Mailing List Archive

Author: billcole
Date: Wed Feb 14 15:49:12 2024
New Revision: 1915794

URL: http://svn.apache.org/viewvc?rev=1915794&view=rev
Log:
adding a test for .best tld, which is currently a spammer fave

Modified:
spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf

Modified: spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf?rev=1915794&r1=1915793&r2=1915794&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf Wed Feb 14 15:49:12 2024
@@ -114,6 +114,14 @@ describe T_SCC_URL_CLOUDINARY Has Cloud
uri T_SCC_URL_CLOUDINARY /https?:\/\/res.cloudinary.com/
tflags T_SCC_URL_CLOUDINARY multiple maxhits=5

+#Very bad Feb 2024. We'll see if it lasts
+describe T_SCC_FROM_TLD_BEST From domain in *.best
+header T_SCC_FROM_TLD_BEST From =~ /<[^ @]+@[^ @>]+\.best>/
+
+describe T_SCC_URL_BEST has a .best URL
+uri T_SCC_URL_BEST /https?:\/\/[^ ]*\.best/
+tflags T_SCC_URL_BEST multiple maxhits=5
+
# Lots of spam getting through at GMail with these...
describe __SCC_HASHBUST_1 Innocent text seen a lot in 'hash-buster' text.
rawbody __SCC_HASHBUST_1 /FACULT\x{C3}\x{89} D\x{E2}\x{80}\x{99}\x{C3}\x{89}DUCATION pour l\x{E2}\x{80}\x{99}ann\x{C3}\x{A9}e universitaire 2019 \/ 2020.$/im