[Bug 2992] New: Proposed new rules

[bu...@bugzilla.spamassassin.org]

http://bugzilla.spamassassin.org/show_bug.cgi?id=2992

           Summary: Proposed new rules
           Product: Spamassassin
           Version: 2.63
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: enhancement
          Priority: P3
         Component: Rules
        AssignedTo: spamassassin-dev@incubator.apache.org
        ReportedBy: martin-sabz@zamenhof.demon.co.uk


The following rules are designed to catch a currently common ratware tool.

Many of these messages hit virtually no existing rules and hence can easily get 
less than 0.1 points, with the result that their included Bayes-busting text 
gets auto-learned as ham.

These messages have a header:
Received: from [numeric_ip] by numeric_ip with HTTP; ...

header L_SPAMMY_RCVD Received =~ /from \[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\] 
by \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} with HTTP;/
describe L_SPAMMY_RCVD Received header has Ratware traces
score L_SPAMMY_RCVD 1.0

header L_MIME_BOUND_MANY_DIG    Content-Type =~ /boundary=\"\d{13,}\"/
describe L_MIME_BOUND_MANY_DIG  MIME boundary contains all digits
score L_MIME_BOUND_MANY_DIG     1.0

header L_MSGID_SPAM1         Message-Id =~ /<[A-Z]{7}-000[0-9]{10}\@[a-z]*>/
describe L_MSGID_SPAM1       Message-ID has known spammer pattern
score L_MSGID_SPAM1          1.0

rawbody L_TITLE_MESSAGE      m{<TITLE>Message</TITLE>}
describe  L_TITLE_MESSAGE    Mail has an HMTL TITLE tag of "Message"
score  L_TITLE_MESSAGE       1.0

rawbody L_CONVERTED          m{<DIV><!-- Converted from text/plain format -->}
describe L_CONVERTED         Converted from text/plain
score  L_CONVERTED           1.0



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.