# HAVENURLS-0601.rc
#
# Recent URLs seen in spam, at domains that are not spammers themselves.
#
# Last updated: 1/31/2006

:0 B
* !--.*forwarded message --
* !^forwarded message:
* -1000^0
*  1100^0 (^|[^0-9a-z]|=3D)web(ÿ|\.|[=%]2E)tiscali(ÿ|\.|[=%]2E)it/worldancevents2006
{ LOCALTAG=yes }

# Encoded Spam Domains
#
#   Lots of spammers using this to evade SURBL and other message
#   body URI patterns.
#
:0 B
* !--.*forwarded message --
* !^forwarded message:
* -1000^0
*  1100^0  (^|[^0-9a-z]|=3D)%73%2Dv%63%64(ÿ|\.|[=%]2E)(c|%63)(o|%6F)(m|%6D)([^a-z0-9.]|\. |\.$|$)
*  1100^0  (^|[^0-9a-z]|=3D)%72%75%6D%61%74%61%2E%72%75([^a-z0-9.]|\. |\.$|$)
*  1100^0  (^|[^0-9a-z]|=3D)(c|%63)(a|%41)(f|%66)(e|%65)24(ÿ|\.|[=%]2E)(c|%63)(o|%6F)(m|%6D)([^a-z0-9.]|\. |\.$|$)
*  1100^0  (^|[^0-9a-z]|=3D)(n|%6e)(u|%75)(r|%72)(i|%69)(ÿ|\.|[=%]2E)(c|%63)(c|%63)([^a-z0-9.]|\. |\.$|$)
*  1100^0  (^|[^0-9a-z]|=3D)(c|%63)(o|%6f)(d|%64)(n|%6e)(s|%73)(ÿ|\.|[=%]2E)(c|%63)(o|%6f)(m|%6d)([^a-z0-9.]|\. |\.$|$)
*  1100^0  (^|[^0-9a-z]|=3D)(d|%64)(m|%6D)(s|%73)(u|%75)(p|%70)(e|%65)(r|%72)(ÿ|\.|[=%]2E)(c|%63)(o|%6F)(m|%6D)([^a-z0-9.]|\. |\.$|$)
{ LOCALTAG=yes }