You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by gb...@apache.org on 2018/11/03 14:59:21 UTC
svn commit: r1845668 - /spamassassin/trunk/rulesrc/sandbox/gbechis/20_misc.cf
Author: gbechis
Date: Sat Nov 3 14:59:21 2018
New Revision: 1845668
URL: http://svn.apache.org/viewvc?rev=1845668&view=rev
Log:
new spam seen on the wild
Modified:
spamassassin/trunk/rulesrc/sandbox/gbechis/20_misc.cf
Modified: spamassassin/trunk/rulesrc/sandbox/gbechis/20_misc.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/gbechis/20_misc.cf?rev=1845668&r1=1845667&r2=1845668&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/gbechis/20_misc.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/gbechis/20_misc.cf Sat Nov 3 14:59:21 2018
@@ -4,3 +4,8 @@ describe MALWARE_DROPBOX_JAR_URI Dropbox
uri GOOGLE_OBFU /^https:\/\/www\.google\.([a-z]{2,3})\/url\?sa=t\&rct=j\&q=\&esrc=s\&source=web\&cd=([0-9])+\&cad=rja\&uact=([0-9]+)\&ved=(.*)\&url=https?:\/\/(.*)&usg=(.*)/
describe GOOGLE_OBFU Obfuscate url through Google redirect
+
+uri __URI_SHORT /https?:\/\/(?:j\.mp|bit\.ly|goo\.gl|x\.co|t\.co|t\.cn|tinyurl\.com|hop\.kz|urla\.ru|fw\.to|back\.ly)(\/)/i
+header __COPY_OF Subject =~ /Copy of:/
+meta COPY_OF_SHORT ( __URI_SHORT && __COPY_OF && __KAM_BODY_LENGTH_LT_1024 )
+describe COPY_OF_SHORT Url shortnener spam