You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2014/06/18 04:05:34 UTC
svn commit: r1603347 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Wed Jun 18 02:05:34 2014
New Revision: 1603347
URL: http://svn.apache.org/r1603347
Log:
Various rules tweaking
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1603347&r1=1603346&r2=1603347&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Wed Jun 18 02:05:34 2014
@@ -1254,7 +1254,7 @@ tflags FOUND_YOU publish
#meta ADMITS_CANSPAM __ADMITS_CANSPAM && !__VIA_ML
#describe ADMITS_CANSPAM Admits to being spam
-#body __ADMITS_SPAM /\bth(?:e[- ]+above|is)(?:\?+s|[- ]+is)[- ]+(?:intended[- ]+as[- ]+)?an?[- ]+advert[i1l]sement\b/i
+body __ADMITS_SPAM /\bth(?:e[- ]+above|is)(?:\?+s|[- ]+is)[- ]+(?:intended[- ]+as[- ]+)?an?[- ]+advert[i1l]sement\b/i
#body __OBFU_ADVERT /\badvert[1l]sement\b/i
#meta OBFU_ADVERT __OBFU_ADVERT
#describe OBFU_ADVERT Misspelled "advertisement"
@@ -1403,7 +1403,7 @@ tflags UC_GIBBERISH_OBFU publish
header __NO_TRUSTED_RELAY X-Spam-Relays-Trusted !~ /ip=/i
#body CANT_SEE_AD /\b(?:can(?:no|')?t|(?:aren'?t |not |un)able to) (?:view|read|see|scan|witness|consider|look at|participate in|take in|(?:make|check|scope) out|eye|scrutinize|watch|display|observe) (?:our|this|the) (?:commercial[-. ]|ad(?:v[-.]?ert[i1l]se-?ment)? |images |newsletter |mailing ){1,2}(?:at all|(?:(?:down )?(?:below|underneath))|in (?:your|this) mail|(?:due to|because(?: of)?|as|from) (?:no |missing |unloaded |blocked )?images)\b/i
-body CANT_SEE_AD /\b(?:can(?:no|')?t|(?:aren'?t[-,!\s]{1,3}|not[-,!\s]{1,3}|un)able[-,!\s]{1,3}to)[-,!\s]{1,3}(?:(?!our|this|the)\w{1,12}[-,\s]{1,3}){1,2}(?:our|this|the)[-.,\s]{1,3}(?:commercial[-.,\s]{1,3}|ad(?:v[-.]?ert[i1l]se-?ment)?[-.,\s]{1,3}|images |newsletter |mailing ){1,2}(?:at all|(?:(?:down )?(?:below|underneath))|in (?:your|this) mail|(?:due to|because(?: of)?|as|from) (?:no |missing |unloaded |blocked )?(?:images|graphics))\b/i
+body CANT_SEE_AD /\b(?:can(?:no|')?t|(?:aren'?t[-,!\s]{1,3}|not[-,!\s]{1,3}|un)able[-,!\s]{1,3}to)[-,!\s]{1,3}(?:(?!our|this|the)\w{1,12}[-,\s]{1,3}){1,2}(?:our|this|the)[-.,\s*]{1,3}(?:commercial[-.,\s]{1,3}|ad(?:v[-.]?ert[i1l]se-?ment)?[-.,\s]{1,3}|images |newsletter |mailing ){1,2}(?:at all|(?:(?:down )?(?:below|underneath))|in (?:your|this) mail|(?:due to|because(?: of)?|as|from) (?:no |missing |unloaded |blocked )?(?:images|graphics))\b/i
describe CANT_SEE_AD You really want to see our spam.
score CANT_SEE_AD 3.000 # limit
tflags CANT_SEE_AD publish
@@ -1473,18 +1473,36 @@ describe PUMPDUMP_MULTI Pump-and-d
score PUMPDUMP_MULTI 3.000 # limit
tflags PUMPDUMP_MULTI publish
-body DR_OZ_OBFU /\bD(?:r\.|octor) ?0z\b/i
+body DR_OZ_OBFU /\bD(?:r\.|oc(?:tor)?) ?0z\b/i
describe DR_OZ_OBFU Obfuscated "Dr. Oz"
-body ADMAIL /\bad-?mails?\b/i
+body ADMAIL /(?:\b|_)ad-?(?:mail|message)s?(?:\b|_)/i
describe ADMAIL "admail" and variants
tflags ADMAIL publish
body ORS /\bOn-?line Rate Saver\b/i
describe ORS "Online Rate Saver"
-body THIS_AD /\bthis -?ad(?:vert[i1l]sement)?\b/i
-describe THIS_AD "This ad"
+body THIS_AD /(?:\b|_)this[- _]+(?:ad(?:vert[i1l]sement)?|promo(?:tion)?)(?:\b|_)/i
+describe THIS_AD "This ad" and variants
tflags THIS_AD publish
+body AD_PREFS /(?:\b|_)(?:ad(?:vert[i1l]s[i1l]ng)?|promo(?:tion)?|marketing)[- _](?:pref(?:s|erences)|settings)(?:\b|_)/i
+describe AD_PREFS Advertising preferences
+tflags AD_PREFS publish
+
+body OPT_OUT /\bOpt-Out Here\b/i
+score OPT_OUT 2.000
+
+
+## REFINE THIS
+#body __INCOMING_FAX /\bincoming fax\b/i
+#body __BANK /\bbank\b/i
+#body __ACCT_STMT /\bac(?:count|tivity) statement\b/i
+#uri __URI_DROPBOX m,[/.]dropbox\.com\/,i
+#meta DROPBOX_MALW (__INCOMING_FAX || (__BANK && __ACCT_STMT)) && __URI_DROPBOX && !ALL_TRUSTED
+#describe DROPBOX_MALW Spoofed FAX or bank statement with Dropbox link: PROBABLE MALWARE
+#score DROPBOX_MALW 10.00
+
+