promotions validated
git-svn-id: https://svn.apache.org/repos/asf/spamassassin/trunk@1919713 13f79535-47bb-0310-9956-ffa450edef68
diff --git a/rules/active.list b/rules/active.list
index 279c23e..a191437 100644
--- a/rules/active.list
+++ b/rules/active.list
@@ -134,6 +134,9 @@
# good enough
AXB_XMAILER_MIMEOLE_OL_024C2
+# good enough
+AXB_X_FF_SEZ_S
+
# tflags learn
BAYES_00
@@ -407,9 +410,6 @@
# good enough
DSN_NO_MIMEVERSION
-# good enough
-DUP_SUSP_HDR
-
# tflags publish
DX_TEXT_02
@@ -444,9 +444,6 @@
FAKE_REPLY_A1
# good enough
-FAKE_REPLY_B
-
-# good enough
FAKE_REPLY_C
# tflags publish
@@ -569,7 +566,7 @@
# good enough
FROM_MISSP_PHISH
-# good enough
+# tflags net
FROM_MISSP_REPLYTO
# tflags net
@@ -770,9 +767,6 @@
# tflags publish
HAS_X_OUTGOING_SPAM_STAT
-# tflags net
-HDRS_LCASE
-
# tflags publish
HDRS_MISSP
@@ -900,6 +894,9 @@
JH_SPAMMY_PATTERN02
# tflags net
+KHOP_FAKE_EBAY
+
+# tflags net
KHOP_HELO_FCRDNS
# tflags publish
@@ -950,21 +947,12 @@
# tflags publish
MALW_ATTACH
-# tflags net
-MANY_HDRS_LCASE
-
# tflags publish
MANY_SPAN_IN_TEXT
-# good enough
-MANY_SUBDOM
-
# tflags net
MAY_BE_FORGED
-# good enough
-MILLION_EUR
-
# tflags publish
MILLION_HUNDRED
@@ -1094,6 +1082,9 @@
# good enough
NSL_RCVD_HELO_USER
+# good enough
+NULL_IN_BODY
+
# tflags publish
OBFU_BITCOIN
@@ -1125,9 +1116,6 @@
PDS_DBL_URL_TNB_RUNON
# tflags net
-PDS_FROM_2_EMAILS
-
-# tflags net
PDS_HELO_SPF_FAIL
# good enough
@@ -1590,6 +1578,9 @@
SURBL_BLOCKED
# good enough
+SUSP_UTF8_WORD_COMBO
+
+# good enough
SUSP_UTF8_WORD_FROM
# tflags publish
@@ -1626,6 +1617,9 @@
TO_EQ_FM_DIRECT_MX
# tflags net
+TO_EQ_FM_DOM_HTML_IMG
+
+# tflags net
TO_EQ_FM_DOM_HTML_ONLY
# tflags net
@@ -1652,9 +1646,6 @@
# tflags publish
TO_NO_BRKTS_HTML_ONLY
-# tflags net
-TO_NO_BRKTS_MSFT
-
# tflags publish
TO_NO_BRKTS_NORDNS_HTML
@@ -1667,7 +1658,7 @@
# tflags net
TVD_SPACE_ENCODED
-# good enough
+# tflags net
TVD_SPACE_RATIO_MINFP
# tflags net
@@ -1883,10 +1874,10 @@
# tflags publish
URI_WP_DIRINDEX
-# tflags publish
+# tflags net
URI_WP_HACKED
-# tflags publish
+# tflags net
URI_WP_HACKED_2
# tflags publish
