]>
Commit | Line | Data |
---|---|---|
b780ea8d SI |
1 | # SpamAssassin rules file |
2 | # | |
3 | # Manual override of the automatically-generated scores | |
4 | # for automatically-published sandbox rules | |
5 | # | |
6 | # <@LICENSE> | |
7 | # Licensed to the Apache Software Foundation (ASF) under one or more | |
8 | # contributor license agreements. See the NOTICE file distributed with | |
9 | # this work for additional information regarding copyright ownership. | |
10 | # The ASF licenses this file to you under the Apache License, Version 2.0 | |
11 | # (the "License"); you may not use this file except in compliance with | |
12 | # the License. You may obtain a copy of the License at: | |
13 | # | |
14 | # http://www.apache.org/licenses/LICENSE-2.0 | |
15 | # | |
16 | # Unless required by applicable law or agreed to in writing, software | |
17 | # distributed under the License is distributed on an "AS IS" BASIS, | |
18 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
19 | # See the License for the specific language governing permissions and | |
20 | # limitations under the License. | |
21 | # </@LICENSE> | |
22 | # | |
23 | ########################################################################### | |
24 | ||
cabe596e | 25 | require_version 3.004006 |
b780ea8d SI |
26 | |
27 | # jhardin | |
28 | # things depend on these | |
29 | # score as informative just for the hits header | |
30 | score LOTS_OF_MONEY 0.001 | |
31 | score FILL_THIS_FORM 0.001 | |
32 | ||
33 | # jhardin | |
34 | # reevolved Advance Fee rules | |
35 | # scores are cumulative (i.e. 3 hits 2, 4 hits 3 and 2) | |
36 | # Commented out if GA is scoring reasonably | |
37 | #score ADVANCE_FEE_2_NEW_MONEY 0.50 | |
38 | #score ADVANCE_FEE_2_NEW_FORM 0.75 | |
39 | #score ADVANCE_FEE_3_NEW 0.50 | |
40 | #score ADVANCE_FEE_3_NEW_MONEY 1.00 | |
41 | #score ADVANCE_FEE_3_NEW_FORM 1.00 | |
42 | #score ADVANCE_FEE_4_NEW 1.00 | |
43 | #score ADVANCE_FEE_5_NEW 1.50 | |
cabe596e | 44 | score ADVANCE_FEE_5_NEW_MONEY 3.00 |
b780ea8d SI |
45 | |
46 | # jhardin | |
47 | # metas using Advance Fee component rules | |
48 | # Commented out if GA is scoring reasonably | |
49 | #score FORM_FRAUD_3 0.50 | |
50 | #score FORM_FRAUD_5 0.50 | |
51 | #score MONEY_FRAUD_3 1.00 | |
52 | #score MONEY_FRAUD_5 0.50 | |
53 | #score MONEY_FRAUD_8 0.50 | |
54 | ||
55 | # jhardin | |
56 | # GA scores this unreasonably high, and | |
57 | # the fact that this is defined in an #ifplugin | |
58 | # appears to be preventing score limiting from working | |
59 | score FILL_THIS_FORM_LONG 2.00 | |
60 | ||
61 | # jhardin | |
62 | # misc rules | |
63 | # Commented out if GA is scoring reasonably | |
64 | #score FROM_MISSP_MSFT 0.50 | |
65 | #score TO_NO_BRKTS_DYNIP 0.50 | |
66 | #score LOTTO_AGENT 0.50 | |
67 | ||
68 | # jhardin | |
69 | # 1.000 S/O, hits only <= 6 points, but GA is not publishing it! | |
70 | # perhaps because very few examples in spam corpus | |
71 | # 12/24/12 GA likes it now | |
72 | #score GOOGLE_DOCS_PHISH 3.00 | |
73 | # similar: .990 S/O, hits primarily spam <= 5 points | |
74 | # 01/07/13 GA likes it now | |
75 | #score EMAIL_URI_PHISH 2.50 | |
76 | # Reliable but not widespread (low corpus count, ahead of the curve?), boost the score | |
77 | score PHISH_AZURE_CLOUDAPP 3.50 | |
78 | score URI_GOOG_STO_SPAMMY 3.50 | |
79 | ||
80 | # jhardin | |
81 | # double-extension file attachments, low corpus count | |
82 | score PHISH_ATTACH 3.50 | |
83 | score MALW_ATTACH 3.50 | |
84 | ||
85 | # hege | |
86 | # FPs reported [bug 6417], GA assigning 3+ points | |
87 | # reduce score until that's resolved | |
88 | # score HK_FAKENAME_MICROSOFT 2.50 | |
89 | # RULE DISABLED IN 20_hk.cf | |
90 | ||
91 | # jhardin for mmartinec | |
92 | # Lots of hate; score as informative hammy, may override locally | |
93 | score RP_MATCHES_RCVD -0.001 | |
94 | ||
95 | # until rule or rescoring issues sorted, hits 20%+ ham | |
96 | # too problematic, disabled entirely | |
97 | #score STYLE_GIBBERISH 0.1 | |
98 | ||
99 | # jhardin | |
100 | # Limit some network scores until rule changes can be evaluated by weekly net masscheck | |
101 | # Dangit, relative scores are broken - see bug#7721 | |
102 | #score FROM_IN_TO_AND_SUBJ (0) 0.001 (0) 0.001 | |
103 | #score OBFU_TEXT_ATTACH (0) 0.001 (0) 0.001 | |
104 | #score MIME_NO_TEXT (0) 0.001 (0) 0.001 | |
105 | #score AD_PREFS (0) 0.001 (0) 0.001 | |
106 | score AD_PREFS 0.250 | |
107 | #score URI_WP_HACKED_2 (0) 0.001 (0) 0.001 | |
108 | #score STYLE_GIBBERISH (0) 0.001 (0) 0.001 | |
109 | #score UC_GIBBERISH_OBFU (0) 0.001 (0) 0.001 | |
110 | #score LUCRATIVE (0) 0.001 (0) 0.001 | |
111 | #score HEXHASH_WORD (0) 0.001 (0) 0.001 | |
112 | #score FROM_WORDY (0) 0.001 (0) 0.001 | |
113 | #score AC_HTML_NONSENSE_TAGS (0) 0.001 (0) 0.001 | |
114 | #score LONG_HEX_URI (0) 0.001 (0) 0.001 | |
115 | #score FROM_PAYPAL_SPOOF (0) 0.001 (0) 0.001 | |
116 | ||
46cfc9e2 SI |
117 | |
118 | # jhardin | |
119 | # Don't joe-job a SA dev's wife | |
120 | score ADULT_DATING_COMPANY 20.000 | |
121 |