From be8e4c5a2228eb63b624be1f40c2f9a017456769 Mon Sep 17 00:00:00 2001 From: Don Armstrong Date: Thu, 22 Nov 2007 04:20:02 +0000 Subject: [PATCH 01/16] * Use trap - ERR instead of trap ERR git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@109 0b7a5b0c-1f2c-0410-bd74-c376f8064c91 --- update_spamassassin | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/update_spamassassin b/update_spamassassin index 2610c9e..7ffe440 100755 --- a/update_spamassassin +++ b/update_spamassassin @@ -81,7 +81,7 @@ if ! spamassassin -p $TMPDIR/spamassassin_config/$USERCONF --lint > $TMPDIR/sa_l fi; mv "$SACONFIG" "$BAKDIR/spamassassin_config_r$ORIGREV" mv "$TMPDIR/spamassassin_config" "$SACONFIG" -trap ERR +trap - ERR remove_pidfile rm -rf "$TMPDIR" -- 2.39.2 From 1d2e21926a683f56e5d58b4f588baf00386e61fc Mon Sep 17 00:00:00 2001 From: Martin Zobel-Helas Date: Sat, 24 Nov 2007 10:16:08 +0000 Subject: [PATCH 02/16] list specific: Subscriber Changes for all lists git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@116 0b7a5b0c-1f2c-0410-bd74-c376f8064c91 --- lists/user_prefs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lists/user_prefs b/lists/user_prefs index 2329180..5ae0640 100644 --- a/lists/user_prefs +++ b/lists/user_prefs @@ -128,3 +128,6 @@ meta DEVELITP (__DEVELITP1 && __DEVELITP2) describe MENTORSRFS This mail might be an ITP on d-devel score MENTORSRFS -0.3 +header SUBCHANGES subject =~ /Daily un\/subscription report/i +describe SUBCHANGES Subscriber Changes for all lists sent to listmasters +score SUBCHANGES -10 -- 2.39.2 From d40810c06420de91b7ba45fc2c9fc4ddb3b5f980 Mon Sep 17 00:00:00 2001 From: Martin Schulze Date: Sat, 24 Nov 2007 11:47:46 +0000 Subject: [PATCH 03/16] Moved listserver to liszt git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@117 0b7a5b0c-1f2c-0410-bd74-c376f8064c91 --- update_spamassassin | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/update_spamassassin b/update_spamassassin index 7ffe440..b897699 100755 --- a/update_spamassassin +++ b/update_spamassassin @@ -12,7 +12,7 @@ TMPDIR=$(mktemp -d); if [ "$HOSTNAME" == "rietz" ]; then BASEDIR="/org/bugs.debian.org" USERCONF="bugs/user_prefs"; -elif [ "$HOSTNAME" == "murphy" ]; then +elif [ "$HOSTNAME" == "liszt" ]; then BASEDIR="/var/list/.etc"; USERCONF="lists/user_prefs"; else -- 2.39.2 From 0766b5f57e272e7dc85d6c93c86266087b46bb2e Mon Sep 17 00:00:00 2001 From: Martin Schulze Date: Sat, 24 Nov 2007 11:48:43 +0000 Subject: [PATCH 04/16] Moved listserver to liszt git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@118 0b7a5b0c-1f2c-0410-bd74-c376f8064c91 --- update_spamassassin | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/update_spamassassin b/update_spamassassin index b897699..b564136 100755 --- a/update_spamassassin +++ b/update_spamassassin @@ -87,7 +87,7 @@ rm -rf "$TMPDIR" if [ "$HOSTNAME" == "rietz" ]; then touch /home/debbugs/.spamassassin/user_prefs -elif [ "$HOSTNAME" == "murphy" ]; then +elif [ "$HOSTNAME" == "liszt" ]; then # do nothing true; else -- 2.39.2 From 6bb9a2a665430bf7c44e23c3d91ddf37b09b072a Mon Sep 17 00:00:00 2001 From: Martin Schulze Date: Sat, 24 Nov 2007 12:03:51 +0000 Subject: [PATCH 05/16] Moved listserver to liszt git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@119 0b7a5b0c-1f2c-0410-bd74-c376f8064c91 --- common/debian_specific | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/common/debian_specific b/common/debian_specific index 5fd45cf..84fb4d7 100644 --- a/common/debian_specific +++ b/common/debian_specific @@ -19,7 +19,7 @@ describe MURPHY_DEBIAN_MESSAGE Found Debian-Header. score MURPHY_DEBIAN_MESSAGE -10 # joy, 2003-08-17 -header OUR_MTA_MSGID Message-Id =~ /\@(master|murphy|gluck)\.debian\.org/ +header OUR_MTA_MSGID Message-Id =~ /\@(master|liszt|gluck)\.debian\.org/ describe OUR_MTA_MSGID Sounds like a msgid autogenerated by our MTAs score OUR_MTA_MSGID 2 -- 2.39.2 From 61ecb532edf1e0893261a0229c33f3ec04797894 Mon Sep 17 00:00:00 2001 From: Martin Schulze Date: Sat, 24 Nov 2007 12:05:58 +0000 Subject: [PATCH 06/16] Moved listserver to liszt git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@120 0b7a5b0c-1f2c-0410-bd74-c376f8064c91 --- common/list_specific | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/common/list_specific b/common/list_specific index 9c36009..e7e84e6 100644 --- a/common/list_specific +++ b/common/list_specific @@ -3,12 +3,12 @@ # our MTAs fix up headers for a slew of spams, so mark these as suspicious # -- joy, 2003-06-28 # deactivated as this rule is also part of SA itself. -#header OUR_MTA_MSGID Message-Id =~ /\@(murphy|master|gluck)\.debian\.org/ +#header OUR_MTA_MSGID Message-Id =~ /\@(liszt|master|gluck)\.debian\.org/ #describe OUR_MTA_MSGID Sounds like a MsgId autogenerated by our MTAs #score OUR_MTA_MSGID 1 # -- joy, 2003-08-15 -header SENDER_FOR_US From =~ /\@(murphy|master|gluck|lists)\.debian\.org/ +header SENDER_FOR_US From =~ /\@(liszt|master|gluck|lists)\.debian\.org/ describe SENDER_FOR_US Sounds like a mail aimed at tricking our MTAs score SENDER_FOR_US 2 @@ -46,9 +46,9 @@ score MDOMOSUBS -2 #describe OURCRONMAILS Sounds like a legitimate cron job mail #score OURCRONMAILS -3 -header MURPHY_LOCAL_FORWARDED Resent-From =~ /murphy\.debian\.org/ -describe MURPHY_LOCAL_FORWARDED Mail has been locally forwarded. -score MURPHY_LOCAL_FORWARDED -5 +header LISZT_LOCAL_FORWARDED Resent-From =~ /liszt\.debian\.org/ +describe LISZT_LOCAL_FORWARDED Mail has been locally forwarded. +score LISZT_LOCAL_FORWARDED -5 # temp work-around for d-l-f @@ -67,7 +67,7 @@ describe MURPHY_MIGUS_REPORT Auto-generated report from migus on translations score MURPHY_MIGUS_REPORT -5 # our own whitelisting of subscribers -header LDOSUBSCRIBER X-Subscriber-murphy.debian.org =~ /./ +header LDOSUBSCRIBER X-Subscriber-lists.debian.org =~ /./ describe LDOSUBSCRIBER Sender is a lists.debian.org subscriber score LDOSUBSCRIBER -6 -- 2.39.2 From db16a12a2962f72a6cc4c7ad9e30e6f1dd122e03 Mon Sep 17 00:00:00 2001 From: Don Armstrong Date: Sat, 1 Dec 2007 09:47:09 +0000 Subject: [PATCH 07/16] * add more rules from blars git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@121 0b7a5b0c-1f2c-0410-bd74-c376f8064c91 --- common/drug_spam | 6 +++--- common/misc_spam | 6 ++++++ common/phrase_spam | 32 +++++++++++++++++++++++++++++++- 3 files changed, 40 insertions(+), 4 deletions(-) diff --git a/common/drug_spam b/common/drug_spam index f49baf8..c5c93a5 100644 --- a/common/drug_spam +++ b/common/drug_spam @@ -1,12 +1,12 @@ # various drugs match these rules # blarson, 2004-05-10 -> lists --pasc 04/05/11 -body DRUGSPAM /(\b|_)(c.?(i|\?|\=ed|\xed).?a.?l.?[ig].?s|v.?(i|1|=ed|\xed).?[\a@].?g.?r.?a|v.?i.?c.?o.?d.?i.?n|h.?y.?d.?r.?o.?c.?o.?d.?o.?n.?e|[xz].?a.?n.?a.\?x|p.?r.?o.?z.?a.?c|rx|hgh)(\b|_)/i +body DRUGSPAM /(\b|_)(c.?(i|\?|\=ed|\xed).?a.?l.?[ig].?s|v.?(i|1|=ed|\xed|l).?(?:a|\@|\/\\).?g.?r.?(?:a|\@|\/\\)|v.?i.?c.?o.?d.?i.?n|h.?y.?d.?r.?o.?c.?o.?d.?o.?n.?e|[xz].?a.?n.?a.\?x|p.?r.?o.?z.?a.?c|hgh)(\b|_)/i describe DRUGSPAM drug spam score DRUGSPAM 3 # blarson, 2004-05-10 -> lists --pasc 04/05/11 -header DRUGSPAM2 subject =~ /(\b|_)(c.?(i|\?|\=ed|\xed).?a.?l.?[ig].?s|v\.?(i|1|=ed).?[a@].?g.?r.?a|v.?i.?c.?o.?d.?i.?n|h.?y.?d.?r.?o.?c.?o.?d.?o.?n.?e|\[xz].?a.?n.?a.?x|p.?r.?o.?z.?a.?c|rx|hgh)(\b|_)/i +header DRUGSPAM2 subject =~ /(\b|_)(c.?(i|\?|\=ed|\xed).?a.?l.?[ig].?s|v\.?(i|1|=ed).?(?:a|\@|\/\\).?g.?r.?(?:a|\/\\)|v.?i.?c.?o.?d.?i.?n|h.?y.?d.?r.?o.?c.?o.?d.?o.?n.?e|\[xz].?a.?n.?a.?x|p.?r.?o.?z.?a.?c|hgh)(\b|_)/i describe DRUGSPAM2 more drug spam score DRUGSPAM2 3 @@ -259,6 +259,6 @@ describe XTRASIZE more penis spam score XTRASIZE 2 # blarson 2007-11-14 -header BIGORGAN subject =~ /\b(?:macro|sizeable|bouffant|colossal|elephantin|largish|gargantuan|vast|ample|broad|huge|size|significant|oversized|monolithic|hulky|voluminous|whopping|enormous|titanic|large|extended|bulky|humongous|outsize|puffy|prodigious|extended|sized|monstrous|wide|thumping|stupendous|gigantic|big|important|mountainous|immense|extended|plumping|tremendous|extensive|massive|sizable|conspicuous|prodigious|jumbo|monster|greatest|scale|immence|spacious|ranging|giant|biggish|outsized|whacking|fat|capacious|grand|intense|monumental|rangy|prominent|cosmic|bigger|muscular|obvious|overlarge|enlarged|oversize)\s+(?:body part|member|phallus|fuckstick|shlong|dic.?k|shaft|penis|erectile|organ|cock|rods?)\b/i +header BIGORGAN subject =~ /\b(?:macro|sizeable|bouffant|colossal|elephantin|largish|gargantuan|vast|ample|broad|huge|size|significant|oversized|monolithic|hulky|voluminous|whopping|enormous|titanic|large|extended|bulky|humongous|outsize|puffy|prodigious|extended|sized|monstrous|wide|thumping|stupendous|gigantic|big|important|mountainous|immense|extended|plumping|tremendous|extensive|massive|sizable|conspicuous|prodigious|jumbo|monster|greatest|scale|immence|spacious|ranging|giant|biggish|outsized|whacking|fat|capacious|grand|intense|monumental|rangy|prominent|cosmic|bigger|muscular|obvious|overlarge|enlarged|oversize|super)\s+(?:body part|member|phallus|fuckstick|shlong|dic.?k|shaft|penis|erectile|organ|cock|rods?|dik)\b/i describe BIGORGAN big body part score BIGORGAN 3 diff --git a/common/misc_spam b/common/misc_spam index 702ea0e..9a2f8c1 100644 --- a/common/misc_spam +++ b/common/misc_spam @@ -285,3 +285,9 @@ score XJ2ID 4 header LONGWORD subject =~ /\b[\w\d]{30,}/i describe LONGWORD long word in subject score LONGWORD 2 + +# blarson 2007-11-23 +header TESTIMONIAL subject =~ /\btestimonial/i +describe TESTIMONIAL testimonials +score TESTIMONIAL 2 + diff --git a/common/phrase_spam b/common/phrase_spam index dc35d64..d9829e9 100644 --- a/common/phrase_spam +++ b/common/phrase_spam @@ -85,7 +85,7 @@ describe REFWD re or fwd nothing score REFWD 3.5 # blarson 2005-11-11 -header ONEWORD subject =~ /^(?:Fw:|re:)?\s*\w+\s*$/i +header ONEWORD subject =~ /^(?:Fw:|re:)?\s*\S+\s*$/i describe ONEWORD one word subject score ONEWORD 1 @@ -662,3 +662,33 @@ score VENTTRANS 4 body HOLIDAYHERE /\bHolidays are here\b/i describe HOLIDAYHERE Holidays are here score HOLIDAYHERE 3 + +# blarson 2007-11-22 +header CAPINIT subject =~ /^\s*(?:(?:[A-Z][a-z-]+|PaintBrush|Jet plane|Tennis racquet|Leather jacket)\s+){2,}[A-Z][a-z-]+\s*$/ +describe CAPINIT Capinit Every Word +score CAPINIT 2 + +# blarson 2007-11-23 +body REMOVESPACE /\b(?:remove|w\/o|without|delete) spaces?\b/i +describe REMOVESPACE w/o space +score REMOVESPACE 2 + +# blason 2007-11-27 +header BEAHERO subject =~ /Be a hero/ +describe BEAHERO Be a hero +score BEAHERO 4 + +# blarson 2007-11-28 +header SOFTCHEAP subject =~ /Soft and cheap/i +describe SOFTCHEAP Soft and cheap +score SOFTCHEAP 3 + +# blarson 2007-11-30 +body CHEAPSOFT /\bcheap (?:OEM)?\s*soft(?:ware)?/i +describe CHEAPSOFT cheap OEM soft +score CHEAPSOFT 2 + +# blarson 2007-11-30 +header MAKEMONEY subject =~ /\b(?:Make|need|extra)\s+(?:Cash|money|income)\b/i +describe MAKEMONEY Make Cash +score MAKEMONEY 3 -- 2.39.2 From a41f744a1d96220e3c83279cdcbdf83b773cf6b8 Mon Sep 17 00:00:00 2001 From: Don Armstrong Date: Sat, 1 Dec 2007 09:51:16 +0000 Subject: [PATCH 08/16] disable flowgoaway RBL git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@122 0b7a5b0c-1f2c-0410-bd74-c376f8064c91 --- common/url_spam | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/common/url_spam b/common/url_spam index 30032e4..bb76063 100644 --- a/common/url_spam +++ b/common/url_spam @@ -294,12 +294,13 @@ body SPACECOM /^[\w\d]+\s\.\scom\b/ describe SPACECOM whatever . com score SPACECOM 3 +# don -- flowgoaway.com doesn't appear to be a working RBL anymore (if it ever was?) # blarson 2007-11-20 -uridnsbl URIBL_FLO flowgoaway.com. A -body URIBL_FLO eval:check_uridnsbl('URIBL_FLO') -describe URIBL_FLO web site in flowgoaway.com -tflags URIBL_FLO net -score URIBL_FLO 1 +# uridnsbl URIBL_FLO flowgoaway.com. A +# body URIBL_FLO eval:check_uridnsbl('URIBL_FLO') +# describe URIBL_FLO web site in flowgoaway.com +# tflags URIBL_FLO net +# score URIBL_FLO 1 # blarson 2007-11-20 body SOFTROU /\bwww\.softrou\.com\b/i -- 2.39.2 From 07723eafc59b1bf8fa565e2e8af4b810f16c549d Mon Sep 17 00:00:00 2001 From: Martin Zobel-Helas Date: Tue, 1 Jan 2008 10:30:52 +0000 Subject: [PATCH 09/16] new phrase spam: Pls check this new site git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@123 0b7a5b0c-1f2c-0410-bd74-c376f8064c91 --- common/phrase_spam | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/common/phrase_spam b/common/phrase_spam index d9829e9..c03ca6e 100644 --- a/common/phrase_spam +++ b/common/phrase_spam @@ -692,3 +692,7 @@ score CHEAPSOFT 2 header MAKEMONEY subject =~ /\b(?:Make|need|extra)\s+(?:Cash|money|income)\b/i describe MAKEMONEY Make Cash score MAKEMONEY 3 + +body SITESUBJECT /\bPlease see this site in Subject\b/i +describe SITESUBJECT Pls check this new site +score SITESUBJECT 3 -- 2.39.2 From 2f2d36225a773d664dcfca545ac9ffc9807180c8 Mon Sep 17 00:00:00 2001 From: Don Armstrong Date: Tue, 1 Jan 2008 13:08:54 +0000 Subject: [PATCH 10/16] fix string equality and quoting in update_spamassassin git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@124 0b7a5b0c-1f2c-0410-bd74-c376f8064c91 --- update_spamassassin | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/update_spamassassin b/update_spamassassin index b564136..0e08376 100755 --- a/update_spamassassin +++ b/update_spamassassin @@ -9,10 +9,10 @@ SVN=$(which svn) TMPDIR=$(mktemp -d); -if [ "$HOSTNAME" == "rietz" ]; then +if [ "$HOSTNAME" = "rietz" ]; then BASEDIR="/org/bugs.debian.org" USERCONF="bugs/user_prefs"; -elif [ "$HOSTNAME" == "liszt" ]; then +elif [ "$HOSTNAME" = "liszt" ]; then BASEDIR="/var/list/.etc"; USERCONF="lists/user_prefs"; else @@ -28,7 +28,7 @@ ORIGREV=$(svn info $SACONFIG |awk '/^Revision:/{print $2}') NEWREV=$(svn info $(svn info $SACONFIG|awk '/^URL:/{print $2}')|awk '/^Revision:/{print $2}') # no changes, bug out. -if [ $ORIGREV -ge $NEWREV ]; then +if [ "$ORIGREV" -ge "$NEWREV" ]; then exit 0; fi; -- 2.39.2 From 22de5baac70926a056c76c2d7e9b05f151813dd4 Mon Sep 17 00:00:00 2001 From: Don Armstrong Date: Tue, 1 Jan 2008 13:09:12 +0000 Subject: [PATCH 11/16] add blars changes to spam rules git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@125 0b7a5b0c-1f2c-0410-bd74-c376f8064c91 --- common/bts_specific | 3 +++ common/drug_spam | 56 ++++++++++++++++++++++++++++++++++++++++++--- common/misc_spam | 9 ++++++++ common/money_spam | 10 ++++++++ common/phrase_spam | 43 +++++++++++++++++++++++++++++----- common/url_spam | 40 ++++++++++++++++++++++++++++++++ 6 files changed, 152 insertions(+), 9 deletions(-) diff --git a/common/bts_specific b/common/bts_specific index a616c29..579d487 100644 --- a/common/bts_specific +++ b/common/bts_specific @@ -84,3 +84,6 @@ score INFOLOOP 7 header KOI8R Content-Type =~ /koi8-r/i describe KOI8R korean content score KOI8R 3 + +# blarson 2007-12-10 +score ONEWORD 3 diff --git a/common/drug_spam b/common/drug_spam index c5c93a5..173cc26 100644 --- a/common/drug_spam +++ b/common/drug_spam @@ -72,8 +72,8 @@ score MURPHY_DRUGS_REL7 0.2 body MURPHY_DRUGS_REL8 /patch/i score MURPHY_DRUGS_REL8 0.02 -body MURPHY_DRUGS_REL9 /pill/i -score MURPHY_DRUGS_REL9 0.2 +body MURPHY_DRUGS_REL9 /\bpills?\b/i +score MURPHY_DRUGS_REL9 1 body MURPHY_DRUGS_REL10 /bacteria/i score MURPHY_DRUGS_REL10 0.1 @@ -259,6 +259,56 @@ describe XTRASIZE more penis spam score XTRASIZE 2 # blarson 2007-11-14 -header BIGORGAN subject =~ /\b(?:macro|sizeable|bouffant|colossal|elephantin|largish|gargantuan|vast|ample|broad|huge|size|significant|oversized|monolithic|hulky|voluminous|whopping|enormous|titanic|large|extended|bulky|humongous|outsize|puffy|prodigious|extended|sized|monstrous|wide|thumping|stupendous|gigantic|big|important|mountainous|immense|extended|plumping|tremendous|extensive|massive|sizable|conspicuous|prodigious|jumbo|monster|greatest|scale|immence|spacious|ranging|giant|biggish|outsized|whacking|fat|capacious|grand|intense|monumental|rangy|prominent|cosmic|bigger|muscular|obvious|overlarge|enlarged|oversize|super)\s+(?:body part|member|phallus|fuckstick|shlong|dic.?k|shaft|penis|erectile|organ|cock|rods?|dik)\b/i +header BIGORGAN subject =~ /\b(?:macro|sizeable|bouffant|colossal|elephantin|largish|gargantuan|vast|ample|broad|huge|size|significant|oversized?|monolithic|hulky|voluminous|whopping|enormous|titanic|large|extended|bulky|humongous|outsize|puffy|prodigious|extended|sized|monstrous|wide|thumping|stupendous|gigantic|big|important|mountainous|immense|extended|plumping|tremendous|extensive|massive|sizable|conspicuous|prodigious|jumbo|monster|greatest|scale|immence|spacious|ranging|giant|biggish|outsized|whacking|fat|capacious|grand|intense|monumental|rangy|prominent|cosmic|bigger|muscular|obvious|overlarge|enlarged|super|larger|increase|stronger|sized?|your|great|longest|true|harder)\s+(?:body part|member|phallus|fuckstick|sc?hlong|dic?\W?k|shaft|p\W?e\W?n[i!]s|erectile|organ|cock|rods?|ejaculation|erections?|in\sgirth|one-eyed|penile|w[i1][l1]+y|magic wand|masculinity|PE)\b/i describe BIGORGAN big body part score BIGORGAN 3 + +# blarson 2007-12-02 +header BKWORD subject =~ /\b\{word\}\b/ +describe BKWORD {word} +score BKWORD 3 + +# blarson 2007-12-10 +header MEDS subject =~ /\bmed(?:ication)?s?\b/ +describe MEDS meds +score MEDS 2 + +# blarson 2007-12-10 +header STEROIDS subject =~ /\bsteroids?\b/i +describe STEROIDS steroids +score STEROIDS 3 + +# blarson 2007-12-11 +header HEALTH subject =~ /\bhealth\b/i +describe HEALTH health +score HEALTH 0.2 + +# blarson 2007-12-18 +body MEDS2 /\bmed\W?s?\b/ +describe MEDS2 meds +score MEDS2 2 + +# blarson 2007-12-21 +full VPXL /\bVPXL\b/ +describe VPXL VPXL +score VPXL 3 + +# blarson 2007-12-22 +full TRIBULUS /\b(?:Tribulus terrestris|Albizzia lebbeck|Argyrerin speciosa|Valeriana wallichii|Soya protein)\b/i +describe TRIBULUS Tribulus terrestris|Albizzia lebbeck +score TRIBULUS 3 + +# blarson 2007-12-24 +body VITAMINE /\bVitamin E\b/ +describe VITAMINE Vitamin E +score VITAMINE 3 + +# blarson 2007-12-24 +full PENISSIZE /\b(?:penis|dick|cock)\s+(?:size|enlargement|width|girth)\b/i +describe PENISSIZE penis size +score PENISSIZE 3 + +# blarson 2007-12-24 +full INVOICE /\bPharmacy Invoice\b/i +describe INVOICE Pharmacy Invoice +score INVOICE 3 diff --git a/common/misc_spam b/common/misc_spam index 9a2f8c1..1641a3d 100644 --- a/common/misc_spam +++ b/common/misc_spam @@ -291,3 +291,12 @@ header TESTIMONIAL subject =~ /\btestimonial/i describe TESTIMONIAL testimonials score TESTIMONIAL 2 +# blarson 2007-12-13 +header ITXS subject =~ /\bit\`s\b/i +describe ITXS it`s +score ITXS 4 + +# blarson 2007-12-18 +rawbody TINYFONT /\bFONT-SIZE\:\s+[123]px\;/i +describe TINYFONT tiny font specified +score TINYFONT 3 diff --git a/common/money_spam b/common/money_spam index 34f5216..cfb44dd 100644 --- a/common/money_spam +++ b/common/money_spam @@ -282,3 +282,13 @@ score STOCKFRLE 3.4 body OPORTUNI /\bOportunidade de Emprego\b/i describe OPORTUNI Oportunidade de Emprego score OPORTUNI 3.5 + +# blarson 2007-12-10 +header WATCHES subject =~ /\b(?:watches|time\s*piece|Replica)\b/i +describe WATCHES watches +score WATCHES 2 + +# blarson 2007-12-29 +body COUP0N /\bCoup0n\b/i +describe COUP0N Coup0n +score COUP0N 3 diff --git a/common/phrase_spam b/common/phrase_spam index c03ca6e..7edc197 100644 --- a/common/phrase_spam +++ b/common/phrase_spam @@ -87,7 +87,7 @@ score REFWD 3.5 # blarson 2005-11-11 header ONEWORD subject =~ /^(?:Fw:|re:)?\s*\S+\s*$/i describe ONEWORD one word subject -score ONEWORD 1 +score ONEWORD 2 # robot101, 2003-09-22 header CROSSWALK X-UnityUser =~ /^Crosswalk.com, Inc/ @@ -193,8 +193,9 @@ header SENTMESSAGE subject =~ /(sent you a( personal|) message|would like to cha describe SENTMESSAGE Sent you a message (like duh?) score SENTMESSAGE 2 -# blarson 2006-03-16 2007-09-18 -body DEARDIGIT /^(?:well\s+)?(?:Dear|Hey|H[ea]y?ll?.?o|To|Attention|Hi+|Hey+a?|Bonjorno|(?:Yo\s*)+|(?:g[o0]+d\s*)?(?:d?ay|morning|evening?|afternoon|night)|what.?i?s\s+up|wa(?:s|z)+up|greetings?|Salutations|(Mail|News)\s+to|how(?:.?s|\s+is)?\s*(?:(?:it)?(?:\s+is)??\s*going|have\s+you\s+been|are you).?\s*(?:there|to\s+you)?|compliments|Regards|Adieu)\,?\s+(?:Account\s+\#?|\=?3d|)(?:bro|there|sir|Mr\.?)\s*?\d{3,}/i +# blarson 2006-03-16 2007-09-18 not working, replaced 2007-12-08 +# body DEARDIGIT /^(?:well\s+)?(?:Dear|Hey|H[ea]y?ll?.?o|To|Attention|Hi+|Hey+a?|Bonjorno|(?:Yo\s*)+|(?:g[o0]+d\s*)?(?:d?ay|morning|evening?|afternoon|night)|what.?i?s\s+up|wa(?:s|z)+up|greetings?|Salutations|(Mail|News)\s+to|how(?:.?s|\s+is)?\s*(?:(?:it)?(?:\s+is)??\s*going|have\s+you\s+been|are you).?\s*(?:there|to\s+you)?|compliments|Regards|Adieu)\,?\s+(?:Account\s+\#?|\=?3d|)(?:bro|there|sir|Mr\.?)\s*?\d{3,}/i +body DEARDIGIT /^\s*(?:Good\s*)?(?:evenin|night|day|hi|hello|greetin|Compliment|Wa[sz]+up|dear|Regard|Mornin|(?:yo\s*)+)[sg]?\s+(?:there\s+)?\d{3,}/i describe DEARDIGIT Dear number score DEARDIGIT 3.9 @@ -348,7 +349,7 @@ describe ACRO8PR0 sales spam score ACRO8PR0 4 # blarson 2007-10-05 -body WBRS /\b(WBRS|FPMC|ADYN|AFML|MISJ|HXPN|WHKA|CBFE|HSBC|PCAI|MPRG|HPRS|AUNI|TGVI|MHII|TAMG|GDKI|ACEN|CDYV|G7Q\.F|mbwc|CHFR|CDPN|DSDI|UTEV|P-S-U-D|GPSI|SGXI|CAON|SREA|ERMX|VPSN|SZSN|PAYI\.OB|LTDI|C\W\W?Y\W\W?T\W\W?V|E\WX\WM\WT|CYTV|VGPM|V\s?G\s?P\s?M(\.PK)?|wwng|WWNG|F\WD\WE\WG|FDEG|UTYW|M\s*I\s*H\s*I|O\W?N\W?C\W?O|P\W?P\W?Y\W?H|S\W?R\W?E\W?A|A\W?C\W?G\W?U|S\W?C\W?Y\W?F|C\W?H\W?V\W?C|D\W?M\W?X\W?C|F\W?R\W?L\W?E|M\W?A\W?K\W?U|C\W?W\W?T\W?E|F\W?R\W?L\W?E|M\W?X\W?X\W?R|P\W?R\W?T\W?H|A\W?L\W?L\W?U|C\W?W\W?T\W?D|T\W?A\W?D\W?F|D\W?M\W?H\W?N|C\W?A\W?O\W?N|Cwtd|N\W?C\W?S\W?H|F\W?R\W?L\W?E|M\W?A\W?K\W?U|d\W?m\W?h\W?n|T\W?R\W?T\W?M|[Ee]\W?[Tt]\W?[Gg]\W?[Uu])\b/ +body WBRS /\b(WBRS|FPMC|ADYN|AFML|MISJ|HXPN|WHKA|CBFE|HSBC|PCAI|MPRG|HPRS|AUNI|TGVI|MHII|TAMG|GDKI|ACEN|CDYV|G7Q\.F|mbwc|CHFR|CDPN|DSDI|UTEV|P-S-U-D|GPSI|SGXI|CAON|SREA|ERMX|VPSN|SZSN|PAYI\.OB|LTDI|C\W\W?Y\W\W?T\W\W?V|E\WX\WM\WT|CYTV|VGPM|V\s?G\s?P\s?M(\.PK)?|wwng|WWNG|F\WD\WE\WG|FDEG|UTYW|M\s*I\s*H\s*I|O\W?N\W?C\W?O|P\W?P\W?Y\W?H|S\W?R\W?E\W?A|A\W?C\W?G\W?U|S\W?C\W?Y\W?F|C\W?H\W?V\W?C|D\W?M\W?X\W?C|F\W?R\W?L\W?E|M\W?A\W?K\W?U|C\W?W\W?T\W?E|F\W?R\W?L\W?E|M\W?X\W?X\W?R|P\W?R\W?T\W?H|A\W?L\W?L\W?U|C\W?W\W?T\W?D|T\W?A\W?D\W?F|D\W?M\W?H\W?N|C\W?A\W?O\W?N|Cwtd|N\W?C\W?S\W?H|F\W?R\W?L\W?E|M\W?A\W?K\W?U|d\W?m\W?h\W?n|T\W?R\W?T\W?M|[Ee]\W?[Tt]\W?[Gg]\W?[Uu]|PERT|EWIN|SXB\.F)\b/ describe WBRS stock spam score WBRS 4 @@ -664,9 +665,9 @@ describe HOLIDAYHERE Holidays are here score HOLIDAYHERE 3 # blarson 2007-11-22 -header CAPINIT subject =~ /^\s*(?:(?:[A-Z][a-z-]+|PaintBrush|Jet plane|Tennis racquet|Leather jacket)\s+){2,}[A-Z][a-z-]+\s*$/ +header CAPINIT subject =~ /^(?:Re:)?\s*(?:(?:[A-Z][a-z-]+|PaintBrush|Jet (?:plane|fighter)|Tennis racquet|Leather jacket|IWC|\&|Jaeger-LeCoultre)\s+)+(?:[A-Z][a-z-]+|PaintBrush|Jet (?:plane|fighter)|Tennis racquet|Leather jacket)\s*$/ describe CAPINIT Capinit Every Word -score CAPINIT 2 +score CAPINIT 2.2 # blarson 2007-11-23 body REMOVESPACE /\b(?:remove|w\/o|without|delete) spaces?\b/i @@ -693,6 +694,36 @@ header MAKEMONEY subject =~ /\b(?:Make|need|extra)\s+(?:Cash|money|income)\b/i describe MAKEMONEY Make Cash score MAKEMONEY 3 +# blarson 2007-12-07 +header PREVED subject =~ /\bPreved\b/i +describe PREVED Preved +score PREVED 3 + +# blarson 2007-12-08 +body YOURPROFILE /\byour profile\b/i +describe YOURPROFILE your profile +score YOURPROFILE 2 + +# blarson 2007-12-09 +body SEEKEMP /\bseeking for employees\b/ +describe SEEKEMP seeking for employees +score SEEKEMP 3 + +# blarson 2007-12-27 +body PRICELIST /(?:^(?:adobe|microsoft|intuit|autodesk|symantec)\W.*\b\d{2,}$){3,}/i +describe PRICELIST list of prices +score PRICELIST 1 + +# blarson 2007-12-30 +full OEMSOFT /\b[O0]EM\s+s[o0][\W_]?ft_?(?:w_?a_?r_?e)?\b/i +describe OEMSOFT OEM software +score OEMSOFT 2 + +# blarson 2008-01-01 +header NIGHTGIRL subject =~ /\bnight\b.*\bgirlfriend\b/ +describe NIGHTGIRL night ... girlfriend +score NIGHTGIRL 3 + body SITESUBJECT /\bPlease see this site in Subject\b/i describe SITESUBJECT Pls check this new site score SITESUBJECT 3 diff --git a/common/url_spam b/common/url_spam index bb76063..1fd858f 100644 --- a/common/url_spam +++ b/common/url_spam @@ -311,3 +311,43 @@ score SOFTROU 3 body GOOGLEPAGES /\bgooglepages\.com\b/i describe GOOGLEPAGES spammers use googlepages score GOOGLEPAGES 2 + +# blarson 2007-12-07 +body SOFTBESTGRAND /\bsoft(?:bestgrand|wareonlinemuch)\.com\b/ +describe SOFTBESTGRAND softbestgrand.com +score SOFTBESTGRAND 4 + +# blarson 2007-12-10 +body PCSOFTCHEAP /\b(?:pcsoftcheap|cheapezsoft|cheapsoftxp|adobe4cheap|phonowa|saleonsoftware|bestdealoem|realcheapsoft|krasniyles|cheapxp4pc|supercheapoem|lowpriceoem|realcheapoem|cheapadobedeal|softwarefoundation|2008oem|xprimesoftware|xpxmas|cheap2008soft|xprimeeasy|snowysoftware|2008adobe)\s?\.\s?(?:com|net)\b/ +describe PCSOFTCHEAP pcsoftcheap. com +score PCSOFTCHEAP 4 + +# blarson 2007-12-11 +body GOLDGAME /\b(?:gamblingplacegold|goldgamesite|topgamingsite|richbestgaming|luxgoldgaming)\.(?:net|com)\b/ +describe GOLDGAME gambling sites +score GOLDGAME 4 + +# blarson 2007-12-14 +body ENLARGETW /\b(?:enlarge|0rz)\.tw\b/ +describe ENLARGETW enlarge.tw +score ENLARGETW 4 + +# blarson 2007-12-15 +body POSTTHROUGH /\b(?:postthrough|speedgrand|certaincoast)\.com\b/ +describe POSTTHROUGH postthrough.com +score POSTTHROUGH 4 + +# blarson 2007-12-25 +body UHAVE /\b(?:uhavepost|happy(?:santa)?|newyear|familypost|fresh)cards?(?:2008)?\.com\b/ +describe UHAVE uhavepostcard.com +score UHAVE 4 + +# blarson 2007-12-26 +body RUSSWIFE /\byourrussianwife\.info\b/ +describe RUSSWIFE yourrussianwife.info +score RUSSWIFE 4 + +# blarson 2007-12-31 +body HAPPY2008 /\b(?:happy2008toyou|hellosanta2008|hohoho2008)\.com\b/ +describe HAPPY2008 happy2008toyou.com +score HAPPY2008 4 -- 2.39.2 From 0cdaf21fb478802c6886dab48aaeab58f0cb61bb Mon Sep 17 00:00:00 2001 From: Thomas Viehmann Date: Tue, 1 Jan 2008 22:12:23 +0000 Subject: [PATCH 12/16] phrase spam: from: pls check this new site git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@126 0b7a5b0c-1f2c-0410-bd74-c376f8064c91 --- common/phrase_spam | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/common/phrase_spam b/common/phrase_spam index 7edc197..4a271f9 100644 --- a/common/phrase_spam +++ b/common/phrase_spam @@ -727,3 +727,8 @@ score NIGHTGIRL 3 body SITESUBJECT /\bPlease see this site in Subject\b/i describe SITESUBJECT Pls check this new site score SITESUBJECT 3 + +# tomv 2008-01-01 +header PLSCHECKSITE from =~ /\bPls check this new site\b/i +describe PLSCHECKSITE Pls check this new site +score PLSCHECKSITE 4 -- 2.39.2 From 17951141d6176ad0f670d55291155c61d2f0a12a Mon Sep 17 00:00:00 2001 From: Don Armstrong Date: Tue, 8 Jan 2008 05:43:34 +0000 Subject: [PATCH 13/16] * Add blars changes to SA rules git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@127 0b7a5b0c-1f2c-0410-bd74-c376f8064c91 --- common/drug_spam | 7 ++++++- common/phrase_spam | 5 +++++ common/url_spam | 30 +++++++++++++++++++++++++----- 3 files changed, 36 insertions(+), 6 deletions(-) diff --git a/common/drug_spam b/common/drug_spam index 173cc26..a26de30 100644 --- a/common/drug_spam +++ b/common/drug_spam @@ -259,7 +259,7 @@ describe XTRASIZE more penis spam score XTRASIZE 2 # blarson 2007-11-14 -header BIGORGAN subject =~ /\b(?:macro|sizeable|bouffant|colossal|elephantin|largish|gargantuan|vast|ample|broad|huge|size|significant|oversized?|monolithic|hulky|voluminous|whopping|enormous|titanic|large|extended|bulky|humongous|outsize|puffy|prodigious|extended|sized|monstrous|wide|thumping|stupendous|gigantic|big|important|mountainous|immense|extended|plumping|tremendous|extensive|massive|sizable|conspicuous|prodigious|jumbo|monster|greatest|scale|immence|spacious|ranging|giant|biggish|outsized|whacking|fat|capacious|grand|intense|monumental|rangy|prominent|cosmic|bigger|muscular|obvious|overlarge|enlarged|super|larger|increase|stronger|sized?|your|great|longest|true|harder)\s+(?:body part|member|phallus|fuckstick|sc?hlong|dic?\W?k|shaft|p\W?e\W?n[i!]s|erectile|organ|cock|rods?|ejaculation|erections?|in\sgirth|one-eyed|penile|w[i1][l1]+y|magic wand|masculinity|PE)\b/i +header BIGORGAN subject =~ /\b(?:macro|sizeable|bouffant|colossal|elephantin|largish|gargantuan|vast|ample|broad|huge|size|significant|oversized?|monolithic|hulky|voluminous|whopping|enormous|titanic|large|extended|bulky|humongous|outsize|puffy|prodigious|extended|sized|monstrous|wide|thumping|stupendous|gigantic|big|important|mountainous|immense|extended|plumping|tremendous|extensive|massive|sizable|conspicuous|prodigious|jumbo|monster|greatest|scale|immence|spacious|ranging|giant|biggish|outsized|whacking|fat|capacious|grand|intense|monumental|rangy|prominent|cosmic|bigger|muscular|obvious|overlarge|enlarged|super|larger|increase|stronger|sized?|your|great|longest|true|harder|tiny|small|gaining)\s+(?:body part|member|phallus|fuckstick|sc?hlong|dic?\W?k|shaft|p\W?e\W?n[i!l]s|erectile|organ|cock|rods?|ejaculation|erections?|in\sgirth|one-eyed|penile|w[i1][l1]+y|magic wand|masculinity|PE)\b/i describe BIGORGAN big body part score BIGORGAN 3 @@ -312,3 +312,8 @@ score PENISSIZE 3 full INVOICE /\bPharmacy Invoice\b/i describe INVOICE Pharmacy Invoice score INVOICE 3 + +# blarson 2008-01-01 +header S_E_X subject =~ /\bs\W?e\W?(?:x|[>)]\W?[<(])(?:\b|u)/i +describe S_E_X s.e.x +score S_E_X 3 diff --git a/common/phrase_spam b/common/phrase_spam index 4a271f9..7433700 100644 --- a/common/phrase_spam +++ b/common/phrase_spam @@ -732,3 +732,8 @@ score SITESUBJECT 3 header PLSCHECKSITE from =~ /\bPls check this new site\b/i describe PLSCHECKSITE Pls check this new site score PLSCHECKSITE 4 + +# blarson 2008-01-03 +header MARRYCH subject =~ /\bMarry Christmas\b/ +describe MARRYCH Marry Christmas +score MARRYCH 3 diff --git a/common/url_spam b/common/url_spam index 1fd858f..fb1c7bc 100644 --- a/common/url_spam +++ b/common/url_spam @@ -117,7 +117,7 @@ describe BESTLOANS Best loans url score BESTLOANS 2 # blarson 2007-07-22 2007-09-12 -body PENPRO /\@(?:penmailpro|OnsetIng|openprotection|NearOut|SuperOnset|medicalgloveonline|YourOnset|GreatGloveCell|thegloveworks|asiafriendworld)\.info\b/i +body PENPRO /\@(?:penmailpro|OnsetIng|openprotection|NearOut|SuperOnset|medicalgloveonline|YourOnset|GreatGloveCell|thegloveworks|asiafriendworld|NaturalImprove|charmshine)\.info\b/i describe PENPRO penmailpro spam score PENPRO 3.5 @@ -318,7 +318,7 @@ describe SOFTBESTGRAND softbestgrand.com score SOFTBESTGRAND 4 # blarson 2007-12-10 -body PCSOFTCHEAP /\b(?:pcsoftcheap|cheapezsoft|cheapsoftxp|adobe4cheap|phonowa|saleonsoftware|bestdealoem|realcheapsoft|krasniyles|cheapxp4pc|supercheapoem|lowpriceoem|realcheapoem|cheapadobedeal|softwarefoundation|2008oem|xprimesoftware|xpxmas|cheap2008soft|xprimeeasy|snowysoftware|2008adobe)\s?\.\s?(?:com|net)\b/ +body PCSOFTCHEAP /\b(?:pcsoftcheap|cheapezsoft|cheapsoftxp|adobe4cheap|phonowa|saleonsoftware|bestdealoem|realcheapsoft|krasniyles|cheapxp4pc|supercheapoem|lowpriceoem|realcheapoem|cheapadobedeal|softwarefoundation|2008oem|xpxmas|cheap2008soft|snowysoftware|2008adobe|adobe2008|cheapgetsoftone|x(?:higher|main|prime)(?:soft|software|easy)|softonlinepc|andsoftware|softonlinedownload)\s?\.\s?(?:com|net)\b/ describe PCSOFTCHEAP pcsoftcheap. com score PCSOFTCHEAP 4 @@ -338,16 +338,36 @@ describe POSTTHROUGH postthrough.com score POSTTHROUGH 4 # blarson 2007-12-25 -body UHAVE /\b(?:uhavepost|happy(?:santa)?|newyear|familypost|fresh)cards?(?:2008)?\.com\b/ +body UHAVE /\b(?:uhavepost|happy(?:santa)?|newyear|familypost|fresh|post)cards?-?(?:2008)?\.com\b/ describe UHAVE uhavepostcard.com score UHAVE 4 # blarson 2007-12-26 -body RUSSWIFE /\byourrussianwife\.info\b/ +body RUSSWIFE /\byour(?:russian?|address)(?:wife|bride)\.info\b/ describe RUSSWIFE yourrussianwife.info score RUSSWIFE 4 # blarson 2007-12-31 -body HAPPY2008 /\b(?:happy2008toyou|hellosanta2008|hohoho2008)\.com\b/ +body HAPPY2008 /\b(?:happy2008toyou|hellosanta2008|hohoho2008|santawishes2008)\.com\b/ describe HAPPY2008 happy2008toyou.com score HAPPY2008 4 + +# blarson 2008-01-02 +body BONGHIT /\b(?:beaverbonghits|dobongworld)\.com\b/ +describe BONGHIT beaverbonghits.com +score BONGHIT 4 + +# blarson 2008-01-02 +body GOOGLESEARCH /http\:\/\/google\.(com|tw|co\.uk)\/+search/i +describe GOOGLESEARCH google search URL +score GOOGLESEARCH 2 + +# blarson 2008-01-02 +body SIGAS /\b(?:Sigashash|Reelhotsi|Erisgoonti|Erisgoners|Freesignsies|Rielhotties|Foredroons|Feeshoons|Erisgant|hapburge|wuimooed|jiuezdoo|goingoinghom|buloies|Poeshages|Rueshabesoo)(?:\.|\=2E)com\b/ +describe SIGAS www.Sigashash.com +score SIGAS 4 + +# blarson 2008-01-05 +body RUSSIABRIDE /\brussian?(bride|wife)(?:home|live)\.info\b/ +describe RUSSIABRIDE russiabridehome.info +score RUSSIABRIDE 4 -- 2.39.2 From c20fe3f5bd4d4475ffd8d1ec7f7d6ed0db50d768 Mon Sep 17 00:00:00 2001 From: Don Armstrong Date: Tue, 8 Jan 2008 06:03:16 +0000 Subject: [PATCH 14/16] match buy the product spams git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@128 0b7a5b0c-1f2c-0410-bd74-c376f8064c91 --- common/phrase_spam | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/common/phrase_spam b/common/phrase_spam index 7433700..16d1f7b 100644 --- a/common/phrase_spam +++ b/common/phrase_spam @@ -737,3 +737,9 @@ score PLSCHECKSITE 4 header MARRYCH subject =~ /\bMarry Christmas\b/ describe MARRYCH Marry Christmas score MARRYCH 3 + +# don 2008-01-7 +header BUYTHEPRODUCT subject =~ /Buy the product/i +describe BUYTHEPRODUCT Buy the product subject +score BUYTHEPRODUCT 3 + -- 2.39.2 From ac4891522d27c06ae7f27d0869c2ef8b9886312a Mon Sep 17 00:00:00 2001 From: Don Armstrong Date: Tue, 15 Jan 2008 22:07:52 +0000 Subject: [PATCH 15/16] add blars changes to rules git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@129 0b7a5b0c-1f2c-0410-bd74-c376f8064c91 --- common/drug_spam | 19 +++++++++++++++++-- common/money_spam | 4 ++-- common/phrase_spam | 8 ++++++-- common/url_spam | 20 +++++++++++++++----- 4 files changed, 40 insertions(+), 11 deletions(-) diff --git a/common/drug_spam b/common/drug_spam index a26de30..eaa027d 100644 --- a/common/drug_spam +++ b/common/drug_spam @@ -16,7 +16,7 @@ describe DRUGSPAM3 yet more drugs score DRUGSPAM3 1.5 # blarson 2007-09-13 -body MURPHY_DRUGS1 /\bv.?i.?a.?[gdk].?r.?a\b/i +full MURPHY_DRUGS1 /\bv.?i.?a+.?[gdk]+.?r+.?a+\b/i describe MURPHY_DRUGS1 Viagra score MURPHY_DRUGS1 1.5 @@ -259,7 +259,7 @@ describe XTRASIZE more penis spam score XTRASIZE 2 # blarson 2007-11-14 -header BIGORGAN subject =~ /\b(?:macro|sizeable|bouffant|colossal|elephantin|largish|gargantuan|vast|ample|broad|huge|size|significant|oversized?|monolithic|hulky|voluminous|whopping|enormous|titanic|large|extended|bulky|humongous|outsize|puffy|prodigious|extended|sized|monstrous|wide|thumping|stupendous|gigantic|big|important|mountainous|immense|extended|plumping|tremendous|extensive|massive|sizable|conspicuous|prodigious|jumbo|monster|greatest|scale|immence|spacious|ranging|giant|biggish|outsized|whacking|fat|capacious|grand|intense|monumental|rangy|prominent|cosmic|bigger|muscular|obvious|overlarge|enlarged|super|larger|increase|stronger|sized?|your|great|longest|true|harder|tiny|small|gaining)\s+(?:body part|member|phallus|fuckstick|sc?hlong|dic?\W?k|shaft|p\W?e\W?n[i!l]s|erectile|organ|cock|rods?|ejaculation|erections?|in\sgirth|one-eyed|penile|w[i1][l1]+y|magic wand|masculinity|PE)\b/i +header BIGORGAN subject =~ /\b(?:macro|sizeable|bouffant|colossal|elephantin|largish|gargantuan|vast|ample|broad|huge|size|significant|oversized?|monolithic|hulky|voluminous|whopping|enormous|titanic|large|extended|bulky|humongous|outsize|puffy|prodigious|extended|sized|monstrous|wide|thumping|stupendous|gigantic|big|important|mountainous|immense|extended|plumping|tremendous|extensive|massive|sizable|conspicuous|prodigious|jumbo|monster|greatest|scale|immence|spacious|ranging|giant|biggish|outsized|whacking|fat|capacious|grand|intense|monumental|rangy|prominent|cosmic|bigger|muscular|obvious|overlarge|enlarged|super|larger|increase|stronger|sized?|your|great|longest|true|harder|tiny|small|gaining|ultimate|amazing)\s+(?:body part|member|phallus|fuckstick|sc?hlong|d[il]c?\W?k|shaft|p\W?e\W?n[i!l]s|erectile|organ|cock|rods?|ejaculation|erections?|in\sgirth|one-eyed|penile|w[i1][l1]+y|magic wand|masculinity|PE|pleasure machine|herbal|stick|male|d\Wi\Wc\Wk)\b/i describe BIGORGAN big body part score BIGORGAN 3 @@ -317,3 +317,18 @@ score INVOICE 3 header S_E_X subject =~ /\bs\W?e\W?(?:x|[>)]\W?[<(])(?:\b|u)/i describe S_E_X s.e.x score S_E_X 3 + +# blarson 2008-01-11 +header EDSET subject =~ /\bEDSET\b/ +describe EDSET EDSET +score EDSET 4 + +# blarson 2008-01-12 +full CANADIAN /\bCanadian.*pharmacy\b/i +describe CANADIAN Canadian pharmacy +score CANADIAN 3 + +# blarson 2008-01-14 +header INVOICE subject =~ /\bInvoice\s+.?\d+/i +describe INVOICE invoice number +score INVOICE 3 diff --git a/common/money_spam b/common/money_spam index cfb44dd..a89019a 100644 --- a/common/money_spam +++ b/common/money_spam @@ -257,9 +257,9 @@ body DMXC /Look at D-M-X-C!/ describe DMXC stock spam score DMXC 4 -body MONEY /((usd|yen|eur?o?|dollar|\$)\s*[\d\.\, ]+|[\d\.\, ]+\s*(usd|yen|eur?o?|dollar|\$))/i +body MONEY /((usd|yen|eur?o?|dollar|\$)\s*\d[\d\.\,]+|\d[\d\.\,]+\s*(usd|yen|eur?o?|dollar|\$))/i describe MONEY Some amount of money in body -score MONEY 1.5 +score MONEY 0.5 header SUBJMONEY subject =~ /((usd|yen|eur?o?|dollar|\$)\s*[\d\.\, ]+|[\d\.\, ]+\s*(usd|yen|eur?o?|dollar|\$))/i describe SUBJMONEY Some amount of money in subject diff --git a/common/phrase_spam b/common/phrase_spam index 16d1f7b..b2864ef 100644 --- a/common/phrase_spam +++ b/common/phrase_spam @@ -359,7 +359,7 @@ score FOURLA 0.1 meta STOCKLIKE (FOURLA && (MONEY || SUBJMONEY)) describe STOCKLIKE Four letter acronyms with money; stock scam -score STOCKLIKE 2 +score STOCKLIKE 1 # blarson 2007-01-26 header ACROBAT8 subject =~ /\badobe acr[o0]bat 8\b/i @@ -710,7 +710,7 @@ describe SEEKEMP seeking for employees score SEEKEMP 3 # blarson 2007-12-27 -body PRICELIST /(?:^(?:adobe|microsoft|intuit|autodesk|symantec)\W.*\b\d{2,}$){3,}/i +body PRICELIST /(?m:^(?:adobe|microsoft|intuit|autodesk|symantec)\W.*\b\d{2,}$){3,}/i describe PRICELIST list of prices score PRICELIST 1 @@ -743,3 +743,7 @@ header BUYTHEPRODUCT subject =~ /Buy the product/i describe BUYTHEPRODUCT Buy the product subject score BUYTHEPRODUCT 3 +# blarson 2008-01-11 +body IBERIS /\bIberis Capital Group\b/ +describe IBERIS Iberis Capital Group +score IBERIS 4 diff --git a/common/url_spam b/common/url_spam index fb1c7bc..bfe6dc4 100644 --- a/common/url_spam +++ b/common/url_spam @@ -318,7 +318,7 @@ describe SOFTBESTGRAND softbestgrand.com score SOFTBESTGRAND 4 # blarson 2007-12-10 -body PCSOFTCHEAP /\b(?:pcsoftcheap|cheapezsoft|cheapsoftxp|adobe4cheap|phonowa|saleonsoftware|bestdealoem|realcheapsoft|krasniyles|cheapxp4pc|supercheapoem|lowpriceoem|realcheapoem|cheapadobedeal|softwarefoundation|2008oem|xpxmas|cheap2008soft|snowysoftware|2008adobe|adobe2008|cheapgetsoftone|x(?:higher|main|prime)(?:soft|software|easy)|softonlinepc|andsoftware|softonlinedownload)\s?\.\s?(?:com|net)\b/ +body PCSOFTCHEAP /\b(?:pcsoftcheap|cheapezsoft|cheapsoftxp|adobe4cheap|phonowa|saleonsoftware|bestdealoem|realcheapsoft|krasniyles|cheapxp4pc|supercheapoem|lowpriceoem|realcheapoem|cheapadobedeal|softwarefoundation|2008oem|xpxmas|cheap2008soft|snowysoftware|2008adobe|adobe2008|cheapgetsoftone|x(?:higher|main|prime)(?:soft|software|easy)|softonlinepc|andsoftware|softonlinedownload|kunchakoem|erhere\w|kiroemch|phonowd|cheap(?:soft|oem|software)here|softwarenowprox|xprosoftonlinedl|siniyglaz|popandosoem|xsoftprodepot|triudava|krasniynos|fastsoftnow|cheapeasy(soft|oem|software)|ezadobenow)\s?\.\s?(?:com|net)\b/ describe PCSOFTCHEAP pcsoftcheap. com score PCSOFTCHEAP 4 @@ -343,7 +343,7 @@ describe UHAVE uhavepostcard.com score UHAVE 4 # blarson 2007-12-26 -body RUSSWIFE /\byour(?:russian?|address)(?:wife|bride)\.info\b/ +body RUSSWIFE /\b(?:your|best|new|the)(?:russian?|address)(?:wife|bride)\.info\b/ describe RUSSWIFE yourrussianwife.info score RUSSWIFE 4 @@ -358,16 +358,26 @@ describe BONGHIT beaverbonghits.com score BONGHIT 4 # blarson 2008-01-02 -body GOOGLESEARCH /http\:\/\/google\.(com|tw|co\.uk)\/+search/i +body GOOGLESEARCH /\bgoo+gle\.(com|\w\w|com?\.\w\w)\/+search/i describe GOOGLESEARCH google search URL score GOOGLESEARCH 2 # blarson 2008-01-02 -body SIGAS /\b(?:Sigashash|Reelhotsi|Erisgoonti|Erisgoners|Freesignsies|Rielhotties|Foredroons|Feeshoons|Erisgant|hapburge|wuimooed|jiuezdoo|goingoinghom|buloies|Poeshages|Rueshabesoo)(?:\.|\=2E)com\b/ +body SIGAS /\b(?:Sigashash|Reelhotsi|Erisgoonti|Erisgoners|Freesignsies|Rielhotties|Foredroons|Feeshoons|Erisgant|hapburge|wuimooed|jiuezdoo|goingoinghom|buloies|Poeshages|Rueshabesoo|clitoriseries|clitorina)(?:\.|\=2E)com\b/ describe SIGAS www.Sigashash.com score SIGAS 4 # blarson 2008-01-05 -body RUSSIABRIDE /\brussian?(bride|wife)(?:home|live)\.info\b/ +body RUSSIABRIDE /\brussian?(bride|wife)(?:home|live|blog)\.info\b/ describe RUSSIABRIDE russiabridehome.info score RUSSIABRIDE 4 + +# blarson 2008-01-14 +body REDMEHS /\bwww\.redmehs\b/ +describe REDMEHS www.redmehs +score REDMEHS 4 + +# blarson 2008-01-15 +body MYURL /\bmyurl\.com\.tw\b/i +describe MYURL myurl.com.tw +score MYURL 3 -- 2.39.2 From b7d371dd90b849669f0d107ec3b5d5baa41123e7 Mon Sep 17 00:00:00 2001 From: Martin Zobel-Helas Date: Wed, 16 Jan 2008 22:45:22 +0000 Subject: [PATCH 16/16] we dont like retails git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@130 0b7a5b0c-1f2c-0410-bd74-c376f8064c91 --- common/money_spam | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/common/money_spam b/common/money_spam index a89019a..1e92820 100644 --- a/common/money_spam +++ b/common/money_spam @@ -292,3 +292,7 @@ score WATCHES 2 body COUP0N /\bCoup0n\b/i describe COUP0N Coup0n score COUP0N 3 + +header SOFTWARERETAIL subject =~ /\bretail/i +describe SOFTWARERETAIL Adobe RETAIL products +score SOFTWARERETAIL 3.2 -- 2.39.2