You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@spamassassin.apache.org by gb...@apache.org on 2019/05/16 17:43:24 UTC

svn commit: r1859398 - /spamassassin/trunk/rulesrc/sandbox/gbechis/20_misc.cf

Author: gbechis
Date: Thu May 16 17:43:24 2019
New Revision: 1859398

URL: http://svn.apache.org/viewvc?rev=1859398&view=rev
Log:
FromNameSpoof test rule

Modified:
    spamassassin/trunk/rulesrc/sandbox/gbechis/20_misc.cf

Modified: spamassassin/trunk/rulesrc/sandbox/gbechis/20_misc.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/gbechis/20_misc.cf?rev=1859398&r1=1859397&r2=1859398&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/gbechis/20_misc.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/gbechis/20_misc.cf Thu May 16 17:43:24 2019
@@ -9,3 +9,8 @@ score GOOGLE_OBFU 0.25 # limit
 header          __COPY_OF       Subject =~ /Copy of:|offers for you/
 meta            COPY_OF_SHORT   ( __URL_SHORTENER && __COPY_OF && __KAM_BODY_LENGTH_LT_1024 )
 describe        COPY_OF_SHORT   Url shortnener spam
+
+ifplugin Mail::SpamAssassin::Plugin::FromNameSpoof
+  meta     FROMNAME_SPOOFED_EMAIL_IP  ( FROMNAME_SPOOFED_EMAIL && !__NOT_SPOOFED )
+  describe FROMNAME_SPOOFED_EMAIL_IP  From:name looks like a spoofed email from a spoofed ip
+endif