You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by km...@apache.org on 2013/03/22 12:57:51 UTC
svn commit: r1459738 -
/spamassassin/trunk/rulesrc/sandbox/kmcgrail/20_fake_helo_tests.cf
Author: kmcgrail
Date: Fri Mar 22 11:57:51 2013
New Revision: 1459738
URL: http://svn.apache.org/r1459738
Log:
lower score for masscheck ceiling on CK_HELO_DYNAMIC_SPLIT_IP
Modified:
spamassassin/trunk/rulesrc/sandbox/kmcgrail/20_fake_helo_tests.cf
Modified: spamassassin/trunk/rulesrc/sandbox/kmcgrail/20_fake_helo_tests.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/kmcgrail/20_fake_helo_tests.cf?rev=1459738&r1=1459737&r2=1459738&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/kmcgrail/20_fake_helo_tests.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/kmcgrail/20_fake_helo_tests.cf Fri Mar 22 11:57:51 2013
@@ -28,7 +28,7 @@
#rule that excludes the dotted-quad HELOs caught by RCVD_NUMERIC_HELO
header CK_HELO_DYNAMIC_SPLIT_IP X-Spam-Relays-Untrusted =~ /^[^\]]+helo=(?!(?:\d+\.){4})\d+[^\d\s]+\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]/i
describe CK_HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname (Split IP)
-score CK_HELO_DYNAMIC_SPLIT_IP 3.0
+score CK_HELO_DYNAMIC_SPLIT_IP 1.5
header CK_HELO_GENERIC X-Spam-Relays-Untrusted =~ /^[^\]]+helo=(?=\S*(?:pool|dyna|lease|dial|dip|static))\S*\d+[^\d\s]+\d+[^\]]+ auth= /i
describe CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or Generic rPTR