML && !__NOT_SPOOFED && !__HAS_SENDER && !__HAS_ERRORS_TO && !__HAS_X_BEEN_THERE && !__RP_MATCHES_RCVD && !ALL_TRUSTED && !__TO_EQ_FROM_DOM && !__RCD_RDNS_MAIL_MESSY && !__MIME_BASE64 && !__S25R_1
+#describe TBIRD_SPOOF Claims Thunderbird mail client but looks suspicious
+#score TBIRD_SPOOF 2.00 # limit
# seen in a few HTML fraud spams
rawbody RUNON_SHY /(?:\­){3}/i
@@ -294,6 +295,9 @@ ifplugin Mail::SpamAssassin::Plugin::Fre
describe FREEMAIL_RVW_ATTCH Please review attached document, from freemail
endif
+meta EMPTY_RVM_ATTCH (__PLS_REVIEW || __DLND_ATTACH) && __EMPTY_BODY
+describe EMPTY_RVM_ATTCH Please review attached document, empty message
+
body END_FUTURE_EMAILS /\bend future (?:email|alert)s?\b/i
describe END_FUTURE_EMAILS Pump-and-dump unsubscribe