projects / proxmox-spamassassin.git / blame
| Commit | Line | Data |
|---|---|---|
| 6927b9b6 SI |
1 | #KAM.cf aka the KAM ruleset - Apache SpamAssassin Rules |
| 2 | ||
| 3 | #Authors: Kevin A. McGrail with key contributions from Joe Quinn, Karsten Bräckelmann, | |
| 4 | # Bill Cole & Giovanni Bechis | |
| 5 | ||
| 6 | #Email: Kevin.McGrail@McGrail.com | |
| 7 | ||
| 8 | #Questions: Questions about the KAM Ruleset are best submitted at: | |
| 9 | # https://raptor.pccc.com/raptor.cgim?template=report_problem | |
| 10 | ||
| 11 | #HomePage: https://mcgrail.com/template/projects#KAM1 | |
| 12 | ||
| 13 | ||
| 14 | #Installation: There are multiple files that make up the KAM ruleset including | |
| 15 | #heavyweight, deadweight, & nonKAMrules. The KAM ruleset is now a channel! | |
| 16 | # | |
| 17 | #Please see https://mcgrail.com/template/kam.cf_channel for more information | |
| 18 | ||
| 19 | ||
| 20 | #The ruleset includes internal rules so not every rule will be useful but | |
| 21 | #we encapsulate those in a RaptorOnly defined loop. | |
| 22 | ||
| 23 | #KAM.cf is maintained by The McGrail Foundation, a 501(c)(3) charity. Donations | |
| 24 | #are appreciated. See www.mcgrail.com for more information on donations and | |
| 25 | #sponsorships. | |
| 26 | ||
| 27 | #THANK YOU TO OUR SPONSORS (in Alphabetical Order): | |
| 28 | #cPanel, INKY, Invaluement, iSpark, Linode, PCCC, ShipShapeIT and Zix/Appriver | |
| 29 | ||
| 30 | ||
| 31 | #This is a collection of special rules that KAM developed and uses for | |
| 32 | #https://raptoremailsecurity.com/. | |
| 33 | # | |
| 34 | #The exact date is lost to the sands of time but we have been publishing this | |
| 35 | #ruleset since at least May 2004 at no charge for the benefit of all. | |
| 36 | # | |
| 37 | #They were intended as live research for committal to SpamAssassin's SVN sandbox but | |
| 38 | #often rely on our corpora so they do not fair well in masschecks. | |
| 39 | ||
| 40 | ||
| 41 | #Problems and suggestions are best sent by this form to avoid being caught by our | |
| 42 | #filters: #https://raptor.pccc.com/raptor.cgim?template=report_problem | |
| 43 | #We do respond to most problem reports *especially* if you send an email sample. | |
| 44 | #Samples in mbox format are preferred. | |
| 45 | ||
| 46 | ||
| 47 | #The KAM Ruleset is production ready and in use on production systems protecting | |
| 48 | #many millions of mailboxes every day. | |
| 49 | # | |
| 50 | #IMPORTANT: This ruleset cf file is designed for systems at a threshold of 5.0+. | |
| 51 | ||
| 52 | ||
| 53 | #NOTE: We do use some poison pill (i.e. Automatic HAM/SPAM rules). | |
| 54 | # | |
| 55 | # - Because we use meta rules, false positives are minimized and a larger score | |
| 56 | # is acceptable. | |
| 57 | # | |
| 58 | # - In developing these rules and the associated RBL, we use a consent litmus | |
| 59 | # test. We do not block solely based on content except for the sexually | |
| 60 | # explicit rules. You can, of course, locally disable these rules. | |
| 61 | ||
| 62 | ||
| 63 | #Copyright (c) 2022 Kevin A. McGrail and The McGrail Foundation | |
| 64 | # | |
| 65 | # Licensed under the Apache License, Version 2.0 (the "License"); | |
| 66 | # you may not use this file except in compliance with the License. | |
| 67 | # You may obtain a copy of the License at | |
| 68 | # | |
| 69 | # http://www.apache.org/licenses/LICENSE-2.0 | |
| 70 | # | |
| 71 | # Unless required by applicable law or agreed to in writing, software | |
| 72 | # distributed under the License is distributed on an "AS IS" BASIS, | |
| 73 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| 74 | # See the License for the specific language governing permissions and | |
| 75 | # limitations under the License. | |
| 76 | ||
| 77 | # Thanks to Wolfgang Breyha for his help fixing a few rules | |
| 78 | ||
| 79 | # COURTESY OF Marcin Miros | |
| 80 | body __KAM_MM_FOREX_1 /program.{0,10}ktory\ssam\sgra\sna\sgieldzie|program\sdo\sgry\sna\sgieldzie|Potega\stego\sprogramu\stkwi|program.{0,10}handluje.{0,10}zarabia.{0,10}gieldzie.{0,10}udzialu.{0,10}czlowieka|zarabiaj.{0,10}program.{0,10}nie.{0,10}jest.{0,10}zabroniony|Program.{0,10}zrobi.{0,10}wszystko.{0,10}sam|handluj.{0,10}na.{0,10}gieldzie.{0,10}programowi|100.{0,10}%.{0,10}pewnych.{0,10}transakcji|program.{0,10}100.{0,10}%.{0,10}zysk|handel.{0,10}bedzie.{0,10}zabroniony|program.{0,10}odmieni.{0,10}twoje.{0,10}zycie|system.{0,10}finansow.{0,10}przed.{0,10}upadkiem|grupa.{0,10}niemieckich.{0,10}matematykow.{0,10}inteligentny.{0,10}program|zostan\sobrzydliwie\sbogaty|technologia.{0,10}100%.{0,10}pewne.{0,10}decyzje|zarabianie.{0,10}w.{0,10}sieci|swoja.{0,10}szanse.{0,10}zarabianie|internet.{0,10}doprowadzil.{0,10}pieniedzy|zarabia.{0,10}(w|przez).{0,10}internet|karaluch.{0,10}dom.{0,10}brzeg.{0,10}morza|odmieni.{0,10}zycie|pieniadz|pieniedz|zarabia|zarobi/i | |
| 81 | ||
| 82 | rawbody __KAM_MM_FOREX_2 /(\[|\<).{1,10}http:\/\/.{1,50}php\?.{1,30}\=.{1,30}(\]|\>).{0,20}(klik|odwiedz|dowiedz|przegap|odnosnik|zarobi|spiesz|majatek|wiecej\sinformacji\sna\sten\stemat\sznajdziesz\s-\stutaj|tutaj\sznajdziesz.{0,10}szczegolowe.{0,10}informacje|odwiedz|zarabia|wchodz)/i | |
| 83 | ||
| 84 | meta KAM_MM_FOREX __KAM_MM_FOREX_1 && __KAM_MM_FOREX_2 | |
| 85 | score KAM_MM_FOREX 2.5 | |
| 86 | describe KAM_MM_FOREX Polish-language spam from the Forex botnet | |
| 87 | ||
| 88 | #PHISHING TEST | |
| 89 | rawbody KAM_PHISH1 /u style="cursor: pointer"/ | |
| 90 | describe KAM_PHISH1 Test for PHISH that changes the cursor | |
| 91 | score KAM_PHISH1 0.01 | |
| 92 | ||
| 93 | header __KAM_PHISH4_1 From =~ /host|apple|amazon|microsoft|windows|express|app.serv|goodluck|bank|support/i | |
| 94 | body __KAM_PHISH4_2 /dear.{0,50}customer|automated.message|spam.activities|attempted.gaining.access|your.account.expires|authorized.government|important.message|message.alert|suspended/i | |
| 95 | body __KAM_PHISH4_3 /(confirm|verify|update).your.(identity|account)|account.password|credit.(bureau|profile)|identity.theft|accredited.commission|security.concern|kindly.find.enclosed|owner of this account/i | |
| 96 | ||
| 97 | ifplugin Mail::SpamAssassin::Plugin::MIMEHeader | |
| 98 | mimeheader __KAM_PHISH4_4 Content-Type =~ /(verification|information|form)\.htm/i | |
| 99 | endif | |
| 100 | ||
| 101 | meta KAM_PHISH4 (__KAM_PHISH4_1 + __KAM_PHISH4_2 + __KAM_PHISH4_3 + __KAM_PHISH4_4 >= 3) | |
| 102 | score KAM_PHISH4 3.5 | |
| 103 | describe KAM_PHISH4 Another phishing attempt | |
| 104 | ||
| 105 | #KAM REALESTATE / RE-FINANCE SCAM EMAILS - Thanks to David Goldsmith for pointing out my error in the meta rule! | |
| 106 | body __KAM_REAL1 /(^|\b)RE market/is | |
| 107 | body __KAM_REAL2 /(crashing|declining)/i | |
| 108 | body __KAM_REAL3 /(vacation|second) (home|place)/is | |
| 109 | meta KAM_REAL (__KAM_REAL1 + __KAM_REAL2 + __KAM_REAL3 >= 3) | |
| 110 | describe KAM_REAL Real Estate or Re-Finance Spam | |
| 111 | score KAM_REAL 0.5 | |
| 112 | ||
| 113 | #REFINANCE SCAM EMAILS | |
| 114 | header __KAM_REFI1 Subject =~ /(refinance|rates) at \d\.\d*%|(?:I would like to offer you my help|Lower your house payment|follow up email|evaluation enclosed|submit a bid|fixed rates|ARM program|New Program|regardless of credit|loan request|accepting your application|refinance appl?ication|ready to (give a (business )?loan|lend)|good credit or not|refinance without perfect credit|financial independence|Loan Offer|Get a Loan|your urgent loan|credit report|time to refinance|refi.(rates|requirements|plus|program|plan|advice)|rates at historical low|EQUIFAX|TRANSUNION|Experian|rates can be cut|save your home)|Reverse.?Mortgage|obama (extends|waives)|VA loan|harp program|re.?fi.advice|homeowners.owe|harp.extension|\d+\.\d+%.fixed|\d+\.\d+.pct|this.rate|refi(nance)?.rate|lower.refi|refinance.your.mortgage|refinance.now|obama.?s?.refi|monthly.payment|house.payment|monthly.savings|modified.payment|new.payment|overpaying|calculate.your|your.saving|housing.plan|obama.?s.hous|l.f..insuranc.|offer.for.your.home|second.mortgage/i | |
| 115 | body __KAM_REFI2 /(Free Evaluation (?:online|on your (?:current )?home loan)|No hidden costs|no strings attached|good credit or not|personalized consultation|in need of loan|consolidation loan|loan processing|apply by sending|loan of any amount|clean up any inacccuracies|lock in saving|save on monthly mortgage|absolutely no cost|underwater)|Reverse.?Mortgage|qualify for a VA loan|Refi now.? and Save|obama..?announces|rate.calculator|save.thousands|update: \d.\d\d..available|homeowner|over.your.head|rate.service|now.eligi?[bl]{2}e|a.second.mortgage|urgent.loan|loan.offer/is | |
| 116 | body __KAM_REFI3 /(restructure (?:proposal|program|opportunity|your loan)|switch from an adjustable rate to a fixed|new lending program|(low|reasonable) interest (loan|rate)|lowest monthly payment|\d% interest|unsecured personal|better credit terms|lower your mortgage|low-interest refinance|see your credit score|credit score.{1,15}updated|refi with HARP)|obama announce(s|d) (the )?harp program|obama'?s.refi|a.fortune.off|lower.home.rate|your.home|home.loan|gov.program|official.harp|currently.overpaying/is | |
| 117 | body __KAM_REFI4 /(\$\d{1,3},\d{1,3}|\d{2,3}k of funds|\d{4,6} USD|\d{4,6}\$ per month|\d{3,5}\/mo)|refinance at \d\.\d%|\$\d{3,}(\.\d\d)?.(a|per).year|extend.harp|spending.too.much|new.payment|better.rate/i | |
| 118 | body __KAM_REFI5 /([\d,]{5,6}|\d{2}\s*%) savings|principal \d+% less|\d+\.\d+%.fixed|refi.calculator|lowered.requirements|home.?owner/is | |
| 119 | body __KAM_REFI6 /((?:reduce your monthly payment|save you) (between )?\d{2}\s*%|save yourself hundreds of dollars|great rate available|completely unsecured|instantly connect with\s+lenders|get you back on the right financial|get report today|protect against identity|know your credit score|crazy payments)|u.?s.? homeowners|drop.your.rate|in.your.pocket|our.records|apply.for.your/is | |
| 120 | body __KAM_REFI7 /(?:loan product|equity cash|house.payment|home.payment|no up front fees|seasoned equity|pay off high rate cards|ARM Program|credit is less than perfect|credit (score )?will not disqualify|plastic money|charge card balances|we offer out loans|floating loan scheme|unsecured guaranteed|President.?s new program|Home Affordable Refinance Program)|save $?[\d\.]+ per (year|month)|low.rate|harp.?2|rates.like.th(is|ese)/is | |
| 121 | header __KAM_REFI8 From =~ /great loan|mortgage|financ|Delta|Rate\.?market|credit score|free.?score|harp|mtge|foreclosure|VA loan|lower.my.(bills|debt|mortgage|rate)|refi.(alert|advantage|quote|calc|rate)|obama|lendingtree|(house|home).?payment|home.?payment|lower.rate|\d+\.\d+%|saving|d.r.ct.l.f.|helpline/i | |
| 122 | ||
| 123 | meta KAM_REFI (__KAM_REFI1 + __KAM_REFI2 + __KAM_REFI3 + __KAM_REFI4 + (__KAM_REFI5 + __KAM_REFI6 >= 1) + __KAM_REFI7 + __KAM_REFI8 + (KAM_SHORT || AC_HTML_NONSENSE_TAGS || KAM_EU) >= 4) | |
| 124 | describe KAM_REFI Real Estate / Re-Finance Spam | |
| 125 | score KAM_REFI 3.0 | |
| 126 | ||
| 127 | meta KAM_REFI2 (__KAM_REFI1 + __KAM_REFI2 + __KAM_REFI3 + __KAM_REFI4 + (__KAM_REFI5 + __KAM_REFI6 >= 1) + __KAM_REFI7 + __KAM_REFI8 + (KAM_SHORT || AC_HTML_NONSENSE_TAGS || KAM_EU) >= 6) | |
| 128 | describe KAM_REFI2 Real Estate / Re-Finance Spam | |
| 129 | score KAM_REFI2 2.75 | |
| 130 | ||
| 131 | #KAM ERADICATE DEBTS | |
| 132 | body __KAM_DEBT1 /(debts disappear|reduce your payments|piling bills|creditors|late bills|vanish some of your bills|reduce your payments|looming bills|all that debt|outstanding debt|debt.{0,7}accumulated|all my debt|penalties,? and fees are gone|banking laws|select legal|change your life|get out of .?d.?e.?b.?t|Free[- ]Credit Report|debt relief options|are you in debt|pay off all your debt|get better rates|credit card debt|could.be.easy)/is | |
| 133 | header __KAM_DEBT2 Subject =~ /(all that you owe|all you owe|everything you owe|eradicate|indebted|sick of bills|debt.{0,7}accumulated|tired of (the )?debt|looming debt|creditors|bank[ ]?rupt|debt ?free|out ?of ?debt|take control of your monthly payments|bills disappear|We can help|consultation regarding bills|get better rates|credit score|FICO Score|eliminate\s{1,2}debt|Erase the debt|loan offer|consolidating.debt)/i | |
| 134 | body __KAM_DEBT3 /(bills keeping you|brink of bankruptcy|take all the (stress|pain) away|all the bills|tired of high credit card|make your bills disappear|improve your credit score|b.?a.?n.?k.?r.?u.?p.?t.?c?.?y|monitor your[- ]credit|Wipes out debt|being debt free|interest rates are reasonable|view your credit score|manage.your.finance)/is | |
| 135 | ||
| 136 | meta KAM_DEBT ((__KAM_DEBT1 + __KAM_DEBT2 + __KAM_DEBT3) >= 3) | |
| 137 | describe KAM_DEBT Debt eradication spams | |
| 138 | score KAM_DEBT 2.5 | |
| 139 | ||
| 140 | meta KAM_DEBT2 ((__KAM_DEBT1 + __KAM_DEBT2 + __KAM_DEBT3 + __KAM_ADVERT2) >= 2) | |
| 141 | describe KAM_DEBT2 Likely Debt eradication spams | |
| 142 | score KAM_DEBT2 1.0 | |
| 143 | ||
| 144 | #XtraSize+ Penis Enlargement Scam | |
| 145 | header __KAM_SILD1 Subject =~ /Sildenafil Citrate/i | |
| 146 | body __KAM_SILD2 /(XtraSize\+|Sildenafil Citrate)/i | |
| 147 | ||
| 148 | meta KAM_SILD (__KAM_SILD1 + __KAM_SILD2 >= 1) | |
| 149 | ||
| 150 | describe KAM_SILD Simple rule to block one more enhancement message | |
| 151 | score KAM_SILD 5.0 | |
| 152 | ||
| 153 | #if (version < 3.002000) | |
| 154 | # #HTML_SHORT_LENGTH DEPENDENCY RULE REMOVED FROM SA 3.2.X | |
| 155 | # #KAM NUMBER EMAILS - Thanks to Mark Damrose for the NUMBER3 idea & Jan-Pieter Cornet | |
| 156 | # header __KAM_NUMBER1 Subject =~ /^\d+$/ | |
| 157 | # body __KAM_NUMBER2 /\d{1,6}/ | |
| 158 | # header __KAM_NUMBER3 Message-ID =~ /\<[a-z]{19}\@/i | |
| 159 | # | |
| 160 | # meta KAM_NUMBER ((__KAM_NUMBER1 + __KAM_NUMBER2 + MIME_HTML_ONLY + HTML_SHORT_LENGTH + __KAM_NUMBER3) >= 5) | |
| 161 | # describe KAM_NUMBER Silly Number Emails | |
| 162 | # score KAM_NUMBER 1.0 | |
| 163 | #endif | |
| 164 | ||
| 165 | #KAM MEDICATION KAM_OVERPAY | |
| 166 | body KAM_OVERPAY /O . V . E . R . P . A . Y/i | |
| 167 | describe KAM_OVERPAY Common Medicinal Ad Trick | |
| 168 | score KAM_OVERPAY 3.5 | |
| 169 | ||
| 170 | #VIAGRA AD - CHANGED DUE TO FPS on 2010-05-06 - Replaced [VACLXPSI] with separate rules space separated | |
| 171 | replace_rules __KAM_VIAGRA2 | |
| 172 | ||
| 173 | body __KAM_VIAGRA1 /V I A G R A|C I A L I S|V A L I U M|X A N A X/i | |
| 174 | header __KAM_VIAGRA2 Subject =~ /<V1><I1><A1><G1><R1><A1>/i | |
| 175 | ||
| 176 | meta KAM_VIAGRA1 (__KAM_VIAGRA1 + __KAM_VIAGRA2 >= 1) | |
| 177 | describe KAM_VIAGRA1 Common Viagra and Medicinal Table Trick | |
| 178 | score KAM_VIAGRA1 3.0 | |
| 179 | ||
| 180 | #VIAGRA AD 2 | |
| 181 | body KAM_VIAGRA2 /(?:Xan|Som|CIA|VAL|VIA|Pro|Amb|Lev|Mer) (?:Xan|Som|CIA|VAL|VIA|Pro|Amb|Lev|Mer) (?:Xan|Som|CIA|VAL|VIA|Pro|Amb|Lev|Mer)/i | |
| 182 | describe KAM_VIAGRA2 Common Viagra and Medicinal Table Trick | |
| 183 | score KAM_VIAGRA2 3.1 | |
| 184 | ||
| 185 | #VIAGRA AD 3 - REMOVED FOR LOW S/O - Thanks to Shane Williams for reporting the FP | |
| 186 | #body KAM_VIAGRA3 /(?:Xan|Som|CIA|VAL|VIA|Pro|Amb|Lev|Mer)( \w )(?:ax|lis|ra|ium)/i | |
| 187 | #describe KAM_VIAGRA3 Common Viagra and Medicinal Table Trick | |
| 188 | #score KAM_VIAGRA3 3.1 | |
| 189 | ||
| 190 | #VIAGRA AD 4 | |
| 191 | body __KAM_VIAGRA4A /V (. )?A (. )?L (. )?[I\/t] (. )?U (. )?M/i | |
| 192 | body __KAM_VIAGRA4B /V (. )?[I\/t] (. )?A (. )?G (. )?R (. )?A/i | |
| 193 | body __KAM_VIAGRA4C /M (. )?E (. )?R (. )?[I\/t] (. )?D (. )?[I\/] (. )?A/i | |
| 194 | ||
| 195 | # FP FOR "Les Iles du Monde Via Gramsci" OR ITALIAN "WE WISH YOU" | |
| 196 | # FP for Via Great thanks to Shane Williams | |
| 197 | body __KAM_VIAGRA_FPS /via gre?a|i augur/i | |
| 198 | ||
| 199 | meta KAM_VIAGRA4 ((__KAM_VIAGRA4A + __KAM_VIAGRA4B + __KAM_VIAGRA4C) >= 2) | |
| 200 | describe KAM_VIAGRA4 Common Viagra and Medicinal Table Trick | |
| 201 | score KAM_VIAGRA4 3.1 | |
| 202 | ||
| 203 | #VIAGRA AD 5 | |
| 204 | body KAM_VIAGRA5 /(V [1li|\]] [a&] G R A|VljAG+R+A)/i | |
| 205 | describe KAM_VIAGRA5 Viagra Obfuscation Technique SPAM | |
| 206 | score KAM_VIAGRA5 3.1 | |
| 207 | ||
| 208 | #VIAGRA AD 6 | |
| 209 | #Switch to [-_\. ]? to avoid FP's reported by Robin Tan | |
| 210 | #Also added a few more boundary checks thanks to Daniele Duca | |
| 211 | body __KAM_VIAGRA6A /V[-_\. ]?[IL1][-_\. ]?A.?G.?R.?A/i | |
| 212 | body __KAM_VIAGRA6B /(\b|^)A.?M.?B.?[il1].?E.?N($|\b)/i | |
| 213 | body __KAM_VIAGRA6C /V.?A.?L.?[il1].?U.?M/i | |
| 214 | body __KAM_VIAGRA6D /(\b|^)C.?[il1].?A.?L.?[Il1].?S($|\b)/i | |
| 215 | header __KAM_VIAGRA6E From =~ /(Viagra|Cialis)(\b|$)/i | |
| 216 | ||
| 217 | meta KAM_VIAGRA6 (__KAM_VIAGRA6A + __KAM_VIAGRA6B + __KAM_VIAGRA6C + __KAM_VIAGRA6D + __KAM_VIAGRA6E >= 2) | |
| 218 | describe KAM_VIAGRA6 Viagra Obfuscation Technique SPAM | |
| 219 | score KAM_VIAGRA6 3.1 | |
| 220 | ||
| 221 | #VIAGRA AD 7 - TWEAKING RULE 7B TO PREVENT HITS ON SPECIALIST | |
| 222 | body __KAM_VIAGRA7A /V[ij]+AGRA/i | |
| 223 | body __KAM_VIAGRA7B /(^|\b)C[ij]+AL[ij]+S($|\b)/i | |
| 224 | body __KAM_VIAGRA7C /(^|\b)AMB[ij]+EN($|\b)/i | |
| 225 | body __KAM_VIAGRA7D /VAL[ij]+UM/i | |
| 226 | ||
| 227 | meta KAM_VIAGRA7 ((__KAM_VIAGRA7A + __KAM_VIAGRA7B + __KAM_VIAGRA7C + __KAM_VIAGRA7D >= 2) && (KAM_VIAGRA6 < 1)) | |
| 228 | describe KAM_VIAGRA7 Viagra Obfuscation Technique SPAM | |
| 229 | score KAM_VIAGRA7 3.1 | |
| 230 | ||
| 231 | #VIAGRA AD 8 | |
| 232 | body __KAM_VIAGRA8A /VI...?AGRA/i | |
| 233 | body __KAM_VIAGRA8B /AM...?BIEN/i | |
| 234 | body __KAM_VIAGRA8C /VA...?LIUM/i | |
| 235 | body __KAM_VIAGRA8D /CI...?ALIS/i | |
| 236 | ||
| 237 | meta KAM_VIAGRA8 ((__KAM_VIAGRA8A + __KAM_VIAGRA8B + __KAM_VIAGRA8C + __KAM_VIAGRA8D) >= 2) | |
| 238 | describe KAM_VIAGRA8 Viagra Obfuscation Technique SPAM | |
| 239 | score KAM_VIAGRA8 5.1 | |
| 240 | ||
| 241 | #VIAGRA AD 9 | |
| 242 | body __KAM_VIAGRA9A /V[IL1]A..GRA/i | |
| 243 | body __KAM_VIAGRA9B /AMB..IEN/i | |
| 244 | body __KAM_VIAGRA9C /VAL..IUM/i | |
| 245 | body __KAM_VIAGRA9D /C[IL1]A..LIS/i | |
| 246 | ||
| 247 | meta KAM_VIAGRA9 ((__KAM_VIAGRA9A + __KAM_VIAGRA9B + __KAM_VIAGRA9C + __KAM_VIAGRA9D) >= 2) | |
| 248 | describe KAM_VIAGRA9 Viagra Obfuscation Technique SPAM | |
| 249 | score KAM_VIAGRA9 5.1 | |
| 250 | ||
| 251 | #VIAGRA AD 10 - CONTENT-LESS EMAIL FROM "MALE ENHANCEMENT" | |
| 252 | header __KAM_VIAGRA10A From =~ /male enhancement|mens.renewal/i | |
| 253 | header __KAM_VIAGRA10B Subject =~ /your intimate partner will (thank|love)|grow.your.manhood|satisfy.your.woman/i | |
| 254 | ||
| 255 | meta KAM_VIAGRA10 (__KAM_VIAGRA10A + __KAM_VIAGRA10B >= 1) | |
| 256 | describe KAM_VIAGRA10 Male enhancement spam with no content | |
| 257 | score KAM_VIAGRA10 8.0 | |
| 258 | ||
| 259 | #NITROXIN - A NEW AND SPAMMY COMPETITOR TO VIAGRA | |
| 260 | header __KAM_NITROXIN1A From =~ /nitroxin/i | |
| 261 | ||
| 262 | meta KAM_NITROXIN1 (__KAM_NITROXIN1A >= 1) | |
| 263 | describe KAM_NITROXIN1 Another variant of Viagra spam | |
| 264 | score KAM_NITROXIN1 8.0 | |
| 265 | ||
| 266 | #RE[#] SPAM | |
| 267 | #NOTE: Thanks to Jason Haar" <Jason.Haar@trimble.co.nz> for pointing out that I was only doing >=1! | |
| 268 | header KAM_RE Subject =~ /^Re(?:\s)*\[\d\]+(?:\s)*:?$/i | |
| 269 | describe KAM_RE Subject of Re[0]: etc prevalent in Spam | |
| 270 | score KAM_RE 2.0 | |
| 271 | ||
| 272 | meta KAM_RE_PLUS (HTML_IMAGE_ONLY_08+KAM_RE >= 2) | |
| 273 | describe KAM_RE_PLUS Bad Subject and Image Only rule hit == SPAM! | |
| 274 | score KAM_RE_PLUS 4.0 | |
| 275 | ||
| 276 | #HOODIA | |
| 277 | #RE-WEIGHTING - Thanks to Martin Kaempf and Gareth Blades for pointing out the False Positives!! | |
| 278 | #Changed to escape + for 920\+ and changed to rawbody because we don't want to check the subject twice. | |
| 279 | #thansk to Michael Denney for the FP report | |
| 280 | header __KAM_HOODIA1 Subject =~ /(hoodia|920\+|serotonin|reduce your appetite)/i | |
| 281 | rawbody __KAM_HOODIA2 /(?:hoodia|920\+)/i | |
| 282 | body __KAM_HOODIA3 /(?:fat loss product|sur?p?press appetite|Reduce Your Appetite)/is | |
| 283 | ||
| 284 | meta KAM_HOODIA (__KAM_HOODIA1 + __KAM_HOODIA2 + __KAM_HOODIA3 >= 2) | |
| 285 | describe KAM_HOODIA Hoodia / Weight Loss Product Promotion Spam | |
| 286 | score KAM_HOODIA 3.0 | |
| 287 | ||
| 288 | #STOCK TIPS | |
| 289 | ||
| 290 | ##1 through 120 disabld 5-12-2014 due to age | |
| 291 | ##body __KAM_STOCKTIP1 /(?:Reynaldo's Mexican Food|RYNL)/is | |
| 292 | ##body __KAM_STOCKTIP2 /(?:KOKO PETROLEUM|KKPT)/is | |
| 293 | ##body __KAM_STOCKTIP3 /(?:DARK DYNAMITE|DKDY|D K D Y)/is | |
| 294 | ##body __KAM_STOCKTIP4 /(?:Remington Ventures|RMVN)/is | |
| 295 | ##body __KAM_STOCKTIP5 /(?:m-Wise|MWIS|M W I S)/is | |
| 296 | ##body __KAM_STOCKTIP6 /(?:China World Trade Corporation|CWTD)/is | |
| 297 | ##body __KAM_STOCKTIP7 /(?:Packets International|IPKL)/is | |
| 298 | ##body __KAM_STOCKTIP8 /(?:Infinex Ventures|IFNX)/is | |
| 299 | ##body __KAM_STOCKTIP9 /(?:FacePrint Global Solutions|FCPG)/is | |
| 300 | ###THANKS TO HOMER PARKER FOR THE FALSE POSSITIVE NOTE! | |
| 301 | ##body __KAM_STOCKTIP10 /(?:Ever[-_ ~]{0,3}Gl[o0]ry|(^|\b)E[-_~\. =]{0,3}G[-_~\. =]{0,3}L[-_~\. =]{0,3}Y($|\b))/is | |
| 302 | ##body __KAM_STOCKTIP11 /(?:Gulf Petroleum|GFPE)/is | |
| 303 | ##body __KAM_STOCKTIP12 /(?:Patriot Mechanical Handling|PMHH)/is | |
| 304 | ##body __KAM_STOCKTIP13 /(?:KSW Industries|KSWJ)/is | |
| 305 | ##body __KAM_STOCKTIP14 /(?:Conforce International|CFRI)/is | |
| 306 | ##body __KAM_STOCKTIP15 /(?:Nano Superlattice Technology|NSLT)/is | |
| 307 | ##body __KAM_STOCKTIP16 /(?:Morgan Beaumont|MBEU)/is | |
| 308 | ##body __KAM_STOCKTIP17 /(?:Relay Capital|(^|\b)RLYC($|\b))/is | |
| 309 | ###THANKS TO DAVID GOLDSMITH FOR POINTING OUT THE POTENTIAL FPs FROM THIS RULE | |
| 310 | ##body __KAM_STOCKTIP18 /(?:Madison Explorations|(?:^|\b)MDEX(?:$|\b))/is | |
| 311 | ##body __KAM_STOCKTIP19 /(?:CTR Investments and Consulting|C ?I ?V ?X)/is | |
| 312 | ##body __KAM_STOCKTIP20 /(?:PREMIER INFORMATION|(?:^|\b)PIFR(?:$|\b))/is | |
| 313 | ##body __KAM_STOCKTIP21 /(?:Harbin Pingchuan|P G C N|PGCN)/is | |
| 314 | ##body __KAM_STOCKTIP22 /(?:CLIENT TRACK CORP|CTKR)/is | |
| 315 | ##body __KAM_STOCKTIP23 /(?:EXTREME INNOVATIONS|(^|\b)EXTI($|\b))/is | |
| 316 | ##body __KAM_STOCKTIP24 /(?:Medical Home Products|\bMHPT\b)/is | |
| 317 | ##body __KAM_STOCKTIP25 /(?:AmeraMex International|AMMX)/is | |
| 318 | ##body __KAM_STOCKTIP26 /(?:Equipment & Systems Engineering|EQUIPMENT & SYS ENGR|EQSE)/is | |
| 319 | ##body __KAM_STOCKTIP27 /(?:NANOFORCE|NNFC)/i | |
| 320 | ##body __KAM_STOCKTIP28 /(?:\b|^)(?:Resort Clubs (I|\|)nternational|R[ ]*T[ ]*C[ ]*(?:I|\|))(?:\b|$)/is | |
| 321 | ##body __KAM_STOCKTIP29 /(?:Innovation Holdings|IVHN)/is | |
| 322 | ##body __KAM_STOCKTIP30 /(?:GOLDEN APPLE OIL|GAPJ)/is | |
| 323 | ##body __KAM_STOCKTIP31 /(?:inZon Corporation|(^|\b)I ?Z ?O ?N($|\b))/is | |
| 324 | ##body __KAM_STOCKTIP32 /(?:Midland Baring Financial Group|MDBF)/is | |
| 325 | ##body __KAM_STOCKTIP33 /(?:Aradyme Corporation|A D Y E)/is | |
| 326 | ##body __KAM_STOCKTIP34 /(?:TRANSAKT CORP|TKTJF)/is | |
| 327 | ##body __KAM_STOCKTIP35 /(?:CTXE|CANTEX ENERGY CORP)/is | |
| 328 | ##body __KAM_STOCKTIP36 /(?:De Greko|DGKO)/is | |
| 329 | ##body __KAM_STOCKTIP37 /(?:Deep Earth Resource, Inc|CTFE|DPER)/is | |
| 330 | ##body __KAM_STOCKTIP38 /(?:Vemics|(\b|^)VMCI(\b|$)|Summit Financial Resources)/is | |
| 331 | ##body __KAM_STOCKTIP39 /Premium Petroleum/is | |
| 332 | ##body __KAM_STOCKTIP40 /(?:F ?a ?l ?c ?o ?n ?E ?n ?e ?r ?g ?y|F.?C.?Y.?I)/s | |
| 333 | ##body __KAM_STOCKTIP41 /(?:CHINA GOLD CORP|CGDC)/is | |
| 334 | ##body __KAM_STOCKTIP42 /DPEK/i | |
| 335 | ###FIXED FP THANKS TO BEN LENTZ - Also found that the X ?X ?X ?X concept is causing too many FPs thanks to Homer Parker | |
| 336 | ##body __KAM_STOCKTIP43 /(?:Amerossi International Group|A M S N(\b|$)|AMSN)/is | |
| 337 | ##body __KAM_STOCKTIP44 /(?:WATAIRE INDUSTRIES|W ?T ?A ?F)/is | |
| 338 | ##body __KAM_STOCKTIP45 /(?:ABSOLUTESKY|A ?B ?S ?Y)/i | |
| 339 | ##body __KAM_STOCKTIP46 /(?:Infinex Ventures|I ?N ? ?F ?X)/is | |
| 340 | ##body __KAM_STOCKTIP47 /(?:Holly ?wood Intermediate|HYWI|H Y W I)/is | |
| 341 | ###DISABLED DUPLICATE OF 40 | |
| 342 | ###body __KAM_STOCKTIP48 /(?:Falcon Energy|F ?C ?Y ?I)/is | |
| 343 | ##body __KAM_STOCKTIP49 /(?:\b|^)(?:AGA Resources|A ?G ?A)(?:\b|$)/is | |
| 344 | ##body __KAM_STOCKTIP50 /(?:COSCO|CCPI)/i | |
| 345 | ##body __KAM_STOCKTIP51 /(?:PETRO([- ?])?SUN DRILLING|P[- ]?S[- ]?U[- ]?D)/is | |
| 346 | ##body __KAM_STOCKTIP52 /(?:KMA Global Solutions International|KMAG)/is | |
| 347 | ##body __KAM_STOCKTIP53 /(?:Advanced Powerline Technologies|APWL)/is | |
| 348 | ##body __KAM_STOCKTIP54 /(?:GOLDMARK INDUSTRIES|GDKI)/is | |
| 349 | ##body __KAM_STOCKTIP55 /(?:QUANTUM ENERGY|QEGY)/is | |
| 350 | ###FP FIXED THANKS TO Homer Parker | |
| 351 | ##body __KAM_STOCKTIP56 /(?:AAGA RESOURCE+S NEW|A G A O|(\b|^)AGAO(\b|$))/is | |
| 352 | ###FP FIXED THANKS TO Homer Parker | |
| 353 | ##body __KAM_STOCKTIP57 /(?:Bicoastal Communications|BCLC|B C L C)/is | |
| 354 | ##body __KAM_STOCKTIP58 /(?:Greater China Media \& Ent|G ?C ?M ?E)/is | |
| 355 | ##body __KAM_STOCKTIP59 /(?:Viva International|(\b|^)VIVI(\b|$))/s | |
| 356 | ##body __KAM_STOCKTIP60 /(?:WILON RESOURCES|(\b|^)WLON(\b|$))/is | |
| 357 | ##body __KAM_STOCKTIP61 /(?:Am+erica+n U+ni+ty I+nve+stments|(\b|^)A[ _]?U[ _]?N[ _]?I[ _]?(\b|$))/is | |
| 358 | ##body __KAM_STOCKTIP62 /(?:DEFENSE DIRECTIVE|(\b|^)DFSE(\b|$))/is | |
| 359 | ##body __KAM_STOCKTIP63 /(?:Cyberhand Technologies|(\b|^)CYHD(\b|$))/is | |
| 360 | ##body __KAM_STOCKTIP64 /(?:Texhoma Energy|(\b|^)TXHE(\b|$))/is | |
| 361 | ##body __KAM_STOCKTIP65 /(?:Equal Trading|(\b|^)EQTD(\b|$))/is | |
| 362 | ###DISABLED FOR FALSE POSITIVES AND AGE | |
| 363 | ###body __KAM_STOCKTIP66 /(?:\b|^)W.?B.?R.?S(?:\b|$)/is | |
| 364 | ##body __KAM_STOCKTIP67 /(?:Mobile Airwaves|(\b|^)M.?W.?B.?C.?(\b|$))/is | |
| 365 | ##body __KAM_STOCKTIP68 /(?:X-tra Petroleum|(\b|^)XTPT(\b|$))/is | |
| 366 | ###ADDED FP BOUNDARY CHECK THANKS TO Greg Troxel for reporting the issue | |
| 367 | ##body __KAM_STOCKTIP69 /(?:Red Reef Laboratories|(\b|^)RREF(\b|$))/is | |
| 368 | ##body __KAM_STOCKTIP70 /(?:Great American Food Chain|(\b|^)GAMN(\b|$))/is | |
| 369 | ##body __KAM_STOCKTIP71 /(?:Cana Petroleum|(\b|^)CNPM(\b|$))/is | |
| 370 | ##body __KAM_STOCKTIP72 /(?:China Health Management|(\b|^)CNHC(\b|$))/is | |
| 371 | ##body __KAM_STOCKTIP73 /(?:Makeup Limited|MAKU)/is | |
| 372 | ##body __KAM_STOCKTIP74 /(?:Premier Holdings Group|PMHD)/is | |
| 373 | ###FP FIXED THANKS TO Christopher X. Candreva | |
| 374 | ##body __KAM_STOCKTIP75 /(?:VSUS technologies|(\b|^)VSUS($|\b))/is | |
| 375 | ##body __KAM_STOCKTIP76 /(?:FLAIR PETROLEUM|FPMC)/is | |
| 376 | ##body __KAM_STOCKTIP77 /(?:Physician Adult Daycare|PHYA)/is | |
| 377 | ###FP FIXED THANKS TO Homer Parker | |
| 378 | ##body __KAM_STOCKTIP78 /(?:AlgoDyne Ethanol Energy|(\b|^)ADYN(\b|$))/is | |
| 379 | ##body __KAM_STOCKTIP79 /(?:Critical Care.{1,3}Inc|CTCX)/is | |
| 380 | ##body __KAM_STOCKTIP80 /(?:Aerofoam Metals|AFML)/is | |
| 381 | ##body __KAM_STOCKTIP81 /(?:Ten \& 10|(?:\b|^)TTEN)/is | |
| 382 | ##body __KAM_STOCKTIP82 /(?:Medical Institutional Services|MISJ(\b|$))/is | |
| 383 | ##body __KAM_STOCKTIP83 /(?:Harris Exploration|HXPN)/is | |
| 384 | ##body __KAM_STOCKTIP84 /(?:MARSHAL HOLDINGS|MHII)/is | |
| 385 | ##body __KAM_STOCKTIP85 /(?:ADVANCED GROWING SYSTEMS|AGWS)/is | |
| 386 | ##body __KAM_STOCKTIP86 /(?:WEST EXCELSIOR ENT|WEXE)/is | |
| 387 | ##body __KAM_STOCKTIP87 /(?:Hemisphere Gold|HPGI)/is | |
| 388 | ##body __KAM_STOCKTIP88 /(?:Victory Energy Corporation|VYEY)/is | |
| 389 | ##body __KAM_STOCKTIP89 /UTEV/i | |
| 390 | ##body __KAM_STOCKTIP90 /(?:CHINA BIOLIFE ENTERP|CBFE)/is | |
| 391 | ##body __KAM_STOCKTIP91 /(?:Critical Care|C ?T ?C ?X)/is | |
| 392 | ##body __KAM_STOCKTIP92 /CBRJ/i | |
| 393 | ##body __KAM_STOCKTIP93 /(?:LAS VEGAS CENTRAL RESERVATIONS|LVCC)/is | |
| 394 | ##body __KAM_STOCKTIP94 /GTAP/i | |
| 395 | ##body __KAM_STOCKTIP95 /(North American Energy Group|N-?N-?Y-?R)/is | |
| 396 | ###FP FIXED THANKS TO BRETT GARRETT | |
| 397 | ##body __KAM_STOCKTIP96 /(\b|^)C\.?C\.?T\.?I(\b|$)/i | |
| 398 | ##body __KAM_STOCKTIP97 /(C ?E ?O AMERICA|C ? E ? O ?A)/is | |
| 399 | ##body __KAM_STOCKTIP98 /PLMA/i | |
| 400 | ##body __KAM_STOCKTIP99 /CDYV/i | |
| 401 | ##body __KAM_STOCKTIP100 /(Fire (Mountain|Mtn) Beverage Company|(^|\b)F[ _]?B[ _]?V[ _]?G($|\b))/is | |
| 402 | ###Added boundary check thanks to Michael Denney | |
| 403 | ##body __KAM_STOCKTIP101 /(\b|^)WDSC(\b|$)/i | |
| 404 | ##body __KAM_STOCKTIP102 /(Distributed Power|DPWI)/is | |
| 405 | ##body __KAM_STOCKTIP103 /(HUMET-PBC|L9Z\.F)/is | |
| 406 | ##body __KAM_STOCKTIP104 /ASVP/is | |
| 407 | ##body __KAM_STOCKTIP105 /CHVC/is | |
| 408 | ##body __KAM_STOCKTIP106 /(China Datacom|CDPN)/is | |
| 409 | ##body __KAM_STOCKTIP107 /(ORAMED PHARMA|OJU\.F)/is | |
| 410 | ##body __KAM_STOCKTIP108 /(DSDI|DSI Direct Sales)/is | |
| 411 | ##body __KAM_STOCKTIP109 /(Monolith Athletic Club|M[-_ ]?N[-_ ]?A[-_ ]?B)/is | |
| 412 | ###DUPLICATED STOCKTIP #51 | |
| 413 | ###body __KAM_STOCKTIP110 /(PETRO-SUN|P[- ]?S[- ]?U[- ]?D)/is | |
| 414 | ##body __KAM_STOCKTIP111 /(COMPLIANCE SYSTEMS|(\b|^)COPI(\b|$))/is | |
| 415 | ###FP Fixed thanks to Greg Troxel | |
| 416 | ##body __KAM_STOCKTIP112 /(Global Pay Solutions|(\b|^)GPSI(\b|$))/is | |
| 417 | ##body __KAM_STOCKTIP113 /(MEGOLA|MGOA)/i | |
| 418 | ###FP FIXED THANKS TO Antonio Falzarano | |
| 419 | ##body __KAM_STOCKTIP114 /(\b|^)ADOV(\b|$)/i | |
| 420 | ##body __KAM_STOCKTIP115 /(Oncology Med|(\b|^)ONCO(\b|$))/is | |
| 421 | ##body __KAM_STOCKTIP116 /(Strategy X|SGXI)/is | |
| 422 | ##body __KAM_STOCKTIP117 /(Spotlight Homes|COST CONTAINMENT TEC|SPHM)/is | |
| 423 | ###FALSE POSITIVE ON DANSREALESTATE. | |
| 424 | ##body __KAM_STOCKTIP118 /((\b|^)SREA(\b|$)|Score One)/is | |
| 425 | ##body __KAM_STOCKTIP119 /(Monster Motors|MRMT)/is | |
| 426 | ##body __KAM_STOCKTIP120 /(EntreMetrix|ERMX)/i | |
| 427 | ||
| 428 | body __KAM_STOCKTIP121 /(VISION AIRSHIPS|(\b|^)VPSN(\b|$))/is | |
| 429 | body __KAM_STOCKTIP122 /(Shandong Zhouyuan Seed and Nursery|(\b|^)SZSN(\b|$))/is | |
| 430 | body __KAM_STOCKTIP123 /(Puerto Rico 7|(\b|^)P ?R ?T ?H(\b|$))/is | |
| 431 | body __KAM_STOCKTIP124 /((\b|^)VGPM(\b|$)|Vega Promotional Sys)/is | |
| 432 | body __KAM_STOCKTIP125 /((\b|^)D[- ]?M[- ]?X[- ]?C(\b|$))/i | |
| 433 | body __KAM_STOCKTIP126 /((\b|^)C\.?W\.?T\.?E(\b|$)|C'Watre International)/is | |
| 434 | body __KAM_STOCKTIP127 /(Physical Property Holdings|(\b|^)PPYH(\b|$))/is | |
| 435 | #FP ON MNUM IN PLAIN TEXT HTML CONVERSION - Thanks to Kevin Lewis | |
| 436 | body __KAM_STOCKTIP128 /(MONUMENTAL MARKETING|(\b|^)MNUM(\b|$))/is | |
| 437 | body __KAM_STOCKTIP129 /(EnerBrite Technologies Group|(\b|^)eTgU(\b|$))/is | |
| 438 | body __KAM_STOCKTIP130 /(Pricester|(\b|^)PRCC(\b|$))/is | |
| 439 | #Added boundary check thanks to Michael Denney | |
| 440 | body __KAM_STOCKTIP131 /(Greenstone Holdings|(\b|^)GSHN(\b|$))/is | |
| 441 | body __KAM_STOCKTIP132 /((\b|^)AGMS(\b|$)|Angstrom[- ]Microsystems)/is | |
| 442 | body __KAM_STOCKTIP133 /(Pluris Energy|(\b|^)PEYG(\b|$))/is | |
| 443 | body __KAM_STOCKTIP134 /(United Consortium|(\b|^)UCSO(\b|$))/is | |
| 444 | body __KAM_STOCKTIP135 /(Dominion Minerals|(\b|^)DMNM(\b|$))/is | |
| 445 | body __KAM_STOCKTIP136 /(PrimeGen Energy|(\b|$)PGNE(\b|^))/is | |
| 446 | body __KAM_STOCKTIP137 /Dynamic Response Group|(\b|^)DRGZ(\b|$)/is | |
| 447 | body __KAM_STOCKTIP138 /Cobra Oil (and|&) Gas|(\b|^)CGCA(\b|$)/is | |
| 448 | body __KAM_STOCKTIP139 /Solanex Management|(\b|^)SLNX(\b|$)/is | |
| 449 | body __KAM_STOCKTIP140 /BIO-SOLUTIONS|(\b|^)BISU(\b|$)/is | |
| 450 | #FP IN French email on 3/2/2017 | |
| 451 | #body __KAM_STOCKTIP141 /(\b|^)FORC(\b|$)/is | |
| 452 | body __KAM_STOCKTIP142 /Hawk Systems Inc|(\b|^)HWSYD(\b|$)/is | |
| 453 | body __KAM_STOCKTIP143 /AmeriLithium/is #|(\b|^)AMEL(\b|$)/is # FP 9/10/15 | |
| 454 | body __KAM_STOCKTIP144 /Fleet Management Solutions|(\b|^)FLMG(\b|$)/is | |
| 455 | body __KAM_STOCKTIP145 /Nuvilex|(\b|^)N.?V.?L.?X.?(\b|$)/is | |
| 456 | body __KAM_STOCKTIP146 /Plandai|(\b|^)PLPL(\b|$)/is | |
| 457 | #FP on Bozic 3/9/2021 - Thanks to Lars Einarsen | |
| 458 | body __KAM_STOCKTIP147 /Beamz Interactive|(\b|^)BZIC(\b|$)/is | |
| 459 | body __KAM_STOCKTIP148 /(\b|^)STBV(\b|$)/i | |
| 460 | body __KAM_STOCKTIP149 /LifeApps|(\b|^)LFAP(\b|$)/i | |
| 461 | body __KAM_STOCKTIP150 /MONARCHY RESOURCES/i | |
| 462 | body __KAM_STOCKTIP151 /Alanco Tech/i | |
| 463 | body __KAM_STOCKTIP152 /Siga Resources/i | |
| 464 | body __KAM_STOCKTIP153 /INSCOR|(\b|^)IOGA(\b|$)/is | |
| 465 | body __KAM_STOCKTIP154 /mLight Tech|(\b|^)MLGT(\b|$)/is | |
| 466 | body __KAM_STOCKTIP155 /Alanco Technologies/is | |
| 467 | body __KAM_STOCKTIP156 /Progress Watch|(\b|^)PROW(\b|$)/is | |
| 468 | #body __KAM_STOCKTIP157 /(\b|^)PRFC(\b|$)/is | |
| 469 | body __KAM_STOCKTIP158 /(\b|^)(RCHA|R\.+C\.+H\.+A|R\/C\/H\/A)(\b|$)/is | |
| 470 | body __KAM_STOCKTIP159 /(\b|^)(RNBI|R.N.B.I)(\b|$)/is | |
| 471 | body __KAM_STOCKTIP160 /(\b|^)(CNRMF|C.N.R.M.F)(\b|$)/is | |
| 472 | body __KAM_STOCKTIP161 /(\b|^)(NUAN|N[- ]U[- ]A[- ]N)(\b|$)|NUANCE COMMUNICATIONS/is | |
| 473 | body __KAM_STOCKTIP162 /(\b|^)(CHICF|C.H.I.C.F)(\b|$)/is | |
| 474 | body __KAM_STOCKTIP163 /(\b|^)(brixmor)(\b|$)/is | |
| 475 | body __KAM_STOCKTIP164 /(\b|^)(KBLB|K.B.L.B)(\b|$)/is | |
| 476 | body __KAM_STOCKTIP165 /(\b|^)(SCRF|S.C.R.F)(\b|$)/is | |
| 477 | body __KAM_STOCKTIP166 /(\b|^)(INCT|Incapta)(\b|$)/is | |
| 478 | body __KAM_STOCKTIP167 /(\b|^)(QSMS|Quest Science Management Gate)(\b|$)/is | |
| 479 | body __KAM_STOCKTIP168 /(\b|^)(QSMG|Q.S.M.G|Stemvax)(\b|$)/is | |
| 480 | body __KAM_STOCKTIP169 /(\b|^)E.?C.?G.?R(\b|$)/s | |
| 481 | ||
| 482 | ||
| 483 | body __KAM_STOCKOTC /(OTC|OTC ?BB|OTC Pink Sheets|NASDAQ|NYSE|StockWatch):/is | |
| 484 |