| |
| # From discussion on the users list 6/09 |
| |
| # |
| # This depends on bugfixes in ReplaceTags.pm for proper operation |
| # |
| # If you are using this with 3.2.5, make sure you get this as well: |
| # http://svn.apache.org/viewvc/spamassassin/branches/3.2/lib/Mail/SpamAssassin/Plugin/ReplaceTags.pm |
| # |
| |
| ifplugin Mail::SpamAssassin::Plugin::ReplaceTags |
| |
| # Disabled 10/2016 - abysmal S/O, it's ignoring the score limit, and reported FPs in bug#7365 that I can't repro |
| # trying minor tuning change before we give up, will disable again if that doesn't help |
| # Disabled again 11/2016, still ignoring the score limit, abysmal S/O |
| #body URI_OBFU_WWW /(?<!:\/\/)\b_*w{2,3}(?!(?:\.+|\/|,)[-\w]+\.+(?:com|net|org|biz|info))[^[:alnum:]]{1,3}(?:<D><O><T>+[^[:alnum:]]{1,3})?[[:alnum:]][-\w]{1,20}[[:alnum:]][^[:alnum:]]{1,3}(?:<D><O><T>+[^[:alnum:]]{1,3})?(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g|b\s?i\s?z|i\s?n\s?f\s?o)_*\b/i |
| #describe URI_OBFU_WWW Obfuscated URI |
| #replace_rules URI_OBFU_WWW |
| #score URI_OBFU_WWW 2.000 # limit |
| |
| endif |
| |
| # First started appearing 02/2011 |
| body URI_OBFU_PROTO m,h\st\st\sp(?:\ss)\s?:\s?/\s?/,i |
| describe URI_OBFU_PROTO URI http protocol with space obfuscation |
| |
| body __URI_OBFU_TLD /\.\s(?:c\so\sm|n\se\st|o\sr\sg|b\si\sz|i\sn\sf\so)/i |
| meta URI_OBFU_TLD __URI_OBFU_TLD && !__MSGID_OK_HOST |
| describe URI_OBFU_TLD URI top-level domain with space obfuscation |
| |
| body __URI_DEOBFU_INSTR /(?:delete|remove|take\sout)(?:\sthe)?\sspaces/i |
| meta URI_DEOBFU_INSTR __URI_DEOBFU_INSTR && !__MSGID_OK_HOST |
| describe URI_DEOBFU_INSTR How to deobfuscate this URI |
| #tflags URI_DEOBFU_INSTR nopublish |
| |
