You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Marc Kool <M....@vioro.nl> on 2004/03/18 08:12:22 UTC
another new rule set
Hi all,
I developed a new rule set which works very well for the
amavisd-new/postfix setup that I use.
I don't have a large sample of ham and spam so could
somebody please mass-check the following rule set
and let me know ?
Thanks
Marc
body V_CIALIS_MISSPELLED_1 /(Cgalis|Cialjs|Cialgs|Cbalis|Ciwlis|Cial..is)/i
describe V_CIALIS_MISSPELLED_1 Cialis misspelled (simple)
score V_CIALIS_MISSPELLED_1 3.5
# CIALIS == C. I . A . L . I . S
body V_CIALIS_MISSPELLED_2 /c.?(i|1|\||l|\!).?(a|\@).?(i|1|\||l|\!).?(i|1|\||l|\!).?s/i
describe V_CIALIS_MISSPELLED_2 Cialis misspelled
score V_CIALIS_MISSPELLED_2 3.5
body V_VIAGRA_MISSPELLED_1 /(viaara|voagra|viagr..a|viag..ra)/i
describe V_VIAGRA_MISSPELLED_1 Viagra misspelled (simple)
score V_VIAGRA_MISSPELLED_1 3.5
# VIAGRA == V. I . A . G. R. A
body V_VIAGRA_MISSPELLED_2 /v.?(i|1|\||l|\!).?(a|\@).?g.?r.?(a|\@)/i
describe V_VIAGRA_MISSPELLED_2 Viagra misspelled
score V_VIAGRA_MISSPELLED_2 3.5
body V_CIALAPREN_ADS /cialapren/i
describe V_CIALAPREN_ADS Cialapren drug
score V_CIALAPREN_ADS 2.5
body V_VIAGRA_ADS /\/.9.gif/
describe V_VIAGRA_ADS Various Viagra ads
score V_VIAGRA_ADS 2.0
rawbody V_VIAGRA_AD_01 /<!--.{10,18}--><a href="http:\/\/www\..{5,12}\.com[\/a-zA-Z0-9]{0,7}"><img src="http:\/\/www\..{5,12}\.com\/.{2,3}\.gif" border=0>/
describe V_VIAGRA_AD_01 Viagra Ad 1
score V_VIAGRA_AD_01 4.0
rawbody V_VIAGRA_AD_02 />v<.*>i<.*>a<.*>g<.*>r<.*>a</i
describe V_VIAGRA_AD_02 Viagra Ad 2
score V_VIAGRA_AD_02 2.0
rawbody V_VIAGRA_AD_03 />c<.*>i<.*>a<.*>l<.*>i<.*>s</i
describe V_VIAGRA_AD_03 Cialis Ad 3
score V_VIAGRA_AD_03 2.0
rawbody V_AFFILIATE_01 /affiliate/i
describe V_AFFILIATE_01 Affiliate ad 1
score V_AFFILIATE_01 0.6
rawbody V_AFFILIATE_02 /affiliate_id/i
describe V_AFFILIATE_02 Affiliate ad 2
score V_AFFILIATE_02 1.2
rawbody V_CAMPAIGN_01 /campaign/i
describe V_CAMPAIGN_01 Campaign ad 1
score V_CAMPAIGN_01 0.6
rawbody V_CAMPAIGN_02 /campaign_id/i
describe V_CAMPAIGN_02 Campaign ad 2
score V_CAMPAIGN_02 1.2
rawbody V_INLINE_GIF /image\/gif/i
describe V_INLINE_GIF inlined gif image
score V_INLINE_GIF 0.6
rawbody V_INLINE_JPG /image\/jpe?g/i
describe V_INLINE_JPG inlined jpeg image
score V_INLINE_JPG 0.6
# viagra ads:
body V_DRUNK_PUNCH /(drunk|drungk|punch)/i
describe V_DRUNK_PUNCH drunk punch
score V_DRUNK_PUNCH 1.2
body V_DICK_MISSPELLED /\b(d[^iuyoea]ck|dicck)/i
describe V_DICK_MISSPELLED dick misspelled
score V_DICK_MISSPELLED 2.0
body V_PILLS_1 /\bpills/i
describe V_PILLS_1 pills
score V_PILLS_1 0.7
body V_PILLS_MISSPELLED /\bpi11s/i
describe V_PILLS_MISSPELLED pills misspelled
score V_PILLS_MISSPELLED 2.2
body V_FUCKED_MISSPELLED /\bf[^uo]cked\b/i
describe V_FUCKED_MISSPELLED fucked misspelled
score V_FUCKED_MISSPELLED 2.0
# unusual long word
rawbody V_VERY_LONG_WORD_1 /\w{55,}/
describe V_VERY_LONG_WORD_1 long sequence of normal characters
score V_VERY_LONG_WORD_1 0.2
# can be a long URL:
rawbody V_VERY_LONG_WORD_2 /\S{95,}/
describe V_VERY_LONG_WORD_2 long sequence of characters
score V_VERY_LONG_WORD_2 0.5
# many spaces
body V_MANY_SPACES /\s{14}/
describe V_MANY_SPACES 14 whitespace characters
score V_MANY_SPACES 0.7
# HTML comment usually indicates an ad
rawbody V_HTML_COMMENT /\<!\-\-/
describe V_HTML_COMMENT HTML comment
score V_HTML_COMMENT 0.4
# fake HTML tag without vowels
rawbody V_FAKE_TAG_1 /\<[\/!]?[bcdfghjklmnpqrstvwxz]{5,9}\>/i
describe V_FAKE_TAG_1 5-9 char fake HTML tag (no vowels)
score V_FAKE_TAG_1 2.0
# fake HTML tag that is too long
rawbody V_FAKE_TAG_2 /\<[\/!]?[a-z_0-9]{10,20}\>/i
describe V_FAKE_TAG_2 10+ char fake HTML tag with optional digit and underscore
score V_FAKE_TAG_2 2.0
# fake HTML tag with digits
rawbody V_FAKE_TAG_3 /\<[\/!]?[a-z]{2,10}[0-9]\w{0,12}\>/i
describe V_FAKE_TAG_3 fake HTML tag with a digit
score V_FAKE_TAG_3 2.0
rawbody V_MESSAGE_LOADING /\>message loading\</i
describe V_MESSAGE_LOADING message loading (between tags)
score V_MESSAGE_LOADING 2.0
rawbody V_IMAGE_NOT_LOADING /image not loading/i
describe V_IMAGE_NOT_LOADING image not loading
score V_IMAGE_NOT_LOADING 1.8
rawbody V_IMAGE_NOT_SHOWING /image not showing/i
describe V_IMAGE_NOT_SHOWING image not showing
score V_IMAGE_NOT_SHOWING 1.8
body V_ADS_01 /doctor/i
score V_ADS_01 0.5
body V_ADS_02 /prices/i
score V_ADS_02 0.5
body V_ADS_03 /products/i
score V_ADS_03 0.5
body V_ADS_04 /licensed/i
score V_ADS_04 0.5
body V_ADS_05 /shipped/i
score V_ADS_05 0.5
body V_ADS_06 /shipping/i
score V_ADS_06 0.5
body V_ADS_07 /orders/i
score V_ADS_07 0.5
body V_ADS_08 /rolexes/i
score V_ADS_08 1.5
body V_ADS_09 /bachelors/i
score V_ADS_09 0.5
body V_ADS_10 /masters/i
score V_ADS_10 0.5
body V_ADS_11 /ship(ped)? to all countries/i
score V_ADS_11 0.8
# long username (no dots) in from address
header V_FROM_IS_LONG_ND From =~ /[-_a-zA-Z0-9]{24,}\@/
describe V_FROM_IS_LONG_ND user name is 24+ long (without dots)
score V_FROM_IS_LONG_ND 0.5
# very long username in from address
header V_FROM_IS_LONG From =~ /[-_a-zA-Z0-9\.]{40,}\@/
describe V_FROM_IS_LONG user name is 40+ long
score V_FROM_IS_LONG 0.5
# accept newsletters DUTCH
body V_NEWSLETTER /(newsletter|nieuwsbrief)/i
describe V_NEWSLETTER newsletter
score V_NEWSLETTER -0.8
# some spammers use yahoo for redirection
uri V_REDIR_YAHOO /https?:\/\/drs.yahoo.com\/.{5,50}\*http/i
describe V_REDIR_YAHOO ad redirection via Yahoo!
score V_REDIR_YAHOO 2.0
# the following is a more generic re for redirection
uri V_DOUBLE_URI /https?.{3,9}[-a-z0-9\.]{1,60}\/.{1,80}(url=|redir=|returnto=|https?)/
describe V_DOUBLE_URI URI contains 2nd URI
score V_DOUBLE_URI 1.5
# random tokens without vowels (e.g. "xdfhskmwqs")
body V_NO_VOWEL_7 /[bcdfghjklmnpqrstvwxz]{7}/i
describe V_NO_VOWEL_7 7-char word without vowels
score V_NO_VOWEL_7 0.7
body V_NO_VOWEL_8 /[bcdfghjklmnpqrstvwxz]{8}/i
describe V_NO_VOWEL_8 8-char word without vowels
score V_NO_VOWEL_8 1.1
body V_NO_VOWEL_9 /[bcdfghjklmnpqrstvwxz]{9}/i
describe V_NO_VOWEL_9 9-char word without vowels
score V_NO_VOWEL_9 0.5
body V_2_LONG_WORDS /[a-zA-Z]{50,200}\s+[a-zA-Z]{50,200}/
describe V_2_LONG_WORDS 2 consecutive very long words
score V_2_LONG_WORDS 0.7
body V_3_LONG_WORDS /[a-zA-Z]{50,200}\s+[a-zA-Z]{50,200}\s+[a-zA-Z]{50,200}/
describe V_3_LONG_WORDS 3 consecutive very long words
score V_3_LONG_WORDS 1.2
body V_4_LONG_WORDS /[a-zA-Z]{50,200}\s+[a-zA-Z]{50,200}\s+[a-zA-Z]{50,200}\s+[a-zA-Z]{50,200}/
describe V_4_LONG_WORDS 4 consecutive very long words
score V_4_LONG_WORDS 1.2
# detect crap like "jqp zomqku, wiu, dkte . hcr zicztp chl, hztz, phhy . sbnlfu"
body V_9_RND_SMALL_WORDS /([a-zA-Z]{3,6}[ \.,]{1,3}){9,}/
describe V_9_RND_SMALL_WORDS 9 consecutive small words
score V_9_RND_SMALL_WORDS 0.6
body V_10_RND_SMALL_WORDS /([a-zA-Z]{3,6}[ \.,]{1,3}){10,}/
describe V_10_RND_SMALL_WORDS 10 consecutive small words
score V_10_RND_SMALL_WORDS 1.1
body V_16_RND_SMALL_WORDS /([a-zA-Z]{2,6}[ \.,]{1,3}){16,}/
describe V_16_RND_SMALL_WORDS 16 consecutive small words
score V_16_RND_SMALL_WORDS 1.5
# detect lines with a set of random words
# e.g. "taint dutchman conductor gingko defector augur cummins demagogue zaire biota crowberry idiotic hardboard september"
body V_18_WORDS /^([a-zA-Z]{3,20}\s+){18,}/
describe V_18_WORDS 18+ words without interpunction
score V_18_WORDS 0.8
body V_24_WORDS /^([a-zA-Z]{3,20}\s+){24,}/
describe V_24_WORDS 24+ words without interpunction
score V_24_WORDS 1.2
# detect lines with a set of random tokens
# e.g. "0678YDXqs 4K8687 t1qh8486q B7jk16 QF N15ed82J 321Yb1F1 hJ1653w 7u455 g2j4kUQN 10 cPs 2R o35 88rS6 066Q7I2kh"
body V_18_TOKENS /^([a-zA-Z0-9]{2,9}\s+){18,}/
describe V_18_TOKENS 18+ tokens without interpunction
score V_18_TOKENS 0.8
body V_24_TOKENS /^([a-zA-Z0-9]{2,9}\s+){24,}/
describe V_24_TOKENS 24+ tokens without interpunction
score V_24_TOKENS 1.2
Re: another new rule set
Posted by John Hardin <jo...@aproposretail.com>.
On Wed, 2004-03-17 at 23:12, Marc Kool wrote:
> body V_CIALIS_MISSPELLED_1 /(Cgalis|Cialjs|Cialgs|Cbalis|Ciwlis|Cial..is)/i
Checking for obfuscation should include accented characters:
body VIAGRAS_01
/v[i1!í-ï][a@]gr[a@]|\Wc[il1í-ï][a@][l1][i1!í-ï][s5]|\Wr[e3]g[a@][l1][i1!í-ï][s5]/i
Note the range of accented "i" characters included. (It should probably
also include the uppercase versions as well, since the case-insensitive
match flag probably doesn't work on those.)
--
John Hardin KA7OHZ
Internal Systems Administrator/Guru voice: (425) 672-1304
Apropos Retail Management Systems, Inc. fax: (425) 672-0192
-----------------------------------------------------------------------
If you smash a computer to bits with a mallet, that appears to count
as encryption in the state of Nevada.
- CRYPTO-GRAM 12/2001
-----------------------------------------------------------------------
[SPAM: 16.10/05.00] Re: another new rule set
Posted by Jesse Houwing <j....@student.utwente.nl>.
> # some spammers use yahoo for redirection
> uri V_REDIR_YAHOO
> /https?:\/\/drs.yahoo.com\/.{5,50}\*http/i
> describe V_REDIR_YAHOO ad redirection via Yahoo!
> score V_REDIR_YAHOO 2.0
>
> # the following is a more generic re for redirection
> uri V_DOUBLE_URI
> /https?.{3,9}[-a-z0-9\.]{1,60}\/.{1,80}(url=|redir=|returnto=|https?)/
> describe V_DOUBLE_URI URI contains 2nd URI
> score V_DOUBLE_URI 1.5
I've written a ruleset specifically for Redirect scripts it can be found
here:
http://www.exit0.us/index.php/ToAoMsRedirectRules
It also contains the two rules you've added to your set, though my scores a
a bit lower.
Jesse
Re: another new rule set
Posted by Robert Menschel <Ro...@Menschel.net>.
Hello Marc,
Wednesday, March 17, 2004, 11:12:22 PM, you wrote:
MK> Hi all,
MK> I developed a new rule set which works very well for the
MK> amavisd-new/postfix setup that I use.
MK> I don't have a large sample of ham and spam so could
MK> somebody please mass-check the following rule set
MK> and let me know ?
MK> Thanks
MK> Marc
I don't have time to fix the rules broken by line wrap today.
If you can send me another copy, with the rule set attached so there is
no line wrap, I'll run it through my corpus.
Bob Menschel