svn commit: r106217 - /spamassassin/trunk/rules/20_uri_tests.cf

[qu...@apache.org]

Author: quinlan
Date: Mon Nov 22 12:45:19 2004
New Revision: 106217

Modified:
   spamassassin/trunk/rules/20_uri_tests.cf
Log:
promote best URI-based T_SPOOF_* rules


Modified: spamassassin/trunk/rules/20_uri_tests.cf
Url: http://svn.apache.org/viewcvs/spamassassin/trunk/rules/20_uri_tests.cf?view=diff&rev=106217&p1=spamassassin/trunk/rules/20_uri_tests.cf&r1=106216&p2=spamassassin/trunk/rules/20_uri_tests.cf&r2=106217
==============================================================================
--- spamassassin/trunk/rules/20_uri_tests.cf	(original)
+++ spamassassin/trunk/rules/20_uri_tests.cf	Mon Nov 22 12:45:19 2004
@@ -117,3 +117,19 @@
 # really a URI rule
 header URI_REDIRECTOR		eval:check_for_http_redirector()
 describe URI_REDIRECTOR		Message has HTTP redirector URI
+
+# a.com.b.c
+uri SPOOF_COM2OTH	m{^https?://(?:\w+\.)+?com\.(?:\w+\.){2,}}i
+describe SPOOF_COM2OTH	URI contains ".com" in middle
+
+# a.com.b.com
+uri SPOOF_COM2COM	m{^https?://(?:\w+\.)+?com\.(?:\w+\.)+?com}i
+describe SPOOF_COM2COM 	URI contains ".com" in middle and end
+
+# a.net.b.com
+uri SPOOF_NET2COM	m{^https?://(?:\w+\.)+?(?:net|org)\.(?:\w+\.)+?com}i
+describe SPOOF_NET2COM 	URI contains ".net" or ".org", then ".com"
+
+# CDNs (Akamai (edgesuite), Speedera, and NYUD, so far) do this, so skip them
+uri SPOOF_OURI		m{^https?://(?:[a-z0-9_-]+?\.){2,}(?:com|net|org|biz|info|edu|www)(?!\.(?:\w+\.)?(?:edgesuite|nyud|speedera)\.net)(?:\.[a-z0-9_%-]+?){2,}(?:(?::|%3a)\d+)?}i
+describe SPOOF_OURI	URL has items in odd places