add rule for domains trying to stay anonymous

diff --git a/conf/composites.conf b/conf/composites.conf
index 12f44599054ba2f888cdc274b97066143fba4c7f..b2b9f9d5e7b8e9acfe9ce073734475f890cdca78 100644 (file)
--- a/conf/composites.conf
+++ b/conf/composites.conf
@@ -114,6 +114,11 @@ composites {
         description = "Spammy message with detailled sender but generic recipient";
         score = 0.5;
     }
+    HAS_ANON_DOMAIN {
+        expression = "HAS_GUC_PROXY_URI | URIBL_RED | DBL_ABUSE_REDIR";
+        description = "Contains one or more domains trying to disguise owner/destination";
+        score = 0.5;
+    }
 
     .include(try=true; priority=1; duplicate=merge) "$LOCAL_CONFDIR/local.d/composites.conf"
     .include(try=true; priority=10) "$LOCAL_CONFDIR/override.d/composites.conf"