You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2021/01/07 16:49:42 UTC
svn commit: r1885243 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Thu Jan 7 16:49:42 2021
New Revision: 1885243
URL: http://svn.apache.org/viewvc?rev=1885243&view=rev
Log:
Prep for correcting __FSL_ENVFROM_*
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1885243&r1=1885242&r2=1885243&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Thu Jan 7 16:49:42 2021
@@ -3450,6 +3450,16 @@ describe ENVFROM_GOOG_TRIX F
score ENVFROM_GOOG_TRIX 3.000 # limit
tflags ENVFROM_GOOG_TRIX publish
+# evaluate before altering __FSL_ENVFROM_*
+header __JH_ENVFROM_GOOGLE EnvelopeFrom =~ /\@g(?:mail|oogle)\.com$/i
+header __JH_ENVFROM_YAHOO EnvelopeFrom =~ /\@yahoo(?:groups)?\./i
+header __JH_ENVFROM_YMAIL EnvelopeFrom =~ /\@ymail\.com$/i
+header __JH_ENVFROM_ROCKET EnvelopeFrom =~ /\@rocketmail\.com$/i
+header __JH_ENVFROM_HOTMAIL EnvelopeFrom =~ /\@hotmail\./i
+header __JH_ENVFROM_LIVE EnvelopeFrom =~ /\@live\./i
+header __JH_ENVFROM_AOL EnvelopeFrom =~ /\@aol\./i
+
+
# observed in Netflix phish 12/2020
uri URI_FREELOGO m;::/www\.freepnglogos\.com/uploads;i