You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2009/07/12 18:19:18 UTC
svn commit: r793371 - in /spamassassin/trunk/rulesrc/sandbox/jhardin:
20_fillform.cf 20_uri_obfu_ws.cf
Author: jhardin
Date: Sun Jul 12 16:19:17 2009
New Revision: 793371
URL: http://svn.apache.org/viewvc?rev=793371&view=rev
Log:
fillform and URI obfuscation tuning
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf
spamassassin/trunk/rulesrc/sandbox/jhardin/20_uri_obfu_ws.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf?rev=793371&r1=793370&r2=793371&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf Sun Jul 12 16:19:17 2009
@@ -23,7 +23,7 @@
# Address variations
replace_tag FF_A1 (?:(?:address|country|county|states?|city|province|territory|(?:zip|postal)(?:\s?code)?)<ANDOR>?){1,3}(?:\sof\s(?:residence|birth|employment|citizenship))?
- replace_tag FF_A2 (?:(?:contact|e-?mail|full|home|resident[ia]+l|business|mailing|work|office)<ANDOR>?){0,3}\s?(?:address?(?:es)?|location)
+ replace_tag FF_A2 (?:(?:contact|e-?mail|full|home|resident[ia]+l|business|mailing|work|office|delivery|shipping)<ANDOR>?){0,3}\s?(?:address?(?:es)?|location)
# Name variations
replace_tag FF_N1 (?:company|first|last|all|business|legal)?\s?names?(?:<ANDOR>address)?
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_uri_obfu_ws.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_uri_obfu_ws.cf?rev=793371&r1=793370&r2=793371&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_uri_obfu_ws.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_uri_obfu_ws.cf Sun Jul 12 16:19:17 2009
@@ -4,3 +4,6 @@
body URI_OBFU_X9_WS /\bwww(?:\s\W?\s?|\W\s?)\w{1,15}\d{1,10}(?:\s\W?\s?|\W\s)(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g)\b/i
describe URI_OBFU_X9_WS www.xx99.com URI obfuscated with whitespace
+body URI_OBFU_WWW /\bwww[^[:alnum:]]{1,3}\w{1,20}(?:(?!\.[[:alnum:]])[^[:alnum:]]{1,3})(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g)\b/i
+describe URI_OBFU_WWW Obfuscated URI
+