Browse Source
Merge pull request #4683 from twesterhever/temp-improve-freemail-aff
[Minor] Improve FREEMAIL_AFF capture rates
tags/3.8.0
Vsevolod Stakhov
6 months ago
No account linked to committer's email address
|
|
@@ -163,7 +163,7 @@ composites { |
|
|
|
group = "scams"; |
|
|
|
} |
|
|
|
FREEMAIL_AFF { |
|
|
|
expression = "(FREEMAIL_FROM | FREEMAIL_ENVFROM | FREEMAIL_REPLYTO) & (TO_DN_RECIPIENTS | R_UNDISC_RCPT) & (INTRODUCTION | FROM_NAME_HAS_TITLE | FREEMAIL_REPLYTO_NEQ_FROM_DOM)"; |
|
|
|
expression = "(FREEMAIL_FROM | FREEMAIL_ENVFROM | FREEMAIL_REPLYTO) & (TO_DN_RECIPIENTS | R_UNDISC_RCPT) & (INTRODUCTION | FROM_NAME_HAS_TITLE | FREEMAIL_REPLYTO_NEQ_FROM_DOM | SUBJECT_HAS_CURRENCY)"; |
|
|
|
score = 4.0; |
|
|
|
policy = "leave"; |
|
|
|
description = "Message exhibits strong characteristics of advance fee fraud (AFF a/k/a '419' spam) involving freemail addresses"; |