spamassassin-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From jhar...@apache.org
Subject svn commit: r825625 - in /spamassassin/trunk/rulesrc/sandbox/jhardin: 20_advance_fee_reevolved.cf 20_misc_testing.cf
Date Thu, 15 Oct 2009 19:49:17 GMT
Author: jhardin
Date: Thu Oct 15 19:49:17 2009
New Revision: 825625

URL: http://svn.apache.org/viewvc?rev=825625&view=rev
Log:
Added some new HTML obfuscation and Google feedproxy URI rules

Modified:
    spamassassin/trunk/rulesrc/sandbox/jhardin/20_advance_fee_reevolved.cf
    spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf

Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_advance_fee_reevolved.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_advance_fee_reevolved.cf?rev=825625&r1=825624&r2=825625&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_advance_fee_reevolved.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_advance_fee_reevolved.cf Thu Oct 15 19:49:17
2009
@@ -19,6 +19,7 @@
 # 
 # $Id$
 # 
+#testrules
 
 meta      ADVANCE_FEE_2_NEW  (__AFR_UNION + __ATM_CARD + __BACK_SCRATCH + __BANK_DRAFT +
__CONTACT_YOU + __COURIER + __DEAD_PARENT + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED +
__DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU
+ __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR
+ __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_MCQ
+ __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK
+ __FRAUD_UOQ + __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW + __FRAUD_YPO
+ __FRAUD_YQV + __I_INHERIT + __INTL_BANK_EN + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU
+ __KAM_LOTTO2 + LOTTO_AGENT + LOTTO_AGENT_RPLY + LOTTO_DEPT + LOTTO_RELATED + LOTTO_URI +
LOTTO_WIN_01 + LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET + __PCT_OF_PMTS
+ __SCAM + __SHARE_IT + __THEY_INHERIT + __TRUSTE
 D_CHECK + __UNCLAIMED + __WIDOW + __WILL_LEGAL + __WIRE_XFR + __YOU_ASSIST + __YOU_INHERIT
+ __YOUR_FUND + __YOUR_PERM + __YOU_WON_04B > 1)
 describe  ADVANCE_FEE_2_NEW  Appears to be advance fee fraud (Nigerian 419)

Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=825625&r1=825624&r2=825625&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Thu Oct 15 19:49:17 2009
@@ -172,4 +172,22 @@
 
 body           SA_SKYPE            /\bCall this phone number in South Africa with Skype\b/
 
+# <SPAN> tags shouldn't appear in the midst of text
+rawbody        __SPAN_BEG_TEXT     /\w{3}<span\s/i
+tflags         __SPAN_BEG_TEXT     multiple
+rawbody        __SPAN_END_TEXT     /<\/span>\w{3}/i
+tflags         __SPAN_END_TEXT     multiple
+meta           MANY_SPAN_IN_TEXT   (__SPAN_BEG_TEXT > 10) && (__SPAN_END_TEXT
> 10)
+describe       MANY_SPAN_IN_TEXT   Many <SPAN> tags embedded within text
+
+rawbody        __FEEDPROXY         m;http://feedproxy\.google\.com/;
+tflags         __FEEDPROXY         multiple
+meta           MANY_GOOG_PROXY     __FEEDPROXY > 5
+describe       MANY_GOOG_PROXY     Many Google feedproxy URIs
+
+rawbody        __TINY_FLOAT         /\bstyle\s*=\s*"[^"]{0,40}?(?:(?:FONT-SIZE\s*:\s+\dpx|FLOAT\s*:\s+(?:right|left))(?:;\s+)?(?:(?!(?:FONT-SIZE|FLOAT))\w+:\s+\w+;?\s*)*){2}/i
+tflags         __TINY_FLOAT         multiple
+meta           MANY_TINY_FLOAT      __TINY_FLOAT > 10
+describe       MANY_TINY_FLOAT      Many small-font floating HTML elements - text obfuscation?
+
 



Mime
View raw message