Public bug reported:
Mails containing this URL will be scored higher (depending on the set
score, IIRC it's 2.5 for URI_OBFU_WWW plus 2.3 for FSL_RU_URL if
activated).
A manual test using perl and the URI_OBFU_WWW rule regex confirms this:
> perl -ne 'print if
> /(?<!http:\/\/)\b_*w{2,3}(?!\.[-\w]+\.(?:com|net|org|biz|info))[^[:alnum:]]{1,3}(?:<D><O><T>+[^[:alnum:]]{1,3})?[[:alnum:]][-\w]{1,20}[[:alnum:]][^[:alnum:]]{1,3}(?:<D><O><T>+[^[:alnum:]]{1,3})?(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g|b\s?i\s?z|i\s?n\s?f\s?o)_*\b/i;'
> < Mail1.txt
> www.tuning-net.ru
This URL should not be detected as obfuscated. It is plain text and
looks OK (non-obfuscated).
ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: spamassassin 3.3.2-2ubuntu1
ProcVersionSignature: Ubuntu 3.2.0-43.68-generic 3.2.42
Uname: Linux 3.2.0-43-generic x86_64
ApportVersion: 2.0.1-0ubuntu17.6
Architecture: amd64
Date: Thu Nov 14 14:14:04 2013
MarkForUpload: True
PackageArchitecture: all
ProcEnviron:
TERM=xterm-256color
PATH=(custom, no user)
LANG=de_DE.UTF-8
SHELL=/bin/bash
SourcePackage: spamassassin
UpgradeStatus: Upgraded to precise on 2012-05-04 (558 days ago)
mtime.conffile..etc.default.spamassassin: 2012-05-13T09:03:40.993608
** Affects: spamassassin (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug precise
--
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to spamassassin in Ubuntu.
https://bugs.launchpad.net/bugs/1251237
Title:
SpamAssassin's URI_OBFU_WWW rule claims "www.tuning-net.ru" is an
obfuscated URL
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/spamassassin/+bug/1251237/+subscriptions
--
Ubuntu-server-bugs mailing list
Ubuntu-server-bugs@lists.ubuntu.com
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
