# SARE HTML Ruleset for SpamAssassin - ruleset 2 # Version: 01.03.10 # Created: 2004-03-31 # Modified: 2006-06-03 # Usage instructions, documentation, and change history in 70_sare_html0.cf #@@# Revision History: Full Revision History stored in 70_sare_html.log #@@# 01.03.09: May ?? 2006 #@@# Minor score tweaks based on recent mass-checks #@@# Moved file 0 to file 2: SARE_HTML_EHTML_OBFU #@@# Moved file 0 to file 2: SARE_HTML_HEAD_AFFIL #@@# Moved file 0 to file 2: SARE_HTML_LEAKTHRU1 #@@# Moved file 0 to file 2: SARE_HTML_LEAKTHRU2 #@@# Moved file 0 to file 2: SARE_HTML_ONE_LINE3 #@@# Moved file 0 to file 2: SARE_HTML_POB1200 #@@# Moved file 0 to file 2: SARE_HTML_URI_HIDADD #@@# Moved file 0 to file 2: SARE_HTML_URI_LOGOGEN #@@# Moved file 0 to file 2: SARE_HTML_URI_OFF #@@# Moved file 0 to file 2: SARE_HTML_USL_B7 #@@# Moved file 0 to file 2: SARE_HTML_USL_B9 #@@# Moved file 0 to file 2: SARE_PHISH_HTML_01 #@@# 01.03.10: June 3 2006 #@@# Minor score tweaks based on recent mass-checks #@@# Moved file 1 to 2: SARE_HTML_BR_MANY #@@# Moved file 1 to 2: SARE_HTML_ONE_LINE2 #@@# Moved file 1 to 2: SARE_HTML_URI_OC # License: Artistic - see http://www.rulesemporium.com/license.txt # Current Maintainer: Bob Menschel - RMSA@Menschel.net # Current Home: http://www.rulesemporium.com/rules/70_sare_html2.cf # ######## ###################### ################################################## rawbody __SARE_HTML_HAS_A eval:html_tag_exists('a') rawbody __SARE_HTML_HAS_BR eval:html_tag_exists('br') rawbody __SARE_HTML_HAS_DIV eval:html_tag_exists('div') rawbody __SARE_HTML_HAS_FONT eval:html_tag_exists('font') rawbody __SARE_HTML_HAS_IMG eval:html_tag_exists('img') rawbody __SARE_HTML_HAS_P eval:html_tag_exists('p') rawbody __SARE_HTML_HAS_PRE eval:html_tag_exists('pre') rawbody __SARE_HTML_HAS_TITLE eval:html_tag_exists('title') rawbody __SARE_HTML_HBODY m''i rawbody __SARE_HTML_BEHTML m''i rawbody __SARE_HTML_BEHTML2 m'^'i rawbody __SARE_HTML_EFONT m'^'i rawbody __SARE_HTML_EHEB m'^'i rawbody __SARE_HTML_CMT_CNTR /
/i describe SARE_HTML_CMT_MONEY HTML Comment seems to mention money score SARE_HTML_CMT_MONEY 0.100 #counts SARE_HTML_CMT_MONEY 0s/0h of 98542 corpus (76935s/21607h RM) 05/12/04 #counts SARE_HTML_CMT_MONEY 0s/0h of 29365 corpus (5882s/23483h JH) 08/14/04 TM2 SA3.0-pre2 ######## ###################### ################################################## # Image tag tests ######## ###################### ################################################## rawbody SARE_HTML_GIF_NUM /\.gif\d{2,}/i describe SARE_HTML_GIF_NUM HTML contains tracking numbers after .gif score SARE_HTML_GIF_NUM 0.100 #counts SARE_HTML_GIF_NUM 0s/0h of 98542 corpus (76935s/21607h RM) 05/12/04 #counts SARE_HTML_GIF_NUM 0s/0h of 29365 corpus (5882s/23483h JH) 08/14/04 TM2 SA3.0-pre2 ######## ###################### ################################################## # Paragraphs, breaks, and spacings ######## ###################### ################################################## rawbody SARE_HTML_BR_MANY /
{5}/i describe SARE_HTML_BR_MANY Too many sequential identical HTML tags score SARE_HTML_BR_MANY 0.555 #stype SARE_HTML_BR_MANY spamp #counts SARE_HTML_BR_MANY 0s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_HTML_BR_MANY 2s/0h of 258858 corpus (114246s/144612h RM) 05/27/05 #counts SARE_HTML_BR_MANY 0s/0h of 29365 corpus (5882s/23483h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_HTML_BR_MANY 0s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05 #counts SARE_HTML_BR_MANY 0s/0h of 47221 corpus (42968s/4253h MY) 06/18/05 rawbody __SARE_HTML_MANY_BR05 /
\s*
\s*
\s*
\s*
\s*
/i meta SARE_HTML_MANY_BR05 __SARE_HTML_MANY_BR05 && HTML_MESSAGE describe SARE_HTML_MANY_BR05 Tooo many
's! score SARE_HTML_MANY_BR05 0.500 #hist SARE_HTML_MANY_BR05 Contrib by Matt Keller June 7 2004 #note SARE_HTML_MANY_BR05 Remove HTML_MESSAGE test increases spam 4% but doubles ham #hist SARE_HTML_MANY_BR05 this and SARE_HTML_MANY_BR10 obsolete SARE_HTML_TD_BR4 = FR_WICKED_SPAM_?? #counts SARE_HTML_MANY_BR05 0s/0h of 114422 corpus (81069s/33353h RM) 01/16/05 #alone SARE_HTML_MANY_BR05 2051s/43h of 66351 corpus (40971s/25380h RM) 08/21/04 #counts SARE_HTML_MANY_BR05 0s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05 #max SARE_HTML_MANY_BR05 755s/2h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04 #counts SARE_HTML_MANY_BR05 0s/0h of 26326 corpus (22886s/3440h MY) 02/15/05 ######## ###################### ################################################## # Javascript and object tests ######## ###################### ################################################## rawbody SARE_HTML_JVS_POPUP /