spamassassin-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From jhar...@apache.org
Subject svn commit: r1438927 - /spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Date Sat, 26 Jan 2013 18:02:23 GMT
Author: jhardin
Date: Sat Jan 26 18:02:23 2013
New Revision: 1438927

URL: http://svn.apache.org/viewvc?rev=1438927&view=rev
Log:
tweak email phishing rules - more polish variants; add "your photos" rule; tweak "I'm not
spam!" rule

Modified:
    spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf

Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1438927&r1=1438926&r2=1438927&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Sat Jan 26 18:02:23 2013
@@ -927,10 +927,10 @@ describe    SUBJ_ODD_CASE      Oddly mix
 
 
 # Somebody's resurrecting the dead 07/1012
-body        BILL_1618          /Under Bills?.1618(?: Title III)? passed by the 105th U\.S\.
Congress/i
-describe    BILL_1618          Mentions proposed US law supposedly permitting spam
-body        NOT_LEGALLY_SPAM   /this mail cannot be considered Spam/i
-describe    NOT_LEGALLY_SPAM   Claims legitimacy under a law that was never passed
+body        BILL_1618          /\bUnder Bills?.1618(?: Title III)? passed by the 105th U\.S\.
Congress\b/i
+describe    BILL_1618          Mentions proposed US law supposedly permitting spamming
+body        NOT_SPAM           /\b(?:this mail cannot be considered Spam|ESTE CORREO NO PUEDE
SER CONSIDERADO (?:INTRUSIVO|spam))\b/i
+describe    NOT_SPAM           I'm not spam! Really!
 
 
 # suggested by http://isc.sans.edu/diary.html?storyid=13921
@@ -996,10 +996,10 @@ uri         __URI_GOOGLE_DOC     m,^http
 body        __WEBMAIL_ACCT       /\byour web ?mail account/i
 body        __MAILBOX_FULL       /\b(?:you(?:r (?:mail\s?box|(?:e-?|web ?)mail))? (?:is (?:almost
)?full|(?:quota )?ha(?:s|ve) (?:reached|exceeded|passed) (?:the|your|it'?s?) (?:size|storage|set|(?:e-?|web
?)mail|quota|folder|mail ?box)[\/\s](?:limit|quota))|over your mail\s?box (?:size )?(?:limit|quota)|maximum
mail\s?box (?:size )?(?:limit|quota) exceeded|sua (?:conta|caixa) de (?:(?:e-?|web ?)mail|correio)
(?:excedeu (?:sua|o) limite|est(?:=E1|[\xe1]|[\xc3][\xa1]) quase cheio))\b/i
 body        __CLEAN_MAILBOX      /\b(?:(?:e-?mail|mail\s?box|violation:|(?-i:CLICK)) (?:quota
size|clean(?:-?up))|clean ?up click ?here)\b/i
-body        __VALIDATE_MAILBOX   /\b(?:(?:re-?)?(?:valida(?:te|r)|confirm)(?:\S?(?:increase|raise))?
(?:your|(?:a )?sua) (?:mail\s?box|(?:e-?)?mail quota|caixa)|confirmar (?:que )?a sua conta
(?:de e-?mail|ainda est(?:=E1|[\xe1]|[\xc3][\xa1]) ativa)|wprowadz dane konta ponizej)\b/i
-body        __UPGR_MAILBOX       /\b(?:up(?:g[ra]+d(?:e|ing)|date) (?:[hw]as\s(?:[a-z]+\s){1,5})?(?:o[nf]
)?(?:your )?(?:mail\s?box|(?:web ?|e-?)mail)|(?:web ?|e-?)mail Upgrade cuenta|atualize sua
caixa de correio|click\S{0,10} (?:here(?:[:\.\s]{0,5}\S{0,10}http\S{10,80})?|below)(?: link)?
to (?:(?:complete|finish|increase) )?(?:(?:the|this|your)\s)?(?:up(?:date|grade)|(?:web ?|e-?)?mail(?:\s?box)?
(?:size|quota|limit)))\b/i
-body        __LOCK_MAILBOX       /\b(?:(?:deactivate|lock|lose access to) (?:your )?(?:mail\s?box|(?:web
?|e-?)mail)|ditt konto vara "?deaktiverad"?|begr(?:=E4|\xe4|[\xc3][\xa4])nsad tillg(?:=E5|[\xe5]|[\xc3][\xa5])ng
till din brevl(?:=E5|[\xe5]|[\xc3][\xa5])da|conta de (?:web ?|e-?)mail (?:ser(?:=E1|[\xe1]|[\xc3][\xa1])
desativado|(?:=E9|[\xe9]|[\xc3][\xa9]) exclu(?:=ED|[\xed]|[\xc3][\xad])do)|destruir a sua
caixa de correio|tw(?:=F3|[\xf3])j konto zostalo ograniczone)\b/i
-body        __SYSADMIN           /\b(?:help?[- ]?desk|(?:(?:web ?)?mail ?|sys(?:tem )?)admin(?:istrator)|local[-
]host|(?:support|upgrade) team|message from administrator|suporte t(?:=E9|[\xe9]|[\xc3][\xa9])cnico|administrador
do sistema)\b/i
+body        __VALIDATE_MAILBOX   /\b(?:(?:re-?)?(?:valida(?:te|r)|confirm)(?:\S?(?:increase|raise))?
(?:your|(?:a )?sua) (?:mail\s?box|(?:e-?)?mail quota|caixa)|confirmar (?:que )?a sua conta
(?:de e-?mail|ainda est(?:=E1|[\xe1]|[\xc3][\xa1]) ativa)|wprowadz dane konta ponizej|utrzymania
aktywnego konta e-?mail|weryfikacji konta)\b/i
+body        __UPGR_MAILBOX       /\b(?:up(?:g[ra]+d(?:e|ing)|date) (?:[hw]as\s(?:[a-z]+\s){1,5})?(?:o[nf]
)?(?:your )?(?:mail\s?box|(?:web ?|e-?)mail)|(?:web ?|e-?)mail Upgrade cuenta|atualize sua
caixa de correio|click\S{0,10} (?:here(?:[:\.\s]{0,5}\S{0,10}http\S{10,80})?|below)(?: link)?
to (?:(?:complete|finish|increase) )?(?:(?:the|this|your)\s)?(?:up(?:date|grade)|(?:web ?|e-?)?mail(?:\s?box)?
(?:size|quota|limit))|utrzymania aktywnego konta)\b/i
+body        __LOCK_MAILBOX       /\b(?:(?:deactivate|lock|lose access to) (?:your )?(?:mail\s?box|(?:web
?|e-?)mail)|ditt konto vara "?deaktiverad"?|begr(?:=E4|\xe4|[\xc3][\xa4])nsad tillg(?:=E5|[\xe5]|[\xc3][\xa5])ng
till din brevl(?:=E5|[\xe5]|[\xc3][\xa5])da|conta de (?:web ?|e-?)mail (?:ser(?:=E1|[\xe1]|[\xc3][\xa1])
desativado|(?:=E9|[\xe9]|[\xc3][\xa9]) exclu(?:=ED|[\xed]|[\xc3][\xad])do)|destruir a sua
caixa de correio|tw(?:=F3|[\xf3])j konto zostalo ograniczone|straci swoje e-?mail na sta[\xc5][\x82]e|konto
zostanie automatycznie wy[\xc5][\x82][\xc4][\x85]czona)\b/i
+body        __SYSADMIN           /\b(?:help?[- ]?desk|(?:(?:web ?)?mail ?|sys(?:tem )?)admin(?:istrator)|local[-
]host|(?:support|upgrade|management) team|message from administrator|university mail server
copyright|suporte t(?:=E9|[\xe9]|[\xc3][\xa9])cnico|administrador do sistema)\b/i
 body        __ATTN_MAIL_USER     /\b(?:att(?:entio)?n|dear|caro) (?:web ?(?:mail)?\s\S\s)?(?:web
?|e-?)?mail (?:user|DO USU(?:=E1|[\xe1]|[\xc3][\xa1])RIO)[:;,]/i
 body        __MAIL_ACCT_ACCESS1  /\b(?:your (?:web ?|e-?)?mail (?:account|log-?in) (?:has
)?been accessed|r(?:=F3|[\xf3])zne komputery zalogowaniu sie)\b/i
 body        __MAIL_ACCT_ACCESS2  /\blo+se ac+es+ to your (?:web|e-?)?mail (?:account|log-?in|box|address)\b/i
@@ -1047,3 +1047,13 @@ tflags      __BODY_TEXT_LINE     multipl
 meta        __EMPTY_BODY         __BODY_TEXT_LINE < 2
 
 
+#ifplugin Mail::SpamAssassin::Plugin::DKIM
+#  # malformed DKIM signatures seenin the wild - see bug#6895
+#  # see how well this performs
+#  meta      __DKIM_MALFORMED	DKIM_SIGNED && !DKIM_VALID
+#endif
+
+body        YOUR_PHOTOS         /\byour photos (?:as promised )?(?:- )?http:/i
+describe    YOUR_PHOTOS         "Your Photos" phishing or malware
+
+



Mime
View raw message