]>
Commit | Line | Data |
---|---|---|
460e9a07 | 1 | #KAM.cf - Apache SpamAssassin Rules |
badcf991 | 2 | |
5c391e88 | 3 | #Author: Kevin A. McGrail with contributions from Joe Quinn, Karsten Bräckelmann, |
d354cc29 | 4 | # Bill Cole & Giovanni Bechis |
badcf991 | 5 | |
75012d20 DM |
6 | #Email: Kevin.McGrail@McGrail.com - NOTE: Questions about spam are best submitted |
7 | # at https://raptor.pccc.com/raptor.cgim?template=report_problem | |
badcf991 DM |
8 | |
9 | #HomePage: http://www.mcgrail.com/downloads/KAM.cf | |
10 | ||
460e9a07 SI |
11 | |
12 | #Installation: There are multiple files that make up the KAM ruleset including | |
13 | #heavyweight, deadweight, & nonKAMrules. KAM.cf is changing to a channel-based | |
14 | #distribution. Watch the users@spamassassin.apache.org mailing list for an | |
15 | #announcement in early November 2020. | |
16 | ||
17 | #The ruleset includes internal rules so not every rule will be useful but | |
18 | #we encapsulate those in a KAMOnly defined loop. | |
19 | ||
20 | #KAM.cf is maintained by The McGrail Foundation, a 501(c)(3) charity. Donations | |
21 | #are appreciated. See www.mcgrail.com for more information on donations and | |
22 | #sponsorships. | |
23 | ||
24 | #THANK YOU TO OUR SPONSORS (in Alphabetical Order): | |
25 | #cPanel, INKY, Invaluement, iSpark, Linode, PCCC, ShipShapeIT and Zix/Appriver | |
badcf991 DM |
26 | |
27 | ||
75012d20 DM |
28 | #This is a collection of special rules that I have developed and use on my system. |
29 | # | |
30 | #The exact date is lost to the sands of time but we have been publishing this | |
31 | #ruleset since at least May 2004. | |
32 | # | |
33 | #They are intended as live research for committal to SpamAssassin's SVN sandbox but | |
34 | #often rely on my corpora so they do not fair well in masschecks. | |
35 | # | |
36 | #You are welcome and encouraged to email me directly regarding suggestions. | |
badcf991 | 37 | |
75012d20 DM |
38 | #To avoid being caught by our filters, False positives and negatives should be |
39 | #submitted to https://raptor.pccc.com/raptor.cgim?template=report_problem | |
40 | # | |
41 | #I believe the rules are safe and they are in use on production systems so I will | |
42 | #do my best to respond to FPs *especially* if you can send me an email sample. | |
43 | # | |
460e9a07 | 44 | #IMPORTANT: This cf file is designed for systems with a threshold of 5.0 or higher. |
badcf991 DM |
45 | |
46 | ||
75012d20 DM |
47 | #It is best to save an email sample in mbox format and zip it to attach to get |
48 | #around my filters. It is sometimes best to send samples in a second email so I | |
49 | #know to go looking for it in my spam folders. | |
50 | # | |
51 | #NOTE: I do use some poison pill (i.e. Automatic HAM/SPAM rules). | |
52 | # | |
53 | # - I don't view many of my rules as single rules as I typically use meta rules. | |
54 | # I view meta rules as multiple rules hence a larger score is acceptable. | |
55 | # | |
56 | # - Some content needs to be blocked either due to large number of complaints or | |
57 | # for content. For example, the sexually explicit items and the stock tips. | |
58 | # FPs in these rules will be quickly addressed. | |
badcf991 | 59 | |
359333c2 | 60 | #Copyright (c) 2020 Kevin A. McGrail and the McGrail Foundation |
75012d20 DM |
61 | # |
62 | # Licensed under the Apache License, Version 2.0 (the "License"); | |
63 | # you may not use this file except in compliance with the License. | |
64 | # You may obtain a copy of the License at | |
65 | # | |
66 | # http://www.apache.org/licenses/LICENSE-2.0 | |
67 | # | |
68 | # Unless required by applicable law or agreed to in writing, software | |
69 | # distributed under the License is distributed on an "AS IS" BASIS, | |
70 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
71 | # See the License for the specific language governing permissions and | |
72 | # limitations under the License. | |
73 | ||
75012d20 DM |
74 | # COURTESY OF Marcin Miros.aw <marcin@mejor.pl> |
75 | body __KAM_MM_FOREX_1 /program.{0,10}ktory\ssam\sgra\sna\sgieldzie|program\sdo\sgry\sna\sgieldzie|Potega\stego\sprogramu\stkwi|program.{0,10}handluje.{0,10}zarabia.{0,10}gieldzie.{0,10}udzialu.{0,10}czlowieka|zarabiaj.{0,10}program.{0,10}nie.{0,10}jest.{0,10}zabroniony|Program.{0,10}zrobi.{0,10}wszystko.{0,10}sam|handluj.{0,10}na.{0,10}gieldzie.{0,10}programowi|100.{0,10}%.{0,10}pewnych.{0,10}transakcji|program.{0,10}100.{0,10}%.{0,10}zysk|handel.{0,10}bedzie.{0,10}zabroniony|program.{0,10}odmieni.{0,10}twoje.{0,10}zycie|system.{0,10}finansow.{0,10}przed.{0,10}upadkiem|grupa.{0,10}niemieckich.{0,10}matematykow.{0,10}inteligentny.{0,10}program|zostan\sobrzydliwie\sbogaty|technologia.{0,10}100%.{0,10}pewne.{0,10}decyzje|zarabianie.{0,10}w.{0,10}sieci|swoja.{0,10}szanse.{0,10}zarabianie|internet.{0,10}doprowadzil.{0,10}pieniedzy|zarabia.{0,10}(w|przez).{0,10}internet|karaluch.{0,10}dom.{0,10}brzeg.{0,10}morza|odmieni.{0,10}zycie|pieniadz|pieniedz|zarabia|zarobi/i | |
460e9a07 | 76 | |
75012d20 | 77 | rawbody __KAM_MM_FOREX_2 /(\[|\<).{1,10}http:\/\/.{1,50}php\?.{1,30}\=.{1,30}(\]|\>).{0,20}(klik|odwiedz|dowiedz|przegap|odnosnik|zarobi|spiesz|majatek|wiecej\sinformacji\sna\sten\stemat\sznajdziesz\s-\stutaj|tutaj\sznajdziesz.{0,10}szczegolowe.{0,10}informacje|odwiedz|zarabia|wchodz)/i |
460e9a07 | 78 | |
75012d20 DM |
79 | meta KAM_MM_FOREX __KAM_MM_FOREX_1 && __KAM_MM_FOREX_2 |
80 | score KAM_MM_FOREX 2.5 | |
81 | describe KAM_MM_FOREX Polish-language spam from the Forex botnet | |
82 | ||
83 | #PHISHING TEST | |
84 | rawbody KAM_PHISH1 /u style="cursor: pointer"/ | |
85 | describe KAM_PHISH1 Test for PHISH that changes the cursor | |
86 | score KAM_PHISH1 0.01 | |
87 | ||
20dc3cb6 SI |
88 | header __KAM_PHISH4_1 From =~ /host|apple|amazon|microsoft|windows|express|app.serv|goodluck|bank|support/i |
89 | body __KAM_PHISH4_2 /dear.{0,50}customer|automated.message|spam.activities|attempted.gaining.access|your.account.expires|authorized.government|important.message|message.alert|suspended/i | |
90 | body __KAM_PHISH4_3 /(confirm|verify|update).your.(identity|account)|account.password|credit.(bureau|profile)|identity.theft|accredited.commission|security.concern|kindly.find.enclosed|owner of this account/i | |
75012d20 DM |
91 | |
92 | ifplugin Mail::SpamAssassin::Plugin::MIMEHeader | |
5c391e88 | 93 | mimeheader __KAM_PHISH4_4 Content-Type =~ /(verification|information|form)\.htm/i |
75012d20 DM |
94 | endif |
95 | ||
96 | meta KAM_PHISH4 (__KAM_PHISH4_1 + __KAM_PHISH4_2 + __KAM_PHISH4_3 + __KAM_PHISH4_4 >= 3) | |
97 | score KAM_PHISH4 3.5 | |
98 | describe KAM_PHISH4 Another phishing attempt | |
99 | ||
100 | #KAM REALESTATE / RE-FINANCE SCAM EMAILS - Thanks to David Goldsmith for pointing out my error in the meta rule! | |
101 | body __KAM_REAL1 /(^|\b)RE market/is | |
102 | body __KAM_REAL2 /(crashing|declining)/i | |
103 | body __KAM_REAL3 /(vacation|second) (home|place)/is | |
104 | meta KAM_REAL (__KAM_REAL1 + __KAM_REAL2 + __KAM_REAL3 >= 3) | |
105 | describe KAM_REAL Real Estate or Re-Finance Spam | |
106 | score KAM_REAL 0.5 | |
107 | ||
108 | #REFINANCE SCAM EMAILS | |
109 | header __KAM_REFI1 Subject =~ /(refinance|rates) at \d\.\d*%|(?:I would like to offer you my help|Lower your house payment|follow up email|evaluation enclosed|submit a bid|fixed rates|ARM program|New Program|regardless of credit|loan request|accepting your application|refinance appl?ication|ready to (give a (business )?loan|lend)|good credit or not|refinance without perfect credit|financial independence|Loan Offer|Get a Loan|your urgent loan|credit report|time to refinance|refi.(rates|requirements|plus|program|plan|advice)|rates at historical low|EQUIFAX|TRANSUNION|Experian|rates can be cut|save your home)|Reverse.?Mortgage|obama (extends|waives)|VA loan|harp program|re.?fi.advice|homeowners.owe|harp.extension|\d+\.\d+%.fixed|\d+\.\d+.pct|this.rate|refi(nance)?.rate|lower.refi|refinance.your.mortgage|refinance.now|obama.?s?.refi|monthly.payment|house.payment|monthly.savings|modified.payment|new.payment|overpaying|calculate.your|your.saving|housing.plan|obama.?s.hous|l.f..insuranc.|offer.for.your.home|second.mortgage/i | |
110 | body __KAM_REFI2 /(Free Evaluation (?:online|on your (?:current )?home loan)|No hidden costs|no strings attached|good credit or not|personalized consultation|in need of loan|consolidation loan|loan processing|apply by sending|loan of any amount|clean up any inacccuracies|lock in saving|save on monthly mortgage|absolutely no cost|underwater)|Reverse.?Mortgage|qualify for a VA loan|Refi now.? and Save|obama..?announces|rate.calculator|save.thousands|update: \d.\d\d..available|homeowner|over.your.head|rate.service|now.eligi?[bl]{2}e|a.second.mortgage|urgent.loan|loan.offer/is | |
111 | body __KAM_REFI3 /(restructure (?:proposal|program|opportunity|your loan)|switch from an adjustable rate to a fixed|new lending program|(low|reasonable) interest (loan|rate)|lowest monthly payment|\d% interest|unsecured personal|better credit terms|lower your mortgage|low-interest refinance|see your credit score|credit score.{1,15}updated|refi with HARP)|obama announce(s|d) (the )?harp program|obama'?s.refi|a.fortune.off|lower.home.rate|your.home|home.loan|gov.program|official.harp|currently.overpaying/is | |
112 | body __KAM_REFI4 /(\$\d{1,3},\d{1,3}|\d{2,3}k of funds|\d{4,6} USD|\d{4,6}\$ per month|\d{3,5}\/mo)|refinance at \d\.\d%|\$\d{3,}(\.\d\d)?.(a|per).year|extend.harp|spending.too.much|new.payment|better.rate/i | |
113 | body __KAM_REFI5 /([\d,]{5,6}|\d{2}\s*%) savings|principal \d+% less|\d+\.\d+%.fixed|refi.calculator|lowered.requirements|home.?owner/is | |
114 | body __KAM_REFI6 /((?:reduce your monthly payment|save you) (between )?\d{2}\s*%|save yourself hundreds of dollars|great rate available|completely unsecured|instantly connect with\s+lenders|get you back on the right financial|get report today|protect against identity|know your credit score|crazy payments)|u.?s.? homeowners|drop.your.rate|in.your.pocket|our.records|apply.for.your/is | |
115 | body __KAM_REFI7 /(?:loan product|equity cash|house.payment|home.payment|no up front fees|seasoned equity|pay off high rate cards|ARM Program|credit is less than perfect|credit (score )?will not disqualify|plastic money|charge card balances|we offer out loans|floating loan scheme|unsecured guaranteed|President.?s new program|Home Affordable Refinance Program)|save $?[\d\.]+ per (year|month)|low.rate|harp.?2|rates.like.th(is|ese)/is | |
116 | header __KAM_REFI8 From =~ /great loan|mortgage|financ|Delta|Rate\.?market|credit score|free.?score|harp|mtge|foreclosure|VA loan|lower.my.(bills|debt|mortgage|rate)|refi.(alert|advantage|quote|calc|rate)|obama|lendingtree|(house|home).?payment|home.?payment|lower.rate|\d+\.\d+%|saving|d.r.ct.l.f.|helpline/i | |
117 | ||
118 | meta KAM_REFI (__KAM_REFI1 + __KAM_REFI2 + __KAM_REFI3 + __KAM_REFI4 + (__KAM_REFI5 + __KAM_REFI6 >= 1) + __KAM_REFI7 + __KAM_REFI8 + (KAM_SHORT || AC_HTML_NONSENSE_TAGS || KAM_EU) >= 4) | |
119 | describe KAM_REFI Real Estate / Re-Finance Spam | |
120 | score KAM_REFI 3.0 | |
121 | ||
122 | meta KAM_REFI2 (__KAM_REFI1 + __KAM_REFI2 + __KAM_REFI3 + __KAM_REFI4 + (__KAM_REFI5 + __KAM_REFI6 >= 1) + __KAM_REFI7 + __KAM_REFI8 + (KAM_SHORT || AC_HTML_NONSENSE_TAGS || KAM_EU) >= 6) | |
123 | describe KAM_REFI2 Real Estate / Re-Finance Spam | |
124 | score KAM_REFI2 2.75 | |
125 | ||
126 | #KAM ERADICATE DEBTS | |
127 | body __KAM_DEBT1 /(debts disappear|reduce your payments|piling bills|creditors|late bills|vanish some of your bills|reduce your payments|looming bills|all that debt|outstanding debt|debt.{0,7}accumulated|all my debt|penalties,? and fees are gone|banking laws|select legal|change your life|get out of .?d.?e.?b.?t|Free[- ]Credit Report|debt relief options|are you in debt|pay off all your debt|get better rates|credit card debt|could.be.easy)/is | |
128 | header __KAM_DEBT2 Subject =~ /(all that you owe|all you owe|everything you owe|eradicate|indebted|sick of bills|debt.{0,7}accumulated|tired of (the )?debt|looming debt|creditors|bank[ ]?rupt|debt ?free|out ?of ?debt|take control of your monthly payments|bills disappear|We can help|consultation regarding bills|get better rates|credit score|FICO Score|eliminate\s{1,2}debt|Erase the debt|loan offer|consolidating.debt)/i | |
129 | body __KAM_DEBT3 /(bills keeping you|brink of bankruptcy|take all the (stress|pain) away|all the bills|tired of high credit card|make your bills disappear|improve your credit score|b.?a.?n.?k.?r.?u.?p.?t.?c?.?y|monitor your[- ]credit|Wipes out debt|being debt free|interest rates are reasonable|view your credit score|manage.your.finance)/is | |
130 | ||
131 | meta KAM_DEBT ((__KAM_DEBT1 + __KAM_DEBT2 + __KAM_DEBT3) >= 3) | |
132 | describe KAM_DEBT Debt eradication spams | |
133 | score KAM_DEBT 2.5 | |
134 | ||
135 | meta KAM_DEBT2 ((__KAM_DEBT1 + __KAM_DEBT2 + __KAM_DEBT3 + __KAM_ADVERT2) >= 2) | |
136 | describe KAM_DEBT2 Likely Debt eradication spams | |
137 | score KAM_DEBT2 1.0 | |
138 | ||
139 | #XtraSize+ Penis Enlargement Scam | |
140 | header __KAM_SILD1 Subject =~ /Sildenafil Citrate/i | |
141 | body __KAM_SILD2 /(XtraSize\+|Sildenafil Citrate)/i | |
142 | ||
143 | meta KAM_SILD (__KAM_SILD1 + __KAM_SILD2 >= 1) | |
144 | ||
145 | describe KAM_SILD Simple rule to block one more enhancement message | |
146 | score KAM_SILD 5.0 | |
147 | ||
148 | #if (version < 3.002000) | |
149 | # #HTML_SHORT_LENGTH DEPENDENCY RULE REMOVED FROM SA 3.2.X | |
150 | # #KAM NUMBER EMAILS - Thanks to Mark Damrose for the NUMBER3 idea & Jan-Pieter Cornet | |
151 | # header __KAM_NUMBER1 Subject =~ /^\d+$/ | |
152 | # body __KAM_NUMBER2 /\d{1,6}/ | |
153 | # header __KAM_NUMBER3 Message-ID =~ /\<[a-z]{19}\@/i | |
154 | # | |
155 | # meta KAM_NUMBER ((__KAM_NUMBER1 + __KAM_NUMBER2 + MIME_HTML_ONLY + HTML_SHORT_LENGTH + __KAM_NUMBER3) >= 5) | |
156 | # describe KAM_NUMBER Silly Number Emails | |
157 | # score KAM_NUMBER 1.0 | |
158 | #endif | |
159 | ||
160 | #KAM MEDICATION KAM_OVERPAY | |
161 | body KAM_OVERPAY /O . V . E . R . P . A . Y/i | |
162 | describe KAM_OVERPAY Common Medicinal Ad Trick | |
163 | score KAM_OVERPAY 3.5 | |
164 | ||
165 | #VIAGRA AD - CHANGED DUE TO FPS on 2010-05-06 - Replaced [VACLXPSI] with separate rules space separated | |
460e9a07 SI |
166 | replace_rules __KAM_VIAGRA2 |
167 | ||
168 | body __KAM_VIAGRA1 /V I A G R A|C I A L I S|V A L I U M|X A N A X/i | |
169 | header __KAM_VIAGRA2 Subject =~ /<V1><I1><A1><G1><R1><A1>/i | |
170 | ||
171 | meta KAM_VIAGRA1 (__KAM_VIAGRA1 + __KAM_VIAGRA2 >= 1) | |
75012d20 DM |
172 | describe KAM_VIAGRA1 Common Viagra and Medicinal Table Trick |
173 | score KAM_VIAGRA1 3.0 | |
174 | ||
175 | #VIAGRA AD 2 | |
176 | body KAM_VIAGRA2 /(?:Xan|Som|CIA|VAL|VIA|Pro|Amb|Lev|Mer) (?:Xan|Som|CIA|VAL|VIA|Pro|Amb|Lev|Mer) (?:Xan|Som|CIA|VAL|VIA|Pro|Amb|Lev|Mer)/i | |
177 | describe KAM_VIAGRA2 Common Viagra and Medicinal Table Trick | |
178 | score KAM_VIAGRA2 3.1 | |
179 | ||
180 | #VIAGRA AD 3 - REMOVED FOR LOW S/O - Thanks to Shane Williams for reporting the FP | |
181 | #body KAM_VIAGRA3 /(?:Xan|Som|CIA|VAL|VIA|Pro|Amb|Lev|Mer)( \w )(?:ax|lis|ra|ium)/i | |
182 | #describe KAM_VIAGRA3 Common Viagra and Medicinal Table Trick | |
183 | #score KAM_VIAGRA3 3.1 | |
184 | ||
185 | #VIAGRA AD 4 | |
186 | body __KAM_VIAGRA4A /V (. )?A (. )?L (. )?[I\/t] (. )?U (. )?M/i | |
187 | body __KAM_VIAGRA4B /V (. )?[I\/t] (. )?A (. )?G (. )?R (. )?A/i | |
188 | body __KAM_VIAGRA4C /M (. )?E (. )?R (. )?[I\/t] (. )?D (. )?[I\/] (. )?A/i | |
189 | ||
190 | # FP FOR "Les Iles du Monde Via Gramsci" OR ITALIAN "WE WISH YOU" | |
191 | body __KAM_VIAGRA_FPS /via gra|i augur/i | |
192 | ||
193 | meta KAM_VIAGRA4 ((__KAM_VIAGRA4A + __KAM_VIAGRA4B + __KAM_VIAGRA4C) >= 2) | |
194 | describe KAM_VIAGRA4 Common Viagra and Medicinal Table Trick | |
195 | score KAM_VIAGRA4 3.1 | |
196 | ||
197 | #VIAGRA AD 5 | |
198 | body KAM_VIAGRA5 /(V [1li|\]] [a&] G R A|VljAG+R+A)/i | |
199 | describe KAM_VIAGRA5 Viagra Obfuscation Technique SPAM | |
200 | score KAM_VIAGRA5 3.1 | |
201 | ||
202 | #VIAGRA AD 6 | |
203 | #Switch to [-_\. ]? to avoid FP's reported by Robin Tan | |
204 | #Also added a few more boundary checks thanks to Daniele Duca | |
205 | body __KAM_VIAGRA6A /V[-_\. ]?[IL1][-_\. ]?A.?G.?R.?A/i | |
206 | body __KAM_VIAGRA6B /(\b|^)A.?M.?B.?[il1].?E.?N($|\b)/i | |
207 | body __KAM_VIAGRA6C /V.?A.?L.?[il1].?U.?M/i | |
208 | body __KAM_VIAGRA6D /(\b|^)C.?[il1].?A.?L.?[Il1].?S($|\b)/i | |
209 | header __KAM_VIAGRA6E From =~ /Viagra|Cialis(\b|$)/i | |
210 | ||
211 | meta KAM_VIAGRA6 (__KAM_VIAGRA6A + __KAM_VIAGRA6B + __KAM_VIAGRA6C + __KAM_VIAGRA6D + __KAM_VIAGRA6E >= 2) | |
212 | describe KAM_VIAGRA6 Viagra Obfuscation Technique SPAM | |
213 | score KAM_VIAGRA6 3.1 | |
214 | ||
215 | #VIAGRA AD 7 - TWEAKING RULE 7B TO PREVENT HITS ON SPECIALIST | |
216 | body __KAM_VIAGRA7A /V[ij]+AGRA/i | |
217 | body __KAM_VIAGRA7B /(^|\b)C[ij]+AL[ij]+S($|\b)/i | |
218 | body __KAM_VIAGRA7C /(^|\b)AMB[ij]+EN($|\b)/i | |
219 | body __KAM_VIAGRA7D /VAL[ij]+UM/i | |
220 | ||
221 | meta KAM_VIAGRA7 ((__KAM_VIAGRA7A + __KAM_VIAGRA7B + __KAM_VIAGRA7C + __KAM_VIAGRA7D >= 2) && (KAM_VIAGRA6 < 1)) | |
222 | describe KAM_VIAGRA7 Viagra Obfuscation Technique SPAM | |
223 | score KAM_VIAGRA7 3.1 | |
224 | ||
225 | #VIAGRA AD 8 | |
226 | body __KAM_VIAGRA8A /VI...?AGRA/i | |
227 | body __KAM_VIAGRA8B /AM...?BIEN/i | |
228 | body __KAM_VIAGRA8C /VA...?LIUM/i | |
229 | body __KAM_VIAGRA8D /CI...?ALIS/i | |
230 | ||
231 | meta KAM_VIAGRA8 ((__KAM_VIAGRA8A + __KAM_VIAGRA8B + __KAM_VIAGRA8C + __KAM_VIAGRA8D) >= 2) | |
232 | describe KAM_VIAGRA8 Viagra Obfuscation Technique SPAM | |
233 | score KAM_VIAGRA8 5.1 | |
234 | ||
235 | #VIAGRA AD 9 | |
236 | body __KAM_VIAGRA9A /V[IL1]A..GRA/i | |
237 | body __KAM_VIAGRA9B /AMB..IEN/i | |
238 | body __KAM_VIAGRA9C /VAL..IUM/i | |
239 | body __KAM_VIAGRA9D /C[IL1]A..LIS/i | |
240 | ||
241 | meta KAM_VIAGRA9 ((__KAM_VIAGRA9A + __KAM_VIAGRA9B + __KAM_VIAGRA9C + __KAM_VIAGRA9D) >= 2) | |
242 | describe KAM_VIAGRA9 Viagra Obfuscation Technique SPAM | |
243 | score KAM_VIAGRA9 5.1 | |
244 | ||
245 | #VIAGRA AD 10 - CONTENT-LESS EMAIL FROM "MALE ENHANCEMENT" | |
246 | header __KAM_VIAGRA10A From =~ /male enhancement|mens.renewal/i | |
247 | header __KAM_VIAGRA10B Subject =~ /your intimate partner will (thank|love)|grow.your.manhood|satisfy.your.woman/i | |
248 | ||
249 | meta KAM_VIAGRA10 (__KAM_VIAGRA10A + __KAM_VIAGRA10B >= 1) | |
250 | describe KAM_VIAGRA10 Male enhancement spam with no content | |
251 | score KAM_VIAGRA10 8.0 | |
252 | ||
253 | #NITROXIN - A NEW AND SPAMMY COMPETITOR TO VIAGRA | |
254 | header __KAM_NITROXIN1A From =~ /nitroxin/i | |
255 | ||
256 | meta KAM_NITROXIN1 (__KAM_NITROXIN1A >= 1) | |
257 | describe KAM_NITROXIN1 Another variant of Viagra spam | |
258 | score KAM_NITROXIN1 8.0 | |
259 | ||
260 | #RE[#] SPAM | |
261 | #NOTE: Thanks to Jason Haar" <Jason.Haar@trimble.co.nz> for pointing out that I was only doing >=1! | |
262 | header KAM_RE Subject =~ /^Re(?:\s)*\[\d\]+(?:\s)*:?$/i | |
263 | describe KAM_RE Subject of Re[0]: etc prevalent in Spam | |
264 | score KAM_RE 2.0 | |
265 | ||
266 | meta KAM_RE_PLUS (HTML_IMAGE_ONLY_08+KAM_RE >= 2) | |
267 | describe KAM_RE_PLUS Bad Subject and Image Only rule hit == SPAM! | |
268 | score KAM_RE_PLUS 4.0 | |
269 | ||
270 | #HOODIA | |
271 | #RE-WEIGHTING - Thanks to Martin Kaempf and Gareth Blades for pointing out the False Positives!! | |
272 | #Changed to escape + for 920\+ and changed to rawbody because we don't want to check the subject twice. | |
273 | #thansk to Michael Denney for the FP report | |
274 | header __KAM_HOODIA1 Subject =~ /(hoodia|920\+|serotonin|reduce your appetite)/i | |
275 | rawbody __KAM_HOODIA2 /(?:hoodia|920\+)/i | |
276 | body __KAM_HOODIA3 /(?:fat loss product|sur?p?press appetite|Reduce Your Appetite)/is | |
277 | ||
278 | meta KAM_HOODIA (__KAM_HOODIA1 + __KAM_HOODIA2 + __KAM_HOODIA3 >= 2) | |
279 | describe KAM_HOODIA Hoodia / Weight Loss Product Promotion Spam | |
280 | score KAM_HOODIA 3.0 | |
281 | ||
282 | #STOCK TIPS | |
283 | ||
284 | ##1 through 120 disabld 5-12-2014 due to age | |
285 | ##body __KAM_STOCKTIP1 /(?:Reynaldo's Mexican Food|RYNL)/is | |
286 | ##body __KAM_STOCKTIP2 /(?:KOKO PETROLEUM|KKPT)/is | |
287 | ##body __KAM_STOCKTIP3 /(?:DARK DYNAMITE|DKDY|D K D Y)/is | |
288 | ##body __KAM_STOCKTIP4 /(?:Remington Ventures|RMVN)/is | |
289 | ##body __KAM_STOCKTIP5 /(?:m-Wise|MWIS|M W I S)/is | |
290 | ##body __KAM_STOCKTIP6 /(?:China World Trade Corporation|CWTD)/is | |
291 | ##body __KAM_STOCKTIP7 /(?:Packets International|IPKL)/is | |
292 | ##body __KAM_STOCKTIP8 /(?:Infinex Ventures|IFNX)/is | |
293 | ##body __KAM_STOCKTIP9 /(?:FacePrint Global Solutions|FCPG)/is | |
294 | ###THANKS TO HOMER PARKER FOR THE FALSE POSSITIVE NOTE! | |
295 | ##body __KAM_STOCKTIP10 /(?:Ever[-_ ~]{0,3}Gl[o0]ry|(^|\b)E[-_~\. =]{0,3}G[-_~\. =]{0,3}L[-_~\. =]{0,3}Y($|\b))/is | |
296 | ##body __KAM_STOCKTIP11 /(?:Gulf Petroleum|GFPE)/is | |
297 | ##body __KAM_STOCKTIP12 /(?:Patriot Mechanical Handling|PMHH)/is | |
298 | ##body __KAM_STOCKTIP13 /(?:KSW Industries|KSWJ)/is | |
299 | ##body __KAM_STOCKTIP14 /(?:Conforce International|CFRI)/is | |
300 | ##body __KAM_STOCKTIP15 /(?:Nano Superlattice Technology|NSLT)/is | |
301 | ##body __KAM_STOCKTIP16 /(?:Morgan Beaumont|MBEU)/is | |
302 | ##body __KAM_STOCKTIP17 /(?:Relay Capital|(^|\b)RLYC($|\b))/is | |
303 | ###THANKS TO DAVID GOLDSMITH FOR POINTING OUT THE POTENTIAL FPs FROM THIS RULE | |
304 | ##body __KAM_STOCKTIP18 /(?:Madison Explorations|(?:^|\b)MDEX(?:$|\b))/is | |
305 | ##body __KAM_STOCKTIP19 /(?:CTR Investments and Consulting|C ?I ?V ?X)/is | |
306 | ##body __KAM_STOCKTIP20 /(?:PREMIER INFORMATION|(?:^|\b)PIFR(?:$|\b))/is | |
307 | ##body __KAM_STOCKTIP21 /(?:Harbin Pingchuan|P G C N|PGCN)/is | |
308 | ##body __KAM_STOCKTIP22 /(?:CLIENT TRACK CORP|CTKR)/is | |
309 | ##body __KAM_STOCKTIP23 /(?:EXTREME INNOVATIONS|(^|\b)EXTI($|\b))/is | |
310 | ##body __KAM_STOCKTIP24 /(?:Medical Home Products|\bMHPT\b)/is | |
311 | ##body __KAM_STOCKTIP25 /(?:AmeraMex International|AMMX)/is | |
312 | ##body __KAM_STOCKTIP26 /(?:Equipment & Systems Engineering|EQUIPMENT & SYS ENGR|EQSE)/is | |
313 | ##body __KAM_STOCKTIP27 /(?:NANOFORCE|NNFC)/i | |
314 | ##body __KAM_STOCKTIP28 /(?:\b|^)(?:Resort Clubs (I|\|)nternational|R[ ]*T[ ]*C[ ]*(?:I|\|))(?:\b|$)/is | |
315 | ##body __KAM_STOCKTIP29 /(?:Innovation Holdings|IVHN)/is | |
316 | ##body __KAM_STOCKTIP30 /(?:GOLDEN APPLE OIL|GAPJ)/is | |
317 | ##body __KAM_STOCKTIP31 /(?:inZon Corporation|(^|\b)I ?Z ?O ?N($|\b))/is | |
318 | ##body __KAM_STOCKTIP32 /(?:Midland Baring Financial Group|MDBF)/is | |
319 | ##body __KAM_STOCKTIP33 /(?:Aradyme Corporation|A D Y E)/is | |
320 | ##body __KAM_STOCKTIP34 /(?:TRANSAKT CORP|TKTJF)/is | |
321 | ##body __KAM_STOCKTIP35 /(?:CTXE|CANTEX ENERGY CORP)/is | |
322 | ##body __KAM_STOCKTIP36 /(?:De Greko|DGKO)/is | |
323 | ##body __KAM_STOCKTIP37 /(?:Deep Earth Resource, Inc|CTFE|DPER)/is | |
324 | ##body __KAM_STOCKTIP38 /(?:Vemics|(\b|^)VMCI(\b|$)|Summit Financial Resources)/is | |
325 | ##body __KAM_STOCKTIP39 /Premium Petroleum/is | |
326 | ##body __KAM_STOCKTIP40 /(?:F ?a ?l ?c ?o ?n ?E ?n ?e ?r ?g ?y|F.?C.?Y.?I)/s | |
327 | ##body __KAM_STOCKTIP41 /(?:CHINA GOLD CORP|CGDC)/is | |
328 | ##body __KAM_STOCKTIP42 /DPEK/i | |
329 | ###FIXED FP THANKS TO BEN LENTZ - Also found that the X ?X ?X ?X concept is causing too many FPs thanks to Homer Parker | |
330 | ##body __KAM_STOCKTIP43 /(?:Amerossi International Group|A M S N(\b|$)|AMSN)/is | |
331 | ##body __KAM_STOCKTIP44 /(?:WATAIRE INDUSTRIES|W ?T ?A ?F)/is | |
332 | ##body __KAM_STOCKTIP45 /(?:ABSOLUTESKY|A ?B ?S ?Y)/i | |
333 | ##body __KAM_STOCKTIP46 /(?:Infinex Ventures|I ?N ? ?F ?X)/is | |
334 | ##body __KAM_STOCKTIP47 /(?:Holly ?wood Intermediate|HYWI|H Y W I)/is | |
335 | ###DISABLED DUPLICATE OF 40 | |
336 | ###body __KAM_STOCKTIP48 /(?:Falcon Energy|F ?C ?Y ?I)/is | |
337 | ##body __KAM_STOCKTIP49 /(?:\b|^)(?:AGA Resources|A ?G ?A)(?:\b|$)/is | |
338 | ##body __KAM_STOCKTIP50 /(?:COSCO|CCPI)/i | |
339 | ##body __KAM_STOCKTIP51 /(?:PETRO([- ?])?SUN DRILLING|P[- ]?S[- ]?U[- ]?D)/is | |
340 | ##body __KAM_STOCKTIP52 /(?:KMA Global Solutions International|KMAG)/is | |
341 | ##body __KAM_STOCKTIP53 /(?:Advanced Powerline Technologies|APWL)/is | |
342 | ##body __KAM_STOCKTIP54 /(?:GOLDMARK INDUSTRIES|GDKI)/is | |
343 | ##body __KAM_STOCKTIP55 /(?:QUANTUM ENERGY|QEGY)/is | |
344 | ###FP FIXED THANKS TO Homer Parker | |
345 | ##body __KAM_STOCKTIP56 /(?:AAGA RESOURCE+S NEW|A G A O|(\b|^)AGAO(\b|$))/is | |
346 | ###FP FIXED THANKS TO Homer Parker | |
347 | ##body __KAM_STOCKTIP57 /(?:Bicoastal Communications|BCLC|B C L C)/is | |
348 | ##body __KAM_STOCKTIP58 /(?:Greater China Media \& Ent|G ?C ?M ?E)/is | |
349 | ##body __KAM_STOCKTIP59 /(?:Viva International|(\b|^)VIVI(\b|$))/s | |
350 | ##body __KAM_STOCKTIP60 /(?:WILON RESOURCES|(\b|^)WLON(\b|$))/is | |
351 | ##body __KAM_STOCKTIP61 /(?:Am+erica+n U+ni+ty I+nve+stments|(\b|^)A[ _]?U[ _]?N[ _]?I[ _]?(\b|$))/is | |
352 | ##body __KAM_STOCKTIP62 /(?:DEFENSE DIRECTIVE|(\b|^)DFSE(\b|$))/is | |
353 | ##body __KAM_STOCKTIP63 /(?:Cyberhand Technologies|(\b|^)CYHD(\b|$))/is | |
354 | ##body __KAM_STOCKTIP64 /(?:Texhoma Energy|(\b|^)TXHE(\b|$))/is | |
355 | ##body __KAM_STOCKTIP65 /(?:Equal Trading|(\b|^)EQTD(\b|$))/is | |
356 | ###DISABLED FOR FALSE POSITIVES AND AGE | |
357 | ###body __KAM_STOCKTIP66 /(?:\b|^)W.?B.?R.?S(?:\b|$)/is | |
358 | ##body __KAM_STOCKTIP67 /(?:Mobile Airwaves|(\b|^)M.?W.?B.?C.?(\b|$))/is | |
359 | ##body __KAM_STOCKTIP68 /(?:X-tra Petroleum|(\b|^)XTPT(\b|$))/is | |
360 | ###ADDED FP BOUNDARY CHECK THANKS TO Greg Troxel for reporting the issue | |
361 | ##body __KAM_STOCKTIP69 /(?:Red Reef Laboratories|(\b|^)RREF(\b|$))/is | |
362 | ##body __KAM_STOCKTIP70 /(?:Great American Food Chain|(\b|^)GAMN(\b|$))/is | |
363 | ##body __KAM_STOCKTIP71 /(?:Cana Petroleum|(\b|^)CNPM(\b|$))/is | |
364 | ##body __KAM_STOCKTIP72 /(?:China Health Management|(\b|^)CNHC(\b|$))/is | |
365 | ##body __KAM_STOCKTIP73 /(?:Makeup Limited|MAKU)/is | |
366 | ##body __KAM_STOCKTIP74 /(?:Premier Holdings Group|PMHD)/is | |
367 | ###FP FIXED THANKS TO Christopher X. Candreva | |
368 | ##body __KAM_STOCKTIP75 /(?:VSUS technologies|(\b|^)VSUS($|\b))/is | |
369 | ##body __KAM_STOCKTIP76 /(?:FLAIR PETROLEUM|FPMC)/is | |
370 | ##body __KAM_STOCKTIP77 /(?:Physician Adult Daycare|PHYA)/is | |
371 | ###FP FIXED THANKS TO Homer Parker | |
372 | ##body __KAM_STOCKTIP78 /(?:AlgoDyne Ethanol Energy|(\b|^)ADYN(\b|$))/is | |
373 | ##body __KAM_STOCKTIP79 /(?:Critical Care.{1,3}Inc|CTCX)/is | |
374 | ##body __KAM_STOCKTIP80 /(?:Aerofoam Metals|AFML)/is | |
375 | ##body __KAM_STOCKTIP81 /(?:Ten \& 10|(?:\b|^)TTEN)/is | |
376 | ##body __KAM_STOCKTIP82 /(?:Medical Institutional Services|MISJ(\b|$))/is | |
377 | ##body __KAM_STOCKTIP83 /(?:Harris Exploration|HXPN)/is | |
378 | ##body __KAM_STOCKTIP84 /(?:MARSHAL HOLDINGS|MHII)/is | |
379 | ##body __KAM_STOCKTIP85 /(?:ADVANCED GROWING SYSTEMS|AGWS)/is | |
380 | ##body __KAM_STOCKTIP86 /(?:WEST EXCELSIOR ENT|WEXE)/is | |
381 | ##body __KAM_STOCKTIP87 /(?:Hemisphere Gold|HPGI)/is | |
382 | ##body __KAM_STOCKTIP88 /(?:Victory Energy Corporation|VYEY)/is | |
383 | ##body __KAM_STOCKTIP89 /UTEV/i | |
384 | ##body __KAM_STOCKTIP90 /(?:CHINA BIOLIFE ENTERP|CBFE)/is | |
385 | ##body __KAM_STOCKTIP91 /(?:Critical Care|C ?T ?C ?X)/is | |
386 | ##body __KAM_STOCKTIP92 /CBRJ/i | |
387 | ##body __KAM_STOCKTIP93 /(?:LAS VEGAS CENTRAL RESERVATIONS|LVCC)/is | |
388 | ##body __KAM_STOCKTIP94 /GTAP/i | |
389 | ##body __KAM_STOCKTIP95 /(North American Energy Group|N-?N-?Y-?R)/is | |
390 | ###FP FIXED THANKS TO BRETT GARRETT | |
391 | ##body __KAM_STOCKTIP96 /(\b|^)C\.?C\.?T\.?I(\b|$)/i | |
392 | ##body __KAM_STOCKTIP97 /(C ?E ?O AMERICA|C ? E ? O ?A)/is | |
393 | ##body __KAM_STOCKTIP98 /PLMA/i | |
394 | ##body __KAM_STOCKTIP99 /CDYV/i | |
395 | ##body __KAM_STOCKTIP100 /(Fire (Mountain|Mtn) Beverage Company|(^|\b)F[ _]?B[ _]?V[ _]?G($|\b))/is | |
396 | ###Added boundary check thanks to Michael Denney | |
397 | ##body __KAM_STOCKTIP101 /(\b|^)WDSC(\b|$)/i | |
398 | ##body __KAM_STOCKTIP102 /(Distributed Power|DPWI)/is | |
399 | ##body __KAM_STOCKTIP103 /(HUMET-PBC|L9Z\.F)/is | |
400 | ##body __KAM_STOCKTIP104 /ASVP/is | |
401 | ##body __KAM_STOCKTIP105 /CHVC/is | |
402 | ##body __KAM_STOCKTIP106 /(China Datacom|CDPN)/is | |
403 | ##body __KAM_STOCKTIP107 /(ORAMED PHARMA|OJU\.F)/is | |
404 | ##body __KAM_STOCKTIP108 /(DSDI|DSI Direct Sales)/is | |
405 | ##body __KAM_STOCKTIP109 /(Monolith Athletic Club|M[-_ ]?N[-_ ]?A[-_ ]?B)/is | |
406 | ###DUPLICATED STOCKTIP #51 | |
407 | ###body __KAM_STOCKTIP110 /(PETRO-SUN|P[- ]?S[- ]?U[- ]?D)/is | |
408 | ##body __KAM_STOCKTIP111 /(COMPLIANCE SYSTEMS|(\b|^)COPI(\b|$))/is | |
409 | ###FP Fixed thanks to Greg Troxel | |
410 | ##body __KAM_STOCKTIP112 /(Global Pay Solutions|(\b|^)GPSI(\b|$))/is | |
411 | ##body __KAM_STOCKTIP113 /(MEGOLA|MGOA)/i | |
412 | ###FP FIXED THANKS TO Antonio Falzarano | |
413 | ##body __KAM_STOCKTIP114 /(\b|^)ADOV(\b|$)/i | |
414 | ##body __KAM_STOCKTIP115 /(Oncology Med|(\b|^)ONCO(\b|$))/is | |
415 | ##body __KAM_STOCKTIP116 /(Strategy X|SGXI)/is | |
416 | ##body __KAM_STOCKTIP117 /(Spotlight Homes|COST CONTAINMENT TEC|SPHM)/is | |
417 | ###FALSE POSITIVE ON DANSREALESTATE. | |
418 | ##body __KAM_STOCKTIP118 /((\b|^)SREA(\b|$)|Score One)/is | |
419 | ##body __KAM_STOCKTIP119 /(Monster Motors|MRMT)/is | |
420 | ##body __KAM_STOCKTIP120 /(EntreMetrix|ERMX)/i | |
421 | ||
422 | body __KAM_STOCKTIP121 /(VISION AIRSHIPS|(\b|^)VPSN(\b|$))/is | |
423 | body __KAM_STOCKTIP122 /(Shandong Zhouyuan Seed and Nursery|(\b|^)SZSN(\b|$))/is | |
424 | body __KAM_STOCKTIP123 /(Puerto Rico 7|(\b|^)P ?R ?T ?H(\b|$))/is | |
425 | body __KAM_STOCKTIP124 /(VGPM|Vega Promotional Sys)/is | |
426 | body __KAM_STOCKTIP125 /((\b|^)D[- ]?M[- ]?X[- ]?C(\b|$))/i | |
427 | body __KAM_STOCKTIP126 /((\b|^)C\.?W\.?T\.?E(\b|$)|C'Watre International)/is | |
428 | body __KAM_STOCKTIP127 /(Physical Property Holdings|(\b|^)PPYH(\b|$))/is | |
429 | #FP ON MNUM IN PLAIN TEXT HTML CONVERSION - Thanks to Kevin Lewis | |
430 | body __KAM_STOCKTIP128 /(MONUMENTAL MARKETING|(\b|^)MNUM(\b|$))/is | |
431 | body __KAM_STOCKTIP129 /(EnerBrite Technologies Group|(\b|^)eTgU(\b|$))/is | |
432 | body __KAM_STOCKTIP130 /(Pricester|(\b|^)PRCC(\b|$))/is | |
433 | #Added boundary check thanks to Michael Denney | |
434 | body __KAM_STOCKTIP131 /(Greenstone Holdings|(\b|^)GSHN(\b|$))/is | |
435 | body __KAM_STOCKTIP132 /((\b|^)AGMS(\b|$)|Angstrom[- ]Microsystems)/is | |
436 | body __KAM_STOCKTIP133 /(Pluris Energy|(\b|^)PEYG(\b|$))/is | |
437 | body __KAM_STOCKTIP134 /(United Consortium|(\b|^)UCSO(\b|$))/is | |
438 | body __KAM_STOCKTIP135 /(Dominion Minerals|(\b|^)DMNM(\b|$))/is | |
439 | body __KAM_STOCKTIP136 /(PrimeGen Energy|(\b|$)PGNE(\b|^))/is | |
440 | body __KAM_STOCKTIP137 /Dynamic Response Group|(\b|^)DRGZ(\b|$)/is | |
441 | body __KAM_STOCKTIP138 /Cobra Oil (and|&) Gas|(\b|^)CGCA(\b|$)/is | |
442 | body __KAM_STOCKTIP139 /Solanex Management|(\b|^)SLNX(\b|$)/is | |
443 | body __KAM_STOCKTIP140 /BIO-SOLUTIONS|(\b|^)BISU(\b|$)/is | |
444 | #FP IN French email on 3/2/2017 | |
445 | #body __KAM_STOCKTIP141 /(\b|^)FORC(\b|$)/is | |
446 | body __KAM_STOCKTIP142 /Hawk Systems Inc|(\b|^)HWSYD(\b|$)/is | |
447 | body __KAM_STOCKTIP143 /AmeriLithium/is #|(\b|^)AMEL(\b|$)/is # FP 9/10/15 | |
448 | body __KAM_STOCKTIP144 /Fleet Management Solutions|(\b|^)FLMG(\b|$)/is | |
449 | body __KAM_STOCKTIP145 /Nuvilex|(\b|^)N.?V.?L.?X.?(\b|$)/is | |
450 | body __KAM_STOCKTIP146 /Plandai|(\b|^)PLPL(\b|$)/is | |
451 | body __KAM_STOCKTIP147 /Beamz Interactive|(\b|^)B.?Z.?I.?C(\b|$)/is | |
452 | body __KAM_STOCKTIP148 /(\b|^)STBV(\b|$)/i | |
453 | body __KAM_STOCKTIP149 /LifeApps|(\b|^)LFAP(\b|$)/i | |
454 | body __KAM_STOCKTIP150 /MONARCHY RESOURCES/i | |
455 | body __KAM_STOCKTIP151 /Alanco Tech/i | |
456 | body __KAM_STOCKTIP152 /Siga Resources/i | |
457 | body __KAM_STOCKTIP153 /INSCOR|(\b|^)IOGA(\b|$)/is | |
458 | body __KAM_STOCKTIP154 /mLight Tech|(\b|^)MLGT(\b|$)/is | |
459 | body __KAM_STOCKTIP155 /Alanco Technologies/is | |
460 | body __KAM_STOCKTIP156 /Progress Watch|(\b|^)PROW(\b|$)/is | |
359333c2 | 461 | #body __KAM_STOCKTIP157 /(\b|^)PRFC(\b|$)/is |
75012d20 DM |
462 | body __KAM_STOCKTIP158 /(\b|^)(RCHA|R\.+C\.+H\.+A|R\/C\/H\/A)(\b|$)/is |
463 | body __KAM_STOCKTIP159 /(\b|^)(RNBI|R.N.B.I)(\b|$)/is | |
464 | body __KAM_STOCKTIP160 /(\b|^)(CNRMF|C.N.R.M.F)(\b|$)/is | |
465 | body __KAM_STOCKTIP161 /(\b|^)(NUAN|N[- ]U[- ]A[- ]N)(\b|$)|NUANCE COMMUNICATIONS/is | |
466 | body __KAM_STOCKTIP162 /(\b|^)(CHICF|C.H.I.C.F)(\b|$)/is | |
467 | body __KAM_STOCKTIP163 /(\b|^)(brixmor)(\b|$)/is | |
468 | body __KAM_STOCKTIP164 /(\b|^)(KBLB|K.B.L.B)(\b|$)/is | |
469 | body __KAM_STOCKTIP165 /(\b|^)(SCRF|S.C.R.F)(\b|$)/is | |
470 | body __KAM_STOCKTIP166 /(\b|^)(INCT|Incapta)(\b|$)/is | |
460e9a07 | 471 | body __KAM_STOCKTIP167 /(\b|^)(QSMS|Quest Science Management Gate)(\b|$)/is |
75012d20 | 472 | body __KAM_STOCKTIP168 /(\b|^)(QSMG|Q.S.M.G|Stemvax)(\b|$)/is |
ded625ef | 473 | body __KAM_STOCKTIP169 /(\b|^)E.?C.?G.?R(\b|$)/s |
75012d20 DM |
474 | |
475 | ||
476 | body __KAM_STOCKOTC /(OTC|OTC ?BB|OTC Pink Sheets|NASDAQ|NYSE|StockWatch):/is | |
477 |