# SpamAssassin rules file
#
# Manual override of the automatically-generated scores
# for automatically-published sandbox rules
#
# <@LICENSE>
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to you under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at:
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# </@LICENSE>
#
###########################################################################
require_version 4.000001
# jhardin
# things depend on these
# score as informative just for the hits header
score LOTS_OF_MONEY 0.001
score FILL_THIS_FORM 0.001
# jhardin
# reevolved Advance Fee rules
# scores are cumulative (i.e. 3 hits 2, 4 hits 3 and 2)
# Commented out if GA is scoring reasonably
#score ADVANCE_FEE_2_NEW_MONEY 0.50
#score ADVANCE_FEE_2_NEW_FORM 0.75
#score ADVANCE_FEE_3_NEW 0.50
#score ADVANCE_FEE_3_NEW_MONEY 1.00
#score ADVANCE_FEE_3_NEW_FORM 1.00
#score ADVANCE_FEE_4_NEW 1.00
#score ADVANCE_FEE_5_NEW 1.50
score ADVANCE_FEE_5_NEW_MONEY 3.00
# jhardin
# metas using Advance Fee component rules
# Commented out if GA is scoring reasonably
#score FORM_FRAUD_3 0.50
#score FORM_FRAUD_5 0.50
#score MONEY_FRAUD_3 1.00
#score MONEY_FRAUD_5 0.50
#score MONEY_FRAUD_8 0.50
# jhardin
# GA scores this unreasonably high, and
# the fact that this is defined in an #ifplugin
# appears to be preventing score limiting from working
score FILL_THIS_FORM_LONG 2.00
# jhardin
# misc rules
# Commented out if GA is scoring reasonably
#score FROM_MISSP_MSFT 0.50
#score TO_NO_BRKTS_DYNIP 0.50
#score LOTTO_AGENT 0.50
# jhardin
# 1.000 S/O, hits only <= 6 points, but GA is not publishing it!
# perhaps because very few examples in spam corpus
# 12/24/12 GA likes it now
#score GOOGLE_DOCS_PHISH 3.00
# similar: .990 S/O, hits primarily spam <= 5 points
# 01/07/13 GA likes it now
#score EMAIL_URI_PHISH 2.50
# Reliable but not widespread (low corpus count, ahead of the curve?), boost the score
score PHISH_AZURE_CLOUDAPP 3.50
score URI_GOOG_STO_SPAMMY 3.50
# jhardin
# double-extension file attachments, low corpus count
score PHISH_ATTACH 3.50
score MALW_ATTACH 3.50
# hege
# FPs reported [bug 6417], GA assigning 3+ points
# reduce score until that's resolved
# score HK_FAKENAME_MICROSOFT 2.50
# RULE DISABLED IN 20_hk.cf
# jhardin for mmartinec
# Lots of hate; score as informative hammy, may override locally
score RP_MATCHES_RCVD -0.001
# until rule or rescoring issues sorted, hits 20%+ ham
# too problematic, disabled entirely
#score STYLE_GIBBERISH 0.1
# jhardin
# Limit some network scores until rule changes can be evaluated by weekly net masscheck
# Dangit, relative scores are broken - see bug#7721
#score FROM_IN_TO_AND_SUBJ (0) 0.001 (0) 0.001
#score OBFU_TEXT_ATTACH (0) 0.001 (0) 0.001
#score MIME_NO_TEXT (0) 0.001 (0) 0.001
#score AD_PREFS (0) 0.001 (0) 0.001
score AD_PREFS 0.250
#score URI_WP_HACKED_2 (0) 0.001 (0) 0.001
#score STYLE_GIBBERISH (0) 0.001 (0) 0.001
#score UC_GIBBERISH_OBFU (0) 0.001 (0) 0.001
#score LUCRATIVE (0) 0.001 (0) 0.001
#score HEXHASH_WORD (0) 0.001 (0) 0.001
#score FROM_WORDY (0) 0.001 (0) 0.001
#score AC_HTML_NONSENSE_TAGS (0) 0.001 (0) 0.001
#score LONG_HEX_URI (0) 0.001 (0) 0.001
#score FROM_PAYPAL_SPOOF (0) 0.001 (0) 0.001
# jhardin
# Don't joe-job a SA dev's wife
score ADULT_DATING_COMPANY 20.000