Mailing List Archive

Author: quinlan
Date: Mon Feb 23 22:48:19 2004
New Revision: 6845

Modified:
incubator/spamassassin/trunk/rules/70_testing.cf
Log:
add some T_RCVD_DOUBLE_IP variants


Modified: incubator/spamassassin/trunk/rules/70_testing.cf
==============================================================================
--- incubator/spamassassin/trunk/rules/70_testing.cf (original)
+++ incubator/spamassassin/trunk/rules/70_testing.cf Mon Feb 23 22:48:19 2004
@@ -441,6 +441,13 @@
header T_RCVD_DOUBLE_IP Received =~ /from \[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\] by \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} with HTTP;/
describe T_RCVD_DOUBLE_IP Bulk email fingerprint (double IP) found

+# variants - go crazy, whoo!
+header T_RCVD_DOUBLE_IP_2 Received =~ /from \[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\] by \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} with/
+header T_RCVD_DOUBLE_IP_3 Received =~ /from \[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\] by \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/
+header T_RCVD_DOUBLE_IP_4 Received =~ /\b(?:from|by)\b.{1,2}\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b.{1,2}\b(?:by|from)\b.{1,2}\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/i
+header T_RCVD_DOUBLE_IP_5 Received =~ /\b(?:from|by)\b.{1,2}\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?<!127\.0\.0\.1)\b.{1,2}\b(?:by|from)\b.{1,2}\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?<!127\.0\.0\.1)\b/i
+header T_RCVD_DOUBLE_IP_6 Received =~ /\b\w+\b.{1,2}\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?<!127\.0\.0\.1)\b.{1,2}\b\w+\b.{1,2}\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?<!127\.0\.0\.1)\b/i
+
header T_MIME_BOUND_DIGITS15 Content-Type =~ /boundary=\"\d{15,}\"/
describe T_MIME_BOUND_DIGITS15 MIME boundary contains all digits