File Explorer

# SpamAssassin rules file
#
# Manual override of the automatically-generated scores
# for automatically-published sandbox rules
#
# <@LICENSE>
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to you under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at:
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# </@LICENSE>
#
###########################################################################

require_version 3.004006

# jhardin
# things depend on these
# score as informative just for the hits header
score LOTS_OF_MONEY            0.001
score FILL_THIS_FORM           0.001

# jhardin
# reevolved Advance Fee rules
# scores are cumulative (i.e. 3 hits 2, 4 hits 3 and 2)
# Commented out if GA is scoring reasonably
#score ADVANCE_FEE_2_NEW_MONEY  0.50
#score ADVANCE_FEE_2_NEW_FORM   0.75
#score ADVANCE_FEE_3_NEW        0.50
#score ADVANCE_FEE_3_NEW_MONEY  1.00
#score ADVANCE_FEE_3_NEW_FORM   1.00
#score ADVANCE_FEE_4_NEW        1.00
#score ADVANCE_FEE_5_NEW        1.50
score ADVANCE_FEE_5_NEW_MONEY  3.00

# jhardin
# metas using Advance Fee component rules
# Commented out if GA is scoring reasonably
#score FORM_FRAUD_3             0.50
#score FORM_FRAUD_5             0.50
#score MONEY_FRAUD_3            1.00
#score MONEY_FRAUD_5            0.50
#score MONEY_FRAUD_8            0.50

# jhardin
# GA scores this unreasonably high, and
# the fact that this is defined in an #ifplugin
# appears to be preventing score limiting from working
score FILL_THIS_FORM_LONG      2.00

# jhardin
# misc rules
# Commented out if GA is scoring reasonably
#score FROM_MISSP_MSFT          0.50
#score TO_NO_BRKTS_DYNIP        0.50
#score LOTTO_AGENT              0.50

# jhardin
# 1.000 S/O, hits only <= 6 points, but GA is not publishing it!
# perhaps because very few examples in spam corpus
# 12/24/12 GA likes it now
#score GOOGLE_DOCS_PHISH        3.00
# similar: .990 S/O, hits primarily spam <= 5 points
# 01/07/13 GA likes it now
#score EMAIL_URI_PHISH 	        2.50
# Reliable but not widespread (low corpus count, ahead of the curve?), boost the score
score PHISH_AZURE_CLOUDAPP     3.50
#score URI_GOOG_STO_SPAMMY      3.50	# lots in corpora now, masscheck reliable

# jhardin
# double-extension file attachments, low corpus count
score PHISH_ATTACH             3.50
score MALW_ATTACH              3.50

# hege
# FPs reported [bug 6417], GA assigning 3+ points
# reduce score until that's resolved
# score HK_FAKENAME_MICROSOFT    2.50
# RULE DISABLED IN 20_hk.cf

# jhardin for mmartinec
# Lots of hate; score as informative hammy, may override locally
score RP_MATCHES_RCVD           -0.001

# until rule or rescoring issues sorted, hits 20%+ ham
# too problematic, disabled entirely
#score STYLE_GIBBERISH 0.1

# jhardin
# Limit some network scores until rule changes can be evaluated by weekly net masscheck
# Dangit, relative scores are broken - see bug#7721
#score FROM_IN_TO_AND_SUBJ    (0) 0.001 (0) 0.001
#score OBFU_TEXT_ATTACH       (0) 0.001 (0) 0.001
#score MIME_NO_TEXT           (0) 0.001 (0) 0.001
#score AD_PREFS               (0) 0.001 (0) 0.001
score AD_PREFS               0.250
#score URI_WP_HACKED_2        (0) 0.001 (0) 0.001
#score STYLE_GIBBERISH        (0) 0.001 (0) 0.001
#score UC_GIBBERISH_OBFU      (0) 0.001 (0) 0.001
#score LUCRATIVE              (0) 0.001 (0) 0.001
#score HEXHASH_WORD           (0) 0.001 (0) 0.001
#score FROM_WORDY             (0) 0.001 (0) 0.001
#score AC_HTML_NONSENSE_TAGS  (0) 0.001 (0) 0.001
#score LONG_HEX_URI           (0) 0.001 (0) 0.001
#score FROM_PAYPAL_SPOOF      (0) 0.001 (0) 0.001

# jhardin
# strong phishing indicator but masscheck scores it low?
score URI_GOOGDRAWPREVIEW_MINFP 3.000

# jhardin
# Don't joe-job a SA dev's wife
score ADULT_DATING_COMPANY 20.000

Editing File: 73_sandbox_manual_scores.cf