# SARE Spammer URI Rule Set for SpamAssassin - file 2
# Version:  01.01.03
# Created:  2004-09-13
# Modified: 2005-10-05
# Usage instructions and documentation are found in 70_sare_uri0.cf 
#@@# Revision History:  Full Revision History stored in 70_sare_uri.log
#@@# 01.01.03: Oct 05 2005 
#@#@           Created files 2, 4, and x31.
#@@#           Minor score updates based on additional mass-check
#@@#           Moved file 0 to file 2:               SARE_URI_HARRYDAV
#@@#           Moved file 0 to file 2:               SARE_URI_OC
#@@#           Moved file 0 to file 2:               SARE_URI_SHARE_DIG

# License:  Artistic - see http://www.rulesemporium.com/license.txt
# Current   Maintainer: Bob Menschel - uri@rulesemporium.com
# Current   Home: http://www.rulesemporium.com/rules/70_sare_uri3.cf

########  ######################   ##################################################
#    Category:  Sub-rules needed by others
########  ######################   ##################################################

########  ######################   ##################################################
#    Category:  URI links identified by spammer words
########  ######################   ##################################################

########  ######################   ##################################################
#    Category:  URI links identified by spammer names
########  ######################   ##################################################

uri       SARE_URI_HARRYDAV        /\bharryanddavid\b/i
describe  SARE_URI_HARRYDAV        body contains link to known spammer 
score     SARE_URI_HARRYDAV        3.333
#stype    SARE_URI_HARRYDAV        spamgg
#hist     SARE_URI_HARRYDAV        Created by Bob Menschel Aug 26 2004
#counts   SARE_URI_HARRYDAV        0s/0h of 619677 corpus (318875s/300802h RM) 09/11/05
#max      SARE_URI_HARRYDAV        14s/0h of 70699 corpus (43133s/27566h RM) 10/02/04
#counts   SARE_URI_HARRYDAV        0s/0h of 19448 corpus (16863s/2585h MY) 09/06/04
#counts   SARE_URI_HARRYDAV        0s/0h of 44759 corpus (16528s/28231h JH-SA3.0rc1) 09/06/04
#counts   SARE_URI_HARRYDAV        0s/0h of 682 corpus (290s/392h CRF) 02/16/05
#counts   SARE_URI_HARRYDAV        0s/0h of 11015 corpus (6587s/4428h CT) 03/10/05

########  ######################   ##################################################
#    Category:  URI links identified by technical attributes
########  ######################   ##################################################

########  ######################   ##################################################
#    Category:  URI links identified by use of randomizing characters
########  ######################   ##################################################

uri       SARE_URI_SHARE_DIG       /\d\.share\d\.(?:us|biz|info)/i
describe  SARE_URI_SHARE_DIG       Domain is one of several, likely spammer
score     SARE_URI_SHARE_DIG       0.622
#hist     SARE_URI_SHARE_DIG       Fred Tarasevicius - FU_SHARE_DIGIT
#counts   SARE_URI_SHARE_DIG       0s/0h of 196626 corpus (96197s/100429h RM) 02/22/05
#max      SARE_URI_SHARE_DIG       10s/0h of 114212 corpus (81067s/33145h RM) 01/19/05
#counts   SARE_URI_SHARE_DIG       0s/0h of 54103 corpus (16925s/37178h JH-3.01) 02/15/05
#counts   SARE_URI_SHARE_DIG       0s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
#max      SARE_URI_SHARE_DIG       2s/0h of 26190 corpus (22790s/3400h MY) 02/15/05
#counts   SARE_URI_SHARE_DIG       0s/0h of 682 corpus (290s/392h CRF) 02/16/05
#counts   SARE_URI_SHARE_DIG       0s/0h of 11015 corpus (6587s/4428h CT) 03/10/05

########  ######################   ##################################################
#    Category:  URI links identified by web page/file names
########  ######################   ##################################################

uri       SARE_URI_OC              /\?oc=\d{4,10}/
describe  SARE_URI_OC              Possible spammer sign in URL
score     SARE_URI_OC              1.306
#counts   SARE_URI_OC              0s/0h of 619677 corpus (318875s/300802h RM) 09/11/05
#max      SARE_URI_OC              31s/0h of 66947 corpus (41732s/25215h RM) 09/06/04
#counts   SARE_URI_OC              4s/0h of 54103 corpus (16925s/37178h JH-3.01) 02/15/05
#counts   SARE_URI_OC              0s/0h of 26190 corpus (22790s/3400h MY) 02/15/05
#max      SARE_URI_OC              100s/0h of 19447 corpus (16862s/2585h MY) 09/06/04
#counts   SARE_URI_OC              0s/0h of 682 corpus (290s/392h CRF) 02/16/05
#counts   SARE_URI_OC              0s/0h of 11015 corpus (6587s/4428h CT) 03/10/05

# EOF