On Fri, 1 Jul 2016, RW wrote:
The meta rule COMPENSATION is defined:
meta COMPENSATION __COMPENSATION && ... && !__LOCAL_PP_NONPPURL ...
That's based on masscheck results, not necessarily any logic about what
the rule means: __COMPENSATION hits X spam and Y ham. __COMPENSATION +
__LOCAL_PP_NONPPURL hits 0 spam and Y1 ham, so excluding hits on
__LOCAL_PP_NONPPURL hits improves the S/O of the scored rule.
Granted, this may vary over time.
with
uri __LOCAL_PP_NONPPURL
m'https?://(?:[A-Za-z0-9-_]+)\.(?!paypal\.com)(?:[A-Za-z0-9-_\.]+)'i
The name suggests to me that it was intended to hit bogus paypal links.
But it actually hits URLs that starts with https?:// but don't start
with https?://<something>.paypal.com
COMPENSATION can then only fire on emails that contain a link with
a paypal.com sub-domain. It also requires !__NOT_SPOOFED.
I'm wondering to what extent COMPENSATION is
HAS_PAYPAL_LINK && !__DKIM_EXISTS && THROW_MOST_HITS_AWAY
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
[email protected] FALaholic #11174 pgpk -a [email protected]
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Insofar as the police deter by their presence, they are very, very
good. Criminals take great pains not to commit a crime in front of
them. -- Jeffrey Snyder
-----------------------------------------------------------------------
3 days until the Juno probe arrives at Jupiter
