spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From MAYER Hans <Hans.Ma...@iiasa.ac.at>
Subject RE: RE: New type of SPAM aggression
Date Tue, 12 Feb 2019 09:44:02 GMT


Dear Rupert,

Many thanks for your configuration you posted.
I installed your ruleset but unfortunately it didn’t not trigger. I run “spamassassin
-D  < “ redirecting from a text file too and it doesn’t show this rule. But other local
rules are triggered which I add. Obviously it does not recognize these url’s. I played around
a little bit with the “full” statement but without success. Also with a simplified regex.
Finally I saw you missed an underscrore in “meta” statement. It should be:  meta   TMU
( __HAS_URI > 10 )
And the “full”  statement should be:   full __HAS_URI /(http|https):\/\//

I post this to the mailing list because it could be useful for others too.

This is the mail body with which I made some tests:

https://ajnsxz.com/?ajnsxz ajnsxz https://befghkp.ua/?befghkp befghkp https://ailswy.ua/?ailswy
ailswy
https://efjqsxy.ua/?efjqsxy efjqsxy http://dfhtv.ua/?dfhtv dfhtv https://begimrv.ua/?begimrv
<https://begimrv.ua/?begimrv>  begimrv https://jlprv.net/?jlprv <https://jlprv.net/?jlprv>
 jlprv
http://efhsz.ua/?efhsz efhsz https://dgiqs.ua/?dgiqs dgiqs http://bgiprx.net/?bgiprx
<http://bgiprx.net/?bgiprx>  bgiprx https://cdklmqv.biz/?cdklmqv <https://cdklmqv.biz/?cdklmqv>
cdklmqv https://adgnowz.ua/?adgnowz <https://adgnowz.ua/?adgnowz>  adgnowz
http://cfjnorty.ru/?cfjnorty <http://cfjnorty.ru/?cfjnorty>  cfjnorty https://bcfhpqvy.ru/?bcfhpqvy
<https://bcfhpqvy.ru/?bcfhpqvy>  bcfhpqvy http://beiqv.biz/?beiqv <http://beiqv.biz/?beiqv>
 beiqv


I learned a lot. Your reply was very helpful.

Kind regards
Hans




From: Rupert Gallagher <ruga@protonmail.com>
Sent: Thursday, February 7, 2019 7:37 PM
To: MAYER Hans <Hans.Mayer@iiasa.ac.at>; SA <users@spamassassin.apache.org>
Subject: Re: RE: New type of SPAM aggression


full __HAS_URI /(http|https):///
tflags __HAS_URI multiple
meta   TMU ( _HAS_URI > 10 )
describe TMU Too many URIs (>10)
score TMU 5.0



On Thu, Feb 7, 2019 at 09:12, MAYER Hans <Hans.Mayer@iiasa.ac.at<mailto:Hans.Mayer@iiasa.ac.at>>
wrote:

> … All emails were spam with links. …

We receive such spam mails with a lot of links too.
Is there a rule which detects a certain amount of links inside an e-mail ?

Mime
View raw message