X-Git-Url: https://git.donarmstrong.com/?p=spamassassin_config.git;a=blobdiff_plain;f=common%2Fmisc_spam;h=f3d468211095ca495744f60998c2a748e2ed642c;hp=d48de35b29c3ccdcc432c3a140d8a77a5587351c;hb=4cbb1e86273811dd5d98cea12edf0da4f268103e;hpb=0b86840d8aeec21e8af8a5d7f103700e957fc327

diff --git a/common/misc_spam b/common/misc_spam
index d48de35..f3d4682 100644
--- a/common/misc_spam
+++ b/common/misc_spam
@@ -1,3 +1,5 @@
+# -*- mode: spamassassin -*-
+
 # This seems to catch a lot of spam, but not sure about false positive (from airmax.cf)
 # pasc couldn't find any false positives on the lists he's on
 header   X_MESSAGE_INFO exists:X-Message-Info
@@ -20,9 +22,9 @@ describe GUEBDE www.geub.de
 score GUEBDE    5
 
 # Don 2008-06-27
-rawbody	PGPSIGNATURE	/-----BEGIN PGP SIGNATURE-----/
-descr	PGPSIGNATURE	Has a pgp signature (may not be valid, but who cares?)
-score	PGPSIGNATURE	-5
+rawbody	 PGPSIGNATURE	/-----BEGIN PGP SIGNATURE-----/
+describe PGPSIGNATURE	Has a pgp signature (may not be valid, but who cares?)
+score	 PGPSIGNATURE	-5
 
 
 # TODO: The rules below seem to be very similar; possibly fix them.
@@ -325,3 +327,47 @@ score YAHOOCALENDAR	4
 header BOUNDARYID	content-type =~ /\bboundary\=\"Boundary_\(ID_/
 describe BOUNDARYID	spamware boundary
 score BOUNDARYID	0.6
+
+# blarson 2008-07-02
+body GBKXWFLXF		/\bgbkxwflxf\b/
+describe GBKXWFLXF	gbkxwflxf
+score GBKXWFLXF		5
+
+# blarson 2008-09-07
+body LUKSUS		/\bluksus\b/i
+score LUKSUS		4
+describe LUKSUS		Luksus
+
+# disabled by don; was causing false positives
+# probably needs to be modified to check if it really is ironport
+# blarson 2008-09-22
+# header XIRONPORT	X-IronPort-Anti-Spam-Filtered =~ /true/
+# describe XIRONPORT	claims to be ironport filtered
+# score XIRONPORT		2.5
+
+# blarson 2008-10-13
+header AUTORESPON	subject =~ /Auto_response/
+describe AUTORESPON	Auto_response
+score AUTORESPON	3
+
+# blarson 2008-10-28
+header XWUM		x-wum-to =~ /./
+describe XWUM		X-WUM-TO
+score XWUM		2
+
+# cord 2008-10-31
+# compensate false-positives for 140.Red-80-25-20.staticIP.rima-tde.net and stuff
+header STATIC_RIMA_TDE	received =~ /staticIP\.rima-tde\.net/
+describe STATIC_RIMA_TDE static IP from rima-tde.net
+score STATIC_RIMA_TDE	-5
+
+# cord 2008-11-30 # compensate LDO_SUBSCRIBER bonus for Forum2Mail-Gw
+full NABBLE		/lists\@nabble\.com/
+describe NABBLE		sent through nabble.com
+score NABBLE		5
+
+# don 2009-02-04
+full HTML_NBSP		/(\ ){3,}/
+describe HTML_NBSP	Lots of  
+score HTML_NBSP		2
+