Am 2024-06-14 17:11, schrieb Matus UHLAR - fantomas:
FONT_INVIS_NORDNS=1.544
HTML_FONT_TINY_NORDNS=1.514
RDNS_NONE=0.793
working fcrdns would fix much for them.
However, not doing stupid shit with fonts would help even more:
FONT_INVIS_MSGID=2.497
FONT_INVIS_NORDNS=1.544
HTML_FONT_TINY_NORDNS=1.514
On 14.06.24 18:00, Thomas Barth via users wrote:
Thanks, I have forwarded these infos and hope it will be corrected.
I cannot find the definitions on your old site
https://spamassassin.apache.org/old/tests_3_1_x.html.
why 3.1?
Google only shows this old version and I can't find a link to the
current test definitions on the website itself.
I see them in SA 4.0 rules:
72_active.cf: meta FONT_INVIS_MSGID __FONT_INVIS_MSGID && !__RCD_RDNS_MX_MESSY && !__RCD_RDNS_MX && !__HAS_ERRORS_TO
&& !__RCD_RDNS_MAIL && !__MAIL_LINK && !__HDR_RCVD_AMAZON && !__MIME_QP && !__HAS_CAMPAIGNID &&
!__HAS_THREAD_INDEX && !__RCD_RDNS_MTA
72_active.cf: meta FONT_INVIS_NORDNS __FONT_INVIS_NORDNS && !__HTML_SINGLET
&& !__LYRIS_EZLM_REMAILER && !__YOUR_PERSONAL && !__HAS_X_MAILER
72_active.cf: rawbody __FONT_INVIS
/<(?!style)[a-z]+\s[^>]{1,80}(?:font(?:-size)?\s*:\s*(?:0*[01](?:\.\d+)?(?:px|pt|Q|vw|vh|vmin)|0+(?:\.\d+)?(?:cm|mm|pc|ch|rem|lh|vmax|%)|0+(?:\.0\d*)(?:em|ex|in))(?:\s[a-z]|\s*[;'])|['"\s;]color\s*:\s*transparent\s*[;'])[^>]{0,80}>\w/i
72_active.cf:meta HTML_FONT_TINY_NORDNS __HTML_FONT_TINY_NORDNS &&
!__HAS_CID
72_active.cf:meta __HTML_FONT_TINY_NORDNS (__HTML_FONT_TINY_01 ||
__HTML_FONT_TINY_02 || __AC_TINY_FONT) && __RDNS_NONE
72_active.cf:rawbody __AC_TINY_FONT
/(?:font-size)\s*:\s*[1-3]\s*(?:em|p[tx]|%)?(?:\s*!important)?\s*[";]/i
72_active.cf:rawbody __HTML_FONT_TINY_01 /font-size:\s{0,5}[0-4]px;/i
72_active.cf:rawbody __HTML_FONT_TINY_02
/<font\s[^>]{0,80}size\s*=\s*["']?-(?:[2-9]|[1-9]\d+)["']?[^>]{0,80}>/i
1. as I said it's hard to find out without the body
2. hiding data indicates a spammer.
--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
2B|!2B, that's a question!
