# SARE HTML Ruleset for SpamAssassin - ruleset 0 
# Version: 01.03.07
# Created: 2004-03-31 
# Modified: 2005-07-02
# Usage instructions, documentation, and change history in 70_sare_html0.cf 
#@@# Revision History:  Full Revision History stored in 70_sare_html.log
#@@# 01.03.07: July 2 2005
#@@#           Minor score tweaks based on recent mass-checks
#@@#           Added file 0:      SARE_HTML_EHTML_OBFU
#@@#           Moved file 0 to 1: SARE_HTML_INV_TAGA

# License: Artistic - see http://www.rulesemporium.com/license.txt 
# Current Maintainer: Bob Menschel - RMSA@Menschel.net
# Current Home: http://www.rulesemporium.com/rules/70_sare_html0.cf 
#
# Usage:  This family of files, 70_sare_html*.cf, contain rules that test HTML strings within emails
#         (except URIs, which are handled in the 70_sare_uri*.cf family of files).
#
# File 0: 70_sare_html0.cf -- These are html rules that hit at least 10 spam and no ham. 
#         While SARE cannot guarantee they never will hit ham, they have not hit ham in any SARE mass-check, against tens of thousands of ham.
#         This is a rules file we expect any/all email systems using SpamAssassin to benefit from. 
#
# File 1: 70_sare_html1.cf -- These are html rules that meet one of the follow criteria: 
#         a) Rules that do, or in the past have hit ham during SARE mass-check tests 
#         b) Rules that hit no ham and currently do not hit more than 10 spam in any single mass-check run. 
#         If the rules hit ham, they hit at last 10 spam to each 1 ham. 
#         If the rules hit ham, they hit fewer than 100 ham 
#         With few exceptions these rules score significantly less than the rules in file 0. 
#         Systems which are very sensitive to false positives and/or need to be very careful about resource use may want to exclude this ruleset, 
#         pick and choose among its rules, or lower their scores.
#         Systems that use this file 1 should ALSO use file 0. 
#
# File 2: 70_sare_html2.cf -- These html rules hit no spam at this time, but they are considered "safe" rules that should never hit ham.
#         These are primarily rules that test for specific html seen only in spam, or similar types of "pretty darn sure" rules. 
#         Systems which are very sensitive to SpamAssassin overhead may want to exclude this ruleset file to avoid its overhead, 
#         but systems with plenty of resources that want to be aggressive against spam may benefit from this ruleset file.
#
# File 3: 70_sare_html3.cf -- These are html rules that hit a significant amount of ham during SARE mass-check tests. 
#         Systems which are very sensitive to false positives or to SA resource usage should NOT install this ruleset. 
#
# File 4: 70_sare_html4.cf -- These are html rules that meet one of the following criteria: 
#         a) They hit over 100 ham during SARE mass-check tests, but still hit enough spam to be worth while to aggressively anti-spam systems. 
#         b) They hit no emails at this time, but have been recommended by anti-spam sources.
#         Again, systems which are very sensitive to false positives or to SA resource usage should NOT install this ruleset. 
#
# eng:    70_sare_html_eng.cf -- These are html rules which work well within the English language, but are liable to cause false
#         positives in other languages. They include rules which test for letter combinations. Systems that
#         receive ham in languages other than English should NOT use this file. 
#
# x30:    70_sare_html_x30.cf -- These are html rules which have been incorporated into SpamAssassin 3.0.x, 
#         or which duplicate or greatly overlap 3.0.x rules. 
#         Systems which have installed SpamAssassin 3.0.x should therefore NOT use this file.
#
# arc:    70_sare_html_arc.cf -- These are html rules that once were published in other files, but which have since lost all value.
#         They either hit too much ham (without hitting enough spam to make it worth while), or they don't hit any spam. 
#         SARE regularly runs mass-checks on these rules to see if any of them are worth reviving, but 
#         we expect that nobody will be running these rules in any production system. 
#
########  ######################   ##################################################

########  ######################   ##################################################
#         Rules renamed or moved
########  ######################   ##################################################

meta      SARE_HTML_ALT_WAIT2      0    # archived         Feb 26 2005, 01.03.04
meta      SARE_HTML_BADOPEN        0    # archived         Feb 26 2005, 01.03.04
meta      SARE_HTML_BAD_FG_CLR     0    # Moved 3 to 4,    Feb 26 2005, 01.03.04
meta      SARE_HTML_COLOR_B        0    # Moved 1 to 3,    Feb 26 2005, 01.03.04
meta      SARE_HTML_COLOR_NWHT3    0    # Moved 3 to 4,    Feb 26 2005, 01.03.04
meta      SARE_HTML_FONT_INVIS2    0    # Moved 3 to 4,    Feb 26 2005, 01.03.04
meta      SARE_HTML_FSIZE_1ALL     0    # Moved 1 to 4,    Feb 26 2005, 01.03.04
meta      SARE_HTML_GIF_DIM        0    # Moved 3 to 4,    Feb 26 2005, 01.03.04
meta      SARE_HTML_HTML_AFTER     0    # Moved 3 to 4,    Feb 26 2005, 01.03.04
meta      SARE_HTML_HTML_DBL       0    # Moved 0 to 1,    Feb 26 2005, 01.03.04
meta      SARE_HTML_HTML_TBL       0    # Moved 0 to 1,    Feb 26 2005, 01.03.04
meta      SARE_HTML_IMG_ONLY       0    # Moved 0 to 1,    Feb 26 2005, 01.03.04
meta      SARE_HTML_JVS_HREF       0    # Unarchived to 3, Feb 26 2005, 01.03.04
meta      SARE_HTML_MANY_BR10      0    # Moved 1 to 3,    Feb 26 2005, 01.03.04
meta      SARE_HTML_MANY_BR10      0    # Moved 3 to 4,    Feb 26 2005, 01.03.04
meta      SARE_HTML_NO_BODY        0    # Moved 1 to 3,    Feb 26 2005, 01.03.04
meta      SARE_HTML_NO_HTML1       0    # Moved 1 to 3,    Feb 26 2005, 01.03.04
meta      SARE_HTML_P_JUSTIFY      0    # Moved 3 to 4,    Feb 26 2005, 01.03.04
meta      SARE_HTML_TITLE_SEX      0    # Moved 0 to 1,    Feb 26 2005, 01.03.04
meta      SARE_HTML_URI_2SLASH     0    # Moved 3 to 4,    Feb 26 2005, 01.03.04
meta      SARE_HTML_URI_AXEL       0    # archived         Feb 26 2005, 01.03.04
meta      SARE_HTML_URI_BADQRY     0    # Moved 0 to 3,    Feb 26 2005, 01.03.04
meta      SARE_HTML_URI_FORMPHP    0    # Unarchived to 3, Feb 26 2005, 01.03.04
meta      SARE_HTML_URI_HREF       0    # Moved 0 to 3,    Feb 26 2005, 01.03.04
meta      SARE_HTML_URI_MANYP2     0    # archived         Feb 26 2005, 01.03.04
meta      SARE_HTML_URI_MANYP3     0    # Moved 3 to 4,    Feb 26 2005, 01.03.04
meta      SARE_HTML_URI_NUMPHP3    0    # Moved 3 to 4,    Feb 26 2005, 01.03.04
meta      SARE_HTML_URI_OBFU4      0    # archived         Feb 26 2005, 01.03.04
meta      SARE_HTML_URI_OBFU4a     0    # archived         Feb 26 2005, 01.03.04
meta      SARE_HTML_URI_PARTID     0    # Moved 0 to 1,    Feb 26 2005, 01.03.04
meta      SARE_HTML_URI_RID        0    # archived         Feb 26 2005, 01.03.04
meta      SARE_HTML_USL_MULT       0    # archived         Feb 26 2005, 01.03.04
meta      SARE_HTML_FONT_EBEF      0    # Moved 0 to 1,    Mar 12 2005, 01.03.05
meta      SARE_HTML_URI_DEFASP     0    # Moved 0 to 1,    Mar 12 2005, 01.03.05
meta      SARE_HTML_INV_TAGA       0

########  ######################   ##################################################

rawbody   __SARE_HTML_HAS_A        eval:html_tag_exists('a')
rawbody   __SARE_HTML_HAS_BR       eval:html_tag_exists('br')
rawbody   __SARE_HTML_HAS_DIV      eval:html_tag_exists('div')
rawbody   __SARE_HTML_HAS_FONT     eval:html_tag_exists('font')
rawbody   __SARE_HTML_HAS_IMG      eval:html_tag_exists('img')
rawbody   __SARE_HTML_HAS_P        eval:html_tag_exists('p')
rawbody   __SARE_HTML_HAS_PRE      eval:html_tag_exists('pre')
rawbody   __SARE_HTML_HAS_TITLE    eval:html_tag_exists('title')

header    __SARE_HTML_HAS_TO       exists:To 
body      __SARE_HTML_HAS_MSG      /./
rawbody   __SARE_HTML_HBODY        m'<html><body>'i
rawbody   __SARE_HTML_BEHTML       m'<body></html>'i
rawbody   __SARE_HTML_BEHTML2      m'^</?body></html>'i
rawbody   __SARE_HTML_EFONT        m'^</font>'i
rawbody   __SARE_HTML_EHEB         m'^</html></body>'i
rawbody   __SARE_HTML_CMT_CNTR     /<center><!--/

# JH: These rules test for strange color combinations. There migth be even more powerful combinations, but I haven't had time to check them all
rawbody   __SARE_LIGHT_FG_COLOR    /[^\-a-z]color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?!fff\W|ffffff)(?:[e-f]{3}\W|(?:[e-f][0-9a-f]){3})|rgb(?:\((?!\s{0,10}255\s{0,10},\s{0,10}255\s{0,10},\s{0,10}255)\s{0,10}2[2-5][0-9]\s{0,10},\s{0,10}2[2-5][0-9]\s{0,10},\s{0,10}2[2-5][0-9]\s{0,10}\)|\((?!\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%)\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10},\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10},\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10}\))|(?:Light(?:Cyan|Yellow)|(?:Ghost|Floral)White|WhiteSmoke|LemonChiffon|AliceBlue|Cornsilk|Seashell|Honeydew|Azure|MintCream|Snow|Ivory|OldLace|LavenderBlush|Linen|MistyRose))/i
rawbody   __SARE_WHITE_FG_COLOR    /[^\-a-z]color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?:fff\W|ffffff)|rgb(?:\(\s{0,10}255\s{0,10},\s{0,10}255\s{0,10},\s{0,10}255\s{0,10}\)|\\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10}\))|white)/i
rawbody   __SARE_DARK_FG_COLOR     /[^\-a-z]color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?!000\W|000000)(?:[01]{3}\W|(?:[01][0-9a-f]){3})|rgb(?:\((?!\s{0,10}0\s{0,10},\s{0,10}0\s{0,10},\s{0,10}0\D)\s{0,10}[0-3]?[0-9]\s{0,10},\s{0,10}[0-3]?[0-9]\s{0,10},\s{0,10}[0-3]?[0-9]\s{0,10}\)|\((?!\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%)\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10},\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10},\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10}\)))/i
rawbody   __SARE_BLACK_FG_COLOR    /[^\-a-z]color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?:000\W|000000)|rgb\s{0,10}\(\s{0,10}0\s{0,10},\s{0,10}0\s{0,10},\s{0,10}0\s{0,10}\)|rgb\s{0,10}\(\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10}\)|black)/i
rawbody   __SARE_LIGHT_BG_COLOR    /(?:bg|background\-)color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?!ffffff|fff\W)(?:[e-f]{3}\W|(?:[e-f][0-9a-f]){3})|rgb(?:\((?!\s{0,10}255\s{0,10},\s{0,10}255\s{0,10},\s{0,10}255)\s{0,10}2[2-5][0-9]\s{0,10},\s{0,10}2[2-5][0-9]\s{0,10},\s{0,10}2[2-5][0-9]\s{0,10}\)|\((?!\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%)\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10},\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10},\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10}\))|(?:Light(?:Cyan|Yellow)|(?:Ghost|Floral)White|WhiteSmoke|LemonChiffon|AliceBlue|Cornsilk|Seashell|Honeydew|Azure|MintCream|Snow|Ivory|OldLace|LavenderBlush|Linen|MistyRose))/i
rawbody   __SARE_WHITE_BG_COLOR    /(?:bg|background\-)color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?:fff\W|ffffff)|rgb(?:\(\s{0,10}255\s{0,10},\s{0,10}255\s{0,10},\s{0,10}255\s{0,10}\)|\(\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10}\))|white)/i
rawbody   __SARE_DARK_BG_COLOR     /(?:bg|background\-)color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?!000\W|000000)(?:[01]{3}\W|(?:[01][0-9a-f]){3})|rgb(?:\((?!\s{0,10}0\s{0,10},\s{0,10}0\s{0,10},\s{0,10}0\D)\s{0,10}[0-3]?[0-9]\s{0,10},\s{0,10}[0-3]?[0-9]\s{0,10},\s{0,10}[0-3]?[0-9]\s{0,10}\)|\((?!\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%)\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10},\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10},\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10}\)))/i
rawbody   __SARE_BLACK_BG_COLOR    /(?:bg|background\-)color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?:000\W|000000)|rgb\s{0,10}\(\s{0,10}0\s{0,10},\s{0,10}0\s{0,10},\s{0,10}0\s{0,10}\)|rgb\s{0,10}\(\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10}\)|black)/i
rawbody   __SARE_HAS_BG_COLOR      /(?:bg|background\-)color\s{0,10}(?::|=)/i
rawbody   __SARE_HAS_FG_COLOR      /[^\-a-z]color\s{0,10}(?::|=)/i

# This following rule is part of the SA distribution. It is included here only to simplify mass-check executions.
header    __CT_TEXT_PLAIN          Content-Type =~ /^text\/plain\b/i

########  ######################   ##################################################
#   <HTML> and <BODY> tag spamsign
########  ######################   ##################################################

full      SARE_HTML_HTML_QUOT      /<HTML>.{0,2}&quot;/is
describe  SARE_HTML_HTML_QUOT      Message body has very strange HTML sequence
score     SARE_HTML_HTML_QUOT      1.666
#hist     SARE_HTML_HTML_QUOT      Fred T: FR_HTML_QUOTE
#counts   SARE_HTML_HTML_QUOT      75s/0h of 258858 corpus (114246s/144612h RM) 05/27/05
#max      SARE_HTML_HTML_QUOT      236s/0h of 114422 corpus (81069s/33353h RM) 01/16/05
#counts   SARE_HTML_HTML_QUOT      38s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_HTML_QUOT      98s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_HTML_QUOT      0s/0h of 4676 corpus (808s/3868h ft) 05/28/05
#counts   SARE_HTML_HTML_QUOT      12s/0h of 10826 corpus (6364s/4462h CT) 05/28/05

rawbody   SARE_HTML_EHTML_OBFU     m'<\s*/\s+(?!html)[HTmL\s]{4,}>'i
describe  SARE_HTML_EHTML_OBFU     Phoney tag
score     SARE_HTML_EHTML_OBFU     1.111
#stype    SARE_HTML_EHTML_OBFU     spamp
#hist     SARE_HTML_EHTML_OBFU     Loren Wilton, June 2005
#counts   SARE_HTML_EHTML_OBFU     20s/0h of 271461 corpus (129860s/141601h RM) 06/12/05
#counts   SARE_HTML_EHTML_OBFU     0s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#counts   SARE_HTML_EHTML_OBFU     0s/0h of 6804 corpus (1336s/5468h ft) 06/17/05
#counts   SARE_HTML_EHTML_OBFU     21s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_EHTML_OBFU     8s/0h of 47221 corpus (42968s/4253h MY) 06/18/05

########  ######################   ##################################################
#   <A> and HREF rules          
########  ######################   ##################################################

rawbody   SARE_HTML_A_INV          /href\w*href/i
describe  SARE_HTML_A_INV          HTML has malformed anchor/href tag
score     SARE_HTML_A_INV          3.333 
#stype    SARE_HTML_A_INV          spamg
#wasalso  SARE_HTML_A_INV          /href[a-z]*href/i
#wasalso  SARE_HTML_A_INV          Fred's FR_FUNNY_HREF
#wasalso  SARE_HTML_A_INV          /\w\whref=http:/i  from  David B Funk <dbfunk@engineering.uiowa.edu> Wed, 17 Mar 2004 04:04:58 -0600 (CST)
#counts   SARE_HTML_A_INV          11s/0h of 281271 corpus (109792s/171479h RM) 05/05/05
#max      SARE_HTML_A_INV          628s/0h of 66351 corpus (40971s/25380h RM) 08/21/04
#counts   SARE_HTML_A_INV          8s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_A_INV          101s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_A_INV          2s/0h of 31513 corpus (27912s/3601h MY) 03/09/05
#counts   SARE_HTML_A_INV          13s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#max      SARE_HTML_A_INV          23s/0h of 6944 corpus (3188s/3756h CT) 05/19/04

########  ######################   ##################################################
#   Spamsign character sets and fonts 
########  ######################   ##################################################

rawbody   SARE_HTML_POB1200        /width="599" bgColor="\#9999FF"/i
describe  SARE_HTML_POB1200        Used by POB1200 Orangestad spammer
score     SARE_HTML_POB1200        1.666
#stype    SARE_HTML_POB1200        spamp
#hist     SARE_HTML_POB1200        Jennifer Wheeler <jennifer.sare@nxtek.net> May 17 2004
#counts   SARE_HTML_POB1200        0s/0h of 196681 corpus (96193s/100488h RM) 02/22/05
#max      SARE_HTML_POB1200        414s/0h of 114422 corpus (81069s/33353h RM) 01/16/05
#counts   SARE_HTML_POB1200        7s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_POB1200        42s/0h of 18153 corpus (15872s/2281h MY) 05/18/04
#counts   SARE_HTML_POB1200        1s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_POB1200        18s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_POB1200        22s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_POB1200        0s/0h of 10826 corpus (6364s/4462h CT) 05/28/05

rawbody   SARE_HTML_FONT_LWORD     m'^<font style=font-size:1px>[a-z]{30,}\.</font><br>'i
describe  SARE_HTML_FONT_LWORD     unusual document format
score     SARE_HTML_FONT_LWORD     1.666
#hist     SARE_HTML_FONT_LWORD     Loren Wilton: LW_SPAMFERSURE
#counts   SARE_HTML_FONT_LWORD     39s/0h of 258858 corpus (114246s/144612h RM) 05/27/05
#max      SARE_HTML_FONT_LWORD     194s/0h of 400504 corpus (178155s/222349h RM) 03/31/05
#counts   SARE_HTML_FONT_LWORD     81s/0h of 54969 corpus (17793s/37176h JH-3.01) 03/13/05
#counts   SARE_HTML_FONT_LWORD     0s/0h of 31513 corpus (27912s/3601h MY) 03/09/05
#counts   SARE_HTML_FONT_LWORD     2s/0h of 10826 corpus (6364s/4462h CT) 05/28/05

full      SARE_HTML_FONT_SPLIT     /<font color=\n\n"?\#[a-f]\w[a-f]\w[a-f]\w"?>/i
describe  SARE_HTML_FONT_SPLIT     HTML bright font color tag split by blank lines
score     SARE_HTML_FONT_SPLIT     1.666
#hist     SARE_HTML_FONT_SPLIT     David B Funk <dbfunk@engineering.uiowa.edu> Wed, 17 Mar 2004 04:04:58 -0600 (CST)
#overlap  SARE_HTML_FONT_SPLIT     Overlaps strongly with SARE_HTML_A_INV, though there's no regex overlap
#overlap  SARE_HTML_FONT_SPLIT     Overlaps strongly with SARE_HTML_FONT_SPL for obvious reasons, but not enough to warrant dropping one.
#counts   SARE_HTML_FONT_SPLIT     5s/0h of 281271 corpus (109792s/171479h RM) 05/05/05
#max      SARE_HTML_FONT_SPLIT     431s/0h of 85073 corpus (62478s/22595h RM) 06/07/04
#counts   SARE_HTML_FONT_SPLIT     6s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_FONT_SPLIT     65s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_FONT_SPLIT     0s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_FONT_SPLIT     2s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#max      SARE_HTML_FONT_SPLIT     14s/0h of 6944 corpus (3188s/3756h CT) 05/19/04

########  ######################   ##################################################
#   <TITLE> Tag Tests
########  ######################   ##################################################

########  ######################   ##################################################
#  Obviously invalid html tag
########  ######################   ##################################################

header    __CT_TEXT_PLAIN          Content-Type =~ /^text\/plain\b/i
rawbody   __SARE_HTML_INV_TAG      /\w<\!\w{18,60}>\w/i
#counts   __SARE_HTML_INV_TAG      0s/0h of 56828 corpus (32234s/24594h RM) 07/25/04
#max      __SARE_HTML_INV_TAG      124s/0h of 98542 corpus (76935s/21607h RM) 05/12/04
#counts   __SARE_HTML_INV_TAG      4s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#max      __SARE_HTML_INV_TAG      20s/0h of 32906 corpus (9660s/23246h JH) 05/24/04
#counts   __SARE_HTML_INV_TAG      4s/0h of 6944 corpus (3188s/3756h CT) 05/19/04
rawbody   __SARE_HTML_INV_TAG2     m'\w</?(?!(?:blockquote|optiongroup|plaintext|fontfamily|underline|cf.+))[a-z]{9,17}>\w'
#hist     __SARE_HTML_INV_TAG2     Aug 2004: Improved by Jesse Houwing, eliminating most/all ham hits
#counts   __SARE_HTML_INV_TAG2     2963s/0h of 63826 corpus (38891s/24935h RM) 09/01/04
#counts   __SARE_HTML_INV_TAG2     772s/0h of 19469 corpus (16883s/2586h MY) 09/03/04
#counts   __SARE_HTML_INV_TAG2     739s/0h of 38766 corpus (15284s/23482h JH-SA3.0rc1) 09/03/04
rawbody   __SARE_HTML_INV_TAG3     m'\w<[/!]?(?!cf.+)\w{11,20}>\w'i
#hist     __SARE_HTML_INV_TAG3     Sep 2004: Adopted improvement from __SARE_HTML_INV_TAG2 
#counts   __SARE_HTML_INV_TAG3     3376s/0h of 63828 corpus (38892s/24936h RM) 09/02/04
#counts   __SARE_HTML_INV_TAG3     795s/0h of 19469 corpus (16883s/2586h MY) 09/03/04
#counts   __SARE_HTML_INV_TAG3     709s/0h of 38766 corpus (15284s/23482h JH-SA3.0rc1) 09/03/04
rawbody   __SARE_HTML_INV_TAG4     m'\w(?!</?cf.{1,8}>)<[/!]?[bcdfghjklmnpqrstvwxz]{5,9}>\w'i
describe  __SARE_HTML_INV_TAG4     Message contains invalid HTML tag
#hist     __SARE_HTML_INV_TAG4     Sep 2004: Adopted improvement from __SARE_HTML_INV_TAG2 
#counts   __SARE_HTML_INV_TAG4     337s/0h of 63828 corpus (38892s/24936h RM) 09/02/04
#counts   __SARE_HTML_INV_TAG4     111s/0h of 19469 corpus (16883s/2586h MY) 09/03/04
#counts   __SARE_HTML_INV_TAG4     186s/0h of 38766 corpus (15284s/23482h JH-SA3.0rc1) 09/03/04

meta      SARE_HTML_INV_TAG        ( __SARE_HTML_INV_TAG || __SARE_HTML_INV_TAG2 || __SARE_HTML_INV_TAG3 || __SARE_HTML_INV_TAG4 ) && !__CT_TEXT_PLAIN
describe  SARE_HTML_INV_TAG        Message contains invalid HTML tag
score     SARE_HTML_INV_TAG        2.222
#hist     SARE_HTML_INV_TAG        Combined three invalid-tag rules into one, added \w front and back, to test for
#hist     SARE_HTML_INV_TAG        obfuscation of surrounding text, added tests against __CT_TEXT_PLAIN to give 
#hist     SARE_HTML_INV_TAG        higher scores to HTML email than to plain text email. Enhancements due to 
#hist     SARE_HTML_INV_TAG        ideas suggested by Jesse Houwing, Nicolas Riendeau, and Bob Menschel
#counts   SARE_HTML_INV_TAG        663s/0h of 275081 corpus (134226s/140855h RM) 05/30/05
#max      SARE_HTML_INV_TAG        5650s/0h of 114422 corpus (81069s/33353h RM) 01/16/05
#counts   SARE_HTML_INV_TAG        386s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_INV_TAG        930s/0h of 38766 corpus (15284s/23482h JH-SA3.0rc1) 09/03/04
#counts   SARE_HTML_INV_TAG        0s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#max      SARE_HTML_INV_TAG        952s/0h of 19469 corpus (16883s/2586h MY) 09/03/04
#counts   SARE_HTML_INV_TAG        16s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#max      SARE_HTML_INV_TAG        66s/0h of 10826 corpus (6364s/4462h CT) 05/28/05

########  ######################   ##################################################
#   Invalid or Suspicious URI Tests
########  ######################   ##################################################

#overlap  SARE_HTML_URI_HIDADD     Overlaps completely within SARE_HTML_P_BREAK 2004-06-11
rawbody   SARE_HTML_URI_HIDADD     /(?:\&\~c\&o\&m|\&\~n\&e\&t)/i
describe  SARE_HTML_URI_HIDADD     URI with obfuscated destination 
score     SARE_HTML_URI_HIDADD     1.666
#stype    SARE_HTML_URI_HIDADD     spamp
#hist     SARE_HTML_URI_HIDADD     Fred T: FR_HIDDEN_ADDY
#overlap  SARE_HTML_URI_HIDADD     Overlaps completely within SARE_HTML_P_BREAK 2004-06-11
#counts   SARE_HTML_URI_HIDADD     183s/0h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_URI_HIDADD     817s/0h of 400504 corpus (178155s/222349h RM) 03/31/05
#counts   SARE_HTML_URI_HIDADD     0s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#max      SARE_HTML_URI_HIDADD     2s/0h of 32260 corpus (8983s/23277h JH) 05/14/04
#counts   SARE_HTML_URI_HIDADD     1s/0h of 47221 corpus (42968s/4253h MY) 06/18/05

rawbody   SARE_HTML_URI_JOKNG      /joking="\d:\d{6,14}.{0,25}>/i
describe  SARE_HTML_URI_JOKNG      URI to page name which suggests spammer's page
score     SARE_HTML_URI_JOKNG      0.944
#hist     SARE_HTML_URI_JOKNG      Fred T: FR_JOKING_EQ
#overlap  SARE_HTML_URI_JOKNG      Overlaps completely within SARE_HTML_URI_OBFU1, but no ham hits here
#counts   SARE_HTML_URI_JOKNG      0s/0h of 175738 corpus (98979s/76759h RM) 02/14/05
#max      SARE_HTML_URI_JOKNG      12s/0h of 85088 corpus (62493s/22595h RM) 06/10/04
#counts   SARE_HTML_URI_JOKNG      0s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#max      SARE_HTML_URI_JOKNG      47s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_URI_JOKNG      0s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_URI_JOKNG      11s/0h of 26326 corpus (22886s/3440h MY) 02/15/05

uri       SARE_HTML_URI_LOGOGEN    m{/logogen\.img\?}i
score     SARE_HTML_URI_LOGOGEN    1.666
describe  SARE_HTML_URI_LOGOGEN    Uses some logo generation software
#hist     SARE_HTML_URI_LOGOGEN    Jesse Houwing, Aug 19 2004
#counts   SARE_HTML_URI_LOGOGEN    0s/0h of 175738 corpus (98979s/76759h RM) 02/14/05
#max      SARE_HTML_URI_LOGOGEN    6s/0h of 65858 corpus (40621s/25237h RM) 08/19/04
#counts   SARE_HTML_URI_LOGOGEN    319s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_URI_LOGOGEN    453s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#counts   SARE_HTML_URI_LOGOGEN    0s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_URI_LOGOGEN    48s/0h of 18647 corpus (16116s/2531h MY) 08/25/04
#counts   SARE_HTML_URI_LOGOGEN    0s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#max      SARE_HTML_URI_LOGOGEN    7s/0h of 10826 corpus (6364s/4462h CT) 05/28/05

uri       SARE_HTML_URI_OFF        /http.{5,35}\boff\.(?:htm|html|php|asp|pl|cgi|jsp)\b/i
describe  SARE_HTML_URI_OFF        URI to page name which suggests spammer's page
score     SARE_HTML_URI_OFF        2.222
#hist     SARE_HTML_URI_OFF        FR_PAGE_OFF
#counts   SARE_HTML_URI_OFF        0s/0h of 258858 corpus (114246s/144612h RM) 05/27/05
#max      SARE_HTML_URI_OFF        2619s/0h of 109180 corpus (88746s/20434h RM) 04/09/04
#counts   SARE_HTML_URI_OFF        2s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_URI_OFF        89s/0h of 32260 corpus (8983s/23277h JH) 05/14/04
#counts   SARE_HTML_URI_OFF        0s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_URI_OFF        0s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#max      SARE_HTML_URI_OFF        39s/0h of 6944 corpus (3188s/3756h CT) 05/19/04

########  ######################   ##################################################
#  <!-- Comment tag tests
########  ######################   ##################################################

########  ######################   ##################################################
#   Image tag tests
########  ######################   ##################################################

rawbody   SARE_HTML_IMG_CID2       /\"cid:(?:[A-Z]{8}\.){3}[A-Z]{8}_csseditor\"/ # no /i
describe  SARE_HTML_IMG_CID2       table spam image
score     SARE_HTML_IMG_CID2       1.666
#hist     SARE_HTML_IMG_CID2       Loren Wilton, May 2005
#counts   SARE_HTML_IMG_CID2       409s/0h of 275081 corpus (134226s/140855h RM) 05/30/05
#counts   SARE_HTML_IMG_CID2       1s/0h of 4676 corpus (808s/3868h ft) 05/28/05
#counts   SARE_HTML_IMG_CID2       71s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#counts   SARE_HTML_IMG_CID2       40s/0h of 45388 corpus (41458s/3930h MY) 05/16/05
#counts   SARE_HTML_IMG_CID2       45s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05

########  ######################   ##################################################
#   Javascript and object tests     
########  ######################   ##################################################

########  ######################   ##################################################
#   Header tags
########  ######################   ##################################################

rawbody   SARE_HTML_HEAD_AFFIL     /\<h[0-9]\>.{2,30}\/.{1,3}affiliate.{1,20}\<\/h[0-9]\>/i
describe  SARE_HTML_HEAD_AFFIL     Affiliate in BOLD
score     SARE_HTML_HEAD_AFFIL     0.744
#hist     SARE_HTML_HEAD_AFFIL     Matt Yackley, Apr 15 2005
#counts   SARE_HTML_HEAD_AFFIL     2s/0h of 258858 corpus (114246s/144612h RM) 05/27/05
#max      SARE_HTML_HEAD_AFFIL     23s/0h of 292246 corpus (119174s/173072h RM) 04/15/05
#counts   SARE_HTML_HEAD_AFFIL     1s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#counts   SARE_HTML_HEAD_AFFIL     0s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_HEAD_AFFIL     10s/0h of 47221 corpus (42968s/4253h MY) 06/18/05

########  ######################   ##################################################
#   Paragraphs, breaks, and spacings
########  ######################   ##################################################

rawbody   SARE_HTML_ORIG_MSG       /^-----original message-----<br>$/
describe  SARE_HTML_ORIG_MSG       Fake replied message?
score     SARE_HTML_ORIG_MSG       1.666
#hist     SARE_HTML_ORIG_MSG       Tim Jackson, May 12, 2005
#counts   SARE_HTML_ORIG_MSG       58s/0h of 275081 corpus (134226s/140855h RM) 05/30/05
#counts   SARE_HTML_ORIG_MSG       12s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#counts   SARE_HTML_ORIG_MSG       22s/1h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_ORIG_MSG       154s/0h of 47221 corpus (42968s/4253h MY) 06/18/05

########  ######################   ##################################################
#  Suspicious tag combinations
########  ######################   ##################################################

full      SARE_HTML_CALL_ME        m'\nPhone:\s+\d{3}-[\d\-<BR>]+\nMobile:\s+\d{3}-[\d\-<BR>]+\nEmail:\s+<A href.{1,100}</A>\n</DIV></BODY></HTML>'
describe  SARE_HTML_CALL_ME        spammer sign in text
score     SARE_HTML_CALL_ME        2.222
#hist     SARE_HTML_CALL_ME        Loren Wilton: LW_CALLME
#counts   SARE_HTML_CALL_ME        1427s/0h of 271461 corpus (129860s/141601h RM) 06/12/05
#max      SARE_HTML_CALL_ME        1964s/0h of 400504 corpus (178155s/222349h RM) 03/31/05
#counts   SARE_HTML_CALL_ME        0s/0h of 54969 corpus (17793s/37176h JH-3.01) 03/13/05
#counts   SARE_HTML_CALL_ME        0s/0h of 31513 corpus (27912s/3601h MY) 03/09/05
#counts   SARE_HTML_CALL_ME        0s/0h of 11260 corpus (6568s/4692h CT) 06/17/05

full      SARE_HTML_ONE_LINE3      m'\n<html><body>\n<center>.{0,140}</center>\n</body></html>\n'
describe  SARE_HTML_ONE_LINE3      Another single-line centered HTML message
score     SARE_HTML_ONE_LINE3      1.256
#hist     SARE_HTML_ONE_LINE3      Loren Wilton: LW_SINGLELINE4
#counts   SARE_HTML_ONE_LINE3      0s/0h of 281271 corpus (109792s/171479h RM) 05/05/05
#max      SARE_HTML_ONE_LINE3      64s/0h of 70245 corpus (42816s/27429h RM) 10/02/04
#counts   SARE_HTML_ONE_LINE3      61s/0h of 54969 corpus (17793s/37176h JH-3.01) 03/13/05
#counts   SARE_HTML_ONE_LINE3      0s/0h of 19447 corpus (16862s/2585h MY) 10/06/04
#counts   SARE_HTML_ONE_LINE3      0s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#max      SARE_HTML_ONE_LINE3      1s/0h of 10826 corpus (6364s/4462h CT) 05/28/05

rawbody   SARE_HTML_LEAKTHRU1      m'^<BODY><p><(\w+)></(?:\1)><A href=\"[^"]+\"><(\w+)></(?:\2)>$'
score     SARE_HTML_LEAKTHRU1      1.111
#stype    SARE_HTML_LEAKTHRU1      spamp
#hist     SARE_HTML_LEAKTHRU1      Loren Wilton:  LW_LEAKTHRU
describe  SARE_HTML_LEAKTHRU1      Another image-only spam
#counts   SARE_HTML_LEAKTHRU1      2s/0h of 293224 corpus (119270s/173954h RM) 04/12/05
#max      SARE_HTML_LEAKTHRU1      72s/0h of 196642 corpus (96193s/100449h RM) 02/22/05
#counts   SARE_HTML_LEAKTHRU1      0s/0h of 54969 corpus (17793s/37176h JH-3.01) 03/13/05
#counts   SARE_HTML_LEAKTHRU1      22s/0h of 31513 corpus (27912s/3601h MY) 03/09/05
#counts   SARE_HTML_LEAKTHRU1      0s/0h of 11260 corpus (6568s/4692h CT) 06/17/05

rawbody   SARE_HTML_LEAKTHRU2      m'^<BODY><p><(\w+)(?:\s[\w\=]+)?></(?:\1)><A href=\"[^"]+\"><(\w+)(?:\s[\w\=]+)?></(?:\2)>$'
score     SARE_HTML_LEAKTHRU2      1.666
#stype    SARE_HTML_LEAKTHRU2      spamp
#hist     SARE_HTML_LEAKTHRU2      Loren Wilton:  LW_LEAKTHRU1
describe  SARE_HTML_LEAKTHRU2      Another image-only spam
#counts   SARE_HTML_LEAKTHRU2      3s/0h of 281271 corpus (109792s/171479h RM) 05/05/05
#max      SARE_HTML_LEAKTHRU2      178s/0h of 283600 corpus (129945s/153655h RM) 03/08/05
#counts   SARE_HTML_LEAKTHRU2      0s/0h of 54969 corpus (17793s/37176h JH-3.01) 03/13/05
#counts   SARE_HTML_LEAKTHRU2      48s/0h of 31513 corpus (27912s/3601h MY) 03/09/05
#counts   SARE_HTML_LEAKTHRU2      0s/0h of 11260 corpus (6568s/4692h CT) 06/17/05

########  ######################   ##################################################
#   Miscellaneous tag tests
########  ######################   ##################################################

########  ######################   ##################################################
#  Useless tags (tag structures that do nothing) 
#  Largely submitted by Matt Yackley, with contributions by 
#  Carl Friend, Jennifer Wheeler, Scott Sprunger, Larry Gilson
########  ######################   ##################################################

########  ######################   ##################################################
#   Tests destined for other rule sets
########  ######################   ##################################################

full      __SARE_PHISH_HTML_01a    m*<a[^<]{0,60} onMouseMove=(?:3D)?"window.status=(?:3D)?'https?://*
rawbody   __SARE_PHISH_HTML_01b    m*<a[^<]{0,60} onMouseMove=(?:3D)?"window.status=(?:3D)?'https?://*
meta      SARE_PHISH_HTML_01       __SARE_PHISH_HTML_01a || __SARE_PHISH_HTML_01b
describe  SARE_PHISH_HTML_01       Hiding actual site with fake secure site!
score     SARE_PHISH_HTML_01       2.500
#stype    SARE_PHISH_HTML_01       spamgg # phish 
#hist     SARE_PHISH_HTML_01       Loren Wilton: LW_MOUSEMOVE
#counts   SARE_PHISH_HTML_01       0s/0h of 293224 corpus (119270s/173954h RM) 04/12/05
#max      SARE_PHISH_HTML_01       17s/0h of 70245 corpus (42816s/27429h RM) 10/02/04
#counts   SARE_PHISH_HTML_01       2s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_PHISH_HTML_01       5s/0h of 54969 corpus (17793s/37176h JH-3.01) 03/13/05
#counts   SARE_PHISH_HTML_01       0s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_PHISH_HTML_01       6s/0h of 19447 corpus (16862s/2585h MY) 10/06/04
#counts   SARE_PHISH_HTML_01       0s/0h of 11260 corpus (6568s/4692h CT) 06/17/05

rawbody   __SARE_PHISH_HTML_02a    m'<a[\s\w=\.]+href=\"https?://\d+[^>]+>https://[^\d]'i
full      __SARE_PHISH_HTML_02b    m'<a[\s\w=\.]+href=\"https?://\d+[^>]+>https://[^\d]'i
meta      SARE_PHISH_HTML_02       __SARE_PHISH_HTML_02a || __SARE_PHISH_HTML_02b
score     SARE_PHISH_HTML_02       2.500 
#stype    SARE_PHISH_HTML_02       spamgg # phish 
#hist     SARE_PHISH_HTML_02       Loren Wilton: SARE_PHISH_HTML_03
describe  SARE_PHISH_HTML_02       numeric href with https description
#counts   SARE_PHISH_HTML_02       80s/0h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_PHISH_HTML_02       85s/0h of 400504 corpus (178155s/222349h RM) 03/31/05
#counts   SARE_PHISH_HTML_02       5s/0h of 54969 corpus (17793s/37176h JH-3.01) 03/13/05
#counts   SARE_PHISH_HTML_02       1s/0h of 31513 corpus (27912s/3601h MY) 03/09/05
#counts   SARE_PHISH_HTML_02       1s/0h of 10826 corpus (6364s/4462h CT) 05/28/05

rawbody   __SARE_PHISH_HTML_03     m'<a\s+[\s\w=\.]*href=\"https?://\d+[^>]+>https://[^\d]'is
full      __SARE_PHISH_HTML_03a    m'<a\s+[\s\w=\.]*href=\"https?://\d+[^>]+>https://[^\d]'is
meta      SARE_PHISH_HTML_03       __SARE_PHISH_HTML_03 || __SARE_PHISH_HTML_03a
describe  SARE_PHISH_HTML_03       numeric href with https description
score     SARE_PHISH_HTML_03       1.666
#stype    SARE_PHISH_HTML_03       spamg
#hist     SARE_PHISH_HTML_03       Loren Wilton, Feb 28 2005
#counts   SARE_PHISH_HTML_03       80s/0h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_PHISH_HTML_03       85s/0h of 400504 corpus (178155s/222349h RM) 03/31/05
#counts   SARE_PHISH_HTML_03       5s/0h of 54806 corpus (17633s/37173h JH-3.01) 03/13/05
#counts   SARE_PHISH_HTML_03       1s/0h of 10826 corpus (6364s/4462h CT) 05/28/05

# EOF


# SARE HTML Ruleset for SpamAssassin - ruleset 1
# Version: 01.03.07
# Created: 2004-03-31 
# Modified: 2005-07-02
# Usage instructions, documentation, and change history in 70_sare_html0.cf 
#@@# Revision History:  Full Revision History stored in 70_sare_html.log
#@@# 01.03.07: July 2 2005
#@@#           Minor score tweaks based on recent mass-checks
#@@#           Moved file 0 to 1: SARE_HTML_INV_TAGA
#@@#           Moved file 3 to 1: SARE_HTML_A_BODY

# License: Artistic - see http://www.rulesemporium.com/license.txt 
# Current Maintainer: Bob Menschel - RMSA@Menschel.net
# Current Home: http://www.rulesemporium.com/rules/70_sare_html1.cf 
#
########  ######################   ##################################################

header    __CTYPE_HTML             Content-Type =~ /text\/html/i

rawbody   __SARE_HTML_HAS_A        eval:html_tag_exists('a')
rawbody   __SARE_HTML_HAS_BR       eval:html_tag_exists('br')
rawbody   __SARE_HTML_HAS_DIV      eval:html_tag_exists('div')
rawbody   __SARE_HTML_HAS_FONT     eval:html_tag_exists('font')
rawbody   __SARE_HTML_HAS_IMG      eval:html_tag_exists('img')
rawbody   __SARE_HTML_HAS_P        eval:html_tag_exists('p')
rawbody   __SARE_HTML_HAS_PRE      eval:html_tag_exists('pre')
rawbody   __SARE_HTML_HAS_TITLE    eval:html_tag_exists('title')

header    __SARE_HTML_HAS_TO       To =~ /./
body      __SARE_HTML_HAS_MSG      /./
rawbody   __SARE_HTML_HBODY        m'<html><body>'i
rawbody   __SARE_HTML_BEHTML       m'<body></html>'i
rawbody   __SARE_HTML_BEHTML2      m'^</?body></html>'i
rawbody   __SARE_HTML_EFONT        m'^</font>'i
rawbody   __SARE_HTML_EHEB         m'^</html></body>'i
rawbody   __SARE_HTML_CMT_CNTR     /<center><!--/

# JH: These rules test for strange color combinations. There migth be even more powerful combinations, but I haven't had time to check them all
rawbody   __SARE_LIGHT_FG_COLOR    /[^\-a-z]color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?!fff\W|ffffff)(?:[e-f]{3}\W|(?:[e-f][0-9a-f]){3})|rgb(?:\((?!\s{0,10}255\s{0,10},\s{0,10}255\s{0,10},\s{0,10}255)\s{0,10}2[2-5][0-9]\s{0,10},\s{0,10}2[2-5][0-9]\s{0,10},\s{0,10}2[2-5][0-9]\s{0,10}\)|\((?!\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%)\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10},\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10},\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10}\))|(?:Light(?:Cyan|Yellow)|(?:Ghost|Floral)White|WhiteSmoke|LemonChiffon|AliceBlue|Cornsilk|Seashell|Honeydew|Azure|MintCream|Snow|Ivory|OldLace|LavenderBlush|Linen|MistyRose))/i
rawbody   __SARE_WHITE_FG_COLOR    /[^\-a-z]color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?:fff\W|ffffff)|rgb(?:\(\s{0,10}255\s{0,10},\s{0,10}255\s{0,10},\s{0,10}255\s{0,10}\)|\\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10}\))|white)/i
rawbody   __SARE_DARK_FG_COLOR     /[^\-a-z]color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?!000\W|000000)(?:[01]{3}\W|(?:[01][0-9a-f]){3})|rgb(?:\((?!\s{0,10}0\s{0,10},\s{0,10}0\s{0,10},\s{0,10}0\D)\s{0,10}[0-3]?[0-9]\s{0,10},\s{0,10}[0-3]?[0-9]\s{0,10},\s{0,10}[0-3]?[0-9]\s{0,10}\)|\((?!\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%)\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10},\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10},\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10}\)))/i
rawbody   __SARE_BLACK_FG_COLOR    /[^\-a-z]color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?:000\W|000000)|rgb\s{0,10}\(\s{0,10}0\s{0,10},\s{0,10}0\s{0,10},\s{0,10}0\s{0,10}\)|rgb\s{0,10}\(\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10}\)|black)/i
rawbody   __SARE_LIGHT_BG_COLOR    /(?:bg|background\-)color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?!ffffff|fff\W)(?:[e-f]{3}\W|(?:[e-f][0-9a-f]){3})|rgb(?:\((?!\s{0,10}255\s{0,10},\s{0,10}255\s{0,10},\s{0,10}255)\s{0,10}2[2-5][0-9]\s{0,10},\s{0,10}2[2-5][0-9]\s{0,10},\s{0,10}2[2-5][0-9]\s{0,10}\)|\((?!\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%)\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10},\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10},\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10}\))|(?:Light(?:Cyan|Yellow)|(?:Ghost|Floral)White|WhiteSmoke|LemonChiffon|AliceBlue|Cornsilk|Seashell|Honeydew|Azure|MintCream|Snow|Ivory|OldLace|LavenderBlush|Linen|MistyRose))/i
rawbody   __SARE_WHITE_BG_COLOR    /(?:bg|background\-)color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?:fff\W|ffffff)|rgb(?:\(\s{0,10}255\s{0,10},\s{0,10}255\s{0,10},\s{0,10}255\s{0,10}\)|\(\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10}\))|white)/i
rawbody   __SARE_DARK_BG_COLOR     /(?:bg|background\-)color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?!000\W|000000)(?:[01]{3}\W|(?:[01][0-9a-f]){3})|rgb(?:\((?!\s{0,10}0\s{0,10},\s{0,10}0\s{0,10},\s{0,10}0\D)\s{0,10}[0-3]?[0-9]\s{0,10},\s{0,10}[0-3]?[0-9]\s{0,10},\s{0,10}[0-3]?[0-9]\s{0,10}\)|\((?!\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%)\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10},\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10},\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10}\)))/i
rawbody   __SARE_BLACK_BG_COLOR    /(?:bg|background\-)color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?:000\W|000000)|rgb\s{0,10}\(\s{0,10}0\s{0,10},\s{0,10}0\s{0,10},\s{0,10}0\s{0,10}\)|rgb\s{0,10}\(\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10}\)|black)/i
rawbody   __SARE_HAS_BG_COLOR      /(?:bg|background\-)color\s{0,10}(?::|=)/i
rawbody   __SARE_HAS_FG_COLOR      /[^\-a-z]color\s{0,10}(?::|=)/i

########  ######################   ##################################################
#   Is there a message? 
########  ######################   ##################################################

########  ######################   ##################################################
#   <HTML> and <BODY> tag spamsign
########  ######################   ##################################################

rawbody   SARE_HTML_EHTML2         m'</html></html>'i
describe  SARE_HTML_EHTML2         Double end html tag
score     SARE_HTML_EHTML2         1.550
#ham      SARE_HTML_EHTML2         verified (1), HP Newsletter
#hist     SARE_HTML_EHTML2         Created by Bob Menschel Jan 28 2005
#counts   SARE_HTML_EHTML2         147s/3h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_EHTML2         1944s/0h of 175738 corpus (98979s/76759h RM) 02/14/05
#counts   SARE_HTML_EHTML2         396s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_EHTML2         31s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_EHTML2         62s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_EHTML2         142s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#max      SARE_HTML_EHTML2         213s/0h of 10826 corpus (6364s/4462h CT) 05/28/05

full      SARE_HTML_HTML_TBL       /<html>.{0,2}<table/is
describe  SARE_HTML_HTML_TBL       Message body has very strange HTML sequence
score     SARE_HTML_HTML_TBL       0.773
#hist     SARE_HTML_HTML_TBL       Fred T: FR_HTML_TABLE
#counts   SARE_HTML_HTML_TBL       157s/3h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_HTML_TBL       287s/0h of 114422 corpus (81069s/33353h RM) 01/16/05
#counts   SARE_HTML_HTML_TBL       11s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_HTML_TBL       140s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_HTML_TBL       23s/3h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_HTML_TBL       5s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#counts   SARE_HTML_HTML_TBL       0s/1h of 4676 corpus (808s/3868h ft) 05/28/05

########  ######################   ##################################################
#   <TITLE> Tag Tests
########  ######################   ##################################################

rawbody   SARE_HTML_TITLE_1WD      m'^<title>[a-z]+</title>$'  
describe  SARE_HTML_TITLE_1WD      strange document title
score     SARE_HTML_TITLE_1WD      1.252
#hist     SARE_HTML_TITLE_1WD      Loren Wilton LW_FUNNY_TITLE
#counts   SARE_HTML_TITLE_1WD      628s/4h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_TITLE_1WD      688s/1h of 196642 corpus (96193s/100449h RM) 02/22/05
#counts   SARE_HTML_TITLE_1WD      123s/2h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_TITLE_1WD      1s/0h of 4676 corpus (808s/3868h ft) 05/28/05
#counts   SARE_HTML_TITLE_1WD      100s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#counts   SARE_HTML_TITLE_1WD      151s/1h of 47221 corpus (42968s/4253h MY) 06/18/05

rawbody   SARE_HTML_TITLE_2WD      m'^<title>[a-z]+\s[a-z]+</title>$'        # no /i
score     SARE_HTML_TITLE_2WD      0.778
describe  SARE_HTML_TITLE_2WD      strange document title
#hist     SARE_HTML_TITLE_2WD      Loren Wilton LW_FUNNY_TITLE1
#counts   SARE_HTML_TITLE_2WD      77s/1h of 269462 corpus (128310s/141152h RM) 06/17/05
#counts   SARE_HTML_TITLE_2WD      6s/1h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_TITLE_2WD      19s/1h of 54089 corpus (16916s/37173h JH-3.01) 02/25/05
#counts   SARE_HTML_TITLE_2WD      15s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#counts   SARE_HTML_TITLE_2WD      22s/0h of 47221 corpus (42968s/4253h MY) 06/18/05

rawbody   SARE_HTML_TITLE_DAY      /<title>(monday|tuesday|wednesday|thursday|friday)<\/title>/i
describe  SARE_HTML_TITLE_DAY      HTML contains day of week in title
score     SARE_HTML_TITLE_DAY      0.728
#hist     SARE_HTML_TITLE_DAY      Tim Jackson, May 12 2005
#counts   SARE_HTML_TITLE_DAY      22s/1h of 269462 corpus (128310s/141152h RM) 06/17/05
#counts   SARE_HTML_TITLE_DAY      25s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#counts   SARE_HTML_TITLE_DAY      2s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_TITLE_DAY      13s/0h of 47221 corpus (42968s/4253h MY) 06/18/05

rawbody   SARE_HTML_TITLE_LWORD    /<title>[a-zA-Z]{15,}<\/title>/i
describe  SARE_HTML_TITLE_LWORD    HTML Title contains looong word
score     SARE_HTML_TITLE_LWORD    0.863
#ham      SARE_HTML_TITLE_LWORD    Rite Aid Single Check Rebates <rebates@rebates.riteaid.com>
#counts   SARE_HTML_TITLE_LWORD    150s/4h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_TITLE_LWORD    290s/5h of 175738 corpus (98979s/76759h RM) 02/14/05
#counts   SARE_HTML_TITLE_LWORD    32s/1h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_TITLE_LWORD    202s/1h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_TITLE_LWORD    3s/0h of 10826 corpus (6364s/4462h CT) 05/28/05

rawbody   SARE_HTML_TITLE_MNY      /<title>.{0,25}Money.{0,25}<\/title>/i
describe  SARE_HTML_TITLE_MNY      HTML Title implies this may be spam
score     SARE_HTML_TITLE_MNY      0.887
#hist     SARE_HTML_TITLE_MNY      Fred T: FR_TITLE_MONEY
#counts   SARE_HTML_TITLE_MNY      81s/1h of 269462 corpus (128310s/141152h RM) 06/17/05
#counts   SARE_HTML_TITLE_MNY      0s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#max      SARE_HTML_TITLE_MNY      7s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_TITLE_MNY      98s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_TITLE_MNY      0s/1h of 6944 corpus (3188s/3756h CT) 05/19/04

rawbody   SARE_HTML_TITLE_SEX      /<title>.{0,15}\bSex.{0,15}<\/title>/i
score     SARE_HTML_TITLE_SEX      0.611
#ham      SARE_HTML_TITLE_SEX      confirmed (2) 
#hist     SARE_HTML_TITLE_SEX      Fred T: FR_TITLE_SEX
#counts   SARE_HTML_TITLE_SEX      42s/4h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_TITLE_SEX      167s/2h of 196681 corpus (96193s/100488h RM) 02/22/05
#counts   SARE_HTML_TITLE_SEX      5s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_TITLE_SEX      14s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#counts   SARE_HTML_TITLE_SEX      0s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_TITLE_SEX      3s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#max      SARE_HTML_TITLE_SEX      7s/0h of 6944 corpus (3188s/3756h CT) 05/19/04

########  ######################   ##################################################
#   <A> and HREF rules          
########  ######################   ##################################################

full      SARE_HTML_A_BODY         /(?!<body>\n\n<a href)<body>.{0,4}<a href/is
describe  SARE_HTML_A_BODY         Message body has very strange HTML sequence
score     SARE_HTML_A_BODY         0.700
#hist     SARE_HTML_A_BODY         Fred T: FR_BODY_AHREF
#counts   SARE_HTML_A_BODY         403s/4h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_A_BODY         1491s/0h of 114422 corpus (81069s/33353h RM) 01/16/05
#counts   SARE_HTML_A_BODY         359s/25h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_A_BODY         30s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_A_BODY         50s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_A_BODY         66s/3h of 11260 corpus (6568s/4692h CT) 06/17/05
#max      SARE_HTML_A_BODY         92s/3h of 10826 corpus (6364s/4462h CT) 05/28/05

rawbody   __SARE_HTML_INCREDML     m{content=3D"IncrediMail}
rawbody   __SARE_HTML_A_HIDE       m{<A HREF=3D\".+}i
meta      SARE_HTML_A_HIDE         __SARE_HTML_A_HIDE && !__SARE_HTML_INCREDML
describe  SARE_HTML_A_HIDE         contains HTML anchor href with = hidden
score     SARE_HTML_A_HIDE         0.622
#ham      SARE_HTML_A_HIDE         forward of a forward, strangely wrapped mail.
#counts   SARE_HTML_A_HIDE         155s/25h of 269462 corpus (128310s/141152h RM) 06/17/05
#counts   SARE_HTML_A_HIDE         128s/1h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_A_HIDE         152s/0h of 32900 corpus (9656s/23244h JH) 05/24/04
#counts   SARE_HTML_A_HIDE         25s/2h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_A_HIDE         30s/2h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_A_HIDE         42s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#max      SARE_HTML_A_HIDE         68s/0h of 10826 corpus (6364s/4462h CT) 05/28/05

rawbody   SARE_HTML_A_NULL         m`<A href="http://www.[a-z']{2,15}.com"></A>` # no /i needed
describe  SARE_HTML_A_NULL         Useless HREF to bogus site found
score     SARE_HTML_A_NULL         0.981
#ham      SARE_HTML_A_NULL         verified (2) 
#hist     SARE_HTML_A_NULL         Loren Wilton: LW_NULL_A
#counts   SARE_HTML_A_NULL         42s/1h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_A_NULL         210s/1h of 400504 corpus (178155s/222349h RM) 03/31/05
#counts   SARE_HTML_A_NULL         109s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_A_NULL         115s/0h of 54969 corpus (17793s/37176h JH-3.01) 03/13/05
#counts   SARE_HTML_A_NULL         0s/0h of 31513 corpus (27912s/3601h MY) 03/09/05
#counts   SARE_HTML_A_NULL         2s/0h of 10826 corpus (6364s/4462h CT) 05/28/05

########  ######################   ##################################################
#   Spamsign character sets and fonts 
########  ######################   ##################################################

rawbody   __SARE_BLACK_BG_COLOR    /(?:bg|background\-)color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?:000\W|000000)|rgb\s{0,10}\(\s{0,10}0\s{0,10},\s{0,10}0\s{0,10},\s{0,10}0\s{0,10}\)|rgb\s{0,10}\(\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10}\)|black)/i
rawbody   __SARE_HTML_COLOR_WH     /<[^>]+\Wcolor(:|=(3d)?)[\s\"\']*(white|\#?FFFFFF)\b/i
rawbody   __SARE_HTML_COLOR_NWH    /<[^>]+\Wcolor(:|=(3d)?)[\s\"\']*\#?F.F.F./i
rawbody   __SARE_HTML_COLOR_NWH2   /<[^>]+\Wcolor(:|=(3d)?)[\s\"\']*\#?(E.F.F.|F.E.F.|F.F.E.)/i

meta      SARE_HTML_COLOR_NWHT2    ( __SARE_LIGHT_FG_COLOR && !__SARE_WHITE_FG_COLOR && !__SARE_BLACK_BG_COLOR && !SARE_HTML_COLOR_NWHT )
describe  SARE_HTML_COLOR_NWHT2    Light color on a white background
score     SARE_HTML_COLOR_NWHT2    0.928
#hist     SARE_HTML_COLOR_NWHT2    Jesse Houwing
#counts   SARE_HTML_COLOR_NWHT2    950s/17h of 269462 corpus (128310s/141152h RM) 06/17/05
#counts   SARE_HTML_COLOR_NWHT2    282s/8h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_COLOR_NWHT2    621s/2h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_COLOR_NWHT2    0s/2h of 4676 corpus (808s/3868h ft) 05/28/05
#counts   SARE_HTML_COLOR_NWHT2    159s/0h of 11260 corpus (6568s/4692h CT) 06/17/05

rawbody   SARE_HTML_FONT_EBEF      m'</body></font>'i
describe  SARE_HTML_FONT_EBEF      Message body has very strange HTML sequence
score     SARE_HTML_FONT_EBEF      0.692
#ham      SARE_HTML_FONT_EBEF      verified (1) 
#hist     SARE_HTML_FONT_EBEF      Fred T: FR_BODY_FONT
#counts   SARE_HTML_FONT_EBEF      24s/1h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_FONT_EBEF      44s/1h of 281655 corpus (110173s/171482h RM) 05/05/05
#counts   SARE_HTML_FONT_EBEF      36s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_FONT_EBEF      123s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_FONT_EBEF      38s/2h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_FONT_EBEF      50s/1h of 31513 corpus (27912s/3601h MY) 03/09/05

rawbody   SARE_HTML_FONT_INVIS1    /color="\#FFFFF[0-9A-E]"/i
describe  SARE_HTML_FONT_INVIS1    Message contains nearly white color text
score     SARE_HTML_FONT_INVIS1    0.712
#overlap  SARE_HTML_FONT_INVIS1    Significant overlap with SARE_HTML_COLOR_NWH1
#counts   SARE_HTML_FONT_INVIS1    1155s/61h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_FONT_INVIS1    1193s/32h of 281655 corpus (110173s/171482h RM) 05/05/05
#counts   SARE_HTML_FONT_INVIS1    570s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_FONT_INVIS1    14s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_FONT_INVIS1    26s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_FONT_INVIS1    59s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#counts   SARE_HTML_FONT_INVIS1    0s/2h of 6804 corpus (1336s/5468h ft) 06/17/05

rawbody   SARE_HTML_FONT_SPL       /^\#[a-z0-9]{6}>/i    
describe  SARE_HTML_FONT_SPL       Message uses suspicious font size and/or color
score     SARE_HTML_FONT_SPL       0.683
#ham      SARE_HTML_FONT_SPL       verified (1)
#hist     SARE_HTML_FONT_SPL       Charles Gregory 
#overlap  SARE_HTML_FONT_SPL       Overlaps strongly with SARE_HTML_A_INV, though there's no regex overlap
#overlap  SARE_HTML_FONT_SPL       Overlaps strongly with SARE_HTML_FONT_SPLIT for obvious reasons, but not enough to warrant dropping one.
#counts   SARE_HTML_FONT_SPL       1s/0h of 269462 corpus (128310s/141152h RM) 06/17/05
#counts   SARE_HTML_FONT_SPL       16s/0h of 283600 corpus (129945s/153655h RM) 03/08/05
#max      SARE_HTML_FONT_SPL       360s/0h of 85073 corpus (62478s/22595h RM) 06/07/04
#counts   SARE_HTML_FONT_SPL       5s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_FONT_SPL       53s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_FONT_SPL       1s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_FONT_SPL       0s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#max      SARE_HTML_FONT_SPL       14s/0h of 6944 corpus (3188s/3756h CT) 05/19/04

########  ######################   ##################################################
#   Invalid or Suspicious URI Tests
########  ######################   ##################################################

uri       SARE_HTML_URI_BUG        /(\%0[01]|\0).*\@/i
describe  SARE_HTML_URI_BUG        Attempted use of URI bug.
score     SARE_HTML_URI_BUG        2.000 
#stype    SARE_HTML_URI_BUG        spamg
#hist     SARE_HTML_URI_BUG        KAM_URIPARSE, from Kevin A. McGrail <kmcgrail@pccc.com>
#counts   SARE_HTML_URI_BUG        1s/0h of 258858 corpus (114246s/144612h RM) 05/27/05
#max      SARE_HTML_URI_BUG        9s/0h of 98542 corpus (76935s/21607h RM) 05/12/04
#counts   SARE_HTML_URI_BUG        0s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_URI_BUG        2s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_URI_BUG        0s/0h of 26326 corpus (22886s/3440h MY) 02/15/05

uri       SARE_HTML_URI_DEFASP     m'/default.asp\?id='i
describe  SARE_HTML_URI_DEFASP     URI to page name which suggests spammer's page
score     SARE_HTML_URI_DEFASP     0.500
#hist     SARE_HTML_URI_DEFASP     Deleted SARE_HTML_URI_X1 = LW_URI_ID due to complete overlap: /\?id\x10\x30\x34\x35/i
#counts   SARE_HTML_URI_DEFASP     7s/1h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_URI_DEFASP     34s/12h of 283600 corpus (129945s/153655h RM) 03/08/05
#counts   SARE_HTML_URI_DEFASP     0s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_URI_DEFASP     361s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_URI_DEFASP     11s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_URI_DEFASP     0s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#max      SARE_HTML_URI_DEFASP     44s/0h of 6944 corpus (3188s/3756h CT) 05/19/04

rawbody   SARE_HTML_URI_ESCWWW     /(?:%77w%77|w%77%77|%77%77w)/i
describe  SARE_HTML_URI_ESCWWW     URI with obfuscated destination 
score     SARE_HTML_URI_ESCWWW     1.344
#hist     SARE_HTML_URI_ESCWWW     Fred T: FR_ESCAPE_WWW
#overlap  SARE_HTML_URI_ESCWWW     Overlaps with SARE_HTML_FSIZE_1ALL
#counts   SARE_HTML_URI_ESCWWW     2s/0h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_URI_ESCWWW     121s/0h of 85073 corpus (62478s/22595h RM) 06/07/04
#counts   SARE_HTML_URI_ESCWWW     0s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_URI_ESCWWW     16s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_URI_ESCWWW     0s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_URI_ESCWWW     1s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_URI_ESCWWW     1s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#max      SARE_HTML_URI_ESCWWW     3s/0h of 6944 corpus (3188s/3756h CT) 05/19/04
#counts   SARE_HTML_URI_ESCWWW     1s/0h of 4676 corpus (808s/3868h ft) 05/28/05

uri       SARE_HTML_URI_LHOST30    m*^https?://[a-z0-9]{30}\.*i
describe  SARE_HTML_URI_LHOST30    Long unbroken string within URI
score     SARE_HTML_URI_LHOST30    1.111
#stype    SARE_HTML_URI_LHOST30    spamp
#hist     SARE_HTML_URI_LHOST30    Fred T (originally 40,)
#ham      SARE_HTML_URI_LHOST30    30: www.rebuildingthevillagefoundation.org
#counts   SARE_HTML_URI_LHOST30    36s/0h of 258858 corpus (114246s/144612h RM) 05/27/05
#max      SARE_HTML_URI_LHOST30    255s/0h of 98528 corpus (76921s/21607h RM) 05/12/04
#counts   SARE_HTML_URI_LHOST30    0s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_URI_LHOST30    3s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_URI_LHOST30    1s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#max      SARE_HTML_URI_LHOST30    4s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#counts   SARE_HTML_URI_LHOST30    12s/0h of 47221 corpus (42968s/4253h MY) 06/18/05

uri       SARE_HTML_URI_LHOST31    m*^https?://[a-z0-9]{31,}\.*i
describe  SARE_HTML_URI_LHOST31    Long unbroken string within URI
score     SARE_HTML_URI_LHOST31    1.639
#hist     SARE_HTML_URI_LHOST31    Fred T (originally 40,)
#ham      SARE_HTML_URI_LHOST31    30: www.rebuildingthevillagefoundation.org
#counts   SARE_HTML_URI_LHOST31    138s/0h of 258858 corpus (114246s/144612h RM) 05/27/05
#counts   SARE_HTML_URI_LHOST31    17s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_URI_LHOST31    22s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_URI_LHOST31    14s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#counts   SARE_HTML_URI_LHOST31    21s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05

uri       SARE_HTML_URI_NOMORE     m'/nomore\.htm'i
describe  SARE_HTML_URI_NOMORE     URI to page name which suggests spammer's page
score     SARE_HTML_URI_NOMORE     0.669  
#ham      SARE_HTML_URI_NOMORE     http://www.afsc.org/nomore.htm; Student Peace Action Network (SPAN)
#counts   SARE_HTML_URI_NOMORE     20s/5h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_URI_NOMORE     1200s/0h of 92209 corpus (74874s/17335h RM) 01/17/04
#counts   SARE_HTML_URI_NOMORE     54s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_URI_NOMORE     68s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_URI_NOMORE     4s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_URI_NOMORE     44s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#max      SARE_HTML_URI_NOMORE     69s/0h of 10826 corpus (6364s/4462h CT) 05/28/05

uri       SARE_HTML_URI_OC         /\?oc=\d{4,10}/
describe  SARE_HTML_URI_OC         Possible spammer sign in URL
score     SARE_HTML_URI_OC         1.666
#hist     SARE_HTML_URI_OC         LW_URI_OC
#counts   SARE_HTML_URI_OC         2s/0h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_URI_OC         440s/0h of 89461 corpus (67464s/21997h RM) 05/29/04
#counts   SARE_HTML_URI_OC         0s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_URI_OC         17s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_URI_OC         0s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#max      SARE_HTML_URI_OC         85s/0h of 13454 corpus (11339s/2115h MY) 06/02/04

uri       SARE_HTML_URI_OUTPHP     /\bout\.php/i
describe  SARE_HTML_URI_OUTPHP     text uri to unsubscribe link
score     SARE_HTML_URI_OUTPHP     1.000
#addsto   SARE_HTML_URI_OUTPHP     SARE_HTML_URI_OPTPHP
#ham      SARE_HTML_URI_OUTPHP     Bravenet ad attached to reply form email
#counts   SARE_HTML_URI_OUTPHP     26s/0h of 269462 corpus (128310s/141152h RM) 06/17/05
#counts   SARE_HTML_URI_OUTPHP     13s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_URI_OUTPHP     25s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_URI_OUTPHP     8s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_URI_OUTPHP     6s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#max      SARE_HTML_URI_OUTPHP     21s/0h of 6944 corpus (3188s/3756h CT) 05/19/04

uri       SARE_HTML_URI_PARTID     m|/[\?\&]partid=|i
describe  SARE_HTML_URI_PARTID     Partner Id in URL
score     SARE_HTML_URI_PARTID     0.699
#hist     SARE_HTML_URI_PARTID     Loren Wilton <lwilton@earthlink.net>, Sat, 3 Apr 2004 20:29:32 -0800
#counts   SARE_HTML_URI_PARTID     37s/0h of 258858 corpus (114246s/144612h RM) 05/27/05
#max      SARE_HTML_URI_PARTID     1264s/0h of 85073 corpus (62478s/22595h RM) 06/07/04
#counts   SARE_HTML_URI_PARTID     81s/6h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_URI_PARTID     302s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_URI_PARTID     26s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_URI_PARTID     37s/0h of 6944 corpus (3188s/3756h CT) 05/19/04

uri       SARE_HTML_URI_REFID      /\?refid[D=]/i
describe  SARE_HTML_URI_REFID      Spammer signature in URL
score     SARE_HTML_URI_REFID      0.760
#hist     SARE_HTML_URI_REFID      LW_URI_REFID
#ham      SARE_HTML_URI_REFID      Netmechanic.com 
#counts   SARE_HTML_URI_REFID      1075s/36h of 269462 corpus (128310s/141152h RM) 06/17/05
#counts   SARE_HTML_URI_REFID      71s/1h of 13454 corpus (11339s/2115h MY) 06/02/04
#counts   SARE_HTML_URI_REFID      55s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_URI_REFID      213s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_URI_REFID      95s/1h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_URI_REFID      137s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#max      SARE_HTML_URI_REFID      161s/0h of 10826 corpus (6364s/4462h CT) 05/28/05

uri       SARE_HTML_URI_RM         /\brm\.(?:htm|html|php|asp|pl|cgi|jsp)\b/i
describe  SARE_HTML_URI_RM         text uri to unsubscribe link
score     SARE_HTML_URI_RM         1.666
#ham      SARE_HTML_URI_RM         PC Magazine <PCMagazine@pcmag-direct.com>
#counts   SARE_HTML_URI_RM         3278s/8h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_URI_RM         3933s/6h of 196718 corpus (96193s/100525h RM) 02/22/05
#counts   SARE_HTML_URI_RM         598s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_URI_RM         17s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_URI_RM         45s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_URI_RM         220s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#counts   SARE_HTML_URI_RM         3s/0h of 6804 corpus (1336s/5468h ft) 06/17/05

uri       SARE_HTML_URI_UNSUB      /unsub\.gif/i
describe  SARE_HTML_URI_UNSUB      URI with common spammer graphic name
score     SARE_HTML_URI_UNSUB      1.666
#counts   SARE_HTML_URI_UNSUB      346s/58h of 269462 corpus (128310s/141152h RM) 06/17/05
#counts   SARE_HTML_URI_UNSUB      0s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#max      SARE_HTML_URI_UNSUB      4s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_URI_UNSUB      626s/1h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_URI_UNSUB      1s/0h of 4676 corpus (808s/3868h ft) 05/28/05
#counts   SARE_HTML_URI_UNSUB      439s/0h of 11260 corpus (6568s/4692h CT) 06/17/05

########  ######################   ##################################################
#  <!-- Comment tag tests
########  ######################   ##################################################

meta      SARE_HTML_CMT_CNTR       __SARE_HTML_CMT_CNTR
describe  SARE_HTML_CMT_CNTR       Message has a center followed by a comment
score     SARE_HTML_CMT_CNTR       0.643
#hist     SARE_HTML_CMT_CNTR       Carl F: CRM_CENTER_COM
#ham      SARE_HTML_CMT_CNTR       Strategic Developer <strategicdeveloper@newsletter.infoworld.com>, Thursday, January 27, 2005, 10:57:37 AM  
#counts   SARE_HTML_CMT_CNTR       88s/9h of 269462 corpus (128310s/141152h RM) 06/17/05
#counts   SARE_HTML_CMT_CNTR       53s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#max      SARE_HTML_CMT_CNTR       196s/0h of 32260 corpus (8983s/23277h JH) 05/14/04
#counts   SARE_HTML_CMT_CNTR       18s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_CMT_CNTR       0s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#max      SARE_HTML_CMT_CNTR       7s/0h of 6944 corpus (3188s/3756h CT) 05/19/04

########  ######################   ##################################################
#   Image tag tests
########  ######################   ##################################################

rawbody   SARE_HTML_IMG_2AT        /IMG\s*SRC\s*=s*"cid:part1\.\d{8}.\d{8}\@[a-z]+\@[\w\.]+"/is
describe  SARE_HTML_IMG_2AT        strange internal image link
score     SARE_HTML_IMG_2AT        1.666
#hist     SARE_HTML_IMG_2AT        Loren Wilton: LW_DOUBLE_AT
#hist     SARE_HTML_IMG_2AT        Apr 2 2005, Bob Menschel, Added spaces around "="
#hist     SARE_HTML_IMG_2AT        Apr 16 2005, Bob Menschel, replaced spaces with \s
#counts   SARE_HTML_IMG_2AT        2477s/0h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_IMG_2AT        2559s/0h of 258858 corpus (114246s/144612h RM) 05/27/05
#counts   SARE_HTML_IMG_2AT        57s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_IMG_2AT        105s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_IMG_2AT        2s/1h of 4676 corpus (808s/3868h ft) 05/28/05
#counts   SARE_HTML_IMG_2AT        51s/0h of 11260 corpus (6568s/4692h CT) 06/17/05

########  ######################   ##################################################
#   Javascript and object tests     
########  ######################   ##################################################

full      SARE_HTML_IMG_ONLY       m'<(?:html|body).{1,200}<a.{12,145}<img.{11,200}</(?:body|html)>'is
describe  SARE_HTML_IMG_ONLY       Short HTML msg, IMG and A HREF, maybe naught else
score     SARE_HTML_IMG_ONLY       1.666
#ham      SARE_HTML_IMG_ONLY       Verified (image-only ham)
#hist     SARE_HTML_IMG_ONLY       Originally Fred T: FVGT_m_IMAGE_ONLY
#hist     SARE_HTML_IMG_ONLY       Enhanced May 29 2004 by Bob Menschel, incorporate all tests in one regex
#ham      SARE_HTML_IMG_ONLY       5: Oct 2002 Yahoo webmail with automatically inserted FAULTY flamingtext.com advertisement
#overlap  SARE_HTML_IMG_ONLY       Rules that completely overlap this one: SARE_HTML_PILL3, SARE_HTML_PILL4
#counts   SARE_HTML_IMG_ONLY       854s/1h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_IMG_ONLY       2697s/0h of 114422 corpus (81069s/33353h RM) 01/16/05
#counts   SARE_HTML_IMG_ONLY       261s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_IMG_ONLY       553s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_IMG_ONLY       49s/2h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_IMG_ONLY       141s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_IMG_ONLY       1s/1h of 6804 corpus (1336s/5468h ft) 06/17/05
#counts   SARE_HTML_IMG_ONLY       92s/1h of 11260 corpus (6568s/4692h CT) 06/17/05

rawbody   SARE_HTML_JSCRIPT_ENC    /language=(?:3D)?\"JScript.Encode\"/i
score     SARE_HTML_JSCRIPT_ENC    0.911
describe  SARE_HTML_JSCRIPT_ENC    Uses encoded JScript in a message
#hist     SARE_HTML_JSCRIPT_ENC    Jesse Houwing Sep 4 2004
#counts   SARE_HTML_JSCRIPT_ENC    0s/0h of 196681 corpus (96193s/100488h RM) 02/22/05
#max      SARE_HTML_JSCRIPT_ENC    25s/0h of 114422 corpus (81069s/33353h RM) 01/16/05
#counts   SARE_HTML_JSCRIPT_ENC    33s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_JSCRIPT_ENC    38s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#counts   SARE_HTML_JSCRIPT_ENC    0s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_JSCRIPT_ENC    1s/0h of 26326 corpus (22886s/3440h MY) 02/15/05

rawbody   SARE_HTML_JVS_FLASH      m'codebase="https://download\.macromedia\.com/pub/shockwave'i
describe  SARE_HTML_JVS_FLASH      Tries to load flash animation 
score     SARE_HTML_JVS_FLASH      0.662
#ham      SARE_HTML_JVS_FLASH      verified (1) cbs.marketwatch.com
#hist     SARE_HTML_JVS_FLASH      Mike Kuentz <JunkEmail@rapidigm.com>
#counts   SARE_HTML_JVS_FLASH      45s/3h of 258858 corpus (114246s/144612h RM) 05/27/05
#max      SARE_HTML_JVS_FLASH      114s/0h of 196718 corpus (96193s/100525h RM) 02/22/05
#counts   SARE_HTML_JVS_FLASH      0s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#max      SARE_HTML_JVS_FLASH      7s/0h of 29366 corpus (5882s/23484h JH) 07/23/04 TM2 SA3.0-pre2
#counts   SARE_HTML_JVS_FLASH      28s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_JVS_FLASH      4s/0h of 11260 corpus (6568s/4692h CT) 06/17/05

########  ######################   ##################################################
#  Obviously invalid html tag
########  ######################   ##################################################

meta      SARE_HTML_INV_TAGA       ( __SARE_HTML_INV_TAG || __SARE_HTML_INV_TAG2 || __SARE_HTML_INV_TAG3 || __SARE_HTML_INV_TAG4 ) && __CT_TEXT_PLAIN
describe  SARE_HTML_INV_TAGA       Plain text email contains invalid HTML tag 
score     SARE_HTML_INV_TAGA       0.555
#ham      SARE_HTML_INV_TAGA       source code in plain text email
#hist     SARE_HTML_INV_TAGA       Combined three invalid-tag rules into one, added \w front and back, to test for
#hist     SARE_HTML_INV_TAGA       obfuscation of surrounding text, added tests against __CT_TEXT_PLAIN to give 
#hist     SARE_HTML_INV_TAGA       higher scores to HTML email than to plain text email. Enhancements due to 
#hist     SARE_HTML_INV_TAGA       ideas suggested by Jesse Houwing, Nicolas Riendeau, and Bob Menschel
#counts   SARE_HTML_INV_TAGA       0s/1h of 271461 corpus (129860s/141601h RM) 06/12/05
#max      SARE_HTML_INV_TAGA       5s/0h of 114422 corpus (81069s/33353h RM) 01/16/05
#counts   SARE_HTML_INV_TAGA       0s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_INV_TAGA       6s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#counts   SARE_HTML_INV_TAGA       0s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#max      SARE_HTML_INV_TAGA       5s/0h of 19469 corpus (16883s/2586h MY) 09/03/04
#counts   SARE_HTML_INV_TAGA       0s/0h of 10826 corpus (6364s/4462h CT) 05/28/05

########  ######################   ##################################################
#   Paragraphs, breaks, and spacings
########  ######################   ##################################################

rawbody   SARE_HTML_BR_MANY        /<br>{5}/i
describe  SARE_HTML_BR_MANY        Too many sequential identical HTML tags
score     SARE_HTML_BR_MANY        0.555
#stype    SARE_HTML_BR_MANY        spamp
#counts   SARE_HTML_BR_MANY        2s/0h of 258858 corpus (114246s/144612h RM) 05/27/05
#counts   SARE_HTML_BR_MANY        0s/0h of 29365 corpus (5882s/23483h JH) 08/14/04 TM2 SA3.0-pre2
#counts   SARE_HTML_BR_MANY        0s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_BR_MANY        0s/0h of 47221 corpus (42968s/4253h MY) 06/18/05

########  ######################   ##################################################
#  Suspicious tag combinations
########  ######################   ##################################################

rawbody   SARE_HTML_CNTR_TBL       /<center>\s*<table>/im
describe  SARE_HTML_CNTR_TBL       Contains centred table
score     SARE_HTML_CNTR_TBL       0.853
#ham      SARE_HTML_CNTR_TBL       verified (1) 
#hist     SARE_HTML_CNTR_TBL       Tim Jackson, May 25 2005
#counts   SARE_HTML_CNTR_TBL       80s/1h of 269462 corpus (128310s/141152h RM) 06/17/05
#counts   SARE_HTML_CNTR_TBL       2s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#max      SARE_HTML_CNTR_TBL       3s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#counts   SARE_HTML_CNTR_TBL       0s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_CNTR_TBL       25s/0h of 47221 corpus (42968s/4253h MY) 06/18/05

rawbody   SARE_HTML_ONE_LINE1      m'<html><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"></head><body><p><a href="http://\w+\.\w+\.info/'
describe  SARE_HTML_ONE_LINE1      standard spam formatting
score     SARE_HTML_ONE_LINE1      1.111
#stype    SARE_HTML_ONE_LINE1      spamp 
#hist     SARE_HTML_ONE_LINE1      Loren Wilton, LW_SINGLELINE2, Sep 5 2004
#counts   SARE_HTML_ONE_LINE1      0s/0h of 281655 corpus (110173s/171482h RM) 05/05/05
#max      SARE_HTML_ONE_LINE1      25s/0h of 114422 corpus (81069s/33353h RM) 01/16/05
#counts   SARE_HTML_ONE_LINE1      1s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#counts   SARE_HTML_ONE_LINE1      0s/0h of 26326 corpus (22886s/3440h MY) 02/15/05

rawbody   SARE_HTML_ONE_LINE2      m'<body><p><a href="http://\w+\.\w+\.info/\?[\w\.]+"><IMG SRC="cid:[\w\@\.]+" border="0" ALT=""></a>'
describe  SARE_HTML_ONE_LINE2      standard spam formatting
score     SARE_HTML_ONE_LINE2      1.111
#stype    SARE_HTML_ONE_LINE2      spamp 
#hist     SARE_HTML_ONE_LINE2      Loren Wilton, LW_SINGLELINE4 Sep 5 2004
#counts   SARE_HTML_ONE_LINE2      0s/0h of 281655 corpus (110173s/171482h RM) 05/05/05
#max      SARE_HTML_ONE_LINE2      22s/0h of 114422 corpus (81069s/33353h RM) 01/16/05
#counts   SARE_HTML_ONE_LINE2      1s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#counts   SARE_HTML_ONE_LINE2      5s/0h of 26326 corpus (22886s/3440h MY) 02/15/05

########  ######################   ##################################################
#  Useless tags (tag structures that do nothing) 
#  Largely submitted by Matt Yackley, with contributions by 
#  Carl Friend, Jennifer Wheeler, Scott Sprunger, Larry Gilson
########  ######################   ##################################################

rawbody   SARE_HTML_USL_FONT       m'^<FONT[^>]{0,20}></FONT><'
describe  SARE_HTML_USL_FONT       Another spam attempt
score     SARE_HTML_USL_FONT       1.666
#hist     SARE_HTML_USL_FONT       Loren Wilton Apr 11 2005
#counts   SARE_HTML_USL_FONT       5192s/1h of 269462 corpus (128310s/141152h RM) 06/17/05
#counts   SARE_HTML_USL_FONT       9s/0h of 6804 corpus (1336s/5468h ft) 06/17/05
#counts   SARE_HTML_USL_FONT       1s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#counts   SARE_HTML_USL_FONT       7s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_USL_FONT       618s/1h of 47221 corpus (42968s/4253h MY) 06/18/05

rawbody   SARE_HTML_USL_OBFU       m'\w<(\w+)(?: [^>]*)?></\1[^>]*>\w'
describe  SARE_HTML_USL_OBFU       Message body has very strange HTML sequence
score     SARE_HTML_USL_OBFU       1.257
#match    SARE_HTML_USL_OBFU       partialword<tag></tag>restofword
#hist     SARE_HTML_USL_OBFU       Created by Bob Menschel Aug 12 2004
#counts   SARE_HTML_USL_OBFU       337s/5h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_USL_OBFU       520s/6h of 196718 corpus (96193s/100525h RM) 02/22/05
#counts   SARE_HTML_USL_OBFU       298s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_USL_OBFU       457s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#counts   SARE_HTML_USL_OBFU       113s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_USL_OBFU       148s/0h of 17145 corpus (14677s/2468h MY) 08/12/04
#counts   SARE_HTML_USL_OBFU       3s/0h of 6804 corpus (1336s/5468h ft) 06/17/05
#counts   SARE_HTML_USL_OBFU       7s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#max      SARE_HTML_USL_OBFU       16s/0h of 10826 corpus (6364s/4462h CT) 05/28/05

########  ######################   ##################################################
#   Miscellaneous tag tests
########  ######################   ##################################################

# EOF


# SARE HTML Ruleset for SpamAssassin - ruleset 2
# Version: 01.03.07
# Created: 2004-03-31 
# Modified: 2005-07-02
# Usage instructions, documentation, and change history in 70_sare_html0.cf 
#@@# Revision History:  Full Revision History stored in 70_sare_html.log
#@@# 01.03.07: July 2 2005
#@@#           Minor score tweaks based on recent mass-checks

# License: Artistic - see http://www.rulesemporium.com/license.txt 
# Current Maintainer: Bob Menschel - RMSA@Menschel.net
# Current Home: http://www.rulesemporium.com/rules/70_sare_html2.cf 
#
########  ######################   ##################################################

rawbody   __SARE_HTML_HAS_A        eval:html_tag_exists('a')
rawbody   __SARE_HTML_HAS_BR       eval:html_tag_exists('br')
rawbody   __SARE_HTML_HAS_DIV      eval:html_tag_exists('div')
rawbody   __SARE_HTML_HAS_FONT     eval:html_tag_exists('font')
rawbody   __SARE_HTML_HAS_IMG      eval:html_tag_exists('img')
rawbody   __SARE_HTML_HAS_P        eval:html_tag_exists('p')
rawbody   __SARE_HTML_HAS_PRE      eval:html_tag_exists('pre')
rawbody   __SARE_HTML_HAS_TITLE    eval:html_tag_exists('title')

header    __SARE_HTML_HAS_TO       To =~ /./
body      __SARE_HTML_HAS_MSG      /./
rawbody   __SARE_HTML_HBODY        m'<html><body>'i
rawbody   __SARE_HTML_BEHTML       m'<body></html>'i
rawbody   __SARE_HTML_BEHTML2      m'^</?body></html>'i
rawbody   __SARE_HTML_EFONT        m'^</font>'i
rawbody   __SARE_HTML_EHEB         m'^</html></body>'i
rawbody   __SARE_HTML_CMT_CNTR     /<center><!--/

########  ######################   ##################################################
#   Spamsign character sets and fonts 
########  ######################   ##################################################

rawbody   SARE_HTML_COLOR_D        /(?:style="?|<style[^>]*>)[^>"]*[^-]color\s*:\s*rgb\(\s*(?:100|9[0-9]|8[6-9])\s*%\s*,\s*(?:100|9[0-9]|8[6-9])\s*%\s*,\s*(?:100|9[0-9]|8[6-9])\s*%\s*\)[^>]*>/i
describe  SARE_HTML_COLOR_D        BAD STYLE: color: too light (rgb(%))
score     SARE_HTML_COLOR_D        0.100
#hist     SARE_HTML_COLOR_D        From Jesse Houwing May 14 2004
#counts   SARE_HTML_COLOR_D        0s/0h of 98435 corpus (76828s/21607h RM) 05/14/04
#counts   SARE_HTML_COLOR_D        0s/0h of 29365 corpus (5882s/23483h JH) 08/14/04 TM2 SA3.0-pre2

########  ######################   ##################################################
#  <FRAME> Tag Tests
########  ######################   ##################################################

rawbody   SARE_HTML_NOFRAMES       /<frame><noframes>\w*<\/noframes><\/frame>/i
describe  SARE_HTML_NOFRAMES       Body appears to hide anti-anti-spam text in frame
score     SARE_HTML_NOFRAMES       1.000
#counts   SARE_HTML_NOFRAMES       0s/0h of 98542 corpus (76935s/21607h RM) 05/12/04
#max      SARE_HTML_NOFRAMES       96 spam, 0 ham, Sep 5 2003
#counts   SARE_HTML_NOFRAMES       0s/0h of 29365 corpus (5882s/23483h JH) 08/14/04 TM2 SA3.0-pre2

########  ######################   ##################################################
#   Invalid or Suspicious URI Tests
########  ######################   ##################################################

rawbody   SARE_HTML_URI_GBYE       />Good Bye<\/a>/i
describe  SARE_HTML_URI_GBYE       text has URL to spammer's unsubscribe link
score     SARE_HTML_URI_GBYE       0.100
#counts   SARE_HTML_URI_GBYE       0s/0h of 98542 corpus (76935s/21607h RM) 05/12/04
#counts   SARE_HTML_URI_GBYE       0s/0h of 29365 corpus (5882s/23483h JH) 08/14/04 TM2 SA3.0-pre2

uri       SARE_HTML_URI_HIDE1      /:ac=[A-Z,a-z,0-9,@,!,;]+/
describe  SARE_HTML_URI_HIDE1      URI attempts to hide destination domain
score     SARE_HTML_URI_HIDE1      0.100
#counts   SARE_HTML_URI_HIDE1      0s/0h of 98542 corpus (76935s/21607h RM) 05/12/04
#counts   SARE_HTML_URI_HIDE1      0s/0h of 29365 corpus (5882s/23483h JH) 08/14/04 TM2 SA3.0-pre2

########  ######################   ##################################################
#  <tag ... ALT= ...> tag tests
########  ######################   ##################################################

rawbody   SARE_HTML_ALT_WAIT1      /alt=.{0,10}please wait/i
describe  SARE_HTML_ALT_WAIT1      Asks you to wait while SPAM loads.
score     SARE_HTML_ALT_WAIT1      0.100
#counts   SARE_HTML_ALT_WAIT1      0s/0h of 98542 corpus (76935s/21607h RM) 05/12/04
#counts   SARE_HTML_ALT_WAIT1      0s/0h of 29365 corpus (5882s/23483h JH) 08/14/04 TM2 SA3.0-pre2

########  ######################   ##################################################
#  <!-- Comment tag tests
########  ######################   ##################################################

rawbody   SARE_HTML_CMT_MONEY      /<\!--\${1,10}-->/i
describe  SARE_HTML_CMT_MONEY      HTML Comment seems to mention money
score     SARE_HTML_CMT_MONEY      0.100
#counts   SARE_HTML_CMT_MONEY      0s/0h of 98542 corpus (76935s/21607h RM) 05/12/04
#counts   SARE_HTML_CMT_MONEY      0s/0h of 29365 corpus (5882s/23483h JH) 08/14/04 TM2 SA3.0-pre2

########  ######################   ##################################################
#   Image tag tests
########  ######################   ##################################################

rawbody   SARE_HTML_GIF_NUM        /\.gif\d{2,}/i
describe  SARE_HTML_GIF_NUM        HTML contains tracking numbers after .gif
score     SARE_HTML_GIF_NUM        0.100
#counts   SARE_HTML_GIF_NUM        0s/0h of 98542 corpus (76935s/21607h RM) 05/12/04
#counts   SARE_HTML_GIF_NUM        0s/0h of 29365 corpus (5882s/23483h JH) 08/14/04 TM2 SA3.0-pre2

########  ######################   ##################################################
#   Paragraphs, breaks, and spacings
########  ######################   ##################################################

########  ######################   ##################################################
#   Javascript and object tests     
########  ######################   ##################################################

rawbody   SARE_HTML_JVS_POPUP      /<body onload \= \"window\.open/i
describe  SARE_HTML_JVS_POPUP      Bad HTML form.  Tries to load a javascript pop up.
score     SARE_HTML_JVS_POPUP      0.100
#counts   SARE_HTML_JVS_POPUP      0s/0h of 98542 corpus (76935s/21607h RM) 05/12/04
#counts   SARE_HTML_JVS_POPUP      0s/0h of 29365 corpus (5882s/23483h JH) 08/14/04 TM2 SA3.0-pre2

########  ######################   ##################################################
#   Miscellaneous tag tests
########  ######################   ##################################################

########  ######################   ##################################################
#  Useless tags (tag structures that do nothing) 
#  Largely submitted by Matt Yackley, with contributions by 
#  Carl Friend, Jennifer Wheeler, Scott Sprunger, Larry Gilson
########  ######################   ##################################################

rawbody   SARE_HTML_USL_B7         /(<b><\/b>.{1,5}){7,8}/i
describe  SARE_HTML_USL_B7         Multiple <b></b> (7-8)
score     SARE_HTML_USL_B7         0.100
#counts   SARE_HTML_USL_B7         0s/0h of 98542 corpus (76935s/21607h RM) 05/12/04
#counts   SARE_HTML_USL_B7         0s/0h of 29365 corpus (5882s/23483h JH) 08/14/04 TM2 SA3.0-pre2

rawbody   SARE_HTML_USL_B9         /(<b><\/b>.{1,5}){9,10}/i
describe  SARE_HTML_USL_B9         Multiple <b></b> (9-10)
score     SARE_HTML_USL_B9         0.100
#counts   SARE_HTML_USL_B9         0s/0h of 98542 corpus (76935s/21607h RM) 05/12/04
#counts   SARE_HTML_USL_B9         0s/0h of 29365 corpus (5882s/23483h JH) 08/14/04 TM2 SA3.0-pre2

# EOF

# SARE HTML Ruleset for SpamAssassin - ruleset 3
# Version: 01.03.07
# Created: 2004-03-31 
# Modified: 2005-07-02
# Usage instructions, documentation, and change history in 70_sare_html0.cf 
#@@# Revision History:  Full Revision History stored in 70_sare_html.log
#@@# 01.03.07: July 2 2005
#@@#           Minor score tweaks based on recent mass-checks
#@@#           Archived from file 3: SARE_HTML_URI_ENC_AT
#@@#           Moved file 3 to 1: SARE_HTML_A_BODY

# License: Artistic - see http://www.rulesemporium.com/license.txt 
# Current Maintainer: Bob Menschel - RMSA@Menschel.net
# Current Home: http://www.rulesemporium.com/rules/70_sare_html3.cf 
#
########  ######################   ##################################################

rawbody   __SARE_HTML_HAS_A        eval:html_tag_exists('a')
rawbody   __SARE_HTML_HAS_BR       eval:html_tag_exists('br')
rawbody   __SARE_HTML_HAS_DIV      eval:html_tag_exists('div')
rawbody   __SARE_HTML_HAS_FONT     eval:html_tag_exists('font')
rawbody   __SARE_HTML_HAS_IMG      eval:html_tag_exists('img')
rawbody   __SARE_HTML_HAS_P        eval:html_tag_exists('p')
rawbody   __SARE_HTML_HAS_PRE      eval:html_tag_exists('pre')
rawbody   __SARE_HTML_HAS_TITLE    eval:html_tag_exists('title')

header    __SARE_HTML_HAS_TO       To =~ /./
body      __SARE_HTML_HAS_MSG      /./
rawbody   __SARE_HTML_HBODY        m'<html><body>'i
rawbody   __SARE_HTML_BEHTML       m'<body></html>'i
rawbody   __SARE_HTML_BEHTML2      m'^</?body></html>'i
rawbody   __SARE_HTML_EFONT        m'^</font>'i
rawbody   __SARE_HTML_EHEB         m'^</html></body>'i
rawbody   __SARE_HTML_CMT_CNTR     /<center><!--/

########  ######################   ##################################################
#   Is there a message? 
########  ######################   ##################################################

meta      SARE_HTML_EMPTY          __CTYPE_HTML && !( __SARE_HTML_HAS_TITLE ||  __TAG_EXISTS_HTML || __SARE_HTML_HAS_FONT || __TAG_EXISTS_BODY || __SARE_HTML_HAS_PRE || __SARE_HTML_HAS_DIV || __SARE_HTML_HAS_P || __SARE_HTML_HAS_A || __SARE_HTML_HAS_BR )
describe  SARE_HTML_EMPTY          Email is HTML format, but common tags not found
score     SARE_HTML_EMPTY          0.063
#ham      SARE_HTML_EMPTY          An "html" format email, 30 Oct 2002, Microsoft Outlook Express 6.00.2600.0000, that used no tags, just one long textual paragraph
#counts   SARE_HTML_EMPTY          159s/18h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_EMPTY          300s/19h of 258858 corpus (114246s/144612h RM) 05/27/05
#counts   SARE_HTML_EMPTY          28s/1h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_EMPTY          32s/2h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#counts   SARE_HTML_EMPTY          5s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_EMPTY          132s/2h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_EMPTY          12s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#counts   SARE_HTML_EMPTY          1s/171h of 6804 corpus (1336s/5468h ft) 06/17/05

meta      SARE_HTML_NO_BODY_TO     ( !__SARE_HTML_HAS_MSG && !__SARE_HTML_HAS_TO ) 
describe  SARE_HTML_NO_BODY_TO     Message is empty and has no To destination
score     SARE_HTML_NO_BODY_TO     0.227
#ham      SARE_HTML_NO_BODY_TO     verified (1) 
#AddsTo   SARE_HTML_NO_BODY_TO     SARE_HTML_NO_BODY 
#counts   SARE_HTML_NO_BODY_TO     296s/83h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_NO_BODY_TO     942s/0h of 89684 corpus (67687s/21997h RM) 05/23/04
#counts   SARE_HTML_NO_BODY_TO     18s/2h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_NO_BODY_TO     45s/1h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_NO_BODY_TO     60s/1h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_NO_BODY_TO     0s/1h of 10826 corpus (6364s/4462h CT) 05/28/05

########  ######################   ##################################################
#   <HTML> and <BODY> tag spamsign
########  ######################   ##################################################

rawbody   __SARE_HTML_BODY_END2    m'</body[^>]*>.*</body[^>]*>'i
meta      SARE_HTML_BODY_END2      __SARE_HTML_BODY_END2 
describe  SARE_HTML_BODY_END2      Double </body>
score     SARE_HTML_BODY_END2      0.521
#hist     SARE_HTML_BODY_END2      Contrib by Matt Keller June 7 2004
#note     SARE_HTML_BODY_END2      Add/remove HTML_MESSAGE test has no effect
#counts   SARE_HTML_BODY_END2      36s/5h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_BODY_END2      163s/13h of 281655 corpus (110173s/171482h RM) 05/05/05
#counts   SARE_HTML_BODY_END2      15s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_BODY_END2      63s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_BODY_END2      20s/2h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_BODY_END2      4s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#max      SARE_HTML_BODY_END2      6s/0h of 10826 corpus (6364s/4462h CT) 05/28/05

rawbody   SARE_HTML_HTML_DBL       /<html[^>]*><html[^>]*>/i
describe  SARE_HTML_HTML_DBL       Message body has very strange HTML sequence
score     SARE_HTML_HTML_DBL       0.724
#ham      SARE_HTML_HTML_DBL       Verified (several), common to various opt-in lists.
#hist     SARE_HTML_HTML_DBL       Fred T: FR_HTML_HTML
#hist     SARE_HTML_HTML_DBL       2004-06-11: [^>]* added by Bob Menschel
#counts   SARE_HTML_HTML_DBL       51s/2h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_HTML_DBL       168s/0h of 65984 corpus (40739s/25245h RM) 08/21/04
#counts   SARE_HTML_HTML_DBL       25s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#max      SARE_HTML_HTML_DBL       75s/0h of 32906 corpus (9660s/23246h JH) 05/24/04
#counts   SARE_HTML_HTML_DBL       9s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_HTML_DBL       6s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#max      SARE_HTML_HTML_DBL       9s/0h of 6944 corpus (3188s/3756h CT) 05/19/04

########  ######################   ##################################################
#   <TITLE> Tag Tests
########  ######################   ##################################################

########  ######################   ##################################################
#   <A> and HREF rules          
########  ######################   ##################################################

########  ######################   ##################################################
#   Spamsign character sets and fonts 
########  ######################   ##################################################

rawbody   SARE_HTML_COLOR_B        /(?:style="?|<style[^>]*>)[^>"]*[^-]color\s*:\s*rgb\(\s*2[2-5][0-9]\s*,\s*2[2-5][0-9]\s*,\s*2[2-5][0-9]\s*\)[^>]*>/i
describe  SARE_HTML_COLOR_B        BAD STYLE: color: too light (rgb(n))
score     SARE_HTML_COLOR_B        0.073
#hist     SARE_HTML_COLOR_B        From Jesse Houwing May 14 2004
#counts   SARE_HTML_COLOR_B        10s/12h of 269462 corpus (128310s/141152h RM) 06/17/05
#counts   SARE_HTML_COLOR_B        3s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_COLOR_B        5s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#counts   SARE_HTML_COLOR_B        4s/0h of 47221 corpus (42968s/4253h MY) 06/18/05

meta      SARE_HTML_COLOR_NWHT     ( __SARE_HTML_COLOR_NWH || __SARE_HTML_COLOR_NWH2 ) && !__SARE_HTML_COLOR_WH && !__SARE_BLACK_BG_COLOR 
describe  SARE_HTML_COLOR_NWHT     HTML contains nearly white color (F.F.F.)
score     SARE_HTML_COLOR_NWHT     0.543
#hist     SARE_HTML_COLOR_NWHT     Contrib by Matt Keller June 7 2004
#counts   SARE_HTML_COLOR_NWHT     1159s/194h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_COLOR_NWHT     1305s/41h of 196718 corpus (96193s/100525h RM) 02/22/05
#counts   SARE_HTML_COLOR_NWHT     725s/12h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_COLOR_NWHT     835s/12h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#counts   SARE_HTML_COLOR_NWHT     101s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_COLOR_NWHT     214s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_COLOR_NWHT     0s/4h of 6804 corpus (1336s/5468h ft) 06/17/05
#counts   SARE_HTML_COLOR_NWHT     78s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#max      SARE_HTML_COLOR_NWHT     106s/0h of 10826 corpus (6364s/4462h CT) 05/28/05

rawbody   SARE_HTML_INV_CHARSET    /charset=(?:3D)?(?!3D)(?:["']|&quot;|\s)*(?!['"]|&quot;|\s)(?!$|x-euc-jp|Cp1252|iso-8851-15|windows-874|ansi|unicode|437|8(?:5[01257]|6[0123569])|904|a(?:dobe\-s(?:tandard|ymbol)\-encoding|mi(?:ga\-?|\-)?1251|nsi_x3\.(?:110\-1983|4\-19(?:68|86))|rabic7?|s(?:cii|mo(?:\-708|_449)))|b(?:ig5(?:\-hkscs)?|ocu\-1|s_(?:4730|viewdata))|c(?:csid0(?:0(?:858|924)|114[0123456789])|esu\-8|hinese|p(?:0(?:0(?:858|924)|114[0123456789]|3[78])|1(?:026|54)|2(?:7[3458]|8[0145]|9[07])|367|4(?:2[034]|37)|500|775|8(?:19|5[01257]|6\d|7[01]|80|91)|9(?:0[345]|18|36)|\-(?:ar|gr|is))|s(?:a(?:7\-[12]|_(?:t500\-1983|z243\.4\-1985\-(?:gr|[12]))|dobestandardencoding|scii)|b(?:ig5|ocu\-1)|cesu\-8|d(?:ecmc|ku)s|e(?:bcdic(?:atdea|cafr|dknoa?|es[as]?|f(?:isea?|r)|it|pt|u[ks])|uc(?:fixwidjapanese|kr|pkdfmtjapanese))|gb2312|h(?:alfwidthkatakana|p(?:desktop|legal|math8|p(?:ifont|smath)|roman8))|i(?:b(?:bm904|m(?:03[78]|1026|2(?:7[34578]|8[0145]|9[07])|42[034]|500|8(?:5[157]|6[01345689]|7[01]|80|91)|9(?:0[35]|18)|ebcdicatde|symbols|thai))|nvariant|so(?:1(?:0(?:2t617bit|3(?:67box|t618bit)|646utf1|swedish)|1(?:1ecmacyrillic|swedishfornames)|2(?:1canadian1|2canadian2|3csaz24341985gr|8t101g2)|3(?:9csn369103|jisc6220jp)|4(?:1jusib1002|3iecp271|6serbian|7macedonian|jisc6220ro)|5(?:0greekccitt|1cuba|3gost1976874|8lap|9jisx02121990|italian|0)|6portuguese|7spanish|8greek7old|9latingreek)|2(?:0(?:22(?:jp2?|kr)|33)|1german|5french|7latingreek1|intlrefversion)|4(?:2jisc62261978|7bsviewdata|9inis|unitedkingdom)|5(?:0inis8|1iniscyrillic|42(?:7cyrillic|8greek)|7gb1988|8gb231280)|6(?:0(?:danishnorwegian|norwegian1)|1norwegian2|46(?:basic1983|danish)|9(?:37add|french))|70videotexsupp1|8(?:4portuguese2|5spanish2|6hungarian|7jisx0208|8(?:59(?:6[ei]|8[ei]|supp)|greek7)|9asmo449)|9(?:1jisc62291984a|2jisc62991984b|3jis62291984badd|4jis62291984hand|5jis62291984handadd|6jisc62291984kana|9naplps|0)|latin(?:arabic|cyrillic|greek|hebrew|[123456])|textcomm))|jisencoding|k(?:oi8r|sc56(?:011987|36))|m(?:acintosh|icrosoftpublishing|nem(?:onic)?)|n(?:_369103|ats(?:dano(?:add)?|sefi(?:add)?))|p(?:c(?:775baltic|8(?:50multilingual|62latinhebrew|codepage437|danishnorwegian|turkish)|p852)|tcp154)|shiftjis|u(?:cs4|n(?:icode(?:11(?:utf7)?|ascii|ibm12(?:6[1458]|76)|latin1)?|known8bit)|sdk)|v(?:entura(?:international|math|us)|i(?:qr|scii))|windows3(?:0latin1|1(?:latin[125]|j)))|uba|yrillic(?:\-asian)?|[an])|d(?:ec(?:\-mcs)?|in_66003|k\-us|s_?2089|[ek])|e(?:13b|bcdic\-(?:at\-de(?:\-a)?|b[er]|c(?:a\-fr|p\-(?:ar[12]|be|c[ah]|dk|es|f[ir]|g[br]|he|i[st]|n[lo]|roece|se|tr|us|wt|yu)|yrillic)|d(?:e\-273\+euro|k\-(?:277\+euro|no(?:\-a)?))|es(?:\-(?:284\+euro|[as]))?|f(?:i\-(?:278\+euro|se(?:\-a)?)|r\-297\+euro|r)|gb\-285\+euro|i(?:nt(?:ernational\-500\+euro)?|s\-871\+euro|t\-280\+euro|t)|jp\-(?:kana|e)|latin9\-\-euro|no\-277\+euro|pt|se\-278\+euro|u(?:s\-37\+euro|[ks]))|cma\-(?:11[48]|cyrillic)|lot_928|s2|uc\-(?:jp|kr)|xtended_unix_code_(?:fixed_width|packed_format)_for_japanese|s)|f[ir]|g(?:b(?:18030|2312|_(?:1988|2312)\-80|k)|ost_19768\-74|reek(?:7\-old|\-ccitt|[78])?|b)|h(?:ebrew|p\-(?:desktop|legal|math8|pi\-font|roman8)|z\-gb\-2312|u)|i(?:bm(?:0(?:0(?:858|924)|114[0123456789]|3[78])|10(?:26|47)|2(?:7[34578]|8[0145]|9[07])|367|4(?:2[034]|37)|500|775|8(?:19|5[01257]|6\d|7[01]|80|91)|9(?:0[345]|18)|\-(?:1047|symbols|thai))|ec_p27\-1|n(?:is(?:\-(?:cyrillic|8))?|variant)|rv|so(?:5427cyrillic1981|646\-(?:c(?:a2|[anu])|d[ek]|es2?|f(?:r1|[ir])|gb|hu|it|jp(?:\-ocr\-b)?|kr|no2?|pt2?|se2?|us|yu)|\-(?:10646(?:\-(?:j\-1|u(?:cs\-(?:basic|[24])|nicode\-latin1|tf\-1)))?|2022\-(?:cn(?:\-ext)?|jp(?:\-2)?|kr)|8859\-(?:1(?:\-windows\-3\.[01]\-latin\-1|[03456])|2\-windows\-latin\-2|6\-[ei]|8\-[ei]|9\-windows\-latin\-5|[123456789])|celtic|ir\-(?:1(?:0[01239]|1[01]|2[123678]|3[89]|4[12346789]|5[012345789]|99|[013456789])|2(?:26|[157])|37|4[279]|5[014578]|6[019]|70|8(?:\-[12]|[456789])|9(?:\-[12]|\d)|[246])|unicode\-ibm\-12(?:6[1458]|76))|_(?:10367\-box|2033\-1983|542(?:7\:1981|8\:1980|7)|6(?:46\.(?:basic\:1983|irv\:19(?:83|91))|937\-2\-(?:25|add))|8859\-(?:1(?:0\:1992|4\:1998|6\:2001|\:1987|[456])|2\:1987|3\:1988|4\:1988|5\:1988|6(?:\-[ei]|\:1987)|7\:1987|8(?:\-[ei]|\:1988)|9\:1989|supp|[123456789])|9036))|t)|j(?:is_(?:c622(?:0\-1969(?:\-(?:jp|ro))?|6\-19(?:78|83)|9\-1984\-(?:b\-add|hand(?:\-add)?|kana|[ab]))|encoding|x02(?:0(?:8\-1983|1)|12\-1990))|p\-ocr\-(?:b\-add|hand(?:\-add)?|[ab])|us_i\.b1\.00(?:3\-(?:mac|serb)|2)|[ps])|k(?:atakana|o(?:i(?:7\-switched|8\-[eru])|rean)|s(?:_c_5601\-198[79]|c(?:5636|_5601)))|l(?:10|a(?:tin(?:1(?:\-2\-5|0)|\-(?:greek(?:\-1)?|lap|9)|[1234568])|p)|[1234568])|m(?:ac(?:edonian|intosh)?|icrosoft\-publishing|nem(?:onic)?|s(?:936|_kanji|z_7795\.3))|n(?:a(?:plps|ts\-(?:dano(?:\-add)?|sefi(?:\-add)?))|c_nc00\-10\:81|f_z_62\-010(?:_\(1973\))?|o2|s_4551\-[12]|o)|osd_ebcdic_df0(?:3_irv|4_15?)|p(?:c(?:8\-(?:danish\-norwegian|turkish)|\-multilingual\-850\+euro)|t(?:154|cp154|2)|t)|r(?:ef|oman8|8)|s(?:csu|e(?:n_850200_[bc]|rbian|2)|hift_jis|t_sev_358\-88|e)|t(?:\.(?:101\-g2|61(?:\-[78]bit)?)|is\-620)|u(?:n(?:icode\-1\-1(?:\-utf\-7)?|known\-8bit)|s\-(?:ascii|dk)|tf\-(?:16(?:be|le)?|32(?:be|le)?|[78])|[ks])|v(?:entura\-(?:international|math|us)|i(?:deotex\-suppl|qr|scii))|windows\-(?:125[012345678]|31j|936)|x02(?:0(?:1\-7|[18])|12)|yu)[a-z0-9._-]*(?![a-z0-9._-])(?!=)/i
describe  SARE_HTML_INV_CHARSET    Illegal chracterset in message
score     SARE_HTML_INV_CHARSET    0.309
#counts   SARE_HTML_INV_CHARSET    137s/49h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_INV_CHARSET    177s/31h of 196718 corpus (96193s/100525h RM) 02/22/05
#counts   SARE_HTML_INV_CHARSET    111s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_INV_CHARSET    130s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#counts   SARE_HTML_INV_CHARSET    35s/1h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_INV_CHARSET    1s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#max      SARE_HTML_INV_CHARSET    4s/0h of 10826 corpus (6364s/4462h CT) 05/28/05

rawbody   SARE_HTML_LANG_PTBR      /lang=(?:3D)?PT-BR/
describe  SARE_HTML_LANG_PTBR      Odd language
score     SARE_HTML_LANG_PTBR      0.185
#hist     SARE_HTML_LANG_PTBR      LW_PT_BR, Loren Wilton
#counts   SARE_HTML_LANG_PTBR      21s/4h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_LANG_PTBR      213s/0h of 70693 corpus (43127s/27566h RM) 10/02/04
#counts   SARE_HTML_LANG_PTBR      69s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_LANG_PTBR      0s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_LANG_PTBR      10s/0h of 19448 corpus (16863s/2585h MY) 10/05/04
#counts   SARE_HTML_LANG_PTBR      0s/22h of 11260 corpus (6568s/4692h CT) 06/17/05

########  ######################   ##################################################
#   Invalid or Suspicious URI Tests
########  ######################   ##################################################

uri       SARE_HTML_URI_AT         /http.\/\/\w{1,20}\@\w{3,25}\./i
describe  SARE_HTML_URI_AT         URI contains "@"
score     SARE_HTML_URI_AT         0.293
#ham      SARE_HTML_URI_AT         error in email; http: instead of mailto:
#counts   SARE_HTML_URI_AT         73s/13h of 269462 corpus (128310s/141152h RM) 06/17/05
#counts   SARE_HTML_URI_AT         4s/1h of 258858 corpus (114246s/144612h RM) 05/27/05
#max      SARE_HTML_URI_AT         2396s/1h of 98542 corpus (76935s/21607h RM) 05/12/04
#counts   SARE_HTML_URI_AT         2s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_URI_AT         58s/2h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_URI_AT         0s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_URI_AT         0s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#max      SARE_HTML_URI_AT         65s/0h of 6944 corpus (3188s/3756h CT) 05/19/04

uri       SARE_HTML_URI_DEFHTM     /\/default\d{1,5}\.htm/i
describe  SARE_HTML_URI_DEFHTM     text points to seq numbered "default" page
score     SARE_HTML_URI_DEFHTM     0.056
#ham      SARE_HTML_URI_DEFHTM     Centre for Computer-aided Egyptological Research (CCER): http://www.ccer.theo.uu.nl/ccer/default3.html
#ham      SARE_HTML_URI_DEFHTM     http://movies.fantasticfactory.com/dagon/default8.htm
#overlap  SARE_HTML_URI_DEFHTM     Significant overlap with SARE_HTML_URI_NOMORE
#counts   SARE_HTML_URI_DEFHTM     1s/1h of 258858 corpus (114246s/144612h RM) 05/27/05
#max      SARE_HTML_URI_DEFHTM     260s/2h of 85079 corpus (62484s/22595h RM) 06/07/04
#counts   SARE_HTML_URI_DEFHTM     1s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_URI_DEFHTM     72s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_URI_DEFHTM     0s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_URI_DEFHTM     3s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_URI_DEFHTM     0s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#max      SARE_HTML_URI_DEFHTM     2s/0h of 6944 corpus (3188s/3756h CT) 05/19/04

uri       SARE_HTML_URI_FORMPHP    /form.php\?/i
describe  SARE_HTML_URI_FORMPHP    URI to page name which suggests spammer's page
score     SARE_HTML_URI_FORMPHP    0.427
#counts   SARE_HTML_URI_FORMPHP    93s/6h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_URI_FORMPHP    30s/0h of 92209 corpus (74874s/17335h RM) 01/17/04
#counts   SARE_HTML_URI_FORMPHP    0s/6h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#counts   SARE_HTML_URI_FORMPHP    7s/0h of 47221 corpus (42968s/4253h MY) 06/18/05

uri       SARE_HTML_URI_LONG8      /http:\/\/.{800}/i
describe  SARE_HTML_URI_LONG8      link appears to be excessively long
score     SARE_HTML_URI_LONG8      0.264
#counts   SARE_HTML_URI_LONG8      1s/21h of 258858 corpus (114246s/144612h RM) 05/27/05
#max      SARE_HTML_URI_LONG8      1701s/15h of 89684 corpus (67687s/21997h RM) 05/23/04
#counts   SARE_HTML_URI_LONG8      0s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#max      SARE_HTML_URI_LONG8      2s/0h of 32900 corpus (9656s/23244h JH) 05/24/04
#counts   SARE_HTML_URI_LONG8      118s/1h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_URI_LONG8      0s/2h of 10826 corpus (6364s/4462h CT) 05/28/05
#max      SARE_HTML_URI_LONG8      1s/0h of 6944 corpus (3188s/3756h CT) 05/19/04

uri       SARE_HTML_URI_OPTPHP     /optout\.php/i
describe  SARE_HTML_URI_OPTPHP     opt-out page seen only in spam 
score     SARE_HTML_URI_OPTPHP     0.427
#counts   SARE_HTML_URI_OPTPHP     74s/0h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_URI_OPTPHP     1073s/0h of 85078 corpus (62483s/22595h RM) 06/07/04
#counts   SARE_HTML_URI_OPTPHP     8s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_URI_OPTPHP     242s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_URI_OPTPHP     10s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_URI_OPTPHP     20s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_URI_OPTPHP     8s/11h of 11260 corpus (6568s/4692h CT) 06/17/05
#max      SARE_HTML_URI_OPTPHP     21s/11h of 6944 corpus (3188s/3756h CT) 05/19/04
#counts   SARE_HTML_URI_OPTPHP     0s/1h of 6804 corpus (1336s/5468h ft) 06/17/05

uri       SARE_HTML_URI_UNSPHP     /unsubscribe\.php/i
describe  SARE_HTML_URI_UNSPHP     URI with common spammer email remove page name
score     SARE_HTML_URI_UNSPHP     0.182
#counts   SARE_HTML_URI_UNSPHP     289s/94h of 269462 corpus (128310s/141152h RM) 06/17/05
#counts   SARE_HTML_URI_UNSPHP     10s/8h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_URI_UNSPHP     129s/5h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_URI_UNSPHP     8s/23h of 11260 corpus (6568s/4692h CT) 06/17/05
#counts   SARE_HTML_URI_UNSPHP     0s/2h of 6804 corpus (1336s/5468h ft) 06/17/05

rawbody   __SARE_HTML_URR_OBFU3    /(&\#\d{1,3};){4}/i
describe  __SARE_HTML_URR_OBFU3    URI with obfuscated destination 
#hist     __SARE_HTML_URR_OBFU3    Mike Kuentz 
#hist     __SARE_HTML_URR_OBFU3    Generalization/expansion suggested by Loren Wilton 
rawbody   __SARE_HTML_URR_MAILTO   m'(?:mailto|\&\#109;\&\#97;\&\#105;\&\#108;\&\#116;\&\#111;)(?:\&\#58;|:)'
rawbody   __SARE_HTML_URR_OBMAIL   /\&\#109;\&\#97;\&\#105;\&\#108;\&\#116;\&\#111;/
meta      SARE_HTML_URR_OBFU3B     __SARE_HTML_URR_OBFU3 && !__SARE_HTML_URR_MAILTO && !__SARE_HTML_URR_OBMAIL
describe  SARE_HTML_URR_OBFU3B     URI with obfuscated destination 
score     SARE_HTML_URR_OBFU3B     0.091
#overlap  SARE_HTML_URR_OBFU3B     Removed SARE_HTML_URR_OBFU6 and SARE_HTML_URR_OBFU2 due to overlap: m'\&\#104;\&\#116;\&\#116;\&\#112;' and /(&\#119;){3}/
#counts   SARE_HTML_URR_OBFU3B     45s/42h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_URR_OBFU3B     84s/28h of 196718 corpus (96193s/100525h RM) 02/22/05
#counts   SARE_HTML_URR_OBFU3B     16s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_URR_OBFU3B     62s/0h of 13451 corpus (11340s/2111h MY) 06/02/04
#counts   SARE_HTML_URR_OBFU3B     2s/1h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_URR_OBFU3B     106s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_URR_OBFU3B     7s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_URR_OBFU3B     2s/0h of 11260 corpus (6568s/4692h CT) 06/17/05

########  ######################   ##################################################
#   Image tag tests
########  ######################   ##################################################

########  ######################   ##################################################
#   Paragraphs, breaks, and spacings
########  ######################   ##################################################

rawbody   __SARE_HTML_MANY_BR05    /<br>\s*<br>\s*<br>\s*<br>\s*<br>\s*<br>/i
meta      SARE_HTML_MANY_BR05      __SARE_HTML_MANY_BR05 && HTML_MESSAGE
describe  SARE_HTML_MANY_BR05      Tooo many <br>'s!
score     SARE_HTML_MANY_BR05      0.500
#hist     SARE_HTML_MANY_BR05      Contrib by Matt Keller June 7 2004
#note     SARE_HTML_MANY_BR05      Remove HTML_MESSAGE test increases spam 4% but doubles ham
#hist     SARE_HTML_MANY_BR05      this and SARE_HTML_MANY_BR10 obsolete SARE_HTML_TD_BR4 = FR_WICKED_SPAM_??
#counts   SARE_HTML_MANY_BR05      0s/0h of 114422 corpus (81069s/33353h RM) 01/16/05
#alone    SARE_HTML_MANY_BR05      2051s/43h of 66351 corpus (40971s/25380h RM) 08/21/04
#counts   SARE_HTML_MANY_BR05      0s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#max      SARE_HTML_MANY_BR05      755s/2h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_MANY_BR05      0s/0h of 26326 corpus (22886s/3440h MY) 02/15/05

rawbody   SARE_HTML_P_MANY3        /<P><P><P>/i
describe  SARE_HTML_P_MANY3        Too many empty paragraph tags in a row
score     SARE_HTML_P_MANY3        0.217
#hist     SARE_HTML_P_MANY3        04/02/2004 http://www.rulesemporium.com/rules/99_FVGT_rawbody.cf
#overlap  SARE_HTML_P_MANY3        Total overlap within SARE_HTML_URI_MANYP2, but no ham hits here (until Feb 2005)
#ham      SARE_HTML_P_MANY3        From: Ticketmaster <support@reply.ticketmaster.com>, Tuesday, January 25, 2005, 4:00:27 PM
#counts   SARE_HTML_P_MANY3        48s/21h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_P_MANY3        745s/0h of 125099 corpus (104916s/20183h RM) 04/02/04
#counts   SARE_HTML_P_MANY3        4s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_P_MANY3        15s/0h of 32260 corpus (8983s/23277h JH) 05/14/04
#counts   SARE_HTML_P_MANY3        34s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_P_MANY3        0s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#max      SARE_HTML_P_MANY3        9s/0h of 6944 corpus (3188s/3756h CT) 05/19/04

########  ######################   ##################################################
#   Javascript and object tests     
########  ######################   ##################################################

########  ######################   ##################################################
#  Useless tags (tag structures that do nothing) 
#  Largely submitted by Matt Yackley, with contributions by 
#  Carl Friend, Jennifer Wheeler, Scott Sprunger, Larry Gilson
########  ######################   ##################################################

rawbody   SARE_HTML_USL_1CHAR      m'(?!<[bipu]></[bipu]>)<([a-z])></\1>'i 
describe  SARE_HTML_USL_1CHAR      Invalid and empty 1-char tag - /tag combination
score     SARE_HTML_USL_1CHAR      0.290
#counts   SARE_HTML_USL_1CHAR      46s/8h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_USL_1CHAR      46s/6h of 196718 corpus (96193s/100525h RM) 02/22/05
#counts   SARE_HTML_USL_1CHAR      3s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_USL_1CHAR      6s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#counts   SARE_HTML_USL_1CHAR      1s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#counts   SARE_HTML_USL_1CHAR      0s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#max      SARE_HTML_USL_1CHAR      3s/0h of 6944 corpus (3188s/3756h CT) 05/19/04

########  ######################   ##################################################
#   Miscellaneous tag tests
########  ######################   ##################################################

rawbody   SARE_HTML_BODY_2SP       /<body  /i
describe  SARE_HTML_BODY_2SP       HTML tag is strangely formed
score     SARE_HTML_BODY_2SP       0.201
#hist     SARE_HTML_BODY_2SP       FR_BODY_2SPACES
#counts   SARE_HTML_BODY_2SP       132s/60h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_BODY_2SP       270s/15h of 175738 corpus (98979s/76759h RM) 02/14/05
#counts   SARE_HTML_BODY_2SP       62s/5h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_BODY_2SP       94s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_BODY_2SP       66s/2h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_BODY_2SP       0s/4h of 4676 corpus (808s/3868h ft) 05/28/05

rawbody   SARE_HTML_H2_CLK         /<h2>.{0,40}click.{0,40}<\/h2>/i
describe  SARE_HTML_H2_CLK         Spammer word in heading
score     SARE_HTML_H2_CLK         0.555
#stype    SARE_HTML_H2_CLK         spamp
#counts   SARE_HTML_H2_CLK         2s/0h of 269462 corpus (128310s/141152h RM) 06/17/05
#counts   SARE_HTML_H2_CLK         0s/0h of 29365 corpus (5882s/23483h JH) 08/14/04 TM2 SA3.0-pre2
#counts   SARE_HTML_H2_CLK         0s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_H2_CLK         1s/0h of 26326 corpus (22886s/3440h MY) 02/15/05

rawbody   SARE_HTML_LEFT           /<left>/i
describe  SARE_HTML_LEFT           HTML has strange tag
score     SARE_HTML_LEFT           0.167
#counts   SARE_HTML_LEFT           22s/8h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_LEFT           29s/2h of 114422 corpus (81069s/33353h RM) 01/16/05
#counts   SARE_HTML_LEFT           2s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#max      SARE_HTML_LEFT           4s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_LEFT           2s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_LEFT           1s/0h of 10826 corpus (6364s/4462h CT) 05/28/05

body      __TAG_EXISTS_BODY        eval:html_tag_exists('body')
body      __TAG_EXISTS_HTML        eval:html_tag_exists('html')
meta      SARE_HTML_NO_HTML1       ( __TAG_EXISTS_BODY && !__TAG_EXISTS_HTML)
describe  SARE_HTML_NO_HTML1       No body tag found in HTML email 
score     SARE_HTML_NO_HTML1       0.620
#counts   SARE_HTML_NO_HTML1       3082s/288h of 269462 corpus (128310s/141152h RM) 06/17/05
#counts   SARE_HTML_NO_HTML1       239s/9h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_NO_HTML1       139s/7h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_NO_HTML1       339s/8h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_NO_HTML1       11s/2h of 11260 corpus (6568s/4692h CT) 06/17/05
#max      SARE_HTML_NO_HTML1       47s/2h of 6944 corpus (3188s/3756h CT) 05/19/04
#counts   SARE_HTML_NO_HTML1       15s/10h of 6804 corpus (1336s/5468h ft) 06/17/05

full      SARE_HTML_TD_BR          m'<td.{10,400}<br>.{1,7}<br>.{1,7}<br>.{1,7}<br>.{0,400}</td>'is
describe  SARE_HTML_TD_BR          Multiple line breaks in spammer pattern
score     SARE_HTML_TD_BR          0.303
#hist     SARE_HTML_TD_BR          Fred T: FR_WICKED_SPAM_??
#counts   SARE_HTML_TD_BR          113s/42h of 269462 corpus (128310s/141152h RM) 06/17/05
#max      SARE_HTML_TD_BR          137s/35h of 258858 corpus (114246s/144612h RM) 05/27/05
#counts   SARE_HTML_TD_BR          36s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_TD_BR          182s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_TD_BR          184s/15h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_TD_BR          0s/1h of 4676 corpus (808s/3868h ft) 05/28/05
#counts   SARE_HTML_TD_BR          16s/5h of 11260 corpus (6568s/4692h CT) 06/17/05

# EOF