]>
Commit | Line | Data |
---|---|---|
75012d20 DM |
1 | #KAM.cf - SpamAssassin Rules |
2 | # | |
3 | #Author: Kevin A. McGrail with contributions from Joe Quinn & Karsten Bräckelmann | |
4 | # | |
5 | #Email: Kevin.McGrail@McGrail.com - NOTE: Questions about spam are best submitted | |
6 | # at https://raptor.pccc.com/raptor.cgim?template=report_problem | |
7 | # | |
8 | #HomePage: http://www.pccc.com/downloads/SpamAssassin/contrib/KAM.cf | |
9 | # | |
10 | #This is a collection of special rules that I have developed and use on my system. | |
11 | # | |
12 | #The exact date is lost to the sands of time but we have been publishing this | |
13 | #ruleset since at least May 2004. | |
14 | # | |
15 | #They are intended as live research for committal to SpamAssassin's SVN sandbox but | |
16 | #often rely on my corpora so they do not fair well in masschecks. | |
17 | # | |
18 | #You are welcome and encouraged to email me directly regarding suggestions. | |
19 | # | |
20 | #To avoid being caught by our filters, False positives and negatives should be | |
21 | #submitted to https://raptor.pccc.com/raptor.cgim?template=report_problem | |
22 | # | |
23 | #I believe the rules are safe and they are in use on production systems so I will | |
24 | #do my best to respond to FPs *especially* if you can send me an email sample. | |
25 | # | |
26 | #This cf file is designed for systems with a threshold of 5.0 or higher. | |
27 | # | |
28 | # | |
29 | #It is best to save an email sample in mbox format and zip it to attach to get | |
30 | #around my filters. It is sometimes best to send samples in a second email so I | |
31 | #know to go looking for it in my spam folders. | |
32 | # | |
33 | #NOTE: I do use some poison pill (i.e. Automatic HAM/SPAM rules). | |
34 | # | |
35 | # - I don't view many of my rules as single rules as I typically use meta rules. | |
36 | # I view meta rules as multiple rules hence a larger score is acceptable. | |
37 | # | |
38 | # - Some content needs to be blocked either due to large number of complaints or | |
39 | # for content. For example, the sexually explicit items and the stock tips. | |
40 | # FPs in these rules will be quickly addressed. | |
41 | # | |
42 | #For a free anti-spam consultation, fill out the form at the following URL: | |
43 | #https://raptor.pccc.com/free_spam_consultation.cgim | |
44 | ||
45 | # | |
46 | #Copyright (c) 2017 Kevin A. McGrail | |
47 | # | |
48 | # Licensed under the Apache License, Version 2.0 (the "License"); | |
49 | # you may not use this file except in compliance with the License. | |
50 | # You may obtain a copy of the License at | |
51 | # | |
52 | # http://www.apache.org/licenses/LICENSE-2.0 | |
53 | # | |
54 | # Unless required by applicable law or agreed to in writing, software | |
55 | # distributed under the License is distributed on an "AS IS" BASIS, | |
56 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
57 | # See the License for the specific language governing permissions and | |
58 | # limitations under the License. | |
59 | ||
60 | # NOTE: You might want to also grab a file we use of some various rules at | |
61 | # https://www.pccc.com/downloads/SpamAssassin/contrib/nonKAMrules.cf | |
62 | # And realize that we have numerous internal rules so not every rule will be | |
63 | # useful but we try and encapsulate those in a KAMOnly defined loop. | |
64 | ||
65 | # COURTESY OF Marcin Miros.aw <marcin@mejor.pl> | |
66 | body __KAM_MM_FOREX_1 /program.{0,10}ktory\ssam\sgra\sna\sgieldzie|program\sdo\sgry\sna\sgieldzie|Potega\stego\sprogramu\stkwi|program.{0,10}handluje.{0,10}zarabia.{0,10}gieldzie.{0,10}udzialu.{0,10}czlowieka|zarabiaj.{0,10}program.{0,10}nie.{0,10}jest.{0,10}zabroniony|Program.{0,10}zrobi.{0,10}wszystko.{0,10}sam|handluj.{0,10}na.{0,10}gieldzie.{0,10}programowi|100.{0,10}%.{0,10}pewnych.{0,10}transakcji|program.{0,10}100.{0,10}%.{0,10}zysk|handel.{0,10}bedzie.{0,10}zabroniony|program.{0,10}odmieni.{0,10}twoje.{0,10}zycie|system.{0,10}finansow.{0,10}przed.{0,10}upadkiem|grupa.{0,10}niemieckich.{0,10}matematykow.{0,10}inteligentny.{0,10}program|zostan\sobrzydliwie\sbogaty|technologia.{0,10}100%.{0,10}pewne.{0,10}decyzje|zarabianie.{0,10}w.{0,10}sieci|swoja.{0,10}szanse.{0,10}zarabianie|internet.{0,10}doprowadzil.{0,10}pieniedzy|zarabia.{0,10}(w|przez).{0,10}internet|karaluch.{0,10}dom.{0,10}brzeg.{0,10}morza|odmieni.{0,10}zycie|pieniadz|pieniedz|zarabia|zarobi/i | |
67 | rawbody __KAM_MM_FOREX_2 /(\[|\<).{1,10}http:\/\/.{1,50}php\?.{1,30}\=.{1,30}(\]|\>).{0,20}(klik|odwiedz|dowiedz|przegap|odnosnik|zarobi|spiesz|majatek|wiecej\sinformacji\sna\sten\stemat\sznajdziesz\s-\stutaj|tutaj\sznajdziesz.{0,10}szczegolowe.{0,10}informacje|odwiedz|zarabia|wchodz)/i | |
68 | meta KAM_MM_FOREX __KAM_MM_FOREX_1 && __KAM_MM_FOREX_2 | |
69 | score KAM_MM_FOREX 2.5 | |
70 | describe KAM_MM_FOREX Polish-language spam from the Forex botnet | |
71 | ||
72 | #PHISHING TEST | |
73 | rawbody KAM_PHISH1 /u style="cursor: pointer"/ | |
74 | describe KAM_PHISH1 Test for PHISH that changes the cursor | |
75 | score KAM_PHISH1 0.01 | |
76 | ||
77 | header __KAM_PHISH4_1 From =~ /host|apple|amazon|microsoft|windows|express|app.serv|goodluck|bank/i | |
78 | body __KAM_PHISH4_2 /dear.{0,50}customer|automated.message|spam.activities|attempted.gaining.access|your.account.expires|authorized.government|important.message|message.alert/i | |
79 | body __KAM_PHISH4_3 /(confirm|verify|update).your.(identity|account)|account.password|credit.(bureau|profile)|identity.theft|accredited.commission|security.concern|kindly.find.enclosed/i | |
80 | ||
81 | ifplugin Mail::SpamAssassin::Plugin::MIMEHeader | |
82 | mimeheader __KAM_PHISH4_4 Content-Type =~ /(verification|information|form).htm/i | |
83 | endif | |
84 | ||
85 | meta KAM_PHISH4 (__KAM_PHISH4_1 + __KAM_PHISH4_2 + __KAM_PHISH4_3 + __KAM_PHISH4_4 >= 3) | |
86 | score KAM_PHISH4 3.5 | |
87 | describe KAM_PHISH4 Another phishing attempt | |
88 | ||
89 | #KAM REALESTATE / RE-FINANCE SCAM EMAILS - Thanks to David Goldsmith for pointing out my error in the meta rule! | |
90 | body __KAM_REAL1 /(^|\b)RE market/is | |
91 | body __KAM_REAL2 /(crashing|declining)/i | |
92 | body __KAM_REAL3 /(vacation|second) (home|place)/is | |
93 | meta KAM_REAL (__KAM_REAL1 + __KAM_REAL2 + __KAM_REAL3 >= 3) | |
94 | describe KAM_REAL Real Estate or Re-Finance Spam | |
95 | score KAM_REAL 0.5 | |
96 | ||
97 | #REFINANCE SCAM EMAILS | |
98 | header __KAM_REFI1 Subject =~ /(refinance|rates) at \d\.\d*%|(?:I would like to offer you my help|Lower your house payment|follow up email|evaluation enclosed|submit a bid|fixed rates|ARM program|New Program|regardless of credit|loan request|accepting your application|refinance appl?ication|ready to (give a (business )?loan|lend)|good credit or not|refinance without perfect credit|financial independence|Loan Offer|Get a Loan|your urgent loan|credit report|time to refinance|refi.(rates|requirements|plus|program|plan|advice)|rates at historical low|EQUIFAX|TRANSUNION|Experian|rates can be cut|save your home)|Reverse.?Mortgage|obama (extends|waives)|VA loan|harp program|re.?fi.advice|homeowners.owe|harp.extension|\d+\.\d+%.fixed|\d+\.\d+.pct|this.rate|refi(nance)?.rate|lower.refi|refinance.your.mortgage|refinance.now|obama.?s?.refi|monthly.payment|house.payment|monthly.savings|modified.payment|new.payment|overpaying|calculate.your|your.saving|housing.plan|obama.?s.hous|l.f..insuranc.|offer.for.your.home|second.mortgage/i | |
99 | body __KAM_REFI2 /(Free Evaluation (?:online|on your (?:current )?home loan)|No hidden costs|no strings attached|good credit or not|personalized consultation|in need of loan|consolidation loan|loan processing|apply by sending|loan of any amount|clean up any inacccuracies|lock in saving|save on monthly mortgage|absolutely no cost|underwater)|Reverse.?Mortgage|qualify for a VA loan|Refi now.? and Save|obama..?announces|rate.calculator|save.thousands|update: \d.\d\d..available|homeowner|over.your.head|rate.service|now.eligi?[bl]{2}e|a.second.mortgage|urgent.loan|loan.offer/is | |
100 | body __KAM_REFI3 /(restructure (?:proposal|program|opportunity|your loan)|switch from an adjustable rate to a fixed|new lending program|(low|reasonable) interest (loan|rate)|lowest monthly payment|\d% interest|unsecured personal|better credit terms|lower your mortgage|low-interest refinance|see your credit score|credit score.{1,15}updated|refi with HARP)|obama announce(s|d) (the )?harp program|obama'?s.refi|a.fortune.off|lower.home.rate|your.home|home.loan|gov.program|official.harp|currently.overpaying/is | |
101 | body __KAM_REFI4 /(\$\d{1,3},\d{1,3}|\d{2,3}k of funds|\d{4,6} USD|\d{4,6}\$ per month|\d{3,5}\/mo)|refinance at \d\.\d%|\$\d{3,}(\.\d\d)?.(a|per).year|extend.harp|spending.too.much|new.payment|better.rate/i | |
102 | body __KAM_REFI5 /([\d,]{5,6}|\d{2}\s*%) savings|principal \d+% less|\d+\.\d+%.fixed|refi.calculator|lowered.requirements|home.?owner/is | |
103 | body __KAM_REFI6 /((?:reduce your monthly payment|save you) (between )?\d{2}\s*%|save yourself hundreds of dollars|great rate available|completely unsecured|instantly connect with\s+lenders|get you back on the right financial|get report today|protect against identity|know your credit score|crazy payments)|u.?s.? homeowners|drop.your.rate|in.your.pocket|our.records|apply.for.your/is | |
104 | body __KAM_REFI7 /(?:loan product|equity cash|house.payment|home.payment|no up front fees|seasoned equity|pay off high rate cards|ARM Program|credit is less than perfect|credit (score )?will not disqualify|plastic money|charge card balances|we offer out loans|floating loan scheme|unsecured guaranteed|President.?s new program|Home Affordable Refinance Program)|save $?[\d\.]+ per (year|month)|low.rate|harp.?2|rates.like.th(is|ese)/is | |
105 | header __KAM_REFI8 From =~ /great loan|mortgage|financ|Delta|Rate\.?market|credit score|free.?score|harp|mtge|foreclosure|VA loan|lower.my.(bills|debt|mortgage|rate)|refi.(alert|advantage|quote|calc|rate)|obama|lendingtree|(house|home).?payment|home.?payment|lower.rate|\d+\.\d+%|saving|d.r.ct.l.f.|helpline/i | |
106 | ||
107 | meta KAM_REFI (__KAM_REFI1 + __KAM_REFI2 + __KAM_REFI3 + __KAM_REFI4 + (__KAM_REFI5 + __KAM_REFI6 >= 1) + __KAM_REFI7 + __KAM_REFI8 + (KAM_SHORT || AC_HTML_NONSENSE_TAGS || KAM_EU) >= 4) | |
108 | describe KAM_REFI Real Estate / Re-Finance Spam | |
109 | score KAM_REFI 3.0 | |
110 | ||
111 | meta KAM_REFI2 (__KAM_REFI1 + __KAM_REFI2 + __KAM_REFI3 + __KAM_REFI4 + (__KAM_REFI5 + __KAM_REFI6 >= 1) + __KAM_REFI7 + __KAM_REFI8 + (KAM_SHORT || AC_HTML_NONSENSE_TAGS || KAM_EU) >= 6) | |
112 | describe KAM_REFI2 Real Estate / Re-Finance Spam | |
113 | score KAM_REFI2 2.75 | |
114 | ||
115 | #KAM ERADICATE DEBTS | |
116 | body __KAM_DEBT1 /(debts disappear|reduce your payments|piling bills|creditors|late bills|vanish some of your bills|reduce your payments|looming bills|all that debt|outstanding debt|debt.{0,7}accumulated|all my debt|penalties,? and fees are gone|banking laws|select legal|change your life|get out of .?d.?e.?b.?t|Free[- ]Credit Report|debt relief options|are you in debt|pay off all your debt|get better rates|credit card debt|could.be.easy)/is | |
117 | header __KAM_DEBT2 Subject =~ /(all that you owe|all you owe|everything you owe|eradicate|indebted|sick of bills|debt.{0,7}accumulated|tired of (the )?debt|looming debt|creditors|bank[ ]?rupt|debt ?free|out ?of ?debt|take control of your monthly payments|bills disappear|We can help|consultation regarding bills|get better rates|credit score|FICO Score|eliminate\s{1,2}debt|Erase the debt|loan offer|consolidating.debt)/i | |
118 | body __KAM_DEBT3 /(bills keeping you|brink of bankruptcy|take all the (stress|pain) away|all the bills|tired of high credit card|make your bills disappear|improve your credit score|b.?a.?n.?k.?r.?u.?p.?t.?c?.?y|monitor your[- ]credit|Wipes out debt|being debt free|interest rates are reasonable|view your credit score|manage.your.finance)/is | |
119 | ||
120 | meta KAM_DEBT ((__KAM_DEBT1 + __KAM_DEBT2 + __KAM_DEBT3) >= 3) | |
121 | describe KAM_DEBT Debt eradication spams | |
122 | score KAM_DEBT 2.5 | |
123 | ||
124 | meta KAM_DEBT2 ((__KAM_DEBT1 + __KAM_DEBT2 + __KAM_DEBT3 + __KAM_ADVERT2) >= 2) | |
125 | describe KAM_DEBT2 Likely Debt eradication spams | |
126 | score KAM_DEBT2 1.0 | |
127 | ||
128 | #XtraSize+ Penis Enlargement Scam | |
129 | header __KAM_SILD1 Subject =~ /Sildenafil Citrate/i | |
130 | body __KAM_SILD2 /(XtraSize\+|Sildenafil Citrate)/i | |
131 | ||
132 | meta KAM_SILD (__KAM_SILD1 + __KAM_SILD2 >= 1) | |
133 | ||
134 | describe KAM_SILD Simple rule to block one more enhancement message | |
135 | score KAM_SILD 5.0 | |
136 | ||
137 | #if (version < 3.002000) | |
138 | # #HTML_SHORT_LENGTH DEPENDENCY RULE REMOVED FROM SA 3.2.X | |
139 | # #KAM NUMBER EMAILS - Thanks to Mark Damrose for the NUMBER3 idea & Jan-Pieter Cornet | |
140 | # header __KAM_NUMBER1 Subject =~ /^\d+$/ | |
141 | # body __KAM_NUMBER2 /\d{1,6}/ | |
142 | # header __KAM_NUMBER3 Message-ID =~ /\<[a-z]{19}\@/i | |
143 | # | |
144 | # meta KAM_NUMBER ((__KAM_NUMBER1 + __KAM_NUMBER2 + MIME_HTML_ONLY + HTML_SHORT_LENGTH + __KAM_NUMBER3) >= 5) | |
145 | # describe KAM_NUMBER Silly Number Emails | |
146 | # score KAM_NUMBER 1.0 | |
147 | #endif | |
148 | ||
149 | #KAM MEDICATION KAM_OVERPAY | |
150 | body KAM_OVERPAY /O . V . E . R . P . A . Y/i | |
151 | describe KAM_OVERPAY Common Medicinal Ad Trick | |
152 | score KAM_OVERPAY 3.5 | |
153 | ||
154 | #VIAGRA AD - CHANGED DUE TO FPS on 2010-05-06 - Replaced [VACLXPSI] with separate rules space separated | |
155 | body KAM_VIAGRA1 /V I A G R A|C I A L I S|V A L I U M|X A N A X/i | |
156 | describe KAM_VIAGRA1 Common Viagra and Medicinal Table Trick | |
157 | score KAM_VIAGRA1 3.0 | |
158 | ||
159 | #VIAGRA AD 2 | |
160 | body KAM_VIAGRA2 /(?:Xan|Som|CIA|VAL|VIA|Pro|Amb|Lev|Mer) (?:Xan|Som|CIA|VAL|VIA|Pro|Amb|Lev|Mer) (?:Xan|Som|CIA|VAL|VIA|Pro|Amb|Lev|Mer)/i | |
161 | describe KAM_VIAGRA2 Common Viagra and Medicinal Table Trick | |
162 | score KAM_VIAGRA2 3.1 | |
163 | ||
164 | #VIAGRA AD 3 - REMOVED FOR LOW S/O - Thanks to Shane Williams for reporting the FP | |
165 | #body KAM_VIAGRA3 /(?:Xan|Som|CIA|VAL|VIA|Pro|Amb|Lev|Mer)( \w )(?:ax|lis|ra|ium)/i | |
166 | #describe KAM_VIAGRA3 Common Viagra and Medicinal Table Trick | |
167 | #score KAM_VIAGRA3 3.1 | |
168 | ||
169 | #VIAGRA AD 4 | |
170 | body __KAM_VIAGRA4A /V (. )?A (. )?L (. )?[I\/t] (. )?U (. )?M/i | |
171 | body __KAM_VIAGRA4B /V (. )?[I\/t] (. )?A (. )?G (. )?R (. )?A/i | |
172 | body __KAM_VIAGRA4C /M (. )?E (. )?R (. )?[I\/t] (. )?D (. )?[I\/] (. )?A/i | |
173 | ||
174 | # FP FOR "Les Iles du Monde Via Gramsci" OR ITALIAN "WE WISH YOU" | |
175 | body __KAM_VIAGRA_FPS /via gra|i augur/i | |
176 | ||
177 | meta KAM_VIAGRA4 ((__KAM_VIAGRA4A + __KAM_VIAGRA4B + __KAM_VIAGRA4C) >= 2) | |
178 | describe KAM_VIAGRA4 Common Viagra and Medicinal Table Trick | |
179 | score KAM_VIAGRA4 3.1 | |
180 | ||
181 | #VIAGRA AD 5 | |
182 | body KAM_VIAGRA5 /(V [1li|\]] [a&] G R A|VljAG+R+A)/i | |
183 | describe KAM_VIAGRA5 Viagra Obfuscation Technique SPAM | |
184 | score KAM_VIAGRA5 3.1 | |
185 | ||
186 | #VIAGRA AD 6 | |
187 | #Switch to [-_\. ]? to avoid FP's reported by Robin Tan | |
188 | #Also added a few more boundary checks thanks to Daniele Duca | |
189 | body __KAM_VIAGRA6A /V[-_\. ]?[IL1][-_\. ]?A.?G.?R.?A/i | |
190 | body __KAM_VIAGRA6B /(\b|^)A.?M.?B.?[il1].?E.?N($|\b)/i | |
191 | body __KAM_VIAGRA6C /V.?A.?L.?[il1].?U.?M/i | |
192 | body __KAM_VIAGRA6D /(\b|^)C.?[il1].?A.?L.?[Il1].?S($|\b)/i | |
193 | header __KAM_VIAGRA6E From =~ /Viagra|Cialis(\b|$)/i | |
194 | ||
195 | meta KAM_VIAGRA6 (__KAM_VIAGRA6A + __KAM_VIAGRA6B + __KAM_VIAGRA6C + __KAM_VIAGRA6D + __KAM_VIAGRA6E >= 2) | |
196 | describe KAM_VIAGRA6 Viagra Obfuscation Technique SPAM | |
197 | score KAM_VIAGRA6 3.1 | |
198 | ||
199 | #VIAGRA AD 7 - TWEAKING RULE 7B TO PREVENT HITS ON SPECIALIST | |
200 | body __KAM_VIAGRA7A /V[ij]+AGRA/i | |
201 | body __KAM_VIAGRA7B /(^|\b)C[ij]+AL[ij]+S($|\b)/i | |
202 | body __KAM_VIAGRA7C /(^|\b)AMB[ij]+EN($|\b)/i | |
203 | body __KAM_VIAGRA7D /VAL[ij]+UM/i | |
204 | ||
205 | meta KAM_VIAGRA7 ((__KAM_VIAGRA7A + __KAM_VIAGRA7B + __KAM_VIAGRA7C + __KAM_VIAGRA7D >= 2) && (KAM_VIAGRA6 < 1)) | |
206 | describe KAM_VIAGRA7 Viagra Obfuscation Technique SPAM | |
207 | score KAM_VIAGRA7 3.1 | |
208 | ||
209 | #VIAGRA AD 8 | |
210 | body __KAM_VIAGRA8A /VI...?AGRA/i | |
211 | body __KAM_VIAGRA8B /AM...?BIEN/i | |
212 | body __KAM_VIAGRA8C /VA...?LIUM/i | |
213 | body __KAM_VIAGRA8D /CI...?ALIS/i | |
214 | ||
215 | meta KAM_VIAGRA8 ((__KAM_VIAGRA8A + __KAM_VIAGRA8B + __KAM_VIAGRA8C + __KAM_VIAGRA8D) >= 2) | |
216 | describe KAM_VIAGRA8 Viagra Obfuscation Technique SPAM | |
217 | score KAM_VIAGRA8 5.1 | |
218 | ||
219 | #VIAGRA AD 9 | |
220 | body __KAM_VIAGRA9A /V[IL1]A..GRA/i | |
221 | body __KAM_VIAGRA9B /AMB..IEN/i | |
222 | body __KAM_VIAGRA9C /VAL..IUM/i | |
223 | body __KAM_VIAGRA9D /C[IL1]A..LIS/i | |
224 | ||
225 | meta KAM_VIAGRA9 ((__KAM_VIAGRA9A + __KAM_VIAGRA9B + __KAM_VIAGRA9C + __KAM_VIAGRA9D) >= 2) | |
226 | describe KAM_VIAGRA9 Viagra Obfuscation Technique SPAM | |
227 | score KAM_VIAGRA9 5.1 | |
228 | ||
229 | #VIAGRA AD 10 - CONTENT-LESS EMAIL FROM "MALE ENHANCEMENT" | |
230 | header __KAM_VIAGRA10A From =~ /male enhancement|mens.renewal/i | |
231 | header __KAM_VIAGRA10B Subject =~ /your intimate partner will (thank|love)|grow.your.manhood|satisfy.your.woman/i | |
232 | ||
233 | meta KAM_VIAGRA10 (__KAM_VIAGRA10A + __KAM_VIAGRA10B >= 1) | |
234 | describe KAM_VIAGRA10 Male enhancement spam with no content | |
235 | score KAM_VIAGRA10 8.0 | |
236 | ||
237 | #NITROXIN - A NEW AND SPAMMY COMPETITOR TO VIAGRA | |
238 | header __KAM_NITROXIN1A From =~ /nitroxin/i | |
239 | ||
240 | meta KAM_NITROXIN1 (__KAM_NITROXIN1A >= 1) | |
241 | describe KAM_NITROXIN1 Another variant of Viagra spam | |
242 | score KAM_NITROXIN1 8.0 | |
243 | ||
244 | #RE[#] SPAM | |
245 | #NOTE: Thanks to Jason Haar" <Jason.Haar@trimble.co.nz> for pointing out that I was only doing >=1! | |
246 | header KAM_RE Subject =~ /^Re(?:\s)*\[\d\]+(?:\s)*:?$/i | |
247 | describe KAM_RE Subject of Re[0]: etc prevalent in Spam | |
248 | score KAM_RE 2.0 | |
249 | ||
250 | meta KAM_RE_PLUS (HTML_IMAGE_ONLY_08+KAM_RE >= 2) | |
251 | describe KAM_RE_PLUS Bad Subject and Image Only rule hit == SPAM! | |
252 | score KAM_RE_PLUS 4.0 | |
253 | ||
254 | #HOODIA | |
255 | #RE-WEIGHTING - Thanks to Martin Kaempf and Gareth Blades for pointing out the False Positives!! | |
256 | #Changed to escape + for 920\+ and changed to rawbody because we don't want to check the subject twice. | |
257 | #thansk to Michael Denney for the FP report | |
258 | header __KAM_HOODIA1 Subject =~ /(hoodia|920\+|serotonin|reduce your appetite)/i | |
259 | rawbody __KAM_HOODIA2 /(?:hoodia|920\+)/i | |
260 | body __KAM_HOODIA3 /(?:fat loss product|sur?p?press appetite|Reduce Your Appetite)/is | |
261 | ||
262 | meta KAM_HOODIA (__KAM_HOODIA1 + __KAM_HOODIA2 + __KAM_HOODIA3 >= 2) | |
263 | describe KAM_HOODIA Hoodia / Weight Loss Product Promotion Spam | |
264 | score KAM_HOODIA 3.0 | |
265 | ||
266 | #STOCK TIPS | |
267 | ||
268 | ##1 through 120 disabld 5-12-2014 due to age | |
269 | ##body __KAM_STOCKTIP1 /(?:Reynaldo's Mexican Food|RYNL)/is | |
270 | ##body __KAM_STOCKTIP2 /(?:KOKO PETROLEUM|KKPT)/is | |
271 | ##body __KAM_STOCKTIP3 /(?:DARK DYNAMITE|DKDY|D K D Y)/is | |
272 | ##body __KAM_STOCKTIP4 /(?:Remington Ventures|RMVN)/is | |
273 | ##body __KAM_STOCKTIP5 /(?:m-Wise|MWIS|M W I S)/is | |
274 | ##body __KAM_STOCKTIP6 /(?:China World Trade Corporation|CWTD)/is | |
275 | ##body __KAM_STOCKTIP7 /(?:Packets International|IPKL)/is | |
276 | ##body __KAM_STOCKTIP8 /(?:Infinex Ventures|IFNX)/is | |
277 | ##body __KAM_STOCKTIP9 /(?:FacePrint Global Solutions|FCPG)/is | |
278 | ###THANKS TO HOMER PARKER FOR THE FALSE POSSITIVE NOTE! | |
279 | ##body __KAM_STOCKTIP10 /(?:Ever[-_ ~]{0,3}Gl[o0]ry|(^|\b)E[-_~\. =]{0,3}G[-_~\. =]{0,3}L[-_~\. =]{0,3}Y($|\b))/is | |
280 | ##body __KAM_STOCKTIP11 /(?:Gulf Petroleum|GFPE)/is | |
281 | ##body __KAM_STOCKTIP12 /(?:Patriot Mechanical Handling|PMHH)/is | |
282 | ##body __KAM_STOCKTIP13 /(?:KSW Industries|KSWJ)/is | |
283 | ##body __KAM_STOCKTIP14 /(?:Conforce International|CFRI)/is | |
284 | ##body __KAM_STOCKTIP15 /(?:Nano Superlattice Technology|NSLT)/is | |
285 | ##body __KAM_STOCKTIP16 /(?:Morgan Beaumont|MBEU)/is | |
286 | ##body __KAM_STOCKTIP17 /(?:Relay Capital|(^|\b)RLYC($|\b))/is | |
287 | ###THANKS TO DAVID GOLDSMITH FOR POINTING OUT THE POTENTIAL FPs FROM THIS RULE | |
288 | ##body __KAM_STOCKTIP18 /(?:Madison Explorations|(?:^|\b)MDEX(?:$|\b))/is | |
289 | ##body __KAM_STOCKTIP19 /(?:CTR Investments and Consulting|C ?I ?V ?X)/is | |
290 | ##body __KAM_STOCKTIP20 /(?:PREMIER INFORMATION|(?:^|\b)PIFR(?:$|\b))/is | |
291 | ##body __KAM_STOCKTIP21 /(?:Harbin Pingchuan|P G C N|PGCN)/is | |
292 | ##body __KAM_STOCKTIP22 /(?:CLIENT TRACK CORP|CTKR)/is | |
293 | ##body __KAM_STOCKTIP23 /(?:EXTREME INNOVATIONS|(^|\b)EXTI($|\b))/is | |
294 | ##body __KAM_STOCKTIP24 /(?:Medical Home Products|\bMHPT\b)/is | |
295 | ##body __KAM_STOCKTIP25 /(?:AmeraMex International|AMMX)/is | |
296 | ##body __KAM_STOCKTIP26 /(?:Equipment & Systems Engineering|EQUIPMENT & SYS ENGR|EQSE)/is | |
297 | ##body __KAM_STOCKTIP27 /(?:NANOFORCE|NNFC)/i | |
298 | ##body __KAM_STOCKTIP28 /(?:\b|^)(?:Resort Clubs (I|\|)nternational|R[ ]*T[ ]*C[ ]*(?:I|\|))(?:\b|$)/is | |
299 | ##body __KAM_STOCKTIP29 /(?:Innovation Holdings|IVHN)/is | |
300 | ##body __KAM_STOCKTIP30 /(?:GOLDEN APPLE OIL|GAPJ)/is | |
301 | ##body __KAM_STOCKTIP31 /(?:inZon Corporation|(^|\b)I ?Z ?O ?N($|\b))/is | |
302 | ##body __KAM_STOCKTIP32 /(?:Midland Baring Financial Group|MDBF)/is | |
303 | ##body __KAM_STOCKTIP33 /(?:Aradyme Corporation|A D Y E)/is | |
304 | ##body __KAM_STOCKTIP34 /(?:TRANSAKT CORP|TKTJF)/is | |
305 | ##body __KAM_STOCKTIP35 /(?:CTXE|CANTEX ENERGY CORP)/is | |
306 | ##body __KAM_STOCKTIP36 /(?:De Greko|DGKO)/is | |
307 | ##body __KAM_STOCKTIP37 /(?:Deep Earth Resource, Inc|CTFE|DPER)/is | |
308 | ##body __KAM_STOCKTIP38 /(?:Vemics|(\b|^)VMCI(\b|$)|Summit Financial Resources)/is | |
309 | ##body __KAM_STOCKTIP39 /Premium Petroleum/is | |
310 | ##body __KAM_STOCKTIP40 /(?:F ?a ?l ?c ?o ?n ?E ?n ?e ?r ?g ?y|F.?C.?Y.?I)/s | |
311 | ##body __KAM_STOCKTIP41 /(?:CHINA GOLD CORP|CGDC)/is | |
312 | ##body __KAM_STOCKTIP42 /DPEK/i | |
313 | ###FIXED FP THANKS TO BEN LENTZ - Also found that the X ?X ?X ?X concept is causing too many FPs thanks to Homer Parker | |
314 | ##body __KAM_STOCKTIP43 /(?:Amerossi International Group|A M S N(\b|$)|AMSN)/is | |
315 | ##body __KAM_STOCKTIP44 /(?:WATAIRE INDUSTRIES|W ?T ?A ?F)/is | |
316 | ##body __KAM_STOCKTIP45 /(?:ABSOLUTESKY|A ?B ?S ?Y)/i | |
317 | ##body __KAM_STOCKTIP46 /(?:Infinex Ventures|I ?N ? ?F ?X)/is | |
318 | ##body __KAM_STOCKTIP47 /(?:Holly ?wood Intermediate|HYWI|H Y W I)/is | |
319 | ###DISABLED DUPLICATE OF 40 | |
320 | ###body __KAM_STOCKTIP48 /(?:Falcon Energy|F ?C ?Y ?I)/is | |
321 | ##body __KAM_STOCKTIP49 /(?:\b|^)(?:AGA Resources|A ?G ?A)(?:\b|$)/is | |
322 | ##body __KAM_STOCKTIP50 /(?:COSCO|CCPI)/i | |
323 | ##body __KAM_STOCKTIP51 /(?:PETRO([- ?])?SUN DRILLING|P[- ]?S[- ]?U[- ]?D)/is | |
324 | ##body __KAM_STOCKTIP52 /(?:KMA Global Solutions International|KMAG)/is | |
325 | ##body __KAM_STOCKTIP53 /(?:Advanced Powerline Technologies|APWL)/is | |
326 | ##body __KAM_STOCKTIP54 /(?:GOLDMARK INDUSTRIES|GDKI)/is | |
327 | ##body __KAM_STOCKTIP55 /(?:QUANTUM ENERGY|QEGY)/is | |
328 | ###FP FIXED THANKS TO Homer Parker | |
329 | ##body __KAM_STOCKTIP56 /(?:AAGA RESOURCE+S NEW|A G A O|(\b|^)AGAO(\b|$))/is | |
330 | ###FP FIXED THANKS TO Homer Parker | |
331 | ##body __KAM_STOCKTIP57 /(?:Bicoastal Communications|BCLC|B C L C)/is | |
332 | ##body __KAM_STOCKTIP58 /(?:Greater China Media \& Ent|G ?C ?M ?E)/is | |
333 | ##body __KAM_STOCKTIP59 /(?:Viva International|(\b|^)VIVI(\b|$))/s | |
334 | ##body __KAM_STOCKTIP60 /(?:WILON RESOURCES|(\b|^)WLON(\b|$))/is | |
335 | ##body __KAM_STOCKTIP61 /(?:Am+erica+n U+ni+ty I+nve+stments|(\b|^)A[ _]?U[ _]?N[ _]?I[ _]?(\b|$))/is | |
336 | ##body __KAM_STOCKTIP62 /(?:DEFENSE DIRECTIVE|(\b|^)DFSE(\b|$))/is | |
337 | ##body __KAM_STOCKTIP63 /(?:Cyberhand Technologies|(\b|^)CYHD(\b|$))/is | |
338 | ##body __KAM_STOCKTIP64 /(?:Texhoma Energy|(\b|^)TXHE(\b|$))/is | |
339 | ##body __KAM_STOCKTIP65 /(?:Equal Trading|(\b|^)EQTD(\b|$))/is | |
340 | ###DISABLED FOR FALSE POSITIVES AND AGE | |
341 | ###body __KAM_STOCKTIP66 /(?:\b|^)W.?B.?R.?S(?:\b|$)/is | |
342 | ##body __KAM_STOCKTIP67 /(?:Mobile Airwaves|(\b|^)M.?W.?B.?C.?(\b|$))/is | |
343 | ##body __KAM_STOCKTIP68 /(?:X-tra Petroleum|(\b|^)XTPT(\b|$))/is | |
344 | ###ADDED FP BOUNDARY CHECK THANKS TO Greg Troxel for reporting the issue | |
345 | ##body __KAM_STOCKTIP69 /(?:Red Reef Laboratories|(\b|^)RREF(\b|$))/is | |
346 | ##body __KAM_STOCKTIP70 /(?:Great American Food Chain|(\b|^)GAMN(\b|$))/is | |
347 | ##body __KAM_STOCKTIP71 /(?:Cana Petroleum|(\b|^)CNPM(\b|$))/is | |
348 | ##body __KAM_STOCKTIP72 /(?:China Health Management|(\b|^)CNHC(\b|$))/is | |
349 | ##body __KAM_STOCKTIP73 /(?:Makeup Limited|MAKU)/is | |
350 | ##body __KAM_STOCKTIP74 /(?:Premier Holdings Group|PMHD)/is | |
351 | ###FP FIXED THANKS TO Christopher X. Candreva | |
352 | ##body __KAM_STOCKTIP75 /(?:VSUS technologies|(\b|^)VSUS($|\b))/is | |
353 | ##body __KAM_STOCKTIP76 /(?:FLAIR PETROLEUM|FPMC)/is | |
354 | ##body __KAM_STOCKTIP77 /(?:Physician Adult Daycare|PHYA)/is | |
355 | ###FP FIXED THANKS TO Homer Parker | |
356 | ##body __KAM_STOCKTIP78 /(?:AlgoDyne Ethanol Energy|(\b|^)ADYN(\b|$))/is | |
357 | ##body __KAM_STOCKTIP79 /(?:Critical Care.{1,3}Inc|CTCX)/is | |
358 | ##body __KAM_STOCKTIP80 /(?:Aerofoam Metals|AFML)/is | |
359 | ##body __KAM_STOCKTIP81 /(?:Ten \& 10|(?:\b|^)TTEN)/is | |
360 | ##body __KAM_STOCKTIP82 /(?:Medical Institutional Services|MISJ(\b|$))/is | |
361 | ##body __KAM_STOCKTIP83 /(?:Harris Exploration|HXPN)/is | |
362 | ##body __KAM_STOCKTIP84 /(?:MARSHAL HOLDINGS|MHII)/is | |
363 | ##body __KAM_STOCKTIP85 /(?:ADVANCED GROWING SYSTEMS|AGWS)/is | |
364 | ##body __KAM_STOCKTIP86 /(?:WEST EXCELSIOR ENT|WEXE)/is | |
365 | ##body __KAM_STOCKTIP87 /(?:Hemisphere Gold|HPGI)/is | |
366 | ##body __KAM_STOCKTIP88 /(?:Victory Energy Corporation|VYEY)/is | |
367 | ##body __KAM_STOCKTIP89 /UTEV/i | |
368 | ##body __KAM_STOCKTIP90 /(?:CHINA BIOLIFE ENTERP|CBFE)/is | |
369 | ##body __KAM_STOCKTIP91 /(?:Critical Care|C ?T ?C ?X)/is | |
370 | ##body __KAM_STOCKTIP92 /CBRJ/i | |
371 | ##body __KAM_STOCKTIP93 /(?:LAS VEGAS CENTRAL RESERVATIONS|LVCC)/is | |
372 | ##body __KAM_STOCKTIP94 /GTAP/i | |
373 | ##body __KAM_STOCKTIP95 /(North American Energy Group|N-?N-?Y-?R)/is | |
374 | ###FP FIXED THANKS TO BRETT GARRETT | |
375 | ##body __KAM_STOCKTIP96 /(\b|^)C\.?C\.?T\.?I(\b|$)/i | |
376 | ##body __KAM_STOCKTIP97 /(C ?E ?O AMERICA|C ? E ? O ?A)/is | |
377 | ##body __KAM_STOCKTIP98 /PLMA/i | |
378 | ##body __KAM_STOCKTIP99 /CDYV/i | |
379 | ##body __KAM_STOCKTIP100 /(Fire (Mountain|Mtn) Beverage Company|(^|\b)F[ _]?B[ _]?V[ _]?G($|\b))/is | |
380 | ###Added boundary check thanks to Michael Denney | |
381 | ##body __KAM_STOCKTIP101 /(\b|^)WDSC(\b|$)/i | |
382 | ##body __KAM_STOCKTIP102 /(Distributed Power|DPWI)/is | |
383 | ##body __KAM_STOCKTIP103 /(HUMET-PBC|L9Z\.F)/is | |
384 | ##body __KAM_STOCKTIP104 /ASVP/is | |
385 | ##body __KAM_STOCKTIP105 /CHVC/is | |
386 | ##body __KAM_STOCKTIP106 /(China Datacom|CDPN)/is | |
387 | ##body __KAM_STOCKTIP107 /(ORAMED PHARMA|OJU\.F)/is | |
388 | ##body __KAM_STOCKTIP108 /(DSDI|DSI Direct Sales)/is | |
389 | ##body __KAM_STOCKTIP109 /(Monolith Athletic Club|M[-_ ]?N[-_ ]?A[-_ ]?B)/is | |
390 | ###DUPLICATED STOCKTIP #51 | |
391 | ###body __KAM_STOCKTIP110 /(PETRO-SUN|P[- ]?S[- ]?U[- ]?D)/is | |
392 | ##body __KAM_STOCKTIP111 /(COMPLIANCE SYSTEMS|(\b|^)COPI(\b|$))/is | |
393 | ###FP Fixed thanks to Greg Troxel | |
394 | ##body __KAM_STOCKTIP112 /(Global Pay Solutions|(\b|^)GPSI(\b|$))/is | |
395 | ##body __KAM_STOCKTIP113 /(MEGOLA|MGOA)/i | |
396 | ###FP FIXED THANKS TO Antonio Falzarano | |
397 | ##body __KAM_STOCKTIP114 /(\b|^)ADOV(\b|$)/i | |
398 | ##body __KAM_STOCKTIP115 /(Oncology Med|(\b|^)ONCO(\b|$))/is | |
399 | ##body __KAM_STOCKTIP116 /(Strategy X|SGXI)/is | |
400 | ##body __KAM_STOCKTIP117 /(Spotlight Homes|COST CONTAINMENT TEC|SPHM)/is | |
401 | ###FALSE POSITIVE ON DANSREALESTATE. | |
402 | ##body __KAM_STOCKTIP118 /((\b|^)SREA(\b|$)|Score One)/is | |
403 | ##body __KAM_STOCKTIP119 /(Monster Motors|MRMT)/is | |
404 | ##body __KAM_STOCKTIP120 /(EntreMetrix|ERMX)/i | |
405 | ||
406 | body __KAM_STOCKTIP121 /(VISION AIRSHIPS|(\b|^)VPSN(\b|$))/is | |
407 | body __KAM_STOCKTIP122 /(Shandong Zhouyuan Seed and Nursery|(\b|^)SZSN(\b|$))/is | |
408 | body __KAM_STOCKTIP123 /(Puerto Rico 7|(\b|^)P ?R ?T ?H(\b|$))/is | |
409 | body __KAM_STOCKTIP124 /(VGPM|Vega Promotional Sys)/is | |
410 | body __KAM_STOCKTIP125 /((\b|^)D[- ]?M[- ]?X[- ]?C(\b|$))/i | |
411 | body __KAM_STOCKTIP126 /((\b|^)C\.?W\.?T\.?E(\b|$)|C'Watre International)/is | |
412 | body __KAM_STOCKTIP127 /(Physical Property Holdings|(\b|^)PPYH(\b|$))/is | |
413 | #FP ON MNUM IN PLAIN TEXT HTML CONVERSION - Thanks to Kevin Lewis | |
414 | body __KAM_STOCKTIP128 /(MONUMENTAL MARKETING|(\b|^)MNUM(\b|$))/is | |
415 | body __KAM_STOCKTIP129 /(EnerBrite Technologies Group|(\b|^)eTgU(\b|$))/is | |
416 | body __KAM_STOCKTIP130 /(Pricester|(\b|^)PRCC(\b|$))/is | |
417 | #Added boundary check thanks to Michael Denney | |
418 | body __KAM_STOCKTIP131 /(Greenstone Holdings|(\b|^)GSHN(\b|$))/is | |
419 | body __KAM_STOCKTIP132 /((\b|^)AGMS(\b|$)|Angstrom[- ]Microsystems)/is | |
420 | body __KAM_STOCKTIP133 /(Pluris Energy|(\b|^)PEYG(\b|$))/is | |
421 | body __KAM_STOCKTIP134 /(United Consortium|(\b|^)UCSO(\b|$))/is | |
422 | body __KAM_STOCKTIP135 /(Dominion Minerals|(\b|^)DMNM(\b|$))/is | |
423 | body __KAM_STOCKTIP136 /(PrimeGen Energy|(\b|$)PGNE(\b|^))/is | |
424 | body __KAM_STOCKTIP137 /Dynamic Response Group|(\b|^)DRGZ(\b|$)/is | |
425 | body __KAM_STOCKTIP138 /Cobra Oil (and|&) Gas|(\b|^)CGCA(\b|$)/is | |
426 | body __KAM_STOCKTIP139 /Solanex Management|(\b|^)SLNX(\b|$)/is | |
427 | body __KAM_STOCKTIP140 /BIO-SOLUTIONS|(\b|^)BISU(\b|$)/is | |
428 | #FP IN French email on 3/2/2017 | |
429 | #body __KAM_STOCKTIP141 /(\b|^)FORC(\b|$)/is | |
430 | body __KAM_STOCKTIP142 /Hawk Systems Inc|(\b|^)HWSYD(\b|$)/is | |
431 | body __KAM_STOCKTIP143 /AmeriLithium/is #|(\b|^)AMEL(\b|$)/is # FP 9/10/15 | |
432 | body __KAM_STOCKTIP144 /Fleet Management Solutions|(\b|^)FLMG(\b|$)/is | |
433 | body __KAM_STOCKTIP145 /Nuvilex|(\b|^)N.?V.?L.?X.?(\b|$)/is | |
434 | body __KAM_STOCKTIP146 /Plandai|(\b|^)PLPL(\b|$)/is | |
435 | body __KAM_STOCKTIP147 /Beamz Interactive|(\b|^)B.?Z.?I.?C(\b|$)/is | |
436 | body __KAM_STOCKTIP148 /(\b|^)STBV(\b|$)/i | |
437 | body __KAM_STOCKTIP149 /LifeApps|(\b|^)LFAP(\b|$)/i | |
438 | body __KAM_STOCKTIP150 /MONARCHY RESOURCES/i | |
439 | body __KAM_STOCKTIP151 /Alanco Tech/i | |
440 | body __KAM_STOCKTIP152 /Siga Resources/i | |
441 | body __KAM_STOCKTIP153 /INSCOR|(\b|^)IOGA(\b|$)/is | |
442 | body __KAM_STOCKTIP154 /mLight Tech|(\b|^)MLGT(\b|$)/is | |
443 | body __KAM_STOCKTIP155 /Alanco Technologies/is | |
444 | body __KAM_STOCKTIP156 /Progress Watch|(\b|^)PROW(\b|$)/is | |
445 | body __KAM_STOCKTIP157 /(\b|^)PRFC(\b|$)/is | |
446 | body __KAM_STOCKTIP158 /(\b|^)(RCHA|R\.+C\.+H\.+A|R\/C\/H\/A)(\b|$)/is | |
447 | body __KAM_STOCKTIP159 /(\b|^)(RNBI|R.N.B.I)(\b|$)/is | |
448 | body __KAM_STOCKTIP160 /(\b|^)(CNRMF|C.N.R.M.F)(\b|$)/is | |
449 | body __KAM_STOCKTIP161 /(\b|^)(NUAN|N[- ]U[- ]A[- ]N)(\b|$)|NUANCE COMMUNICATIONS/is | |
450 | body __KAM_STOCKTIP162 /(\b|^)(CHICF|C.H.I.C.F)(\b|$)/is | |
451 | body __KAM_STOCKTIP163 /(\b|^)(brixmor)(\b|$)/is | |
452 | body __KAM_STOCKTIP164 /(\b|^)(KBLB|K.B.L.B)(\b|$)/is | |
453 | body __KAM_STOCKTIP165 /(\b|^)(SCRF|S.C.R.F)(\b|$)/is | |
454 | body __KAM_STOCKTIP166 /(\b|^)(INCT|Incapta)(\b|$)/is | |
455 | body __KAM_STOCKTIP167 /(\b|^)(QSMS|Quest Management|Quest Science Management Gate)(\b|$)/is | |
456 | body __KAM_STOCKTIP168 /(\b|^)(QSMG|Q.S.M.G|Stemvax)(\b|$)/is | |
457 | body __KAM_STOCKTIP169 /(\b|^)E.?C.?G.?R(\b|$)/is | |
458 | ||
459 | ||
460 | body __KAM_STOCKOTC /(OTC|OTC ?BB|OTC Pink Sheets|NASDAQ|NYSE|StockWatch):/is | |
461 |