You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by sm...@apache.org on 2013/03/26 01:45:41 UTC
svn commit: r1460940 - in /spamassassin/trunk/rulesrc/sandbox/smf: 20_smf.cf
30_smf_nontest.cf
Author: smf
Date: Tue Mar 26 00:45:41 2013
New Revision: 1460940
URL: http://svn.apache.org/r1460940
Log:
Sandbox updates
Modified:
spamassassin/trunk/rulesrc/sandbox/smf/20_smf.cf
spamassassin/trunk/rulesrc/sandbox/smf/30_smf_nontest.cf
Modified: spamassassin/trunk/rulesrc/sandbox/smf/20_smf.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/smf/20_smf.cf?rev=1460940&r1=1460939&r2=1460940&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/smf/20_smf.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/smf/20_smf.cf Tue Mar 26 00:45:41 2013
@@ -7,7 +7,9 @@ describe FSL_NOT_FROM_GOOGLE Envelope
header __FSL_RELAY_YAHOO X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.yahoo(?:dns)?\.co(?:m|\.jp) /i
header __FSL_ENVFROM_YAHOO X-Spam-Relays-External =~ /^[^\]]+ envfrom=[^\@ ]+\@yahoo(?:groups)?\./i
-meta FSL_NOT_FROM_YAHOO __FSL_ENVFROM_YAHOO && !__FSL_RELAY_YAHOO
+header __FSL_ENVFROM_YMAIL X-Spam-Relays-External =~ /^[^\]]+ envfrom=[^\@ ]+\@ymail\.com /i
+header __FSL_ENVFROM_ROCKET X-Spam-Relays-External =~ /^[^\]]+ envfrom=[^\@ ]+\@rocketmail\.com /i
+meta FSL_NOT_FROM_YAHOO ((__FSL_ENVFROM_YAHOO || __FSL_ENVFROM_YMAIL || __FSL_ENVFROM_ROCKET) && !__FSL_RELAY_YAHOO)
score FSL_NOT_FROM_YAHOO 2.0
describe FSL_NOT_FROM_YAHOO Envelope-From Yahoo or Yahoo Groups but not originated from Yahoo systems
@@ -112,8 +114,9 @@ score FSL_TO_ROLE_BULK 1.0
# Received: from hwyhsxwaxz (amandacallow@113.162.65.176 with login) by
header __FSL_YAHOO_AUTH1 Received =~ /from [a-z]{10} \([^\@ ]+\@\d+\.\d+\.\d+\.\d+ with (?:plain|login)\) /
# Received: from localhost (rhinotrick@46.185.178.15 with login) by
-header __FSL_YAHOO_AUTH2 Received =~ /from localhost \([^\@ ]+\@\d+\.\d+\.\d+\.\d+ with (?:plain|login)\) /
-meta FSL_YAHOO_AUTH_SIG (__FSL_RELAY_YAHOO && (__FSL_YAHOO_AUTH1 || __FSL_YAHOO_AUTH2))
+header __FSL_YAHOO_AUTH2 Received =~ /from localhost \([^\@ ]+\@\d+\.\d+\.\d+\.\d+ with (?:plain|login)\) /i
+header __FSL_YAHOO_AUTH3 Received =~ /from user \([^\@ ]+\@\d+\.\d+\.\d+\.\d+ with (?:plain|login)\) /i
+meta FSL_YAHOO_AUTH_SIG (__FSL_RELAY_YAHOO && (__FSL_YAHOO_AUTH1 || __FSL_YAHOO_AUTH2 || __FSL_YAHOO_AUTH3))
describe FSL_YAHOO_AUTH_SIG Yahoo SMTP AUTH observed patterns
score FSL_YAHOO_AUTH_SIG 5.0
@@ -126,8 +129,15 @@ describe FSL_UNSUB_RATWARE Unsubscri
score FSL_UNSUB_RATWARE 3.0
# Based on John Hardin's MONEY_FROM_41
-header __FSL_IPV4_41 ALL =~ / \[?41\.(?:[0-9]{1,3}\.){2}[0-9]{1,3}\]?/
+header __FSL_IPV4_41 ALL =~ /(?:\(|\s+)?\[?41\.(?:[0-9]{1,3}\.){2}[0-9]{1,3}\]?/
body __FSL_URGENT_ASSIST /your urgent assist/i
body __FSL_MAIL_HAS /your mail has/i
-meta FSL_FRAUD_FROM_41 (__FSL_IPV4_41 && (LOTS_OF_MONEY || FSL_MY_NAME_IS || __FSL_URGENT_ASSIST || __FSL_MAIL_HAS))
+header __FSL_SUBJECT_EMAIL Subject =~ /\b[^\@ ]+\@[^\@ ]+\b/
+body __FSL_ATM_CARD /\bATM [Cc][Aa][Rr][Dd]\b/
+meta FSL_FRAUD_FROM_41 (__FSL_IPV4_41 && (LOTS_OF_MONEY || FSL_MY_NAME_IS || __FSL_URGENT_ASSIST || __FSL_MAIL_HAS || __FSL_SUBJECT_EMAIL || __FSL_ATM_CARD))
score FSL_FRAUD_FROM_41 1.0
+
+uri __FSL_PAYPAL_URI /\.paypal/i
+header __FSL_FROM_PAYPAL X-Spam-Relays-External =~ / envfrom=[^\@ ]+\@paypal\.\S+ /i
+meta FSL_PAYPAL_PHISH (__FSL_PAYPAL_URI && !__FSL_FROM_PAYPAL)
+score FSL_PAYPAL_PHISH 10.0
Modified: spamassassin/trunk/rulesrc/sandbox/smf/30_smf_nontest.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/smf/30_smf_nontest.cf?rev=1460940&r1=1460939&r2=1460940&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/smf/30_smf_nontest.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/smf/30_smf_nontest.cf Tue Mar 26 00:45:41 2013
@@ -3,9 +3,9 @@
body FSL_MY_NAME_IS /\bmy name is\b/i
describe FSL_MY_NAME_IS My name is ...
-score FSL_MY_NAME_IS 1.0
+#score FSL_MY_NAME_IS 1.0
header __FSL_HAS_LIST_UNSUB exists:List-Unsubscribe
meta FSL_BULK_SIG ((DCC_CHECK || RAZOR2_CHECK || PYZOR_CHECK) && !__FSL_HAS_LIST_UNSUB)
describe FSL_BULK_SIG Bulk signature with no Unsubscribe
-score FSL_BULK_SIG 1.0
+#score FSL_BULK_SIG 1.0