+# -*- mode: spamassassin -*-
# joy, 2003-06-29
body ORIENTSKY /orient-sky\.com/
describe ORIENTSKY Japanese spam
# blarson 2005-12-08
# don 2007-11-21 -- combine other rule; increment score
-body GEOCITIES /http\:\/\/.*geocities/i
-describe GEOCITIES geocities url
-score GEOCITIES 2.5
+# don 2009-02-17 -- increase score even more; ditch http
+uri GEOCITIES /geocities/i
+describe GEOCITIES geocities uri
+score GEOCITIES 3
# blarson 2005-12-24
body EMPTYURL /\bhttp:\/\/(?:www\.)?$/i
score BESTLOANS 2
# blarson 2007-07-22 2007-09-12
-body PENPRO /\@(?:penmailpro|OnsetIng|openprotection|NearOut|SuperOnset|medicalgloveonline|YourOnset|GreatGloveCell|thegloveworks|asiafriendworld|NaturalImprove|charmshine)\.info\b/i
+body PENPRO /\@(?:penmailpro|OnsetIng|openprotection|NearOut|SuperOnset|medicalgloveonline|YourOnset|GreatGloveCell|thegloveworks|asiafriendworld|NaturalImprove|charmshine|healthinsweb)\.info\b/i
describe PENPRO penmailpro spam
score PENPRO 3.5
score SPAMARREST 4
# blarson 2007-09-14
-body FROMAD /\bhttp\:\/\/(?:budhipps|fromad|conavel|cliensy|comnoe)\.com\b/i
+body FROMAD /\bhttp\:\/\/(?:budhipps|fromad|conavel|cliensy|comnoe|mybudshop)\.com\b/i
describe FROMAD more penis spam
score FROMAD 4
-# blarson 2007-09-14
-uridnsbl URIBL_CNKR cn-kr.blackholes.us. A
-body URIBL_CNKR eval:check_uridnsbl('URIBL_CNKR')
-describe URIBL_CNKR china or korea hosted web site
-tflags URIBL_CNKR net
-score URIBL_CNKR 2.5
-
-# blarson 2007-09-14
-uridnsbl_skip_domain debian.org debian.net yahoo.com google.com
-
-# blarson 2007-09-14
-uridnsbl URIBL_SBL sbl.spamhaus.org. A
-body URIBL_SBL eval:check_uridnsbl('URIBL_SBL')
-describe URIBL_SBL Contains an URL listed in the SBL blocklist
-tflags URIBL_SBL net
-#reuse URIBL_SBL
-score URIBL_SBL 3.5
-
# blarson 2007-09-17
body MYCHEAP /\b(?:my)?cheap(?:xp|adobe)?(?:oem|soft)+(?:now|ware)?(?:(?:4|for)?less)?\d*\s*\.\s*com\b/i
describe MYCHEAP software spam
# blarson 2007-10-22
body BLOGSPOT /\bblogspot\.com\b/i
describe BLOGSPOT spammers are hosting on blogspot
-score BLOGSPOT 2
+score BLOGSPOT 3
# blarson 2007-10-25
body PILLUS /PILL-US\.COM\b/i
score SOFTBESTGRAND 4
# blarson 2007-12-10
-body PCSOFTCHEAP /\b(?:pcsoftcheap|cheapezsoft|cheapsoftxp|adobe4cheap|phonowa|saleonsoftware|bestdealoem|realcheapsoft|krasniyles|cheapxp4pc|supercheapoem|lowpriceoem|realcheapoem|cheapadobedeal|softwarefoundation|2008oem|xpxmas|cheap2008soft|snowysoftware|2008adobe|adobe2008|cheapgetsoftone|x(?:higher|main|prime)(?:soft|software|easy)|softonlinepc|andsoftware|softonlinedownload|kunchakoem|erhere\w|kiroemch|phonowd|cheap(?:soft|oem|software)here|softwarenowprox|xprosoftonlinedl|siniyglaz|popandosoem|xsoftprodepot|triudava|krasniynos|fastsoftnow|cheapeasy(soft|oem|software)|ezadobenow)\s?\.\s?(?:com|net)\b/
+body PCSOFTCHEAP /\b(?:pcsoftcheap|cheapezsoft|cheapsoftxp|adobe4cheap|phonowa|saleonsoftware|bestdealoem|realcheapsoft|krasniyles|cheapxp4pc|supercheapoem|lowpriceoem|realcheapoem|cheapadobedeal|softwarefoundation|2008oem|xpxmas|cheap2008soft|snowysoftware|2008adobe|adobe2008|cheapgetsoftone|x(?:higher|main|prime)(?:soft|software|easy)|softonlinepc|andsoftware|softonlinedownload|kunchakoem|erhere\w|kiroemch|phonowd|cheap(?:soft|oem|software)here|softwarenowprox|xprosoftonlinedl|siniyglaz|popandosoem|xsoftprodepot|triudava|krasniynos|fastsoftnow|cheapeasy(soft|oem|software)|ezadobenow|softnowpromohere|primenetsofthe|nowinstantsoftieq|isktesoft|best(?:oem|soft|software)2008|new2008(?:soft|oem|software)|fastez(?:soft|oem|software)|ezfast(?:oem|soft|software)|2008(?:micro)?softdeals|oemfactorysale|nbuysoft|softnuhere|softsale2008|softwintersale|blatnoyoem|svedsoft|gsxoempromo|getmicrosoftfast|adobeoemsale|xp4(?:cheap|less)|xpoemnow|buycheapxp|alloem4less|lun(?:soft|oem|software)|(?:new|fast)xp(?:soft|oem|software)|frukanoka|softcheap(?:n[eo]w|xp)|adobe(?:web|blog|new)(?:soft|spot|deal))\s?\.\s?(?:com|net)\b/
describe PCSOFTCHEAP pcsoftcheap. com
score PCSOFTCHEAP 4
score UHAVE 4
# blarson 2007-12-26
-body RUSSWIFE /\b(?:your|best|new|the)(?:russian?|address)(?:wife|bride)\.info\b/
+body RUSSWIFE /\b(?:your|best|new|the|my)(?:russ[il]an?|address|russ)(?:wife|bride)\.info\b/
describe RUSSWIFE yourrussianwife.info
score RUSSWIFE 4
score BONGHIT 4
# blarson 2008-01-02
-body GOOGLESEARCH /\bgoo+gle\.(com|\w\w|com?\.\w\w)\/+search/i
+body GOOGLESEARCH /\bgoo+gle\.(com|\w\w|com?\.\w\w)\/+(?:search|pagead)/i
describe GOOGLESEARCH google search URL
score GOOGLESEARCH 2
# blarson 2008-01-02
-body SIGAS /\b(?:Sigashash|Reelhotsi|Erisgoonti|Erisgoners|Freesignsies|Rielhotties|Foredroons|Feeshoons|Erisgant|hapburge|wuimooed|jiuezdoo|goingoinghom|buloies|Poeshages|Rueshabesoo|clitoriseries|clitorina)(?:\.|\=2E)com\b/
+body SIGAS /\b(?:Sigashash|Reelhotsi|Erisgoonti|Erisgoners|Freesignsies|Rielhotties|Foredroons|Feeshoons|Erisgant|hapburge|wuimooed|jiuezdoo|goingoinghom|buloies|Poeshages|Rueshabesoo|clitoriseries|clitorina|glueplot|crumbtost|ideaputs)(?:\.|\=2E)com\b/
describe SIGAS www.Sigashash.com
score SIGAS 4
# blarson 2008-01-05
-body RUSSIABRIDE /\brussian?(bride|wife)(?:home|live|blog)\.info\b/
+body RUSSIABRIDE /\bruss[il]an?(bride|wife)(?:home|live|blog|)\.info\b/
describe RUSSIABRIDE russiabridehome.info
score RUSSIABRIDE 4
# blarson 2008-01-14
-body REDMEHS /\bwww\.redmehs\b/
+body REDMEHS /\bwww\.(?:redmehs|feltas|barataslo|quasibot|tageshes|flessimo|spendhope|instrumentstart)\b/
describe REDMEHS www.redmehs
score REDMEHS 4
body MYURL /\bmyurl\.com\.tw\b/i
describe MYURL myurl.com.tw
score MYURL 3
+
+# blarson 2008-01-28
+body W0MEN /w0men\.info\b/i
+describe W0MEN hotw0men.info ukrw0men.info
+score W0MEN 3
+
+# blarson 2008-01-29
+body ACEMST /\bacemst\.com\b/
+describe ACEMST acemst.com
+score ACEMST 3
+
+# blarson 2008-02-01
+body GALSINFO /\b(?:foreigngals|californiaimprove)\.info\b/i
+describe GALSINFO foreigngals.info
+score GALSINFO 3
+
+# blarson 2008-02-06
+body RIDGEST /\bridgest\.com\b/
+describe RIDGEST ridgest.com
+score RIDGEST 4
+
+# blarson 2008-02-16
+body SOFTROI /\bsoft(?:roi|ove)\.com\b/
+describe SOFTROI softroi.com
+score SOFTROI 4
+
+# don 2008-02-23
+body FILEZONE /(file-zone.co.uk|File-Zone)/
+describe FILEZONE File-Zone
+score FILEZONE 2
+
+# blarson 2008-02-28
+body X2J1F /\b2j1f\.com\b/i
+descrIbe X2J1F 2j1f.com
+score X2J1F 4
+
+# blarson 2008-02-28
+body ILVE /\bilveant\.net\b/i
+describe ILVE www.ilveant.net
+score ILVE 4
+
+# don 2008-03-04
+body VIDEOFILBMS /www\.videofilbms\.cn/i
+describe VIDEOFILBMS video filbms url
+score VIDEOFILBMS 4
+
+# blarson 2008-03-05
+body ABESOFT /\bca.abesoft\.com\b/i
+describe ABESOFT www.cazabesoft.com etc.
+score ABESOFT 4
+
+# blarson 2008-03-06
+body STARLEYT /\bstarleyt\.com\b/i
+describe STARLEYT starleyt.com
+score STARLEYT 4
+
+# blarson 2008-03-07
+body URLOEM /\bhttp\:\/\/\{/
+describe URLOEM http://{urloem2}
+score URLOEM 3
+
+# blarson 2008-03-12
+body WILDERGO /\b(?:WilderGoLovan|golovable|BestGolova|SuperGolovaWorld)\.com\b/i
+describe WILDERGO WilderGoLovan.com
+score WILDERGO 4
+
+# don 2008-03-17
+body PROGOLD /\bprogold-inc\.com\b/i
+describe PROGOLD progold-inc.com
+score PROGOLD 4
+
+# blarson 2008-03-18
+body KMINU /\b(?:kminutte|rubstream)\.com\b/i
+describe KMINU kminutte.com
+score KMINU 4
+
+# don 2008-03-19
+body SCIJOURNALS /\bsciencejournals\.info\b/i
+describe SCIJOURNALS scientific journals
+score SCIJOURNALS 4
+
+# blarson 2008-03-19
+body JANEHOT /\bjane\d[\w\d]*\@hotmail\.com\s*$/
+describe JANEHOT jane*@hotmail.com
+score JANEHOT 3
+
+# blarson 2008-03-20
+rawbody BIFUTRA /\b(?:bifutra|veriapoli|xenifeao|toporaig|jieros|bifreca|werikine|incroomise|genbullenst|writeprovide)(?:\.|\=2E)com\b/
+describe BIFUTRA spammer web sites
+score BIFUTRA 4
+
+# don 2008-04-02
+body LONGLINEURL /^.{55,}\S\shttp:\/\/www\.\w+\.(?:com|net|org)\/\s*$/
+describe LONGLINEURL long line ending in a simple url
+score LONGLINEURL 2
+
+# don 2008-04-07
+uri MYTHANKYOUURI /www\.mythankyou\.com/i
+describe MYTHANKYOUURI www.mythankyou.com
+score MYTHANKYOUURI 5
+
+# blarson 2008-04-09
+uri SAMEAS /\bsupersameas\.com\b/
+describe SAMEAS supersameas.com
+score SAMEAS 3
+
+# blarson 2008-04-12
+body URIEXE /\bhttp:\S*\.exe\b/
+describe URIEXE .exe url
+score URIEXE 3
+
+# blarson 2008-04-24
+uri SANSATION /\b(?:sansationel|garmenys|iconaliste)\.com\b/i
+describe SANSATION sansationel.com
+score SANSATION 4
+
+# blarson 2008-05-04
+body EQMEDS /\beqmeds\b/i
+describe EQMEDS eqmeds
+score EQMEDS 4
+
+# blarson 2008-05-06
+uri MYLIVE /\bmylivegi\b/i
+describe MYLIVE mylivegirlx.com
+score MYLIVE 4
+
+# don 2008-05-26
+body BROKENURL /^\s*www((\s+\.\s*)|(\s*\.\+))\S+((\s+\.\s*)|(\s*\.\+))(com|net|org)\s*$/
+describe BROKENURL Broken url displayed
+score BROKENURL 4
+
+# don 2008-06-13
+body STUPIDURL /\w+\[\w+\](?:com|net|org)/
+describe STUPIDURL No one will guess that fooo[DOT]com is an URL!
+score STUPIDURL 2.5
+
+# blarson 2008-06-16
+body SUGARCOM /\b(?:indicatesugar|industryexpect|eset)\.com\b/
+describe SUGARCOM indicatesugar.com
+score SUGARCOM 4
+
+# blarson 2008-07-22
+body VIEWMOVIE /\/(?:(?:viewmovie|stream|watchit|topnews|hotnews|fresh|checkit|default|gowatch|showvideo|livestreaming|top|whatsup|tophot|lol|first|index1|1)\.html\b|(?:video|news2\/)\s*$)/
+describe VIEWMOVIE tabiloid style spam
+score VIEWMOVIE 3
+
+# blarson 2008-07-22
+uri OPERAMAIL /\bwww\.opera\.com\/mail\//
+describe OPERAMAIL opera.com mail
+score OPERAMAIL 1
+
+# blarson 2008-08-09
+body NOSITE /http:\/\/\//
+describe NOSITE http URL with no site
+score NOSITE 2
+
+# don 2008-09-04
+uri TIECORRECT /tiecorrect\.com/
+describe TIECORRECT Contains a tiecorrect.com uri
+score TIECORRECT 4
+
+# don 2009-02-04
+body FOURMINUTI /4minuti/
+describe FOURMINUTI Spam from 4 minuti
+score FOURMINUTI 3
+
+# don 2009-02-09
+uri CREDITREPORTURI /creditreport/
+describe CREDITREPORTURI Credit report in the url isn't good
+score CREDITREPORTURI 2
+
+uri YAARIURI /yaari.com/i
+describe YAARIURI Contains a yaari.com uri
+score YAARIURI 3
+
+uri DEBRICOLAJE /debricolaje/i
+describe DEBRICOLAJE Contains a debricolaje url
+score DEBRICOLAJE 6
\ No newline at end of file
projects / spamassassin_config.git / blobdiff