diff options
| author | heraklit256 <37872459+heraklit256@users.noreply.github.com#> | 2018-09-08 12:11:36 +0200 |
|---|---|---|
| committer | heraklit256 <37872459+heraklit256@users.noreply.github.com#> | 2018-09-08 12:11:36 +0200 |
| commit | faadf253adda58a1f6363621f9c396950dfae4e7 (patch) | |
| tree | e00fc2a394be21c703ab007028e02d1a4544f86d /conf | |
| parent | 46bb18fa937540fcb19e027dae95d1a54256fab9 (diff) | |
| download | rspamd-faadf253adda58a1f6363621f9c396950dfae4e7.tar.gz rspamd-faadf253adda58a1f6363621f9c396950dfae4e7.zip | |
add rule for phish messages containing emotional subjects
Diffstat (limited to 'conf')
| -rw-r--r-- | conf/composites.conf | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/conf/composites.conf b/conf/composites.conf index 89f03790e..83ae88e47 100644 --- a/conf/composites.conf +++ b/conf/composites.conf @@ -101,6 +101,11 @@ composites { description = "Message was generated by PHP script and contains some spam indicators"; score = 1.0; } + PHISH_EMOTION { + expression = "(HACKED_WP_PHISHING | DBL_PHISH | PHISHED_OPENPHISH | PHISHED_PHISHTANK) & (SUBJECT_ENDS_QUESTION | SUBJECT_ENDS_EXCLAIM)"; + description = "Phish message with subject trying to address users emotion"; + score = 2.0; + } .include(try=true; priority=1; duplicate=merge) "$LOCAL_CONFDIR/local.d/composites.conf" .include(try=true; priority=10) "$LOCAL_CONFDIR/override.d/composites.conf" |