Here's my next set of possible rules for submission to the SpamAssassin
distribution set.
URI rules may tend to be more transient than other types of rules, since
it's so easy for spammers to change domain names. I'm therefore including
only those that hit at least 0.15% of my spam. Well, the pillsavings rule
has hit several domains over several months, so that one I'll keep in,
though it's not quite 0.15%. Ditto the href= rule.
Feedback and/or mass-checks on these before formal submission are
invited.
Bob Menschel
uri RM_usd_530000x /530000x\.net/i
describe RM_usd_530000x body contains link to known spammer
score RM_usd_530000x 7.650 # 685s/0h of 92209 corpus (74874s/17335h)
01/17/04
uri RM_usd_biogenusa /biogenusa\.biz/i
describe RM_usd_biogenusa text references known spammer
score RM_usd_biogenusa 7.650 # 193s/0h of 92209 corpus (74874s/17335h)
01/17/04
uri RM_usd_awayoutofdebtf /awayoutofdebtfast\.com/i
describe RM_usd_awayoutofdebtf text references known spammer
score RM_usd_awayoutofdebtf 7.650 # 175s/0h of 92209 corpus (74874s/17335h)
01/17/04
uri RM_usd_dealsbythemin /dealsby(?:the)?(?:minute|hour)\.biz/i
describe RM_usd_dealsbythemin text references known spammer
score RM_usd_dealsbythemin 7.650 # 188s/0h of 92209 corpus (74874s/17335h)
01/17/04
uri RM_usd_dubnh /dubnh\.us/i
describe RM_usd_dubnh body contains link to known spammer
score RM_usd_dubnh 7.650 # 432s/0h of 92209 corpus (74874s/17335h)
01/17/04
uri RM_usd_ehostzzz /ehostzzz\.net/i
describe RM_usd_ehostzzz body contains link to known spammer
score RM_usd_ehostzzz 7.650 # 456s/0h of 92209 corpus (74874s/17335h)
01/17/04
uri RM_usd_ghkp /ghkp\.us/i
describe RM_usd_ghkp body contains link to known spammer
score RM_usd_ghkp 7.650 # 262s/0h of 92209 corpus (74874s/17335h)
01/17/04
uri RM_usd_OfferClicks /OfferClicks\.com/i
describe RM_usd_OfferClicks text references known spammer
score RM_usd_OfferClicks 7.650 # 765s/0h of 92209 corpus (74874s/17335h)
01/17/04
uri RM_usd_pillsavings /pillsavings?[0-9]*\.com/i
describe RM_usd_pillsavings URL link might be to spam site
score RM_usd_pillsavings 7.650 # 95s/0h of 92209 corpus (74874s/17335h)
01/17/04
uri RM_usd_smartcontrol /smartcontrol\.biz/i
describe RM_usd_smartcontrol body contains link to known spammer
score RM_usd_smartcontrol 7.650 # 124s/0h of 92209 corpus (74874s/17335h)
01/17/04
uri RM_up_hrefinuri /href=/i
describe RM_up_hrefinuri link includes href within code
score RM_up_hrefinuri 3.000 # 106s/0h of 92209 corpus (74874s/17335h)
01/17/04
uri RE_uwd_DefaultAsp /\/default\.asp\?id\=/i
describe RE_uwd_DefaultAsp Contains a likely spammer default.asp link.
score RE_uwd_DefaultAsp 4.500 # type=spamp - 1137s/0h of 92209 corpus
(74874s/17335h) 01/17/04
uri RM_uwd_defaultN /\/default\d{1,5}\.htm/i
describe RM_uwd_defaultN text points to sequentially numbered "default" page
score RM_uwd_defaultN 3.000 # 1322s/2h of 92209 corpus (74874s/17335h)
01/17/04
# ham: 1999 (1), 2003:
http://movies.fantasticfactory.com/dagon/default8.htm in ToS email.
uri RM_uwd_nomore /\/nomore\.htm/i
describe RM_uwd_nomore text includes pointer to spammer unsubscribe link
score RM_uwd_nomore 4.500 # type=spamp - 1200s/0h of 92209 corpus
(74874s/17335h) 01/17/04
uri RM_uwd_UnsubscribePHP /unsubscribe\.php/i
describe RM_uwd_UnsubscribePHP text uri to unsubscribe link
score RM_uwd_UnsubscribePHP 3.000 # 236s/0h of 92209 corpus (74874s/17335h)
01/17/04
-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
