update SpamAssassin signatures

[proxmox-spamassassin.git] / sa-updates / 73_sandbox_manual_scores.cf

diff --git a/sa-updates/73_sandbox_manual_scores.cf b/sa-updates/73_sandbox_manual_scores.cf
new file mode 100644 (file)
index 0000000..3dea981
--- /dev/null
+++ b/sa-updates/73_sandbox_manual_scores.cf
@@ -0,0 +1,115 @@
+# SpamAssassin rules file
+#
+# Manual override of the automatically-generated scores
+# for automatically-published sandbox rules
+#
+# <@LICENSE>
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at:
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# </@LICENSE>
+#
+###########################################################################
+
+require_version 3.004005
+
+# jhardin
+# things depend on these
+# score as informative just for the hits header
+score LOTS_OF_MONEY            0.001
+score FILL_THIS_FORM           0.001
+
+# jhardin
+# reevolved Advance Fee rules
+# scores are cumulative (i.e. 3 hits 2, 4 hits 3 and 2)
+# Commented out if GA is scoring reasonably
+#score ADVANCE_FEE_2_NEW_MONEY  0.50
+#score ADVANCE_FEE_2_NEW_FORM   0.75
+#score ADVANCE_FEE_3_NEW        0.50
+#score ADVANCE_FEE_3_NEW_MONEY  1.00
+#score ADVANCE_FEE_3_NEW_FORM   1.00
+#score ADVANCE_FEE_4_NEW        1.00
+#score ADVANCE_FEE_5_NEW        1.50
+
+# jhardin
+# metas using Advance Fee component rules
+# Commented out if GA is scoring reasonably
+#score FORM_FRAUD_3             0.50
+#score FORM_FRAUD_5             0.50
+#score MONEY_FRAUD_3            1.00
+#score MONEY_FRAUD_5            0.50
+#score MONEY_FRAUD_8            0.50
+
+# jhardin
+# GA scores this unreasonably high, and
+# the fact that this is defined in an #ifplugin
+# appears to be preventing score limiting from working
+score FILL_THIS_FORM_LONG      2.00
+
+# jhardin
+# misc rules
+# Commented out if GA is scoring reasonably
+#score FROM_MISSP_MSFT          0.50
+#score TO_NO_BRKTS_DYNIP        0.50
+#score LOTTO_AGENT              0.50
+
+# jhardin
+# 1.000 S/O, hits only <= 6 points, but GA is not publishing it!
+# perhaps because very few examples in spam corpus
+# 12/24/12 GA likes it now
+#score GOOGLE_DOCS_PHISH        3.00
+# similar: .990 S/O, hits primarily spam <= 5 points
+# 01/07/13 GA likes it now
+#score EMAIL_URI_PHISH                 2.50
+# Reliable but not widespread (low corpus count, ahead of the curve?), boost the score
+score PHISH_AZURE_CLOUDAPP     3.50
+score URI_GOOG_STO_SPAMMY      3.50
+
+# jhardin
+# double-extension file attachments, low corpus count
+score PHISH_ATTACH             3.50
+score MALW_ATTACH              3.50
+
+# hege
+# FPs reported [bug 6417], GA assigning 3+ points
+# reduce score until that's resolved
+# score HK_FAKENAME_MICROSOFT    2.50
+# RULE DISABLED IN 20_hk.cf
+
+# jhardin for mmartinec
+# Lots of hate; score as informative hammy, may override locally
+score RP_MATCHES_RCVD           -0.001
+
+# until rule or rescoring issues sorted, hits 20%+ ham
+# too problematic, disabled entirely
+#score STYLE_GIBBERISH 0.1
+
+# jhardin
+# Limit some network scores until rule changes can be evaluated by weekly net masscheck
+# Dangit, relative scores are broken - see bug#7721
+#score FROM_IN_TO_AND_SUBJ    (0) 0.001 (0) 0.001
+#score OBFU_TEXT_ATTACH       (0) 0.001 (0) 0.001
+#score MIME_NO_TEXT           (0) 0.001 (0) 0.001
+#score AD_PREFS               (0) 0.001 (0) 0.001
+score AD_PREFS               0.250
+#score URI_WP_HACKED_2        (0) 0.001 (0) 0.001
+#score STYLE_GIBBERISH        (0) 0.001 (0) 0.001
+#score UC_GIBBERISH_OBFU      (0) 0.001 (0) 0.001
+#score LUCRATIVE              (0) 0.001 (0) 0.001
+#score HEXHASH_WORD           (0) 0.001 (0) 0.001
+#score FROM_WORDY             (0) 0.001 (0) 0.001
+#score AC_HTML_NONSENSE_TAGS  (0) 0.001 (0) 0.001
+#score LONG_HEX_URI           (0) 0.001 (0) 0.001
+#score FROM_PAYPAL_SPOOF      (0) 0.001 (0) 0.001
+