You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2021/01/08 17:55:28 UTC
svn commit: r1885274 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Fri Jan 8 17:55:28 2021
New Revision: 1885274
URL: http://svn.apache.org/viewvc?rev=1885274&view=rev
Log:
Final fix for google trix; add subrule for eval
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1885274&r1=1885273&r2=1885274&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Fri Jan 8 17:55:28 2021
@@ -3441,11 +3441,8 @@ describe URI_MYSP_AC U
# evaluate different options before finalizing
-header __ENVFROM_GOOG_TRIX_01 X-Spam-Relays-External =~ /\senvfrom=[^@\s]+\@trix\.bounces\.google\.com\s/
-header __ENVFROM_GOOG_TRIX_02 Return-Path =~ /\@trix\.bounces\.google\.com/
-header __ENVFROM_GOOG_TRIX_03 EnvelopeFrom =~ /\@trix\.bounces\.google\.com$/
-header __ENVFROM_GOOG_TRIX_04 EnvelopeFrom =~ /=trix\.bounces\.google\.com=/
-meta ENVFROM_GOOG_TRIX (__ENVFROM_GOOG_TRIX_01 || __ENVFROM_GOOG_TRIX_02 || __ENVFROM_GOOG_TRIX_03 || __ENVFROM_GOOG_TRIX_04) && !__FROM_FULL_NAME
+header __ENVFROM_GOOG_TRIX EnvelopeFrom =~ /(?:@|=)trix\.bounces\.google\.com(?:$|=)/
+meta ENVFROM_GOOG_TRIX __ENVFROM_GOOG_TRIX && !__FROM_FULL_NAME
describe ENVFROM_GOOG_TRIX From suspicious Google subdomain
score ENVFROM_GOOG_TRIX 3.000 # limit
tflags ENVFROM_GOOG_TRIX publish
@@ -3495,4 +3492,7 @@ tflags MIXED_HREF_CASE p
# noticed in a couple of 419 spams
header __REPTO_ADDR_MALF_ENC Reply-To:addr =~ /^=\?[^?]+\?.\?[^?]+\?=$/
+# phishing content
+uri __URI_FIREBASEAPP m,://[^.]+\.firebaseapp\.com/,
+