############################################ # Good to avoid FPs with other rules. # The following rules were borrowed from an older version of SA. rawbody __PGP_BEGIN /^-----BEGIN PGP (?:SIGNATURE|MESSAGE)-----$/ rawbody __PGP_MIDDLE /^[0-9A-Za-z+\/]{64}$/ rawbody __PGP_END /^-----END PGP (?:SIGNATURE|MESSAGE)-----$/ meta __PGP_SIGNATURE (__PGP_BEGIN && __PGP_MIDDLE && __PGP_END) # # Prevent hits with Double forwards, or messages with attachments not parsed out. rawbody __FR_ATTACHMENT /Content-Disposition: attachment/i rawbody __FR_INLINEATTACH /Content-Disposition: inline.{1,4}filename.{1,4}/i rawbody __FR_AUDIO_FILE /Content-Type: audio/i rawbody __FR_IMAGETYPE /Content-Type: image\/(?:jpeg|gif)/i # # Prevent hits with Yahoo groups, common occurance! header __FH_YAHOOGROUPS exists:X-Yahoo-Profile # meta __BADMIMEPARSES (__FR_ATTACHMENT || __FR_INLINEATTACH || __FR_IMAGETYPE || __FR_AUDIO_FILE || __PGP_SIGNATURE || __FH_YAHOOGROUPS) ############################################# # Special META rules rawbody __FB_WHITEBODY /|<\/STYLE>/i body __FB_HIBIT_10 /\b[\x80-\xff]{9,10}\b/ body __FB_HIBIT_13 /\b[\x80-\xff]{11,13}\b/ # HOAXES body __HOAX_JDBGMGR_TEDDY /teddy bear/i body __HOAX_JDBGMGR_NOOPEN /do not open it/i body __HOAX_JDBGMGR_EXENAME /jdbgmgr\.exe/i meta JDBGMGR_HOAX ((__HOAX_JDBGMGR_TEDDY + __HOAX_JDBGMGR_NOOPEN + __HOAX_JDBGMGR_EXENAME) > 1) score JDBGMGR_HOAX 5.0 # Stable Rules # This rule has moved to sare_html0.cf # meta FC_IMAGEONLY1 ((HTML_IMAGE_ONLY_02 + MIME_HTML_ONLY + MIME_HTML_ONLY_MULTI) > 1) # score FC_IMAGEONLY1 1.3 meta FC_OBFU01 (FVGT_s_LONGSUBJECT && HTML_90_100) score FC_OBFU01 2.5 meta FC_SPECIAL01 (DATE_MISSING && FROM_NO_LOWER && FVGT_u_GEOCITIES) score FC_SPECIAL01 2.5 meta FC_SPECIAL03 ((TRACKER_ID + HTML_TAG_BALANCE_A + HTML_FONT_BIG + HTML_IMAGE_ONLY_04 + HTML_IMAGE_ONLY_02) > 2) score FC_SPECIAL03 2.0 meta FC_SPECIAL04 (FORGED_YAHOO_RCVD && HTML_70_80) score FC_SPECIAL04 2.1 meta FC_SPECIAL05 (FORGED_YAHOO_RCVD && FVGT_u_DOM_END_NUM) score FC_SPECIAL05 1.1 meta FC_SPECIAL06 (HTML_90_100 && HTML_COMMENT_RATIO && HTML_IMAGE_ONLY_02 && MIME_HTML_ONLY) score FC_SPECIAL06 2.0 meta FC_SPECIAL07 (HTML_IMAGE_ONLY_02 && MIME_HTML_NO_CHARSET && MIME_HTML_ONLY) score FC_SPECIAL07 2.5 meta FM_HOTMAIL_BIZ (FORGED_HOTMAIL_RCVD && FU_TLD_BIZ) score FM_HOTMAIL_BIZ 2.5 meta FM_MASKEDW0RDS (__FB_MASKEDW0RDS && !__BADMIMEPARSES) score FM_MASKEDW0RDS 3.2 meta FM_N0N0_WORDS (__FB_N0N0_WORDS && !__BADMIMEPARSES) score FM_N0N0_WORDS 3.2 meta FM_NO_STYLE (__FR_NO_STYLE && !__FH_NETSCAPE && !FH_FWD_MSG && !__ORIG_MSG_AGENT) score FM_NO_STYLE 0.9 meta FM_HIBIT_10 (__FB_HIBIT_10 && !__BADMIMEPARSES) score FM_HIBIT_10 1.2 meta FM_HIBIT_13 (__FB_HIBIT_13 && !__BADMIMEPARSES) score FM_HIBIT_13 1.2 meta FM_PRESSCLICK (CLICK_BELOW && FB_PRESSHERE) score FM_PRESSCLICK 1.1 meta FM_WHITEONWHITE (__FB_WHITEBODY && __FB_WHITEFONT) score FM_WHITEONWHITE 0.45 meta FM_RATES_PAYING ((FB_PAYING_TOO_MUCH + FB_YOUR_RATES + FB_HEALTH_INSURANCE + FB_PERSONAL_QUOTE) > 2) score FM_RATES_PAYING 1.6 meta FM_RATES_AGAIN ((FB_FROM_QUOTE + FS_CREDIT + FB_RATES_R_LOW + FB_INTEREST_RATES + FB_CONSOL_YOUR) > 2) score FM_RATES_AGAIN 1.6 body __PRESCRIPTION /prescription/i body __OBFU_PRESCRIPTION /pr[e3]scr[i1]pt[i1][o0]n/i meta FM_PRESCRIPTION (__OBFU_PRESCRIPTION && !__PRESCRIPTION) score FM_PRESCRIPTION 3.0 body __PERSCRIPTION /perscription/i body __OBFU_PERSCRIPTION /p[e3]rscr[i1]pt[i1][o0]n/i meta FM_PERSCRIPTION (__OBFU_PERSCRIPTION && !__PERSCRIPTION) score FM_PERSCRIPTION 3.0 header __EROTICA Subject =~ /erotica/i header __OBFU_EROTICA Subject =~ /[e3]r[o0O]t[i1]c[a\@]/i meta FM_EROTICA (__OBFU_EROTICA && !__EROTICA) score FM_EROTICA 4.0 # $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ # Catch Image ONLY spams! rawbody __FR_HTML_HAS_AHREF eval:html_tag_exists('a') rawbody __FR_HTML_HAS_IMG eval:html_tag_exists('img') full __FR_HTML_LEN_80375 /<(?:html|body).{80,375}<\/(?:body|html)>/is full __FR_A_THEN_IMG / 3) score FM_WEIGHT_LOSS 4.0 # $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ # We don't need no schooling ;) body __BACHELORS /Bachelor/i body __MASTERS /Masters/i body __MBA /MBA/i body __PHD /PhD/i body __DIPLOMA /diploma/i meta FM_SCHOOLING ((__BACHELORS + __MASTERS + __MBA + __PHD) > 2) score FM_SCHOOLING 1.2 meta FM_SCHOOL_DIPLOMA (FM_SCHOOLING && __DIPLOMA) score FM_SCHOOL_DIPLOMA 2.0 # $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ # One & Two letter pages, folders, and images. uri __ONE_LETTER_IMG m*/[A-Z0-9]\.(?:gif|jpg|png)*i uri __TWO_LETTER_IMG m*/[A-Z0-9]{2}\.(?:gif|jpg|png)*i uri __ONE_LETTER_PAGE m*/[A-Z0-9]\.(?:htm|php|asp|pl|cgi|sht)*i uri __TWO_LETTER_PAGE m*/[A-Z0-9]{2}\.(?:htm|php|asp|pl|cgi|sht)*i uri __ONE_LETTER_FLDR m*/[A-Z0-9]/*i uri __TWO_LETTER_FLDR m*/[A-Z0-9]{2}/*i meta DBL_1_CHR_PGFLD (__ONE_LETTER_PAGE && __ONE_LETTER_FLDR) score DBL_1_CHR_PGFLD 0.2 meta DBL_2_CHR_PGFLD (__TWO_LETTER_PAGE && __TWO_LETTER_FLDR) score DBL_2_CHR_PGFLD 0.2 meta DBL_12_CHR_PGIMG ((__ONE_LETTER_PAGE || __TWO_LETTER_PAGE) && (__ONE_LETTER_IMG || __TWO_LETTER_IMG)) score DBL_12_CHR_PGIMG 0.2 meta DBL_12_LETTER_PGIMG ((__ONE_LETTER_FLDR || __TWO_LETTER_FLDR) && (__ONE_LETTER_IMG || __TWO_LETTER_IMG)) score DBL_12_LETTER_PGIMG 0.2 meta DBL_12_LETTER_FLDR (__ONE_LETTER_FLDR && __TWO_LETTER_FLDR) score DBL_12_LETTER_FLDR 0.2 meta DBL_12_LETTER_FLDRPG (__TWO_LETTER_FLDR && __ONE_LETTER_PAGE) score DBL_12_LETTER_FLDRPG 0.2 # $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ # Special of the week, payper view, xxx movies and cable filters. meta SPECIAL_OF_WEEK_01 ((FB_PAY_PER_VIEW + FB_XXX_MOVIE + FB_CABLE_FILTER + FH_MPOPWEBMAIL + FR_DDDD_HOSTING) > 3) score SPECIAL_OF_WEEK_01 1.5 # $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ # lowest-rates # best-insurance body __LOWEST_RATES /lowest.{1,3}rate/i body __BEST_INSURAN /best.{1,3}insurance/i meta FM_RATES_INSURANC (__LOWEST_RATES && __BEST_INSURAN) score FM_RATES_INSURANC 2.0 # $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ # Core obfu rules, these are generated from multiple US dictionary files. body __FB_OBFU_J /j[bcfgw]/i body __FB_OBFU_OTHER /(?:vj|vk|xj|xk|yy|zf|zj)/i body __FB_OBFU_Q0 /[jkpqtvwz]q/i body __FB_OBFU_Q1 /q[afhjkmnsy]/i body __FB_OBFU_V /[fgqw]v/i body __FB_OBFU_X /[cgjkqsvz]x/i body __FB_OBFU_Z /[fjkpqx]z/i # Multiple occurances will lead to more points, idea taken from Jennifer (popcorn & backhair) meta __FM_MULTI_ODD2 ((__FB_OBFU_J + __FB_OBFU_OTHER + __FB_OBFU_Q0 + __FB_OBFU_Q1 + __FB_OBFU_V + __FB_OBFU_X + __FB_OBFU_Z) > 1) meta __FM_MULTI_ODD3 ((__FB_OBFU_J + __FB_OBFU_OTHER + __FB_OBFU_Q0 + __FB_OBFU_Q1 + __FB_OBFU_V + __FB_OBFU_X + __FB_OBFU_Z) > 2) meta __FM_MULTI_ODD4 ((__FB_OBFU_J + __FB_OBFU_OTHER + __FB_OBFU_Q0 + __FB_OBFU_Q1 + __FB_OBFU_V + __FB_OBFU_X + __FB_OBFU_Z) > 3) meta __FM_MULTI_ODD5 ((__FB_OBFU_J + __FB_OBFU_OTHER + __FB_OBFU_Q0 + __FB_OBFU_Q1 + __FB_OBFU_V + __FB_OBFU_X + __FB_OBFU_Z) > 4) # Core meta rules, these combine multiple variations of above rules, with exceptions for Attachments and PGP sig's. # describe FVGT_m_MULTI_ODD? Contains multiple odd letter combinations meta FM_MULTI_ODD2 (__FM_MULTI_ODD2 && !__BADMIMEPARSES) meta FM_MULTI_ODD3 (__FM_MULTI_ODD3 && !__BADMIMEPARSES) meta FM_MULTI_ODD4 (__FM_MULTI_ODD4 && !__BADMIMEPARSES) meta FM_MULTI_ODD5 (__FM_MULTI_ODD5 && !__BADMIMEPARSES) score FM_MULTI_ODD2 1.1 score FM_MULTI_ODD3 0.7 score FM_MULTI_ODD4 0.7 score FM_MULTI_ODD5 0.9 # $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ # I think it was Jesse Houwing who first wrote rules for this, I could not find them and had to make my own! ##Check this out! rawbody __DEAD_FONT /^