X-Git-Url: https://git.donarmstrong.com/?p=spamassassin_config.git;a=blobdiff_plain;f=common%2Furl_spam;h=3e59d57d50c10d2e48c893edf70fb211c42067a0;hp=e938258e731d8ce74131b5379bf845f58ad488d2;hb=54e11f99b62979da9964192cf57425e2c6984c54;hpb=8a22a55bc937824a7d826d15d1f284a9c7e11175

diff --git a/common/url_spam b/common/url_spam
index e938258..3e59d57 100644
--- a/common/url_spam
+++ b/common/url_spam
@@ -66,9 +66,10 @@ describe CANDYHOS	spams from korea, hosts in japan
 score CANDYHOS		5
 
 # blarson 2005-12-08
+# don 2007-11-21 -- combine other rule; increment score
 body GEOCITIES		/http\:\/\/.*geocities/i
 describe GEOCITIES	geocities url
-score GEOCITIES		1.6
+score GEOCITIES		2.5
 
 # blarson 2005-12-24
 body EMPTYURL		/\bhttp:\/\/(?:www\.)?$/i
@@ -116,7 +117,7 @@ describe BESTLOANS	Best loans url
 score BESTLOANS		2
 
 # blarson 2007-07-22 2007-09-12
-body PENPRO		/\@(?:penmailpro|OnsetIng|openprotection|NearOut|SuperOnset|medicalgloveonline|YourOnset|GreatGloveCell|thegloveworks|asiafriendworld)\.info\b/i
+body PENPRO		/\@(?:penmailpro|OnsetIng|openprotection|NearOut|SuperOnset|medicalgloveonline|YourOnset|GreatGloveCell|thegloveworks|asiafriendworld|NaturalImprove|charmshine|healthinsweb)\.info\b/i
 describe PENPRO		penmailpro spam
 score PENPRO		3.5
 
@@ -156,28 +157,10 @@ describe SPAMARREST	forwards thier spam problem
 score SPAMARREST	4
 
 # blarson 2007-09-14
-body FROMAD		/\bhttp\:\/\/(?:budhipps|fromad|conavel|cliensy|comnoe)\.com\b/i
+body FROMAD		/\bhttp\:\/\/(?:budhipps|fromad|conavel|cliensy|comnoe|mybudshop)\.com\b/i
 describe FROMAD		more penis spam
 score FROMAD		4
 
-# blarson 2007-09-14
-uridnsbl URIBL_CNKR	cn-kr.blackholes.us.	A
-body	URIBL_CNKR	eval:check_uridnsbl('URIBL_CNKR')
-describe URIBL_CNKR	china or korea hosted web site
-tflags	URIBL_CNKR	net
-score URIBL_CNKR	2.5
-
-# blarson 2007-09-14
-uridnsbl_skip_domain	debian.org debian.net
-
-# blarson 2007-09-14
-uridnsbl        URIBL_SBL       sbl.spamhaus.org.       A
-body            URIBL_SBL       eval:check_uridnsbl('URIBL_SBL')
-describe        URIBL_SBL       Contains an URL listed in the SBL blocklist
-tflags          URIBL_SBL       net
-#reuse          URIBL_SBL
-score		URIBL_SBL	3.5
-
 # blarson 2007-09-17
 body MYCHEAP		/\b(?:my)?cheap(?:xp|adobe)?(?:oem|soft)+(?:now|ware)?(?:(?:4|for)?less)?\d*\s*\.\s*com\b/i
 describe MYCHEAP	software spam
@@ -235,7 +218,7 @@ score PLATSOFT		4
 # blarson 2007-10-22
 body BLOGSPOT		/\bblogspot\.com\b/i
 describe BLOGSPOT	spammers are hosting on blogspot
-score BLOGSPOT		2
+score BLOGSPOT		3
 
 # blarson 2007-10-25
 body PILLUS		/PILL-US\.COM\b/i
@@ -252,10 +235,6 @@ body MASZON		/mc?a(szon|yvidol|ttk)\.(com|org|net)/i
 describe MASZON		pron spam
 score MASZON		4
 
-# blarson 2007-10-26
-full GEOCITIES		/\bhttp\:\/\/geocities\.com\b/i
-describe GEOCITIES	http://geocities.com/
-score GEOCITIES		1
 
 # blarson 2007-10-27
 body GMAIL		/\@gmail\.com\b/i
@@ -283,7 +262,7 @@ describe HANOIFASH	WWW.HANOI-FASHION.COM
 score HANOIFASH		4
 
 # blarson 2007-11-06
-body ONLINEMED		/\b(?:onlinemedicalkey|pharm\w*|webvinz|wendebay|webdcd|vowelstep|wclth|duringgear|broadbasic|instantsuffix)\s*\.\s*com\b/i
+body ONLINEMED		/\b(?:onlinemedicalkey|pharm\w*|webvinz|wendebay|webdcd|vowelstep|wclth|duringgear|broadbasic|instantsuffix|magnetdouble|drugsdirecteat)\s*\.\s*com\b/i
 describe ONLINEMED	onlinemedicalkey.com
 score ONLINEMED		4
 
@@ -295,4 +274,242 @@ score GETUP		4
 # blarson (pusling's idea) 2007-11-16
 body SPACECOM		/^[\w\d]+\s\.\scom\b/
 describe SPACECOM	whatever . com
-score SPACECOM		2
+score SPACECOM		3
+
+# don -- flowgoaway.com doesn't appear to be a working RBL anymore (if it ever was?)
+# blarson 2007-11-20
+# uridnsbl URIBL_FLO	flowgoaway.com.	A
+# body	URIBL_FLO	eval:check_uridnsbl('URIBL_FLO')
+# describe URIBL_FLO	web site in flowgoaway.com
+# tflags	URIBL_FLO	net
+# score URIBL_FLO		1
+
+# blarson 2007-11-20
+body SOFTROU		/\bwww\.softrou\.com\b/i
+describe SOFTROU	www.softrou.com
+score SOFTROU		3
+
+# blarson 2007-11-20
+body GOOGLEPAGES	/\bgooglepages\.com\b/i
+describe GOOGLEPAGES	spammers use googlepages
+score GOOGLEPAGES	2
+
+# blarson 2007-12-07
+body SOFTBESTGRAND	/\bsoft(?:bestgrand|wareonlinemuch)\.com\b/
+describe SOFTBESTGRAND	softbestgrand.com
+score SOFTBESTGRAND	4
+
+# blarson 2007-12-10
+body PCSOFTCHEAP	/\b(?:pcsoftcheap|cheapezsoft|cheapsoftxp|adobe4cheap|phonowa|saleonsoftware|bestdealoem|realcheapsoft|krasniyles|cheapxp4pc|supercheapoem|lowpriceoem|realcheapoem|cheapadobedeal|softwarefoundation|2008oem|xpxmas|cheap2008soft|snowysoftware|2008adobe|adobe2008|cheapgetsoftone|x(?:higher|main|prime)(?:soft|software|easy)|softonlinepc|andsoftware|softonlinedownload|kunchakoem|erhere\w|kiroemch|phonowd|cheap(?:soft|oem|software)here|softwarenowprox|xprosoftonlinedl|siniyglaz|popandosoem|xsoftprodepot|triudava|krasniynos|fastsoftnow|cheapeasy(soft|oem|software)|ezadobenow|softnowpromohere|primenetsofthe|nowinstantsoftieq|isktesoft|best(?:oem|soft|software)2008|new2008(?:soft|oem|software)|fastez(?:soft|oem|software)|ezfast(?:oem|soft|software)|2008(?:micro)?softdeals|oemfactorysale|nbuysoft|softnuhere|softsale2008|softwintersale|blatnoyoem|svedsoft|gsxoempromo|getmicrosoftfast|adobeoemsale|xp4(?:cheap|less)|xpoemnow|buycheapxp|alloem4less|lun(?:soft|oem|software)|(?:new|fast)xp(?:soft|oem|software)|frukanoka|softcheap(?:n[eo]w|xp)|adobe(?:web|blog|new)(?:soft|spot|deal))\s?\.\s?(?:com|net)\b/
+describe PCSOFTCHEAP	pcsoftcheap. com
+score PCSOFTCHEAP	4
+
+# blarson 2007-12-11
+body GOLDGAME		/\b(?:gamblingplacegold|goldgamesite|topgamingsite|richbestgaming|luxgoldgaming)\.(?:net|com)\b/
+describe GOLDGAME	gambling sites
+score GOLDGAME		4
+
+# blarson 2007-12-14
+body ENLARGETW		/\b(?:enlarge|0rz)\.tw\b/
+describe ENLARGETW	enlarge.tw
+score ENLARGETW		4
+
+# blarson 2007-12-15
+body POSTTHROUGH	/\b(?:postthrough|speedgrand|certaincoast)\.com\b/
+describe POSTTHROUGH	postthrough.com
+score POSTTHROUGH	4
+
+# blarson 2007-12-25
+body UHAVE		/\b(?:uhavepost|happy(?:santa)?|newyear|familypost|fresh|post)cards?-?(?:2008)?\.com\b/
+describe UHAVE		uhavepostcard.com
+score UHAVE		4
+
+# blarson 2007-12-26
+body RUSSWIFE		/\b(?:your|best|new|the|my)(?:russ[il]an?|address|russ)(?:wife|bride)\.info\b/
+describe RUSSWIFE	yourrussianwife.info
+score RUSSWIFE		4
+
+# blarson 2007-12-31
+body HAPPY2008		/\b(?:happy2008toyou|hellosanta2008|hohoho2008|santawishes2008)\.com\b/
+describe HAPPY2008	happy2008toyou.com
+score HAPPY2008		4
+
+# blarson 2008-01-02
+body BONGHIT		/\b(?:beaverbonghits|dobongworld)\.com\b/
+describe BONGHIT	beaverbonghits.com
+score BONGHIT		4
+
+# blarson 2008-01-02
+body GOOGLESEARCH	/\bgoo+gle\.(com|\w\w|com?\.\w\w)\/+(?:search|pagead)/i
+describe GOOGLESEARCH	google search URL
+score GOOGLESEARCH	2
+
+# blarson 2008-01-02
+body SIGAS		/\b(?:Sigashash|Reelhotsi|Erisgoonti|Erisgoners|Freesignsies|Rielhotties|Foredroons|Feeshoons|Erisgant|hapburge|wuimooed|jiuezdoo|goingoinghom|buloies|Poeshages|Rueshabesoo|clitoriseries|clitorina|glueplot|crumbtost|ideaputs)(?:\.|\=2E)com\b/
+describe SIGAS		www.Sigashash.com
+score SIGAS		4
+
+# blarson 2008-01-05
+body RUSSIABRIDE	/\bruss[il]an?(bride|wife)(?:home|live|blog|)\.info\b/
+describe RUSSIABRIDE	russiabridehome.info
+score RUSSIABRIDE	4
+
+# blarson 2008-01-14
+body REDMEHS		/\bwww\.(?:redmehs|feltas|barataslo|quasibot|tageshes|flessimo|spendhope|instrumentstart)\b/
+describe REDMEHS	www.redmehs
+score REDMEHS		4
+
+# blarson 2008-01-15
+body MYURL		/\bmyurl\.com\.tw\b/i
+describe MYURL		myurl.com.tw
+score MYURL		3
+
+# blarson 2008-01-28
+body W0MEN		/w0men\.info\b/i
+describe W0MEN		hotw0men.info ukrw0men.info
+score W0MEN		3
+
+# blarson 2008-01-29
+body ACEMST		/\bacemst\.com\b/
+describe ACEMST		acemst.com
+score ACEMST		3
+
+# blarson 2008-02-01
+body GALSINFO		/\b(?:foreigngals|californiaimprove)\.info\b/i
+describe GALSINFO	foreigngals.info
+score GALSINFO		3
+
+# blarson 2008-02-06
+body RIDGEST		/\bridgest\.com\b/
+describe RIDGEST	ridgest.com
+score RIDGEST		4
+
+# blarson 2008-02-16
+body SOFTROI		/\bsoft(?:roi|ove)\.com\b/
+describe SOFTROI	softroi.com
+score SOFTROI		4
+
+# don 2008-02-23
+body FILEZONE		/(file-zone.co.uk|File-Zone)/
+describe FILEZONE	File-Zone
+score FILEZONE		2
+
+# blarson 2008-02-28
+body X2J1F		/\b2j1f\.com\b/i
+descrIbe X2J1F		2j1f.com
+score X2J1F		4
+
+# blarson 2008-02-28
+body ILVE		/\bilveant\.net\b/i
+describe ILVE		www.ilveant.net
+score ILVE		4
+
+# don 2008-03-04
+body  VIDEOFILBMS	/www\.videofilbms\.cn/i
+describe VIDEOFILBMS	video filbms url
+score	 VIDEOFILBMS	4
+
+# blarson 2008-03-05
+body ABESOFT		/\bca.abesoft\.com\b/i
+describe ABESOFT	www.cazabesoft.com etc.
+score ABESOFT		4
+
+# blarson 2008-03-06
+body STARLEYT		/\bstarleyt\.com\b/i
+describe STARLEYT	starleyt.com
+score STARLEYT		4
+
+# blarson 2008-03-07
+body URLOEM		/\bhttp\:\/\/\{/
+describe URLOEM		http://{urloem2}
+score URLOEM		3
+
+# blarson 2008-03-12
+body WILDERGO		/\b(?:WilderGoLovan|golovable|BestGolova|SuperGolovaWorld)\.com\b/i
+describe WILDERGO	WilderGoLovan.com
+score WILDERGO		4
+
+# don 2008-03-17
+body PROGOLD		/\bprogold-inc\.com\b/i
+describe PROGOLD	progold-inc.com
+score PROGOLD		4
+
+# blarson 2008-03-18
+body KMINU		/\b(?:kminutte|rubstream)\.com\b/i
+describe KMINU		kminutte.com
+score KMINU		4
+
+# don 2008-03-19
+body SCIJOURNALS	/\bsciencejournals\.info\b/i
+describe SCIJOURNALS	scientific journals
+score SCIJOURNALS	4
+
+# blarson 2008-03-19
+body JANEHOT		/\bjane\d[\w\d]*\@hotmail\.com\s*$/
+describe JANEHOT	jane*@hotmail.com
+score JANEHOT		3
+
+# blarson 2008-03-20
+rawbody BIFUTRA		/\b(?:bifutra|veriapoli|xenifeao|toporaig|jieros|bifreca|werikine|incroomise|genbullenst|writeprovide)(?:\.|\=2E)com\b/
+describe BIFUTRA	spammer web sites
+score BIFUTRA		4
+
+# don 2008-04-02
+body LONGLINEURL	/^.{55,}\S\shttp:\/\/www\.\w+\.(?:com|net|org)\/\s*$/
+describe LONGLINEURL	long line ending in a simple url
+score LONGLINEURL	2
+
+# don 2008-04-07
+uri MYTHANKYOUURI	/www\.mythankyou\.com/i
+describe MYTHANKYOUURI	www.mythankyou.com
+score MYTHANKYOUURI	5
+
+# blarson 2008-04-09
+uri SAMEAS		/\bsupersameas\.com\b/
+describe SAMEAS		supersameas.com
+score SAMEAS		3
+
+# blarson 2008-04-12
+body URIEXE		/\bhttp:\S*\.exe\b/
+describe URIEXE		.exe url
+score URIEXE		3
+
+# blarson 2008-04-24
+uri SANSATION		/\b(?:sansationel|garmenys|iconaliste)\.com\b/i
+describe SANSATION	sansationel.com
+score SANSATION		4
+
+# blarson 2008-05-04
+body EQMEDS		/\beqmeds\b/i
+describe EQMEDS		eqmeds
+score EQMEDS		4
+
+# blarson 2008-05-06
+uri MYLIVE			/\bmylivegi\b/i
+describe MYLIVE		mylivegirlx.com
+score MYLIVE		4
+
+# don 2008-05-26
+body BROKENURL		/^\s*www((\s+\.\s*)|(\s*\.\+))\S+((\s+\.\s*)|(\s*\.\+))(com|net|org)\s*$/
+describe BROKENURL	Broken url displayed
+score BROKENURL		4
+
+# don 2008-06-13
+body STUPIDURL         /\w+\[\w+\](?:com|net|org)/
+describe STUPIDURL     No one will guess that fooo[DOT]com is an URL!
+score STUPIDURL	       2.5
+
+# blarson 2008-06-16
+body SUGARCOM		/\b(?:indicatesugar|industryexpect|eset)\.com\b/
+describe SUGARCOM	indicatesugar.com
+score SUGARCOM		4
+
+# blarson 2008-07-22
+body VIEWMOVIE		/\b(?:viewmovie|stream|watchit|topnews|hotnews|fresh|checkit|default)\.html\b/
+describe VIEWMOVIE	tabiloid style spam
+score VIEWMOVIE		3
+
+# blarson 2008-07-22
+uri OPERAMAIL		/\bwww\.opera\.com\/mail\//
+describe OPERAMAIL	opera.com mail
+score OPERAMAIL		1