Hi all,
I developed a new rule set which works very well for the
amavisd-new/postfix setup that I use.
I don't have a large sample of ham and spam so could
somebody please mass-check the following rule set
and let me know ?
Thanks
Marc
body V_CIALIS_MISSPELLED_1 /(Cgalis|Cialjs|Cialgs|Cbalis|Ciwlis|Cial..is)/i
describe V_CIALIS_MISSPELLED_1 Cialis misspelled (simple)
score V_CIALIS_MISSPELLED_1 3.5
# CIALIS == C. I . A . L . I
. S
body V_CIALIS_MISSPELLED_2
/c.?(i|1|\||l|\!).?(a|\@).?(i|1|\||l|\!).?(i|1|\||l|\!).?s/i
describe V_CIALIS_MISSPELLED_2 Cialis misspelled
score V_CIALIS_MISSPELLED_2 3.5
body V_VIAGRA_MISSPELLED_1 /(viaara|voagra|viagr..a|viag..ra)/i
describe V_VIAGRA_MISSPELLED_1 Viagra misspelled (simple)
score V_VIAGRA_MISSPELLED_1 3.5
# VIAGRA == V. I . A . G. R. A
body V_VIAGRA_MISSPELLED_2 /v.?(i|1|\||l|\!).?(a|\@).?g.?r.?(a|\@)/i
describe V_VIAGRA_MISSPELLED_2 Viagra misspelled
score V_VIAGRA_MISSPELLED_2 3.5
body V_CIALAPREN_ADS /cialapren/i
describe V_CIALAPREN_ADS Cialapren drug
score V_CIALAPREN_ADS 2.5
body V_VIAGRA_ADS /\/.9.gif/
describe V_VIAGRA_ADS Various Viagra ads
score V_VIAGRA_ADS 2.0
rawbody V_VIAGRA_AD_01 /<!--.{10,18}--><a
href="http:\/\/www\..{5,12}\.com[\/a-zA-Z0-9]{0,7}"><img
src="http:\/\/www\..{5,12}\.com\/.{2,3}\.gif" border=0>/
describe V_VIAGRA_AD_01 Viagra Ad 1
score V_VIAGRA_AD_01 4.0
rawbody V_VIAGRA_AD_02 />v<.*>i<.*>a<.*>g<.*>r<.*>a</i
describe V_VIAGRA_AD_02 Viagra Ad 2
score V_VIAGRA_AD_02 2.0
rawbody V_VIAGRA_AD_03 />c<.*>i<.*>a<.*>l<.*>i<.*>s</i
describe V_VIAGRA_AD_03 Cialis Ad 3
score V_VIAGRA_AD_03 2.0
rawbody V_AFFILIATE_01 /affiliate/i
describe V_AFFILIATE_01 Affiliate ad 1
score V_AFFILIATE_01 0.6
rawbody V_AFFILIATE_02 /affiliate_id/i
describe V_AFFILIATE_02 Affiliate ad 2
score V_AFFILIATE_02 1.2
rawbody V_CAMPAIGN_01 /campaign/i
describe V_CAMPAIGN_01 Campaign ad 1
score V_CAMPAIGN_01 0.6
rawbody V_CAMPAIGN_02 /campaign_id/i
describe V_CAMPAIGN_02 Campaign ad 2
score V_CAMPAIGN_02 1.2
rawbody V_INLINE_GIF /image\/gif/i
describe V_INLINE_GIF inlined gif image
score V_INLINE_GIF 0.6
rawbody V_INLINE_JPG /image\/jpe?g/i
describe V_INLINE_JPG inlined jpeg image
score V_INLINE_JPG 0.6
# viagra ads:
body V_DRUNK_PUNCH /(drunk|drungk|punch)/i
describe V_DRUNK_PUNCH drunk punch
score V_DRUNK_PUNCH 1.2
body V_DICK_MISSPELLED /\b(d[^iuyoea]ck|dicck)/i
describe V_DICK_MISSPELLED dick misspelled
score V_DICK_MISSPELLED 2.0
body V_PILLS_1 /\bpills/i
describe V_PILLS_1 pills
score V_PILLS_1 0.7
body V_PILLS_MISSPELLED /\bpi11s/i
describe V_PILLS_MISSPELLED pills misspelled
score V_PILLS_MISSPELLED 2.2
body V_FUCKED_MISSPELLED /\bf[^uo]cked\b/i
describe V_FUCKED_MISSPELLED fucked misspelled
score V_FUCKED_MISSPELLED 2.0
# unusual long word
rawbody V_VERY_LONG_WORD_1 /\w{55,}/
describe V_VERY_LONG_WORD_1 long sequence of normal characters
score V_VERY_LONG_WORD_1 0.2
# can be a long URL:
rawbody V_VERY_LONG_WORD_2 /\S{95,}/
describe V_VERY_LONG_WORD_2 long sequence of characters
score V_VERY_LONG_WORD_2 0.5
# many spaces
body V_MANY_SPACES /\s{14}/
describe V_MANY_SPACES 14 whitespace characters
score V_MANY_SPACES 0.7
# HTML comment usually indicates an ad
rawbody V_HTML_COMMENT /\<!\-\-/
describe V_HTML_COMMENT HTML comment
score V_HTML_COMMENT 0.4
# fake HTML tag without vowels
rawbody V_FAKE_TAG_1 /\<[\/!]?[bcdfghjklmnpqrstvwxz]{5,9}\>/i
describe V_FAKE_TAG_1 5-9 char fake HTML tag (no vowels)
score V_FAKE_TAG_1 2.0
# fake HTML tag that is too long
rawbody V_FAKE_TAG_2 /\<[\/!]?[a-z_0-9]{10,20}\>/i
describe V_FAKE_TAG_2 10+ char fake HTML tag with optional digit and
underscore
score V_FAKE_TAG_2 2.0
# fake HTML tag with digits
rawbody V_FAKE_TAG_3 /\<[\/!]?[a-z]{2,10}[0-9]\w{0,12}\>/i
describe V_FAKE_TAG_3 fake HTML tag with a digit
score V_FAKE_TAG_3 2.0
rawbody V_MESSAGE_LOADING /\>message loading\</i
describe V_MESSAGE_LOADING message loading (between tags)
score V_MESSAGE_LOADING 2.0
rawbody V_IMAGE_NOT_LOADING /image not loading/i
describe V_IMAGE_NOT_LOADING image not loading
score V_IMAGE_NOT_LOADING 1.8
rawbody V_IMAGE_NOT_SHOWING /image not showing/i
describe V_IMAGE_NOT_SHOWING image not showing
score V_IMAGE_NOT_SHOWING 1.8
body V_ADS_01 /doctor/i
score V_ADS_01 0.5
body V_ADS_02 /prices/i
score V_ADS_02 0.5
body V_ADS_03 /products/i
score V_ADS_03 0.5
body V_ADS_04 /licensed/i
score V_ADS_04 0.5
body V_ADS_05 /shipped/i
score V_ADS_05 0.5
body V_ADS_06 /shipping/i
score V_ADS_06 0.5
body V_ADS_07 /orders/i
score V_ADS_07 0.5
body V_ADS_08 /rolexes/i
score V_ADS_08 1.5
body V_ADS_09 /bachelors/i
score V_ADS_09 0.5
body V_ADS_10 /masters/i
score V_ADS_10 0.5
body V_ADS_11 /ship(ped)? to all countries/i
score V_ADS_11 0.8
# long username (no dots) in from address
header V_FROM_IS_LONG_ND From =~ /[-_a-zA-Z0-9]{24,}\@/
describe V_FROM_IS_LONG_ND user name is 24+ long (without dots)
score V_FROM_IS_LONG_ND 0.5
# very long username in from address
header V_FROM_IS_LONG From =~ /[-_a-zA-Z0-9\.]{40,}\@/
describe V_FROM_IS_LONG user name is 40+ long
score V_FROM_IS_LONG 0.5
# accept newsletters DUTCH
body V_NEWSLETTER /(newsletter|nieuwsbrief)/i
describe V_NEWSLETTER newsletter
score V_NEWSLETTER -0.8
# some spammers use yahoo for redirection
uri V_REDIR_YAHOO /https?:\/\/drs.yahoo.com\/.{5,50}\*http/i
describe V_REDIR_YAHOO ad redirection via Yahoo!
score V_REDIR_YAHOO 2.0
# the following is a more generic re for redirection
uri V_DOUBLE_URI
/https?.{3,9}[-a-z0-9\.]{1,60}\/.{1,80}(url=|redir=|returnto=|https?)/
describe V_DOUBLE_URI URI contains 2nd URI
score V_DOUBLE_URI 1.5
# random tokens without vowels (e.g. "xdfhskmwqs")
body V_NO_VOWEL_7 /[bcdfghjklmnpqrstvwxz]{7}/i
describe V_NO_VOWEL_7 7-char word without vowels
score V_NO_VOWEL_7 0.7
body V_NO_VOWEL_8 /[bcdfghjklmnpqrstvwxz]{8}/i
describe V_NO_VOWEL_8 8-char word without vowels
score V_NO_VOWEL_8 1.1
body V_NO_VOWEL_9 /[bcdfghjklmnpqrstvwxz]{9}/i
describe V_NO_VOWEL_9 9-char word without vowels
score V_NO_VOWEL_9 0.5
body V_2_LONG_WORDS /[a-zA-Z]{50,200}\s+[a-zA-Z]{50,200}/
describe V_2_LONG_WORDS 2 consecutive very long words
score V_2_LONG_WORDS 0.7
body V_3_LONG_WORDS
/[a-zA-Z]{50,200}\s+[a-zA-Z]{50,200}\s+[a-zA-Z]{50,200}/
describe V_3_LONG_WORDS 3 consecutive very long words
score V_3_LONG_WORDS 1.2
body V_4_LONG_WORDS
/[a-zA-Z]{50,200}\s+[a-zA-Z]{50,200}\s+[a-zA-Z]{50,200}\s+[a-zA-Z]{50,200}/
describe V_4_LONG_WORDS 4 consecutive very long words
score V_4_LONG_WORDS 1.2
# detect crap like "jqp zomqku, wiu, dkte . hcr zicztp chl, hztz, phhy . sbnlfu"
body V_9_RND_SMALL_WORDS /([a-zA-Z]{3,6}[ \.,]{1,3}){9,}/
describe V_9_RND_SMALL_WORDS 9 consecutive small words
score V_9_RND_SMALL_WORDS 0.6
body V_10_RND_SMALL_WORDS /([a-zA-Z]{3,6}[ \.,]{1,3}){10,}/
describe V_10_RND_SMALL_WORDS 10 consecutive small words
score V_10_RND_SMALL_WORDS 1.1
body V_16_RND_SMALL_WORDS /([a-zA-Z]{2,6}[ \.,]{1,3}){16,}/
describe V_16_RND_SMALL_WORDS 16 consecutive small words
score V_16_RND_SMALL_WORDS 1.5
# detect lines with a set of random words
# e.g. "taint dutchman conductor gingko defector augur cummins demagogue zaire biota
crowberry idiotic hardboard september"
body V_18_WORDS /^([a-zA-Z]{3,20}\s+){18,}/
describe V_18_WORDS 18+ words without interpunction
score V_18_WORDS 0.8
body V_24_WORDS /^([a-zA-Z]{3,20}\s+){24,}/
describe V_24_WORDS 24+ words without interpunction
score V_24_WORDS 1.2
# detect lines with a set of random tokens
# e.g. "0678YDXqs 4K8687 t1qh8486q B7jk16 QF N15ed82J 321Yb1F1 hJ1653w 7u455
g2j4kUQN 10 cPs 2R o35 88rS6 066Q7I2kh"
body V_18_TOKENS /^([a-zA-Z0-9]{2,9}\s+){18,}/
describe V_18_TOKENS 18+ tokens without interpunction
score V_18_TOKENS 0.8
body V_24_TOKENS /^([a-zA-Z0-9]{2,9}\s+){24,}/
describe V_24_TOKENS 24+ tokens without interpunction
score V_24_TOKENS 1.2
