# SpamAssassin rules file: kam sandbox
#
# Please don't modify this file as your changes will be overwritten with
# the next update. Use @@LOCAL_RULES_DIR@@/local.cf instead.
# See 'perldoc Mail::SpamAssassin::Conf' for details.
#
# <@LICENSE>
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to you under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at:
# 
#     http://www.apache.org/licenses/LICENSE-2.0
# 
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# </@LICENSE>
#
###########################################################################

#Based on khopesh's SPOOFED_URL.
rawbody __SPOOFED_URL_HOST /<a\s[^>]{0,2048}\bhref=(?:3D)?.?(https?:\/\/?[^\/?>"'\# ]{8,29})[^>]{0,2048}>(?:[^<]{0,1024}<(?!\/a)[^>]{1,1024}>){0,99}\s{0,10}(?!\1)https?[^\w<]{1,3}[^<]{5}/i
# Still doesn't handle 'legit' tracking redirectors.
meta	 SPOOFED_URL_HOST	__SPOOFED_URL_HOST && !(__VIA_ML || __SENDER_BOT || __YAHOO_BULK || __UNSUB_LINK || __THREADED || __URL_SHORTENER)
describe SPOOFED_URL_HOST	Has a link whose text is URL with a different host

body COMPUTERS_JEWELRY /Electronics\s{0,5}Computers\s{0,5}Software\s{0,5}Home Essentials\s{0,5}Health & Beauty\s{0,5}Jewelry\s{0,5}More!/i
describe COMPUTERS_JEWELRY Selling computers, jewelry, etc.

#EOF