You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2019/07/18 16:37:30 UTC
svn commit: r1863324 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Thu Jul 18 16:37:30 2019
New Revision: 1863324
URL: http://svn.apache.org/viewvc?rev=1863324&view=rev
Log:
Add test rule for image obfuscation via WordPress redirection
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1863324&r1=1863323&r2=1863324&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Thu Jul 18 16:37:30 2019
@@ -2775,6 +2775,9 @@ uri __URI_IMG_ALICDN m
meta __ALIBABA_IMG_NOT_RCVD_ALI __URI_IMG_ALICDN && !__HDR_RCVD_ALIBABA
+# WordPress "image accelerator" - abused for obfuscating hosted spamvertised product images
+uri __URI_IMG_WP_REDIR m;://i[02]\.wp\.com/.*\.(?:jpe?g|gif|png)$;i
+
meta __HOSTED_IMG_DQ_UNSUB __URI_DQ_UNSUB && ( __URI_IMG_EBAY || __URI_IMG_AMAZON || __URI_IMG_ALICDN )
meta HOSTED_IMG_DQ_UNSUB __HOSTED_IMG_DQ_UNSUB
score HOSTED_IMG_DQ_UNSUB 3.500 # limit
@@ -2828,3 +2831,4 @@ if can(Mail::SpamAssassin::Conf::feature
endif
+