Return-Path: 
 <users-return-102478-apmail-spamassassin-users-archive=spamassassin.apache.org@spamassassin.apache.org>
X-Original-To: apmail-spamassassin-users-archive@www.apache.org
Delivered-To: apmail-spamassassin-users-archive@www.apache.org
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by minotaur.apache.org (Postfix) with SMTP id 672B610658
	for <apmail-spamassassin-users-archive@www.apache.org>;
 Thu, 30 Jan 2014 19:03:50 +0000 (UTC)
Received: (qmail 70500 invoked by uid 500); 30 Jan 2014 19:03:48 -0000
Delivered-To: apmail-spamassassin-users-archive@spamassassin.apache.org
Received: (qmail 70451 invoked by uid 500); 30 Jan 2014 19:03:48 -0000
Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm
Precedence: bulk
list-help: <mailto:users-help@spamassassin.apache.org>
list-unsubscribe: <mailto:users-unsubscribe@spamassassin.apache.org>
List-Post: <mailto:users@spamassassin.apache.org>
List-Id: <users.spamassassin.apache.org>
Delivered-To: mailing list users@spamassassin.apache.org
Received: (qmail 70444 invoked by uid 99); 30 Jan 2014 19:03:48 -0000
Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 30 Jan 2014 19:03:48 +0000
X-ASF-Spam-Status: No, hits=1.5 required=10.0
	tests=HTML_MESSAGE,RCVD_IN_DNSWL_LOW,SPF_PASS
X-Spam-Check-By: apache.org
Received-SPF: pass (athena.apache.org: domain of KMcGrail@pccc.com designates
 38.124.232.10 as permitted sender)
Received: from [38.124.232.10] (HELO intel1.peregrinehw.com) (38.124.232.10)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 30 Jan 2014 19:03:43 +0000
Received: from [127.0.0.1] (talonjr.pccc.com [38.124.232.60])
	(authenticated bits=0)
	by intel1.peregrinehw.com (8.14.5/8.14.5) with ESMTP id s0UJ3APQ016977
	(version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO);
	Thu, 30 Jan 2014 14:03:17 -0500
Message-ID: <52EAA1ED.9040104@PCCC.com>
Date: Thu, 30 Jan 2014 14:03:09 -0500
From: "Kevin A. McGrail" <KMcGrail@PCCC.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
 rv:24.0) Gecko/20100101 Thunderbird/24.2.0
MIME-Version: 1.0
To: Amir Caspi <cepheid@3phase.com>
CC: Andy Jezierski <AJezierski@stepan.com>,
        "users@spamassassin.apache.org" <users@spamassassin.apache.org>
Subject: Re: Help with a regex to catch spam with gibberish html tags
References: 
 <OF5F9BDC6F.22A0D052-ON86257C6F.005BA659-86257C6F.005CCF9F@stepan.com>
 <D0085346-FB8F-49B9-AD56-91492A3BA1A6@3phase.com>
 <OF770A7D4D.F4FA97B0-ON86257C70.00599E5C-86257C70.005A06F0@stepan.com>
 <52EA8BB0.9090009@PCCC.com> <EE7300F1-65AA-4C5C-B3CC-23189374AAD5@3phase.com>
In-Reply-To: <EE7300F1-65AA-4C5C-B3CC-23189374AAD5@3phase.com>
Content-Type: multipart/alternative;
 boundary="------------010000030109070408000401"
X-Authorized-User: 38.124.232.60
X-KAM-Reverse-AUTH: Exempt - 38.124.232.60 is an Authorized Sender
X-Scanned-By: MIMEDefang 2.72 on 38.124.232.10
X-Virus-Checked: Checked by ClamAV on apache.org

This is a multi-part message in MIME format.
--------------010000030109070408000401
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

On 1/30/2014 12:39 PM, Amir Caspi wrote:
> On Jan 30, 2014, at 10:28 AM, Kevin A. McGrail <KMcGrail@PCCC.com 
> <mailto:KMcGrail@PCCC.com>> wrote:
>
>> If you want to share the complete rule, I can throw it into my 
>> sandbox and see what masscheck thinks as well.
>
> The complete rule would be something like this, assuming Andy 
> implemented it as I wrote it:
>
> rawbody HTML_NONSENSE_TAGS/(?:<[A-Za-z0-9]{4,}>\s*){10,}/
> describe HTML_NONSENSE_TAGSMany consecutive multi-letter HTML tags, 
> likely nonsense/spam
> score HTML_NONSENSE_TAGS0.001
>
> Score to be adjusted as needed, of course.
>
> If one wants to be even more explicit, one could require that the tags 
> be prefaced with a <style> tag, although that should, hopefully, get 
> picked up by John Hardin's modifications to STYLE_GIBBERISH sometime 
> in the near future.
>
> Cheers.
>
> --- Amir
Added to the sandbox.  In a day or three, we should be able to check the 
ruleQA and see what it looks like on the masscheck corpora.



  svn commit -m 'Adding html tag gibberish tag rule for testing from 
Amir Caspi on the mailing list'
Adding         rulesrc/sandbox/kmcgrail/20_mailing_list.cf
Transmitting file data .
Committed revision 1562916.


Rule is called AC_HTML_NONSENSE_TAGS and you can then look at it on 
http://ruleqa.spamassassin.org/

The S/O is the big thing to look at http://wiki.apache.org/spamassassin/S/O

Regards,
KAM

--------------010000030109070408000401
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<html>
  <head>
    <meta content="text/html; charset=ISO-8859-1"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 1/30/2014 12:39 PM, Amir Caspi
      wrote:<br>
    </div>
    <blockquote
      cite="mid:EE7300F1-65AA-4C5C-B3CC-23189374AAD5@3phase.com"
      type="cite">
      <meta http-equiv="Content-Type" content="text/html;
        charset=ISO-8859-1">
      On Jan 30, 2014, at 10:28 AM, Kevin A. McGrail &lt;<a
        moz-do-not-send="true" href="mailto:KMcGrail@PCCC.com">KMcGrail@PCCC.com</a>&gt;
      wrote:<br>
      <div><br class="Apple-interchange-newline">
        <blockquote type="cite">
          <meta content="text/html; charset=ISO-8859-1"
            http-equiv="Content-Type">
          <div bgcolor="#FFFFFF" text="#000000">
            <div class="moz-cite-prefix">If you want to share the
              complete rule, I can throw it into my sandbox and see what
              masscheck thinks as well.</div>
          </div>
        </blockquote>
      </div>
      <br>
      <div>The complete rule would be something like this, assuming Andy
        implemented it as I wrote it:</div>
      <div><br>
      </div>
      <div>
        <div bgcolor="#FFFFFF" text="#000000">
          <div><tt><font size="2">rawbody HTML_NONSENSE_TAGS<span
                  class="Apple-tab-span" style="white-space:pre"> </span>/(?:&lt;[A-Za-z0-9]{4,}&gt;\s*){10,}/</font></tt></div>
          <div><tt><font size="2">describe HTML_NONSENSE_TAGS<span
                  class="Apple-tab-span" style="white-space:pre"> </span>Many
                consecutive multi-letter HTML tags, likely nonsense/spam</font></tt></div>
          <div><tt><font size="2">score HTML_NONSENSE_TAGS<span
                  class="Apple-tab-span" style="white-space:pre"> </span>0.001</font></tt></div>
          <div><tt><font size="2"><br>
              </font></tt></div>
          <div><tt><font size="2">Score to be adjusted as needed, of
                course.</font></tt></div>
          <div><tt><font size="2"><br>
              </font></tt></div>
          <div><tt><font size="2">If one wants to be even more explicit,
                one could require that the tags be prefaced with a
                &lt;style&gt; tag, although that should, hopefully, get
                picked up by John Hardin's modifications to
                STYLE_GIBBERISH sometime in the near future.</font></tt></div>
          <div><tt><font size="2"><br>
              </font></tt></div>
          <div><tt><font size="2">Cheers.</font></tt></div>
          <div><tt><font size="2"><br>
              </font></tt></div>
          <div><tt><font size="2">--- Amir</font></tt></div>
        </div>
      </div>
    </blockquote>
    Added to the sandbox.&nbsp; In a day or three, we should be able to check
    the ruleQA and see what it looks like on the masscheck corpora.<br>
    <br>
    <br>
    <br>
    &nbsp;svn commit -m 'Adding html tag gibberish tag rule for testing from
    Amir Caspi on the mailing list'<br>
    Adding&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; rulesrc/sandbox/kmcgrail/20_mailing_list.cf<br>
    Transmitting file data .<br>
    Committed revision 1562916.<br>
    <br>
    <br>
    Rule is called AC_HTML_NONSENSE_TAGS and you can then look at it on
    <a class="moz-txt-link-freetext" href="http://ruleqa.spamassassin.org/">http://ruleqa.spamassassin.org/</a><br>
    <br>
    The S/O is the big thing to look at
    <a class="moz-txt-link-freetext" href="http://wiki.apache.org/spamassassin/S/O">http://wiki.apache.org/spamassassin/S/O</a><br>
    <br>
    Regards,<br>
    KAM<br>
  </body>
</html>

--------------010000030109070408000401--