On Mon, 2018-10-29 at 15:55 +0200, Anders Gustafsson wrote:
> Is there such a rule already in 3.3.x? I would ideally want a version
> of that that adds to the spam score if it sees a x.x.x.x/unsubscribe
> link, possibly translated.
>
> Asking here as regexps are not really my strong side.
>
Here's a (partially) tested rule that can spot two forms of bare IP.
The the rule given below the __MG_BAI0 subrule recognises plain IPs.
i.e. n.n.n.n and the __MG_BAI1 recognises URIs like your example, i.e.
n.n.n.n/wwwww :
describe MG_BARE_IP Bare IP in a URI
body __MG_BAI0 /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/
uri __MG_BAI1 /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\w*/
meta MG_BARE_IP (__MG_BAI0 || __MG_BAI1)
score MG_BARE_IP 0.01
Note that the bare IP - n.n.n.n - is NOT a URI and so must be a body
text rule while the bare IP with a '/name' suffix is a URI and so is
found by a URI rule. This is why I used two subrules joined by the
meta-rule.
Note that technical computing discussions may validly contain bare IPs,
e.g. 127.0.0.1 is never a spam indication since it is the IP of
'localhost' and so its appearance is not a spam indication. There are
other well-known IPs that are also not spam indications.
Martin
