Re: Where are your test definitions?
Matus UHLAR - fantomas <[email protected]>
| Newsgroups | gmane.mail.spam.spamassassin.general |
|---|---|
| Message-ID | <[email protected]> |
>Am 2024-06-14 17:11, schrieb Matus UHLAR - fantomas:
>>FONT_INVIS_NORDNS=1.544
>>HTML_FONT_TINY_NORDNS=1.514
>>RDNS_NONE=0.793
>>
>>working fcrdns would fix much for them.
>>
>>However, not doing stupid shit with fonts would help even more:
>>FONT_INVIS_MSGID=2.497
>>FONT_INVIS_NORDNS=1.544
>>HTML_FONT_TINY_NORDNS=1.514
On 14.06.24 18:00, Thomas Barth via users wrote:
>Thanks, I have forwarded these infos and hope it will be corrected.
>
>>
>>
>>>I cannot find the definitions on your old site
>>>https://spamassassin.apache.org/old/tests_3_1_x.html.
>>
>>why 3.1?
>>
>
>Google only shows this old version and I can't find a link to the
>current test definitions on the website itself.
I see them in SA 4.0 rules:
72_active.cf: meta FONT_INVIS_MSGID __FONT_INVIS_MSGID && !__RCD_RDNS_MX_MESSY && !__RCD_RDNS_MX && !__HAS_ERRORS_TO && !__RCD_RDNS_MAIL && !__MAIL_LINK && !__HDR_RCVD_AMAZON && !__MIME_QP && !__HAS_CAMPAIGNID && !__HAS_THREAD_INDEX && !__RCD_RDNS_MTA
72_active.cf: meta FONT_INVIS_NORDNS __FONT_INVIS_NORDNS && !__HTML_SINGLET && !__LYRIS_EZLM_REMAILER && !__YOUR_PERSONAL && !__HAS_X_MAILER
72_active.cf: rawbody __FONT_INVIS /<(?!style)[a-z]+\s[^>]{1,80}(?:font(?:-size)?\s*:\s*(?:0*[01](?:\.\d+)?(?:px|pt|Q|vw|vh|vmin)|0+(?:\.\d+)?(?:cm|mm|pc|ch|rem|lh|vmax|%)|0+(?:\.0\d*)(?:em|ex|in))(?:\s[a-z]|\s*[;'])|['"\s;]color\s*:\s*transparent\s*[;'])[^>]{0,80}>\w/i
72_active.cf:meta HTML_FONT_TINY_NORDNS __HTML_FONT_TINY_NORDNS && !__HAS_CID
72_active.cf:meta __HTML_FONT_TINY_NORDNS (__HTML_FONT_TINY_01 || __HTML_FONT_TINY_02 || __AC_TINY_FONT) && __RDNS_NONE
72_active.cf:rawbody __AC_TINY_FONT /(?:font-size)\s*:\s*[1-3]\s*(?:em|p[tx]|%)?(?:\s*!important)?\s*[";]/i
72_active.cf:rawbody __HTML_FONT_TINY_01 /font-size:\s{0,5}[0-4]px;/i
72_active.cf:rawbody __HTML_FONT_TINY_02 /<font\s[^>]{0,80}size\s*=\s*["']?-(?:[2-9]|[1-9]\d+)["']?[^>]{0,80}>/i
1. as I said it's hard to find out without the body
2. hiding data indicates a spammer.
--
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
2B|!2B, that's a question!