You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2011/10/21 21:56:37 UTC
svn commit: r1187530 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Fri Oct 21 19:56:37 2011
New Revision: 1187530
URL: http://svn.apache.org/viewvc?rev=1187530&view=rev
Log:
Add SCANNED_EXTERNAL
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1187530&r1=1187529&r2=1187530&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Fri Oct 21 19:56:37 2011
@@ -762,4 +762,14 @@ score SUBJ_OBFU_PUNCT_FEW 0.500
meta SUBJ_OBFU_PUNCT_MANY __SUBJ_OBFU_PUNCT > 4 && !__SUBJECT_ENCODED_B64 && !__VIA_ML && !__THREADED && !__RP_MATCHES_RCVD && !__DKIM_EXISTS
describe SUBJ_OBFU_PUNCT_MANY Heavily punctuation-obfuscated Subject: header
+# A document was scanned and sentto you using a Hewlett-Packard HP Officejet
+# A document was scanned and sent to you using a Hewlett-Packard HP Officejet
+# Scan from Hewlet-Packard Officejet
+# Scan from a HP Officejet
+# Hewlett-Packard Officejet Location: machine location not set
+# Xerox WorkCentre
+# See http://isc.sans.edu/diary.html?storyid=11848#comment
+body __SCANNED_HP /(?:(?:document was scan+ed and sent ?to you using|Scan from)(?: a)? (?:Hewlet+-Packard |HP ){1,2}Officejet|Hewlet+-Packard Officejet Location: machine location not set)/i
+meta SCANNED_EXTERNAL __SCANNED_HP && !ALL_TRUSTED
+describe SCANNED_EXTERNAL "Scanned Document" email from external source - malware?