spamassassin-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From jhar...@apache.org
Subject svn commit: r791307 - in /spamassassin/trunk/rulesrc/sandbox/jhardin: 20_fillform.cf 20_uri_obfu_ws.cf
Date Sun, 05 Jul 2009 20:14:29 GMT
Author: jhardin
Date: Sun Jul  5 20:14:29 2009
New Revision: 791307

URL: http://svn.apache.org/viewvc?rev=791307&view=rev
Log:
Add uri_obfu_ws, tweak fillform

Added:
    spamassassin/trunk/rulesrc/sandbox/jhardin/20_uri_obfu_ws.cf
Modified:
    spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf

Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf?rev=791307&r1=791306&r2=791307&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf Sun Jul  5 20:14:29 2009
@@ -19,7 +19,7 @@
   replace_tag NUMBER    (?:num(?:ber)?s?|nos?\.|no\b|\#s?|nbrs?\.?)
   replace_tag FF_SUFFIX (?:\sin\s(?:full|words))?(?:\s?[({][^)}]{1,30}[)}])?
   replace_tag FF_BLANK1 (?:[\s:;]{0,4}(?:[-=_\.,:;*]{3,80}\s?){1,})
-  replace_tag FF_BLANK2 (?:[-=_\.,:;*\s]{1,80})
+  replace_tag FF_BLANK2 (?:[\s\W]{0,3}[-=_\.,:;\*]{1,80}\s?)
 
   # Address variations
   replace_tag FF_A1 (?:(?:address|country|county|states?|city|province|territory|(?:zip|postal)(?:\s?code)?)<ANDOR>?){1,3}(?:\sof\s(?:residence|birth|employment|citizenship))?
@@ -40,7 +40,7 @@
   # Financial/ID details (scams and phishing)
   replace_tag FF_F1 (?:(?:bank|beneficiary|billing|acc(?:oun)?t|a\/c|rout(?:ing)?|swift|receiver|user)<ANDOR>?){1,3}\s(?:(?:name|address?(?:es)?|location|code|details|<NUMBER>)<ANDOR>?){1,3}
   replace_tag FF_F2 (?:(?:(?:international\s)?driver'?s?\sli[sc]+(:?en[sc]e)?|passport|id(?:entification|entity)(?:\scard)?)<ANDOR>?){1,3}(?:\s<NUMBER>)?
-  replace_tag FF_F3 (?:picture|password|emai?l\sid|test\squestion|answer|amount\swon|(?:inheritance\s)?funds?\svalue|amount\s[\w\s]{0,30}lost[\w\s]{0,15})
+  replace_tag FF_F3 (?:picture|(?:e-?mail\s)?password|e-?mai?l\sid|test\squestion|answer|amount\swon|(?:inheritance\s)?funds?\svalue|amount\s[\w\s]{0,30}lost[\w\s]{0,15})
   replace_tag FF_F4 (?:log[-\s]?in|(?:e-?mail\s)?user)\s?names?
 
   # All variations together

Added: spamassassin/trunk/rulesrc/sandbox/jhardin/20_uri_obfu_ws.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_uri_obfu_ws.cf?rev=791307&view=auto
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_uri_obfu_ws.cf (added)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_uri_obfu_ws.cf Sun Jul  5 20:14:29 2009
@@ -0,0 +1,6 @@
+
+# From discussion on the users list 6/09
+
+body      URI_OBFU_X9_WS   /\bwww(?:\s\W?\s?|\W\s)\w{1,15}\d{1,10}(?:\s\W?\s?|\W\s)(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g)\b/i
+describe  URI_OBFU_X9_WS   www.xx99.com URI obfuscated with whitespace
+



Mime
View raw message