| 1 |
|
# -*- mode: spamassassin -*- |
| 2 |
|
|
| 3 |
# This seems to catch a lot of spam, but not sure about false positive (from airmax.cf) |
# This seems to catch a lot of spam, but not sure about false positive (from airmax.cf) |
| 4 |
# pasc couldn't find any false positives on the lists he's on |
# pasc couldn't find any false positives on the lists he's on |
| 5 |
header X_MESSAGE_INFO exists:X-Message-Info |
header X_MESSAGE_INFO exists:X-Message-Info |
| 327 |
header BOUNDARYID content-type =~ /\bboundary\=\"Boundary_\(ID_/ |
header BOUNDARYID content-type =~ /\bboundary\=\"Boundary_\(ID_/ |
| 328 |
describe BOUNDARYID spamware boundary |
describe BOUNDARYID spamware boundary |
| 329 |
score BOUNDARYID 0.6 |
score BOUNDARYID 0.6 |
| 330 |
|
|
| 331 |
|
# blarson 2008-07-02 |
| 332 |
|
body GBKXWFLXF /\bgbkxwflxf\b/ |
| 333 |
|
describe GBKXWFLXF gbkxwflxf |
| 334 |
|
score GBKXWFLXF 5 |
| 335 |
|
|
| 336 |
|
# blarson 2008-09-07 |
| 337 |
|
body LUKSUS /\bluksus\b/i |
| 338 |
|
score LUKSUS 4 |
| 339 |
|
describe LUKSUS Luksus |
| 340 |
|
|
| 341 |
|
# disabled by don; was causing false positives |
| 342 |
|
# probably needs to be modified to check if it really is ironport |
| 343 |
|
# blarson 2008-09-22 |
| 344 |
|
# header XIRONPORT X-IronPort-Anti-Spam-Filtered =~ /true/ |
| 345 |
|
# describe XIRONPORT claims to be ironport filtered |
| 346 |
|
# score XIRONPORT 2.5 |
| 347 |
|
|
| 348 |
|
# blarson 2008-10-13 |
| 349 |
|
header AUTORESPON subject =~ /Auto_response/ |
| 350 |
|
describe AUTORESPON Auto_response |
| 351 |
|
score AUTORESPON 3 |
| 352 |
|
|
| 353 |
|
# blarson 2008-10-28 |
| 354 |
|
header XWUM x-wum-to =~ /./ |
| 355 |
|
describe XWUM X-WUM-TO |
| 356 |
|
score XWUM 2 |
| 357 |
|
|
| 358 |
|
# cord 2008-10-31 |
| 359 |
|
# compensate false-positives for 140.Red-80-25-20.staticIP.rima-tde.net and stuff |
| 360 |
|
header STATIC_RIMA_TDE received =~ /staticIP\.rima-tde\.net/ |
| 361 |
|
describe STATIC_RIMA_TDE static IP from rima-tde.net |
| 362 |
|
score STATIC_RIMA_TDE -5 |
| 363 |
|
|
| 364 |
|
# cord 2008-11-30 # compensate LDO_SUBSCRIBER bonus for Forum2Mail-Gw |
| 365 |
|
full NABBLE /lists\@nabble\.com/ |
| 366 |
|
describe NABBLE sent through nabble.com |
| 367 |
|
score NABBLE 5 |
| 368 |
|
|
| 369 |
|
# don 2009-02-04 |
| 370 |
|
full HTML_NBSP /(\ ){3,}/ |
| 371 |
|
describe HTML_NBSP Lots of |
| 372 |
|
score HTML_NBSP 2 |
| 373 |
|
|
| 374 |
|
# blarson 2009-02-19 |
| 375 |
|
header ENTIST subject =~ /(?:e.?entist|o.?ctor)/i |
| 376 |
|
describe ENTIST (D)entit/(D)octor |
| 377 |
|
score ENTIST 2 |
| 378 |
|
|
| 379 |
|
header THREADTOPIC thread-topic =~ /./i |
| 380 |
|
describe THREADTOPIC Has a thread topic header |
| 381 |
|
score THREADTOPIC 4 |
Parent Directory
| 
Revision Log
| 
Patch