You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by qu...@apache.org on 2005/05/09 20:30:13 UTC
svn commit: r169346 - in /spamassassin/trunk/rules: 20_drugs.cf
25_replace.cf 70_testing.cf
Author: quinlan
Date: Mon May 9 11:30:12 2005
New Revision: 169346
URL: http://svn.apache.org/viewcvs?rev=169346&view=rev
Log:
rule promotions
Modified:
spamassassin/trunk/rules/20_drugs.cf
spamassassin/trunk/rules/25_replace.cf
spamassassin/trunk/rules/70_testing.cf
Modified: spamassassin/trunk/rules/20_drugs.cf
URL: http://svn.apache.org/viewcvs/spamassassin/trunk/rules/20_drugs.cf?rev=169346&r1=169345&r2=169346&view=diff
==============================================================================
--- spamassassin/trunk/rules/20_drugs.cf (original)
+++ spamassassin/trunk/rules/20_drugs.cf Mon May 9 11:30:12 2005
@@ -51,9 +51,6 @@
header SUBJECT_DRUG_GAP_VA Subject =~ /v.{0,2}a.{0,2}l.{0,2}i.{0,2}u.{0,2}m/i
describe SUBJECT_DRUG_GAP_VA Subject contains a gappy version of 'valium'
-header SUBJECT_DRUG_GAP_VIA Subject =~ /v.{0,2}i.{0,2}a.{0,2}g.{0,2}r.{0,2}a/i
-describe SUBJECT_DRUG_GAP_VIA Subject contains a gappy version of 'viagra'
-
header SUBJECT_DRUG_GAP_VIC Subject =~ /v.{0,2}i.{0,2}c.{0,2}[0o].{0,2}d.{0,2}i.{0,2}n/i
describe SUBJECT_DRUG_GAP_VIC Subject contains a gappy version of 'vicodin'
Modified: spamassassin/trunk/rules/25_replace.cf
URL: http://svn.apache.org/viewcvs/spamassassin/trunk/rules/25_replace.cf?rev=169346&r1=169345&r2=169346&view=diff
==============================================================================
--- spamassassin/trunk/rules/25_replace.cf (original)
+++ spamassassin/trunk/rules/25_replace.cf Mon May 9 11:30:12 2005
@@ -65,7 +65,31 @@
replace_post P3 {1,3}
###########################################################################
-# matching fuzzy words
+# fuzzy header tests
+
+header SUBJECT_FUZZY_MEDS Subject =~ /<M><E><D><S>/i
+describe SUBJECT_FUZZY_MEDS Attempt to obfuscate words in Subject:
+replace_rules SUBJECT_FUZZY_MEDS
+
+header __SUBJECT_FUZZY_VPILL Subject =~ /<inter W2><post P3>(?!viagra)<V><I><A><G><R><A>/i
+replace_rules __SUBJECT_FUZZY_VPILL
+meta SUBJECT_FUZZY_VPILL __SUBJECT_FUZZY_VPILL && !FUZZY_VPILL
+describe SUBJECT_FUZZY_MEDS Attempt to obfuscate words in Subject:
+
+header SUBJECT_FUZZY_CHEAP Subject =~ /<inter W2><post P3>\b(?!cheap)<C><H><E><A><P>(?:\b|<E>)/i
+describe SUBJECT_FUZZY_CHEAP Attempt to obfuscate words in Subject:
+replace_rules SUBJECT_FUZZY_CHEAP
+
+header SUBJECT_FUZZY_PENIS Subject =~ /<inter W3><post P3>\b(?!penis)<P><E><N><I><S>/i
+describe SUBJECT_FUZZY_PENIS Attempt to obfuscate words in Subject:
+replace_rules SUBJECT_FUZZY_PENIS
+
+header SUBJECT_FUZZY_TION Subject =~ /<post P3>(?!tion)<T><I><O><N>/i
+describe SUBJECT_FUZZY_TION Attempt to obfuscate words in Subject:
+replace_rules SUBJECT_FUZZY_TION
+
+###########################################################################
+# fuzzy body tests
body FUZZY_AFFORDABLE /<inter W1><post P2>(?!affordable)<A><F><F><O><R><D><A><B><L><E>/i
describe FUZZY_AFFORDABLE Attempt to obfuscate words in spam
Modified: spamassassin/trunk/rules/70_testing.cf
URL: http://svn.apache.org/viewcvs/spamassassin/trunk/rules/70_testing.cf?rev=169346&r1=169345&r2=169346&view=diff
==============================================================================
--- spamassassin/trunk/rules/70_testing.cf (original)
+++ spamassassin/trunk/rules/70_testing.cf Mon May 9 11:30:12 2005
@@ -26,249 +26,6 @@
#
########################################################################
-# header T_FORGED_IN_WHITELIST eval:check_forged_in_whitelist()
-# describe T_FORGED_IN_WHITELIST Forged From: is in user's white-list
-# tflags T_FORGED_IN_WHITELIST userconf
-#
-# header T_FORGED_DEF_WHITELIST eval:check_forged_in_default_whitelist()
-# describe T_FORGED_DEF_WHITELIST Forged From: is in default white-list
-# tflags T_FORGED_DEF_WHITELIST userconf
-
-##########################################################################
-
-# this doesn't hit a lot, but it's a definite obfuscation technique
-uri T_HTTP_BAD_HOST_CHAR m@^https?://[^/]*[\000-\037\200-\377]@i
-
-########################################################################
-
-# TVD: these should just get turned into obfu/int rules ala above
-# quinlan: yep!
-
-# precursor rules - just here for comparison
-header T_FUZZY_FOREVER_PRE Subject =~ /\bf[\W_]?(?:\[\]|\(\)|[o0\*\xD2-\xD6\xF2-\xF6])[\W_]?[r\xAE][\W_]?[e3\*\xC8-\xCB\xE8-\xEB][\W_]?[vu][\W_]?[e3\*\xC8-\xCB\xE8-\xEB][\W_]?[r\xAE]\b/i
-header T_FUZZY_PROVEN_PRE Subject =~ /\bp[\W_]?[r\xAE][\W_]?(?:\[\]|\(\)|[o0\*\xD2-\xD6\xF2-\xF6])[\W_]?[vu][\W_]?[e3\*\xC8-\xCB\xE8-\xEB][\W_]?[n\xD1\xF1]\b/i
-header T_FUZZY_DEBT_PRE Subject =~ /[d\xD0][\W_]?[e3\*\xC8-\xCB\xE8-\xEB][\W_]?[b8\xDF][\W_]?t/i
-header T_FUZZY_VPILL_PRE Subject =~ /[vu][\W_]?[il1:\|\*\xCC-\xCF\xEC-\xEF][\W_]?[a4\*\@\xC0-\xC5\xAA\xE0-\xE5][\W_]?[g6][\W_]?[r\xAE][\W_]?[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]/i
-header T_FUZZY_MEDS_PRE Subject =~ /m(e|3)ds/i
-header T_FUZZY_TION_PRE Subject =~ /(?!tion)t[\W_]?[il1:\|\*\xCC-\xCF\xEC-\xEF][\W_]?(?:\[\]|\(\)|[o0\*\xD2-\xD6\xF2-\xF6])[\W_]?[n\xD1\xF1]/i
-header T_FUZZY_CHEAP_PRE Subject =~ /(?!\bcheap(er)?)\b[c\xC7\xE7\xA2\xA9][\W_]?h[\W_]?[e3\*\xC8-\xCB\xE8-\xEB][\W_]?[a4\*\@\xC0-\xC5\xAA\xE0-\xE5][\W_]?p([e3\*\xC8-\xCB\xE8-\xEB][\W_]?[r\xAE])?/i
-header T_FUZZY_PENIS_PRE Subject =~ /(?!\bpenis\b)\bp[\W_]?[e3\*\xC8-\xCB\xE8-\xEB][\W_]?[n\xD1\xF1][\W_]?[il1:\|\*\xCC-\xCF\xEC-\xEF][\W_]?[s5\$\xA7]\b/i
-header T_FUZZY_VPILL_PRE Subject =~ /[vu][\W_]?[il1:\|\*\xCC-\xCF\xEC-\xEF][\W_]?[a4\*\@\xC0-\xC5\xAA\xE0-\xE5][\W_]?[g6][\W_]?[r\xAE][\W_]?[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]/i
-
-# these rules should probably not be promoted if they overlap a lot with
-# an existing fuzzy body rule since body rules also test the Subject:
-
-header T_FUZZY_FOREVER Subject =~ /<F><O><R><E><V><E><R>/i
-header T_FUZZY_FOREVER_SP Subject =~ /<inter SP>\b<SP>?<F><O><R><E><V><E><R><SP>?\b/i
-header T_FUZZY_FOREVER_W1 Subject =~ /<inter W1>\b<SP>?<F><O><R><E><V><E><R><SP>?\b/i
-header T_FUZZY_FOREVER_W2 Subject =~ /<inter W2>\b<SP>?<F><O><R><E><V><E><R><SP>?\b/i
-header T_FUZZY_FOREVER_SP_P2 Subject =~ /<inter SP><post P2>\b<SP>?<F><O><R><E><V><E><R><SP>?\b/i
-header T_FUZZY_FOREVER_W1_P2 Subject =~ /<inter W1><post P2>\b<SP>?<F><O><R><E><V><E><R><SP>?\b/i
-header T_FUZZY_FOREVER_W2_P2 Subject =~ /<inter W2><post P2>\b<SP>?<F><O><R><E><V><E><R><SP>?\b/i
-header T_FUZZY_FOREVER_SP_P3 Subject =~ /<inter SP><post P3>\b<SP>?<F><O><R><E><V><E><R><SP>?\b/i
-header T_FUZZY_FOREVER_W1_P3 Subject =~ /<inter W1><post P3>\b<SP>?<F><O><R><E><V><E><R><SP>?\b/i
-header T_FUZZY_FOREVER_W2_P3 Subject =~ /<inter W2><post P3>\b<SP>?<F><O><R><E><V><E><R><SP>?\b/i
-
-header T_FUZZY_PROVEN Subject =~ /<P><R><O><V><E><N>/i
-header T_FUZZY_PROVEN_SP Subject =~ /<inter SP>\b<SP>?<P><R><O><V><E><N><SP>?\b/i
-header T_FUZZY_PROVEN_W1 Subject =~ /<inter W1>\b<SP>?<P><R><O><V><E><N><SP>?\b/i
-header T_FUZZY_PROVEN_W2 Subject =~ /<inter W2>\b<SP>?<P><R><O><V><E><N><SP>?\b/i
-header T_FUZZY_PROVEN_SP_P2 Subject =~ /<inter SP><post P2>\b<SP>?<P><R><O><V><E><N><SP>?\b/i
-header T_FUZZY_PROVEN_W1_P2 Subject =~ /<inter W1><post P2>\b<SP>?<P><R><O><V><E><N><SP>?\b/i
-header T_FUZZY_PROVEN_W2_P2 Subject =~ /<inter W2><post P2>\b<SP>?<P><R><O><V><E><N><SP>?\b/i
-header T_FUZZY_PROVEN_SP_P3 Subject =~ /<inter SP><post P3>\b<SP>?<P><R><O><V><E><N><SP>?\b/i
-header T_FUZZY_PROVEN_W1_P3 Subject =~ /<inter W1><post P3>\b<SP>?<P><R><O><V><E><N><SP>?\b/i
-header T_FUZZY_PROVEN_W2_P3 Subject =~ /<inter W2><post P3>\b<SP>?<P><R><O><V><E><N><SP>?\b/i
-
-header T_FUZZY_DEBT Subject =~ /<D><E><B><T>/i
-header T_FUZZY_DEBT_SP Subject =~ /<inter SP>\b<SP>?<D><E><B><T><SP>?\b/i
-header T_FUZZY_DEBT_W1 Subject =~ /<inter W1>\b<SP>?<D><E><B><T><SP>?\b/i
-header T_FUZZY_DEBT_W2 Subject =~ /<inter W2>\b<SP>?<D><E><B><T><SP>?\b/i
-header T_FUZZY_DEBT_SP_P2 Subject =~ /<inter SP><post P2>\b<SP>?<D><E><B><T><SP>?\b/i
-header T_FUZZY_DEBT_W1_P2 Subject =~ /<inter W1><post P2>\b<SP>?<D><E><B><T><SP>?\b/i
-header T_FUZZY_DEBT_W2_P2 Subject =~ /<inter W2><post P2>\b<SP>?<D><E><B><T><SP>?\b/i
-header T_FUZZY_DEBT_SP_P3 Subject =~ /<inter SP><post P3>\b<SP>?<D><E><B><T><SP>?\b/i
-header T_FUZZY_DEBT_W1_P3 Subject =~ /<inter W1><post P3>\b<SP>?<D><E><B><T><SP>?\b/i
-header T_FUZZY_DEBT_W2_P3 Subject =~ /<inter W2><post P3>\b<SP>?<D><E><B><T><SP>?\b/i
-# note overlap with SUBJECT_DRUG_GAP_VIA, maybe just nuke that rule
-# if we go with this one
-header T_FUZZY_VPILL Subject =~ /(?!viagra)<V><I><A><G><R><A>/i
-header T_FUZZY_VPILL_SP Subject =~ /<inter SP>(?!viagra)<V><I><A><G><R><A>/i
-header T_FUZZY_VPILL_W1 Subject =~ /<inter W1>(?!viagra)<V><I><A><G><R><A>/i
-header T_FUZZY_VPILL_W2 Subject =~ /<inter W2>(?!viagra)<V><I><A><G><R><A>/i
-header T_FUZZY_VPILL_SP_P2 Subject =~ /<inter SP><post P2>(?!viagra)<V><I><A><G><R><A>/i
-header T_FUZZY_VPILL_W1_P2 Subject =~ /<inter W1><post P2>(?!viagra)<V><I><A><G><R><A>/i
-header T_FUZZY_VPILL_W2_P2 Subject =~ /<inter W2><post P2>(?!viagra)<V><I><A><G><R><A>/i
-header T_FUZZY_VPILL_SP_P3 Subject =~ /<inter SP><post P3>(?!viagra)<V><I><A><G><R><A>/i
-header T_FUZZY_VPILL_W1_P3 Subject =~ /<inter W1><post P3>(?!viagra)<V><I><A><G><R><A>/i
-header T_FUZZY_VPILL_W2_P3 Subject =~ /<inter W2><post P3>(?!viagra)<V><I><A><G><R><A>/i
-
-header T_FUZZY_MEDS Subject =~ /<M><E><D><S>/i
-header T_FUZZY_MEDS_SP Subject =~ /<inter SP>\b<SP>?<M><E><D><S><SP>?\b/i
-header T_FUZZY_MEDS_W1 Subject =~ /<inter W1>\b<SP>?<M><E><D><S><SP>?\b/i
-header T_FUZZY_MEDS_W2 Subject =~ /<inter W2>\b<SP>?<M><E><D><S><SP>?\b/i
-header T_FUZZY_MEDS_SP_P2 Subject =~ /<inter SP><post P2>\b<SP>?<M><E><D><S><SP>?\b/i
-header T_FUZZY_MEDS_W1_P2 Subject =~ /<inter W1><post P2>\b<SP>?<M><E><D><S><SP>?\b/i
-header T_FUZZY_MEDS_W2_P2 Subject =~ /<inter W2><post P2>\b<SP>?<M><E><D><S><SP>?\b/i
-header T_FUZZY_MEDS_SP_P3 Subject =~ /<inter SP><post P3>\b<SP>?<M><E><D><S><SP>?\b/i
-header T_FUZZY_MEDS_W1_P3 Subject =~ /<inter W1><post P3>\b<SP>?<M><E><D><S><SP>?\b/i
-header T_FUZZY_MEDS_W2_P3 Subject =~ /<inter W2><post P3>\b<SP>?<M><E><D><S><SP>?\b/i
-
-header T_FUZZY_TION Subject =~ /(?!tion)<T><I><O><N>/i
-header T_FUZZY_TION_SP Subject =~ /<inter SP>(?!tion)<T><I><O><N>/i
-header T_FUZZY_TION_W1 Subject =~ /<inter W1>(?!tion)<T><I><O><N>/i
-header T_FUZZY_TION_W2 Subject =~ /<inter W2>(?!tion)<T><I><O><N>/i
-header T_FUZZY_TION_P2 Subject =~ /<post P2>(?!tion)<T><I><O><N>/i
-header T_FUZZY_TION_P3 Subject =~ /<post P3>(?!tion)<T><I><O><N>/i
-header T_FUZZY_TION_SP_P2 Subject =~ /<inter SP><post P2>(?!tion)<T><I><O><N>/i
-header T_FUZZY_TION_W1_P2 Subject =~ /<inter W1><post P2>(?!tion)<T><I><O><N>/i
-header T_FUZZY_TION_W2_P2 Subject =~ /<inter W2><post P2>(?!tion)<T><I><O><N>/i
-header T_FUZZY_TION_SP_P3 Subject =~ /<inter SP><post P3>(?!tion)<T><I><O><N>/i
-header T_FUZZY_TION_W1_P3 Subject =~ /<inter W1><post P3>(?!tion)<T><I><O><N>/i
-header T_FUZZY_TION_W2_P3 Subject =~ /<inter W2><post P3>(?!tion)<T><I><O><N>/i
-header T_FUZZY_TION_SP_2 Subject =~ /<inter SP>(?!tion)<T><I><O><N>\b/i
-header T_FUZZY_TION_W1_2 Subject =~ /<inter W1>(?!tion)<T><I><O><N>\b/i
-header T_FUZZY_TION_W2_2 Subject =~ /<inter W2>(?!tion)<T><I><O><N>\b/i
-header T_FUZZY_TION_P2_2 Subject =~ /<post P2>(?!tion)<T><I><O><N>\b/i
-header T_FUZZY_TION_P3_2 Subject =~ /<post P3>(?!tion)<T><I><O><N>\b/i
-header T_FUZZY_TION_SP_P2_2 Subject =~ /<inter SP><post P2>(?!tion)<T><I><O><N>\b/i
-header T_FUZZY_TION_W1_P2_2 Subject =~ /<inter W1><post P2>(?!tion)<T><I><O><N>\b/i
-header T_FUZZY_TION_W2_P2_2 Subject =~ /<inter W2><post P2>(?!tion)<T><I><O><N>\b/i
-header T_FUZZY_TION_SP_P3_2 Subject =~ /<inter SP><post P3>(?!tion)<T><I><O><N>\b/i
-header T_FUZZY_TION_W1_P3_2 Subject =~ /<inter W1><post P3>(?!tion)<T><I><O><N>\b/i
-header T_FUZZY_TION_W2_P3_2 Subject =~ /<inter W2><post P3>(?!tion)<T><I><O><N>\b/i
-
-header T_FUZZY_CHEAP Subject =~ /\b(?!cheap)<C><H><E><A><P>(?:\b|<E>)/i
-header T_FUZZY_CHEAP_SP Subject =~ /<inter SP>\b(?!cheap)<C><H><E><A><P>(?:\b|<E>)/i
-header T_FUZZY_CHEAP_SP_P2 Subject =~ /<inter SP><post P2>\b(?!cheap)<C><H><E><A><P>(?:\b|<E>)/i
-header T_FUZZY_CHEAP_W1_P2 Subject =~ /<inter W1><post P2>\b(?!cheap)<C><H><E><A><P>(?:\b|<E>)/i
-header T_FUZZY_CHEAP_W1_P3 Subject =~ /<inter W1><post P3>\b(?!cheap)<C><H><E><A><P>(?:\b|<E>)/i
-header T_FUZZY_CHEAP_W2_P2 Subject =~ /<inter W2><post P2>\b(?!cheap)<C><H><E><A><P>(?:\b|<E>)/i
-header T_FUZZY_CHEAP_W2_P3 Subject =~ /<inter W2><post P3>\b(?!cheap)<C><H><E><A><P>(?:\b|<E>)/i
-header T_FUZZY_CHEAP_W3_P2 Subject =~ /<inter W3><post P2>\b(?!cheap)<C><H><E><A><P>(?:\b|<E>)/i
-header T_FUZZY_CHEAP_W3_P3 Subject =~ /<inter W3><post P3>\b(?!cheap)<C><H><E><A><P>(?:\b|<E>)/i
-
-header T_FUZZY_PENIS Subject =~ /\b(?!penis)<P><E><N><I><S>/i
-header T_FUZZY_PENIS_SP Subject =~ /<inter SP>\b(?!penis)<P><E><N><I><S>/i
-header T_FUZZY_PENIS_SP_P2 Subject =~ /<inter SP><post P2>\b(?!penis)<P><E><N><I><S>/i
-header T_FUZZY_PENIS_W1_P2 Subject =~ /<inter W1><post P2>\b(?!penis)<P><E><N><I><S>/i
-header T_FUZZY_PENIS_W1_P3 Subject =~ /<inter W1><post P3>\b(?!penis)<P><E><N><I><S>/i
-header T_FUZZY_PENIS_W2_P2 Subject =~ /<inter W2><post P2>\b(?!penis)<P><E><N><I><S>/i
-header T_FUZZY_PENIS_W2_P3 Subject =~ /<inter W2><post P3>\b(?!penis)<P><E><N><I><S>/i
-header T_FUZZY_PENIS_W3_P2 Subject =~ /<inter W3><post P2>\b(?!penis)<P><E><N><I><S>/i
-header T_FUZZY_PENIS_W3_P3 Subject =~ /<inter W3><post P3>\b(?!penis)<P><E><N><I><S>/i
-
-header T_FUZZY_PENIS_2 Subject =~ /\b(?!penis)<P><E><N><I><S>\b/i
-header T_FUZZY_PENIS_SP_2 Subject =~ /<inter SP>\b(?!penis)<P><E><N><I><S>\b/i
-header T_FUZZY_PENIS_SP_P2_2 Subject =~ /<inter SP><post P2>\b(?!penis)<P><E><N><I><S>\b/i
-header T_FUZZY_PENIS_W1_P2_2 Subject =~ /<inter W1><post P2>\b(?!penis)<P><E><N><I><S>\b/i
-header T_FUZZY_PENIS_W1_P3_2 Subject =~ /<inter W1><post P3>\b(?!penis)<P><E><N><I><S>\b/i
-header T_FUZZY_PENIS_W2_P2_2 Subject =~ /<inter W2><post P2>\b(?!penis)<P><E><N><I><S>\b/i
-header T_FUZZY_PENIS_W2_P3_2 Subject =~ /<inter W2><post P3>\b(?!penis)<P><E><N><I><S>\b/i
-header T_FUZZY_PENIS_W3_P2_2 Subject =~ /<inter W3><post P2>\b(?!penis)<P><E><N><I><S>\b/i
-header T_FUZZY_PENIS_W3_P3_2 Subject =~ /<inter W3><post P3>\b(?!penis)<P><E><N><I><S>\b/i
-
-replace_rules T_FUZZY_FOREVER
-replace_rules T_FUZZY_FOREVER_SP
-replace_rules T_FUZZY_FOREVER_W1
-replace_rules T_FUZZY_FOREVER_W2
-replace_rules T_FUZZY_FOREVER_SP_P2
-replace_rules T_FUZZY_FOREVER_W1_P2
-replace_rules T_FUZZY_FOREVER_W2_P2
-replace_rules T_FUZZY_FOREVER_SP_P3
-replace_rules T_FUZZY_FOREVER_W1_P3
-replace_rules T_FUZZY_FOREVER_W2_P3
-replace_rules T_FUZZY_PROVEN
-replace_rules T_FUZZY_PROVEN_SP
-replace_rules T_FUZZY_PROVEN_W1
-replace_rules T_FUZZY_PROVEN_W2
-replace_rules T_FUZZY_PROVEN_SP_P2
-replace_rules T_FUZZY_PROVEN_W1_P2
-replace_rules T_FUZZY_PROVEN_W2_P2
-replace_rules T_FUZZY_PROVEN_SP_P3
-replace_rules T_FUZZY_PROVEN_W1_P3
-replace_rules T_FUZZY_PROVEN_W2_P3
-replace_rules T_FUZZY_DEBT
-replace_rules T_FUZZY_DEBT_SP
-replace_rules T_FUZZY_DEBT_W1
-replace_rules T_FUZZY_DEBT_W2
-replace_rules T_FUZZY_DEBT_SP_P2
-replace_rules T_FUZZY_DEBT_W1_P2
-replace_rules T_FUZZY_DEBT_W2_P2
-replace_rules T_FUZZY_DEBT_SP_P3
-replace_rules T_FUZZY_DEBT_W1_P3
-replace_rules T_FUZZY_DEBT_W2_P3
-replace_rules T_FUZZY_VPILL
-replace_rules T_FUZZY_VPILL_SP
-replace_rules T_FUZZY_VPILL_W1
-replace_rules T_FUZZY_VPILL_W2
-replace_rules T_FUZZY_VPILL_SP_P2
-replace_rules T_FUZZY_VPILL_W1_P2
-replace_rules T_FUZZY_VPILL_W2_P2
-replace_rules T_FUZZY_VPILL_SP_P3
-replace_rules T_FUZZY_VPILL_W1_P3
-replace_rules T_FUZZY_VPILL_W2_P3
-replace_rules T_FUZZY_MEDS
-replace_rules T_FUZZY_MEDS_SP
-replace_rules T_FUZZY_MEDS_W1
-replace_rules T_FUZZY_MEDS_W2
-replace_rules T_FUZZY_MEDS_SP_P2
-replace_rules T_FUZZY_MEDS_W1_P2
-replace_rules T_FUZZY_MEDS_W2_P2
-replace_rules T_FUZZY_MEDS_SP_P3
-replace_rules T_FUZZY_MEDS_W1_P3
-replace_rules T_FUZZY_MEDS_W2_P3
-replace_rules T_FUZZY_TION
-replace_rules T_FUZZY_TION_SP
-replace_rules T_FUZZY_TION_W1
-replace_rules T_FUZZY_TION_W2
-replace_rules T_FUZZY_TION_P2
-replace_rules T_FUZZY_TION_P3
-replace_rules T_FUZZY_TION_SP_P2
-replace_rules T_FUZZY_TION_W1_P2
-replace_rules T_FUZZY_TION_W2_P2
-replace_rules T_FUZZY_TION_SP_P3
-replace_rules T_FUZZY_TION_W1_P3
-replace_rules T_FUZZY_TION_W2_P3
-replace_rules T_FUZZY_TION_SP_2
-replace_rules T_FUZZY_TION_W1_2
-replace_rules T_FUZZY_TION_W2_2
-replace_rules T_FUZZY_TION_P2_2
-replace_rules T_FUZZY_TION_P3_2
-replace_rules T_FUZZY_TION_SP_P2_2
-replace_rules T_FUZZY_TION_W1_P2_2
-replace_rules T_FUZZY_TION_W2_P2_2
-replace_rules T_FUZZY_TION_SP_P3_2
-replace_rules T_FUZZY_TION_W1_P3_2
-replace_rules T_FUZZY_TION_W2_P3_2
-replace_rules T_FUZZY_CHEAP
-replace_rules T_FUZZY_CHEAP_SP
-replace_rules T_FUZZY_CHEAP_SP_P2
-replace_rules T_FUZZY_CHEAP_W1_P2
-replace_rules T_FUZZY_CHEAP_W1_P3
-replace_rules T_FUZZY_CHEAP_W2_P2
-replace_rules T_FUZZY_CHEAP_W2_P3
-replace_rules T_FUZZY_CHEAP_W3_P2
-replace_rules T_FUZZY_CHEAP_W3_P3
-replace_rules T_FUZZY_PENIS
-replace_rules T_FUZZY_PENIS_SP
-replace_rules T_FUZZY_PENIS_SP_P2
-replace_rules T_FUZZY_PENIS_W1_P2
-replace_rules T_FUZZY_PENIS_W1_P3
-replace_rules T_FUZZY_PENIS_W2_P2
-replace_rules T_FUZZY_PENIS_W2_P3
-replace_rules T_FUZZY_PENIS_W3_P2
-replace_rules T_FUZZY_PENIS_W3_P3
-replace_rules T_FUZZY_PENIS_2
-replace_rules T_FUZZY_PENIS_SP_2
-replace_rules T_FUZZY_PENIS_SP_P2_2
-replace_rules T_FUZZY_PENIS_W1_P2_2
-replace_rules T_FUZZY_PENIS_W1_P3_2
-replace_rules T_FUZZY_PENIS_W2_P2_2
-replace_rules T_FUZZY_PENIS_W2_P3_2
-replace_rules T_FUZZY_PENIS_W3_P2_2
-replace_rules T_FUZZY_PENIS_W3_P3_2
-
# replacement HELO_DYNAMIC rules which fix the "HELO_DYNAMIC rules firing on authenticated handovers" bug
header T_HELO_DYNAMIC_IPADDR X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]\S*\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+[^\d\s][^\.]*\.\S+\.\S+[^\]]+ auth= /i
header T_HELO_DYNAMIC_DHCP X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S*(?:cm|catv|docsis|cable|dsl|dhcp|cpe|node)\S*\d+[^\d\s]+\d+[^\]]+ auth= /i
@@ -287,8 +44,3 @@
header T_HELO_DYNAMIC_VELOX X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}\d+\.user\.veloxzone\.[^\]]+ auth= /i
header T_HELO_DYNAMIC_NTL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\d+-\d+-cust\d+\.[a-z]{4,6}\.broadband\.ntl\.com[^\]]+ auth= /i
header T_HELO_DYNAMIC_HOME_NL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}\d+-\S\.\S+\d\.[a-z]{2}\.home\.nl[^]]+ auth= /i
-
-########################################################################
-
-uri T_HEX_ENCODED_HTTP_1 /(?!http)(?:\\x68|h)(?:\\x74|t){2}(?:\\x70|p)/i
-rawbody T_HEX_ENCODED_HTTP_2 /(?!http)(?:\\x68|h)(?:\\x74|t){2}(?:\\x70|p)/i