You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by fe...@apache.org on 2005/11/05 23:40:30 UTC
svn commit: r331042 - in /spamassassin/rules/trunk: core/50_scores.cf
sandbox/felicity/ sandbox/felicity/70_other.cf
sandbox/felicity/70_phishing.cf sandbox/old/70_testing.cf
Author: felicity
Date: Sat Nov 5 14:40:28 2005
New Revision: 331042
URL: http://svn.apache.org/viewcvs?rev=331042&view=rev
Log:
move my rules into my own sandbox area and out of the 70_testing file, but leave the code rules in there.
Added:
spamassassin/rules/trunk/sandbox/felicity/
spamassassin/rules/trunk/sandbox/felicity/70_other.cf
spamassassin/rules/trunk/sandbox/felicity/70_phishing.cf
Modified:
spamassassin/rules/trunk/core/50_scores.cf
spamassassin/rules/trunk/sandbox/old/70_testing.cf
Modified: spamassassin/rules/trunk/core/50_scores.cf
URL: http://svn.apache.org/viewcvs/spamassassin/rules/trunk/core/50_scores.cf?rev=331042&r1=331041&r2=331042&view=diff
==============================================================================
--- spamassassin/rules/trunk/core/50_scores.cf (original)
+++ spamassassin/rules/trunk/core/50_scores.cf Sat Nov 5 14:40:28 2005
@@ -428,7 +428,7 @@
score NASTY_GIRLS 1.517 1.344 1.757 0.339
score NA_DOLLARS 0.868 0.609 1.529 1.285
score NONEXISTENT_CHARSET 1.280 1.280 1.480 1.506
-score NORMAL_HTTP_TO_IP 0 0 0.160 0.175
+score NORMAL_HTTP_TO_IP 0.001 0.001 0.160 0.175
score NOT_ADVISOR 2.160 2.160 2.498 2.700
score NO_COST 0 0 0.565 0
score NO_DNS_FOR_FROM 0 2.603 0 3.200
Added: spamassassin/rules/trunk/sandbox/felicity/70_other.cf
URL: http://svn.apache.org/viewcvs/spamassassin/rules/trunk/sandbox/felicity/70_other.cf?rev=331042&view=auto
==============================================================================
--- spamassassin/rules/trunk/sandbox/felicity/70_other.cf (added)
+++ spamassassin/rules/trunk/sandbox/felicity/70_other.cf Sat Nov 5 14:40:28 2005
@@ -0,0 +1,42 @@
+# Rules from what was "rules/70_testing.cf", a temporary new home
+#
+# <@LICENSE>
+# Copyright 2004 Apache Software Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# </...@LICENSE>
+#
+########################################################################
+
+ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
+body T_FUZZY_REPLICA /<inter W1><post P2>(?!replica)<R><E><P><L><I><C><A>/i
+replace_rules T_FUZZY_REPLICA
+
+body T_FUZZY_SPRM /<inter W1><post P2><S><P><U><R><M>/i
+replace_rules T_FUZZY_SPRM
+endif
+
+body T_BODY_RX /\brx\W{0,2}(?:drug|med)/i
+body T_DEAR_WINNER /\bdear.{1,20}winner/i
+
+meta T_SUBJECT_NEEDS_ENCODING (!__SUBJECT_ENCODED_B64 && !__SUBJECT_ENCODED_QP) && __SUBJECT_NEEDS_MIME
+
+body T_SPACED_PHONE /(?:\d\s){2}\d\s?[.-]\s?(?:\d\s){2}\d\s?[.-]\s?(?:\d\s){3}\d/
+
+header __SUBJ_RE_NUM Subject =~ /^\s*Re\[\d+\]:/i
+meta T_SUBJ_RE_NUM !__THEBAT_MUA && __SUBJ_RE_NUM
+describe T_SUBJ_RE_NUM Subject is faking 'The Bat!' responses
+
+# tvd
+# 0.506 0.5714 0.0000 1.000 1.00 0.01 T_DRUGS_HDIA
+header T_DRUGS_HDIA Subject =~ /\bhoodia\b/i
Added: spamassassin/rules/trunk/sandbox/felicity/70_phishing.cf
URL: http://svn.apache.org/viewcvs/spamassassin/rules/trunk/sandbox/felicity/70_phishing.cf?rev=331042&view=auto
==============================================================================
--- spamassassin/rules/trunk/sandbox/felicity/70_phishing.cf (added)
+++ spamassassin/rules/trunk/sandbox/felicity/70_phishing.cf Sat Nov 5 14:40:28 2005
@@ -0,0 +1,44 @@
+# Rules from what was "rules/70_testing.cf", a temporary new home
+#
+# <@LICENSE>
+# Copyright 2004 Apache Software Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# </...@LICENSE>
+#
+########################################################################
+
+# These phrases seem to occur a lot in phishing...
+body T_PH_SEC /\byour .{0,40}account .{0,40}security/i
+describe T_PH_SEC Message has a phrase standard for phishing mails
+body T_PH_REC /\byour .{0,40}account .{0,40}record/i
+describe T_PH_REC Message has a phrase standard for phishing mails
+
+# tvd- works well for me in testing, let's see how well it works for others
+# 0.331 0.3763 0.0000 1.000 0.50 0.01 T_EB_PHISH
+# 0.292 0.3326 0.0000 1.000 0.25 0.01 T_PP_PHISH
+header __FROM_PAYPAL From:addr =~ /\@paypal\.com$/i
+header __FROM_EBAY From:addr =~ /\@ebay\.com$/i
+meta T_PP_PHISH __FROM_PAYPAL && NORMAL_HTTP_TO_IP
+meta T_EB_PHISH __FROM_EBAY && NORMAL_HTTP_TO_IP
+
+# tvd:
+# 1.575 1.8696 0.0000 1.000 1.00 0.01 T_SUBJ_ACC_NUM3
+# 1.532 1.8192 0.0000 1.000 0.67 0.01 T_SUBJ_ACC_NUM
+# 1.532 1.8192 0.0000 1.000 0.67 0.01 T_SUBJ_ACC_NUM2
+header T_SUBJ_ACC_NUM Subject =~ /\b(?i:invoice|account).{1,4}\d+[A-Z]+/
+header T_SUBJ_ACC_NUM2 Subject =~ /\b(?i:invoice|account).{1,4}\d+[A-Z]+\s*$/
+header T_SUBJ_ACC_NUM3 Subject =~ /\b[a-zA-Z]+ \W{1,4}\d+[A-Z]+\s*$/
+describe T_SUBJ_ACC_NUM Subject has spammy looking monetary reference
+describe T_SUBJ_ACC_NUM2 Subject has spammy looking monetary reference
+describe T_SUBJ_ACC_NUM3 Subject has spammy looking monetary reference
Modified: spamassassin/rules/trunk/sandbox/old/70_testing.cf
URL: http://svn.apache.org/viewcvs/spamassassin/rules/trunk/sandbox/old/70_testing.cf?rev=331042&r1=331041&r2=331042&view=diff
==============================================================================
--- spamassassin/rules/trunk/sandbox/old/70_testing.cf (original)
+++ spamassassin/rules/trunk/sandbox/old/70_testing.cf Sat Nov 5 14:40:28 2005
@@ -21,23 +21,6 @@
body T_HTML_IFRAME_SRC eval:check_iframe_src()
describe T_HTML_IFRAME_SRC Message has HTML IFRAME tag with SRC URI
-# These phrases seem to occur a lot in phishing...
-body T_PH_SEC /\byour .{0,40}account .{0,40}security/i
-describe T_PH_SEC Message has a phrase standard for phishing mails
-body T_PH_REC /\byour .{0,40}account .{0,40}record/i
-describe T_PH_REC Message has a phrase standard for phishing mails
-
-# tvd- works well for me in testing, let's see how well it works for others
-# 0.331 0.3763 0.0000 1.000 0.50 0.01 T_EB_PHISH
-# 0.292 0.3326 0.0000 1.000 0.25 0.01 T_PP_PHISH
-header __FROM_PAYPAL From:addr =~ /\@paypal\.com$/i
-header __FROM_EBAY From:addr =~ /\@ebay\.com$/i
-# dup NORMAL_HTTP_TO_IP with a T_ prefix so that the build script won't
-# complain
-uri T_NORMAL_HTTP_TO_IP m{^https?://\d+\.\d+\.\d+\.\d+}i
-meta T_PP_PHISH __FROM_PAYPAL && T_NORMAL_HTTP_TO_IP
-meta T_EB_PHISH __FROM_EBAY && T_NORMAL_HTTP_TO_IP
-
header T_FROM_FORMAT eval:check_from_format()
urirhsbl T_URIBL_XS_SURBL xs.surbl.org. A
@@ -48,36 +31,6 @@
# From discussion on users@ list
body T_URI_HTML_ONLY eval:check_html_uri_only()
describe T_URI_HTML_ONLY URIs only found in HTML part of multipart/alternative message
-
-# tvd:
-# 1.575 1.8696 0.0000 1.000 1.00 0.01 T_SUBJ_ACC_NUM3
-# 1.532 1.8192 0.0000 1.000 0.67 0.01 T_SUBJ_ACC_NUM
-# 1.532 1.8192 0.0000 1.000 0.67 0.01 T_SUBJ_ACC_NUM2
-header T_SUBJ_ACC_NUM Subject =~ /\b(?i:invoice|account).{1,4}\d+[A-Z]+/
-header T_SUBJ_ACC_NUM2 Subject =~ /\b(?i:invoice|account).{1,4}\d+[A-Z]+\s*$/
-header T_SUBJ_ACC_NUM3 Subject =~ /\b[a-zA-Z]+ \W{1,4}\d+[A-Z]+\s*$/
-describe T_SUBJ_ACC_NUM Subject has spammy looking monetary reference
-describe T_SUBJ_ACC_NUM2 Subject has spammy looking monetary reference
-describe T_SUBJ_ACC_NUM3 Subject has spammy looking monetary reference
-
-ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
-body T_FUZZY_REPLICA /<inter W1><post P2>(?!replica)<R><E><P><L><I><C><A>/i
-replace_rules T_FUZZY_REPLICA
-
-body T_FUZZY_SPRM /<inter W1><post P2><S><P><U><R><M>/i
-replace_rules T_FUZZY_SPRM
-endif
-
-body T_BODY_RX /\brx\W{0,2}(?:drug|med)/i
-body T_DEAR_WINNER /\bdear.{1,20}winner/i
-
-meta T_SUBJECT_NEEDS_ENCODING (!__SUBJECT_ENCODED_B64 && !__SUBJECT_ENCODED_QP) && __SUBJECT_NEEDS_MIME
-
-body T_SPACED_PHONE /(?:\d\s){2}\d\s?[.-]\s?(?:\d\s){2}\d\s?[.-]\s?(?:\d\s){3}\d/
-
-header __SUBJ_RE_NUM Subject =~ /^\s*Re\[\d+\]:/i
-meta T_SUBJ_RE_NUM !__THEBAT_MUA && __SUBJ_RE_NUM
-describe T_SUBJ_RE_NUM Subject is faking 'The Bat!' responses
# tvd
# 1.345 1.5187 0.0000 1.000 1.00 0.01 T_SUBJ_LEN_SHORT