/usr/share/spamassassin/25_replace.cf is in spamassassin 3.4.1-8build1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 | # SpamAssassin - ReplaceTags configuration
#
# Please don't modify this file as your changes will be overwritten with
# the next update. Use @@LOCAL_RULES_DIR@@/local.cf instead.
# See 'perldoc Mail::SpamAssassin::Conf' for details.
#
# <@LICENSE>
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to you under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at:
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# </@LICENSE>
#
###########################################################################
# Requires the Mail::SpamAssassin::Plugin::ReplaceTags plugin be loaded.
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
replace_tag A (?:[gra\@\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xe4\xe3\xe2\xe0\xe1\xe2\xe3\xe4\xe5\xe6o0]|[\xce][\x86\x91\x94\x9b\xac\xb1]|[\xd0][\x90\xb0]|[\xd1][\xa6\xa7]|[\xd3][\x90\x91\x92\x93]|[\xe1][\x8e][\xaa])
replace_tag B (?:[b8]|[\xce][\x92\xb2]|[\xcf][\x90\xb8]|[\xd0][\x91\x92\xac\xb1\xb2]|[\xd1][\x8a\x8c\xa2\xa3]|[\xd2][\x8c\x8d])
replace_tag C (?:[ck\xc7\xe7@]|[\xc3][\x87]|[\xc4][\x86\x87\x88\x89\x8a\x8b\x8c\x8d]|[\xcf][\x82\x9a\x9b\xb2\xb9\xbe]|[\xd0][\xa1]|[\xd1][\x81]|[\xd2][\x80\x81\xaa\xab]|[\xd5][\x87]|&\#(?:1(?:0(?:10|17|2[123]|57|89)|1(?:52|53|94|95)|99)|2(?:31|6[2-9])|39[12]|x(?:3(?:f2|f9|fe)|4(?:21|41|80|81|aa|ab)));)
replace_tag D (?:[d\xd0]|[\xd4][\x80\x81]|[\xd5][\xaa])
replace_tag E (?:[e3]|[\xc4][\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b]|[\xc8][\x84\x85\x86\x87\xa8\xa9]|[\xce][\x88\x95\xa3\xad\xb5\xbe]|[\xcf][\xb5]|[\xd0][\x80\x81\x84\x95\xb5]|[\xd1][\x90\x91\x94\xb3]|[\xd2][\xbc\xbd\xbe\xbf]|[\xd3][\x96\x97\xa9\xab]|[\xd4][\x90\x91]|[\xc8\xc9\xca\xcb\xe8\xe9\xea\xeb\xa4]|&\#(?:1(?:0(?:13|2[458]|45|77)|108|2(?:1[2-5]|3[89]|9[67]))|2(?:0[0-3]|3[2-5]|7[4-9]|8[0-3])|400|51[6-9]|5[58][23]|603|9(?:04|17|[34]1|4[19]));)
replace_tag F (?:f|[\xcf][\x9c\x9d]|[\xd2][\x92\x93]|[\xd3][\xba\xbb]|[\xd4][\xb2]|[\xd5][\xa2])
replace_tag G (?:[gk]|[\xd2][\xa8\xa9]|[\xd4][\x8c\x8d]|[\xd6][\x81])
replace_tag H (?:h|[\xce][\x89\x97]|[\xcf][\xa6]|[\xd0][\x8a\x8b\x9d\xbd]|[\xd1][\x92\x9b]|[\xd2][\x94\x95\xa2\xa3\xa4\xa5\xba\xbb]|[\xd3][\x87\x88\x89\x8a]|[\xd4][\xbb]|[\xd5][\xab\xb0]|&\#(?:2(?:22[3-6]|9[2-5])|54[23]|1(?:0(?:53|85)|18[6-9]|8(?:0(?:8[89]|9[0-5])|1(?:38[89]|340)))|919);)
replace_tag I (?:[il|!1y?\xcc\xcd\xce\xcf\xec\xed\xee\xef]|[\xc4][\xa8]|[\xc7][\x8f\x90]|[\xce][\x8a\x90\x99\xaa\xaf\xb9]|[\xcf][\x8a]|[\xd0][\x86\x87]|[\xd1][\x96\x97]|[\xd3][\x80\x8f]|[\xd5][\xac]|&\#(?:1(?:03[01]|11[01]|216|231)|2(?:0[4-7]|16|3[6-9]|9[6-9])|3(?:0[0-5])|4(?:0[67]|6[34])|52[0-3]);)
replace_tag J (?:j|[\xcf][\xb3]|[\xd0][\x88]|[\xd1][\x98]|[\xd5][\xb5])
replace_tag K (?:k|[\xc7][\xa8\xa9]|[\xce][\x9a\xba]|[\xd0][\x8c\x9a\xba]|[\xd1][\x9c]|[\xd2][\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1]|[\xd3][\x83\x84]|[\xd4][\x9e\x9f]|&\#(?:31[0-2]|4[08][89]|9(?:22|54|75)|1(?:0(?:36|50|82)|1(?:16|7[89]|8[0-5])|219|220|31[01]));)
replace_tag L (?:[il|!1\xa3]|[\xc4][\xb9\xba\xbb\xbc\xbd\xbe\xbf]|[\xc5][\x80\x81\x82]|[\xc8][\xbd]|[\xd3][\x80\x8f]|[\xd4][\xbc]|[\xd5][\xac]|[\xd6][\x82]|&\#(?:1340|3(?:1[3-9]|2[0-2])|573|671|x53c|76);)
replace_tag M (?:m|rn|[\xd0][\x9c\xbc]|[\xd2][\xa7]|[\xd3][\x8d\x8e])
replace_tag N (?:[n\xd1\xf1]|[\xd0][\x98\x99\x9f\xb8\xb9\xbb\xbf]|[\xd1][\x9d]|[\xd2][\x8a\x8b]|[\xd3][\x86\xa2\xa3\xa4\xa5]|[\xd4][\xa5]|[\xd5][\x88\x8c\xa4\xa8\xb2\xb8\xbc]|[\xd6][\x80])
replace_tag O (?:[go0\xd2\xd3\xd4\xd5\xd6\xd8\xf0\xf2\xf3\xf4\xf5\xf6\xf8]|[\xd0][\x9e\xae\xbe]|[\xd1][\xba\xbb]|[\xd3][\xa6\xa7\xa8\xaa]|[\xd4][\x9a]|[\xd5][\x95\xae]|[\xd6][\x85]|[\xd7][\xa1])
replace_tag P (?:[p\xfe]|[\xd0][\xa0]|[\xd1][\x80]|[\xd2][\x8e\x8f]|[\xd4][\x97]|[\xd5][\xa9]|[\xd6][\x84])
replace_tag Q (?:q|[\xd4][\x9a\x9b\xb3]|[\xd5][\xa3\xa6])
replace_tag R (?:r|[\xc5][\x94\x95\x96\x97\x98\x99]|[\xc8][\x90\x91\x92\x93]|[\xd0][\x93\xaf]|[\xd1][\x8f\x93]|[\xd2][\x90\x91\x93]|[\xd3][\xb6\xb7]|[\xd4][\xb8\xbb]|[\xd5][\x90\x92]|[\xd6][\x80]|&\#(?:1(?:071|103)|34[0-5]|422|5(?:2[89]|3[01]|8[89])|6(?:3[67]|40));)
replace_tag S (?:[sz\xa6\xa7]|[\xd0][\x85]|[\xd1][\x95]|[\xd5][\x8f])
replace_tag T (?:t|[\xd0][\x93\xa2]|[\xd1][\x82]|[\xd2][\x90\xac\xad]|[\xd3][\xb6]|[\xd4][\xb5\xb7]|[\xd5][\x92\xa7])
replace_tag U (?:[uv\xb5\xd9\xda\xdb\xdc\xfc\xfb\xfa\xf9\xfd]|[\xd0][\x8f\xa6]|[\xd1][\x86\x9f]|[\xd4][\xb1\xbf]|[\xd5][\x84\x8d\xb4\xb6\xbd\xbe]|[\xd6][\x87])
replace_tag V (?:[vu]|\\\/|[\xd1][\xb4\xb5\xb6\xb7])
replace_tag W (?:[wv]|[\xd0][\xa8\xa9]|[\xd1][\x88\x89\xa1\xb0\xb1\xbf]|[\xd4][\x9c\x9d]|[\xd5][\xa1\xba])
replace_tag X (?:[x\xd7]|><|[\xd0][\x96\xa5\xb6]|[\xd1][\x85]|[\xd2][\x96\x97\xb2\xb3]|[\xd3][\x81\x82\x9c\x9d\xbc\xbd\xbe\xbf])
replace_tag Y (?:[y\xff\xfd\xa5j]|[\xd0][\x8e\xa3]|[\xd1][\x83\x87\x9e]|[\xd2][\xae\xaf\xb0\xb1\xb6\xb7\xb8\xb9]|[\xd3][\x8b\x8c\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5]|[\xd4][\xbf]|[\xd5][\x8e\xaf\xbe])
replace_tag Z [zs]
replace_tag IMG (?:jpe?g|gif|png)
replace_tag SP [\s\d_*\$\%(),.:;?!}{\[\]|\/?^\#~\xa1`'+-]
replace_tag WS (?:=?\s|[\xe2](?:[\x80][\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\xaf]|[\x81][\x9f])|&(?:\#(?:8(?:19[2-9]|20[0-5]|239|287)|160|xa0)|(?:e[nm]|nb|thin)sp);)
replace_tag CUR [\$\xa5\xa3\xa4\xa2]
replace_inter SP [\s\d_*\$\%(),.:;?!}{\[\]|\/?^\#~\xa1`'+-]
replace_inter W1 \W?
replace_inter W2 \W{0,2}
replace_inter W3 \W{0,3}
replace_post P2 {1,2}
replace_post P3 {1,3}
###########################################################################
# fuzzy header tests
header SUBJECT_FUZZY_MEDS Subject =~ /(?:\b|_)(?!meds)<M><E><D><S>(?:\b|_)/i
describe SUBJECT_FUZZY_MEDS Attempt to obfuscate words in Subject:
replace_rules SUBJECT_FUZZY_MEDS
header __SUBJECT_FUZZY_VPILL Subject =~ /<inter W2><post P3>(?!viagra)<V><I><A><G><R><A>/i
replace_rules __SUBJECT_FUZZY_VPILL
meta SUBJECT_FUZZY_VPILL __SUBJECT_FUZZY_VPILL && !FUZZY_VPILL
describe SUBJECT_FUZZY_VPILL Attempt to obfuscate words in Subject:
header SUBJECT_FUZZY_CHEAP Subject =~ /<inter W2><post P3>\b(?!cheap)<C><H><E><A><P>(?:\b|<E>)/i
describe SUBJECT_FUZZY_CHEAP Attempt to obfuscate words in Subject:
replace_rules SUBJECT_FUZZY_CHEAP
header SUBJECT_FUZZY_PENIS Subject =~ /<inter W3><post P3>\b(?!pen\s?(?:ie?s|ny[ ']?s))<P><E><N><I><S>\b/i
describe SUBJECT_FUZZY_PENIS Attempt to obfuscate words in Subject:
replace_rules SUBJECT_FUZZY_PENIS
header SUBJECT_FUZZY_TION Subject =~ /<post P3>(?!tion)<T><I><O><N>/i
describe SUBJECT_FUZZY_TION Attempt to obfuscate words in Subject:
replace_rules SUBJECT_FUZZY_TION
###########################################################################
# fuzzy body tests
body FUZZY_AFFORDABLE /<inter W1><post P2>(?!affordable)<A><F><F><O><R><D><A><B><L><E>/i
describe FUZZY_AFFORDABLE Attempt to obfuscate words in spam
replace_rules FUZZY_AFFORDABLE
body FUZZY_AMBIEN /<inter W1><post P2>(?<!t)(?!ambien)(?!ombien)<A><M><B><I><E><N>/i
describe FUZZY_AMBIEN Attempt to obfuscate words in spam
replace_rules FUZZY_AMBIEN
body FUZZY_BILLION /(?!billion)<B><I><L><L><I><O><N>/i
describe FUZZY_BILLION Attempt to obfuscate words in spam
replace_rules FUZZY_BILLION
body FUZZY_CPILL /(?!ciali[sz])<C><I><A><L><I><S>/i
describe FUZZY_CPILL Attempt to obfuscate words in spam
replace_rules FUZZY_CPILL
body FUZZY_CREDIT /<inter W1>(?![ck]r[e\xe9]dit)<C><R><E><D><I><T>/i
describe FUZZY_CREDIT Attempt to obfuscate words in spam
replace_rules FUZZY_CREDIT
body FUZZY_ERECT /<inter W2><post P3>(?!erection)<E><R><E><C><T><I><O><N>/i
describe FUZZY_ERECT Attempt to obfuscate words in spam
replace_rules FUZZY_ERECT
body FUZZY_GUARANTEE /<inter W1><post P2>(?!guarantee)<G><U><A><R><A><N><T><E><E>/i
describe FUZZY_GUARANTEE Attempt to obfuscate words in spam
replace_rules FUZZY_GUARANTEE
body FUZZY_MEDICATION /<inter W1><post P2>(?!medicati[eo])<M><E><D><I><C><A><T><I><O><N>/i
describe FUZZY_MEDICATION Attempt to obfuscate words in spam
replace_rules FUZZY_MEDICATION
body FUZZY_MILLION /(?!milli?[o\xf3\xd3]n)<M><I><L><L><I><O><N>/i
describe FUZZY_MILLION Attempt to obfuscate words in spam
replace_rules FUZZY_MILLION
body FUZZY_MONEY /(?!money)<M><O><N><E><Y>/i
describe FUZZY_MONEY Attempt to obfuscate words in spam
replace_rules FUZZY_MONEY
body FUZZY_MORTGAGE /<inter W1><post P2>(?!mortgage)<M><O><R><T><G><A><G><E>/i
describe FUZZY_MORTGAGE Attempt to obfuscate words in spam
replace_rules FUZZY_MORTGAGE
body FUZZY_OBLIGATION /<inter W1><post P2>(?!obligation)<O><B><L><I><G><A><T><I><O><N>/i
describe FUZZY_OBLIGATION Attempt to obfuscate words in spam
replace_rules FUZZY_OBLIGATION
body FUZZY_OFFERS /(?!offers)<O><F><F><E><R><S>/i
describe FUZZY_OFFERS Attempt to obfuscate words in spam
replace_rules FUZZY_OFFERS
body FUZZY_PHARMACY /<inter W2><post P2>(?!pharmacy)<P><H><A><R><M><A><C><Y>/i
describe FUZZY_PHARMACY Attempt to obfuscate words in spam
replace_rules FUZZY_PHARMACY
body FUZZY_PHENT /<inter W1><post P2>(?!phentermine)<P><H><E><N><T><E><R><M><I><N><E>/i
describe FUZZY_PHENT Attempt to obfuscate words in spam
replace_rules FUZZY_PHENT
body FUZZY_PRESCRIPT /<inter W2><post P2>(?!prescription)<P><R><E><S><C><R><I><P><T><I><O><N>/i
describe FUZZY_PRESCRIPT Attempt to obfuscate words in spam
replace_rules FUZZY_PRESCRIPT
# left S off of negative look-ahead on purpose
body FUZZY_PRICES /<inter W2><post P2>(?!price)<P><R><I><C><E><S>/i
describe FUZZY_PRICES Attempt to obfuscate words in spam
replace_rules FUZZY_PRICES
body FUZZY_REFINANCE /<inter W2><post P2>(?!refinance)<R><E><F><I><N><A><N><C><E>/i
describe FUZZY_REFINANCE Attempt to obfuscate words in spam
replace_rules FUZZY_REFINANCE
body FUZZY_REMOVE /(?!remove)<R><E><M><O><V><E>/i
describe FUZZY_REMOVE Attempt to obfuscate words in spam
replace_rules FUZZY_REMOVE
body FUZZY_ROLEX /(?!rolex)<R><O><L><E><X>/i
describe FUZZY_ROLEX Attempt to obfuscate words in spam
replace_rules FUZZY_ROLEX
body FUZZY_SOFTWARE /(?!software)<S><O><F><T><W><A><R><E>/i
describe FUZZY_SOFTWARE Attempt to obfuscate words in spam
replace_rules FUZZY_SOFTWARE
body FUZZY_THOUSANDS /(?!thousands)<T><H><O><U><S><A><N><D><S>/i
describe FUZZY_THOUSANDS Attempt to obfuscate words in spam
replace_rules FUZZY_THOUSANDS
body FUZZY_VLIUM /<inter W1><post P2>(?!valium|verifiquem|volturno|vollum)<V><A><L><I><U><M>/i
describe FUZZY_VLIUM Attempt to obfuscate words in spam
replace_rules FUZZY_VLIUM
body FUZZY_VIOXX /<inter W1><post P2>(?!vioxx)<V><I><O><X><X>/i
describe FUZZY_VIOXX Attempt to obfuscate words in spam
replace_rules FUZZY_VIOXX
body FUZZY_VPILL /(?!viagra)<V><I><A><G><R><A>/i
describe FUZZY_VPILL Attempt to obfuscate words in spam
replace_rules FUZZY_VPILL
body FUZZY_XPILL /<inter W3><post P2>(?!xanax)<X><A><N><A><X>/i
describe FUZZY_XPILL Attempt to obfuscate words in spam
replace_rules FUZZY_XPILL
endif # Mail::SpamAssassin::Plugin::ReplaceTags
|