# FILTEREVASION.RC # # Checks for various spammer obfuscation tricks. # Bogus HTML tags filter evasion # # Created: 7/16/2003 # Last Modified: 10/05/2005 # LOCALTAG=no :0 * LEANTAG ?? no * $ !^X-Loop: ${NOLOOP} { :0 B * -1000^0 * !--.*forwarded message -- * !^forwarded message: * ! -//W3C//DTD XHTML( ) * ! (^|[^-_0-9a-z]|=2E)trueswitch(я|\.|=2E)com([^a-z0-9.]|\. |\.$|$) * ! ()] * -100^1 ()<(A|ABBR|ACRONYM|ADDRESS|APPLET|AREA|B|BASE|BASEFONT|BDO|BIG|BLOCKQUOTE|BODY|BR|BUTTON|CAPTION|CENTER|CITE|CODE|COL|COLGROUP|DD|DEL|DFN|DIR|DIV|DL|DT|EM|FIELDSET|FONT|FORM|FRAME|FRAMESET|H[1-6]|HEAD|HR|HTML|I|IFRAME|IMG|INPUT|INS|ISINDEX|KBD|LABEL|LEGEND|LI|LINK|MAP|MENU|META|NOFRAMES|NOSCRIPT|OBJECT|OL|OPTGROUP|OPTION|P|PARAM|PRE|Q|S|SAMP|SCRIPT|SELECT|SMALL|SPAN|STRIKE|STRONG|STYLE|SUB|SUP|TABLE|TBODY|TD|TEXTAREA|TFOOT|TH|THEAD|TITLE|TR|TT|U|UL|VAR|XML|X-TAB)[^>]*> * -100^1 ()<(O|W): [0-9a-z]+> * -100^1 ()]+> * 100^1 ()<[§абвгдежзийклмнопрстуфхцшщъыьэюяa-z0-9=]+>() * -100^1 () * -100^1 () * 100^1 ()() * 500^1 ()<[§абвгдежзийклмнопрстуфхцшщъыьэюяa-z0-9=]+ >() * 500^1 ()<[§абвгдежзийклмнопрстуфхцшщъыьэюяa-z0-9=]+\[[0-9]+\]> * 100^1 () * 100^1 () * 200^1 () * 200^1 () * 200^1 ()\. * 500^1 () { LOCALTAG=yes } } :0 * LEANTAG ?? no * $ !^X-Loop: ${NOLOOP} * ! ^Content-Type: text/enriched * ! ^Content-Transfer-Encoding: quoted-printable { :0 B * -1000^0 * !--.*forwarded message -- * !^forwarded message: * ! ^Content-Type: text/enriched * ! -//W3C//DTD XHTML( ) * ! ^Content-Transfer-Encoding: quoted-printable * ! (^|[^-_0-9a-z]|=2E)trueswitch(я|\.|=2E)com([^a-z0-9.]|\. |\.$|$) * ! ()] * 500^1 ()<[§абвгдежзийклмнопрстуфхцшщъыьэюяa-z0-9=]+=$[§абвгдежзийклмнопрстуфхцшщъыьэюяa-z0-9=]+>() { LOCALTAG=yes } } :0 * LOCALTAG ?? yes { SBLOG="A1R-Filter Evasion (Bogus HTML Tags)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 5^0 { SBSCORE=$= } } # Commented HTML filter evasion # # Created: 7/15/2003 # Last Modified: 9/22/2005 # :0 * LEANTAG ?? no * $ !^X-Loop: ${NOLOOP} { :0 B * -1000^0 * !--.*forwarded message -- * !^forwarded message: * ! () * ! /\* [a-z]+ styles \*/ * -200^1 ^[:;#>] * 5^1.5 ()<() * 25^1.5 [0-9a-zабвгдежзийклмнопрстуфхцшщъыьэюя][0-9a-zабвгдежзийклмнопрстуфхцшщъыьэюя] * 25^1.5 [абвгдежзийклмнопрстуфхцшщъыьэюяa-z][абвгдежзийклмнопрстуфхцшщъыьэюяa-z] * 25^1.5 () ]> * 25^1.5 () * 25^1.5 ()<[абвгдежзийклмнопрстуфхцшщъыьэюяa-z][0-9a-zабвгдежзийклмнопрстуфхцшщъыьэюя][0-9][0-9] /> * 800^1 () * 400^1 () * 400^1 () * 400^1 () * 400^1 ()() * 400^1 ()() * 600^1 [абвгдежзийклмнопрстуфхцшщъыьэюяa-z][абвгдежзийклмнопрстуфхцшщъыьэюяa-z] * 600^1 [0-9a-zабвгдежзийклмнопрстуфхцшщъыьэюя]
[0-9a-zабвгдежзийклмнопрстуфхцшщъыьэюя] * 600^1 [0-9a-zабвгдежзийклмнопрстуфхцшщъыьэюя][0-9a-zабвгдежзийклмнопрстуфхцшщъыьэюя] * 600^1 () * 600^1 () * 800^1 () * 600^1 ()]*\|[^>]*> * 600^1 ()]*\[[^>]*> * 600^1 ()]*\][^>]*> * 600^1 ()]*\*[^>]*> * 600^1 ()]*==*[^>]*> * 600^1 ()]*,$*[^>]*> * 600^1 ()]*> * 600^1 [a-z][a-z] * 1100^0 ()\(13057975 { SBLOG="A1R-Filter Evasion (Commented HTML)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 5^0 { SBSCORE=$= } } } # Embedded NAME tags filter evasion # # Created: 8/15/2003 # Last Modified: 8/15/2003 # :0 * LEANTAG ?? no * $ !^X-Loop: ${NOLOOP} { :0 B * -1000^0 * !--.*forwarded message -- * !^forwarded message: * -200^1 ^[:;#>] * 10^1.5 () { SBLOG="A1R-Filter Evasion (Embedded NAME tags)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 5^0 { SBSCORE=$= } } } # Embedded form tags filter evasion # # Created: 11/23/2004 # Last Modified: 11/23/2004 # :0 * LEANTAG ?? no * $ !^X-Loop: ${NOLOOP} { :0 B * !--.*forwarded message -- * !^forwarded message: * -1000^0 * -200^1 ^[:;#>] * 50^1.5 () * 50^1.5 () { SBLOG="A1R-Filter Evasion (Embedded HTML form tags)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 5^0 { SBSCORE=$= } } } # Embedded NOFRAMES filter evasion # # Created: 8/15/2003 # Last Modified: 8/15/2003 # :0 * LEANTAG ?? no * $ !^X-Loop: ${NOLOOP} { :0 B * !--.*forwarded message -- * !^forwarded message: * -1000^0 * -200^1 ^[:;#>] * 50^1.5 ()[0-9a-z]+ { SBLOG="A1R-Filter Evasion (Embedded NOFRAMEs)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 5^0 { SBSCORE=$= } } } # Embedded Punctuation filter evasion # # Created: 10/22/2003 # Last Modified: 12/20/2003 # :0 * ! --.*forwarded message -- * ! ^forwarded message: * ! ^Subject: .*=\?[-_.0-9a-z]+\? * -1000^0 * -500^1 ^Subject: .*[0-9a-z][-_0-9a-z]+@([0-9a-z][-_0-9a-z]+\.)+[a-z][a-z]+([^a-z0-9]|$) * 500^1 ^Subject: .*[a-z]+["!@#$%^&*()=+|;?,]["!@#$%^&*()=+|;?,]?[a-z]+([^a-z0-9]|$) { SBLOG="A1R-Filter Evasion (Embedded Punctuation in Subject line)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 5^0 { SBSCORE=$= } } # Encoded ASCII filter evasion # # Created: 7/15/2003 # Last Modified: 1/27/2005 # LOCALTAG=no :0 * ! ^Subject: =\?[-_.0-9a-z]+\? * -1000^0 * 1000^0 ^Subject:.*%[0-9a-f][0-9a-f]%[0-9a-f][0-9a-f] * 1000^0 ^Subject:.*&#[0-9][0-9][0-9]?[0-9]?[0-9]?;&#[0-9][0-9][0-9]?[0-9]?[0-9]?; { LOCALTAG=yes } :0 * LEANTAG ?? no * LOCALTAG ?? no * $ !^X-Loop: ${NOLOOP} * ! ^Content-Type: text/(plain|html); charset=.?(big5|chinesebig5|euc.(jp|kr)|gb-?(1988|2312|18030)|iso-10646|iso-2022-(cn|jp|kr)|jis.C622[06]|jis.x02(01|08|12)|shift.jis|ks.c.5601-198[79]|utf.?[78]|windows.31j).?$ * ! ^X-Mailer: Microsoft Outlook([^0-9a-z]|$) * ! ^Received: from .*([(]|\[)(66\.163\.1[6-8][0-9]\.[0-9][0-9]?[0-9]?|\ 66\.163\.19[0-1]\.[0-9][0-9]?[0-9]?|\ 66\.218\.6[4-9]\.[0-9][0-9]?[0-9]?|\ 66\.218\.[7-8][0-9]\.[0-9][0-9]?[0-9]?|\ 66\.218\.9[0-5]\.[0-9][0-9]?[0-9]?|\ 206\.190\.3[2-9]\.[0-9][0-9]?[0-9]?|\ 206\.190\.[4-5][0-9]\.[0-9][0-9]?[0-9]?|\ 206\.190\.6[0-3]\.[0-9][0-9]?[0-9]?|\ 216\.109\.11[2-9]\.[0-9][0-9]?[0-9]?|\ 216\.109\.12[0-7]\.[0-9][0-9]?[0-9]?|\ 216\.136\.17[2-5]\.[0-9][0-9]?[0-9]?|\ 216\.136\.22[4-7]\.[0-9][0-9]?[0-9]?|\ 216\.155\.19[2-9]\.[0-9][0-9]?[0-9]?|\ 216\.155\.20[0-7]\.[0-9][0-9]?[0-9]?)([)]|\]) { :0 B * -1000^0 * !--.*forwarded message -- * !^forwarded message: * !^( )*-----Original Message-----( |$) * ! ()
] * 25^1.5 %[0-9a-f][0-9a-f]%[0-9a-f][0-9a-f] * 50^1.5 &#[0-9][0-9][0-9][0-9];&#[0-9][0-9][0-9][0-9]; * 25^1.5 &#[0-9][0-9][0-9]?;&#[0-9][0-9][0-9]?; * 25^1.5 &#[0-9][0-9][0-9][0-9];&#[0-9][0-9][0-9][0-9]; * 25^1.5 &#[0-9][0-9][0-9][0-9][0-9];&#[0-9][0-9][0-9][0-9][0-9]; * 25^1.5 �+[0-9]?[0-9][0-9];�+[0-9]?[0-9][0-9]; * 50^1.5 [0-9] [0-9] * 50^1.5 [a-z] [a-z] { LOCALTAG=yes } } :0 * LOCALTAG ?? yes { SBLOG="A1R-Filter Evasion (Encoded ASCII)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 5^0 { SBSCORE=$= } } # Hidden Hyperlinks # # Created: 2/02/2004 # Last Modified: 1/14/2005 # LOCALTAG=no :0 * LEANTAG ?? no * $ !^X-Loop: ${NOLOOP} { :0 B * ! --.*forwarded message -- * ! ^forwarded message: * -1000^0 * 600^1 () { SBLOG="A1R-Filter Evasion (Hidden Hyperlinks)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 5^0 { SBSCORE=$= } } } # Invisible Ink -- invisible font settings filter evasion # # Created: 7/25/2003 # Last Modified: 4/20/2004 # LOCALTAG=no :0 * 1100^0 ^Subject:.*]*COLOR(3D)?=(\"|3D)?(#FEFEFE|#FFFFFF|white)(\"|3D)? * 1100^0 ^Subject:.*]*SIZE(3D)?=(\")?(-1|0)(\")? { SBLOG="A1R-Filter Evasion (Invisible Ink: Subject Header)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 5^0 { SBSCORE=$= } } :0 * LEANTAG ?? no * LOCALTAG ?? no * $ !^X-Loop: ${NOLOOP} { :0 B * ! --.*forwarded message -- * ! ^forwarded message: * ! ()
-----Original Message-----
$ * ! ()