# SARE HTML Ruleset for SpamAssassin - Change Log # Version: 01.03.08 # Created: 2004-03-31 # Modified: 2005-10-05 # Usage instructions, documentation, and change history in 70_sare_html0.cf # Revision History: Full Revision History stored in 70_sare_html.log # 01.02.04: Enhanced IMG_ONLY rule(s); put no-ham version into file 0 # Added SARE_HTML_MANY_BR10 # Minor score tweaks based on recent mass-checks # Moved rules from one file to another to reflect changing spam rates # 01.02.05: Reduced length of some descriptions to pass 3.0 lint # 01.02.06: Added/enhanced/removed several rules, modified many scores # 01.03.00: Replaced __SARE_HTML_IS_HTML with distribution HTML_MESSAGE # Replaced __SARE_HTML_HAS_HTML with distribution __TAG_EXISTS_HTML # Replaced __SARE_HTML_HAS_BODY with distribution __TAG_EXISTS_BODY # Replaced __SARE_HTML_CT_TXTHTM with distribution __CTYPE_HTML # Removed SARE_HTML_URI_REMOVE due to duplication with distribution REMOVE_PAGE # Implemented various color test improvements from Jesse Houwing # Moved some rules to 70_sare_specific.cf # Created HTML file 4 for rules that hit > 100 ham. # Minor score tweaks based on recent mass-checks # Moved rules from one file to another to reflect changing spam rates # 01.03.01: Improved SARE_HTML_INV_TAG2, 3, 4 rules, and combined them into SARE_HTML_INV_TAG and TAGA. # Moved " from file 1 to file 0 because of improvements. # 01.03.02: Added to file 0: SARE_HTML_JSCRIPT_ENC, SARE_HTML_EHTML2 # 01.03.03: Added to file 1: SARE_HTML_ONE_LINE1, SARE_HTML_ONE_LINE2 # Minor score tweaks based on recent mass-checks # Moved rules from one file to another to reflect changing spam rates # 01.03.04: Minor score tweaks based on recent mass-checks # Added to 0: SARE_HTML_ONE_LINE3 SARE_PHISH_HTML_01 SARE_HTML_IMG_2AT SARE_PHISH_HTML_02 SARE_HTML_LEAKTHRU2 SARE_HTML_FONT_LWORD # Added to 1: SARE_HTML_LANG_PTBR SARE_HTML_TITLE_1WD SARE_HTML_TITLE_2WD # Archived: SARE_HTML_ALT_WAIT2 SARE_HTML_BADOPEN SARE_HTML_URI_AXEL SARE_HTML_URI_MANYP2 SARE_HTML_URI_OBFU4 # Archived: SARE_HTML_URI_OBFU4a SARE_HTML_URI_RID SARE_HTML_USL_MULT # Moved file 0 to 1: SARE_HTML_HTML_TBL SARE_HTML_IMG_ONLY SARE_HTML_URI_PARTID SARE_HTML_HTML_DBL SARE_HTML_TITLE_SEX # Moved from 0 to 3: SARE_HTML_URI_BADQRY SARE_HTML_URI_HREF # Moved from 1 to 3: SARE_HTML_COLOR_B SARE_HTML_MANY_BR10 SARE_HTML_NO_BODY # Moved from 1 to 4: SARE_HTML_FSIZE_1ALL # Moved from 2 to 3: SARE_HTML_H2_CLK # Moved from 3 to 1: SARE_HTML_BODY_2SP SARE_HTML_TITLE_LWORD # Moved from 3 to 4: SARE_HTML_BAD_FG_CLR SARE_HTML_COLOR_NWHT3 SARE_HTML_FONT_INVIS2 SARE_HTML_GIF_DIM SARE_HTML_HTML_AFTER # Moved from 3 to 4: SARE_HTML_MANY_BR10 SARE_HTML_P_JUSTIFY SARE_HTML_URI_2SLASH SARE_HTML_URI_NUMPHP3 # Renamed SARE_HTML_URI_MANYP3 to SARE_HTML_P_MANY3 and moved from 0 to 1 # Unarchived to 3: SARE_HTML_JVS_HREF SARE_HTML_URI_FORMPHP # 01.03.05: March 12 2005 # Added file 0: SARE_PHISH_HTML_03 # Moved file 0 to 1: SARE_HTML_FONT_EBEF # Moved file 0 to 1: SARE_HTML_URI_DEFASP # Moved file 0 to 1: SARE_HTML_HTML_TBL # Archived: SARE_HTML_SPACES1 # 01.03.06: May 29 2005 # Minor score tweaks based on recent mass-checks # Added file 0: SARE_HTML_HEAD_AFFIL # Added file 0: SARE_HTML_IMG_CID2 # Added file 0: SARE_HTML_ORIG_MSG # Added file 1: SARE_HTML_CNTR_TBL # Added file 1: SARE_HTML_TITLE_DAY # Archive from 3: SARE_HTML_JVS_HREF # Archive from 3: SARE_HTML_URI_ATWWW # Archive from 3: SARE_HTML_URI_BADQRY # Archive from 4: SARE_HTML_GIF_SHORT # Archive from 4: SARE_HTML_HTML_4 # Archive from 4: SARE_HTML_NO_BODY2 # Archive from 4: SARE_HTML_NO_BODY3 # Archive from 4: SARE_HTML_NO_HTML2 # Archive from 4: SARE_HTML_NO_HTML3 # Archive from 4: SARE_HTML_NO_HTML4 # Archive from 4: SARE_HTML_NO_HTML5 # Archive from 4: SARE_HTML_P_BREAK # Archive from 4: SARE_HTML_USL_1CHAR2 # Archive from 4: SARE_HTML_USL_A # Deleted from file 4: LW_URI_CR2 # Modified file 1: SARE_HTML_URI_LHOST30 and added SARE_HTML_URI_LHOST31 and moved both to file 1 # Moved file 0 to 1: SARE_HTML_A_NULL # Moved file 0 to 1: SARE_HTML_FONT_SPL # Moved file 0 to 1: SARE_HTML_IMG_2AT # Moved file 0 to 1: SARE_HTML_JSCRIPT_ENC # Moved file 0 to 1: SARE_HTML_URI_ESCWWW # Moved file 0 to 1: SARE_HTML_URI_OC # Moved file 1 to 3: SARE_HTML_BODY_2SP # Moved file 1 to 3: SARE_HTML_BODY_END2 # Moved file 1 to 3: SARE_HTML_COLOR_NWHT # Moved file 1 to 3: SARE_HTML_EMPTY # Moved file 1 to 3: SARE_HTML_HTML_DBL # Moved file 1 to 3: SARE_HTML_INV_CHARSET # Moved file 1 to 3: SARE_HTML_LANG_PTBR # Moved file 1 to 3: SARE_HTML_MANY_BR05 # Moved file 1 to 3: SARE_HTML_NO_BODY_TO # Moved file 1 to 3: SARE_HTML_P_MANY3 # Moved file 1 to 3: SARE_HTML_TD_BR # Moved file 1 to 3: SARE_HTML_URI_AT # Moved file 1 to 3: SARE_HTML_URI_DEFHTM # Moved file 1 to 3: SARE_HTML_URI_OPTPHP # Moved file 1 to 3: SARE_HTML_URR_OBFU3B # Moved file 1 to 3: SARE_HTML_USL_1CHAR # Moved file 1 to 4: SARE_HTML_NO_BODY # Moved file 1 to x30: SARE_HTML_TITLE_PG1 # Moved file 2 to 1: SARE_HTML_BR_MANY # Moved file 3 to 1: SARE_HTML_COLOR_NWHT2 # Moved file 3 to 1: SARE_HTML_TITLE_MNY # Moved file 3 to 1: SARE_HTML_URI_UNSUB # Moved file 3 to 4: SARE_HTML_COLOR_A # Moved file 3 to 4: SARE_HTML_FSIZE6 # Moved file 3 to 4: SARE_HTML_HEAD_EMPTY # Moved file 3 to 4: SARE_HTML_NO_BODY # Moved file 3 to 4: SARE_HTML_TAB_EHTML # Moved file 3 to 4: SARE_HTML_TITLE_EMAIL # Moved file 3 to 4: SARE_HTML_URI_HREF # Moved from file 4: LW_URI_CR to obfu rule set # 01.03.07: July 2 2005 # Added file 0: SARE_HTML_EHTML_OBFU # Archived from file 3: SARE_HTML_URI_ENC_AT # Archived from file 4: SARE_HTML_TAB_EHTML # Moved file 0 to 1: SARE_HTML_INV_TAGA # Moved file 3 to 1: SARE_HTML_A_BODY # 01.03.08: Oct 5 2005 # Minor score tweaks based on recent mass-checks # Archived from file 1: SARE_HTML_INV_TAGA # Archived from file 1: SARE_HTML_URI_REFID, duplicated by SARE_URI_REFID1 in 70_sare_uri1.cf # Archived from file 1: SARE_HTML_URI_RM, duplicated by SARE_URI_RM in 70_sare_uri1.cf # Archived from file 3: SARE_HTML_HEAD_EMPTY # Archived from file 3: SARE_HTML_URI_AT # Archived from file 3: SARE_HTML_URI_DEFHTM # Archived from file 3: SARE_HTML_URI_ENC_AT # Archived from file 3: SARE_HTML_URI_FORMPHP # Archived from file 3: SARE_HTML_URI_LONG8 # Archived from file 3: SARE_HTML_URI_REFID since duplicated by SARE_URI_REFID1 in 70_sare_uri1.cf # Archived from file 3: SARE_HTML_URI_RM since duplicated by SARE_URI_RM in 70_sare_uri1.cf # Archived from file 3: SARE_HTML_URI_UNSPHP # Archived from file 4: SARE_HTML_HEAD_EMPTY # Archived from file 4: SARE_HTML_TAB_EHTML # Created new file x31. # Moved file 0 to file 4: SARE_HTML_URI_JOKNG # Moved file 1 to file 4: SARE_HTML_A_HIDE # Moved file 1 to file 4: SARE_HTML_COLOR_NWHT2 # Moved file 1 to file 4: SARE_HTML_FONT_INVIS1 # Moved file 1 to file 4: SARE_HTML_URI_UNSUB # Moved file 1 to file x31: SARE_HTML_EHTML2 # Moved file 1 to file x31: SARE_HTML_ONE_LINE1 # Moved file 2 to file 0: SARE_HTML_USL_B7 # Moved file 2 to file 0: SARE_HTML_USL_B9 # Moved file 2 to file 1: SARE_HTML_ALT_WAIT1 # Moved file 3 to file 1: SARE_HTML_H2_CLK # Moved file 3 to file 2: SARE_HTML_URR_OBFU3B # Moved file 3 to file 4: SARE_HTML_COLOR_NWHT # Moved file 3 to file 4: SARE_HTML_INV_CHARSET # Moved file 3 to file 4: SARE_HTML_LEFT # Moved file 3 to file 4: SARE_HTML_NO_BODY_TO # Moved file 3 to file 4: SARE_HTML_NO_HTML1 # Moved file 3 to file 4: SARE_HTML_URR_OBFU3B # Replaced __SARE_HTML_HAS_MSG with SA 3.1.0 rule __NONEMPTY_BODY # Replaced __SARE_HTML_HAS_TO with SA 3.1.0 rule __TOCC_EXISTS #@@# 01.03.09: May 31 2006 #@@# Minor score tweaks based on recent mass-checks #@@# Moved file 0 to file 2: SARE_HTML_EHTML_OBFU #@@# Moved file 0 to file 2: SARE_HTML_HEAD_AFFIL #@@# Moved file 0 to file 2: SARE_HTML_LEAKTHRU1 #@@# Moved file 0 to file 2: SARE_HTML_LEAKTHRU2 #@@# Moved file 0 to file 2: SARE_HTML_ONE_LINE3 #@@# Moved file 0 to file 2: SARE_HTML_POB1200 #@@# Moved file 0 to file 2: SARE_HTML_URI_HIDADD #@@# Moved file 0 to file 2: SARE_HTML_URI_LOGOGEN #@@# Moved file 0 to file 2: SARE_HTML_URI_OFF #@@# Moved file 0 to file 2: SARE_HTML_USL_B7 #@@# Moved file 0 to file 2: SARE_HTML_USL_B9 #@@# Moved file 0 to file 2: SARE_PHISH_HTML_01 #@@# Added file 0: SARE_HTML_FLOAT1 #@@# 01.03.10: June 3 2006 #@@# Minor score tweaks based on recent mass-checks #@@# Added file 0 SARE_HTML_LINKWARN #@@# Added file 0 SARE_HTML_SPANNER #@@# Added to file 1 SARE_HTML_SINGLETS #@@# Archive: SARE_HTML_ALT_WAIT1 #@@# Archive: SARE_HTML_A_NULL #@@# Archive: SARE_HTML_FONT_INVIS2 #@@# Archive: SARE_HTML_FSIZE6 #@@# Archive: SARE_HTML_GIF_DIM #@@# Archive: SARE_HTML_H2_CLK #@@# Archive: SARE_HTML_JSCRIPT_ENC #@@# Archive: SARE_HTML_URI_BUG #@@# Archive: SARE_HTML_URI_HREF #@@# Archive: SARE_HTML_URI_IP #@@# Archive: SARE_HTML_URI_JOKNG #@@# Archive: SARE_HTML_URI_NUMPHP3 #@@# Archive: SARE_HTML_URI_OPTPHP #@@# Archive: SARE_HTML_URI_UNSUB #@@# Moved file 1 to 2: SARE_HTML_BR_MANY #@@# Moved file 1 to 2: SARE_HTML_ONE_LINE2 #@@# Moved file 1 to 2: SARE_HTML_URI_OC #@@# Moved file 1 to 3: SARE_HTML_TITLE_MNY #@@# Moved file 1 to 3: SARE_HTML_URI_DEFASP #@@# Moved file 1 to 3: SARE_HTML_URI_DEFASP # License: Artistic - see http://www.rulesemporium.com/license.txt # Current Maintainer: Bob Menschel - RMSA@menschel.net # Current Home: http://www.rulesemporium.com/rules/70_sare_html.log