You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2021/02/20 01:27:10 UTC
svn commit: r1886704 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Sat Feb 20 01:27:09 2021
New Revision: 1886704
URL: http://svn.apache.org/viewvc?rev=1886704&view=rev
Log:
FP Avoidance tuning
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1886704&r1=1886703&r2=1886704&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Sat Feb 20 01:27:09 2021
@@ -136,7 +136,7 @@ ifplugin Mail::SpamAssassin::Plugin::MIM
mimeheader __PHISH_ATTACH_01_01 Content-Disposition =~ /\bfilename(?:="?[^"]*|\*(?:\d+\*)?=(?:UTF-8'')?\S*)(?:\.|%C2%B7|[\xc2][\xb7]|_)(?:pdf|docx?)\.html?[";$]/i
mimeheader __PHISH_ATTACH_01_02 Content-Type =~ /\bname="?[^"]*(?:\.|[\xc2][\xb7]|_)(?:pdf|docx?)\.html?[";$]/i
- meta PHISH_ATTACH __PHISH_ATTACH_01_01 || __PHISH_ATTACH_01_02
+ meta PHISH_ATTACH (__PHISH_ATTACH_01_01 || __PHISH_ATTACH_01_02) && !__HAS_SENDER
describe PHISH_ATTACH Attachment filename suspicious, probable phishing
tflags PHISH_ATTACH publish
@@ -2757,7 +2757,7 @@ header __HAS_DOMAINKEY_SIG e
header __HAS_PHP_SCRIPT exists:X-PHP-Script
header __HAS_PHP_ORIG_SCRIPT exists:X-PHP-Originating-Script
-meta XM_RECPTID __HAS_XM_RECPTID && !__TAG_EXISTS_SCRIPT
+meta XM_RECPTID __HAS_XM_RECPTID && !__TAG_EXISTS_SCRIPT && !__REPLYTO_NOREPLY && !__ENVFROM_AMAZONSES
describe XM_RECPTID Has spammy message header
score XM_RECPTID 3.000 # limit
@@ -3693,7 +3693,7 @@ uri __IMGUR_IMG m
tflags __IMGUR_IMG multiple maxhits=4
meta __IMGUR_IMG_2 __IMGUR_IMG == 2
meta __IMGUR_IMG_3 __IMGUR_IMG == 3
-meta HOSTED_IMG_MULTI_PUB_01 (__IMGUR_IMG_2 || __IMGUR_IMG_3) && !__DATE_LOWER
+meta HOSTED_IMG_MULTI_PUB_01 (__IMGUR_IMG_2 || __IMGUR_IMG_3) && !__DATE_LOWER && !__BOTH_INR_AND_REF
describe HOSTED_IMG_MULTI_PUB_01 Multiple hosted images at public site
score HOSTED_IMG_MULTI_PUB_01 3.000 # limit
tflags HOSTED_IMG_MULTI_PUB_01 publish