Re: Patch to improve detection of offering SEO spam

John Hardin <[email protected]>
Newsgroups gmane.mail.spam.spamassassin.general
Message-ID <[email protected]>
On Fri, 13 Dec 2024, Kirill A. Korinsky wrote:

> Dear SA users,
>
> I'd like to share with you a patch which allows me to catch an offering SEO
> spam which I've encountered in my INBOX quite a few missed for last weeks.
>
> Changes:
> 1. adds .xyz as suspicious zone because namecheap sells this domain for ~€1;
> 2. extends PDS_SEO2 regex to catch that spam.
>
> An example of that spam email: https://pbot.rmdir.de/xbuEKl2kxv7AmPBRYzRU-g
>
> The patch is inlined in this email:
>
> diff --git a/rulesrc/sandbox/pds/20_ntld.cf b/rulesrc/sandbox/pds/20_ntld.cf
> index 9b221486a..3492a67d0 100644
> --- a/rulesrc/sandbox/pds/20_ntld.cf
> +++ b/rulesrc/sandbox/pds/20_ntld.cf
> @@ -27,6 +27,7 @@ enlist_addrlist (SUSP_NTLD) *@*.buzz
> enlist_addrlist (SUSP_NTLD) *@*.trade
> enlist_addrlist (SUSP_NTLD) *@*.cyou
> enlist_addrlist (SUSP_NTLD) *@*.vip
> +enlist_addrlist (SUSP_NTLD) *@*.xyz
>
> enlist_uri_host (SUSP_URI_NTLD) icu
> enlist_uri_host (SUSP_URI_NTLD) online
> @@ -48,6 +49,7 @@ enlist_uri_host (SUSP_URI_NTLD) buzz
> enlist_uri_host (SUSP_URI_NTLD) trade
> enlist_uri_host (SUSP_URI_NTLD) cyou
> enlist_uri_host (SUSP_URI_NTLD) vip
> +enlist_uri_host (SUSP_URI_NTLD) xyz
>
> enlist_uri_host (SUSP_URI_NTLD_PRO) pro
> header   PDS_PRO_TLD eval:check_uri_host_listed('SUSP_URI_NTLD_PRO')
> @@ -92,7 +94,7 @@ score    GOOGLE_DRIVE_REPLY_BAD_NTLD 1.0 # limit
> reuse    GOOGLE_DRIVE_REPLY_BAD_NTLD
>
> body     __PDS_SEO1 /(?:top|first page|1st) (?:(?:results|rank(?:ing)?) )?(?:in|of|on) (?:Google|MSN|Yahoo|Bing)|rank number one|top page rank|guarantee you 1st|link.building/i
> -body     __PDS_SEO2 /losing your (?:[a-z]+ )?(?:rank(?:ing)?|results)|rank well on [a-z]+\b/i
> +body     __PDS_SEO2 /(?:losing your|your website) (?:[a-z]+ )?(?:rank(?:ing)?|results)|rank well on [a-z]+\b/i
>
> meta     SEO_SUSP_NTLD __FROM_ADDRLIST_SUSPNTLD && (__PDS_SEO1 + __PDS_SEO2 >= 1)
> tflags   SEO_SUSP_NTLD publish

I don't know whether Paul is still actively maintaining his rule sandbox, 
his last commit there was four years ago.

The changes seems reasonable, I'll apply them.


-- 
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  [email protected]                         pgpk -a [email protected]
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   Governments do not censor articles that they could expose as lies.
                                                              -- markm
-----------------------------------------------------------------------
  2 days until Bill of Rights day
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.