Patch to improve detection of offering SEO spam

Kirill A. Korinsky <[email protected]>
Newsgroups gmane.mail.spam.spamassassin.general
Message-ID <[email protected]>
Dear SA users,

I'd like to share with you a patch which allows me to catch an offering SEO
spam which I've encountered in my INBOX quite a few missed for last weeks.

Changes:
1. adds .xyz as suspicious zone because namecheap sells this domain for ~€1;
2. extends PDS_SEO2 regex to catch that spam.

An example of that spam email: https://pbot.rmdir.de/xbuEKl2kxv7AmPBRYzRU-g

The patch is inlined in this email:

diff --git a/rulesrc/sandbox/pds/20_ntld.cf b/rulesrc/sandbox/pds/20_ntld.cf
index 9b221486a..3492a67d0 100644
--- a/rulesrc/sandbox/pds/20_ntld.cf
+++ b/rulesrc/sandbox/pds/20_ntld.cf
@@ -27,6 +27,7 @@ enlist_addrlist (SUSP_NTLD) *@*.buzz
 enlist_addrlist (SUSP_NTLD) *@*.trade
 enlist_addrlist (SUSP_NTLD) *@*.cyou
 enlist_addrlist (SUSP_NTLD) *@*.vip
+enlist_addrlist (SUSP_NTLD) *@*.xyz
 
 enlist_uri_host (SUSP_URI_NTLD) icu
 enlist_uri_host (SUSP_URI_NTLD) online
@@ -48,6 +49,7 @@ enlist_uri_host (SUSP_URI_NTLD) buzz
 enlist_uri_host (SUSP_URI_NTLD) trade
 enlist_uri_host (SUSP_URI_NTLD) cyou
 enlist_uri_host (SUSP_URI_NTLD) vip
+enlist_uri_host (SUSP_URI_NTLD) xyz
 
 enlist_uri_host (SUSP_URI_NTLD_PRO) pro
 header   PDS_PRO_TLD eval:check_uri_host_listed('SUSP_URI_NTLD_PRO')
@@ -92,7 +94,7 @@ score    GOOGLE_DRIVE_REPLY_BAD_NTLD 1.0 # limit
 reuse    GOOGLE_DRIVE_REPLY_BAD_NTLD
 
 body     __PDS_SEO1 /(?:top|first page|1st) (?:(?:results|rank(?:ing)?) )?(?:in|of|on) (?:Google|MSN|Yahoo|Bing)|rank number one|top page rank|guarantee you 1st|link.building/i
-body     __PDS_SEO2 /losing your (?:[a-z]+ )?(?:rank(?:ing)?|results)|rank well on [a-z]+\b/i
+body     __PDS_SEO2 /(?:losing your|your website) (?:[a-z]+ )?(?:rank(?:ing)?|results)|rank well on [a-z]+\b/i
 
 meta     SEO_SUSP_NTLD __FROM_ADDRLIST_SUSPNTLD && (__PDS_SEO1 + __PDS_SEO2 >= 1)
 tflags   SEO_SUSP_NTLD publish


-- 
wbr, Kirill
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.