Index: rules/30_text_de.cf =================================================================== --- rules/30_text_de.cf (revision 1819785) +++ rules/30_text_de.cf (working copy) @@ -163,7 +163,6 @@ lang de describe KOREAN_UCE_SUBJECT Betreff enthält koreanische Werbungskennzeichnung lang de describe NO_DNS_FOR_FROM Domain der Absendeadresse nicht im DNS registriert (kein MX/A Eintrag) lang de describe RCVD_HELO_IP_MISMATCH HELO-Name und IP-Adresse in Kopfzeilen passen nicht -lang de describe RCVD_NUMERIC_HELO "Received"-Kopfzeilen enthalten numerische HELO-Identifikation lang de describe RCVD_ILLEGAL_IP "Received"-Kopfzeilen enthalten ungültige IP-Adresse lang de describe RCVD_DOUBLE_IP_SPAM Kennzeichen von Spam-Software (doppelte IP-Adresse) lang de describe RCVD_DOUBLE_IP_LOOSE Empfänger/Sender in Kopfzeilen sehen aus wie IP-Adressen Index: rules/30_text_fr.cf =================================================================== --- rules/30_text_fr.cf (revision 1819785) +++ rules/30_text_fr.cf (working copy) @@ -226,7 +226,6 @@ lang fr describe RCVD_IN_SORBS_SOCKS SORBS: Envoyé par un proxy SOCKS ouvert lang fr describe RCVD_IN_SORBS_WEB SORBS: Envoyé depuis un serveur web vulnérable lang fr describe RCVD_IN_SORBS_ZOMBIE SORBS: Envoyé depuis un réseau IP piraté -lang fr describe RCVD_NUMERIC_HELO Received: contient un HELO numérique lang fr describe REFINANCE_NOW Offre de refinancement immobilier lang fr describe REFINANCE_YOUR_HOME Offre de refinancement immobilier lang fr describe SORTED_RECIPS La liste des destinataires est triée par ordre alphabétique Index: rules/30_text_nl.cf =================================================================== --- rules/30_text_nl.cf (revision 1819785) +++ rules/30_text_nl.cf (working copy) @@ -109,7 +109,6 @@ lang nl describe JAPANESE_UCE_SUBJECT Onderwerp: bevat een Japanese UCE tag lang nl describe KOREAN_UCE_SUBJECT Onderwerp: bevat een koreaanse ongewenste email tag lang nl describe NO_DNS_FOR_FROM Domein in Van heeft geen MX of A DNS record -lang nl describe RCVD_NUMERIC_HELO Received: bevat een numerieke HELO lang nl describe RCVD_DOUBLE_IP_SPAM Buld email vingerafdruk (dubbel IP) gevonden lang nl describe RCVD_DOUBLE_IP_LOOSE Received: door en van lijken op IP adressen lang nl describe FORGED_TELESP_RCVD Bevat een vervalde hostnaam voor een DSL IP in Brazilie Index: rules/30_text_pl.cf =================================================================== --- rules/30_text_pl.cf (revision 1819785) +++ rules/30_text_pl.cf (working copy) @@ -211,7 +211,6 @@ lang pl describe RCVD_IN_SORBS_SOCKS SORBS: nadawca jest otwartym serwerem SOCKS proxy lang pl describe RCVD_IN_SORBS_WEB SORBS: nadawca posiada nadu¿ywany serwer WWW lang pl describe RCVD_IN_SORBS_ZOMBIE SORBS: nadawca jest z sieci bez kontroli -lang pl describe RCVD_NUMERIC_HELO Received: zawiera numeryczne HELO lang pl describe REFINANCE_NOW Refinansowanie domów lang pl describe REFINANCE_YOUR_HOME Refinansowanie domów lang pl describe SORTED_RECIPS Lista odbiorców posortowana wed³ug adresu Index: rules/30_text_pt_br.cf =================================================================== --- rules/30_text_pt_br.cf (revision 1819785) +++ rules/30_text_pt_br.cf (working copy) @@ -284,7 +284,6 @@ lang pt_BR describe MISSING_HB_SEP Não há uma linha separando o cabeçalho do corpo da mensagem lang pt_BR describe UNPARSEABLE_RELAY Info: mensagem possui dados de relay que não puderam ser lidos lang pt_BR describe RCVD_HELO_IP_MISMATCH HELO e IP no "Received:" não conferem -lang pt_BR describe RCVD_NUMERIC_HELO "Received:" contém um endereço IP utilizado no comando HELO lang pt_BR describe NO_RDNS_DOTCOM_HELO Comando HELO enviado como um provedor confiável, mas não possui rDNS # 20_html_tests.cf Index: rulesrc/10_force_active.cf =================================================================== --- rulesrc/10_force_active.cf (revision 1819785) +++ rulesrc/10_force_active.cf (working copy) @@ -497,7 +497,6 @@ publish RCVD_IN_SORBS_ZOMBIE publish RCVD_IN_XBL publish RCVD_MAIL_COM -publish RCVD_NUMERIC_HELO publish RDNS_DYNAMIC publish RDNS_LOCALHOST publish RDNS_NONE Index: rulesrc/sandbox/kmcgrail/20_fake_helo_tests.cf =================================================================== --- rulesrc/sandbox/kmcgrail/20_fake_helo_tests.cf (revision 1819785) +++ rulesrc/sandbox/kmcgrail/20_fake_helo_tests.cf (working copy) @@ -36,7 +36,7 @@ header __HELO_MISC_IP X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[^a-z\?]\S{0,30}(?:\d{1,3}[^\d]){4}[^\]]+ auth= /i -meta HELO_MISC_IP (__HELO_MISC_IP && !HELO_DYNAMIC_IPADDR && !HELO_DYNAMIC_IPADDR2 && !HELO_DYNAMIC_SPLIT_IP && !HELO_DYNAMIC_HCC && !HELO_DYNAMIC_DIALIN && ((TVD_RCVD_IP4 + TVD_RCVD_IP + RCVD_NUMERIC_HELO) <2)) +meta HELO_MISC_IP (__HELO_MISC_IP && !HELO_DYNAMIC_IPADDR && !HELO_DYNAMIC_IPADDR2 && !HELO_DYNAMIC_SPLIT_IP && !HELO_DYNAMIC_HCC && !HELO_DYNAMIC_DIALIN && ((TVD_RCVD_IP4 + TVD_RCVD_IP) <2)) describe HELO_MISC_IP Looking for more Dynamic IP Relays score HELO_MISC_IP 0.25 Index: rulesrc/sandbox/maddoc/99_doc_test.cf =================================================================== --- rulesrc/sandbox/maddoc/99_doc_test.cf (revision 1819785) +++ rulesrc/sandbox/maddoc/99_doc_test.cf (working copy) @@ -99,17 +99,16 @@ # SMF: FP avoidance # JHardin: don't hit 127.x.x.x (loopback) addresses -header __FSL_HELO_BARE_IP_1 X-Spam-Relays-External =~ /^[^\]]+ helo=(?!127)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} /i -meta FSL_HELO_BARE_IP_1 __FSL_HELO_BARE_IP_1 +header __FSL_HELO_BARE_IP_1 X-Spam-Relays-External =~ /^[^\]]+ helo=(?!127)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} [^\]]*auth= /i +meta FSL_HELO_BARE_IP_1 __FSL_HELO_BARE_IP_1 && !ALL_TRUSTED # score FSL_HELO_BARE_IP_1 0.001 # JHardin: FP avoidance per reports on users list 10/12/2013 # SMF: Further FP avoidance; we don't want to match 4.3.2.1.host.domain.com -# score limit due to partial overlap with RCVD_NUMERIC_HELO # JHardin: don't hit 127.x.x.x (loopback) addresses -header __FSL_HELO_BARE_IP_2 X-Spam-Relays-External =~ /helo=(?!127)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} /i -meta FSL_HELO_BARE_IP_2 __FSL_HELO_BARE_IP_2 && !ALL_TRUSTED && !FSL_HELO_BARE_IP_1 && !__VIA_ML && !__HAS_ERRORS_TO +header __FSL_HELO_BARE_IP_2 X-Spam-Relays-Untrusted =~ /helo=(?!127)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} /i +meta FSL_HELO_BARE_IP_2 __FSL_HELO_BARE_IP_2 && !FSL_HELO_BARE_IP_1 && !__VIA_ML && !__HAS_ERRORS_TO score FSL_HELO_BARE_IP_2 1.500 header FSL_HELO_NON_FQDN_1 X-Spam-Relays-External =~ /^[^\]]+ helo=[a-zA-Z0-9-_]+ /i