From: Don Armstrong <don@debian.org>
Date: Thu, 10 Jun 2010 20:22:24 +0000 (+0000)
Subject: add blars rules and rules to catch the rtf attachment spam
X-Git-Url: https://git.donarmstrong.com/?p=spamassassin_config.git;a=commitdiff_plain;h=8965f7c5e1eaf180fcd40d229b6ab7fee5e91b78

add blars rules and rules to catch the rtf attachment spam

git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@340 0b7a5b0c-1f2c-0410-bd74-c376f8064c91
---

diff --git a/bugs/user_prefs b/bugs/user_prefs
index 31d23b5..df0862b 100644
--- a/bugs/user_prefs
+++ b/bugs/user_prefs
@@ -56,6 +56,8 @@ bayes_ignore_header X-IronPort-AV
 # blarson 2009-05-22 google spam
 bayes_ignore_header DKIM-Signature
 bayes_ignore_header DomainKey-Signature
+# blarson 2010-02-23
+bayes_ignore_header X-Greylist
 
 
 include bayes_configuration
diff --git a/common/bts_scores b/common/bts_scores
index 6052734..5ac842a 100644
--- a/common/bts_scores
+++ b/common/bts_scores
@@ -148,3 +148,9 @@ score MIME_HTML_ONLY 3
 score MIME_HTML_MOSTLY 2
 score HTML_EMBEDS 1
 score HTML_MESSAGE 0.5
+
+# blarson 2010-01-03
+score FH_DATE_PAST_20XX 0
+
+# blarson 2010-01-23
+score USER_IN_DEF_SPF_WL 0.1
diff --git a/common/misc_spam b/common/misc_spam
index 38f69e8..a6f31b6 100644
--- a/common/misc_spam
+++ b/common/misc_spam
@@ -459,8 +459,8 @@ header DOTNET		   subject =~ /Planning a Website Design\? Updates/
 describe DOTNET		   .NET Spam
 score DOTNET 		   3
 
-# blarson 2009-12-08
-body REMBOX		/\brembox\@/
+# blarson 2010-02-02
+body REMBOX		/\b(?:rembox|disappear|stopping|delrem|remfiles?|exit)\s?\@/
 describe REMBOX		rembox
 score REMBOX		3
 
@@ -474,3 +474,25 @@ header VAULAS		subject =~ /cursos video aulas video/i
 describe VAULAS		some spanish video spam
 score VAULAS		3
 
+# blarson 2010-01-28
+header FROMWWW		from =~ /\bwww\./i
+describe FROMWWW	from www.whatever
+score FROMWWW		3
+
+# blarson 2010-02-16
+header FROMCASINO	from =~ /\bcasino/i
+describe FROMCASINO	from casino
+score FROMCASINO	3
+
+# don 2010-06-10
+header CTOCTET_STREAM	ContentType =~ /octet-stream/i
+describe CTOCTET_STREAM	Content type is octet-stream
+score CTOCTET_STREAM	0.5
+
+header RTF_ATTACH	ContentType =~ /name=.+\.rtf/i
+describe RTF_ATTACH	Contains an RTF Attachment
+score RTF_ATTACH	0.5
+
+meta RTF_SPAM		CTOCTET_STREAM & RTF_ATTACH
+describe RTF_SPAM	Content type is octet-stream and has an RTF Attachment
+score RTF_SPAM		3
\ No newline at end of file