diff options
| author | Steve Freegard <steve@stevefreegard.com> | 2017-03-23 21:27:02 +0000 |
|---|---|---|
| committer | Steve Freegard <steve@stevefreegard.com> | 2017-03-23 21:27:02 +0000 |
| commit | c53dd6be7203038a0be6e73f1eb4beeeecd65b91 (patch) | |
| tree | 88c01448d83d955c0b30a83fc5b3b269d1d6c15b /conf | |
| parent | 7021ddcc38a0f05b2bf69849f645a848e06be1e2 (diff) | |
| download | rspamd-c53dd6be7203038a0be6e73f1eb4beeeecd65b91.tar.gz rspamd-c53dd6be7203038a0be6e73f1eb4beeeecd65b91.zip | |
New rules
Diffstat (limited to 'conf')
| -rw-r--r-- | conf/composites.conf | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/conf/composites.conf b/conf/composites.conf index 9565ae489..947fa7fbb 100644 --- a/conf/composites.conf +++ b/conf/composites.conf @@ -61,6 +61,16 @@ composites { expression = "HAS_X_POS & HAS_WP_URI & PHISHING"; policy = "leave"; } + COMPROMISED_ACCT_BULK { + expression = "HAS_XOIP & DCC_BULK"; + description = "Likely to be from a compromised webmail account"; + score = 3.0; + } + UNDISC_RCPTS_BULK { + expression = "DCC_BULK & (MISSING_TO | R_UNDISC_RCPT)"; + description = "Missing or undisclosed recipients with a bulk signature"; + score = 3.0; + } .include(try=true; priority=1; duplicate=merge) "$LOCAL_CONFDIR/local.d/composites.conf" .include(try=true; priority=10) "$LOCAL_CONFDIR/override.d/composites.conf" |