You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by sm...@apache.org on 2013/03/29 00:10:50 UTC
svn commit: r1462345 - in /spamassassin/trunk/rulesrc/sandbox/smf: 20_smf.cf
30_smf_nontest.cf
Author: smf
Date: Thu Mar 28 23:10:50 2013
New Revision: 1462345
URL: http://svn.apache.org/r1462345
Log:
Sandbox updates
Modified:
spamassassin/trunk/rulesrc/sandbox/smf/20_smf.cf
spamassassin/trunk/rulesrc/sandbox/smf/30_smf_nontest.cf
Modified: spamassassin/trunk/rulesrc/sandbox/smf/20_smf.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/smf/20_smf.cf?rev=1462345&r1=1462344&r2=1462345&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/smf/20_smf.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/smf/20_smf.cf Thu Mar 28 23:10:50 2013
@@ -26,14 +26,6 @@ meta FSL_NOT_FROM_AOL __FSL_EN
score FSL_NOT_FROM_AOL 2.0
describe FSL_NOT_FROM_AOL Envelope-From AOL but not originated from AOL systems
-uri FSL_LINK_AWS_S3_WEB /http:\/\/[^. ]+\.s3-website-[^. ]+\.amazonaws\.com/i
-score FSL_LINK_AWS_S3_WEB 1.0
-describe FSL_LINK_AWS_S3_WEB Contains a link to Amazon S3 website
-
-meta FSL_LINK_AWS_S3_WEB_FM (FREEMAIL_FROM && FSL_LINK_AWS_S3_WEB)
-score FSL_LINK_AWS_S3_WEB_FM 10.0
-describe FSL_LINK_AWS_S3_WEB_FM Contains a link to Amazon S3 website and from a freemail address
-
header FSL_UNDISCLOSED_RCPTS To =~ /\bundisclosed[- ]recipients\b/i
score FSL_UNDISCLOSED_RCPTS 0.01
describe FSL_UNDISCLOSED_RCPTS To undisclosed recipients
@@ -120,10 +112,6 @@ meta FSL_YAHOO_AUTH_SIG (__FSL_R
describe FSL_YAHOO_AUTH_SIG Yahoo SMTP AUTH observed patterns
score FSL_YAHOO_AUTH_SIG 5.0
-header FSL_PHP_EXPLOIT_41 X-PHP-Script =~ / 41\.\d+\.\d+\.\d+\b/
-describe FSL_PHP_EXPLOIT_41 PHP Script being run by someone in Africa
-score FSL_PHP_EXPLOIT_41 3.0
-
uri FSL_UNSUB_RATWARE /unsubscribe\.php\?M=[0-9]+&C=[^& ]+&L=[0-9]+&N=[0-9]+/
describe FSL_UNSUB_RATWARE Unsubscribe ratware signature
score FSL_UNSUB_RATWARE 3.0
Modified: spamassassin/trunk/rulesrc/sandbox/smf/30_smf_nontest.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/smf/30_smf_nontest.cf?rev=1462345&r1=1462344&r2=1462345&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/smf/30_smf_nontest.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/smf/30_smf_nontest.cf Thu Mar 28 23:10:50 2013
@@ -3,9 +3,17 @@
body FSL_MY_NAME_IS /\bmy name is\b/i
describe FSL_MY_NAME_IS My name is ...
-#score FSL_MY_NAME_IS 1.0
header __FSL_HAS_LIST_UNSUB exists:List-Unsubscribe
meta FSL_BULK_SIG ((DCC_CHECK || RAZOR2_CHECK || PYZOR_CHECK) && !__FSL_HAS_LIST_UNSUB)
describe FSL_BULK_SIG Bulk signature with no Unsubscribe
-#score FSL_BULK_SIG 1.0
+
+uri FSL_LINK_AWS_S3_WEB /http:\/\/[^. ]+\.s3-website-[^. ]+\.amazonaws\.com/i
+describe FSL_LINK_AWS_S3_WEB Contains a link to Amazon S3 website
+
+meta FSL_LINK_AWS_S3_WEB_FM (FREEMAIL_FROM && FSL_LINK_AWS_S3_WEB)
+describe FSL_LINK_AWS_S3_WEB_FM Contains a link to Amazon S3 website and from a Freemail address
+
+header FSL_PHP_EXPLOIT_41 X-PHP-Script =~ / 41\.\d+\.\d+\.\d+\b/
+describe FSL_PHP_EXPLOIT_41 PHP Script being run by someone in Africa
+