X-Git-Url: https://git.donarmstrong.com/?p=spamassassin_config.git;a=blobdiff_plain;f=common%2Fphrase_spam;h=f9349e8cd741554e325f2d26cbf5e7a0686678b8;hp=bb7d71ecd715bd5c11e5a5e22266658743ec82c2;hb=HEAD;hpb=d6e9cadda6ebc0595e16f8691ecebf12fc825d0f diff --git a/common/phrase_spam b/common/phrase_spam index bb7d71e..f9349e8 100644 --- a/common/phrase_spam +++ b/common/phrase_spam @@ -90,6 +90,14 @@ header ONEWORD subject =~ /^(?:Fw:|re:)?\s*\S+\s*$/i describe ONEWORD one word subject score ONEWORD 2 +rawbody ONEWORDBODY /^\s*\S+\s*$/s +describe ONEWORDBODY One word body +score ONEWORDBODY 2 + +meta ONEWORDALL (ONEWORD && ONEWORDBODY) +describe ONEWORDALL Both subject and body contain one word +score ONEWORDALL 4 + # robot101, 2003-09-22 header CROSSWALK X-UnityUser =~ /^Crosswalk.com, Inc/ describe CROSSWALK Crosswalk bible mailing list @@ -663,7 +671,7 @@ score HOLIDAYHERE 3 # blarson 2007-11-22 header CAPINIT subject =~ /^(?:Re:)?\s*(?:(?:[A-Z][a-z-\']+|PaintBrush|Jet (?:plane|fighter)|Tennis racquet|Leather jacket|IWC|\&|Jaeger-LeCoultre)\s+)+(?:[A-Z][a-z-]+|PaintBrush|Jet (?:plane|fighter)|Tennis racquet|Leather jacket)\s*$/ describe CAPINIT Capinit Every Word -score CAPINIT 3 +score CAPINIT 0.5 # blarson 2007-11-23 body REMOVESPACE /\b(?:remove|w\/o|without|delete) spaces?\b/i @@ -847,7 +855,7 @@ score ITCSTORE 4 # blarson 2008-03-26 header GENDER subject =~ /\b(?:she|her|wom[ae]n|m[ae]n|girls?|males?|females?|herself|wife|ladies|lady|wives|(?:girl|boy)friends?)\b/i describe GENDER gender pronoun in subject -score GENDER 1 +score GENDER 0.5 # blarson 2008-03-28 body REBODY /^re\:\s/ @@ -870,12 +878,12 @@ describe SUMHERE summer is here score SUMHERE 3 # don 2008-04-24 -header INVITATIONFROM subject =~ /^\s*Invitation\s*from\s*\w+\s*$/i +header INVITATIONFROM subject =~ /^\s*(Invitation|Invitaci.n)\s*(from|curso)\s*\w+\s*$/i describe INVITATIONFROM Invitation from Spammer score INVITATIONFROM 5 -header INVITESYOU subject =~ /^[\w\s]+invites\s+you\s+to[\w\s]+$/i -describe INVITESYOU Invites me with spam +header INVITESYOU subject =~ /^[\w\s]+(invites|communicates\s+with)\s+you\s+(to|about)[\w\s]+$/i +describe INVITESYOU Invites or communicates me with spam score INVITESYOU 5 # blarson 2008-04-28 @@ -1022,3 +1030,100 @@ body WEBINAR /webinar/i describe WEBINAR Contains webinar score WEBINAR 2 + +header TRIALVERSION subject =~ /trial\s*version/i +describe TRIALVERSION Trial version in subject +score TRIALVERSION 3 + +header SHARESPAM subject =~ /shared photos with you/i +describe SHARESPAM shares photos +score SHARESPAM 3 + +header MYNAMEIS subject =~ /hello(.*)my name is/i +describe MYNAMEIS Name spam +score MYNAMEIS 2.5 + +# formorer 2012-02-28 +header VOTREANN Subject =~ /(votre|Petites) annonce/i +describe VOTREANN Votre annonce +score VOTREANN 4 + +# formorer 2010-01-23 +header LEXCHANGE subject =~ /(?:for|4)\s+L[i1]nks?\s+E?xcha?nge/i +describe LEXCHANGE ask for link exchange +score LEXCHANGE 4 + +# formorer 2013-11-08 +header IMARKETING subject =~ /integrated marketing/i +describe IMARKETING integrated marketing +score IMARKETING 4 + +header LYMBOOMATH subject =~ /Lymboo Math/i +describe LYMBOOMATH Lymboo Math spam +score LYMBOOMATH 4 + +# formorer 2014-05-26 +header JOB_DE1 subject =~ /(Freie Stellen|Stellenbeschreibungen)/ +describe JOB_DE1 german job spam +score JOB_DE1 4 + +header TODAYSHOW subject =~ /Today Show/i +describe TODAYSHOW the today show +score TODAYSHOW 4 + +header LEADS subject =~ /business leads/i +describe LEADS business leads +score LEADS 4 + +header CLIENTS subject =~ /need more clients/i +describe CLIENTS need more clients +score CLIENTS 4 + +body SEOCONS /SEO Consultant/i +score SEOCONS 3 +describe SEOCONS SEO Consultant + +body SEOISSUES /major issues with your website/i +score SEOISSUES 2.5 +describe SEOISSUES Major issues with your website + +body SEOCOM /SEO Company/i +score SEOCOM 2.5 +describe SEOCOM SEO Company + +# rince 2017-03-30 +header USERSLIST_HEADER1 Subject =~ /\bUsers\bList/i +describe USERSLIST_HEADER1 Check wether Subject contains 'Users List' +rawbody USERSLIST_BODY1 /\
\

\If you don=E2=80=99t want/ +describe USERSLIST_BODY2 second potential Spam reconnaissance: style of HTML +rawbody USERSLIST_BODY3 /A Quick Follow up to you that if you are interested in/i +describe USERSLIST_BODY3 third potential Spam reconnaissance: text phrases +rawbody USERSLIST_BODY4 /we also have other technology users like: aws, tripod seat, Jira,/i +describe USERSLIST_BODY4 fourth potential Spam reconnaissance: text phrases +rawbody USERSLIST_BODY5 /Please let me know your thoughts (so that I can send you cost of the list.|we will provide you the more information)/i +describe USERSLIST_BODY5 fifth potential Spam reconnaissance: text phrases +meta META_USERSLIST (( USERSLIST_HEADER1 + USERSLIST_BODY1 + USERSLIST_BODY2 ) || ( USERSLIST_HEADER1 + USERSLIST_BODY3 + USERSLIST_BODY4 ) || ( USERSLIST_HEADER1 + USERSLIST_BODY5 ) > 1 ) +describe META_USERSLIST Question for a Users List +score META_USERSLIST 0.5 + +# rince 2017-04-11 +header OWNERSLIST_HEADER1 Subject =~ /\bOwners\bList/i +describe OWNERSLIST_HEADER1 Check wether Subject contains 'Owners List' +rawbody OWNERSLIST_BODY1 /The list of contacts are \*opt\-in verified\*/ +describe OWNERSLIST_BODY1 First potential Spam reconnaissance: verified opt-in lists +meta META_OWNERSLIST ( (OWNERSLIST_HEADER1 + OWNERSLIST_BODY1 ) >1 ) +describe META_OWNERSLIST Questions for an Owners List +score META_OWNERSLIST 0.5 + +# rince 2017-04-14 +header PRATT subject =~ /Pratt Is Now Earth Works Jacksonville/i +score PRATT 4 +describe PRATT Pratt spam + +# rince 2017-04-15 +header PRATTFROM From =~ /Pratt Brothers/ +describe PRATTFROM Pratt Brothers Spam +score PRATTFROM 1 +