You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2012/12/03 02:10:59 UTC
svn commit: r1416328 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Mon Dec 3 01:10:58 2012
New Revision: 1416328
URL: http://svn.apache.org/viewvc?rev=1416328&view=rev
Log:
tweak email phishing rules
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1416328&r1=1416327&r2=1416328&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Mon Dec 3 01:10:58 2012
@@ -980,11 +980,11 @@ body __WEBMAIL_ACCT /\byour
body __MAILBOX_FULL /\b(?:you(?:r (?:mailbox|(?:e-?|web ?)mail))? (?:is (?:almost )?full|(?:quota )?ha(?:s|ve) (?:reached|exceeded|passed) (?:the|your|it'?s?) (?:size|storage|set|(?:e-?|web ?)mail|quota|folder|mail ?box) (?:limit|quota))|over your mailbox (?:size )?(?:limit|quota))\b/i
body __CLEAN_MAILBOX /\b(?:(?:e-?mail|mailbox|violation:|(?-i:CLICK)) (?:quota size|clean(?:-?up))|clean ?up click ?here)\b/i
body __VALIDATE_MAILBOX /\b(?:re-?)?validate your mailbox\b/i
-body __UPGR_MAILBOX /\bup(?:g[ra]+d(?:e|ing)|date) (?:o[nf] )?(?:your )?(?:mailbox|(?:web ?|e-?)mail)\b/i
+body __UPGR_MAILBOX /\bup(?:g[ra]+d(?:e|ing)|date) (?:[hw]as\s(?:[a-z]+\s){1,5})?(?:o[nf] )?(?:your )?(?:mailbox|(?:web ?|e-?)mail)\b/i
body __SYSADMIN /\b(?:help?[- ]?desk|sys(?:tem )?admin(?:istrator)|local[- ]host|support team|message from administrator)\b/i
body __ATTN_MAIL_USER /\batt(?:entio)?n (?:web|e-?)?mail user[:;]/i
body __MAIL_ACCT_ACCESS1 /\byour (?:web|e-?)?mail (?:account|log-?in) (?:has )?been accessed\b/i
-body __MAIL_ACCT_ACCESS2 /\blo+se ac+es+ to your (?:web|e-?)?mail (?:account|log-?in|box)\b/i
+body __MAIL_ACCT_ACCESS2 /\blo+se ac+es+ to your (?:web|e-?)?mail (?:account|log-?in|box|address)\b/i
meta __EMAIL_PHISH (__WEBMAIL_ACCT + __MAILBOX_FULL + __CLEAN_MAILBOX + __VALIDATE_MAILBOX + __UPGR_MAILBOX + __SYSADMIN + __ATTN_MAIL_USER + __MAIL_ACCT_ACCESS1 + __MAIL_ACCT_ACCESS2 > 1)