spamassassin-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From j.@apache.org
Subject svn commit: r474776 - /spamassassin/rules/trunk/sandbox/jm/20_basic.cf
Date Tue, 14 Nov 2006 13:07:48 GMT
Author: jm
Date: Tue Nov 14 05:07:47 2006
New Revision: 474776

URL: http://svn.apache.org/viewvc?view=rev&rev=474776
Log:
some more sandbox pruning

Modified:
    spamassassin/rules/trunk/sandbox/jm/20_basic.cf

Modified: spamassassin/rules/trunk/sandbox/jm/20_basic.cf
URL: http://svn.apache.org/viewvc/spamassassin/rules/trunk/sandbox/jm/20_basic.cf?view=diff&rev=474776&r1=474775&r2=474776
==============================================================================
--- spamassassin/rules/trunk/sandbox/jm/20_basic.cf (original)
+++ spamassassin/rules/trunk/sandbox/jm/20_basic.cf Tue Nov 14 05:07:47 2006
@@ -57,17 +57,17 @@
 
 # more general, hits massive amounts of GIF spam
 mimeheader __PART_STOCK_CID Content-ID =~ /^<[a-f0-9]{12}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[^\s\.]+>$/
-mimeheader __PART_STOCK_IMG Content-Type =~ /image\/(?:gif|jpeg|png)/
+mimeheader __ANY_IMAGE_ATTACH Content-Type =~ /image\/(?:gif|jpeg|png)/
 mimeheader __PART_STOCK_CL Content-Location =~ /./
 mimeheader __PART_STOCK_CD_F Content-Disposition =~ /filename/
 
-meta PART_CID_STOCK      (__PART_STOCK_IMG&&__PART_STOCK_CID&&!__PART_STOCK_CL&&!__PART_STOCK_CD_F)
+meta PART_CID_STOCK      (__ANY_IMAGE_ATTACH&&__PART_STOCK_CID&&!__PART_STOCK_CL&&!__PART_STOCK_CD_F)
 describe PART_CID_STOCK  Has a spammy image attachment (by Content-ID)
 score PART_CID_STOCK     2.0
 
 # more specific, 0 ham hits
 mimeheader __PART_CID_STOCK_LESS    Content-ID =~ /^<00[a-f0-9]{10}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[A-Za-z]+>$/
-meta PART_CID_STOCK_LESS (__PART_STOCK_IMG&&__PART_CID_STOCK_LESS)
+meta PART_CID_STOCK_LESS (__ANY_IMAGE_ATTACH&&__PART_CID_STOCK_LESS)
 describe PART_CID_STOCK_LESS Has a spammy image attachment (by Content-ID, more specific)
 score PART_CID_STOCK_LESS    2.0
 
@@ -109,7 +109,7 @@
 # backported to here
 # ---------------------------------------------------------------------------
 
-meta DYN_RDNS_AND_INLINE_IMAGE     (RDNS_DYNAMIC && __PART_STOCK_IMG)
+meta DYN_RDNS_AND_INLINE_IMAGE     (RDNS_DYNAMIC && __ANY_IMAGE_ATTACH)
 describe DYN_RDNS_AND_INLINE_IMAGE Contains image, and was sent by dynamic rDNS
 
 header __HELO_NO_DOMAIN   X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[^\.]+ /
@@ -117,15 +117,28 @@
 meta DYN_RDNS_SHORT_HELO_HTML      (__HELO_NO_DOMAIN && RDNS_DYNAMIC && HTML_MESSAGE)
 describe DYN_RDNS_SHORT_HELO_HTML  Sent by dynamic rDNS, short HELO, and HTML
 
-meta STOCK_IMG_HDR_FROM  (__PART_STOCK_IMG&&__ENV_AND_HDR_FROM_MATCH&&T_TVD_FW_GRAPHIC_ID1&&__HTML_IMG_ONLY)
+meta STOCK_IMG_HDR_FROM  (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&T_TVD_FW_GRAPHIC_ID1&&__HTML_IMG_ONLY)
 describe STOCK_IMG_HDR_FROM Stock spam image part, with distinctive From line
 
-meta STOCK_IMG_HTML  (__PART_STOCK_IMG&&__ENV_AND_HDR_FROM_MATCH&&__PART_STOCK_CID&&__HTML_IMG_ONLY)
+meta STOCK_IMG_HTML  (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__PART_STOCK_CID&&__HTML_IMG_ONLY)
 describe STOCK_IMG_HTML   Stock spam image part, with distinctive HTML
 
-meta STOCK_IMG_OUTLOOK  (__PART_STOCK_IMG&&__ENV_AND_HDR_FROM_MATCH&&__HAS_OUTLOOK_IN_MAILER_NEW&&__HTML_LENGTH_1536_2048)
+meta STOCK_IMG_OUTLOOK  (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__HAS_OUTLOOK_IN_MAILER_NEW&&__HTML_LENGTH_1536_2048)
 describe STOCK_IMG_OUTLOOK  Stock spam image part, with Outlook-like features
 
+# Spammy X-Mailer version strings; no longer seen in ham, due to MS'
+# auto-updates, but still appearing in plenty of spam template text
+header XM_OL_29196700    X-Mailer =~ /^Microsoft Outlook Express 5.00.2919.6700$/
+header XM_OL_41332400    X-Mailer =~ /^Microsoft Outlook Express 5.50.4133.2400$/
+header XM_OL_48071700    X-Mailer =~ /^Microsoft Outlook Express 5.50.4807.1700$/
+header XM_OL_28001441    X-Mailer =~ /^Microsoft Outlook Express 6.00.2800.1441$/
+header XM_OL_29196600    X-Mailer =~ /^Microsoft Outlook Express 5.00.2919.6600$/
+header XM_OL_49631700    X-Mailer =~ /^Microsoft Outlook Express 5.50.4963.1700$/
+header XM_OL_48072300    X-Mailer =~ /^Microsoft Outlook Express 5.50.4807.2300$/
+header XM_OL_28004682    X-Mailer =~ /^Microsoft Outlook Express 6.00.2800.4682$/
+header XM_OL_10_0_4115    X-Mailer =~ /^Microsoft Outlook, Build 10.0.4115$/
+header XM_OL_4_72_2106_4  X-Mailer =~ /^Microsoft Outlook Express 4.72.2106.4$/
+
 # ---------------------------------------------------------------------------
 # Testing bit
 
@@ -137,7 +150,7 @@
 # meta __CTYPE_ONETAB_GIF2      (__CTYPE_ONETAB_GIF && !__CONT_LOC_GIF)
 endif
 
-meta STOCK_IMG_CTYPE (__PART_STOCK_IMG&&__ENV_AND_HDR_FROM_MATCH&&__CTYPE_ONETAB_GIF&&__HTML_IMG_ONLY)
+meta STOCK_IMG_CTYPE (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__CTYPE_ONETAB_GIF&&__HTML_IMG_ONLY)
 describe STOCK_IMG_CTYPE  Stock spam image part, with distinctive Content-Type header
 
 header __HDR_ORDER_FTSDMCXXXX ALL =~ /\nFrom: .{1,80}?\nTo: .{1,80}?\nSubject: .{1,200}?\nDate:
.{1,40}?\nMIME-Version: .{1,40}?\nContent-Type: .{1,80}?\nX-Priority: .{1,40}?\nX-MSMail-Priority:
.{1,40}?\nX-Mailer: .{1,40}?\nX-MimeOLE:/s
@@ -147,30 +160,11 @@
 meta HDR_ORDER_FTSDMCXX3      (__HDR_ORDER_FTSDMCXXXX && __MID_START_001C)
 # describe HDR_ORDER_FTSDMCXX   Header order is similar to spam (FTSDMCXX variant)
 
-# meta SHORT_HELO_AND_INLINE_IMAGE     (__HELO_NO_DOMAIN && __PART_STOCK_IMG)
-
-# Spammy X-Mailer version strings; no longer seen in ham, due to MS' auto-updates
-# but still appearing in plenty of spam templates
-header XM_OL_29002180    X-Mailer =~ /^Microsoft Outlook Express V6.00.2900.2180$/
-header XM_OL_29196700    X-Mailer =~ /^Microsoft Outlook Express 5.00.2919.6700$/
-header XM_OL_41332400    X-Mailer =~ /^Microsoft Outlook Express 5.50.4133.2400$/
-header XM_OL_48071700    X-Mailer =~ /^Microsoft Outlook Express 5.50.4807.1700$/
-header XM_OL_28001441    X-Mailer =~ /^Microsoft Outlook Express 6.00.2800.1441$/
-header XM_OL_29196600    X-Mailer =~ /^Microsoft Outlook Express 5.00.2919.6600$/
-header XM_OL_49631700    X-Mailer =~ /^Microsoft Outlook Express 5.50.4963.1700$/
-header XM_OL_48072300    X-Mailer =~ /^Microsoft Outlook Express 5.50.4807.2300$/
-header XM_OL_4115    X-Mailer =~ /^Microsoft Outlook, Build 10.0.4115$/
-header XM_OL_4682    X-Mailer =~ /^Microsoft Outlook Express 6.00.2800.4682$/
-header XM_OL_21064    X-Mailer =~ /^Microsoft Outlook Express 4.72.2106.4$/
-
-header __XM_OL_72660  X-Mailer =~ /Microsoft\ Outlook\ Express\ /
-header __MO_OL_72660  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2180/
-meta XMAILER_MIMEOLE_OL_72660  (__XM_OL_72660 && __MO_OL_72660)
+meta SHORT_HELO_AND_INLINE_IMAGE     (__HELO_NO_DOMAIN && __ANY_IMAGE_ATTACH)
 
 uri __HAS_ANY_URI   /./
 body __HAS_ANY_EMAIL /\w@\S+\.\w/
-
-meta SB_GIF_AND_NO_URIS (__GIF_ATTACH&&!__HAS_ANY_URI&&!__HAS_ANY_EMAIL)
+meta SB_GIF_AND_NO_URIS (__ANY_IMAGE_ATTACH&&!__HAS_ANY_URI&&!__HAS_ANY_EMAIL)
 
 header RATWARE_RCVD_LC_ESMTP2   Received =~ /from (?:unknown|\d+\.\d+\.\d+\.\d+)\s+\(HELO\s+\S+\)\s+by\s+\S+\s+with\s+(?:esmtp|local|smtp);\s/
 



Mime
View raw message