# SARE Spammer URI Rule Set for SpamAssassin - file 1 # Version: 01.01.05 # Created: 2004-09-13 # Modified: 2005-10-10 # Usage instructions and documentation are found in 70_sare_uri0.cf #@@# Revision History: Full Revision History stored in 70_sare_uri.log #@@# 01.01.03: Oct 05 2005 #@@# Minor score updates based on additional mass-check #@@# Renamed __SARE_BODY_BLANKS_5_100 to __SARE_BODY_BLNK_5_100 #@@# Added to file 1: SARE_URI_REFI #@@# Moved file 0 to file 1: SARE_URI_PRIME #@@# Moved file 1 to file 4: SARE_URI_CAMPAIGNID #@@# Moved file 1 to file 4: SARE_URI_CASINO #@@# Moved file 1 to file x31: SARE_URI_MIXED_CASE #@@# 01.01.04: Oct 05 2005 #@@# Corrected lint error in SARE_URI_GEOCIT_NUM #@@# 01.01.05: Oct 10 2005 #@@# Temp disable SARE_URI_SIXCAPS due to http://bugzilla.spamassassin.org/show_bug.cgi?id=4621 # License: Artistic - see http://www.rulesemporium.com/license.txt # Current Maintainer: Bob Menschel - uri@rulesemporium.com # Current Home: http://www.rulesemporium.com/rules/70_sare_uri1.cf ######## ###################### ################################################## # Rule definitions to avoid --lint errors on archived/moved rules. ######## ###################### ################################################## meta SARE_URI_CAMPAIGNID 0 meta SARE_URI_CASINO 0 meta SARE_URI_MIXED_CASE 0 ######## ###################### ################################################## # Category: Sub-rules needed by others ######## ###################### ################################################## uri __SARE_URI_ANY /./ #hist __SARE_URI_ANY Murty Rompalli, 2005-01-03 body __SARE_BODY_BLNK_5_100 eval:check_blank_line_ratio('5','100') #hist __SARE_BODY_BLNK_5_100 Murty Rompalli, 2005-01-03 meta __SARE_META_MURTY3 (__SARE_URI_ANY && __SARE_BODY_BLNK_5_100) #hist __SARE_META_MURTY3 Murty Rompalli, 2005-01-03 ######## ###################### ################################################## # Category: URI links identified by spammer words ######## ###################### ################################################## uri SARE_URI_4_BIZ /4.{0,24}\.biz/i describe SARE_URI_4_BIZ Domain has a "four-you" type domain name score SARE_URI_4_BIZ 0.144 #hist SARE_URI_4_BIZ Fred Tarasevicius - FU_4_BIZ #ham SARE_URI_4_BIZ 40iseinc.biz #counts SARE_URI_4_BIZ 220s/155h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_URI_4_BIZ 827s/1h of 114212 corpus (81067s/33145h RM) 01/19/05 #counts SARE_URI_4_BIZ 147s/0h of 54828 corpus (17650s/37178h JH-3.01) 03/13/05 #counts SARE_URI_4_BIZ 37s/1h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_URI_4_BIZ 67s/1h of 26190 corpus (22790s/3400h MY) 02/15/05 #counts SARE_URI_4_BIZ 0s/0h of 682 corpus (290s/392h CRF) 02/16/05 #counts SARE_URI_4_BIZ 12s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_URI_4_BIZ 60s/0h of 11015 corpus (6587s/4428h CT) 03/10/05 #counts SARE_URI_4_BIZ 0s/3h of 7500 corpus (1767s/5733h ft) 09/18/05 uri SARE_URI_ANUMA /\.[a-z]{4,}\d{4,}[a-z]{4,}\.(?:com|net|biz|info|org)/i describe SARE_URI_ANUMA Domain with ALPHAs NUMBERs APLHAs score SARE_URI_ANUMA 0.632 #ham SARE_URI_ANUMA studio1509fineart.com #hist SARE_URI_ANUMA Created by Chris Santerre Aug 31 2004 #counts SARE_URI_ANUMA 76s/8h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_URI_ANUMA 443s/0h of 70699 corpus (43133s/27566h RM) 10/02/04 #counts SARE_URI_ANUMA 4s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_URI_ANUMA 88s/0h of 19448 corpus (16862s/2586h MY) 08/31/04 #counts SARE_URI_ANUMA 36s/0h of 54103 corpus (16925s/37178h JH-3.01) 02/15/05 #max SARE_URI_ANUMA 117s/0h of 38753 corpus (15271s/23482h JH-SA3.0rc1) 09/03/04 #counts SARE_URI_ANUMA 0s/0h of 682 corpus (290s/392h CRF) 02/16/05 #counts SARE_URI_ANUMA 8s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_URI_ANUMA 12s/0h of 11015 corpus (6587s/4428h CT) 03/10/05 uri SARE_URI_BARGAIN /bargain/i describe SARE_URI_BARGAIN URL has common spammer word score SARE_URI_BARGAIN 0.634 #hist SARE_URI_BARGAIN FU_BARGAIN #ham SARE_URI_BARGAIN "smart bargains" in fwd of FamilyCorner.com Magazine #counts SARE_URI_BARGAIN 583s/50h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_URI_BARGAIN 33s/3h of 54103 corpus (16925s/37178h JH-3.01) 02/15/05 #max SARE_URI_BARGAIN 224s/3h of 44759 corpus (16528s/28231h JH-SA3.0rc1) 09/06/04 #counts SARE_URI_BARGAIN 160s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_URI_BARGAIN 0s/0h of 682 corpus (290s/392h CRF) 02/16/05 #counts SARE_URI_BARGAIN 2s/1h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_URI_BARGAIN 23s/1h of 11015 corpus (6587s/4428h CT) 03/10/05 uri SARE_URI_DEALZ /dealz/i describe SARE_URI_DEALZ spam contains misspelled URI word score SARE_URI_DEALZ 1.666 #hist SARE_URI_DEALZ Created by Bob Menschel May 16 2004 #ham SARE_URI_DEALZ www.slickdealz.net, NYTimes.com Sunday, January 02, 2005 #counts SARE_URI_DEALZ 5063s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_URI_DEALZ 505s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_URI_DEALZ 77s/0h of 19448 corpus (16863s/2585h MY) 09/06/04 #counts SARE_URI_DEALZ 26s/0h of 54103 corpus (16925s/37178h JH-3.01) 02/15/05 #max SARE_URI_DEALZ 218s/0h of 44759 corpus (16528s/28231h JH-SA3.0rc1) 09/06/04 #counts SARE_URI_DEALZ 0s/0h of 682 corpus (290s/392h CRF) 02/16/05 #counts SARE_URI_DEALZ 1s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_URI_DEALZ 3s/1h of 11015 corpus (6587s/4428h CT) 03/10/05 uri SARE_URI_GOOD /(?!\.greatergood\.com)\.[a-z]{3,8}good\.(?:com|net|info|org|biz)/i describe SARE_URI_GOOD spammer hint found in URI score SARE_URI_GOOD 0.164 #hist SARE_URI_GOOD Chris Santerre and Carl R. Friend, Feb 20 2005 #counts SARE_URI_GOOD 108s/47h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_URI_GOOD 14s/1h of 54828 corpus (17650s/37178h JH-3.01) 03/13/05 #counts SARE_URI_GOOD 27s/1h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_URI_GOOD 89s/1h of 31513 corpus (27912s/3601h MY) 03/09/05 #counts SARE_URI_GOOD 1s/0h of 11015 corpus (6587s/4428h CT) 03/10/05 #counts SARE_URI_GOOD 1s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 uri SARE_URI_OEM /\boem\b/i describe SARE_URI_OEM body contains link to probable spammer page score SARE_URI_OEM 0.533 #hist SARE_URI_OEM Created by Bob Menschel Jun 6 7004 #counts SARE_URI_OEM 100s/14h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_URI_OEM 85s/2h of 175589 corpus (98978s/76611h RM) 02/14/05 #counts SARE_URI_OEM 17s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_URI_OEM 23s/0h of 54103 corpus (16925s/37178h JH-3.01) 02/15/05 #counts SARE_URI_OEM 0s/0h of 682 corpus (290s/392h CRF) 02/16/05 #counts SARE_URI_OEM 4s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 uri SARE_URI_OFF /\boff\.(?:htm|html|php|asp|pl|cgi|jsp)\b/i describe SARE_URI_OFF Unsubscribe at this link score SARE_URI_OFF 0.056 #ham SARE_URI_OFF flowers.com #hist SARE_URI_OFF Fred Tarasevicius - FU_PAGE_OFF #counts SARE_URI_OFF 6s/18h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_URI_OFF 71s/0h of 114212 corpus (81067s/33145h RM) 01/19/05 #counts SARE_URI_OFF 3s/0h of 54103 corpus (16925s/37178h JH-3.01) 02/15/05 #counts SARE_URI_OFF 9s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_URI_OFF 0s/0h of 682 corpus (290s/392h CRF) 02/16/05 #counts SARE_URI_OFF 0s/0h of 11015 corpus (6587s/4428h CT) 03/10/05 uri SARE_URI_PILLS /\bpill[sz]\b/i describe SARE_URI_PILLS text references likely spammer score SARE_URI_PILLS 1.047 #hist SARE_URI_PILLS Created by Bob Menschel Apr 04 2004, added z Feb 2 2005 #hist SARE_URI_PILLS Bugzilla entry 3789, Sep 18 2004 #counts SARE_URI_PILLS 128s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_URI_PILLS 2050s/0h of 115925 corpus (94616s/21309h RM) 05/01/04 #counts SARE_URI_PILLS 27s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_URI_PILLS 262s/0h of 19448 corpus (16863s/2585h MY) 09/06/04 #counts SARE_URI_PILLS 17s/0h of 54084 corpus (16906s/37178h JH-3.01) 03/02/05 #max SARE_URI_PILLS 360s/0h of 54103 corpus (16925s/37178h JH-3.01) 02/15/05 #counts SARE_URI_PILLS 1s/0h of 682 corpus (290s/392h CRF) 02/16/05 #counts SARE_URI_PILLS 4s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 uri SARE_URI_PRIME m'/prime/' describe SARE_URI_PRIME body contains link to known spammer score SARE_URI_PRIME 0.950 #ham SARE_URI_PRIME confirmed (1) #hist SARE_URI_PRIME Created by Bob Menschel Aug 09 2004 #counts SARE_URI_PRIME 7s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_URI_PRIME 191s/0h of 175589 corpus (98978s/76611h RM) 02/14/05 #counts SARE_URI_PRIME 92s/0h of 54103 corpus (16925s/37178h JH-3.01) 02/15/05 #counts SARE_URI_PRIME 27s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_URI_PRIME 191s/0h of 31513 corpus (27912s/3601h MY) 03/09/05 #counts SARE_URI_PRIME 0s/0h of 682 corpus (290s/392h CRF) 02/16/05 #counts SARE_URI_PRIME 15s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_URI_PRIME 17s/0h of 11015 corpus (6587s/4428h CT) 03/10/05 #counts SARE_URI_PRIME 1s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 uri SARE_URI_REFI /refi\.(com|net|biz|net|us|ws)/i describe SARE_URI_REFI somethingrefi score SARE_URI_REFI 1.666 #ham SARE_URI_REFI spammer URI spammed into non-spam but inadequately moderated mailing list #hist SARE_URI_REFI Alex Broens, July 2005 #counts SARE_URI_REFI 1752s/3h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_URI_REFI 16s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_URI_REFI 2s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_URI_REFI 223s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 uri SARE_URI_REPLICA /\breplica/i describe SARE_URI_REPLICA body contains link to probable spammer page score SARE_URI_REPLICA 1.634 #hist SARE_URI_REPLICA Fred Tarasevicius - FU_REPLICA #counts SARE_URI_REPLICA 872s/5h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_URI_REPLICA 1285s/10h of 238365 corpus (112478s/125887h RM) 02/28/05 #counts SARE_URI_REPLICA 162s/0h of 54828 corpus (17650s/37178h JH-3.01) 03/13/05 #max SARE_URI_REPLICA 195s/0h of 54103 corpus (16925s/37178h JH-3.01) 02/15/05 #counts SARE_URI_REPLICA 111s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_URI_REPLICA 2s/0h of 682 corpus (290s/392h CRF) 02/16/05 #counts SARE_URI_REPLICA 18s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_URI_REPLICA 60s/0h of 11015 corpus (6587s/4428h CT) 03/10/05 uri SARE_URI_RM /\brm\.(?:htm|html|php|asp|pl|cgi|jsp)\b/i describe SARE_URI_RM Unsubscribe at this link score SARE_URI_RM 1.666 #hist SARE_URI_RM Fred Tarasevicius - FU_PAGE_RM #counts SARE_URI_RM 6239s/10h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_URI_RM 548s/0h of 54828 corpus (17650s/37178h JH-3.01) 03/13/05 #counts SARE_URI_RM 3s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_URI_RM 45s/0h of 26190 corpus (22790s/3400h MY) 02/15/05 #counts SARE_URI_RM 2s/0h of 682 corpus (290s/392h CRF) 02/16/05 #counts SARE_URI_RM 341s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_URI_RM 3s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 body __SARE_URI_VISIT_US /\bv(?:i|l|1)+s(?:i|l|1)t[_\W]+(?:us|our)(?:\S+\s+){1,4}(?:https?\:\/\/|www\.)/i meta SARE_URI_VISIT_US (__SARE_URI_VISIT_US && __SARE_META_MURTY3) describe SARE_URI_VISIT_US Visit us at this link score SARE_URI_VISIT_US 1.666 #hist SARE_URI_VISIT_US Murty Rompalli, 2005-01-03 #counts SARE_URI_VISIT_US 3591s/6h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_URI_VISIT_US 158s/0h of 54828 corpus (17650s/37178h JH-3.01) 03/13/05 #counts SARE_URI_VISIT_US 2s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_URI_VISIT_US 35s/0h of 26190 corpus (22790s/3400h MY) 02/15/05 #counts SARE_URI_VISIT_US 1s/0h of 682 corpus (290s/392h CRF) 02/16/05 #counts SARE_URI_VISIT_US 4s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_URI_VISIT_US 2s/1h of 7500 corpus (1767s/5733h ft) 09/18/05 ######## ###################### ################################################## # Category: URI links identified by spammer names ######## ###################### ################################################## uri SARE_URI_ITEM /item.{0,8}[^a-r,t-z]\.com/i describe SARE_URI_ITEM Contains "item" in a URI score SARE_URI_ITEM 0.637 #hist SARE_URI_ITEM Carl R. Friend, Feb 24 2005 #hist SARE_URI_ITEM Bob Menschel, Oct 1 2005, added exclusion for single letter (not s) after item. #counts SARE_URI_ITEM 767s/63h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_URI_ITEM 6s/6h of 54828 corpus (17650s/37178h JH-3.01) 03/13/05 #counts SARE_URI_ITEM 240s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_URI_ITEM 16s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_URI_ITEM 0s/1h of 7500 corpus (1767s/5733h ft) 09/18/05 uri SARE_URI_MEDS /(?!medscape.com)med[sz].{0,14}\.(?:com|biz|net|org|us|tv|info)/i describe SARE_URI_MEDS domain selling meds score SARE_URI_MEDS 0.842 #stype SARE_URI_MEDS max:1.0 #hist SARE_URI_MEDS Created by Bob Menschel Aug 29 2004 from rules by Bob M & Fred T #ham SARE_URI_MEDS medscape.com, modsociety.org DomesticPetmeds.com #counts SARE_URI_MEDS 1468s/37h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_URI_MEDS 2657s/12h of 238365 corpus (112478s/125887h RM) 02/28/05 #counts SARE_URI_MEDS 159s/1h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_URI_MEDS 498s/1h of 19448 corpus (16863s/2585h MY) 09/06/04 #counts SARE_URI_MEDS 590s/1h of 54828 corpus (17650s/37178h JH-3.01) 03/13/05 #max SARE_URI_MEDS 657s/1h of 44759 corpus (16528s/28231h JH-SA3.0rc1) 09/06/04 #counts SARE_URI_MEDS 13s/0h of 682 corpus (290s/392h CRF) 02/16/05 #counts SARE_URI_MEDS 87s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_URI_MEDS 241s/1h of 11015 corpus (6587s/4428h CT) 03/10/05 #counts SARE_URI_MEDS 6s/5h of 7500 corpus (1767s/5733h ft) 09/18/05 uri __SARE_URI_MEDS2 m'http://[^/]*med[sz]\.'i meta SARE_URI_MEDS2 __SARE_URI_MEDS2 && !SARE_URI_MEDS describe SARE_URI_MEDS2 body contains link to known spammer score SARE_URI_MEDS2 1.666 #hist SARE_URI_MEDS2 RM_usd_meds #hist SARE_URI_MEDS2 Converted to meta to exclude dupes with SARE_URI_MEDS Sep 19 2004 #counts SARE_URI_MEDS2 0s/0h of 238365 corpus (112478s/125887h RM) 02/28/05 #counts SARE_URI_MEDS2 0s/0h of 54103 corpus (16925s/37178h JH-3.01) 02/15/05 #counts SARE_URI_MEDS2 0s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_URI_MEDS2 1s/0h of 26190 corpus (22790s/3400h MY) 02/15/05 #counts SARE_URI_MEDS2 0s/0h of 682 corpus (290s/392h CRF) 02/16/05 #counts SARE_URI_MEDS2 0s/0h of 11015 corpus (6587s/4428h CT) 03/10/05 ######## ###################### ################################################## # Category: URI links identified by technical attributes ######## ###################### ################################################## uri SARE_URI_EQUAL2 /==\.(?:jpg|htm)/i describe SARE_URI_EQUAL2 Suspicious URI score SARE_URI_EQUAL2 0.684 #hist SARE_URI_EQUAL2 Alex Pleiner and Chris Santerre, Feb 2005 #counts SARE_URI_EQUAL2 88s/24h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_URI_EQUAL2 238s/1h of 197615 corpus (96830s/100785h RM) 02/22/05 #counts SARE_URI_EQUAL2 17s/0h of 54084 corpus (16906s/37178h JH-3.01) 03/02/05 #counts SARE_URI_EQUAL2 464s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_URI_EQUAL2 0s/0h of 11015 corpus (6587s/4428h CT) 03/10/05 #counts SARE_URI_EQUAL2 8s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 uri SARE_URI_REFID1 /\?refid[D=]/i describe SARE_URI_REFID1 Spammer signature in URL score SARE_URI_REFID1 0.648 #hist SARE_URI_REFID1 LW_URI_REFID #counts SARE_URI_REFID1 1344s/102h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_URI_REFID1 68s/0h of 54828 corpus (17650s/37178h JH-3.01) 03/13/05 #counts SARE_URI_REFID1 210s/4h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_URI_REFID1 1s/0h of 682 corpus (290s/392h CRF) 02/16/05 #counts SARE_URI_REFID1 166s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_URI_REFID1 207s/0h of 11015 corpus (6587s/4428h CT) 03/10/05 ######## ###################### ################################################## # Category: URI links identified by use of randomizing characters ######## ###################### ################################################## uri SARE_URI_DIGITS4 m'\b\d{4,}\.(?:com|net|biz|info)\b'i describe SARE_URI_DIGITS4 References a multi-digit domain score SARE_URI_DIGITS4 0.415 #hist SARE_URI_DIGITS4 Created by Bob Menschel Aug 23 2004 #ham SARE_URI_DIGITS4 The Learning Company (May, 2002) #counts SARE_URI_DIGITS4 679s/82h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_URI_DIGITS4 905s/28h of 238365 corpus (112478s/125887h RM) 02/28/05 #counts SARE_URI_DIGITS4 14s/4h of 54103 corpus (16925s/37178h JH-3.01) 02/15/05 #max SARE_URI_DIGITS4 61s/4h of 44759 corpus (16528s/28231h JH-SA3.0rc1) 09/06/04 #counts SARE_URI_DIGITS4 9s/3h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_URI_DIGITS4 0s/0h of 682 corpus (290s/392h CRF) 02/16/05 #counts SARE_URI_DIGITS4 2s/3h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_URI_DIGITS4 6s/0h of 11015 corpus (6587s/4428h CT) 03/10/05 #uri SARE_URI_SIXCAPS /[A-Z]{6}\.(?:BIZ|INFO|biz|info)/ meta SARE_URI_SIXCAPS 0 describe SARE_URI_SIXCAPS URI points to a six capital .BIZ domain score SARE_URI_SIXCAPS 0.687 #hist SARE_URI_SIXCAPS SARE test offered by CRF 4/26/04 #counts SARE_URI_SIXCAPS 112s/20h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_URI_SIXCAPS 193s/1h of 175589 corpus (98978s/76611h RM) 02/14/05 #counts SARE_URI_SIXCAPS 103s/0h of 54103 corpus (16925s/37178h JH-3.01) 02/15/05 #counts SARE_URI_SIXCAPS 115s/1h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_URI_SIXCAPS 0s/1h of 682 corpus (290s/392h CRF) 02/16/05 #counts SARE_URI_SIXCAPS 215s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 ######## ###################### ################################################## # Category: URI links identified by web page/file names ######## ###################### ################################################## uri SARE_URI_GEOCIT_NUM /www\.geocities\.com\/[a-z_]{4,20}_\d{2}/i describe SARE_URI_GEOCIT_NUM geocities URI ends in underscore and two digits score SARE_URI_GEOCIT_NUM 0.666 #hist SARE_URI_GEOCIT_NUM From john@tradoc.fr Fri Apr 15 07:05:25 2005 SA Users #counts SARE_URI_GEOCIT_NUM 76s/7h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_URI_GEOCIT_NUM 0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_URI_GEOCIT_NUM 57s/1h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_URI_GEOCIT_NUM 46s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 uri __SARE_URI_LET_DIG_PIC /\/[a-z]\d\.(?:gif|jpg)/ meta SARE_URI_LET_DIG_PIC __SARE_URI_LET_DIG_PIC && !SARE_URI_VDRUG_GIF describe SARE_URI_LET_DIG_PIC Suspicious file name for graphic score SARE_URI_LET_DIG_PIC 1.157 #counts SARE_URI_LET_DIG_PIC 4567s/34h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_URI_LET_DIG_PIC 62s/2h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_URI_LET_DIG_PIC 356s/2h of 19448 corpus (16863s/2585h MY) 09/06/04 #counts SARE_URI_LET_DIG_PIC 332s/6h of 54103 corpus (16925s/37178h JH-3.01) 02/15/05 #max SARE_URI_LET_DIG_PIC 383s/6h of 44759 corpus (16528s/28231h JH-SA3.0rc1) 09/06/04 #counts SARE_URI_LET_DIG_PIC 6s/0h of 682 corpus (290s/392h CRF) 02/16/05 #counts SARE_URI_LET_DIG_PIC 8s/1h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_URI_LET_DIG_PIC 151s/2h of 11015 corpus (6587s/4428h CT) 03/10/05 #counts SARE_URI_LET_DIG_PIC 2s/2h of 7500 corpus (1767s/5733h ft) 09/18/05 uri SARE_URI_NO_MORE m{/nomore\.(?:htm|asp|php)}i describe SARE_URI_NO_MORE Contains a likely spammer unsubscribe link score SARE_URI_NO_MORE 0.522 #hist SARE_URI_NO_MORE Fred Tarasevicius - FU_PAGE_NO_MORE #ham SARE_URI_NO_MORE http://www.afsc.org/nomore.htm; Student Peace Action Network (SPAN) #counts SARE_URI_NO_MORE 4s/9h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_URI_NO_MORE 456s/3h of 238365 corpus (112478s/125887h RM) 02/28/05 #counts SARE_URI_NO_MORE 69s/0h of 54828 corpus (17650s/37178h JH-3.01) 03/13/05 #counts SARE_URI_NO_MORE 3s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_URI_NO_MORE 150s/0h of 26190 corpus (22790s/3400h MY) 02/15/05 #counts SARE_URI_NO_MORE 0s/0h of 682 corpus (290s/392h CRF) 02/16/05 #counts SARE_URI_NO_MORE 18s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_URI_NO_MORE 70s/0h of 11015 corpus (6587s/4428h CT) 03/10/05 # EOF