| 1 |
|
# -*- mode: spamassassin -*- |
| 2 |
# joy, 2003-06-29 |
# joy, 2003-06-29 |
| 3 |
body ORIENTSKY /orient-sky\.com/ |
body ORIENTSKY /orient-sky\.com/ |
| 4 |
describe ORIENTSKY Japanese spam |
describe ORIENTSKY Japanese spam |
| 68 |
|
|
| 69 |
# blarson 2005-12-08 |
# blarson 2005-12-08 |
| 70 |
# don 2007-11-21 -- combine other rule; increment score |
# don 2007-11-21 -- combine other rule; increment score |
| 71 |
body GEOCITIES /http\:\/\/.*geocities/i |
# don 2009-02-17 -- increase score even more; ditch http |
| 72 |
describe GEOCITIES geocities url |
uri GEOCITIES /geocities/i |
| 73 |
score GEOCITIES 2.5 |
describe GEOCITIES geocities uri |
| 74 |
|
score GEOCITIES 3 |
| 75 |
|
|
| 76 |
# blarson 2005-12-24 |
# blarson 2005-12-24 |
| 77 |
body EMPTYURL /\bhttp:\/\/(?:www\.)?$/i |
body EMPTYURL /\bhttp:\/\/(?:www\.)?$/i |
| 123 |
describe PENPRO penmailpro spam |
describe PENPRO penmailpro spam |
| 124 |
score PENPRO 3.5 |
score PENPRO 3.5 |
| 125 |
|
|
| 126 |
# blarson 2007-09-05 2007-09-11 |
# blarson 2007-09-05 2007-09-11 2009-04-12 |
| 127 |
body WWWCN /\b(?:www\.|https?\:.*)\w+\.cn\b/i |
body WWWCN /\b(?:www\.|https?\:.*)(\w|-|\.)+\.cn\b/i |
| 128 |
describe WWWCN chinese web site |
describe WWWCN chinese web site |
| 129 |
score WWWCN 3 |
score WWWCN 3 |
| 130 |
|
|
| 302 |
score SOFTBESTGRAND 4 |
score SOFTBESTGRAND 4 |
| 303 |
|
|
| 304 |
# blarson 2007-12-10 |
# blarson 2007-12-10 |
| 305 |
body PCSOFTCHEAP /\b(?:pcsoftcheap|cheapezsoft|cheapsoftxp|adobe4cheap|phonowa|saleonsoftware|bestdealoem|realcheapsoft|krasniyles|cheapxp4pc|supercheapoem|lowpriceoem|realcheapoem|cheapadobedeal|softwarefoundation|2008oem|xpxmas|cheap2008soft|snowysoftware|2008adobe|adobe2008|cheapgetsoftone|x(?:higher|main|prime)(?:soft|software|easy)|softonlinepc|andsoftware|softonlinedownload|kunchakoem|erhere\w|kiroemch|phonowd|cheap(?:soft|oem|software)here|softwarenowprox|xprosoftonlinedl|siniyglaz|popandosoem|xsoftprodepot|triudava|krasniynos|fastsoftnow|cheapeasy(soft|oem|software)|ezadobenow|softnowpromohere|primenetsofthe|nowinstantsoftieq|isktesoft|best(?:oem|soft|software)2008|new2008(?:soft|oem|software)|fastez(?:soft|oem|software)|ezfast(?:oem|soft|software)|2008(?:micro)?softdeals|oemfactorysale|nbuysoft|softnuhere|softsale2008|softwintersale|blatnoyoem|svedsoft|gsxoempromo|getmicrosoftfast|adobeoemsale|xp4(?:cheap|less)|xpoemnow|buycheapxp|alloem4less|lun(?:soft|oem|software)|(?:new|fast)xp(?:soft|oem|software)|frukanoka|softcheap(?:n[eo]w|xp))\s?\.\s?(?:com|net)\b/ |
body PCSOFTCHEAP /\b(?:pcsoftcheap|cheapezsoft|cheapsoftxp|adobe4cheap|phonowa|saleonsoftware|bestdealoem|realcheapsoft|krasniyles|cheapxp4pc|supercheapoem|lowpriceoem|realcheapoem|cheapadobedeal|softwarefoundation|2008oem|xpxmas|cheap2008soft|snowysoftware|2008adobe|adobe2008|cheapgetsoftone|x(?:higher|main|prime)(?:soft|software|easy)|softonlinepc|andsoftware|softonlinedownload|kunchakoem|erhere\w|kiroemch|phonowd|cheap(?:soft|oem|software)here|softwarenowprox|xprosoftonlinedl|siniyglaz|popandosoem|xsoftprodepot|triudava|krasniynos|fastsoftnow|cheapeasy(soft|oem|software)|ezadobenow|softnowpromohere|primenetsofthe|nowinstantsoftieq|isktesoft|best(?:oem|soft|software)2008|new2008(?:soft|oem|software)|fastez(?:soft|oem|software)|ezfast(?:oem|soft|software)|2008(?:micro)?softdeals|oemfactorysale|nbuysoft|softnuhere|softsale2008|softwintersale|blatnoyoem|svedsoft|gsxoempromo|getmicrosoftfast|adobeoemsale|xp4(?:cheap|less)|xpoemnow|buycheapxp|alloem4less|lun(?:soft|oem|software)|(?:new|fast)xp(?:soft|oem|software)|frukanoka|softcheap(?:n[eo]w|xp)|adobe(?:web|blog|new)(?:soft|spot|deal))\s?\.\s?(?:com|net)\b/ |
| 306 |
describe PCSOFTCHEAP pcsoftcheap. com |
describe PCSOFTCHEAP pcsoftcheap. com |
| 307 |
score PCSOFTCHEAP 4 |
score PCSOFTCHEAP 4 |
| 308 |
|
|
| 466 |
describe MYTHANKYOUURI www.mythankyou.com |
describe MYTHANKYOUURI www.mythankyou.com |
| 467 |
score MYTHANKYOUURI 5 |
score MYTHANKYOUURI 5 |
| 468 |
|
|
|
# don 2008-04-08 |
|
|
uri BLOGSPOTURI /blogspot\.com/i |
|
|
describe BLOGSPOTURI something.blogspot.com |
|
|
score BLOGSPOTURI 2.5 |
|
|
|
|
| 469 |
# blarson 2008-04-09 |
# blarson 2008-04-09 |
| 470 |
uri SAMEAS /\bsupersameas\.com\b/ |
uri SAMEAS /\bsupersameas\.com\b/ |
| 471 |
describe SAMEAS supersameas.com |
describe SAMEAS supersameas.com |
| 485 |
body EQMEDS /\beqmeds\b/i |
body EQMEDS /\beqmeds\b/i |
| 486 |
describe EQMEDS eqmeds |
describe EQMEDS eqmeds |
| 487 |
score EQMEDS 4 |
score EQMEDS 4 |
| 488 |
|
|
| 489 |
|
# blarson 2008-05-06 |
| 490 |
|
uri MYLIVE /\bmylivegi\b/i |
| 491 |
|
describe MYLIVE mylivegirlx.com |
| 492 |
|
score MYLIVE 4 |
| 493 |
|
|
| 494 |
|
# don 2008-05-26 |
| 495 |
|
body BROKENURL /^\s*www((\s+\.\s*)|(\s*\.\+))\S+((\s+\.\s*)|(\s*\.\+))(com|net|org)\s*$/ |
| 496 |
|
describe BROKENURL Broken url displayed |
| 497 |
|
score BROKENURL 4 |
| 498 |
|
|
| 499 |
|
# don 2008-06-13 |
| 500 |
|
body STUPIDURL /\w+\[\w+\](?:com|net|org)/ |
| 501 |
|
describe STUPIDURL No one will guess that fooo[DOT]com is an URL! |
| 502 |
|
score STUPIDURL 2.5 |
| 503 |
|
|
| 504 |
|
# blarson 2008-06-16 |
| 505 |
|
body SUGARCOM /\b(?:indicatesugar|industryexpect|eset)\.com\b/ |
| 506 |
|
describe SUGARCOM indicatesugar.com |
| 507 |
|
score SUGARCOM 4 |
| 508 |
|
|
| 509 |
|
# blarson 2008-07-22 |
| 510 |
|
body VIEWMOVIE /\/(?:(?:viewmovie|stream|watchit|topnews|hotnews|fresh|checkit|default|gowatch|showvideo|livestreaming|top|whatsup|tophot|lol|first|index1|1)\.html\b|(?:video|news2\/)\s*$)/ |
| 511 |
|
describe VIEWMOVIE tabiloid style spam |
| 512 |
|
score VIEWMOVIE 3 |
| 513 |
|
|
| 514 |
|
# blarson 2008-07-22 |
| 515 |
|
uri OPERAMAIL /\bwww\.opera\.com\/mail\// |
| 516 |
|
describe OPERAMAIL opera.com mail |
| 517 |
|
score OPERAMAIL 1 |
| 518 |
|
|
| 519 |
|
# blarson 2008-08-09 |
| 520 |
|
body NOSITE /http:\/\/\// |
| 521 |
|
describe NOSITE http URL with no site |
| 522 |
|
score NOSITE 2 |
| 523 |
|
|
| 524 |
|
# don 2008-09-04 |
| 525 |
|
uri TIECORRECT /tiecorrect\.com/ |
| 526 |
|
describe TIECORRECT Contains a tiecorrect.com uri |
| 527 |
|
score TIECORRECT 4 |
| 528 |
|
|
| 529 |
|
# don 2009-02-04 |
| 530 |
|
body FOURMINUTI /4minuti/ |
| 531 |
|
describe FOURMINUTI Spam from 4 minuti |
| 532 |
|
score FOURMINUTI 3 |
| 533 |
|
|
| 534 |
|
# don 2009-02-09 |
| 535 |
|
uri CREDITREPORTURI /creditreport/ |
| 536 |
|
describe CREDITREPORTURI Credit report in the url isn't good |
| 537 |
|
score CREDITREPORTURI 2 |
| 538 |
|
|
| 539 |
|
uri YAARIURI /yaari.com/i |
| 540 |
|
describe YAARIURI Contains a yaari.com uri |
| 541 |
|
score YAARIURI 3 |
| 542 |
|
|
| 543 |
|
uri MALADIRET /maladiretaemails/ |
| 544 |
|
describe MALADIRET Contains a maladiret uri |
| 545 |
|
score MALADIRET 5 |
| 546 |
|
|
| 547 |
|
uri DEBRICOLAJE /debricolaje/i |
| 548 |
|
describe DEBRICOLAJE Contains a debricolaje url |
| 549 |
|
score DEBRICOLAJE 6 |
| 550 |
|
|
| 551 |
|
# blarson 2009-05-02 |
| 552 |
|
uri ISUISSE /\bisuisse\.com/ |
| 553 |
|
describe ISUISSE isuisse.com |
| 554 |
|
score ISUISSE 4 |
| 555 |
|
|
| 556 |
|
# formorer 2010-01-23 |
| 557 |
|
header LEXCHANGE subject =~ /for Links Exchange/i |
| 558 |
|
describe LEXCHANGE ask for link exchange |
| 559 |
|
score LEXCHANGE 4 |
| 560 |
|
|
| 561 |
|
# don 2010-03-16 |
| 562 |
|
uri EMAILSPARKLE /emailsparkle.com/ |
| 563 |
|
describe EMAILSPARKLE emailsparkle.com uri |
| 564 |
|
score EMAILSPARKLE 4 |