# samples rules submitted by Alex Boyer (NO CLA)
# 2012-09-03

ifplugin  Mail::SpamAssassin::Plugin::URIDetail

## Canada Post
uri_detail      AJB_CANPOST_BADLINK     raw !~ /canadapost\./ text =~ /(?:https?:\/\/|www\.)canadapost\./ type =~ /^a$/
describe        AJB_CANPOST_BADLINK     Found a mismatch between href and anchored text pretending to link to www.canadapost.ca
# score         AJB_UTUBE_BADLINK       1.0
#tflags          AJB_UTUBE_BADLINK       nopublish

## youtube
uri_detail      AJB_UTUBE_BADLINK       raw !~ /youtube\./ text =~ /(?:https?:\/\/|www\.)youtube\./ type =~ /^a$/
describe        AJB_UTUBE_BADLINK       Found a mismatch between href and anchored text pretending to link to www.youtube.com
#score          AJB_UTUBE_BADLINK       0.5
#tflags          AJB_UTUBE_BADLINK       nopublish



# because of link trackers (from massmailer for example), we must meta this with other rulz to be sure we face our fake yutube botnet
header          __AJB_EMPTY_SUBJ        Subject =~ /^$/
tflags          __AJB_EMPTY_SUBJ        nopublish

meta            AJB_FK_UTUBE_BOTNET     AJB_UTUBE_BADLINK && MIME_HTML_ONLY && __AJB_EMPTY_SUBJ
describe        AJB_FK_UTUBE_BOTNET     mismatch between href and anchored + empty subject = botnet
#score          AJB_FK_UTUBE_BOTNET     5.5
tflags          AJB_FK_UTUBE_BOTNET     nopublish

endif