You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by do...@apache.org on 2007/01/12 03:58:06 UTC
svn commit: r495473 - /spamassassin/rules/trunk/sandbox/dos/70_other.cf
Author: dos
Date: Thu Jan 11 18:58:05 2007
New Revision: 495473
URL: http://svn.apache.org/viewvc?view=rev&rev=495473
Log:
sandbox: catch new stock spams claiming to be sent with The Bat!
Modified:
spamassassin/rules/trunk/sandbox/dos/70_other.cf
Modified: spamassassin/rules/trunk/sandbox/dos/70_other.cf
URL: http://svn.apache.org/viewvc/spamassassin/rules/trunk/sandbox/dos/70_other.cf?view=diff&rev=495473&r1=495472&r2=495473
==============================================================================
--- spamassassin/rules/trunk/sandbox/dos/70_other.cf (original)
+++ spamassassin/rules/trunk/sandbox/dos/70_other.cf Thu Jan 11 18:58:05 2007
@@ -124,3 +124,32 @@
describe DOS_DOT_COM_AT Envelope-From has a domain.com@anotherdomain.com
+# pump and dump stock spam claiming to be sent by The Bat!
+header __DOS_RCVD_MON / Mon, /
+header __DOS_RCVD_TUE / Tue, /
+header __DOS_RCVD_WED / Wed, /
+header __DOS_RCVD_THU / Thu, /
+header __DOS_RCVD_FRI / Fri, /
+header __DOS_RCVD_SAT / Sat, /
+header __DOS_RCVD_SUN / Sun, /
+
+body __DOS_BODY_MON /\bmon(?:day)?\b/i
+body __DOS_BODY_TUE /\btue(?:s(?:day)?)?\b/i
+body __DOS_BODY_WED /\bwed(?:nesday)?\b/i
+body __DOS_BODY_THU /\bthu(?:r(?:s(?:day)?)?)?\b/i
+body __DOS_BODY_FRI /\bfri(?:day)?\b/i
+body __DOS_BODY_SAT /\bsat(?:day)?\b/i
+body __DOS_BODY_SUN /\bsun(?:day)?\b/i
+
+meta __DOS_REF_TODAY (__DOS_RCVD_MON && __DOS_BODY_MON) || (__DOS_RCVD_TUE && __DOS_BODY_TUE) || (__DOS_RCVD_WED && __DOS_BODY_WED) || (__DOS_RCVD_THU && __DOS_BODY_THU) || (__DOS_RCVD_FRI && __DOS_BODY_FRI) || (__DOS_RCVD_SAT && __DOS_BODY_SAT) || (__DOS_RCVD_SUN && __DOS_BODY_SUN)
+
+meta __DOS_REF_NEXT_WK_DAY (__DOS_RCVD_MON && __DOS_BODY_TUE) || (__DOS_RCVD_TUE && __DOS_BODY_WED) || (__DOS_RCVD_WED && __DOS_BODY_THU) || (__DOS_RCVD_THU && __DOS_BODY_FRI) || (__DOS_RCVD_FRI && __DOS_BODY_MON) || (__DOS_RCVD_SAT && __DOS_BODY_MON) || (__DOS_RCVD_SUN && __DOS_BODY_MON)
+
+meta __DOS_REF_2_WK_DAYS (__DOS_RCVD_MON && __DOS_BODY_WED) || (__DOS_RCVD_TUE && __DOS_BODY_THU) || (__DOS_RCVD_WED && __DOS_BODY_FRI) || (__DOS_RCVD_THU && __DOS_BODY_MON) || (__DOS_RCVD_FRI && __DOS_BODY_TUE) || (__DOS_RCVD_SAT && __DOS_BODY_TUE) || (__DOS_RCVD_SUN && __DOS_BODY_TUE)
+
+body __DOS_BODY_STOCK /\bstock\b/i
+
+meta DOS_STOCK_BAT __THEBAT_MUA && __DOS_BODY_STOCK && (__DOS_REF_TODAY || __DOS_REF_NEXT_WK_DAY || __DOS_REF_2_WK_DAYS)
+describe DOS_STOCK_BAT Probable pump and dump stock spam
+
+