Home Explore Help
Sign In
bignose
/
debian_pkg-listmaster
Watch 1
Star 0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Branch: master
Branches Tags
debian_pkg-l...
/
spamassassin_config
/
common
/
sare
/
70_sare_html1.cf

70_sare_html1.cf 39 KB
Permalink History Raw

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533 
  1. # SARE HTML Ruleset for SpamAssassin - ruleset 1
    2. 

  2. # Version: 01.03.10
    3. 

  3. # Created: 2004-03-31 
    4. 

  4. # Modified: 2006-06-03
    5. 

  5. # Usage instructions, documentation, and change history in 70_sare_html0.cf 
    6. 

  6. 

  7. #@@# Revision History:  Full Revision History stored in 70_sare_html.log
    8. 

  8. #@@# 01.03.10: June 3 2006
    9. 

  9. #@@#           Minor score tweaks based on recent mass-checks
    10. 

  10. #@@#           Modified "rule has been moved" meta flags 
    11. 

  11. #@@#           Added to file 1      SARE_HTML_SINGLETS
    12. 

  12. #@@#           Archive:             SARE_HTML_ALT_WAIT1
    13. 

  13. #@@#           Archive:             SARE_HTML_A_NULL
    14. 

  14. #@@#           Archive:             SARE_HTML_H2_CLK
    15. 

  15. #@@#           Archive:             SARE_HTML_JSCRIPT_ENC
    16. 

  16. #@@#           Archive:             SARE_HTML_URI_BUG
    17. 

  17. #@@#           Moved file 1 to 2:   SARE_HTML_BR_MANY
    18. 

  18. #@@#           Moved file 1 to 2:   SARE_HTML_ONE_LINE2
    19. 

  19. #@@#           Moved file 1 to 2:   SARE_HTML_URI_OC
    20. 

  20. #@@#           Moved file 1 to 3:   SARE_HTML_TITLE_MNY
    21. 

  21. #@@#           Moved file 1 to 3:   SARE_HTML_URI_DEFASP  
    22. 

  22. 

  23. # License: Artistic - see http://www.rulesemporium.com/license.txt 
    24. 

  24. # Current Maintainer: Bob Menschel - RMSA@Menschel.net
    25. 

  25. # Current Home: http://www.rulesemporium.com/rules/70_sare_html1.cf 
    26. 

  26. 

  27. ########  ######################   ##################################################
    28. 

  28. #         Rules renamed or moved
    29. 

  29. ########  ######################   ##################################################
    30. 

  30. 

  31. meta      __SARE_HEAD_FALSE        __FROM_AOL_COM && !__FROM_AOL_COM
    32. 

  32. meta      SARE_HTML_URI_RM         __SARE_HEAD_FALSE
    33. 

  33. meta      SARE_HTML_URI_REFID      __SARE_HEAD_FALSE
    34. 

  34. meta      SARE_HTML_ALT_WAIT1      __SARE_HEAD_FALSE
    35. 

  35. meta      SARE_HTML_A_NULL         __SARE_HEAD_FALSE
    36. 

  36. meta      SARE_HTML_H2_CLK         __SARE_HEAD_FALSE
    37. 

  37. meta      SARE_HTML_JSCRIPT_ENC    __SARE_HEAD_FALSE
    38. 

  38. meta      SARE_HTML_URI_BUG        __SARE_HEAD_FALSE
    39. 

  39. meta      SARE_HTML_BR_MANY        __SARE_HEAD_FALSE
    40. 

  40. meta      SARE_HTML_ONE_LINE2      __SARE_HEAD_FALSE
    41. 

  41. meta      SARE_HTML_URI_OC         __SARE_HEAD_FALSE
    42. 

  42. meta      SARE_HTML_TITLE_MNY      __SARE_HEAD_FALSE
    43. 

  43. meta      SARE_HTML_URI_DEFASP     __SARE_HEAD_FALSE
    44. 

  44. 

  45. ########  ######################   ##################################################
    46. 

  46. 

  47. header    __CTYPE_HTML             Content-Type =~ /text\/html/i
    48. 

  48. 

  49. rawbody   __SARE_HTML_HAS_A        eval:html_tag_exists('a')
    50. 

  50. rawbody   __SARE_HTML_HAS_BR       eval:html_tag_exists('br')
    51. 

  51. rawbody   __SARE_HTML_HAS_DIV      eval:html_tag_exists('div')
    52. 

  52. rawbody   __SARE_HTML_HAS_FONT     eval:html_tag_exists('font')
    53. 

  53. rawbody   __SARE_HTML_HAS_IMG      eval:html_tag_exists('img')
    54. 

  54. rawbody   __SARE_HTML_HAS_P        eval:html_tag_exists('p')
    55. 

  55. rawbody   __SARE_HTML_HAS_PRE      eval:html_tag_exists('pre')
    56. 

  56. rawbody   __SARE_HTML_HAS_TITLE    eval:html_tag_exists('title')
    57. 

  57. 

  58. rawbody   __SARE_HTML_HBODY        m'<html><body>'i
    59. 

  59. rawbody   __SARE_HTML_BEHTML       m'<body></html>'i
    60. 

  60. rawbody   __SARE_HTML_BEHTML2      m'^</?body></html>'i
    61. 

  61. rawbody   __SARE_HTML_EFONT        m'^</font>'i
    62. 

  62. rawbody   __SARE_HTML_EHEB         m'^</html></body>'i
    63. 

  63. rawbody   __SARE_HTML_CMT_CNTR     /<center><!--/
    64. 

  64. 

  65. # JH: These rules test for strange color combinations. There migth be even more powerful combinations, but I haven't had time to check them all
    66. 

  66. rawbody   __SARE_LIGHT_FG_COLOR    /[^\-a-z]color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?!fff\W|ffffff)(?:[e-f]{3}\W|(?:[e-f][0-9a-f]){3})|rgb(?:\((?!\s{0,10}255\s{0,10},\s{0,10}255\s{0,10},\s{0,10}255)\s{0,10}2[2-5][0-9]\s{0,10},\s{0,10}2[2-5][0-9]\s{0,10},\s{0,10}2[2-5][0-9]\s{0,10}\)|\((?!\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%)\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10},\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10},\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10}\))|(?:Light(?:Cyan|Yellow)|(?:Ghost|Floral)White|WhiteSmoke|LemonChiffon|AliceBlue|Cornsilk|Seashell|Honeydew|Azure|MintCream|Snow|Ivory|OldLace|LavenderBlush|Linen|MistyRose))/i
    67. 

  67. rawbody   __SARE_WHITE_FG_COLOR    /[^\-a-z]color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?:fff\W|ffffff)|rgb(?:\(\s{0,10}255\s{0,10},\s{0,10}255\s{0,10},\s{0,10}255\s{0,10}\)|\\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10}\))|white)/i
    68. 

  68. rawbody   __SARE_DARK_FG_COLOR     /[^\-a-z]color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?!000\W|000000)(?:[01]{3}\W|(?:[01][0-9a-f]){3})|rgb(?:\((?!\s{0,10}0\s{0,10},\s{0,10}0\s{0,10},\s{0,10}0\D)\s{0,10}[0-3]?[0-9]\s{0,10},\s{0,10}[0-3]?[0-9]\s{0,10},\s{0,10}[0-3]?[0-9]\s{0,10}\)|\((?!\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%)\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10},\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10},\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10}\)))/i
    69. 

  69. rawbody   __SARE_BLACK_FG_COLOR    /[^\-a-z]color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?:000\W|000000)|rgb\s{0,10}\(\s{0,10}0\s{0,10},\s{0,10}0\s{0,10},\s{0,10}0\s{0,10}\)|rgb\s{0,10}\(\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10}\)|black)/i
    70. 

  70. rawbody   __SARE_LIGHT_BG_COLOR    /(?:bg|background\-)color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?!ffffff|fff\W)(?:[e-f]{3}\W|(?:[e-f][0-9a-f]){3})|rgb(?:\((?!\s{0,10}255\s{0,10},\s{0,10}255\s{0,10},\s{0,10}255)\s{0,10}2[2-5][0-9]\s{0,10},\s{0,10}2[2-5][0-9]\s{0,10},\s{0,10}2[2-5][0-9]\s{0,10}\)|\((?!\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%)\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10},\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10},\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10}\))|(?:Light(?:Cyan|Yellow)|(?:Ghost|Floral)White|WhiteSmoke|LemonChiffon|AliceBlue|Cornsilk|Seashell|Honeydew|Azure|MintCream|Snow|Ivory|OldLace|LavenderBlush|Linen|MistyRose))/i
    71. 

  71. rawbody   __SARE_WHITE_BG_COLOR    /(?:bg|background\-)color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?:fff\W|ffffff)|rgb(?:\(\s{0,10}255\s{0,10},\s{0,10}255\s{0,10},\s{0,10}255\s{0,10}\)|\(\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10}\))|white)/i
    72. 

  72. rawbody   __SARE_DARK_BG_COLOR     /(?:bg|background\-)color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?!000\W|000000)(?:[01]{3}\W|(?:[01][0-9a-f]){3})|rgb(?:\((?!\s{0,10}0\s{0,10},\s{0,10}0\s{0,10},\s{0,10}0\D)\s{0,10}[0-3]?[0-9]\s{0,10},\s{0,10}[0-3]?[0-9]\s{0,10},\s{0,10}[0-3]?[0-9]\s{0,10}\)|\((?!\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%)\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10},\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10},\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10}\)))/i
    73. 

  73. rawbody   __SARE_BLACK_BG_COLOR    /(?:bg|background\-)color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?:000\W|000000)|rgb\s{0,10}\(\s{0,10}0\s{0,10},\s{0,10}0\s{0,10},\s{0,10}0\s{0,10}\)|rgb\s{0,10}\(\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10}\)|black)/i
    74. 

  74. rawbody   __SARE_HAS_BG_COLOR      /(?:bg|background\-)color\s{0,10}(?::|=)/i
    75. 

  75. rawbody   __SARE_HAS_FG_COLOR      /[^\-a-z]color\s{0,10}(?::|=)/i
    76. 

  76. 

  77. ########  ######################   ##################################################
    78. 

  78. #   Is there a message? 
    79. 

  79. ########  ######################   ##################################################
    80. 

  80. 

  81. ########  ######################   ##################################################
    82. 

  82. #   <HTML> and <BODY> tag spamsign
    83. 

  83. ########  ######################   ##################################################
    84. 

  84. 

  85. full      SARE_HTML_HTML_QUOT      /<HTML>.{0,2}&quot;/is
    86. 

  86. describe  SARE_HTML_HTML_QUOT      Message body has very strange HTML sequence
    87. 

  87. score     SARE_HTML_HTML_QUOT      1.666
    88. 

  88. #ham      SARE_HTML_HTML_QUOT      verified (2)
    89. 

  89. #hist     SARE_HTML_HTML_QUOT      Fred T: FR_HTML_QUOTE
    90. 

  90. #counts   SARE_HTML_HTML_QUOT      197s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
    91. 

  91. #max      SARE_HTML_HTML_QUOT      236s/0h of 114422 corpus (81069s/33353h RM) 01/16/05
    92. 

  92. #counts   SARE_HTML_HTML_QUOT      23s/0h of 9991 corpus (5656s/4335h AxB) 05/14/06
    93. 

  93. #counts   SARE_HTML_HTML_QUOT      16s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    94. 

  94. #counts   SARE_HTML_HTML_QUOT      82s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
    95. 

  95. #counts   SARE_HTML_HTML_QUOT      38s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    96. 

  96. #counts   SARE_HTML_HTML_QUOT      159s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
    97. 

  97. #counts   SARE_HTML_HTML_QUOT      5s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
    98. 

  98. #max      SARE_HTML_HTML_QUOT      98s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
    99. 

  99. #counts   SARE_HTML_HTML_QUOT      0s/0h of 4676 corpus (808s/3868h ft) 05/28/05
    100. 

  100. 

  101. full      SARE_HTML_HTML_TBL       /<html>.{0,2}<table/is
    102. 

  102. describe  SARE_HTML_HTML_TBL       Message body has very strange HTML sequence
    103. 

  103. score     SARE_HTML_HTML_TBL       0.646
    104. 

  104. #hist     SARE_HTML_HTML_TBL       Fred T: FR_HTML_TABLE
    105. 

  105. #counts   SARE_HTML_HTML_TBL       94s/3h of 333405 corpus (262498s/70907h RM) 05/12/06
    106. 

  106. #max      SARE_HTML_HTML_TBL       287s/0h of 114422 corpus (81069s/33353h RM) 01/16/05
    107. 

  107. #counts   SARE_HTML_HTML_TBL       10s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
    108. 

  108. #counts   SARE_HTML_HTML_TBL       10s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    109. 

  109. #counts   SARE_HTML_HTML_TBL       3s/3h of 42454 corpus (34336s/8118h FVGT) 05/15/06
    110. 

  110. #counts   SARE_HTML_HTML_TBL       11s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    111. 

  111. #max      SARE_HTML_HTML_TBL       140s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
    112. 

  112. #counts   SARE_HTML_HTML_TBL       22s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
    113. 

  113. #counts   SARE_HTML_HTML_TBL       13s/3h of 23074 corpus (17350s/5724h MY) 05/14/06
    114. 

  114. #max      SARE_HTML_HTML_TBL       30s/3h of 57287 corpus (52272s/5015h MY) 09/22/05
    115. 

  115. 

  116. ########  ######################   ##################################################
    117. 

  117. #   <TITLE> Tag Tests
    118. 

  118. ########  ######################   ##################################################
    119. 

  119. 

  120. rawbody   SARE_HTML_TITLE_1WD      m'^<title>[a-z]+</title>$'  
    121. 

  121. describe  SARE_HTML_TITLE_1WD      strange document title
    122. 

  122. score     SARE_HTML_TITLE_1WD      1.591
    123. 

  123. #hist     SARE_HTML_TITLE_1WD      Loren Wilton LW_FUNNY_TITLE
    124. 

  124. #counts   SARE_HTML_TITLE_1WD      1125s/4h of 333405 corpus (262498s/70907h RM) 05/12/06
    125. 

  125. #max      SARE_HTML_TITLE_1WD      2076s/18h of 689155 corpus (348140s/341015h RM) 09/18/05
    126. 

  126. #counts   SARE_HTML_TITLE_1WD      34s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
    127. 

  127. #counts   SARE_HTML_TITLE_1WD      105s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    128. 

  128. #max      SARE_HTML_TITLE_1WD      143s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
    129. 

  129. #counts   SARE_HTML_TITLE_1WD      0s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
    130. 

  130. #max      SARE_HTML_TITLE_1WD      1s/0h of 4676 corpus (808s/3868h ft) 05/28/05
    131. 

  131. #counts   SARE_HTML_TITLE_1WD      123s/2h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    132. 

  132. #counts   SARE_HTML_TITLE_1WD      174s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
    133. 

  133. #counts   SARE_HTML_TITLE_1WD      53s/1h of 23074 corpus (17350s/5724h MY) 05/14/06
    134. 

  134. #max      SARE_HTML_TITLE_1WD      151s/1h of 47221 corpus (42968s/4253h MY) 06/18/05
    135. 

  135. 

  136. rawbody   SARE_HTML_TITLE_2WD      m'^<title>[a-z]+\s[a-z]+</title>$'        # no /i
    137. 

  137. score     SARE_HTML_TITLE_2WD      0.660
    138. 

  138. describe  SARE_HTML_TITLE_2WD      strange document title
    139. 

  139. #hist     SARE_HTML_TITLE_2WD      Loren Wilton LW_FUNNY_TITLE1
    140. 

  140. #counts   SARE_HTML_TITLE_2WD      85s/7h of 333405 corpus (262498s/70907h RM) 05/12/06
    141. 

  141. #max      SARE_HTML_TITLE_2WD      314s/9h of 689155 corpus (348140s/341015h RM) 09/18/05
    142. 

  142. #counts   SARE_HTML_TITLE_2WD      18s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
    143. 

  143. #counts   SARE_HTML_TITLE_2WD      14s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    144. 

  144. #max      SARE_HTML_TITLE_2WD      15s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
    145. 

  145. #counts   SARE_HTML_TITLE_2WD      6s/1h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    146. 

  146. #max      SARE_HTML_TITLE_2WD      19s/1h of 54089 corpus (16916s/37173h JH-3.01) 02/25/05
    147. 

  147. #counts   SARE_HTML_TITLE_2WD      29s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
    148. 

  148. #counts   SARE_HTML_TITLE_2WD      18s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
    149. 

  149. #max      SARE_HTML_TITLE_2WD      40s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
    150. 

  150. 

  151. rawbody   SARE_HTML_TITLE_DAY      /<title>(monday|tuesday|wednesday|thursday|friday)<\/title>/i
    152. 

  152. describe  SARE_HTML_TITLE_DAY      HTML contains day of week in title
    153. 

  153. score     SARE_HTML_TITLE_DAY      1.081
    154. 

  154. #hist     SARE_HTML_TITLE_DAY      Tim Jackson, May 12 2005
    155. 

  155. #counts   SARE_HTML_TITLE_DAY      184s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
    156. 

  156. #counts   SARE_HTML_TITLE_DAY      2s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
    157. 

  157. #counts   SARE_HTML_TITLE_DAY      0s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    158. 

  158. #max      SARE_HTML_TITLE_DAY      25s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
    159. 

  159. #counts   SARE_HTML_TITLE_DAY      2s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    160. 

  160. #counts   SARE_HTML_TITLE_DAY      1s/1h of 23074 corpus (17350s/5724h MY) 05/14/06
    161. 

  161. #max      SARE_HTML_TITLE_DAY      16s/1h of 57287 corpus (52272s/5015h MY) 09/22/05
    162. 

  162. 

  163. rawbody   SARE_HTML_TITLE_LWORD    /<title>[a-zA-Z]{15,}<\/title>/i
    164. 

  164. describe  SARE_HTML_TITLE_LWORD    HTML Title contains looong word
    165. 

  165. score     SARE_HTML_TITLE_LWORD    0.665
    166. 

  166. #ham      SARE_HTML_TITLE_LWORD    Rite Aid Single Check Rebates <rebates@rebates.riteaid.com>
    167. 

  167. #counts   SARE_HTML_TITLE_LWORD    485s/31h of 333405 corpus (262498s/70907h RM) 05/12/06
    168. 

  168. #max      SARE_HTML_TITLE_LWORD    732s/40h of 689155 corpus (348140s/341015h RM) 09/18/05
    169. 

  169. #counts   SARE_HTML_TITLE_LWORD    42s/1h of 56024 corpus (51686s/4338h AxB2) 05/15/06
    170. 

  170. #counts   SARE_HTML_TITLE_LWORD    3s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    171. 

  171. #max      SARE_HTML_TITLE_LWORD    3s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
    172. 

  172. #counts   SARE_HTML_TITLE_LWORD    4s/3h of 42454 corpus (34336s/8118h FVGT) 05/15/06
    173. 

  173. #counts   SARE_HTML_TITLE_LWORD    32s/1h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    174. 

  174. #counts   SARE_HTML_TITLE_LWORD    161s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
    175. 

  175. #counts   SARE_HTML_TITLE_LWORD    84s/4h of 23074 corpus (17350s/5724h MY) 05/14/06
    176. 

  176. #max      SARE_HTML_TITLE_LWORD    202s/1h of 47221 corpus (42968s/4253h MY) 06/18/05
    177. 

  177. 

  178. rawbody   SARE_HTML_TITLE_SEX      /<title>.{0,15}\bSex.{0,15}<\/title>/i
    179. 

  179. score     SARE_HTML_TITLE_SEX      0.689
    180. 

  180. #ham      SARE_HTML_TITLE_SEX      confirmed (2) 
    181. 

  181. #hist     SARE_HTML_TITLE_SEX      Fred T: FR_TITLE_SEX
    182. 

  182. #counts   SARE_HTML_TITLE_SEX      4s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
    183. 

  183. #max      SARE_HTML_TITLE_SEX      167s/2h of 196681 corpus (96193s/100488h RM) 02/22/05
    184. 

  184. #counts   SARE_HTML_TITLE_SEX      1s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
    185. 

  185. #counts   SARE_HTML_TITLE_SEX      0s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    186. 

  186. #max      SARE_HTML_TITLE_SEX      7s/0h of 6944 corpus (3188s/3756h CT) 05/19/04
    187. 

  187. #counts   SARE_HTML_TITLE_SEX      7s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
    188. 

  188. #counts   SARE_HTML_TITLE_SEX      5s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    189. 

  189. #max      SARE_HTML_TITLE_SEX      14s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
    190. 

  190. #counts   SARE_HTML_TITLE_SEX      1s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
    191. 

  191. #counts   SARE_HTML_TITLE_SEX      6s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
    192. 

  192. 

  193. ########  ######################   ##################################################
    194. 

  194. #   <A> and HREF rules          
    195. 

  195. ########  ######################   ##################################################
    196. 

  196. 

  197. full      SARE_HTML_A_BODY         /(?!<body>\n\n<a href)<body>.{0,4}<a href/is
    198. 

  198. describe  SARE_HTML_A_BODY         Message body has very strange HTML sequence
    199. 

  199. score     SARE_HTML_A_BODY         0.742
    200. 

  200. #hist     SARE_HTML_A_BODY         Fred T: FR_BODY_AHREF
    201. 

  201. #counts   SARE_HTML_A_BODY         419s/2h of 333405 corpus (262498s/70907h RM) 05/12/06
    202. 

  202. #max      SARE_HTML_A_BODY         1527s/18h of 689155 corpus (348140s/341015h RM) 09/18/05
    203. 

  203. #counts   SARE_HTML_A_BODY         20s/1h of 56024 corpus (51686s/4338h AxB2) 05/15/06
    204. 

  204. #counts   SARE_HTML_A_BODY         2s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    205. 

  205. #max      SARE_HTML_A_BODY         92s/3h of 10826 corpus (6364s/4462h CT) 05/28/05
    206. 

  206. #counts   SARE_HTML_A_BODY         30s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
    207. 

  207. #counts   SARE_HTML_A_BODY         359s/25h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    208. 

  208. #counts   SARE_HTML_A_BODY         134s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
    209. 

  209. #counts   SARE_HTML_A_BODY         10s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
    210. 

  210. #max      SARE_HTML_A_BODY         50s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
    211. 

  211. 

  212. ########  ######################   ##################################################
    213. 

  213. #   Spamsign character sets and fonts 
    214. 

  214. ########  ######################   ##################################################
    215. 

  215. 

  216. rawbody   SARE_HTML_FONT_EBEF      m'</body></font>'i
    217. 

  217. describe  SARE_HTML_FONT_EBEF      Message body has very strange HTML sequence
    218. 

  218. score     SARE_HTML_FONT_EBEF      0.658
    219. 

  219. #ham      SARE_HTML_FONT_EBEF      verified (1) 
    220. 

  220. #hist     SARE_HTML_FONT_EBEF      Fred T: FR_BODY_FONT
    221. 

  221. #counts   SARE_HTML_FONT_EBEF      0s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
    222. 

  222. #max      SARE_HTML_FONT_EBEF      44s/1h of 281655 corpus (110173s/171482h RM) 05/05/05
    223. 

  223. #counts   SARE_HTML_FONT_EBEF      36s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    224. 

  224. #max      SARE_HTML_FONT_EBEF      123s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
    225. 

  225. #counts   SARE_HTML_FONT_EBEF      1s/1h of 23074 corpus (17350s/5724h MY) 05/14/06
    226. 

  226. #max      SARE_HTML_FONT_EBEF      50s/1h of 31513 corpus (27912s/3601h MY) 03/09/05
    227. 

  227. #counts   SARE_HTML_FONT_EBEF      0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
    228. 

  228. 

  229. rawbody   SARE_HTML_FONT_SPL       /^\#[a-z0-9]{6}>/i    
    230. 

  230. describe  SARE_HTML_FONT_SPL       Message uses suspicious font size and/or color
    231. 

  231. score     SARE_HTML_FONT_SPL       0.650
    232. 

  232. #ham      SARE_HTML_FONT_SPL       verified (1)
    233. 

  233. #hist     SARE_HTML_FONT_SPL       Charles Gregory 
    234. 

  234. #overlap  SARE_HTML_FONT_SPL       Overlaps strongly with SARE_HTML_A_INV, though there's no regex overlap
    235. 

  235. #overlap  SARE_HTML_FONT_SPL       Overlaps strongly with SARE_HTML_FONT_SPLIT for obvious reasons, but not enough to warrant dropping one.
    236. 

  236. #counts   SARE_HTML_FONT_SPL       3s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
    237. 

  237. #max      SARE_HTML_FONT_SPL       360s/0h of 85073 corpus (62478s/22595h RM) 06/07/04
    238. 

  238. #counts   SARE_HTML_FONT_SPL       5s/0h of 9991 corpus (5656s/4335h AxB) 05/14/06
    239. 

  239. #counts   SARE_HTML_FONT_SPL       1s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    240. 

  240. #max      SARE_HTML_FONT_SPL       14s/0h of 6944 corpus (3188s/3756h CT) 05/19/04
    241. 

  241. #counts   SARE_HTML_FONT_SPL       5s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    242. 

  242. #max      SARE_HTML_FONT_SPL       53s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
    243. 

  243. #counts   SARE_HTML_FONT_SPL       3s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
    244. 

  244. #counts   SARE_HTML_FONT_SPL       0s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
    245. 

  245. #max      SARE_HTML_FONT_SPL       1s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
    246. 

  246. 

  247. ########  ######################   ##################################################
    248. 

  248. #   Invalid or Suspicious URI Tests
    249. 

  249. ########  ######################   ##################################################
    250. 

  250. 

  251. rawbody   SARE_HTML_URI_ESCWWW     /(?:%77w%77|w%77%77|%77%77w)/i
    252. 

  252. describe  SARE_HTML_URI_ESCWWW     URI with obfuscated destination 
    253. 

  253. score     SARE_HTML_URI_ESCWWW     2.222
    254. 

  254. #hist     SARE_HTML_URI_ESCWWW     Fred T: FR_ESCAPE_WWW
    255. 

  255. #overlap  SARE_HTML_URI_ESCWWW     Overlaps with SARE_HTML_FSIZE_1ALL
    256. 

  256. #counts   SARE_HTML_URI_ESCWWW     2572s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
    257. 

  257. #counts   SARE_HTML_URI_ESCWWW     16s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
    258. 

  258. #counts   SARE_HTML_URI_ESCWWW     0s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    259. 

  259. #max      SARE_HTML_URI_ESCWWW     3s/0h of 6944 corpus (3188s/3756h CT) 05/19/04
    260. 

  260. #counts   SARE_HTML_URI_ESCWWW     117s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
    261. 

  261. #counts   SARE_HTML_URI_ESCWWW     0s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    262. 

  262. #max      SARE_HTML_URI_ESCWWW     16s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
    263. 

  263. #counts   SARE_HTML_URI_ESCWWW     70s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
    264. 

  264. #counts   SARE_HTML_URI_ESCWWW     0s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
    265. 

  265. #max      SARE_HTML_URI_ESCWWW     1s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
    266. 

  266. 

  267. uri       SARE_HTML_URI_LHOST30    m*^https?://[a-z0-9]{30}\.*i
    268. 

  268. describe  SARE_HTML_URI_LHOST30    Long unbroken string within URI
    269. 

  269. score     SARE_HTML_URI_LHOST30    1.666
    270. 

  270. #hist     SARE_HTML_URI_LHOST30    Fred T (originally 40,)
    271. 

  271. #ham      SARE_HTML_URI_LHOST30    30: www.rebuildingthevillagefoundation.org
    272. 

  272. #counts   SARE_HTML_URI_LHOST30    301s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
    273. 

  273. #counts   SARE_HTML_URI_LHOST30    18s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
    274. 

  274. #counts   SARE_HTML_URI_LHOST30    6s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    275. 

  275. #counts   SARE_HTML_URI_LHOST30    27s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
    276. 

  276. #counts   SARE_HTML_URI_LHOST30    0s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    277. 

  277. #max      SARE_HTML_URI_LHOST30    3s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
    278. 

  278. #counts   SARE_HTML_URI_LHOST30    128s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
    279. 

  279. #counts   SARE_HTML_URI_LHOST30    5s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
    280. 

  280. #max      SARE_HTML_URI_LHOST30    13s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
    281. 

  281. 

  282. uri       SARE_HTML_URI_LHOST31    m*^https?://[a-z0-9]{31,}\.*i
    283. 

  283. describe  SARE_HTML_URI_LHOST31    Long unbroken string within URI
    284. 

  284. score     SARE_HTML_URI_LHOST31    1.666
    285. 

  285. #hist     SARE_HTML_URI_LHOST31    Fred T (originally 40,)
    286. 

  286. #ham      SARE_HTML_URI_LHOST31    30: www.rebuildingthevillagefoundation.org
    287. 

  287. #counts   SARE_HTML_URI_LHOST31    776s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
    288. 

  288. #max      SARE_HTML_URI_LHOST31    840s/15h of 689155 corpus (348140s/341015h RM) 09/18/05
    289. 

  289. #counts   SARE_HTML_URI_LHOST31    90s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
    290. 

  290. #counts   SARE_HTML_URI_LHOST31    99s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    291. 

  291. #counts   SARE_HTML_URI_LHOST31    125s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
    292. 

  292. #counts   SARE_HTML_URI_LHOST31    456s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
    293. 

  293. #counts   SARE_HTML_URI_LHOST31    94s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
    294. 

  294. #counts   SARE_HTML_URI_LHOST31    21s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    295. 

  295. 

  296. uri       SARE_HTML_URI_NOMORE     m'/nomore\.htm'i
    297. 

  297. describe  SARE_HTML_URI_NOMORE     URI to page name which suggests spammer's page
    298. 

  298. score     SARE_HTML_URI_NOMORE     0.906
    299. 

  299. #ham      SARE_HTML_URI_NOMORE     http://www.afsc.org/nomore.htm; Student Peace Action Network (SPAN)
    300. 

  300. #counts   SARE_HTML_URI_NOMORE     2s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
    301. 

  301. #max      SARE_HTML_URI_NOMORE     1200s/0h of 92209 corpus (74874s/17335h RM) 01/17/04
    302. 

  302. #counts   SARE_HTML_URI_NOMORE     7s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
    303. 

  303. #counts   SARE_HTML_URI_NOMORE     0s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    304. 

  304. #max      SARE_HTML_URI_NOMORE     69s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
    305. 

  305. #counts   SARE_HTML_URI_NOMORE     54s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    306. 

  306. #max      SARE_HTML_URI_NOMORE     68s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
    307. 

  307. #counts   SARE_HTML_URI_NOMORE     0s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
    308. 

  308. #max      SARE_HTML_URI_NOMORE     4s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
    309. 

  309. 

  310. uri       SARE_HTML_URI_OUTPHP     /\bout\.php/i
    311. 

  311. describe  SARE_HTML_URI_OUTPHP     text uri to unsubscribe link
    312. 

  312. score     SARE_HTML_URI_OUTPHP     0.907
    313. 

  313. #addsto   SARE_HTML_URI_OUTPHP     SARE_HTML_URI_OPTPHP
    314. 

  314. #ham      SARE_HTML_URI_OUTPHP     Bravenet ad attached to reply form email
    315. 

  315. #counts   SARE_HTML_URI_OUTPHP     80s/3h of 333405 corpus (262498s/70907h RM) 05/12/06
    316. 

  316. #max      SARE_HTML_URI_OUTPHP     144s/2h of 689155 corpus (348140s/341015h RM) 09/18/05
    317. 

  317. #counts   SARE_HTML_URI_OUTPHP     88s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
    318. 

  318. #counts   SARE_HTML_URI_OUTPHP     10s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    319. 

  319. #max      SARE_HTML_URI_OUTPHP     21s/0h of 6944 corpus (3188s/3756h CT) 05/19/04
    320. 

  320. #counts   SARE_HTML_URI_OUTPHP     4s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
    321. 

  321. #counts   SARE_HTML_URI_OUTPHP     13s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    322. 

  322. #max      SARE_HTML_URI_OUTPHP     25s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
    323. 

  323. #counts   SARE_HTML_URI_OUTPHP     58s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
    324. 

  324. #counts   SARE_HTML_URI_OUTPHP     0s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
    325. 

  325. #max      SARE_HTML_URI_OUTPHP     17s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
    326. 

  326. 

  327. uri       SARE_HTML_URI_PARTID     m|/[\?\&]partid=|i
    328. 

  328. describe  SARE_HTML_URI_PARTID     Partner Id in URL
    329. 

  329. score     SARE_HTML_URI_PARTID     0.166
    330. 

  330. #hist     SARE_HTML_URI_PARTID     Loren Wilton <lwilton@earthlink.net>, Sat, 3 Apr 2004 20:29:32 -0800
    331. 

  331. #counts   SARE_HTML_URI_PARTID     0s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
    332. 

  332. #max      SARE_HTML_URI_PARTID     1264s/0h of 85073 corpus (62478s/22595h RM) 06/07/04
    333. 

  333. #counts   SARE_HTML_URI_PARTID     0s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    334. 

  334. #max      SARE_HTML_URI_PARTID     37s/0h of 6944 corpus (3188s/3756h CT) 05/19/04
    335. 

  335. #counts   SARE_HTML_URI_PARTID     81s/6h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    336. 

  336. #max      SARE_HTML_URI_PARTID     302s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
    337. 

  337. #counts   SARE_HTML_URI_PARTID     3s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
    338. 

  338. #max      SARE_HTML_URI_PARTID     26s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
    339. 

  339. 

  340. ########  ######################   ##################################################
    341. 

  341. #  <!-- Comment tag tests
    342. 

  342. ########  ######################   ##################################################
    343. 

  343. 

  344. meta      SARE_HTML_CMT_CNTR       __SARE_HTML_CMT_CNTR
    345. 

  345. describe  SARE_HTML_CMT_CNTR       Message has a center followed by a comment
    346. 

  346. score     SARE_HTML_CMT_CNTR       0.676
    347. 

  347. #hist     SARE_HTML_CMT_CNTR       Carl F: CRM_CENTER_COM
    348. 

  348. #ham      SARE_HTML_CMT_CNTR       Strategic Developer <strategicdeveloper@newsletter.infoworld.com>, Thursday, January 27, 2005, 10:57:37 AM  
    349. 

  349. #counts   SARE_HTML_CMT_CNTR       9s/2h of 333405 corpus (262498s/70907h RM) 05/12/06
    350. 

  350. #max      SARE_HTML_CMT_CNTR       173s/7h of 689155 corpus (348140s/341015h RM) 09/18/05
    351. 

  351. #counts   SARE_HTML_CMT_CNTR       1s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
    352. 

  352. #counts   SARE_HTML_CMT_CNTR       53s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
    353. 

  353. #max      SARE_HTML_CMT_CNTR       196s/0h of 32260 corpus (8983s/23277h JH) 05/14/04
    354. 

  354. #counts   SARE_HTML_CMT_CNTR       2s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
    355. 

  355. #counts   SARE_HTML_CMT_CNTR       21s/1h of 23074 corpus (17350s/5724h MY) 05/14/06
    356. 

  356. #counts   SARE_HTML_CMT_CNTR       1s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
    357. 

  357. #counts   SARE_HTML_CMT_CNTR       0s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
    358. 

  358. #max      SARE_HTML_CMT_CNTR       7s/0h of 6944 corpus (3188s/3756h CT) 05/19/04
    359. 

  359. 

  360. ########  ######################   ##################################################
    361. 

  361. #   Image tag tests
    362. 

  362. ########  ######################   ##################################################
    363. 

  363. 

  364. rawbody   SARE_HTML_IMG_2AT        /IMG\s*SRC\s*=s*"cid:part1\.\d{8}.\d{8}\@[a-z]+\@[\w\.]+"/is
    365. 

  365. describe  SARE_HTML_IMG_2AT        strange internal image link
    366. 

  366. score     SARE_HTML_IMG_2AT        1.216
    367. 

  367. #hist     SARE_HTML_IMG_2AT        Loren Wilton: LW_DOUBLE_AT
    368. 

  368. #hist     SARE_HTML_IMG_2AT        Apr 2 2005, Bob Menschel, Added spaces around "="
    369. 

  369. #hist     SARE_HTML_IMG_2AT        Apr 16 2005, Bob Menschel, replaced spaces with \s
    370. 

  370. #counts   SARE_HTML_IMG_2AT        328s/13h of 333405 corpus (262498s/70907h RM) 05/12/06
    371. 

  371. #max      SARE_HTML_IMG_2AT        3648s/4h of 689155 corpus (348140s/341015h RM) 09/18/05
    372. 

  372. #counts   SARE_HTML_IMG_2AT        222s/0h of 9991 corpus (5656s/4335h AxB) 05/14/06
    373. 

  373. #counts   SARE_HTML_IMG_2AT        69s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    374. 

  374. #counts   SARE_HTML_IMG_2AT        828s/1h of 42454 corpus (34336s/8118h FVGT) 05/15/06
    375. 

  375. #counts   SARE_HTML_IMG_2AT        57s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    376. 

  376. #counts   SARE_HTML_IMG_2AT        280s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
    377. 

  377. #counts   SARE_HTML_IMG_2AT        0s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
    378. 

  378. #max      SARE_HTML_IMG_2AT        105s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
    379. 

  379. 

  380. ########  ######################   ##################################################
    381. 

  381. #  <tag ... ALT= ...> tag tests
    382. 

  382. ########  ######################   ##################################################
    383. 

  383. 

  384. ########  ######################   ##################################################
    385. 

  385. #   Javascript and object tests     
    386. 

  386. ########  ######################   ##################################################
    387. 

  387. 

  388. full      SARE_HTML_IMG_ONLY       m'<(?:html|body).{1,200}<a.{12,145}<img.{11,200}</(?:body|html)>'is
    389. 

  389. describe  SARE_HTML_IMG_ONLY       Short HTML msg, IMG and A HREF, maybe naught else
    390. 

  390. score     SARE_HTML_IMG_ONLY       1.666
    391. 

  391. #ham      SARE_HTML_IMG_ONLY       Verified (image-only ham)
    392. 

  392. #hist     SARE_HTML_IMG_ONLY       Originally Fred T: FVGT_m_IMAGE_ONLY
    393. 

  393. #hist     SARE_HTML_IMG_ONLY       Enhanced May 29 2004 by Bob Menschel, incorporate all tests in one regex
    394. 

  394. #ham      SARE_HTML_IMG_ONLY       5: Oct 2002 Yahoo webmail with automatically inserted FAULTY flamingtext.com advertisement
    395. 

  395. #overlap  SARE_HTML_IMG_ONLY       Rules that completely overlap this one: SARE_HTML_PILL3, SARE_HTML_PILL4
    396. 

  396. #counts   SARE_HTML_IMG_ONLY       14904s/16h of 333405 corpus (262498s/70907h RM) 05/12/06
    397. 

  397. #counts   SARE_HTML_IMG_ONLY       70s/1h of 56024 corpus (51686s/4338h AxB2) 05/15/06
    398. 

  398. #counts   SARE_HTML_IMG_ONLY       154s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    399. 

  399. #counts   SARE_HTML_IMG_ONLY       4131s/6h of 42454 corpus (34336s/8118h FVGT) 05/15/06
    400. 

  400. #counts   SARE_HTML_IMG_ONLY       261s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    401. 

  401. #max      SARE_HTML_IMG_ONLY       553s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
    402. 

  402. #counts   SARE_HTML_IMG_ONLY       4730s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
    403. 

  403. #counts   SARE_HTML_IMG_ONLY       7s/7h of 23074 corpus (17350s/5724h MY) 05/14/06
    404. 

  404. #max      SARE_HTML_IMG_ONLY       141s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
    405. 

  405. 

  406. rawbody   SARE_HTML_JVS_FLASH      m'codebase="https://download\.macromedia\.com/pub/shockwave'i
    407. 

  407. describe  SARE_HTML_JVS_FLASH      Tries to load flash animation 
    408. 

  408. score     SARE_HTML_JVS_FLASH      1.246
    409. 

  409. #ham      SARE_HTML_JVS_FLASH      verified (1) cbs.marketwatch.com
    410. 

  410. #hist     SARE_HTML_JVS_FLASH      Mike Kuentz <JunkEmail@rapidigm.com>
    411. 

  411. #counts   SARE_HTML_JVS_FLASH      444s/3h of 333405 corpus (262498s/70907h RM) 05/12/06
    412. 

  412. #counts   SARE_HTML_JVS_FLASH      33s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
    413. 

  413. #counts   SARE_HTML_JVS_FLASH      0s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    414. 

  414. #max      SARE_HTML_JVS_FLASH      4s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
    415. 

  415. #counts   SARE_HTML_JVS_FLASH      0s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
    416. 

  416. #max      SARE_HTML_JVS_FLASH      7s/0h of 29366 corpus (5882s/23484h JH) 07/23/04 TM2 SA3.0-pre2
    417. 

  417. #counts   SARE_HTML_JVS_FLASH      53s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
    418. 

  418. #counts   SARE_HTML_JVS_FLASH      0s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
    419. 

  419. #max      SARE_HTML_JVS_FLASH      28s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
    420. 

  420. 

  421. ########  ######################   ##################################################
    422. 

  422. #  Obviously invalid html tag
    423. 

  423. ########  ######################   ##################################################
    424. 

  424. 

  425. header    __CT_TEXT_PLAIN          Content-Type =~ /^text\/plain\b/i
    426. 

  426. rawbody   __SARE_HTML_INV_TAG      /\w<\!\w{18,60}>\w/i
    427. 

  427. rawbody   __SARE_HTML_INV_TAG2     m'\w</?(?!(?:blockquote|optiongroup|plaintext|fontfamily|underline|cf.+))[a-z]{9,17}>\w'
    428. 

  428. rawbody   __SARE_HTML_INV_TAG3     m'\w<[/!]?(?!cf.+)\w{11,20}>\w'i
    429. 

  429. rawbody   __SARE_HTML_INV_TAG4     m'\w(?!</?cf.{1,8}>)<[/!]?[bcdfghjklmnpqrstvwxz]{5,9}>\w'i
    430. 

  430. 

  431. meta      SARE_HTML_INV_TAG        ( __SARE_HTML_INV_TAG || __SARE_HTML_INV_TAG2 || __SARE_HTML_INV_TAG3 || __SARE_HTML_INV_TAG4 ) && !__CT_TEXT_PLAIN
    432. 

  432. describe  SARE_HTML_INV_TAG        Message contains invalid HTML tag
    433. 

  433. score     SARE_HTML_INV_TAG        2.222
    434. 

  434. #ham      SARE_HTML_INV_TAG        Monotone source code included within body of email
    435. 

  435. #hist     SARE_HTML_INV_TAG        Combined three invalid-tag rules into one, added \w front and back, to test for
    436. 

  436. #hist     SARE_HTML_INV_TAG        obfuscation of surrounding text, added tests against __CT_TEXT_PLAIN to give 
    437. 

  437. #hist     SARE_HTML_INV_TAG        higher scores to HTML email than to plain text email. Enhancements due to 
    438. 

  438. #hist     SARE_HTML_INV_TAG        ideas suggested by Jesse Houwing, Nicolas Riendeau, and Bob Menschel
    439. 

  439. #counts   SARE_HTML_INV_TAG        36s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
    440. 

  440. #max      SARE_HTML_INV_TAG        5650s/0h of 114422 corpus (81069s/33353h RM) 01/16/05
    441. 

  441. #counts   SARE_HTML_INV_TAG        8s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    442. 

  442. #max      SARE_HTML_INV_TAG        66s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
    443. 

  443. #counts   SARE_HTML_INV_TAG        21s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
    444. 

  444. #counts   SARE_HTML_INV_TAG        386s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    445. 

  445. #max      SARE_HTML_INV_TAG        930s/0h of 38766 corpus (15284s/23482h JH-SA3.0rc1) 09/03/04
    446. 

  446. #counts   SARE_HTML_INV_TAG        17s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
    447. 

  447. #counts   SARE_HTML_INV_TAG        0s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
    448. 

  448. #max      SARE_HTML_INV_TAG        952s/0h of 19469 corpus (16883s/2586h MY) 09/03/04
    449. 

  449. 

  450. ########  ######################   ##################################################
    451. 

  451. #   Paragraphs, breaks, and spacings
    452. 

  452. ########  ######################   ##################################################
    453. 

  453. 

  454. ########  ######################   ##################################################
    455. 

  455. #  Suspicious tag combinations
    456. 

  456. ########  ######################   ##################################################
    457. 

  457. 

  458. rawbody   SARE_HTML_CNTR_TBL       /<center>\s*<table>/im
    459. 

  459. describe  SARE_HTML_CNTR_TBL       Contains centred table
    460. 

  460. score     SARE_HTML_CNTR_TBL       1.666
    461. 

  461. #ham      SARE_HTML_CNTR_TBL       verified (1) 
    462. 

  462. #hist     SARE_HTML_CNTR_TBL       Tim Jackson, May 25 2005
    463. 

  463. #counts   SARE_HTML_CNTR_TBL       745s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
    464. 

  464. #counts   SARE_HTML_CNTR_TBL       1188s/2h of 56024 corpus (51686s/4338h AxB2) 05/15/06
    465. 

  465. #counts   SARE_HTML_CNTR_TBL       0s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    466. 

  466. #max      SARE_HTML_CNTR_TBL       3s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
    467. 

  467. #counts   SARE_HTML_CNTR_TBL       27s/1h of 42454 corpus (34336s/8118h FVGT) 05/15/06
    468. 

  468. #counts   SARE_HTML_CNTR_TBL       0s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    469. 

  469. #counts   SARE_HTML_CNTR_TBL       2s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
    470. 

  470. #counts   SARE_HTML_CNTR_TBL       32s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
    471. 

  471. #max      SARE_HTML_CNTR_TBL       57s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
    472. 

  472. 

  473. rawbody   __SARE_HTML_SINGLET1     /> [a-z] </i
    474. 

  474. rawbody   __SARE_HTML_SINGLET2     />[a-z]</i
    475. 

  475. meta      SARE_HTML_SINGLETS       __SARE_HTML_SINGLET1 && __SARE_HTML_SINGLET2
    476. 

  476. describe  SARE_HTML_SINGLETS       spam pattern in HTML email
    477. 

  477. score     SARE_HTML_SINGLETS       1.666
    478. 

  478. #hist     SARE_HTML_SINGLETS       Robert Brooks, March 2006
    479. 

  479. #ham      SARE_HTML_SINGLETS       verified (amateur webmaster sample page attached to email)
    480. 

  480. #counts   SARE_HTML_SINGLETS       26498s/3h of 333405 corpus (262498s/70907h RM) 05/12/06
    481. 

  481. #counts   SARE_HTML_SINGLETS       3660s/2h of 55981 corpus (51658s/4323h AxB2) 05/15/06
    482. 

  482. #counts   SARE_HTML_SINGLETS       130s/0h of 13285 corpus (7413s/5872h CT) 05/14/06
    483. 

  483. #counts   SARE_HTML_SINGLETS       2016s/0h of 155481 corpus (103930s/51551h DOC) 05/15/06
    484. 

  484. #counts   SARE_HTML_SINGLETS       65s/2h of 42253 corpus (34139s/8114h FVGT) 05/15/06
    485. 

  485. #counts   SARE_HTML_SINGLETS       5798s/1h of 106183 corpus (72941s/33242h ML) 05/14/06
    486. 

  486. #counts   SARE_HTML_SINGLETS       20s/1h of 22939 corpus (17232s/5707h MY) 05/14/06
    487. 

  487. 

  488. ########  ######################   ##################################################
    489. 

  489. #  Useless tags (tag structures that do nothing) 
    490. 

  490. #  Largely submitted by Matt Yackley, with contributions by 
    491. 

  491. #  Carl Friend, Jennifer Wheeler, Scott Sprunger, Larry Gilson
    492. 

  492. ########  ######################   ##################################################
    493. 

  493. 

  494. rawbody   SARE_HTML_USL_FONT       m'^<FONT[^>]{0,20}></FONT><'
    495. 

  495. describe  SARE_HTML_USL_FONT       Another spam attempt
    496. 

  496. score     SARE_HTML_USL_FONT       0.797
    497. 

  497. #hist     SARE_HTML_USL_FONT       Loren Wilton Apr 11 2005
    498. 

  498. #counts   SARE_HTML_USL_FONT       54s/2h of 333405 corpus (262498s/70907h RM) 05/12/06
    499. 

  499. #max      SARE_HTML_USL_FONT       5192s/1h of 269462 corpus (128310s/141152h RM) 06/17/05
    500. 

  500. #counts   SARE_HTML_USL_FONT       0s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
    501. 

  501. #max      SARE_HTML_USL_FONT       1s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
    502. 

  502. #counts   SARE_HTML_USL_FONT       0s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
    503. 

  503. #max      SARE_HTML_USL_FONT       9s/0h of 6804 corpus (1336s/5468h ft) 06/17/05
    504. 

  504. #counts   SARE_HTML_USL_FONT       7s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    505. 

  505. #counts   SARE_HTML_USL_FONT       32s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
    506. 

  506. #counts   SARE_HTML_USL_FONT       81s/1h of 23074 corpus (17350s/5724h MY) 05/14/06
    507. 

  507. #max      SARE_HTML_USL_FONT       1047s/1h of 57287 corpus (52272s/5015h MY) 09/22/05
    508. 

  508. 

  509. rawbody   SARE_HTML_USL_OBFU       m'\w<(\w+)(?: [^>]*)?></\1[^>]*>\w'
    510. 

  510. describe  SARE_HTML_USL_OBFU       Message body has very strange HTML sequence
    511. 

  511. score     SARE_HTML_USL_OBFU       1.666
    512. 

  512. #match    SARE_HTML_USL_OBFU       partialword<tag></tag>restofword
    513. 

  513. #hist     SARE_HTML_USL_OBFU       Created by Bob Menschel Aug 12 2004
    514. 

  514. #counts   SARE_HTML_USL_OBFU       393s/3h of 333405 corpus (262498s/70907h RM) 05/12/06
    515. 

  515. #max      SARE_HTML_USL_OBFU       520s/6h of 196718 corpus (96193s/100525h RM) 02/22/05
    516. 

  516. #counts   SARE_HTML_USL_OBFU       14s/0h of 9991 corpus (5656s/4335h AxB) 05/14/06
    517. 

  517. #counts   SARE_HTML_USL_OBFU       0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
    518. 

  518. #max      SARE_HTML_USL_OBFU       16s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
    519. 

  519. #counts   SARE_HTML_USL_OBFU       88s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
    520. 

  520. #counts   SARE_HTML_USL_OBFU       298s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
    521. 

  521. #max      SARE_HTML_USL_OBFU       457s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
    522. 

  522. #counts   SARE_HTML_USL_OBFU       111s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
    523. 

  523. #counts   SARE_HTML_USL_OBFU       21s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
    524. 

  524. #max      SARE_HTML_USL_OBFU       148s/0h of 17145 corpus (14677s/2468h MY) 08/12/04
    525. 

  525. 

  526. ########  ######################   ##################################################
    527. 

  527. #   Miscellaneous tag tests
    528. 

  528. ########  ######################   ##################################################
    529. 

  529. 

  530. # EOF
    531. 

  531. 

  532. 

  533.