body __KAM_VIAGRA6B /(\b|^)A.?M.?B.?[il1].?E.?N($|\b)/i
body __KAM_VIAGRA6C /V.?A.?L.?[il1].?U.?M/i
body __KAM_VIAGRA6D /(\b|^)C.?[il1].?A.?L.?[Il1].?S($|\b)/i
-header __KAM_VIAGRA6E From =~ /Viagra|Cialis(\b|$)/i
+header __KAM_VIAGRA6E From =~ /(Viagra|Cialis)(\b|$)/i
meta KAM_VIAGRA6 (__KAM_VIAGRA6A + __KAM_VIAGRA6B + __KAM_VIAGRA6C + __KAM_VIAGRA6D + __KAM_VIAGRA6E >= 2)
describe KAM_VIAGRA6 Viagra Obfuscation Technique SPAM
#SEXUALLY EXPLICIT EMAILS - With updates courtesy of Mark Damrose
header __KAM_SEX_EXPLICIT1 Subject =~ /SEXUAL{2,3}Y[-_, ]{0,1}EXPL{1,2}I{1,2}CI{1,2}T/i
#EXPANDED TO INCLUDE HEADERS FOR SPAMS PREVALENT MAR 2007
-header __KAM_SEX_EXPLICIT2 Subject =~ /(?:fuck .*suck|suck .*fuck|pussy .*cock|cock .*pussy|horny amateur|couch sex|slut fuck|naked celebrity|pissing babes|ass[- ]fuck|animal cock|(^|\b)P[^a-zA-Z\d]O[^a-zA-Z\d]R[^a-zA-Z\d]N |exposes sexy ass|drunk babe nude|masturbate|looking.for.sex|breast.implants|pedophile|child predator|explore.being.bad|double.penetration|hardcore.slut|getting.laid|your.disco.stick|having.sex.*begging|f.ckbook|xxx gay|asian porn|blow ?job|anal xxx|huge tits tube|xxx tube|porn tube|porn video|sexy.clip|portal for xxx|3d porn|hard(er)?.erect)|dreaming of f.?cking|(^|\b)sex.in.the.car|horny.virgin|sex.acts|best.intercourse|sex request|dripping wet and need to get|S*?exy granny|shagmate/i
+header __KAM_SEX_EXPLICIT2 Subject =~ /(?:fuck .*suck|suck .*fuck|pussy .*cock|cock .*pussy|horny amateur|couch sex|slut fuck|naked celebrity|pissing babes|ass[- ]fuck|animal cock|(^|\b)P[^a-zA-Z\d]O[^a-zA-Z\d]R[^a-zA-Z\d]N |exposes sexy ass|drunk babe nude|masturbate|looking.for.sex|breast.implants|pedophile|child predator|explore.being.bad|double.penetration|hardcore.slut|getting.laid|your.disco.stick|having.sex.*begging|f.ckbook|xxx gay|asian porn|blow ?job|anal xxx|huge tits tube|xxx tube|porn tube|porn video|sexy.clip|portal for xxx|3d porn|hard(er)?.erect)|dreaming of f.?cking|(^|\b)sex.in.the.car|horny.virgin|sex.acts|best.intercourse|sex request|dripping wet and need to get|S*?exy granny|shagmate|her squirt|elongation secret/i
#TRYING TO GET RID OF FPs WITH LAST NAMES
-header __KAM_SEX_EXPLICIT3 From =~ /(?:better sex|sextrick|ashleymadison|booty.call|breast.(aug|surg|redu)|throbing.member|f[\*u]?ckbook|Local MILFs|fuck(s|ing)?(\b|^)|Dating Granny)/i
+header __KAM_SEX_EXPLICIT3 From =~ /(?:better sex|sextrick|ashleymadison|booty.call|breast.(aug|surg|redu)|throbing.member|f[\*u]?ckbook|Local MILFs|fuck(s|ing)?(\b|^)|Dating Granny|school of squirt)|hookup.?alert|horny|bedroom.?partner|hookup.?online|lovely.?asian/i
#MODIFIED TO FIX FP THANKS TO DOC SCHNEIDER AND MARK MARTINEC - REMOVED castrate|sexual.encounter|casual.sex|discreet.encounter 5/19/15
-body __KAM_SEX_EXPLICIT4 /(?:fucked hardcore|dildoes her tight ass|kinky watersports|schoolgirls? slut|teens? porn|first anal(\b|$)|pussy lips|kinky lesbian|sucks? cock|rub puss|spreads? cunt|fetish babe|kinky pee|muffdived \& fuck|deepthroat on knees|hello.naughty.boy|certain.type.of.guy|girlfriend.trick|sexual.stamina|sex...toy|porn.link|cunt.fuck|c-o-c-k|non.stop.sex|porn.industry|stronger.erection|make.her.moan|extreme.pro.abortion|erection.problem|your.erection|get.an.erection|hardest.erection|get.erect|xxx gay|asian porn|blow ?job (comm?unity|porn)|anal xxx|huge tits tube|xxx tube|porn tube|fuckbook|portal for xxx|3d porn|DrPEnterprise|girlfriends.porn|\bsex.galler|pussy.eaten|shemale|(\b|^)anal.adventure|black.girls.video|gay.porn|pussy.wet|make.her.horny|crave sex|women.fuck|women.horny|wanting.to.bang|getting.laid.is.simple|woman.on.her.knees|b r e a s t|generic.ed.product|best.sex|f[^a-z]cking.you|f[^a-z]ckbuddy|F\#ckFriends|Milf Selfies|need.a.horny.man|cute.sex.lover|horny.as.f.ck|fun.in.the.bedroom|my.tits.are|be.horny|horny.girl|horny.i.am|horny.latina|huge.dildo|made.me.climax|sex in my office|a.good.f\@ck|married.horny.woman|sucked.your.d\@ck|horny.milf|suck.you.off|horny.stories|all.my.h[o0]les|cum.heavily|sucking.your.c[o0]ck|to.get.f[^a-z]cked)|h00kup|s\*xy|\bh0rny|ch0ked|pu\$\$y|f\*cked|F\*ck_|find milfs/i
+body __KAM_SEX_EXPLICIT4 /(?:fucked hardcore|dildoes her tight ass|kinky watersports|schoolgirls? slut|teens? porn|first anal(\b|$)|pussy lips|kinky lesbian|sucks? cock|rub puss|spreads? cunt|fetish babe|kinky pee|muffdived \& fuck|deepthroat on knees|hello.naughty.boy|certain.type.of.guy|girlfriend.trick|sexual.stamina|sex...toy|porn.link|cunt.fuck|c-o-c-k|non.stop.sex|porn.industry|stronger.erection|make.her.moan|extreme.pro.abortion|erection.problem|your.erection|get.an.erection|hardest.erection|get.erect|xxx gay|asian porn|blow ?job (comm?unity|porn)|anal xxx|huge tits tube|xxx tube|porn tube|fuckbook|portal for xxx|3d porn|DrPEnterprise|girlfriends.porn|\bsex.galler|pussy.eaten|shemale|(\b|^)anal.adventure|black.girls.video|gay.porn|pussy.wet|make.her.horny|crave sex|women.fuck|women.horny|wanting.to.bang|getting.laid.is.simple|woman.on.her.knees|b r e a s t|generic.ed.product|best.sex|f[^a-z]cking.you|f[^a-z]ckbuddy|F\#ckFriends|Milf Selfies|need.a.horny.man|cute.sex.lover|horny.as.f.ck|fun.in.the.bedroom|my.tits.are|be.horny|horny.girl|horny.i.am|horny.latina|huge.dildo|made.me.climax|sex in my office|a.good.f\@ck|married.horny.woman|sucked.your.d\@ck|horny.milf|suck.you.off|horny.stories|all.my.h[o0]les|cum.heavily|sucking.your.c[o0]ck|to.get.f[^a-z]cked)|h00kup|s\*xy|\bh0rny|ch0ked|pu\$\$y|f\*cked|F\*ck_|find milfs|girls in your city/i
#remove f\#ck for FPs
header __KAM_SEX_EXPLICIT5 Subject =~ /(?:Babe.*dildo|milk.*pussy|licks.*lesbian.*tits|mud.*wrestling.*sluts|rock.*hard.*cock|working.*pussy|(anal|suck|lick|hot|cock|wife).*f.?u.?c.?k|sneaky.*upskirt.*shots|hairy.*(pussy|cunt)|chicks.*cum|shows.*off.*titties|tits.*milf.*sex|riding.*big.*dick|dildo.*pussy|slut.*sex|suck.*dick|show.*off.*pink.*slit|coed.*pussy|squirt.*pussy|polish.*cock|femdom.*fist|schoolgirl.*(f.?u.?c.?k|blowjob)|mistress.*finger.*slave|cervix.*examined|tits.*vibrator|licks.*lesbian|slut.*anal|slurp.*pecker|master.*hogtie|bitch.*stroke.*guy|huge.*cock.*bang|take.*dick.*ride|milf.*nailed|girl.*in.*panties|Slut.*Doing.*it|barely.*legal.*teen|perverted.*girl.*works.*ass|slut.*milking|caught.*fucking|F.?u.?c.?k.*(dick)|shemale.*strips|chick.*drilled|\bass.*screw|teen.*pussy|fucked.*hard|bimbo.*hooter|cuntbanged|tittyfucked|fuck.*cock|blowing and nailed|lesbians.*masturbat|shaking wet booty|pussy.*lip|lick.*asshole|kinky lesbian|suck.*cock|rub puss|tits.*cunt|kinky pee|fetish babe|exposes sexy ass|drunk babe nude|muff.*fuck|cock.?suck.*blonde|fuck.*vibrator|threeway.*orgy|sex.life.*new.level|your.sex.life|hotsex|f.cktonight|my.?pu[s\$]{1,5}y|InstaSext|SnapHookup|InstaAffair|InstaHookup|SexiSnap|SnapF.ck|snapbangmsg)/i
+
body __KAM_SEX_EXPLICIT6 /virus on a porn web/i
meta KAM_SEX_EXPLICIT (__KAM_SEX_EXPLICIT1 + __KAM_SEX_EXPLICIT2 + __KAM_SEX_EXPLICIT3 + __KAM_SEX_EXPLICIT4 + __KAM_SEX_EXPLICIT5 + __KAM_SEX_EXPLICIT6 >= 1)
#2019-11-24 - Removed .bid for FPs
#2020-06-04 - Added FP check for td.date and div.top
#2020-08-23 - Added guru
-header __KAM_SOMETLD_ARE_BAD_TLD_FROM From:addr =~ /\.(pw|stream|trade|press|top|date|guru|casa|online|cam|shop|club)$/i
-uri __KAM_SOMETLD_ARE_BAD_TLD_URI /\.(pw|stream|trade|press|top|date|guru|casa|online|cam|shop|club)($|\/)/i
+#2021-08-14 - Thanks to Giovanni for the new regex and Kenneth Porter for the FP for things that ended in one of the TLDs but wasn't part of the domain
+#2021-08-25 - Added a FP fix for date with { from programming discussions
+header __KAM_SOMETLD_ARE_BAD_TLD_FROM From:addr =~ /\.(pw|stream|trade|press|top|date|guru|casa|online|cam|shop|club|bar|sbs)$/i
+uri __KAM_SOMETLD_ARE_BAD_TLD_URI /:\/{2}([a-z0-9-\.]+)\.(pw|stream|trade|press|top|date|guru|casa|online|cam|shop|club|bar|sbs)($|\/|\:)/i
#FPs
uri __KAM_SOMETLD_ARE_BAD_TLD_URI_NEGATIVE /(^|\b)td\.date|div\.top($|\/)/i
+body __KAM_SOMETLD_ARE_BAD_TLD_PROGRAM_REF /\.date ?\{/i
-meta KAM_SOMETLD_ARE_BAD_TLD (__KAM_SOMETLD_ARE_BAD_TLD_FROM) || (__KAM_SOMETLD_ARE_BAD_TLD_URI && !__KAM_SOMETLD_ARE_BAD_TLD_URI_NEGATIVE)
-describe KAM_SOMETLD_ARE_BAD_TLD .stream, .trade, .pw, .top, .press, .guru, .casa, .online, .cam, .shop, .club & .date TLD Abuse
+meta KAM_SOMETLD_ARE_BAD_TLD (__KAM_SOMETLD_ARE_BAD_TLD_FROM) || (__KAM_SOMETLD_ARE_BAD_TLD_URI && !(__KAM_SOMETLD_ARE_BAD_TLD_PROGRAM_REF + __KAM_SOMETLD_ARE_BAD_TLD_URI_NEGATIVE))
+describe KAM_SOMETLD_ARE_BAD_TLD .stream, .trade, .pw, .top, .press, .guru, .casa, .online, .cam, .shop, .bar, .club, .sbs & .date TLD Abuse
score KAM_SOMETLD_ARE_BAD_TLD 5.0
#2019-11-24 - Test to do the SOMETLD with WLBLEval - Doesn't work because no uri check for the body
score KAM_ADVERT3 5.0
#ADVERTISEMENT
-body KAM_ADVERT2 /No longer interested in our offers|This (message|email)? is an Ad|Continue in your Secure Web Browser|Can\'t see the images( below|, continue)|To view this email as a webpage|see images for this offer|support best practices in responsible email marketing|This email is not unsolicited|You registered with one of our partners websites|a d v e r t i s (?:e )?m e n t|No\-?Images? Click|Program is not endorsed, sponsored by or affiliated|can\'t read or see this email|By clicking any image and\/or text link in this Email|This is a (commercial|commericial)|This message brought to you|THIS EMAIL IS A COMMERCIAL|If you no longer wish to receive further offers|business solicitation message|link is for removal|end these weekly ad\-messages|cancel these Ads go|This is an email advertisement|end all Advertisements go below|We are not spammers|Unsolicited email\?|Quit receiving these admail|I.{0,3}am not spamming|commercial.advertisement|adv.ertisement|if.you.are.not.interested|Brought to you by\:|This communication is an advertisement|removal from further update|inbox by requesting removal|No more incoming messages will be delivered|Never receive these again|This is an ad\-coresspondance|this page is an advertise?ment|this is an \(adver\-?tisement\)|this page are an.ad|statements above are an.ad|advertis.e.ment/is
+body KAM_ADVERT2 /No longer interested in our offers|This (message|email)? is an Ad|Continue in your Secure Web Browser|Can\'t see the images( below|, continue)|To view this email as a webpage|see images for this offer|support best practices in responsible email marketing|This email is not unsolicited|You registered with one of our partners websites|a d v e r t i s (?:e )?m e n t|No\-?Images? Click|Program is not endorsed, sponsored by or affiliated|can\'t read or see this email|By clicking any image and\/or text link in this Email|This is a (commercial|commericial)|This message brought to you|THIS EMAIL IS A COMMERCIAL|If you no longer wish to receive further offers|business solicitation message|link is for removal|end these weekly ad\-messages|cancel these Ads go|This is an email advertisement|end all Advertisements go below|We are not spammers|Unsolicited email\?|Quit receiving these admail|I.{0,3}am not spamming|commercial.advertisement|adv.ertisement|if.you.are.not.interested|Brought to you by\:|This communication is an advertisement|removal from further update|inbox by requesting removal|No more incoming messages will be delivered|Never receive these again|This is an ad\-coresspondance|this page is an advertise?ment|this is an \(adver\-?tisement\)|this page are an.ad|statements above are an.ad|advertis.e.ment|share your contact/is
describe KAM_ADVERT2 This is probably an unwanted commercial email...
score KAM_ADVERT2 0.75
meta KAM_POLITICS (__KAM_POLITICS1 + __KAM_POLITICS2 + (__KAM_POLITICS3 + __KAM_POLITICS4 >= 1) >= 2)
score KAM_POLITICS 4.5
-describe KAM_POLITICS Unsolicited Political E-Mails
+describe KAM_POLITICS Political E-Mails
#SPAMMING COMPANIES
util_rb_2tld isteaching.com
util_rb_2tld googleapis.com
util_rb_2tld a2hosted.com
+ util_rb_2tld netlify.app
endif
# allow URI rules to look at DKIM headers if they exist and our SA version supports it
describe KAM_FROM_COMPROMISED_URIBL_PCCC From address listed in PCCC Compromised URIBL (https://raptor.pccc.com/RBL)
tflags KAM_FROM_COMPROMISED_URIBL_PCCC net
score KAM_FROM_COMPROMISED_URIBL_PCCC 9.0
+
+ #Welcome List URI - In Body
+ urirhssub KAM_BODY_WELCOMELIST_URIBL_PCCC wild.pccc.com. A 127.0.1.8
+ body KAM_BODY_WELCOMELIST_URIBL_PCCC eval:check_uridnsbl('KAM_URIBL2_PCCC')
+ describe KAM_BODY_WELCOMELIST_URIBL_PCCC Body contains URI listed in PCCC Welcome List URIBL (https://raptor.pccc.com/RBL)
+ tflags KAM_BODY_WELCOMELIST_URIBL_PCCC net
+ score KAM_BODY_WELCOMELIST_URIBL_PCCC -7.0
endif
endif
endif
#EMAIL BLACKLIST CHECK FOR PCCC RBL
-ifplugin Mail::SpamAssassin::Plugin::EmailBL
- ifplugin Mail::SpamAssassin::Plugin::KAMOnly
- #uses emailbl -all which is the same as -headers and -bodysafe
- header KAM_MESSAGE_EMAILBL_PCCC eval:check_emailbl('freemail-all', 'wild.pccc.com', '127.0.0.64')
- describe KAM_MESSAGE_EMAILBL_PCCC Message contains freemail address listed in PCCC URIBL (https://raptor.pccc.com/RBL)
- tflags KAM_MESSAGE_EMAILBL_PCCC net
- score KAM_MESSAGE_EMAILBL_PCCC 6.0
+if (version >= 3.004003)
+ ifplugin Mail::SpamAssassin::Plugin::HashBL
+ ifplugin Mail::SpamAssassin::Plugin::KAMOnly
+ header KAM_MESSAGE_HASHBL_FREEMAIL eval:check_hashbl_emails('wild.pccc.com', 'md5/max=10/shuffle', 'ALLFROM/Reply-To/body', '^127\.0\.0\.64', 'freemail')
+ describe KAM_MESSAGE_HASHBL_FREEMAIL Message contains freemail address listed in PCCC URIBL (https://raptor.pccc.com/RBL)
+ tflags KAM_MESSAGE_HASHBL_FREEMAIL net
+ score KAM_MESSAGE_HASHBL_FREEMAIL 6.0
+ endif
endif
endif
+#FREEMAIL SPAMMY ADDRESSES IN UNWANTED LANGUAGES
+ifplugin Mail::SpamAssassin::Plugin::KAMOnly
+ header __GB_FREEMAIL_NUM0 From:addr =~ /[a-z]\d{3}\@(gmail|hotmail|yahoo)\.com/i
+ header __GB_FREEMAIL_NUM1 From:addr =~ /[a-z]\d{5,10}\@(gmail|hotmail|yahoo)\.com/i
+ meta GB_FREEMAIL_NUM ( __GB_FREEMAIL_NUM0 || __GB_FREEMAIL_NUM1 )
+ describe GB_FREEMAIL_NUM Freemail spammy address
+ score GB_FREEMAIL_NUM 1.0
+ meta GB_UNWANTED_FREE_NUM ( GB_FREEMAIL_NUM && UNWANTED_LANGUAGE_BODY )
+ describe GB_UNWANTED_FREE_NUM Freemail spammy address and unwanted language
+ score GB_UNWANTED_FREE_NUM 3.0
+endif
+
#FAKERBL MX RELATED RULES
header __KAM_MX1 Reply-To =~ /\@mx\d+\./i
header __KAM_MX2 Return-Path =~ /\@mx\d+\./i
score KAM_AUTO 4.5
#HOME WARRANTY SPAMS
-header __KAM_WARRANTY1 Subject =~ /home warrant|protect your home|home repair|homeowners insurance|repairing your house/i
+header __KAM_WARRANTY1 Subject =~ /home warrant|protect your home|home repair|homeowners insurance|repairing your house|have you covered/i
body __KAM_WARRANTY2 /Protect your home|choice home warranty|unexpected repair/i
body __KAM_WARRANTY3 /home warrant|complimentary insurance quote/i
-header __KAM_WARRANTY4 From =~ /ChoiceHomeWarrant|TotalProtect|home.?Insurance|CHW Home Warranty|AHS.warranty/i
+header __KAM_WARRANTY4 From =~ /Choice.?Home.?Warrant|TotalProtect|home.?Insurance|CHW Home Warranty|AHS.warranty/i
meta KAM_WARRANTY (__KAM_WARRANTY1 + __KAM_WARRANTY2 + __KAM_WARRANTY3 + __KAM_WARRANTY4 + CBJ_GiveMeABreak >= 3)
score KAM_WARRANTY 1.5
#SEARCH ENGINE SPAM
#Subj
-header __KAM_SEARCH1 Subject =~ /be seen first on (google|msn|yahoo)|get ranked high|rank high|(no cost|free) website (analysis|search engine)|WEBSITE PROMOTION|social media|blog leads|infotech|(first|1st)(.page)?.result|seo.(optimiz|package|service)|seo.{1,30}expert|on.your.website|organic.seo|site.ranking|website.health|(first|1st) page/i
+header __KAM_SEARCH1 Subject =~ /be seen first on (google|msn|yahoo)|get ranked high|rank high|(no cost|free) website (analysis|search engine)|WEBSITE PROMOTION|social media|blog leads|infotech|(first|1st)(.page)?.result|seo.(optimiz|package|service)|seo.{1,30}expert|on.your.website|organic.seo|site.ranking|website.health|(first|1st) page|^proposal$|marketing proposal|top (o|i)n google|looking for an SEO/i
#what specific
body __KAM_SEARCH2 /search (ranking|engine)|S\.?E\.?O|bring.traffic|business.development|marketing strateg/i
#ranging
-body __KAM_SEARCH3 /(first on|all of) the major search|not ranked number one|Website promotion|popular keywords|mobile.website|complete.solution|back.link|india.based|surfing|not.ranking.on|top in Google|1st page|more (clients|customers)|organic search/i
+body __KAM_SEARCH3 /(first on|all of) the major search|not ranked number one|Website promotion|popular keywords|mobile.website|complete.solution|back.link|company in india|india.based|surfing|not.ranking.on|top in Google|1st page|more (clients|customers)|organic search|generate leads|specialization includes SEO/i
+tflags __KAM_SEARCH3 nosubject
#how
-body __KAM_SEARCH4 /guaranteed type of exposure|free website (analysis|report|search engine optimiz)|increase your revenue|improve your website traffice|website rank higher|marketing service|popular.keyword|media.presence|media.portal|brand.awareness|analytics.certified|optimized.content|white.label|website.optimization|digital.marketing|in.your.industry|high.revenue|plans? and pric|keyword|full proposal|online reputation|(blog|article|pr|search engine) (promotion|submission)/i
+body __KAM_SEARCH4 /guaranteed type of exposure|free website (analysis|report|search engine optimiz)|increase your revenue|improve your website traffice|website rank higher|marketing service|popular.keyword|media.presence|media.portal|brand.awareness|analytics.certified|optimized.content|white.label|website.optimization|digital.marketing|in.your.industry|high.revenue|plans? and pric|keyword|full proposal|online reputation|(blog|article|pr|search engine) (promotion|submission)|competitive quote|send you quote/i
#who
-rawbody __KAM_SEARCH5 /Click2Call|a1-solutions|fast-response.net|action-pros.net|tops-1.com|vividinfotech.com|internet.marketing|web.solution|(development|marketing) (executive|consultant)|(search engine|SEO) (consultant|expert|Service)|sales manager/i
+rawbody __KAM_SEARCH5 /Click2Call|a1-solutions|fast-response.net|action-pros.net|tops-1.com|vividinfotech.com|internet.marketing|web.solution|(development|marketing|business) (executive|consultant)|(search engine|SEO) (company|consultant|expert|Service)|sales manager/i
meta KAM_SEARCH (__KAM_SEARCH1 + __KAM_SEARCH2 + __KAM_SEARCH3 + __KAM_SEARCH4 + __KAM_SEARCH5 >= 4)
-score KAM_SEARCH 5.0
+score KAM_SEARCH 6.0
describe KAM_SEARCH Spammers hawking SEO
#SEO
-header __KAM_SEO1 Subject =~ /Idea for \[|can rank 1st on Google|Organic SEO|SEO (Solution|proposal)|integrated marketing|optimization.service|SEO Outsourcing|affordable package|quick result|ranking report/i
+header __KAM_SEO1 Subject =~ /Idea for \[|can rank 1st on Google|Organic SEO|SEO (Solution|proposal)|integrated marketing|optimization.service|SEO Outsourcing|affordable package|quick result|ranking report|why your website/i
#what we give you
-body __KAM_SEO2 /(?:top|first page) (?:in|of) (?:Google|MSN|Yahoo|Bing)|rank number one|top page rank|guarantee you 1st|link.building|business SEO|ranking report/i
+body __KAM_SEO2 /(?:top|first page) (?:in|of) (?:Google|MSN|Yahoo|Bing)|rank number one|top page rank|guarantee you 1st|link.building|business SEO|(audit|ranking) report/i
tflags __KAM_SEO2 nosubject
#what we do/fix
-body __KAM_SEO3 /(came across|never find) your web.?site|major search engines|paid access to tools|WEBSITE AUDIT REPORT|specific.keyword|targeted.email|visited.your.website|not ranking well|Google rankings/i
+body __KAM_SEO3 /(came across|never find) your web.?site|major search engines|paid access to tools|WEBSITE AUDIT REPORT|specific.keyword|targeted.email|visited.your.website|not ranking well|Google rankings|issues bugging your website/i
#SEO
body __KAM_SEO4 /SEO Specialists|online marketing services|S.?E.?O.? Company in INDIA|google.panda|google.penguin|not.ranking|SEO Packages/i
#costs
-body __KAM_SEO5 /more traffic guaranteed|results in thirty day|top 5 organic|high revenue|free.analysis|guaranteed.top|pricelist|completely free|No upfront fees|free trial/i
+body __KAM_SEO5 /more traffic guaranteed|results in thirty day|top 5 organic|high revenue|free.analysis|guaranteed.top|pricelist|completely free|No upfront fees|free trial|proposal for your website/i
#SEO Indicators
-body __KAM_SEO6 /will not get your website banned|Google.?s SEO policies|six month ongoing campaign|web.promotion|quality junk spam/i
+body __KAM_SEO6 /will not get your website banned|Google.?s SEO policies|six month ongoing campaign|web.promotion|quality junk spam|promotional online marketing/i
# LEGITIMATE SEO EMAILS WOULD SURELY HAVE AT LEAST ONE URL TO THEIR WEBSITE...
uri __KAM_SEO7 /./
#WEB DESIGN
-header __KAM_WEB1 Subject =~ /Web.?(Design|programming).?Services|Web.?Designing/i
-body __KAM_WEB2 /INDIA based IT|indian.based.website|certified.it.company/i
-body __KAM_WEB3 /Online Marketing Consultant|possible.redesign|seo.service|mobiles?.app|business.develop|commerce.solution/i
+header __KAM_WEB1 Subject =~ /Web.?(Design|programming|Development)/i
+
+body __KAM_WEB2 /indian?.based.(web|it)|certified.it.company|offering Website Design/i
+tflags __KAM_WEB2 nosubject
+
+body __KAM_WEB3 /Online Marketing (Executive|Consultant)|possible.redesign|seo.service|mobiles?.app|business.develop|commerce.solution/i
meta KAM_WEB (__KAM_WEB1 + __KAM_WEB2 + __KAM_WEB3 + KAM_ADVERT2 >= 3)
score KAM_WEB 4.0
describe KAM_SEXSUBJECT Sexually Explicit Subject
#RUSSIAN WIFE/BRIDE SCAMS
-header __KAM_WIFE1 Subject =~ /Remember me|(Russian|asian|Ukrai?nian) ?(dating|beaut|single|women|bride|lad|babe)/i
+header __KAM_WIFE1 Subject =~ /Remember me|(Russian|asian|Ukrai?nian) ?(dating|beaut|single|women|bride|lad|babe|girls)/i
body __KAM_WIFE2 /marry a Russian|sizzling photos|(russian|asian|ukrai?nian) (women|beaut|bride|girl)|Slavic babes|Russian ?lad(y|ies)|sexy photos/i
tflags __KAM_WIFE2 nosubject
-header __KAM_WIFE3 From =~ /(asian|russian|ukrai?nian).?(dat|bride|single|women|beaut|lad)|(date|nice).?(russian|asian)/i
+header __KAM_WIFE3 From =~ /(asian|russian|ukrai?nian).?(dat|bride|single|women|beaut|lad)|(date|nice|hot).?(russian|asian)/i
meta KAM_WIFE ( __KAM_WIFE1 + __KAM_WIFE2 + __KAM_WIFE3 >= 2)
score KAM_WIFE 8.0
describe KAM_FARM Farming related Spams
#MX URI - Scored lowered from 2.5 to 1.5 due to FPs reported by Christopher X. Candreva - see https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6700 for bug on issue
-uri KAM_MXURI /^(?:http:\/\/)?(mail|mx)\..{1,40}\..{1,8}/i
+uri KAM_MXURI /^(?:http:\/\/)?(mail|mx)\.(?!microsoft).{1,40}\..{1,8}/i
score KAM_MXURI 1.5
describe KAM_MXURI URI begins with a mail exchange prefix, i.e. mx.[...]
replace_rules __KAM_MAILBOX1 __KAM_MAILBOX2 __KAM_MAILBOX3
#ISSUE
- body __KAM_MAILBOX1 /mailbox .{0,12}exceeded|(storage|email|mailbox).(limit|quota|size|capacity)|(box|quota) is (a<L1>most )?(exhausted|fu<L1><L1>)|have been rejected|new version|(prevented|pending) (the )?(delivery|messages)|quota is low|annual upgrade|(held|important) message|messages pending|messages (are|placed) on.?hold|upgrade to our service|recent attack|(request(ed)? to|account) de-?activat|de-?activat(ed|e|ing) (from using|all mailbox)|close down.{0,10}account|(sync|communication) failure|de<A1>ctiv<A1>ted if no <A1>ction|invalid users|request .{0,13}shutdown|migrating all email|del<I1>v<E1>ry <O1>f \d|messages.{0,6}returned|\d.{0,2}(unreceived|failed|undelivered|incoming|valid) (undelivered|incoming|message|e?mail)|synchronize \d email|messages.{1,10}suspend|report your account|(validation|configuration|service|mail) error|updating stage|blacklisted|(server|quota|quarantine|suspension|mail|upgrade) (alert|noti)|mailbox agreement|(system|security|server) (reasons|update|upgrade|alert)|system malfunction|due for an update|mailbox managment|automatically renew|.\d. pending|due for (upgrade|update|reconfirmation)|has been outdated|(due|about) to expire|not confirmed the email|(failed|couldn't be|refused to) deliver|temporarily suspend|failure to proceed|data plan limit|blocked from (sending|receiving)|sending unsolicited|\d\% full|confirm your request|security turned off|blocked or suspended|update warning|account .{1,9}?(restricted|closed)|old versions|mail malfunction|messages now queue|password expir|virus|expire on \d+\/|DNS Upgrad|encountered error|will be shut ?down|unauthorized (person|access)|prevent (further reject|loss of account)|avoid lose access|ensure safety|problem occurred|wrong password|suspicious sign.?in|\d quarantined? (e?mail|message|incoming)|deactivated tempor|low disk space|shutdown robot|suspended email|webmail security|account hijacked|will be suspended|will.{0,2}expire.{0,2}(today|soon)|IP below was used|password.{1,5}expires? today|server is totally full|suspicious activities/i
+ body __KAM_MAILBOX1 /mailbox .{0,12}exceeded|(storage|e-?mail|mailbox|bandwidth).(limit|quota|size|capacity)|(box|quota) is (a<L1>most )?(exhausted|fu<L1><L1>)|have been rejected|new version|(prevented|pending) (the )?(delivery|messages)|quota is low|annual upgrade|(held|important) message|messages pending|messages (are|placed) on.?hold|upgrade to our service|recent attack|(request(ed)? to|account) de-?activat|de-?activat(ed|e|ing) (from using|all mailbox)|close down.{0,10}account|(sync|communication) failure|de<A1>ctiv<A1>ted if no <A1>ction|invalid users|request .{0,13}shutdown|migrating all email|del<I1>v<E1>ry <O1>f \d|messages.{0,6}returned|\d.{0,2}(unreceived|failed|undelivered|incoming|valid) (undelivered|incoming|message|e?mail)|synchronize \d email|messages.{1,10}suspend|report your account|(validation|configuration|service|mail) error|updating stage|blacklisted|(server|quota|quarantine|suspension|mail|upgrade) (alert|noti)|mailbox agreement|(system|security|server) (reasons|update|upgrade|alert)|system malfunction|due for an update|mailbox managment|automatically renew|.\d. pending|due for (upgrade|update|reconfirmation)|has been outdated|(due|about) to expire|not confirmed the email|(failed|couldn't be|refused to) deliver|temporarily suspend|failure to proceed|data plan limit|blocked from (sending|receiving)|sending unsolicited|\d\% full|confirm your request|security turned off|blocked or suspended|update warning|account .{1,9}?(restricted|closed)|old versions|mail malfunction|messages now queue|password expir|virus|expire on \d+\/|DNS Upgrad|encountered error|will be shut ?down|unauthorized (person|access)|prevent (further reject|loss of account)|avoid lose access|ensure safety|problem occurred|wrong password|suspicious sign.?in|\d quarantined? (e?mail|message|incoming)|deactivated tempor|low disk space|shutdown robot|suspended email|webmail security|account hijacked|will be suspended|will.{0,2}expire.{0,2}(today|soon)|IP below was used|password.{1,5}expires? today|server is totally full|account is almost full|suspicious activities|locked out of your account|login (interruption|problem)|automatic shut.?down|lose your contact|not receive new e?mail|deactivation of the email|Expired today|exceeded the limit|disruption of your email|message might be pre<V1>ented|mail delivery blocked|email gets locked|shut down on your account|refusal in updating your email|avoid being barred|losing (of )?your account|undelivered e?-?mail|SSL Port server error|refusal of email security|blocked access to your inbox/i
tflags __KAM_MAILBOX1 nosubject
#ACTION
- body __KAM_MAILBOX2 /(verify|update|upgrade|increase|validate|confirm|disable)"? (their|your)? {0,5}(address|password|<A1>ccount|(web-?)?mail|info|email|web ?mail|ownership)|(increase|upgrade) (my|your?) (inbox |email )?quota|quota (configuration|upgrade)|(increase disk|create some additional) storage|(setup|upgrade) (your )?mailbox|mail malfunction|click here to update|update account|validated within \d\d|deleted (automatically|in our server)|release .{0,40}(message|pending mess)|account to be close|remain active|termination of your account|choose what happens|blacklisting inactive|continue (using|the usage)|untrusted activity|(retrieve|review|view) (message|e?mail)|(verify|validate) (here|now)|reset below|verification (check|process)|email disk usage|auto extend your disk|confirm your (email|details)|mandetory file|retrieve here|expected to reactivate|keep your webmail|data will be lost|(block|release|review) (them|below)|view undelivered sent|reconfirm .{0,40}password|will be deactivat|avoid suspension|start the process|fake payment|(will be|automatically) cancel|mail verification|turn on (security|authentication)|Office 365-?Secure|an usual location|automatically delete|(retrieve|review|reload) (your )?(undelivered|pending)|view, release or delete|reload below|unblock (your )?incoming|rectify below|fix now|Company.Assigned Outlook|fix delivery|restore your roundcube|re-?authenticate (now|below)|manage your quarantine|manually fi|manually fix|review and take action|view (withheld|recent) (incoming|messages|e?mail)|use the button|reduce your mai<L1>|deliver recent mail|(use|using|keep) (current|same) password|change password|stop (this action|account removal)|fix your email|keep.{0,2}current.{0,2}password|verify login|apply update|deliver pending message|archive emails|initiate the upgrad/i
+ body __KAM_MAILBOX2 /(verify|update|upgrade|increase|validate|confirm|disable)"? (their|your)? {0,5}(address|password|<A1>ccount|(web-?)?mail|info|email|web ?mail|ownership|mailbox)|(increase|upgrade) (my|your?) (inbox |email )?quota|quota (configuration|upgrade)|(increase disk|create some additional) storage|(setup|upgrade) (your )?mailbox|mail malfunction|click here to update|update account|validated within \d\d|deleted (automatically|in our server)|release .{0,40}(message|pending mess)|account to be close|remain active|termination of your account|choose what happens|blacklisting inactive|continue (using|the usage)|untrusted activity|(retrieve|review|view) (message|e?mail)|(verify|validate) (it )?(here|now)|reset below|verification (check|process)|email disk usage|auto extend your disk|confirm your (email|details)|mandetory file|retrieve here|expected to reactivate|keep your webmail|data will be lost|(block|release|review) (them|below)|view undelivered sent|reconfirm .{0,40}password|will be deactivat|avoid suspension|start the process|fake payment|(will be|automatically) cancel|mail verification|turn on (security|authentication)|Office 365-?Secure|an usual location|automatically delete|(retrieve|review|reload) (your )?(undelivered|pending)|view, release or delete|reload below|unblock (your )?incoming|rectify below|fix now|Company.Assigned Outlook|fix delivery|restore your roundcube|re-?authenticate (now|below)|manage your quarantine|manually fi|manually fix|review and take action|view (your )?(pending|withheld|recent) (incoming|message|e?mail)|use the button|reduce your mai<L1>|deliver recent mail|(use|using|keep) (current|same) password|change password|stop (this action|account removal)|fix your email|(maintain|keep).{0,6}current.{0,2}(signing|password)|verify login|apply update|deliver pending message|archive emails|initiate the upgrad|(approve|continue with) the (current|same) password|free up space|quick re-?validation|cancel the request|prevent lock of account|back under the limit|update no<W1>|re<A1>ctiv<A1>te <A1>ccess|consider keeping your password|account will work effectively|portal to prompt delivery|open the attachment|Reload Email message|secure your account|authenticate account/i
tflags __KAM_MAILBOX2 nosubject
#SUBJECT
- header __KAM_MAILBOX3 Subject =~ /(mail|exceeded|insufficient) (storage|quota|upgrade)|(@.*?is|Inbox) almost full|(urgent|important|admin|last|suspension|server|account|administrator|system|disk ?usage|max size) (alert|rectification|attention|warning|noti)|needs to be upgraded|(incoming|pending|unreceived) +((e-?)?mail|document|message)|(del<I1>v<E1>ry|synchronization|processing) (problem|is blocked|failure|err<O1>r)|storage (is )?full|inbox full|(unread|upgrade|delayed) (messages|e?mail)|release your message|pending (new )?((e-?)?mail|message)|365 .{0,10} Update|new privacy policy|mandatory up|(sign in|Final|account|password|emails?) (closing|removal|update|upgrade|alert|notification|review)|quarantine|rejected|undelivered|(mailbox|limit|quota) .{0,10}exceeded|confirmation required|(mail|mailbox|account|password) (shutdown|verification|Veirification|Verfication|account)|(blocked|held) message|technology services|(server|mail|account).{1,8}err<O1>r|validat|messages.{1,10}(suspend|hinder)|account (is )?(blocked|limited)|please verify.{1,10}account|mail.{1,6}Notice|email account.{1,11}full|final warning|help\-?desk|mail ownership|point files|(d|r)e-?activation|delayed for \d+ (hour|day)|undeliverable|confirmation required|closure of.{1,15}(\@|account)|(password|mail) (has|will) expire|did you make|password (reset|due|recovery|expir)|recovery option|\d+ new mess|email activity|Immediate action|action required|avoid block|review recent e?mail|final +alert|storage limit|ver<I1>f<I1>cat<I1>on|\@.{1,25}notification|notification \d+\/\d+\/|notification for .{1,25}\@|New Sign-in|deliver.{1,4}(cancel|issue|error|fail)|Unsuccessful Email|Mail DNS|ICT Maintenance|sync err|mailer un.?delivery|unauthorized (person|access)|configuration setting|reminder +for|re-?authenticate|change in your ip|shutdown request|Failure.{0,2}Report|\d emails? suspended|error sync|(e-?mails?|messages) (are )?pending|\d \(?new\)? notice|new IP address|expir(y|ation) notif|reached their disk quota|webmail support|notification for|change.{0,30}account password now/i
+ header __KAM_MAILBOX3 Subject =~ /(mail|exceeded|insufficient) (storage|quota|upgrade)|(@.*?is|Inbox) almost full|(urgent|important|admin|last|suspension|server|account|administrator|system|disk ?usage|max size) (alert|rectification|attention|warning|noti)|needs to be upgraded|(incoming|pending|unreceived) +((e-?)?mail|document|message)|(del<I1>v<E1>ry|synchronization|processing) (problem|is blocked|failure|err<O1>r)|(mailbox|storage) (is )?full|(disc|disk|inbox) full|(unread|upgrade|delayed) (messages|e?mail)|release your message|pending (new )?((e-?)?mail|message)|365 .{0,10} Update|new privacy policy|mandatory up|(sign in|Final|account|password|emails?) (closing|removal|update|upgrade|alert|notification|review)|quarantine|rejected|undelivered|(mailbox|limit|quota) .{0,10}exceeded|confirmation required|(mail|mailbox|account|password) (error|shutdown|verification|Veirification|Verfication|account)|(blocked|held) message|technology services|(server|mail|account).{1,8}err<O1>r|validat|messages.{1,10}(suspend|hinder)|account (is )?(blocked|limited)|please verify.{1,10}account|mail.{1,6}Notice|email account.{1,11}full|final warning|help\-?desk|mail ownership|point files|(d|r)e-?activation|delayed for \d+ (hour|day)|undeliverable|confirmation required|closure of.{1,15}(\@|account)|(password|mail) (has|will) expire|did you make|password.(reset|due|recovery|expir)|recovery option|\d+ new mess|email activity|Immediate action|action required|avoid block|review recent e?mail|final +alert|storage (error|limit)|ver<I1>f<I1>cat<I1>on|\@.{1,25}notification|notification \d+\/\d+\/|notification for .{1,25}\@|New Sign-in|deliver.{1,4}(cancel|issue|error|fail)|Unsuccessful Email|Mail DNS|ICT Maintenance|sync err|mailer un.?delivery|unauthorized (person|access)|configuration setting|reminder +for|re-?authenticate|change in your ip|shutdown request|Failure.{0,2}Report|(mail delivery|\d emails?) suspended|error sync|(e-?mails?|messages) (are )?pending|\d \(?new\)? notice|new IP address|expir(y|ation) notif|reached their disk quota|webmail support|notification for|change.{0,30}account password now|(mail|mail-?box) termination|office? ?365 access|(Attention|urgent):? update (required|needed)|out of storage|quota (limit|reached)|access.{1,4}expire|renew your e?-?mail pass|mail protection update|e-?mail .{0,30}still pending|unauthorized (login|logging) attempt/i
- meta KAM_MAILBOX (__KAM_MAILBOX1 + __KAM_MAILBOX2 + __KAM_MAILBOX3 >=2) && (T_FREEMAIL_DOC_PDF + (KAM_SENDGRID + KAM_SENDGRID2 >= 1) + HTML_MIME_NO_HTML_TAG >= 2)
+ meta KAM_MAILBOX (__KAM_MAILBOX1 + __KAM_MAILBOX2 + __KAM_MAILBOX3 >=2) && (T_FREEMAIL_DOC_PDF + (KAM_SENDGRID + KAM_SENDGRID2 >= 1) + HTML_MIME_NO_HTML_TAG + T_HTML_ATTACH) >= 2
score KAM_MAILBOX 7.75
describe KAM_MAILBOX Mailbox Quota Phishing Scams
score KAM_MAILBOX3 3.75
endif
-#SHORTERNERS
meta KAM_SHORT (__KAM_SHORT + __KAM_TINYDOMAIN >= 1)
score KAM_SHORT 0.001
describe KAM_SHORT Use of a URL Shortener for very short URL
#URL SHORTENER - META RULE TO SEE IF URL SHORTENER IS IN USE - THANKS TO SHANE WILLIAMS and RW for HELP - More thanks to Giovanni Bechis
-uri __KAM_SHORT /^https?:\/\/(?:bit\.(do|ly)|tinyurl\.com|ow\.ly|is\.gd|tumblr\.com|formspring\.me|ff\.im|youtu\.be|tl\.gd|plurk\.com|migre\.me|j\.mp|cli\.gs|urlshortener\.teams\.microsoft\.com|goo\.gl|yfrog\.com|lnk\.ms|su\.pr|fb\.me|alturl\.com|wp\.me|ping\.fm|chatter\.com|post\.ly|twurl\.nl|tiny\.cc|4sq\.com|ustre\.am|short\.to|u\.nu|flic\.kr|budurl\.com|digg\.com|twitvid\.com|gowal\.la|om\.ly|justin\.tv|icio\.us|p\.gs|loopt\.us|tcrn\.ch|xrl\.us|wpo\.st|bkite\.com|t\.cn|t\.co|x\.co|hop\.kz|urla\.ru|fw\.to|back\.ly|justpaste\.it|l\.linklyhq\.com)\/[^\/]{3}\/?/
+ifplugin Mail::SpamAssassin::Plugin::DecodeShortURLs
+ if can(Mail::SpamAssassin::Plugin::DecodeShortURLs::has_short_url)
+ # use DecodeShortURLs plugin and disable __KAM_TINYDOMAIN
+ body __KAM_SHORT eval:short_url()
+ else
+ #OLDER RULE, SHOULD USE DecodeShortURLS and the kam_urlshorterners.cf which is more comprehensive than this.
+ uri __KAM_SHORT /^https?:\/\/(?:bit\.(do|ly)|tinyurl\.com|ow\.ly|is\.gd|tumblr\.com|formspring\.me|ff\.im|youtu\.be|tl\.gd|plurk\.com|migre\.me|j\.mp|cli\.gs|urlshortener\.teams\.microsoft\.com|goo\.gl|yfrog\.com|lnk\.ms|su\.pr|fb\.me|alturl\.com|wp\.me|ping\.fm|chatter\.com|post\.ly|twurl\.nl|tiny\.cc|4sq\.com|ustre\.am|short\.to|u\.nu|flic\.kr|budurl\.com|digg\.com|twitvid\.com|gowal\.la|om\.ly|justin\.tv|icio\.us|p\.gs|loopt\.us|tcrn\.ch|xrl\.us|wpo\.st|bkite\.com|t\.cn|t\.co|x\.co|hop\.kz|urla\.ru|fw\.to|back\.ly|justpaste\.it|l\.linklyhq\.com)\/[^\/]{3}\/?/
-# GENERIC RULE FOR TINY DOMAINS, WHICH WILL LIKELY BE URL SHORTENERS
-uri __KAM_TINYDOMAIN /https?:\/\/(?:[^\/]{1,4})\.(?!avg|ibm).{2,7}\//i
+ # GENERIC RULE FOR TINY DOMAINS, WHICH WILL LIKELY BE URL SHORTENERS
+ uri __KAM_TINYDOMAIN /https?:\/\/(?:[^\/]{1,4})\.(?!avg|ibm).{2,7}\//i
+
+ endif
+else
+ #OLDER RULE, SHOULD USE DecodeShortURLS and the kam_urlshorterners.cf which is more comprehensive than this.
+ uri __KAM_SHORT /^https?:\/\/(?:bit\.(do|ly)|tinyurl\.com|ow\.ly|is\.gd|tumblr\.com|formspring\.me|ff\.im|youtu\.be|tl\.gd|plurk\.com|migre\.me|j\.mp|cli\.gs|urlshortener\.teams\.microsoft\.com|goo\.gl|yfrog\.com|lnk\.ms|su\.pr|fb\.me|alturl\.com|wp\.me|ping\.fm|chatter\.com|post\.ly|twurl\.nl|tiny\.cc|4sq\.com|ustre\.am|short\.to|u\.nu|flic\.kr|budurl\.com|digg\.com|twitvid\.com|gowal\.la|om\.ly|justin\.tv|icio\.us|p\.gs|loopt\.us|tcrn\.ch|xrl\.us|wpo\.st|bkite\.com|t\.cn|t\.co|x\.co|hop\.kz|urla\.ru|fw\.to|back\.ly|justpaste\.it|l\.linklyhq\.com)\/[^\/]{3}\/?/
+ # GENERIC RULE FOR TINY DOMAINS, WHICH WILL LIKELY BE URL SHORTENERS
+ uri __KAM_TINYDOMAIN /https?:\/\/(?:[^\/]{1,4})\.(?!avg|ibm).{2,7}\//i
+endif
#POWER CHAIRS
body __KAM_POWER1 /hoveround/i
replace_tag S1 (?:s|[\xd0][\x85]|[\xf0\x9d\x98\x80]|[\xf0\x9d\x9a\x9c])
replace_tag T1 (?:t|[\xcf][\x84]|[\xf4]|[\xf0\x9d\x98\x81]|[\xf0\x9d\x9a\x9d])
replace_tag U1 (?:u|[\xf0\x9d\x98\x82])
-replace_tag V1 (?:v|[\xf0\x9d\x96\xb5])
-replace_tag W1 (?:w|[\xf0\x9d\x98\x84]|[\xf0\x9d\x9a\xa0])
+replace_tag V1 (?:v|[\xf0\x9d\x96\xb5]|[\xce][\xbd])
+replace_tag W1 (?:w|[\xf0\x9d\x98\x84]|[\xf0\x9d\x9a\xa0]|[\xd1\xa1])
replace_tag Y1 (?:y|[\xf0\x9d\x98\x80]|[\xf0\x9d\x9a\xa2])
replace_tag SPACE1 (?: |[\xc2\xa0])
#PAYPAL PHISH
header __KAM_PAYPAL3A From =~ /paypal/i
-header __KAM_PAYPAL3B From !~ /paypal.com(\.au)?>?$/i
-header __KAM_PAYPAL3C Subject =~ /your.paypal.account|Invoice PP/i
-body __KAM_PAYPAL3D /security.process|more.information|has.limitation|verify.your.information|bitcoin/i
+header __KAM_PAYPAL3B From !~ /paypal(\.com|\.com\.au|\.co\.uk)?>?$/i
+header __KAM_PAYPAL3C Subject =~ /your.paypal.account|Invoice PP|order Confirmation/i
+body __KAM_PAYPAL3D /security.process|more.information|has.limitation|verify.your.information|bitcoin|\d\d hours from today/i
meta KAM_PAYPAL3 ((__KAM_PAYPAL3A && __KAM_PAYPAL3B) + __KAM_PAYPAL3C + __KAM_PAYPAL3D + KAM_LAZY_DOMAIN_SECURITY >= 3)
score KAM_PAYPAL3 8.0
score KAM_ARREST 5.0
#MORE DIET SCAMS
-header __KAM_DIET2_1 From =~ /Coffee.?Bean|Fat.?Burning.?Hormone|Saffron|Lifestyle|burn.fat|slim/i
+header __KAM_DIET2_1 From =~ /Coffee.?Bean|Fat.?Burning.?Hormone|Saffron|Lifestyle|burn.fat|slim|dieting/i
header __KAM_DIET2_2 Subject =~ /diet|flatten your belly|calorie count|metabolism|lose the belly|belly flub/i
-body __KAM_DIET2_3 /secret to being skinny|doctors? are raving|testosterone|could be \d+ ?lbs? lighter|feeling chubby/i
+body __KAM_DIET2_3 /secret to being skinny|doctors? are raving|testosterone|could be \d+ ?lbs? lighter|feeling chubby|burn stubborn fat|lose weight fast/i
meta KAM_DIET2 (__KAM_DIET2_1 + __KAM_DIET2_2 + __KAM_DIET2_3 + KAM_INFOUSMEBIZ >=3)
describe KAM_DIET2 Diet Scams
score KAM_BILLS 4.0
#HOSE
-header __KAM_HOSE1 From =~ /Pocket Hose|gardening/i
-header __KAM_HOSE2 Subject =~ /(best|garden) hose|garden(ing)? and lawn|hose is ready/i
-body __KAM_HOSE3 /(pocket|garden|expandable).hose|(anti|never).kink|FLEX Technology/i
+header __KAM_HOSE1 From:name =~ /Pocket Hose|gardening|hydroeasy/i
+header __KAM_HOSE1A From:addr =~ /\.(house|co|store)$/i
+header __KAM_HOSE2 Subject =~ /(best|garden|expandable) hose|garden(ing)? and lawn|hose is ready|hose gets tangled/i
+body __KAM_HOSE3 /(pocket|garden|expandable).hose|(anti|never).kink|FLEX Technology|hydroeasy/i
+tflags __KAM_HOSE3 nosubject
-meta KAM_HOSE (__KAM_HOSE1 + __KAM_HOSE2 + __KAM_HOSE3 + (KAM_INFOUSMEBIZ + KAM_SOMETLD_ARE_BAD_TLD + DKIM_INVALID >=1) >= 3)
+meta KAM_HOSE (__KAM_HOSE1 + __KAM_HOSE2 + __KAM_HOSE3 + (__KAM_HOSE1A + KAM_INFOUSMEBIZ + KAM_SOMETLD_ARE_BAD_TLD + DKIM_INVALID >=1) >= 3)
describe KAM_HOSE Garden Hose Spams
score KAM_HOSE 4.5
score KAM_SCOOTER 4.75
#ANATABLOC
-header __KAM_ANATA1 From =~ /Anatabloc/i
+header __KAM_ANATA1 From:name =~ /Anatabloc|joint.?pain/i
header __KAM_ANATA2 Subject =~ /(back|joint) pain|arthritis/i
+body __KAM_ANATA3 /Doctor (expose|shock|fix)|conglomerates threatening/i
+tflags __KAM_ANATA3 nosubject
-meta KAM_ANATA (__KAM_ANATA1 + __KAM_ANATA2 >= 2)
+meta KAM_ANATA (__KAM_ANATA1 + __KAM_ANATA2 + __KAM_ANATA3 >= 3)
describe KAM_ANATA Drug Spam
score KAM_ANATA 4.5
#PREV MARK
header __KAM_MARK1 Subject =~ /[\[\<]ADV[\>\]]/i
-header __KAM_MARK2 Subject =~ /[\(\[\<\{\*]\s*(BULK|SPAM)\??\s*[\*\>\]\)\}]/i
+header __KAM_MARK2 Subject =~ /[\(\[\<\{\*]\s*(BULK|SPAM)\??\s*[\*\>\]\)\}]|\[\#+ ?SPAM\]/i
header __KAM_MARK3 Subject =~ /[\[\<\*]\s*VIRUS\s*[\*\>\]]/i
meta KAM_MARKADV (__KAM_MARK1 >= 1)
score KAM_FACEBOOKMAIL 8.0
#FAKE DHL/FEDEX/ETC
-body __KAM_FAKEDELIVER1 /courier couldn.?t make the delivery|Courier was unable to deliver|courier company was not able to deliver|memo.of.application|delivering.address|make.the.delivery|see.attached.file|attention.please|event.invitation|could not deliver|delivery.label|postal.noti(fication|ce)|parcels.(has|have).been.shipped|shipment.label.is.attached|confirm your shipping|view file in attach|unable to locate your address|stored in our local depot/i
+body __KAM_FAKE_DELIVER1 /courier couldn.?t make the delivery|Courier was unable to deliver|courier company was not able to deliver|memo.of.application|delivering.address|make.the.delivery|see.attached.file|attention.please|event.invitation|could not deliver|delivery.label|postal.noti(fication|ce)|parcels.(has|have).been.shipped|shipment.label.is.attached|confirm your shipping|view file in attach|unable to locate your address|stored in our local depot|delivery failed/i
-header __KAM_FAKEDELIVER2 Subject =~ /Invalid Address|shipping service|(ship|postal|delivery) notification|Delivery Failure|Delivery Information|Delivery status|Package Delivery|package is available for pickup|your.package.arrived|attention.please|delivery.problem|id.\d{6}|deliver.(your|the).parcel|shipping confirmation|confirm your address|shipment request|parcel is on hold/i
+header __KAM_FAKE_DELIVER2 Subject =~ /Invalid Address|shipping service|(ship|postal|delivery) notification|Delivery Failure|Delivery Information|Delivery status|(pending|Package) Delivery|package is available for pickup|your.package.(has.)?arrived|attention.please|delivery.(attempt|problem)|id.\d{6}|deliver.(your|the).parcel|shipping confirmation|confirm your address|shipment request|parcel is on hold/i
#DHL
-header __KAM_FAKEDELIVER3 From:name =~ /DHL/i
-header __KAM_FAKEDELIVER4 From:addr !~ /dhl.com/i
+header __KAM_FAKE_DELIVER3 From:name =~ /DHL/i
+header __KAM_FAKE_DELIVER4 From:addr !~ /dhl.com/i
+body __KAM_FAKE_DELIVER4A /dhl team/i
#FEDEX
-rawbody __KAM_FAKEDELIVER5 /Fed ?ex/i
-header __KAM_FAKEDELIVER6 From !~ /fedex.com/i
+rawbody __KAM_FAKE_DELIVER5 /Fed ?ex/i
+header __KAM_FAKE_DELIVER6 From !~ /fedex.com/i
#USPS
-body __KAM_FAKEDELIVER7 /USPS/i
-header __KAM_FAKEDELIVER8 From !~ /usps.com/i
+body __KAM_FAKE_DELIVER7 /USPS/i
+header __KAM_FAKE_DELIVER8 From !~ /usps.com/i
#CARGO
-body __KAM_FAKEDELIVER9 /CARGO/
-header __KAM_FAKEDELIVER10 From =~ /shipping|economy|priority/i
+body __KAM_FAKE_DELIVER9 /CARGO/
+header __KAM_FAKE_DELIVER10 From =~ /shipping|economy|priority/i
#USPS
-body __KAM_FAKEDELIVER11 /DPD/i
-header __KAM_FAKEDELIVER12 From !~ /dpd.com|dpd.co.uk/i
+body __KAM_FAKE_DELIVER11 /DPD/i
+header __KAM_FAKE_DELIVER12 From !~ /dpd.com|dpd.co.uk/i
-uri __KAM_FAKEDELIVER13 /(cdn.discordapp.com|wp-conten|wp\d+\.server)/i
+ #ODD DELIVERY
+uri __KAM_FAKE_DELIVER13 /(cdn\.discordapp\.com|wp-conten|wp\d+\.server|onedrive\.live\.com)/i
+body __KAM_FAKE_DELIVER13A /open the enclosed receipt|print the receipt/i
-meta KAM_FAKE_DELIVER (__KAM_FAKEDELIVER1 + __KAM_FAKEDELIVER2 + ((__KAM_FAKEDELIVER3 + __KAM_FAKEDELIVER4 >= 2) + (__KAM_FAKEDELIVER5 + __KAM_FAKEDELIVER6 >= 2) + (__KAM_FAKEDELIVER7 + __KAM_FAKEDELIVER8 >= 2) + (__KAM_FAKEDELIVER11 + __KAM_FAKEDELIVER12 >= 2) + (__KAM_FAKEDELIVER9 + __KAM_FAKEDELIVER10 >= 2) >= 1) + (HEADER_FROM_DIFFERENT_DOMAINS + SPF_SOFTFAIL + KAM_RAPTOR_ALTERED + __KAM_FAKEDELIVER13 >= 1) >= 3)
+meta KAM_FAKE_DELIVER (__KAM_FAKE_DELIVER1 + __KAM_FAKE_DELIVER2 + ((__KAM_FAKE_DELIVER3 + __KAM_FAKE_DELIVER4 + __KAM_FAKE_DELIVER4A >= 2) + (__KAM_FAKE_DELIVER5 + __KAM_FAKE_DELIVER6 >= 2) + (__KAM_FAKE_DELIVER7 + __KAM_FAKE_DELIVER8 >= 2) + (__KAM_FAKE_DELIVER11 + __KAM_FAKE_DELIVER12 >= 2) + (__KAM_FAKE_DELIVER9 + __KAM_FAKE_DELIVER10 >= 2) >= 1) + (HEADER_FROM_DIFFERENT_DOMAINS + SPF_SOFTFAIL + KAM_RAPTOR_ALTERED + __KAM_FAKE_DELIVER13 + __KAM_FAKE_DELIVER13A >= 1) >= 3)
describe KAM_FAKE_DELIVER Fake delivery notifications
score KAM_FAKE_DELIVER 6.25
-meta KAM_REALLY_FAKE_DELIVER (KAM_FAKE_DELIVER + KAM_RPTR_PASSED + (__KAM_FAKEDELIVER4 && __KAM_FAKEDELIVER6 && __KAM_FAKEDELIVER8) >= 3)
+meta KAM_REALLY_FAKE_DELIVER (KAM_FAKE_DELIVER + KAM_RPTR_PASSED + (__KAM_FAKE_DELIVER4 && __KAM_FAKE_DELIVER6 && __KAM_FAKE_DELIVER8) >= 3)
score KAM_REALLY_FAKE_DELIVER 2.5
describe KAM_REALLY_FAKE_DELIVER Definitely fake delivery notifications
score KAM_SOLAR2 1.9
#ASIAN BRIDE
-header __KAM_ASIAN1 Subject =~ /Asian Bride/i
-body __KAM_ASIAN2 /Adoring Asian/i
+header __KAM_ASIAN1 Subject =~ /(Chinese|Asian) (girl|Lad|Bride)|heart?beat when seeing her|such a beauty/i
+body __KAM_ASIAN2 /Adoring Asian|(\d\+|thousands of) Asian (women|Girls)|Asian Girlfriend|pics of hot|date an? asian|chat and cam/i
header __KAM_ASIAN3 From =~ /asian/i
meta KAM_ASIAN (__KAM_ASIAN1 + __KAM_ASIAN2 + __KAM_ASIAN3 >= 3)
-describe KAM_ASIAN Asian Bride Spams
+describe KAM_ASIAN Asian Bride/Dating Spams
score KAM_ASIAN 3.5
#DR OZ SPAM
describe KAM_GRABBAG2 Grabbag of Spams hitting EU domains and other indicators
#END DIABETES SPAM
-body __KAM_DIABETES1 /- - Diabetes News Today - -|diabetes.health|blood.sugar/i
-body __KAM_DIABETES2 /Reverse.{0,10}(Diabetes|type.2|type.1)|reverse.type.2|beat.type.2|conventional.medical/i
-header __KAM_DIABETES3 Subject =~ /End Diabetes|diabetes.association|every.diabetic/i
-
-meta KAM_DIABETES (__KAM_DIABETES1 + __KAM_DIABETES2 + __KAM_DIABETES3 >= 2)
+body __KAM_DIABETES1 /Diabetes News Today|diabetes.health|blood.sugar/i
+tflags __KAM_DIABETES1 nosubject
+body __KAM_DIABETES2 /Reverse.{0,10}(Diabetes|type.2|type.1)|reverse.type.2|beat.type.2|conventional.medical|doctors don't know|home solution|yellow spice|shocked doctors/i
+tflags __KAM_DIABETES2 nosubject
+header __KAM_DIABETES3 Subject =~ /End Diabetes|diabetes.association|every.diabetic|blood sugar|yellow spice/i
+header __KAM_DIABETES4 From:name =~ /blood.?sugar|clean.?cell/
+
+meta KAM_DIABETES (__KAM_DIABETES1 + __KAM_DIABETES2 + __KAM_DIABETES3 + __KAM_DIABETES4 >= 3)
score KAM_DIABETES 4.5
describe KAM_DIABETES End Diabetes Spam
#SPY CAMERAS, ETC
-header __KAM_SPY1 From =~ /spy.?camera/i
-header __KAM_SPY2 Subject =~ /spy.?camera/i
-body __KAM_SPY3 /spy.?camera.?system|hidden.spy.camera|valuables.safe|protect.your.children/i
+header __KAM_SPY1 From =~ /spy.?camera|smartcam/i
+header __KAM_SPY2 Subject =~ /spy.?camera|small size video/i
+body __KAM_SPY3 /spy.?camera.?system|hidden.spy.camera|valuables.safe|protect.your.children|smartcam pro/i
meta KAM_SPY (__KAM_SPY1 + __KAM_SPY2 + __KAM_SPY3 >= 3)
describe KAM_SPY Spy cameras and similar products
body __KAM_SPACEY_WORDS /a +v +e +n +u +e/i
# SPAM THAT WOULD LIKE TO INVEST IN YOUR COUNTRY
-header __KAM_INVESTCOUNTRY1 Subject =~ /Confidential Contract Proposal/i
-body __KAM_INVESTCOUNTRY2 /invest in your country/i
+header __KAM_INVESTCOUNTRY1 Subject =~ /Confidential Contract Proposal|invest in your country/i
+body __KAM_INVESTCOUNTRY2 /invest in your country|investment purpose/i
+tflags __KAM_INVESTCOUNTRY2 nosubject
-meta KAM_INVESTCOUNTRY (__KAM_INVESTCOUNTRY1 + __KAM_INVESTCOUNTRY2 >= 2)
-score KAM_INVESTCOUNTRY 3.5
+meta KAM_INVESTCOUNTRY (__KAM_INVESTCOUNTRY1 + __KAM_INVESTCOUNTRY2 + FREEMAIL_FROM >= 3)
+score KAM_INVESTCOUNTRY 4.5
describe KAM_INVESTCOUNTRY Spam for investing in your country
# SPAM FOR FLAGS
describe KAM_ZERODAY3 Another obvious zero-day malware
endif
+#MORE ACCOUNTING DANGEROUS SPAMS
+meta KAM_DANGEROUSXLS (__KAM_ZERODAY3 + KAM_OLEMACRO_ENCRYPTED + KAM_OLEMACRO_RENAME >= 3)
+describe KAM_DANGEROUSXLS Dangerous accounting emails with zero day payloads
+score KAM_DANGEROUSXLS 6.0
+
# FAMILY TREE SPAM
header __KAM_ANCESTOR1 From =~ /ancestry/i
header __KAM_ANCESTOR2 Subject =~ /free.family.tree|find.your.ancestor/i
score KAM_TINYURL 4.0
describe KAM_TINYURL Spammy urls that hide behind a link shortener
-# FAKE DROPBOX
-header __KAM_DROPBOX1 From =~ /dropbox/i
-header __KAM_DROPBOX2 From !~ /dropbox.com/i
-body __KAM_DROPBOX3 /shared.a.folder/i
+# FAKE DROPBOX - Adding _ to DROPBOX2 for badly configured ESS servers
+header __KAM_DROP_BOX1 From =~ /dropbox/i
+header __KAM_DROP_BOX2 From !~ /dropbox.com/i
+body __KAM_DROP_BOX3 /shared.a.folder/i
-meta KAM_DROPBOX (__KAM_DROPBOX1 + __KAM_DROPBOX2 + __KAM_DROPBOX3 >= 3)
+meta KAM_DROPBOX (__KAM_DROP_BOX1 + __KAM_DROP_BOX2 + __KAM_DROP_BOX3 >= 3)
score KAM_DROPBOX 4.5
describe KAM_DROPBOX Fake Dropbox emails
endif
# HEARING LOSS
-header __JMQ_HEARINGLOSS1 From =~ /hearing.?loss|deaf \& angry/i
-header __JMQ_HEARINGLOSS2 Subject =~ /reverse.your.hearing|hearing.loss|\d+.year.old.method|hearing.aids/i
-body __JMQ_HEARINGLOSS3 /going.crazy|natural.formula|restore.your.hearing|click.here.to.see|off.hearing.aid/i
+header __JMQ_HEARINGLOSS1 From =~ /hearing.?loss|deaf \& angry|sharpear/i
+header __JMQ_HEARINGLOSS2 Subject =~ /reverse.your.hearing|hearing.loss|\d+.year.old.method|hearing.aids|restore your hearing/i
+body __JMQ_HEARINGLOSS3 /going.crazy|natural.formula|restore.your.hearing|click.here.to.see|off.hearing.aid|mineral to restore/i
meta JMQ_HEARINGLOSS (__JMQ_HEARINGLOSS1 + __JMQ_HEARINGLOSS2 + __JMQ_HEARINGLOSS3 >= 3)
score JMQ_HEARINGLOSS 3.5
describe KAM_RUIN Bank Phishing Scam
#WEIGHT
-body __KAM_WEIGHT2_1 /goodbye to her waist|wild transformation|researcher has just discovered/i
-header __KAM_WEIGHT2_2 Subject =~ /looks \d+ overnight|no gym|fat hack/i
-body __KAM_WEIGHT2_3 /melissa mccarthy|now looks \d+|lbs every \d+ hour/i
-header __KAM_WEIGHT2_4 From:name =~ /eat this seed/i
+body __KAM_WEIGHT2_1 /goodbye to her waist|wild transformation|researcher has just discovered|weight loss is wrong/i
+tflags __KAM_WEIGHT2_1 nosubject
+header __KAM_WEIGHT2_2 Subject =~ /looks \d+ overnight|no gym|fat hack|doctor shocked/i
+body __KAM_WEIGHT2_3 /melissa mccarthy|now looks \d+|lbs every \d+ hour|(pound|lb)s in \d+ days|melts pounds/i
+header __KAM_WEIGHT2_4 From:name =~ /eat this seed|flat.?belly|big.?stomach/i
meta KAM_WEIGHT2 __KAM_WEIGHT2_1 + __KAM_WEIGHT2_2 + __KAM_WEIGHT2_3 + __KAM_WEIGHT2_4 >= 3
score KAM_WEIGHT2 5.25
score KAM_NUMSUBJECT 0.5
describe KAM_NUMSUBJECT Subject ends in numbers excluding current years
+ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
#BAD PDF
mimeheader KAM_MGCS Content-Type =~ /\+\-\+\-\+\-MGCS\-\+\-\+\-\+|[\xC2\xB7]pdf(?=)?"$/i
score KAM_MGCS 10.0
describe KAM_MGCS Boundary Content Indicative of Ratware
+endif
#NetWeaver - Disabled 7/24
#header KAM_NW X-Mailer =~ /SAP NetWeaver/i
body __KAM_PHISHCP3_1 /cPanel Cloud Service/
-meta KAM_PHISHCP3 (__KAM_TINYDOMAIN + __KAM_PHISHCP3_1 >=2)
+meta KAM_PHISHCP3 (KAM_SHORT + __KAM_PHISHCP3_1 >=2)
describe KAM_PHISHCP3 Fraudulent notices purporting to be from cPanel
score KAM_PHISHCP3 15.0
score KAM_FILE 4.5
#FUN SPAM RUN
-header __KAM_FUN1 From =~ /\.fun|\.icu|\.pro|\.stream|\.world|\.monster|\.best|\.store|\.surf|\.rest|\.bar|\.asia|\.casa|\.uno|\.london|\.info|\.cam|\.work|\.cyou>?$/i
-header __KAM_FUN1A From:name =~ /Bite Pro|Diabetes|Blood Sugar|Sugar Disease|Fish Oil|ultra ?boost|Gutter|time ?share|Affiliate|arctic ?blast|splash ?wine|date|fat ?loss|nutrisystem|Silver ?Single|Insta ?Heater|Canvas?Print/i
+header __KAM_FUN1 From =~ /\.fun|\.icu|\.pro|\.stream|\.world|\.monster|\.best|\.store|\.surf|\.rest|\.bar|\.asia|\.casa|\.uno|\.london|\.info|\.cam|\.work|\.cyou|\.quest>?$/i
+header __KAM_FUN1A From:name =~ /Bite Pro|Diabetes|Blood Sugar|Sugar Disease|Fish Oil|ultra ?boost|Gutter|time ?share|Affiliate|arctic ?blast|splash ?wine|date|fat ?loss|nutrisystem|Silver ?Single|Insta ?Heater|Canvas?Print|LeptiSense|Hello.?Fresh/i
-body __KAM_FUN2 /Addify Link|Kennett Pike|PetPlan|Newton Sq|1st Avenue|Jones Blvd|permanently opt-out from our all newsletters|(wish|prefer) (to not|not to|to) receive (these|future) (messages|emails)|purehealth|leave any time|too good to be true|try(ing)? this trick|doesn?'t like this update|(click here|wish) +to unsubscribe|send post-mail to|to be removed from receiving|to unsubscribe.+click|no longer like to receive|this is an advertisement/i
-body __KAM_FUN3 /This Offer is (only )?for (unite. state|USA)|(can ?not|won\'t|can\'t) see this image|visit the page below|Continue Reading|watch now|this is an ad|update preferences|click here now/i
+body __KAM_FUN2 /Addify Link|Kennett Pike|PetPlan|Newton Sq|1st Avenue|Jones Blvd|permanently opt-out from our all newsletters|(wish|prefer) (to not|not to|to) receive (these|future) (messages|emails)|purehealth|leave any time|too good to be true|try(ing)? this trick|doesn?'t like this update|(click here|wish) +to unsub|send post-mail to|to be removed from receiving|to unsubscribe.+click|no longer like to receive|this is an advertisement/i
+body __KAM_FUN3 /This Offer is (only )?for (unite. state|USA)|(can ?not|won\'t|can\'t|unable to) see (the|this)? ?image|visit the page below|Continue Reading|watch now|this is an ad|update preferences|click here now/i
uri __KAM_FUN3A /imgstore.host/i
#Subject
-header __KAM_FUN4 Subject =~ /Gutter|Assisted Living|Refi|rate|livewave|mortgage|E\.D\.|Single|Superfood|tax|protection|debt|mastercard|safety charge|supplement|pillow|Inogenone|learn a language|Roadside safety|carry a gun|minute survey|roofing Deals|fungus|insurance|pain|gold|hair|knife|warranty|reflexology|accufeet|keto|sound|heartburn|skincare|terminix|zippy|sneeze|healthcare|yoga|heal|jesus|virus|neuropathy|BP med|perfect vision|parasites|wine|willie nelson|InstaFresh|InstaSavings|carriers|CPAP|melt your belly|heart attack|power of plants|immunity|smart.?watch|fever|hearing aids|diabetes|gum problem|bad breath|fish oil|ultra ?boost|boost your internet|christmas list|(energy|cooling) (bill|cost)|time ?share|interstate move|vanishes pain|wine order|chat rooms|\d+ ?lbs|dementia|nutrisystem|personal plan|Printer Ink|america strong|perfect gifts|Someone Special|Insta ?heater|asian girls|audiobooks|memories into art/i
+header __KAM_FUN4 Subject =~ /Gutter|Assisted Living|Refinance|rate|livewave|mortgage|E\.D\.|Single|Superfood|tax|protection|debt|mastercard|safety charge|supplement|pillow|Inogenone|learn a language|Roadside safety|carry a gun|minute survey|roofing Deals|fungus|insurance|pain|gold|hair|knife|warranty|reflexology|accufeet|keto|sound|heartburn|skincare|terminix|zippy|sneeze|healthcare|yoga|heal|jesus|virus|neuropathy|BP med|perfect vision|parasites|wine|willie nelson|InstaFresh|InstaSavings|carriers|CPAP|melt your belly|heart attack|power of plants|immunity|smart.?watch|fever|hearing aids|diabetes|gum problem|bad breath|fish oil|ultra ?boost|boost your internet|christmas list|(energy|cooling) (bill|cost)|time ?share|interstate move|vanishes pain|wine order|chat rooms|\d+ ?lbs|dementia|nutrisystem|personal plan|Printer Ink|america strong|perfect gifts|Someone Special|Insta ?heater|asian girls|audiobooks|memories into art|losing weight|CBD Gum/i
#How many/How Soon
body __KAM_FUN5 /\d million americans|less than \d+ (weeks|days|hours)|temporary feeling|\d+ ?lbs|[\d+,]+ Asian babes/i
#miracle!
-body __KAM_FUN6 /finds the secret|new discovery|natural medicine|health channel|medicinal plants|simple tweak|doctors are shocked|mysterious liquid|massive mistake|scientifically shown/i
+body __KAM_FUN6 /finds the secret|new discovery|natural medicine|health channel|medicinal plants|simple tweak|doctors are shocked|mysterious liquid|massive mistake|scientifically shown|chronic pain/i
#what
body __KAM_FUN7 /nerve pain|poor vision|lasik|sleep deeper|smart.?watch|fever|hearing aids|diabetes|gum problem|blood sugar|sugar disease|bad breath|fish oil|ultra ?boost|soothing relief|older women|belly fat|reverse alzheimer|personal safety|gadget.?junk|Insta ?heater|need boyfriends|audiobooks/i
tflags __KAM_FUN7 nosubject
#BAD INVOICE SCAMS
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
- header __KAM_INVOICEPO1 Subject =~ /Invoice copies/i
- body __KAM_INVOICEPO2 /consignment/i
- body __KAM_INVOICEPO3 /invoice copies/i
- mimeheader __KAM_INVOICEPO4 Content-Type =~ /invoice copies.{0,100}\.html/i
+ header __KAM_INVOICEPO1 Subject =~ /Invoice copies|EFT +Process|signed +contract|inquiry|PO-\d+|payment receipt/i
+ body __KAM_INVOICEPO2 /invoice copies|EFT PROCESS|contract signed|attached enquiry|see the attached|Company name\:/i
+ tflags __KAM_INVOICEPO2 nosubject
- meta KAM_INVOICEPO (__KAM_INVOICEPO1 + __KAM_INVOICEPO2 + __KAM_INVOICEPO3 + __KAM_INVOICEPO4 >= 4)
- describe KAM_INVOICEPO Invoice scam
- score KAM_INVOICEPO 4.0
+ meta KAM_INVOICEPO (__KAM_INVOICEPO1 + __KAM_INVOICEPO2 + (KAM_HTMLINVOICE + KAM_HTMLINVOICE2 + T_HTML_ATTACH >= 1) >= 3)
+ describe KAM_INVOICEPO Invoice scam
+ score KAM_INVOICEPO 4.5
- mimeheader KAM_HTMLINVOICE Content-Type =~ /invoice.{0,100}\.html/i
+ mimeheader KAM_HTMLINVOICE Content-Type =~ /(remittance|invoice|contract|order|scan).{0,100}\.(rar|html?)/i
describe KAM_HTMLINVOICE Invoice scam
- score KAM_HTMLINVOICE 1.5
+ score KAM_HTMLINVOICE 3.0
mimeheader KAM_HTMLINVOICE2 Content-Type =~ /(order confirmation|po attachments.{0,100})\.xls\.html/i
describe KAM_HTMLINVOICE2 Invoice scam
- score KAM_HTMLINVOICE2 3.5
+ score KAM_HTMLINVOICE2 3.0
endif
# Spear phishing rules
#trusted_networks 38.124.232.0/24
# CONTACTS / LISTS
-header __KAM_LIST3_1 Subject =~ /Contacts|Visitor|Attendee|User|Professional|Meeting|Expo|Emails|Exhibit|Companies|trade ?show|marketing|retailer|list|outreach|customers|campaign|show|data|leaders|partnership|lead|(accou?nt|Contacts?|buyers?) (list|information)|install base|offices and clinics|healthcare|reach qualified buyers|potential prospects/i
+header __KAM_LIST3_1 Subject =~ /Contacts|Visitor|Attendee|User|Professional|Meeting|Expo|Emails|Exhibit|Companies|trade ?show|marketing|retailer|list|outreach|customers|campaign|show|data|leaders|partnership|lead|(accou?nt|Contacts?|buyers?) (list|information)|install base|offices and clinics|healthcare|reach qualified buyers|potential prospects|decision maker|reach out|target audience|revenue generation|(potential|reach your) client|Lead list|(list|lead) prospecting|market share/i
#title
-body __KAM_LIST3_2 /list services|email campaign|global marketing|(sales|event|campaign) manager|marketing (coordinator|campaign|manager|exec|project|team)|(lead|demand) generation|(business|Data|event) (analyst|coordinator)|(potential|professionals?|qualified) lead|(marketing|lead|attendees?|data|prospect|intelligence).(consultant|specialist)|(marketing|Business) Co-?ordinator|marketing and comm|inside sales|pre-?sales|global leads/i
+body __KAM_LIST3_2 /list services|email campaign|global marketing|(event|campaign|success|purchasing) mana?ger|(tradeshow|marketing) (coordinator|campaign|manager|exec|project|team)|(lead|demand) generation|(business|Data|event|research|marketing) (analyst|coordinator)|(potential|professionals?|qualified) lead|(business development|marketing|lead|attendees?|data|prospect|intelligence).(consultant|specialist)|(marketing|Business) Co-?ordinator|marketing and comm|inside sales|pre-?sales|global leads|data dep(t|artment)/i
tflags __KAM_LIST3_2 nosubject
#db for sale
-body __KAM_LIST3_3 /(information|data) field|verified email|(\d{4,8}|complete) (contact|details)|with email address|target geograph|counts and pric|decision maker|specific parameters|job titles|Specific lists|current attendee|each record|post show attendee|(attendees|counts)\:|(List|contacts|fields) (consists?|Contains?|includes?)|visitors and price|pricing, counts|information about the list|sample (file|record)|direct email|100\% populated|installed users|(compiled|selling) (a )?list|pricing and further|(validated|buy a) dataset|counts, pricing|procure the list|samples for (your )?review|attendees who might|decision.makers|samples and pricing|pricing details|demographics|few samples|database (organization|provider)|expense and count|(samples|counts?) and cost|multichannel marketing|count of email|users of the following|your marketing campaign|\d\d% on emails|acquiring the list|list of retailers/i
+body __KAM_LIST3_3 /(information|data) (count|field)|verified email|with email address|counts and pric|decision maker|specific parameters|job titles|Specific lists|current attendee|each record|post show attendee|(attendees|counts)\:|(List|contacts|fields) (consists?|Contains?|includes?)|visitors and price|pricing, counts|information about the list|sample (file|record)|direct email|100\% populated|installed users|(compiled|selling) (a )?list|pricing and further|(validated|buy a) dataset|counts, pricing|procure the list|samples for (your )?review|attendees who might|decision.makers|samples and pricing|pricing details|demographics|few samples|database (organization|provider)|expense and count|(samples|counts?) and cost|multichannel marketing|count of email|users of the following|your marketing campaign|\d\d% on emails|acquiring (email|the) list|list of retailers|decision maker mailing list|B2B list|acquiring email|contacts? list|interested in acquiring/i
tflags __KAM_LIST3_3 nosubject
#db what
-body __KAM_LIST3_4 /contacts and email|(visitors?|contacts?|attendee.?s?|users?) (contacts? |mailing )?(list|record|database)|end users|our lists|\d\+? (attendee|contact)|users? database|Opt-in email list|(professionals?|user'?s|attendees?) (contact|list)|not spammer|delegates|marketing (analyst|campaigns)|(complete|emailed) list|unique account|contacts\:|titles\:|business profiles|database of|list from USA|(complete|contact) (Name|information|details)|geography|target audience|list.database|data (intelligence|include)|emails, phone|marketing list|unlimited usage|target (attendees|audience|industry)|opt-?in (contact|emails)|offices and clinics|specialties\:|showcase our capabilit|share samples|recently compiled/i
+body __KAM_LIST3_4 /contacts and email|(visitors?|contacts?|attendee.?s?|users?) (contacts? |mailing )?(list|record|database)|end users|our lists|\d\+? (attendee|contact)|users? database|Opt-in email list|(professionals?|user'?s|attendees?) (contact|list)|not spammer|delegates|marketing (analyst|campaigns)|(complete|emailed) list|unique account|contacts\:|titles\:|business profiles|database of|list from USA|(complete|contact) (Name|information)|geography|list.database|data (intelligence|include)|emails, phone|marketing list|unlimited usage|target (audience|geograph|attendees|audience|industry)|opt-?in (contact|emails)|offices and clinics|specialties\:|showcase our capabilit|share samples|recently compiled|contact details|targeted market|marketing needs|Users of the following|100\% populated|b2b contact/i
tflags __KAM_LIST3_4 nosubject
meta KAM_LIST3 (__KAM_LIST3_1 + __KAM_LIST3_2 + __KAM_LIST3_3 + __KAM_LIST3_4 >= 4)
#NO SUBJ MATCH
meta KAM_LIST3_1 (KAM_LIST3 < 1) && (__KAM_LIST3_1 + __KAM_LIST3_2 + __KAM_LIST3_3 + __KAM_LIST3_4 >= 3)
describe KAM_LIST3_1 Likely Mailing List Purveyor Spam
-score KAM_LIST3_1 5.75
+score KAM_LIST3_1 6.75
#MONCLER
header __KAM_MONCLER1 Subject =~ /moncler/i
#
# Note: Certain glues like MailScanner will modify an email before testing. That will cause many DKIM failures. If you have a known broken system for DKIM like this, you should likely disable the plugin.
-
-ifplugin Mail::SpamAssassin::Plugin::AskDNS
- ifplugin Mail::SpamAssassin::Plugin::DKIM
- ifplugin Mail::SpamAssassin::Plugin::SPF
- askdns __KAM_DMARC_POLICY_NONE _dmarc._AUTHORDOMAIN_ TXT /^v=DMARC1;.*\bp=none;/
- askdns __KAM_DMARC_POLICY_QUAR _dmarc._AUTHORDOMAIN_ TXT /^v=DMARC1;.*\bp=quarantine;/
- askdns __KAM_DMARC_POLICY_REJECT _dmarc._AUTHORDOMAIN_ TXT /^v=DMARC1;.*\bp=reject;/
- askdns __KAM_DMARC_POLICY_DKIM_STRICT _dmarc._AUTHORDOMAIN_ TXT /^v=DMARC1;.*\badkim=s;/
-
- #Checks if either DKIM Passed with Alignment and the policy is strict or VALID and alignment didn't pass
- meta KAM_DMARC_STATUS !((DKIM_VALID_AU && __KAM_DMARC_POLICY_DKIM_STRICT) || (DKIM_VALID && !__KAM_DMARC_POLICY_DKIM_STRICT))
- describe KAM_DMARC_STATUS Test Rule for DKIM or SPF Failure with Strict Alignment
- score KAM_DMARC_STATUS 0.01
+ifplugin Mail::SpamAssassin::Plugin::Dmarc
+ ifplugin Mail::SpamAssassin::Plugin::AskDNS
+ ifplugin Mail::SpamAssassin::Plugin::DKIM
+ ifplugin Mail::SpamAssassin::Plugin::SPF
+ askdns __KAM_DMARC_POLICY_NONE _dmarc._AUTHORDOMAIN_ TXT /^v=DMARC1;.*\bp=none;/
+ askdns __KAM_DMARC_POLICY_QUAR _dmarc._AUTHORDOMAIN_ TXT /^v=DMARC1;.*\bp=quarantine;/
+ askdns __KAM_DMARC_POLICY_REJECT _dmarc._AUTHORDOMAIN_ TXT /^v=DMARC1;.*\bp=reject;/
+ askdns __KAM_DMARC_POLICY_DKIM_STRICT _dmarc._AUTHORDOMAIN_ TXT /^v=DMARC1;.*\badkim=s;/
+
+ #Checks if either DKIM Passed with Alignment and the policy is strict or VALID and alignment didn't pass
+ meta KAM_DMARC_STATUS !((DKIM_VALID_AU && __KAM_DMARC_POLICY_DKIM_STRICT) || (DKIM_VALID && !__KAM_DMARC_POLICY_DKIM_STRICT))
+ describe KAM_DMARC_STATUS Test Rule for DKIM or SPF Failure with Strict Alignment
+ score KAM_DMARC_STATUS 0.01
+
+ header KAM_DMARC_REJECT eval:check_dmarc_reject()
+ priority KAM_DMARC_REJECT 500
+ describe KAM_DMARC_REJECT DKIM has Failed or SPF has failed on the message and the domain has a DMARC reject policy
+ score KAM_DMARC_REJECT 3.0
+
+ header KAM_DMARC_QUARANTINE eval:check_dmarc_quarantine()
+ priority KAM_DMARC_QUARANTINE 500
+ describe KAM_DMARC_QUARANTINE DKIM has Failed or SPF has failed on the message and the domain has a DMARC quarantine policy
+ score KAM_DMARC_QUARANTINE 1.5
+
+ header KAM_DMARC_NONE eval:check_dmarc_none()
+ priority KAM_DMARC_NONE 500
+ describe KAM_DMARC_NONE DKIM has Failed or SPF has failed on the message and the domain has no DMARC policy
+ score KAM_DMARC_NONE 0.25
+ endif
+ endif
+ endif
+else
+ ifplugin Mail::SpamAssassin::Plugin::AskDNS
+ ifplugin Mail::SpamAssassin::Plugin::DKIM
+ ifplugin Mail::SpamAssassin::Plugin::SPF
+ askdns __KAM_DMARC_POLICY_NONE _dmarc._AUTHORDOMAIN_ TXT /^v=DMARC1;.*\bp=none;/
+ askdns __KAM_DMARC_POLICY_QUAR _dmarc._AUTHORDOMAIN_ TXT /^v=DMARC1;.*\bp=quarantine;/
+ askdns __KAM_DMARC_POLICY_REJECT _dmarc._AUTHORDOMAIN_ TXT /^v=DMARC1;.*\bp=reject;/
+ askdns __KAM_DMARC_POLICY_DKIM_STRICT _dmarc._AUTHORDOMAIN_ TXT /^v=DMARC1;.*\badkim=s;/
+
+ #Checks if either DKIM Passed with Alignment and the policy is strict or VALID and alignment didn't pass
+ meta KAM_DMARC_STATUS !((DKIM_VALID_AU && __KAM_DMARC_POLICY_DKIM_STRICT) || (DKIM_VALID && !__KAM_DMARC_POLICY_DKIM_STRICT))
+ describe KAM_DMARC_STATUS Test Rule for DKIM or SPF Failure with Strict Alignment
+ score KAM_DMARC_STATUS 0.01
- meta KAM_DMARC_REJECT !(DKIM_VALID_AU || SPF_PASS) && __KAM_DMARC_POLICY_REJECT
- describe KAM_DMARC_REJECT DKIM has Failed or SPF has failed on the message and the domain has a DMARC reject policy
- score KAM_DMARC_REJECT 3.0
-
- meta KAM_DMARC_QUARANTINE !(DKIM_VALID_AU || SPF_PASS) && __KAM_DMARC_POLICY_QUAR
- describe KAM_DMARC_QUARANTINE DKIM has Failed or SPF has failed on the message and the domain has a DMARC quarantine policy
- score KAM_DMARC_QUARANTINE 1.5
-
- meta KAM_DMARC_NONE !(DKIM_VALID_AU || SPF_PASS) && __KAM_DMARC_POLICY_NONE
- describe KAM_DMARC_NONE DKIM has Failed or SPF has failed on the message and the domain has no DMARC policy
- score KAM_DMARC_NONE 0.25
+ meta KAM_DMARC_REJECT !(DKIM_VALID_AU || SPF_PASS) && __KAM_DMARC_POLICY_REJECT
+ describe KAM_DMARC_REJECT DKIM has Failed or SPF has failed on the message and the domain has a DMARC reject policy
+ score KAM_DMARC_REJECT 3.0
+
+ meta KAM_DMARC_QUARANTINE !(DKIM_VALID_AU || SPF_PASS) && __KAM_DMARC_POLICY_QUAR
+ describe KAM_DMARC_QUARANTINE DKIM has Failed or SPF has failed on the message and the domain has a DMARC quarantine policy
+ score KAM_DMARC_QUARANTINE 1.5
+
+ meta KAM_DMARC_NONE !(DKIM_VALID_AU || SPF_PASS) && __KAM_DMARC_POLICY_NONE
+ describe KAM_DMARC_NONE DKIM has Failed or SPF has failed on the message and the domain has no DMARC policy
+ score KAM_DMARC_NONE 0.25
+ endif
endif
endif
endif
ifplugin Mail::SpamAssassin::Plugin::OLEVBMacro
# increase number of mime parts checked
olemacro_num_mime 10
+ # skip psd and other files from macro checks
+ olemacro_skip_exts (?:dotx|potx|ppsx|pptx|psd|sldx|xltx|oxps)$
if (version >= 3.0040005)
meta KAM_OLEMACRO_ZIP_BOT ( KAM_OLEMACRO_ZIP_PW && ( MISSING_MID || PDS_FROMNAME_SPOOFED_EMAIL ) )
describe KAM_OLEMACRO_ZIP_BOT OLE macro sent by a bot / ratware
score KAM_OLEMACRO_ZIP_BOT 5.0
+
+ if (version >= 4.000000)
+ if can(Mail::SpamAssassin::Plugin::OLEVBMacro::has_olemacro_redirect_uri)
+ body OLEMACRO_URI_TARGET eval:check_olemacro_redirect_uri()
+ describe OLEMACRO_URI_TARGET Malicious code inside the Office doc that tries to redirect to an uri
+ score OLEMACRO_URI_TARGET 0.001
+ endif
+ endif
+
endif
#Testing Rule for Subject Prefixes - See note 58397
score PCCC_HASHBL_HDR_EMAIL 0.5
priority PCCC_HASHBL_HDR_EMAIL -100
- #Move this to a file like 99_hashbl_settings.cf when KAM rules become a channel
- hashbl_acl_freemail 020.co.uk
- hashbl_acl_freemail 111mail.com
- hashbl_acl_freemail 123.com
- hashbl_acl_freemail 123box.net
- hashbl_acl_freemail 123india.com
- hashbl_acl_freemail 123iran.com
- hashbl_acl_freemail 123mail.cl
- hashbl_acl_freemail 123mail.org
- hashbl_acl_freemail 123qwe.co.uk
- hashbl_acl_freemail 126.com
- hashbl_acl_freemail 138mail.com
- hashbl_acl_freemail 139.com
- hashbl_acl_freemail 141.ro
- hashbl_acl_freemail 150mail.com
- hashbl_acl_freemail 150ml.com
- hashbl_acl_freemail 163.com
- hashbl_acl_freemail 16mail.com
- hashbl_acl_freemail 188.com
- hashbl_acl_freemail 189.cn
- hashbl_acl_freemail 1963chevrolet.com
- hashbl_acl_freemail 1963pontiac.com
- hashbl_acl_freemail 1netdrive.com
- hashbl_acl_freemail 1st-website.com
- hashbl_acl_freemail 1stpd.net
- hashbl_acl_freemail 2-mail.com
- hashbl_acl_freemail 20after4.com
- hashbl_acl_freemail 21cn.com
- hashbl_acl_freemail 24h.co.jp
- hashbl_acl_freemail 24horas.com
- hashbl_acl_freemail 263.net
- hashbl_acl_freemail 271soundview.com
- hashbl_acl_freemail 2die4.com
- hashbl_acl_freemail 2mydns.com
- hashbl_acl_freemail 2net.us
- hashbl_acl_freemail 3000.it
- hashbl_acl_freemail 37.com
- hashbl_acl_freemail 3ammagazine.com
- hashbl_acl_freemail 3email.com
- hashbl_acl_freemail 3xl.net
- hashbl_acl_freemail 4-music-today.com
- hashbl_acl_freemail 420email.com
- hashbl_acl_freemail 444.net
- hashbl_acl_freemail 4degreez.com
- hashbl_acl_freemail 4email.com
- hashbl_acl_freemail 4email.net
- hashbl_acl_freemail 4newyork.com
- hashbl_acl_freemail 4xn.de
- hashbl_acl_freemail 5005.lv
- hashbl_acl_freemail 50mail.com
- hashbl_acl_freemail 55mail.cc
- hashbl_acl_freemail 5fm.za.com
- hashbl_acl_freemail 5x2.de
- hashbl_acl_freemail 5x2.me
- hashbl_acl_freemail 6210.hu
- hashbl_acl_freemail 6sens.com
- hashbl_acl_freemail 702mail.co.za
- hashbl_acl_freemail 7110.hu
- hashbl_acl_freemail 8848.net
- hashbl_acl_freemail 8m.com
- hashbl_acl_freemail 8m.net
- hashbl_acl_freemail 8u8.com
- hashbl_acl_freemail 8u8.hk
- hashbl_acl_freemail 8u8.tw
- hashbl_acl_freemail 8x.com.br
- hashbl_acl_freemail 9.cn
- hashbl_acl_freemail a-teens.net
- hashbl_acl_freemail a-topmail.at
- hashbl_acl_freemail a.org.ua
- hashbl_acl_freemail abha.cc
- hashbl_acl_freemail about.com
- hashbl_acl_freemail abv.bg
- hashbl_acl_freemail acatperson.com
- hashbl_acl_freemail acceso.or.cr
- hashbl_acl_freemail access4less.net
- hashbl_acl_freemail accessgcc.com
- hashbl_acl_freemail accountant.com
- hashbl_acl_freemail acdcfan.com
- hashbl_acl_freemail acmemail.net
- hashbl_acl_freemail actingbiz.com
- hashbl_acl_freemail activist.com
- hashbl_acl_freemail adexec.com
- hashbl_acl_freemail adiga.com
- hashbl_acl_freemail adinet.com.uy
- hashbl_acl_freemail adogperson.com
- hashbl_acl_freemail adres.nl
- hashbl_acl_freemail advalvas.be
- hashbl_acl_freemail aeiou.pt
- hashbl_acl_freemail aeneasmail.com
- hashbl_acl_freemail africamail.com
- hashbl_acl_freemail afrik.com
- hashbl_acl_freemail afropoets.com
- hashbl_acl_freemail agadir.cc
- hashbl_acl_freemail aggies.com
- hashbl_acl_freemail ahaa.dk
- hashbl_acl_freemail ahsa.ws
- hashbl_acl_freemail aichi.com
- hashbl_acl_freemail aim.com
- hashbl_acl_freemail aircraftmail.com
- hashbl_acl_freemail airpost.net
- hashbl_acl_freemail aiutamici.com
- hashbl_acl_freemail ajman.cc
- hashbl_acl_freemail ajman.us
- hashbl_acl_freemail ajman.ws
- hashbl_acl_freemail aklan.com
- hashbl_acl_freemail aknet.kg
- hashbl_acl_freemail alabama.usa.com
- hashbl_acl_freemail alaska.usa.com
- hashbl_acl_freemail alavatotal.com
- hashbl_acl_freemail albafind.com
- hashbl_acl_freemail albaha.cc
- hashbl_acl_freemail albawaba.com
- hashbl_acl_freemail alburaq.net
- hashbl_acl_freemail aldeax.com
- hashbl_acl_freemail aldeax.com.ar
- hashbl_acl_freemail alex4all.com
- hashbl_acl_freemail alexandria.cc
- hashbl_acl_freemail algeria.com
- hashbl_acl_freemail algerie.cc
- hashbl_acl_freemail alice.it
- hashbl_acl_freemail alinto.com
- hashbl_acl_freemail aliyun.com
- hashbl_acl_freemail all4theskins.com
- hashbl_acl_freemail allergist.com
- hashbl_acl_freemail allhiphop.com
- hashbl_acl_freemail allmail.net
- hashbl_acl_freemail allsportsrock.com
- hashbl_acl_freemail alriyadh.cc
- hashbl_acl_freemail alskens.dk
- hashbl_acl_freemail altavista.se
- hashbl_acl_freemail altbox.org
- hashbl_acl_freemail alternativagratis.com
- hashbl_acl_freemail alum.com
- hashbl_acl_freemail alumni.com
- hashbl_acl_freemail alumnidirector.com
- hashbl_acl_freemail alunos.unipar.br
- hashbl_acl_freemail alvilag.hu
- hashbl_acl_freemail alwaysgrilling.com
- hashbl_acl_freemail alwaysinthekitchen.com
- hashbl_acl_freemail alwayswatchingmovies.com
- hashbl_acl_freemail alwayswatchingtv.com
- hashbl_acl_freemail amenworld.com
- hashbl_acl_freemail america.hm
- hashbl_acl_freemail americamail.com
- hashbl_acl_freemail amman.cc
- hashbl_acl_freemail amnetsal.com
- hashbl_acl_freemail amorous.com
- hashbl_acl_freemail ananzi.co.za
- hashbl_acl_freemail anatomicrock.com
- hashbl_acl_freemail anet.ne.jp
- hashbl_acl_freemail anfmail.com
- hashbl_acl_freemail angelfire.com
- hashbl_acl_freemail angelic.com
- hashbl_acl_freemail animail.net
- hashbl_acl_freemail animeone.com
- hashbl_acl_freemail aniverse.com
- hashbl_acl_freemail anjungcafe.com
- hashbl_acl_freemail another.com
- hashbl_acl_freemail antedoonsub.com
- hashbl_acl_freemail antwerpen.com
- hashbl_acl_freemail anunciador.net
- hashbl_acl_freemail anytimenow.com
- hashbl_acl_freemail aol.co.uk
- hashbl_acl_freemail aol.com
- hashbl_acl_freemail aon.at
- hashbl_acl_freemail apexmail.com
- hashbl_acl_freemail apollo.lv
- hashbl_acl_freemail appraiser.net
- hashbl_acl_freemail approvers.net
- hashbl_acl_freemail aprava.com
- hashbl_acl_freemail apropo.ro
- hashbl_acl_freemail aqaba.cc
- hashbl_acl_freemail arab.ir
- hashbl_acl_freemail arar.ws
- hashbl_acl_freemail archaeologist.com
- hashbl_acl_freemail arcor.de
- hashbl_acl_freemail arcticmail.com
- hashbl_acl_freemail argentina.com
- hashbl_acl_freemail arizona.usa.com
- hashbl_acl_freemail arkansas.usa.com
- hashbl_acl_freemail armmail.com
- hashbl_acl_freemail army.com
- hashbl_acl_freemail arnet.com.ar
- hashbl_acl_freemail aroma.com
- hashbl_acl_freemail arrl.net
- hashbl_acl_freemail artlover.com
- hashbl_acl_freemail aruba.it
- hashbl_acl_freemail asheville.com
- hashbl_acl_freemail asia-links.com
- hashbl_acl_freemail asia-mail.com
- hashbl_acl_freemail asia.com
- hashbl_acl_freemail asiamail.com
- hashbl_acl_freemail asiancutes.com
- hashbl_acl_freemail assala.com
- hashbl_acl_freemail assamesemail.com
- hashbl_acl_freemail asurfer.com
- hashbl_acl_freemail aswan.cc
- hashbl_acl_freemail asylum.com
- hashbl_acl_freemail atheist.com
- hashbl_acl_freemail atl.lv
- hashbl_acl_freemail atlas.cz
- hashbl_acl_freemail atlas.sk
- hashbl_acl_freemail atozasia.com
- hashbl_acl_freemail atreillou.com
- hashbl_acl_freemail att.ne.jp
- hashbl_acl_freemail att.net
- hashbl_acl_freemail au.ru
- hashbl_acl_freemail aubenin.com
- hashbl_acl_freemail auctioneer.net
- hashbl_acl_freemail auf-steroide.de
- hashbl_acl_freemail aufdrogen.de
- hashbl_acl_freemail aus-city.com
- hashbl_acl_freemail ausi.com
- hashbl_acl_freemail aussiemail.com.au
- hashbl_acl_freemail australiamail.com
- hashbl_acl_freemail autoindia.com
- hashbl_acl_freemail autopm.com
- hashbl_acl_freemail avasmail.com.mv
- hashbl_acl_freemail axarnet.com
- hashbl_acl_freemail ayna.com
- hashbl_acl_freemail azet.sk
- hashbl_acl_freemail b-boy.com
- hashbl_acl_freemail baalbeck.cc
- hashbl_acl_freemail babbalu.com
- hashbl_acl_freemail badgers.com
- hashbl_acl_freemail bahraini.cc
- hashbl_acl_freemail bakpaka.com
- hashbl_acl_freemail bakpaka.net
- hashbl_acl_freemail balochistan.org
- hashbl_acl_freemail baluch.com
- hashbl_acl_freemail bama-fan.com
- hashbl_acl_freemail bancora.net
- hashbl_acl_freemail banha.cc
- hashbl_acl_freemail bankersmail.com
- hashbl_acl_freemail barlick.net
- hashbl_acl_freemail barriolife.com
- hashbl_acl_freemail bartender.net
- hashbl_acl_freemail basketball-email.com
- hashbl_acl_freemail beabookworm.com
- hashbl_acl_freemail beagolfer.com
- hashbl_acl_freemail beahealthnut.com
- hashbl_acl_freemail beautifulboy.com
- hashbl_acl_freemail beeebank.com
- hashbl_acl_freemail beehive.org
- hashbl_acl_freemail been-there.com
- hashbl_acl_freemail beirut.com
- hashbl_acl_freemail believeinliberty.com
- hashbl_acl_freemail belizehome.com
- hashbl_acl_freemail belizemail.net
- hashbl_acl_freemail belizeweb.com
- hashbl_acl_freemail bellair.net
- hashbl_acl_freemail bellsouth.net
- hashbl_acl_freemail berlin.com
- hashbl_acl_freemail berlin.de
- hashbl_acl_freemail besser-als-du.de
- hashbl_acl_freemail bestcoolcars.com
- hashbl_acl_freemail bestjobcandidate.com
- hashbl_acl_freemail bestmail.us
- hashbl_acl_freemail besure2vote.com
- hashbl_acl_freemail bflomail.com
- hashbl_acl_freemail bgay.com
- hashbl_acl_freemail bgnmail.com
- hashbl_acl_freemail bharatmail.com
- hashbl_acl_freemail bicycledata.com
- hashbl_acl_freemail bicycling.com
- hashbl_acl_freemail big-orange.com
- hashbl_acl_freemail bigboss.cz
- hashbl_acl_freemail bigfoot.com
- hashbl_acl_freemail bigger.com
- hashbl_acl_freemail bigheavyworld.com
- hashbl_acl_freemail bigmailbox.com
- hashbl_acl_freemail bigmailbox.net
- hashbl_acl_freemail bigmir.net
- hashbl_acl_freemail bigpond.com
- hashbl_acl_freemail bigstring.com
- hashbl_acl_freemail bigtimecatperson.com
- hashbl_acl_freemail bigtimedogperson.com
- hashbl_acl_freemail bigtimereader.com
- hashbl_acl_freemail bigtimesportsfan.com
- hashbl_acl_freemail bikerheaven.net
- hashbl_acl_freemail bikerider.com
- hashbl_acl_freemail bikermail.com
- hashbl_acl_freemail billssite.com
- hashbl_acl_freemail bip.net
- hashbl_acl_freemail birdlover.com
- hashbl_acl_freemail bitwiser.com
- hashbl_acl_freemail biz.by
- hashbl_acl_freemail bizerte.cc
- hashbl_acl_freemail bizhosting.com
- hashbl_acl_freemail black-sea.ro
- hashbl_acl_freemail blackandchristian.com
- hashbl_acl_freemail blackburnmail.com
- hashbl_acl_freemail blackcity.net
- hashbl_acl_freemail blackglobalnetwork.net
- hashbl_acl_freemail blackvault.com
- hashbl_acl_freemail blackvoices.com
- hashbl_acl_freemail blader.com
- hashbl_acl_freemail blida.info
- hashbl_acl_freemail blink182.net
- hashbl_acl_freemail blue.devils.com
- hashbl_acl_freemail bluebottle.com
- hashbl_acl_freemail bluemail.ch
- hashbl_acl_freemail blumail.org
- hashbl_acl_freemail blvds.com
- hashbl_acl_freemail bmx.lv
- hashbl_acl_freemail bmxtrix.com
- hashbl_acl_freemail boardermail.com
- hashbl_acl_freemail boarderzone.com
- hashbl_acl_freemail boatnerd.com
- hashbl_acl_freemail bol.com.br
- hashbl_acl_freemail bolando.com
- hashbl_acl_freemail bolbox.com
- hashbl_acl_freemail bollywood2000.com
- hashbl_acl_freemail bollywoodz.com
- hashbl_acl_freemail bombka.dyn.pl
- hashbl_acl_freemail bonbon.net
- hashbl_acl_freemail bongmail.com
- hashbl_acl_freemail boom.com
- hashbl_acl_freemail bootmail.com
- hashbl_acl_freemail bostonoffice.com
- hashbl_acl_freemail bowl.com
- hashbl_acl_freemail box.az
- hashbl_acl_freemail boxbg.com
- hashbl_acl_freemail boxemail.com
- hashbl_acl_freemail brain.com.pk
- hashbl_acl_freemail brainsurfer.de
- hashbl_acl_freemail brasilia.net
- hashbl_acl_freemail bravanese.com
- hashbl_acl_freemail brazilmail.com
- hashbl_acl_freemail brazilmail.com.br
- hashbl_acl_freemail breathe.com
- hashbl_acl_freemail brestonline.com
- hashbl_acl_freemail brew-master.com
- hashbl_acl_freemail brew-meister.com
- hashbl_acl_freemail brfree.com.br
- hashbl_acl_freemail brujula.net
- hashbl_acl_freemail bsdmail.com
- hashbl_acl_freemail btcc.org
- hashbl_acl_freemail buffaloes.com
- hashbl_acl_freemail bulgaria.com
- hashbl_acl_freemail bulldogs.com
- hashbl_acl_freemail bumerang.ro
- hashbl_acl_freemail buraydah.cc
- hashbl_acl_freemail burntmail.com
- hashbl_acl_freemail butch-femme.net
- hashbl_acl_freemail butch-femme.org
- hashbl_acl_freemail buzy.com
- hashbl_acl_freemail buzzjakkerz.com
- hashbl_acl_freemail byke.com
- hashbl_acl_freemail c-box.cz
- hashbl_acl_freemail c3.hu
- hashbl_acl_freemail c4.com
- hashbl_acl_freemail cadinfo.net
- hashbl_acl_freemail calcfacil.com.br
- hashbl_acl_freemail calcware.org
- hashbl_acl_freemail california.usa.com
- hashbl_acl_freemail californiamail.com
- hashbl_acl_freemail calle22.com
- hashbl_acl_freemail callnetuk.com
- hashbl_acl_freemail camaroclubsweden.com
- hashbl_acl_freemail cameroon.cc
- hashbl_acl_freemail canada-11.com
- hashbl_acl_freemail canada.com
- hashbl_acl_freemail canal21.com
- hashbl_acl_freemail cannabismail.com
- hashbl_acl_freemail canoemail.com
- hashbl_acl_freemail capsfanatic.com
- hashbl_acl_freemail capshockeyfan.com
- hashbl_acl_freemail capsred.com
- hashbl_acl_freemail car-nut.net
- hashbl_acl_freemail caramail.com
- hashbl_acl_freemail cardblvd.com
- hashbl_acl_freemail care-mail.com
- hashbl_acl_freemail care2.com
- hashbl_acl_freemail caress.com
- hashbl_acl_freemail carioca.net
- hashbl_acl_freemail cash4u.com
- hashbl_acl_freemail cashette.com
- hashbl_acl_freemail casino.com
- hashbl_acl_freemail casinomail.com
- hashbl_acl_freemail cat-person.com
- hashbl_acl_freemail cataloniamail.com
- hashbl_acl_freemail catalunyamail.com
- hashbl_acl_freemail cataz.com
- hashbl_acl_freemail catcha.com
- hashbl_acl_freemail catholic.org
- hashbl_acl_freemail caths.co.uk
- hashbl_acl_freemail catlover.com
- hashbl_acl_freemail catlovers.com
- hashbl_acl_freemail catpeoplerule.com
- hashbl_acl_freemail caxess.net
- hashbl_acl_freemail cbrmail.com
- hashbl_acl_freemail cc.lv
- hashbl_acl_freemail cemelli.com
- hashbl_acl_freemail centoper.it
- hashbl_acl_freemail centralpets.com
- hashbl_acl_freemail centrum.cz
- hashbl_acl_freemail centrum.sk
- hashbl_acl_freemail centurylink.net
- hashbl_acl_freemail cercaziende.it
- hashbl_acl_freemail certifiedbitches.com
- hashbl_acl_freemail cgac.es
- hashbl_acl_freemail chaiyo.com
- hashbl_acl_freemail chaiyomail.com
- hashbl_acl_freemail championboxing.com
- hashbl_acl_freemail chance2mail.com
- hashbl_acl_freemail channelonetv.com
- hashbl_acl_freemail charter.net
- hashbl_acl_freemail chat-with-me.com
- hashbl_acl_freemail chattown.com
- hashbl_acl_freemail chatway.com
- hashbl_acl_freemail cheatasrule.com
- hashbl_acl_freemail checkitmail.at
- hashbl_acl_freemail cheerful.com
- hashbl_acl_freemail chef.net
- hashbl_acl_freemail chelny.com
- hashbl_acl_freemail chemist.com
- hashbl_acl_freemail cheshiremail.com
- hashbl_acl_freemail chewiemail.com
- hashbl_acl_freemail chil-e.com
- hashbl_acl_freemail chillaxer.de
- hashbl_acl_freemail chillimail.com
- hashbl_acl_freemail chillymail.com
- hashbl_acl_freemail china.com
- hashbl_acl_freemail chinamail.com
- hashbl_acl_freemail christianmail.org
- hashbl_acl_freemail ciaoweb.it
- hashbl_acl_freemail cine.com
- hashbl_acl_freemail ciphercom.net
- hashbl_acl_freemail circlemail.com
- hashbl_acl_freemail cititrustbank1.cjb.net
- hashbl_acl_freemail citromail.hu
- hashbl_acl_freemail citynetusa.com
- hashbl_acl_freemail ciudad.com.ar
- hashbl_acl_freemail claramail.com
- hashbl_acl_freemail classicmail.co.za
- hashbl_acl_freemail classprod.com
- hashbl_acl_freemail classycouples.com
- hashbl_acl_freemail clerk.com
- hashbl_acl_freemail cliffhanger.com
- hashbl_acl_freemail clix.pt
- hashbl_acl_freemail close2you.net
- hashbl_acl_freemail clovermail.net
- hashbl_acl_freemail clubmember.org
- hashbl_acl_freemail cluemail.com
- hashbl_acl_freemail clujnapoca.ro
- hashbl_acl_freemail collector.org
- hashbl_acl_freemail collegeclub.com
- hashbl_acl_freemail colombia.com
- hashbl_acl_freemail colorado.usa.com
- hashbl_acl_freemail columnist.com
- hashbl_acl_freemail comcast.net
- hashbl_acl_freemail comfortable.com
- hashbl_acl_freemail comic.com
- hashbl_acl_freemail company.org.ua
- hashbl_acl_freemail compaqnet.fr
- hashbl_acl_freemail compuserve.com
- hashbl_acl_freemail computer.net
- hashbl_acl_freemail computer4u.com
- hashbl_acl_freemail computermail.net
- hashbl_acl_freemail computhouse.com
- hashbl_acl_freemail conevyt.org.mx
- hashbl_acl_freemail congiu.net
- hashbl_acl_freemail connect4free.net
- hashbl_acl_freemail connecticut.usa.com
- hashbl_acl_freemail consultant.com
- hashbl_acl_freemail contractor.net
- hashbl_acl_freemail coolgoose.com
- hashbl_acl_freemail coolkiwi.com
- hashbl_acl_freemail coollist.com
- hashbl_acl_freemail coolmail.com
- hashbl_acl_freemail coolmail.net
- hashbl_acl_freemail coolmail.ru
- hashbl_acl_freemail coolsend.com
- hashbl_acl_freemail coolshit.com
- hashbl_acl_freemail coolsite.net
- hashbl_acl_freemail cooltoad.com
- hashbl_acl_freemail cooperation.net
- hashbl_acl_freemail copacabana.com
- hashbl_acl_freemail copticmail.com
- hashbl_acl_freemail corporateattorneys.com
- hashbl_acl_freemail corporation.net
- hashbl_acl_freemail corpusmail.com
- hashbl_acl_freemail correios.net.br
- hashbl_acl_freemail correomagico.com
- hashbl_acl_freemail cosmo.com
- hashbl_acl_freemail cosmosurf.net
- hashbl_acl_freemail cougars.com
- hashbl_acl_freemail counsellor.com
- hashbl_acl_freemail count.com
- hashbl_acl_freemail countrybass.com
- hashbl_acl_freemail couple.com
- hashbl_acl_freemail coxinet.net
- hashbl_acl_freemail crazy4baseball.com
- hashbl_acl_freemail crazy4homeimprovement.com
- hashbl_acl_freemail crazy4mail.com
- hashbl_acl_freemail crazyaboutfilms.net
- hashbl_acl_freemail crazycarfan.com
- hashbl_acl_freemail crazyforemail.com
- hashbl_acl_freemail crazymoviefan.com
- hashbl_acl_freemail criticalpath.net
- hashbl_acl_freemail critterpost.com
- hashbl_acl_freemail crosspaths.net
- hashbl_acl_freemail crosswinds.net
- hashbl_acl_freemail cryingmail.com
- hashbl_acl_freemail cs.com
- hashbl_acl_freemail csucsposta.hu
- hashbl_acl_freemail cumbriamail.com
- hashbl_acl_freemail curio-city.com
- hashbl_acl_freemail custmail.com
- hashbl_acl_freemail cutey.com
- hashbl_acl_freemail cwazy.co.uk
- hashbl_acl_freemail cwazy.net
- hashbl_acl_freemail cww.de
- hashbl_acl_freemail cyber-wizard.com
- hashbl_acl_freemail cyberaccess.com.pk
- hashbl_acl_freemail cyberdude.com
- hashbl_acl_freemail cybergal.com
- hashbl_acl_freemail cybergirls.dk
- hashbl_acl_freemail cyberguys.dk
- hashbl_acl_freemail cyberkriminell.de
- hashbl_acl_freemail cybernet.it
- hashbl_acl_freemail cyberservices.com
- hashbl_acl_freemail cyberunlimited.org
- hashbl_acl_freemail cycledata.com
- hashbl_acl_freemail cymail.net
- hashbl_acl_freemail dabsol.net
- hashbl_acl_freemail dada.net
- hashbl_acl_freemail dadanet.it
- hashbl_acl_freemail dailypioneer.com
- hashbl_acl_freemail dallasmail.com
- hashbl_acl_freemail damuc.org.br
- hashbl_acl_freemail danneben.so
- hashbl_acl_freemail dansegulvet.com
- hashbl_acl_freemail darkfear.com
- hashbl_acl_freemail darkforces.com
- hashbl_acl_freemail darkhorsefan.net
- hashbl_acl_freemail data54.com
- hashbl_acl_freemail daum.net
- hashbl_acl_freemail davegracey.com
- hashbl_acl_freemail dayzers.com
- hashbl_acl_freemail dbmail.com
- hashbl_acl_freemail dbzmail.com
- hashbl_acl_freemail dcemail.com
- hashbl_acl_freemail dcsi.net
- hashbl_acl_freemail deacons.com
- hashbl_acl_freemail deadlymob.org
- hashbl_acl_freemail deal-maker.com
- hashbl_acl_freemail dearriba.com
- hashbl_acl_freemail degoo.com
- hashbl_acl_freemail delajaonline.org
- hashbl_acl_freemail delaware.usa.com
- hashbl_acl_freemail delfi.lv
- hashbl_acl_freemail delhimail.com
- hashbl_acl_freemail deliveryman.com
- hashbl_acl_freemail demon.deacons.com
- hashbl_acl_freemail denmark.ir
- hashbl_acl_freemail descriptivemail.com
- hashbl_acl_freemail desertonline.com
- hashbl_acl_freemail desidrivers.com
- hashbl_acl_freemail deskpilot.com
- hashbl_acl_freemail despammed.com
- hashbl_acl_freemail detik.com
- hashbl_acl_freemail devils.com
- hashbl_acl_freemail dexara.net
- hashbl_acl_freemail dhahran.cc
- hashbl_acl_freemail dhmail.net
- hashbl_acl_freemail dhofar.cc
- hashbl_acl_freemail di-ve.com
- hashbl_acl_freemail didamail.com
- hashbl_acl_freemail differentmail.com
- hashbl_acl_freemail digitaltrue.com
- hashbl_acl_freemail dino.lv
- hashbl_acl_freemail diplomats.com
- hashbl_acl_freemail direccion.com
- hashbl_acl_freemail director-general.com
- hashbl_acl_freemail diri.com
- hashbl_acl_freemail dirtythird.com
- hashbl_acl_freemail discardmail.com
- hashbl_acl_freemail disciples.com
- hashbl_acl_freemail discofan.com
- hashbl_acl_freemail discoverymail.net
- hashbl_acl_freemail disinfo.net
- hashbl_acl_freemail disposable.com
- hashbl_acl_freemail djibouti.cc
- hashbl_acl_freemail djmillenium.com
- hashbl_acl_freemail dmailman.com
- hashbl_acl_freemail dnsmadeeasy.com
- hashbl_acl_freemail do.net.ar
- hashbl_acl_freemail doctor.com
- hashbl_acl_freemail dodgeit.com
- hashbl_acl_freemail dog-person.com
- hashbl_acl_freemail doglover.com
- hashbl_acl_freemail dogmail.co.uk
- hashbl_acl_freemail dogpeoplerule.com
- hashbl_acl_freemail doityourself.com
- hashbl_acl_freemail domaindiscover.com
- hashbl_acl_freemail domainmanager.com
- hashbl_acl_freemail dominican.cc
- hashbl_acl_freemail doneasy.com
- hashbl_acl_freemail dontexist.org
- hashbl_acl_freemail dopefiends.com
- hashbl_acl_freemail doramail.com
- hashbl_acl_freemail dores.com
- hashbl_acl_freemail dostmail.com
- hashbl_acl_freemail dot5hosting.com
- hashbl_acl_freemail dotcom.fr
- hashbl_acl_freemail dotnow.com
- hashbl_acl_freemail dott.it
- hashbl_acl_freemail doubt.com
- hashbl_acl_freemail dplanet.ch
- hashbl_acl_freemail dr-dre.com
- hashbl_acl_freemail dr.com
- hashbl_acl_freemail draac.com
- hashbl_acl_freemail dragoncon.net
- hashbl_acl_freemail dragonfans.com
- hashbl_acl_freemail drakmail.net
- hashbl_acl_freemail dreamstop.com
- hashbl_acl_freemail dropzone.com
- hashbl_acl_freemail dserver.org
- hashbl_acl_freemail dubaiwebcity.com
- hashbl_acl_freemail dublin.com
- hashbl_acl_freemail dublin.ie
- hashbl_acl_freemail dustdevil.com
- hashbl_acl_freemail dutchmail.com
- hashbl_acl_freemail dynamitemail.com
- hashbl_acl_freemail dyndns.org
- hashbl_acl_freemail e-apollo.lv
- hashbl_acl_freemail e-hkma.com
- hashbl_acl_freemail e-mail.am
- hashbl_acl_freemail e-mail.cz
- hashbl_acl_freemail e-mail.ph
- hashbl_acl_freemail e-mailanywhere.com
- hashbl_acl_freemail e-milio.com
- hashbl_acl_freemail e-tapaal.com
- hashbl_acl_freemail e-webtec.com
- hashbl_acl_freemail earthalliance.com
- hashbl_acl_freemail earthling.net
- hashbl_acl_freemail eastmail.com
- hashbl_acl_freemail eastrolog.com
- hashbl_acl_freemail easy-pages.com
- hashbl_acl_freemail easy.com
- hashbl_acl_freemail easydoesit.com
- hashbl_acl_freemail easyinfomail.co.za
- hashbl_acl_freemail easypeasy.com
- hashbl_acl_freemail echina.com
- hashbl_acl_freemail eclub.lv
- hashbl_acl_freemail ecn.org
- hashbl_acl_freemail ecplaza.net
- hashbl_acl_freemail edsamail.com.ph
- hashbl_acl_freemail educacao.te.pt
- hashbl_acl_freemail edumail.co.za
- hashbl_acl_freemail eeism.com
- hashbl_acl_freemail ego.co.th
- hashbl_acl_freemail egypt.ir
- hashbl_acl_freemail egypt.net
- hashbl_acl_freemail eircom.net
- hashbl_acl_freemail ekolay.net
- hashbl_acl_freemail elforotv.com.ar
- hashbl_acl_freemail elitemail.org
- hashbl_acl_freemail elsitio.com
- hashbl_acl_freemail eltimon.com
- hashbl_acl_freemail elvis.com
- hashbl_acl_freemail elvisfan.com
- hashbl_acl_freemail email.bg
- hashbl_acl_freemail email.com
- hashbl_acl_freemail email.com.br
- hashbl_acl_freemail email.cz
- hashbl_acl_freemail email.it
- hashbl_acl_freemail email.lu
- hashbl_acl_freemail email.lviv.ua
- hashbl_acl_freemail email.nu
- hashbl_acl_freemail email.ro
- hashbl_acl_freemail email.si
- hashbl_acl_freemail email2me.com
- hashbl_acl_freemail emailacc.com
- hashbl_acl_freemail emailaccount.com
- hashbl_acl_freemail emailaddresses.com
- hashbl_acl_freemail emailchoice.com
- hashbl_acl_freemail emailcorner.net
- hashbl_acl_freemail emailengine.net
- hashbl_acl_freemail emailengine.org
- hashbl_acl_freemail emailfast.com
- hashbl_acl_freemail emailgaul.com
- hashbl_acl_freemail emailgroups.net
- hashbl_acl_freemail emailhut.net
- hashbl_acl_freemail emailn.de
- hashbl_acl_freemail emailpinoy.com
- hashbl_acl_freemail emailplanet.com
- hashbl_acl_freemail emailplus.org
- hashbl_acl_freemail emailuser.net
- hashbl_acl_freemail ematic.com
- hashbl_acl_freemail embarqmail.com
- hashbl_acl_freemail embroideryforums.com
- hashbl_acl_freemail eml.cc
- hashbl_acl_freemail emoka.ro
- hashbl_acl_freemail emptymail.com
- hashbl_acl_freemail enel.net
- hashbl_acl_freemail enelpunto.net
- hashbl_acl_freemail engineer.com
- hashbl_acl_freemail england.com
- hashbl_acl_freemail englandmail.com
- hashbl_acl_freemail enterate.com.ar
- hashbl_acl_freemail entryweb.it
- hashbl_acl_freemail entusiastisk.com
- hashbl_acl_freemail enusmail.com
- hashbl_acl_freemail envirocitizen.com
- hashbl_acl_freemail epatra.com
- hashbl_acl_freemail epix.net
- hashbl_acl_freemail epomail.com
- hashbl_acl_freemail epost.de
- hashbl_acl_freemail eprompter.com
- hashbl_acl_freemail eqqu.com
- hashbl_acl_freemail eramail.co.za
- hashbl_acl_freemail eresmas.com
- hashbl_acl_freemail eriga.lv
- hashbl_acl_freemail eritrea.cc
- hashbl_acl_freemail ertelecom.ru
- hashbl_acl_freemail escapeartist.com
- hashbl_acl_freemail esde-s.org
- hashbl_acl_freemail esfera.cl
- hashbl_acl_freemail estadao.com.br
- hashbl_acl_freemail etllao.com
- hashbl_acl_freemail euromail.net
- hashbl_acl_freemail europe.com
- hashbl_acl_freemail europemail.com
- hashbl_acl_freemail euroseek.com
- hashbl_acl_freemail euskalmail.com
- hashbl_acl_freemail evafan.com
- hashbl_acl_freemail everyday.com.kh
- hashbl_acl_freemail everymail.net
- hashbl_acl_freemail everyone.net
- hashbl_acl_freemail excite.co.uk
- hashbl_acl_freemail excite.com
- hashbl_acl_freemail execs.com
- hashbl_acl_freemail execs2k.com
- hashbl_acl_freemail executivemail.co.za
- hashbl_acl_freemail expertrenovator.com
- hashbl_acl_freemail expn.com
- hashbl_acl_freemail expressivemail.com
- hashbl_acl_freemail expressmail.dk
- hashbl_acl_freemail ezilon.com
- hashbl_acl_freemail ezrs.com
- hashbl_acl_freemail ezsweeps.com
- hashbl_acl_freemail f-m.fm
- hashbl_acl_freemail facilmail.com
- hashbl_acl_freemail fadrasha.net
- hashbl_acl_freemail fadrasha.org
- hashbl_acl_freemail faithhighway.com
- hashbl_acl_freemail faithmail.com
- hashbl_acl_freemail falasteen.cc
- hashbl_acl_freemail familymailbox.com
- hashbl_acl_freemail familyroll.com
- hashbl_acl_freemail familysafeweb.net
- hashbl_acl_freemail famous.as
- hashbl_acl_freemail fan.com
- hashbl_acl_freemail fan.net
- hashbl_acl_freemail fanaticos.com
- hashbl_acl_freemail fanofbooks.com
- hashbl_acl_freemail fanofcomputers.com
- hashbl_acl_freemail fanofcooking.com
- hashbl_acl_freemail fanoftheweb.com
- hashbl_acl_freemail faroweb.com
- hashbl_acl_freemail farts.com
- hashbl_acl_freemail fast-email.com
- hashbl_acl_freemail fast-mail.org
- hashbl_acl_freemail fastem.com
- hashbl_acl_freemail fastemail.us
- hashbl_acl_freemail fastemailer.com
- hashbl_acl_freemail fastermail.com
- hashbl_acl_freemail fastest.cc
- hashbl_acl_freemail fastimap.com
- hashbl_acl_freemail fastmail.co.uk
- hashbl_acl_freemail fastmail.com
- hashbl_acl_freemail fastmailbox.net
- hashbl_acl_freemail fastmessaging.com
- hashbl_acl_freemail fastservice.com
- hashbl_acl_freemail fastwebmail.it
- hashbl_acl_freemail fawz.net
- hashbl_acl_freemail fea.st
- hashbl_acl_freemail federalcontractors.com
- hashbl_acl_freemail fedxmail.com
- hashbl_acl_freemail feelingnaughty.com
- hashbl_acl_freemail feelings.com
- hashbl_acl_freemail female.ru
- hashbl_acl_freemail fepg.net
- hashbl_acl_freemail ffanet.com
- hashbl_acl_freemail fiberia.com
- hashbl_acl_freemail fieldmail.com
- hashbl_acl_freemail filipinolinks.com
- hashbl_acl_freemail financesource.com
- hashbl_acl_freemail financier.com
- hashbl_acl_freemail findmail.com
- hashbl_acl_freemail fireman.net
- hashbl_acl_freemail firemyst.com
- hashbl_acl_freemail fiscal.net
- hashbl_acl_freemail fit.lv
- hashbl_acl_freemail flashmail.com
- hashbl_acl_freemail fleetmail.com
- hashbl_acl_freemail flipcode.com
- hashbl_acl_freemail florida.usa.com
- hashbl_acl_freemail floridagators.com
- hashbl_acl_freemail fmail.co.uk
- hashbl_acl_freemail fmailbox.com
- hashbl_acl_freemail fmgirl.com
- hashbl_acl_freemail fmguy.com
- hashbl_acl_freemail fnmail.com
- hashbl_acl_freemail focusedonprofits.com
- hashbl_acl_freemail focusedonreturns.com
- hashbl_acl_freemail footballer.com
- hashbl_acl_freemail forfree.at
- hashbl_acl_freemail forsythmissouri.org
- hashbl_acl_freemail fortuncity.com
- hashbl_acl_freemail forum.dk
- hashbl_acl_freemail foxmail.com
- hashbl_acl_freemail free.com.pe
- hashbl_acl_freemail free.fr
- hashbl_acl_freemail free.net.nz
- hashbl_acl_freemail freeaccess.nl
- hashbl_acl_freemail freegates.be
- hashbl_acl_freemail freeghana.com
- hashbl_acl_freemail freehosting.nl
- hashbl_acl_freemail freei.co.th
- hashbl_acl_freemail freeler.nl
- hashbl_acl_freemail freemail.com
- hashbl_acl_freemail freemail.globalsite.com.br
- hashbl_acl_freemail freemailen.de
- hashbl_acl_freemail freemailn.de
- hashbl_acl_freemail freemuslim.net
- hashbl_acl_freemail freenet.de
- hashbl_acl_freemail freenet.kg
- hashbl_acl_freemail freeola.net
- hashbl_acl_freemail freeonline.com
- hashbl_acl_freemail freepgs.com
- hashbl_acl_freemail freesbee.fr
- hashbl_acl_freemail freeservers.com
- hashbl_acl_freemail freestart.hu
- hashbl_acl_freemail freesurf.ch
- hashbl_acl_freemail freesurf.fr
- hashbl_acl_freemail freesurf.nl
- hashbl_acl_freemail freeuk.com
- hashbl_acl_freemail freeuk.net
- hashbl_acl_freemail freeweb.it
- hashbl_acl_freemail freewebemail.com
- hashbl_acl_freemail freeyellow.com
- hashbl_acl_freemail frisurf.no
- hashbl_acl_freemail frontiernet.net
- hashbl_acl_freemail fsmail.net
- hashbl_acl_freemail fsnet.co.uk
- hashbl_acl_freemail ftml.net
- hashbl_acl_freemail fudge.com
- hashbl_acl_freemail fuelie.org
- hashbl_acl_freemail fujairah.cc
- hashbl_acl_freemail fujairah.us
- hashbl_acl_freemail fujairah.ws
- hashbl_acl_freemail fun-greetings-jokes.com
- hashbl_acl_freemail fun.21cn.com
- hashbl_acl_freemail funkytimes.com
- hashbl_acl_freemail fusemail.com
- hashbl_acl_freemail fut.es
- hashbl_acl_freemail futboladdict.com
- hashbl_acl_freemail gabes.cc
- hashbl_acl_freemail gafsa.cc
- hashbl_acl_freemail gala.net
- hashbl_acl_freemail galaxyhit.com
- hashbl_acl_freemail galmail.co.za
- hashbl_acl_freemail gamebox.net
- hashbl_acl_freemail gamecocks.com
- hashbl_acl_freemail gamerssolution.com
- hashbl_acl_freemail games.com
- hashbl_acl_freemail gardener.com
- hashbl_acl_freemail gawab.com
- hashbl_acl_freemail gay.com
- hashbl_acl_freemail gaymailbox.com
- hashbl_acl_freemail gaza.net
- hashbl_acl_freemail gazabo.net
- hashbl_acl_freemail gazeta.pl
- hashbl_acl_freemail gci.net
- hashbl_acl_freemail gdi.net
- hashbl_acl_freemail geeklife.com
- hashbl_acl_freemail gemari.or.id
- hashbl_acl_freemail genxemail.com
- hashbl_acl_freemail geologist.com
- hashbl_acl_freemail geopia.com
- hashbl_acl_freemail georgia.usa.com
- hashbl_acl_freemail germanymail.com
- hashbl_acl_freemail getintobooks.com
- hashbl_acl_freemail getmail.no
- hashbl_acl_freemail ggaweb.ch
- hashbl_acl_freemail giga4u.de
- hashbl_acl_freemail giza.cc
- hashbl_acl_freemail gjk.dk
- hashbl_acl_freemail glay.org
- hashbl_acl_freemail glendale.net
- hashbl_acl_freemail glittergrrrls.com
- hashbl_acl_freemail globalfree.it
- hashbl_acl_freemail globalpinoy.com
- hashbl_acl_freemail globalsite.com.br
- hashbl_acl_freemail globalum.com
- hashbl_acl_freemail globetrotter.net
- hashbl_acl_freemail globomail.com
- hashbl_acl_freemail gmail.com
- hashbl_acl_freemail gmx.com
- hashbl_acl_freemail go-bama.com
- hashbl_acl_freemail go-cavs.com
- hashbl_acl_freemail go-chargers.com
- hashbl_acl_freemail go-dawgs.com
- hashbl_acl_freemail go-gators.com
- hashbl_acl_freemail go-hogs.com
- hashbl_acl_freemail go-irish.com
- hashbl_acl_freemail go-spartans.com
- hashbl_acl_freemail go-tigers.com
- hashbl_acl_freemail go.aggies.com
- hashbl_acl_freemail go.air-force.com
- hashbl_acl_freemail go.badgers.com
- hashbl_acl_freemail go.big-orange.com
- hashbl_acl_freemail go.blue.devils.com
- hashbl_acl_freemail go.buffaloes.com
- hashbl_acl_freemail go.bulldogs.com
- hashbl_acl_freemail go.com
- hashbl_acl_freemail go.cougars.com
- hashbl_acl_freemail go.dores.com
- hashbl_acl_freemail go.gamecocks.com
- hashbl_acl_freemail go.huskies.com
- hashbl_acl_freemail go.longhorns.com
- hashbl_acl_freemail go.mustangs.com
- hashbl_acl_freemail go.rebels.com
- hashbl_acl_freemail go.ro
- hashbl_acl_freemail go.ru
- hashbl_acl_freemail go.terrapins.com
- hashbl_acl_freemail go.wildcats.com
- hashbl_acl_freemail go.wolverines.com
- hashbl_acl_freemail go.yellow-jackets.com
- hashbl_acl_freemail go2net.com
- hashbl_acl_freemail go4.it
- hashbl_acl_freemail goatrance.com
- hashbl_acl_freemail goddess.com
- hashbl_acl_freemail gofree.co.uk
- hashbl_acl_freemail gohip.com
- hashbl_acl_freemail golfemail.com
- hashbl_acl_freemail goliadtexas.com
- hashbl_acl_freemail gomail.com.ua
- hashbl_acl_freemail gonowmail.com
- hashbl_acl_freemail gonuts4free.com
- hashbl_acl_freemail googlemail.com
- hashbl_acl_freemail goplay.com
- hashbl_acl_freemail gorontalo.net
- hashbl_acl_freemail gospelcity.com
- hashbl_acl_freemail gothicgirl.com
- hashbl_acl_freemail gotmail.com
- hashbl_acl_freemail gotomy.com
- hashbl_acl_freemail govzone.com
- hashbl_acl_freemail grad.com
- hashbl_acl_freemail graduate.org
- hashbl_acl_freemail graffiti.net
- hashbl_acl_freemail grapemail.net
- hashbl_acl_freemail graphic-designer.com
- hashbl_acl_freemail gratisweb.com
- hashbl_acl_freemail greatautos.org
- hashbl_acl_freemail greenmail.net
- hashbl_acl_freemail groupmail.com
- hashbl_acl_freemail gtechnics.com
- hashbl_acl_freemail guate.net
- hashbl_acl_freemail guessmail.com
- hashbl_acl_freemail guinea.cc
- hashbl_acl_freemail guy.com
- hashbl_acl_freemail gwalla.com
- hashbl_acl_freemail h-mail.us
- hashbl_acl_freemail haberx.com
- hashbl_acl_freemail hacker.am
- hashbl_acl_freemail hackermail.com
- hashbl_acl_freemail hail2theskins.com
- hashbl_acl_freemail hailmail.net
- hashbl_acl_freemail hairdresser.net
- hashbl_acl_freemail haitisurf.com
- hashbl_acl_freemail halejob.com
- hashbl_acl_freemail hamptonroads.com
- hashbl_acl_freemail hamra.cc
- hashbl_acl_freemail handbag.com
- hashbl_acl_freemail hanmail.net
- hashbl_acl_freemail happemail.com
- hashbl_acl_freemail happycounsel.com
- hashbl_acl_freemail happyhippo.com
- hashbl_acl_freemail hasakah.com
- hashbl_acl_freemail hateinthebox.com
- hashbl_acl_freemail hawaii.com
- hashbl_acl_freemail hawaii.usa.com
- hashbl_acl_freemail hayahaya.tg
- hashbl_acl_freemail hebron.tv
- hashbl_acl_freemail hedgeai.com
- hashbl_acl_freemail heesun.net
- hashbl_acl_freemail heremail.com
- hashbl_acl_freemail hetnet.nl
- hashbl_acl_freemail highveldmail.co.za
- hashbl_acl_freemail hilarious.com
- hashbl_acl_freemail hildebrands.de
- hashbl_acl_freemail hingis.org
- hashbl_acl_freemail hiphopfan.com
- hashbl_acl_freemail hispavista.com
- hashbl_acl_freemail hitmanrecords.com
- hashbl_acl_freemail hitthepuck.com
- hashbl_acl_freemail hockeyghiaccio.com
- hashbl_acl_freemail hockeymail.com
- hashbl_acl_freemail holapuravida.com
- hashbl_acl_freemail home.no.net
- hashbl_acl_freemail home.ro
- hashbl_acl_freemail home.se
- hashbl_acl_freemail homelocator.com
- hashbl_acl_freemail homemail.co.za
- hashbl_acl_freemail homemail.com
- hashbl_acl_freemail homenetmail.com
- hashbl_acl_freemail homestead.com
- hashbl_acl_freemail homosexual.net
- hashbl_acl_freemail homs.cc
- hashbl_acl_freemail hong-kong-1.com
- hashbl_acl_freemail hongkong.com
- hashbl_acl_freemail hopthu.com
- hashbl_acl_freemail hosanna.net
- hashbl_acl_freemail hot-shot.com
- hashbl_acl_freemail hot.ee
- hashbl_acl_freemail hotbot.com
- hashbl_acl_freemail hotbox.ru
- hashbl_acl_freemail hotcoolmail.com
- hashbl_acl_freemail hotdak.com
- hashbl_acl_freemail hotfire.net
- hashbl_acl_freemail hotinbox.com
- hashbl_acl_freemail hotmail.co.uk
- hashbl_acl_freemail hotmail.com
- hashbl_acl_freemail hotpop.com
- hashbl_acl_freemail hotvoice.com
- hashbl_acl_freemail hour.com
- hashbl_acl_freemail housemail.com
- hashbl_acl_freemail houseofhorrors.com
- hashbl_acl_freemail howling.com
- hashbl_acl_freemail hugkiss.com
- hashbl_acl_freemail huhmail.com
- hashbl_acl_freemail hullnumber.com
- hashbl_acl_freemail human.lv
- hashbl_acl_freemail humanoid.net
- hashbl_acl_freemail humour.com
- hashbl_acl_freemail hurra.de
- hashbl_acl_freemail hush.ai
- hashbl_acl_freemail hush.com
- hashbl_acl_freemail hushmail.com
- hashbl_acl_freemail huskies.com
- hashbl_acl_freemail hutchcity.com
- hashbl_acl_freemail i-dig-movies.com
- hashbl_acl_freemail i-france.com
- hashbl_acl_freemail i-love-restaurants.com
- hashbl_acl_freemail i-p.com
- hashbl_acl_freemail i12.com
- hashbl_acl_freemail i2828.com
- hashbl_acl_freemail ibatam.com
- hashbl_acl_freemail ibest.com.br
- hashbl_acl_freemail ibizdns.com
- hashbl_acl_freemail ibra.cc
- hashbl_acl_freemail icafe.com
- hashbl_acl_freemail ice.is
- hashbl_acl_freemail icestorm.com
- hashbl_acl_freemail icloud.com
- hashbl_acl_freemail icq.com
- hashbl_acl_freemail icq.ir
- hashbl_acl_freemail icqmail.com
- hashbl_acl_freemail icrazy.com
- hashbl_acl_freemail id.ru
- hashbl_acl_freemail idaho.usa.com
- hashbl_acl_freemail idigcomputers.com
- hashbl_acl_freemail idigelectronics.com
- hashbl_acl_freemail idigvideos.com
- hashbl_acl_freemail idirect.com
- hashbl_acl_freemail idncafe.com
- hashbl_acl_freemail idunno4recipes.com
- hashbl_acl_freemail ieg.com.br
- hashbl_acl_freemail iespalomeras.net
- hashbl_acl_freemail iespana.es
- hashbl_acl_freemail ifrance.com
- hashbl_acl_freemail ig.com.br
- hashbl_acl_freemail ignazio.it
- hashbl_acl_freemail ihatenetscape.com
- hashbl_acl_freemail ilike2helpothers.com
- hashbl_acl_freemail ilike2invest.com
- hashbl_acl_freemail ilike2workout.com
- hashbl_acl_freemail ilikeelectronics.com
- hashbl_acl_freemail ilikeworkingout.com
- hashbl_acl_freemail illinois.usa.com
- hashbl_acl_freemail ilovehomeprojects.com
- hashbl_acl_freemail iloveourteam.com
- hashbl_acl_freemail iloveworkingout.com
- hashbl_acl_freemail ilse.net
- hashbl_acl_freemail ilse.nl
- hashbl_acl_freemail imail.ru
- hashbl_acl_freemail imailbox.com
- hashbl_acl_freemail imap-mail.com
- hashbl_acl_freemail imap.cc
- hashbl_acl_freemail imapmail.org
- hashbl_acl_freemail imel.org
- hashbl_acl_freemail in-box.net
- hashbl_acl_freemail in.com
- hashbl_acl_freemail in2autos.net
- hashbl_acl_freemail iname.acom
- hashbl_acl_freemail iname.com
- hashbl_acl_freemail inbox.com
- hashbl_acl_freemail inbox.ge
- hashbl_acl_freemail inbox.lv
- hashbl_acl_freemail inbox.net
- hashbl_acl_freemail inbox.ru
- hashbl_acl_freemail incamail.com
- hashbl_acl_freemail indexa.fr
- hashbl_acl_freemail india.com
- hashbl_acl_freemail indiamail.com
- hashbl_acl_freemail indiana.usa.com
- hashbl_acl_freemail indiatimes.com
- hashbl_acl_freemail induquimica.org
- hashbl_acl_freemail inet.com.ua
- hashbl_acl_freemail infinito.it
- hashbl_acl_freemail infoapex.com
- hashbl_acl_freemail infohq.com
- hashbl_acl_freemail infomail.es
- hashbl_acl_freemail infomart.or.jp
- hashbl_acl_freemail infosat.net
- hashbl_acl_freemail infovia.com.ar
- hashbl_acl_freemail inicia.es
- hashbl_acl_freemail inmail.sk
- hashbl_acl_freemail inmail24.com
- hashbl_acl_freemail innocent.com
- hashbl_acl_freemail inorbit.com
- hashbl_acl_freemail inoutbox.com
- hashbl_acl_freemail instruction.com
- hashbl_acl_freemail instructor.net
- hashbl_acl_freemail insurer.com
- hashbl_acl_freemail intelnet.net.gt
- hashbl_acl_freemail intelnett.com
- hashbl_acl_freemail interblod.com
- hashbl_acl_freemail interestedinthejob.com
- hashbl_acl_freemail interfree.it
- hashbl_acl_freemail interia.pl
- hashbl_acl_freemail interlap.com.ar
- hashbl_acl_freemail intermail.hu
- hashbl_acl_freemail internet-e-mail.com
- hashbl_acl_freemail internet-mail.org
- hashbl_acl_freemail internet.lu
- hashbl_acl_freemail internetegypt.com
- hashbl_acl_freemail internetemails.net
- hashbl_acl_freemail internetmailing.net
- hashbl_acl_freemail intimatefire.com
- hashbl_acl_freemail intomotors.com
- hashbl_acl_freemail inwind.it
- hashbl_acl_freemail iobox.com
- hashbl_acl_freemail iobox.fi
- hashbl_acl_freemail iol.it
- hashbl_acl_freemail iol.pt
- hashbl_acl_freemail iowa.usa.com
- hashbl_acl_freemail ip3.com
- hashbl_acl_freemail ipermitmail.com
- hashbl_acl_freemail iphon.biz
- hashbl_acl_freemail iqemail.com
- hashbl_acl_freemail iquebec.com
- hashbl_acl_freemail ir.ae
- hashbl_acl_freemail iran.com
- hashbl_acl_freemail irangate.net
- hashbl_acl_freemail iraq.ir
- hashbl_acl_freemail irbid.ws
- hashbl_acl_freemail ire.ir
- hashbl_acl_freemail ireland.ir
- hashbl_acl_freemail irelandmail.com
- hashbl_acl_freemail irow.com
- hashbl_acl_freemail irr.ir
- hashbl_acl_freemail iscool.net
- hashbl_acl_freemail islandmama.com
- hashbl_acl_freemail ismailia.cc
- hashbl_acl_freemail ismart.net
- hashbl_acl_freemail isonews2.com
- hashbl_acl_freemail isonfire.com
- hashbl_acl_freemail isp9.net
- hashbl_acl_freemail ispey.com
- hashbl_acl_freemail israelmail.com
- hashbl_acl_freemail ist-der-mann.de
- hashbl_acl_freemail ist-der-wahnsinn.de
- hashbl_acl_freemail ist-echt.so
- hashbl_acl_freemail ist-genialer.de
- hashbl_acl_freemail ist-schlauer.de
- hashbl_acl_freemail ist-supersexy.de
- hashbl_acl_freemail istecht.so
- hashbl_acl_freemail italymail.com
- hashbl_acl_freemail itelgua.com
- hashbl_acl_freemail itloox.com
- hashbl_acl_freemail itmom.com
- hashbl_acl_freemail ivenus.com
- hashbl_acl_freemail iwan-fals.com
- hashbl_acl_freemail iwatchrealitytv.com
- hashbl_acl_freemail iwon.com
- hashbl_acl_freemail ixp.net
- hashbl_acl_freemail jadida.cc
- hashbl_acl_freemail jadida.org
- hashbl_acl_freemail japan.com
- hashbl_acl_freemail jaydemail.com
- hashbl_acl_freemail jazzemail.com
- hashbl_acl_freemail jedrzejow.pl
- hashbl_acl_freemail jerash.cc
- hashbl_acl_freemail jetemail.net
- hashbl_acl_freemail jingjo.net
- hashbl_acl_freemail jippii.fi
- hashbl_acl_freemail jizan.cc
- hashbl_acl_freemail jmail.co.za
- hashbl_acl_freemail job4u.com
- hashbl_acl_freemail jojomail.com
- hashbl_acl_freemail jouf.cc
- hashbl_acl_freemail journalist.com
- hashbl_acl_freemail jovem.te.pt
- hashbl_acl_freemail joymail.com
- hashbl_acl_freemail jpg.ir
- hashbl_acl_freemail juanitabynum.com
- hashbl_acl_freemail jubii.dk
- hashbl_acl_freemail jubiipost.dk
- hashbl_acl_freemail jumpy.it
- hashbl_acl_freemail juno.com
- hashbl_acl_freemail justemail.net
- hashbl_acl_freemail justmailz.com
- hashbl_acl_freemail k.ro
- hashbl_acl_freemail kaazoo.com
- hashbl_acl_freemail kabissa.org
- hashbl_acl_freemail kairouan.cc
- hashbl_acl_freemail kaixo.com
- hashbl_acl_freemail kalluritimes.com
- hashbl_acl_freemail kalpoint.com
- hashbl_acl_freemail kann.so
- hashbl_acl_freemail kanoodle.com
- hashbl_acl_freemail kansas.usa.com
- hashbl_acl_freemail karak.cc
- hashbl_acl_freemail katamail.com
- hashbl_acl_freemail kataweb.it
- hashbl_acl_freemail kayafmmail.co.za
- hashbl_acl_freemail keko.com.ar
- hashbl_acl_freemail kentucky.usa.com
- hashbl_acl_freemail keptprivate.com
- hashbl_acl_freemail keromail.com
- hashbl_acl_freemail khaimah.cc
- hashbl_acl_freemail khartoum.cc
- hashbl_acl_freemail khobar.cc
- hashbl_acl_freemail kickboxing.com
- hashbl_acl_freemail kidrock.com
- hashbl_acl_freemail kimo.com
- hashbl_acl_freemail kinkyemail.com
- hashbl_acl_freemail kissfans.com
- hashbl_acl_freemail kittymail.com
- hashbl_acl_freemail kiwitown.com
- hashbl_acl_freemail klik.it
- hashbl_acl_freemail klikni.cz
- hashbl_acl_freemail kmtn.ru
- hashbl_acl_freemail koko.com
- hashbl_acl_freemail kolozsvar.ro
- hashbl_acl_freemail kombud.com
- hashbl_acl_freemail kool-things.com
- hashbl_acl_freemail koreamail.com
- hashbl_acl_freemail koreanmail.com
- hashbl_acl_freemail kotaksuratku.info
- hashbl_acl_freemail krunis.com
- hashbl_acl_freemail ksa.ir
- hashbl_acl_freemail kukamail.com
- hashbl_acl_freemail kuronowish.com
- hashbl_acl_freemail kuwait.ir
- hashbl_acl_freemail kuwaiti.tv
- hashbl_acl_freemail kyokodate.com
- hashbl_acl_freemail kyokofukada.net
- hashbl_acl_freemail kyrgyzstan.cc
- hashbl_acl_freemail ladymail.cz
- hashbl_acl_freemail lagoon.nc
- hashbl_acl_freemail lahaonline.com
- hashbl_acl_freemail lamalla.net
- hashbl_acl_freemail lancsmail.com
- hashbl_acl_freemail land.ru
- hashbl_acl_freemail laposte.net
- hashbl_acl_freemail latakia.cc
- hashbl_acl_freemail latchess.com
- hashbl_acl_freemail latinabarbie.com
- hashbl_acl_freemail latinmail.com
- hashbl_acl_freemail latinogreeks.com
- hashbl_acl_freemail lawyer.com
- hashbl_acl_freemail lawyersmail.com
- hashbl_acl_freemail lawyerzone.com
- hashbl_acl_freemail lebanese.cc
- hashbl_acl_freemail lebanonatlas.com
- hashbl_acl_freemail leehom.net
- hashbl_acl_freemail leesville.com
- hashbl_acl_freemail legislator.com
- hashbl_acl_freemail lemondrop.com
- hashbl_acl_freemail leonardo.it
- hashbl_acl_freemail leonlai.net
- hashbl_acl_freemail letsjam.com
- hashbl_acl_freemail letterbox.org
- hashbl_acl_freemail letterboxes.org
- hashbl_acl_freemail levele.com
- hashbl_acl_freemail lexpress.net
- hashbl_acl_freemail libero.it
- hashbl_acl_freemail liberomail.com
- hashbl_acl_freemail libertysurf.net
- hashbl_acl_freemail libre.net
- hashbl_acl_freemail lightwines.org
- hashbl_acl_freemail linkmaster.com
- hashbl_acl_freemail linuxfreemail.com
- hashbl_acl_freemail linuxmail.org
- hashbl_acl_freemail lionsfan.com.au
- hashbl_acl_freemail live.com
- hashbl_acl_freemail livedoor.com
- hashbl_acl_freemail llandudno.com
- hashbl_acl_freemail llangollen.com
- hashbl_acl_freemail lmxmail.sk
- hashbl_acl_freemail lobbyist.com
- hashbl_acl_freemail loggain.net
- hashbl_acl_freemail loggain.nu
- hashbl_acl_freemail lolnetwork.net
- hashbl_acl_freemail london.com
- hashbl_acl_freemail london.ir
- hashbl_acl_freemail longhorns.com
- hashbl_acl_freemail look.com
- hashbl_acl_freemail looksmart.co.uk
- hashbl_acl_freemail looksmart.com
- hashbl_acl_freemail looksmart.com.au
- hashbl_acl_freemail loteria.net
- hashbl_acl_freemail lotonazo.com
- hashbl_acl_freemail louisiana.usa.com
- hashbl_acl_freemail louiskoo.com
- hashbl_acl_freemail love2exercise.com
- hashbl_acl_freemail love2workout.com
- hashbl_acl_freemail loveable.com
- hashbl_acl_freemail lovecat.com
- hashbl_acl_freemail loveemail.com
- hashbl_acl_freemail lovefantasysports.com
- hashbl_acl_freemail loveis.lv
- hashbl_acl_freemail lovemail.com
- hashbl_acl_freemail lovetoexercise.com
- hashbl_acl_freemail lovingjesus.com
- hashbl_acl_freemail lowrider.com
- hashbl_acl_freemail lpemail.com
- hashbl_acl_freemail lubnan.cc
- hashbl_acl_freemail lubnan.ws
- hashbl_acl_freemail lucky7lotto.net
- hashbl_acl_freemail luckymail.com
- hashbl_acl_freemail luso.pt
- hashbl_acl_freemail lusoweb.pt
- hashbl_acl_freemail luukku.com
- hashbl_acl_freemail luvfishing.com
- hashbl_acl_freemail luvgolfing.com
- hashbl_acl_freemail luvsoccer.com
- hashbl_acl_freemail lv-inter.net
- hashbl_acl_freemail lycos.co.uk
- hashbl_acl_freemail lycos.com
- hashbl_acl_freemail lycosmail.com
- hashbl_acl_freemail mac.com
- hashbl_acl_freemail machinecandy.com
- hashbl_acl_freemail macmail.com
- hashbl_acl_freemail mad.scientist.com
- hashbl_acl_freemail madcrazy.com
- hashbl_acl_freemail madeniggaz.net
- hashbl_acl_freemail madinah.cc
- hashbl_acl_freemail madonnafan.com
- hashbl_acl_freemail madonno.com
- hashbl_acl_freemail madrid.com
- hashbl_acl_freemail mag-spam.net
- hashbl_acl_freemail mag2.com
- hashbl_acl_freemail maghreb.cc
- hashbl_acl_freemail magicmail.co.za
- hashbl_acl_freemail magik-net.com
- hashbl_acl_freemail mail-atlas.net
- hashbl_acl_freemail mail-awu.de
- hashbl_acl_freemail mail-box.cz
- hashbl_acl_freemail mail-center.com
- hashbl_acl_freemail mail-central.com
- hashbl_acl_freemail mail-jp.org
- hashbl_acl_freemail mail-me.com
- hashbl_acl_freemail mail-on.us
- hashbl_acl_freemail mail-online.dk
- hashbl_acl_freemail mail-page.com
- hashbl_acl_freemail mail-x-change.com
- hashbl_acl_freemail mail.austria.com
- hashbl_acl_freemail mail.az
- hashbl_acl_freemail mail.be
- hashbl_acl_freemail mail.bg
- hashbl_acl_freemail mail.bulgaria.com
- hashbl_acl_freemail mail.by
- hashbl_acl_freemail mail.co.za
- hashbl_acl_freemail mail.com
- hashbl_acl_freemail mail.de
- hashbl_acl_freemail mail.dk
- hashbl_acl_freemail mail.ee
- hashbl_acl_freemail mail.goo.ne.jp
- hashbl_acl_freemail mail.gr
- hashbl_acl_freemail mail.lawguru.com
- hashbl_acl_freemail mail.md
- hashbl_acl_freemail mail.mn
- hashbl_acl_freemail mail.org
- hashbl_acl_freemail mail.pf
- hashbl_acl_freemail mail.pt
- hashbl_acl_freemail mail.ru
- hashbl_acl_freemail mail.yahoo.co.jp
- hashbl_acl_freemail mail15.com
- hashbl_acl_freemail mail3000.com
- hashbl_acl_freemail mail333.com
- hashbl_acl_freemail mail4me.com
- hashbl_acl_freemail mail8.com
- hashbl_acl_freemail mailandftp.com
- hashbl_acl_freemail mailandnews.com
- hashbl_acl_freemail mailas.com
- hashbl_acl_freemail mailasia.com
- hashbl_acl_freemail mailbg.com
- hashbl_acl_freemail mailblocks.com
- hashbl_acl_freemail mailbolt.com
- hashbl_acl_freemail mailbomb.com
- hashbl_acl_freemail mailbox.as
- hashbl_acl_freemail mailbox.co.za
- hashbl_acl_freemail mailbox.gr
- hashbl_acl_freemail mailbox.hu
- hashbl_acl_freemail mailbox.sk
- hashbl_acl_freemail mailc.net
- hashbl_acl_freemail mailcan.com
- hashbl_acl_freemail mailcircuit.com
- hashbl_acl_freemail mailclub.fr
- hashbl_acl_freemail mailclub.net
- hashbl_acl_freemail maildozy.com
- hashbl_acl_freemail mailfly.com
- hashbl_acl_freemail mailforce.net
- hashbl_acl_freemail mailftp.com
- hashbl_acl_freemail mailglobal.net
- hashbl_acl_freemail mailhaven.com
- hashbl_acl_freemail mailinator.com
- hashbl_acl_freemail mailingaddress.org
- hashbl_acl_freemail mailingweb.com
- hashbl_acl_freemail mailisent.com
- hashbl_acl_freemail mailite.com
- hashbl_acl_freemail mailme.dk
- hashbl_acl_freemail mailmight.com
- hashbl_acl_freemail mailmij.nl
- hashbl_acl_freemail mailnew.com
- hashbl_acl_freemail mailops.com
- hashbl_acl_freemail mailpanda.com
- hashbl_acl_freemail mailpersonal.com
- hashbl_acl_freemail mailroom.com
- hashbl_acl_freemail mailru.com
- hashbl_acl_freemail mails.de
- hashbl_acl_freemail mailsent.net
- hashbl_acl_freemail mailserver.dk
- hashbl_acl_freemail mailservice.ms
- hashbl_acl_freemail mailsnare.net
- hashbl_acl_freemail mailsurf.com
- hashbl_acl_freemail mailup.net
- hashbl_acl_freemail mailvault.com
- hashbl_acl_freemail mailworks.org
- hashbl_acl_freemail maine.usa.com
- hashbl_acl_freemail majorana.martina-franca.ta.it
- hashbl_acl_freemail majorgolfer.com
- hashbl_acl_freemail majorshopaholic.com
- hashbl_acl_freemail majortechie.com
- hashbl_acl_freemail maktoob.com
- hashbl_acl_freemail malayalamtelevision.net
- hashbl_acl_freemail malayalapathram.com
- hashbl_acl_freemail male.ru
- hashbl_acl_freemail manager.de
- hashbl_acl_freemail manama.cc
- hashbl_acl_freemail manlymail.net
- hashbl_acl_freemail mansoura.tv
- hashbl_acl_freemail mantrafreenet.com
- hashbl_acl_freemail mantramail.com
- hashbl_acl_freemail mantraonline.com
- hashbl_acl_freemail marchmail.com
- hashbl_acl_freemail marihuana.ro
- hashbl_acl_freemail marijuana.nl
- hashbl_acl_freemail marillion.net
- hashbl_acl_freemail marketweighton.com
- hashbl_acl_freemail marrakesh.cc
- hashbl_acl_freemail maryland.usa.com
- hashbl_acl_freemail mascara.ws
- hashbl_acl_freemail masrawy.com
- hashbl_acl_freemail massachusetts.usa.com
- hashbl_acl_freemail mauimail.com
- hashbl_acl_freemail mbox.com.au
- hashbl_acl_freemail mcom.com
- hashbl_acl_freemail mcrmail.com
- hashbl_acl_freemail me.by
- hashbl_acl_freemail me.com
- hashbl_acl_freemail medicinatv.com
- hashbl_acl_freemail meetingmall.com
- hashbl_acl_freemail mega-schlau.de
- hashbl_acl_freemail megamail.pt
- hashbl_acl_freemail megarave.com
- hashbl_acl_freemail meknes.cc
- hashbl_acl_freemail menara.ma
- hashbl_acl_freemail merseymail.com
- hashbl_acl_freemail mesra.net
- hashbl_acl_freemail messagez.com
- hashbl_acl_freemail metacrawler.com
- hashbl_acl_freemail metalfan.com
- hashbl_acl_freemail mexico.com
- hashbl_acl_freemail mexicomail.com
- hashbl_acl_freemail miaoweb.net
- hashbl_acl_freemail michigan.usa.com
- hashbl_acl_freemail micro2media.com
- hashbl_acl_freemail miesto.sk
- hashbl_acl_freemail mighty.co.za
- hashbl_acl_freemail milacamn.net
- hashbl_acl_freemail milmail.com
- hashbl_acl_freemail mindless.com
- hashbl_acl_freemail mindviz.com
- hashbl_acl_freemail minister.com
- hashbl_acl_freemail minnesota.usa.com
- hashbl_acl_freemail mississippi.usa.com
- hashbl_acl_freemail missouri.usa.com
- hashbl_acl_freemail mixmail.com
- hashbl_acl_freemail ml1.net
- hashbl_acl_freemail ml2clan.com
- hashbl_acl_freemail mlanime.com
- hashbl_acl_freemail mm.st
- hashbl_acl_freemail mmail.com
- hashbl_acl_freemail mobimail.mn
- hashbl_acl_freemail mobsters.com
- hashbl_acl_freemail mobstop.com
- hashbl_acl_freemail modemnet.net
- hashbl_acl_freemail modomail.com
- hashbl_acl_freemail mofa.com
- hashbl_acl_freemail moldova.com
- hashbl_acl_freemail moldovacc.com
- hashbl_acl_freemail monarchy.com
- hashbl_acl_freemail montana.usa.com
- hashbl_acl_freemail montevideo.com.uy
- hashbl_acl_freemail moomia.com
- hashbl_acl_freemail moose-mail.com
- hashbl_acl_freemail mosaicfx.com
- hashbl_acl_freemail moscowmail.com
- hashbl_acl_freemail motley.com
- hashbl_acl_freemail motor-nut.com
- hashbl_acl_freemail motormania.com
- hashbl_acl_freemail movemail.com
- hashbl_acl_freemail moviefan.com
- hashbl_acl_freemail mr.outblaze.com
- hashbl_acl_freemail mrspender.com
- hashbl_acl_freemail mscold.com
- hashbl_acl_freemail msn.co.uk
- hashbl_acl_freemail msn.com
- hashbl_acl_freemail msnzone.cn
- hashbl_acl_freemail mundo-r.com
- hashbl_acl_freemail munich.com
- hashbl_acl_freemail muscat.tv
- hashbl_acl_freemail muscat.ws
- hashbl_acl_freemail music.com
- hashbl_acl_freemail musician.net
- hashbl_acl_freemail musician.org
- hashbl_acl_freemail musicsites.com
- hashbl_acl_freemail muslim.com
- hashbl_acl_freemail muslimsonline.com
- hashbl_acl_freemail muss.so
- hashbl_acl_freemail mustangs.com
- hashbl_acl_freemail mxs.de
- hashbl_acl_freemail myblue.cc
- hashbl_acl_freemail mycabin.com
- hashbl_acl_freemail mycapitalsmail.com
- hashbl_acl_freemail mycatiscool.com
- hashbl_acl_freemail mycity.com
- hashbl_acl_freemail mycommail.com
- hashbl_acl_freemail mycool.com
- hashbl_acl_freemail mydomain.com
- hashbl_acl_freemail myeweb.com
- hashbl_acl_freemail myfantasyteamrules.com
- hashbl_acl_freemail myfastmail.com
- hashbl_acl_freemail myfunnymail.com
- hashbl_acl_freemail mygamingconsoles.com
- hashbl_acl_freemail mygrande.net
- hashbl_acl_freemail myiris.com
- hashbl_acl_freemail myjazzmail.com
- hashbl_acl_freemail mykolab.com
- hashbl_acl_freemail mymacmail.com
- hashbl_acl_freemail mymail.dk
- hashbl_acl_freemail mymail.ph.inter.net
- hashbl_acl_freemail mymail.ro
- hashbl_acl_freemail mynet.com
- hashbl_acl_freemail mynet.com.tr
- hashbl_acl_freemail myopera.com
- hashbl_acl_freemail myotw.net
- hashbl_acl_freemail myownemail.com
- hashbl_acl_freemail mypersonalemail.com
- hashbl_acl_freemail myplace.com
- hashbl_acl_freemail myrealbox.com
- hashbl_acl_freemail myself.com
- hashbl_acl_freemail myspace.com
- hashbl_acl_freemail myt.mu
- hashbl_acl_freemail myteamisbest.com
- hashbl_acl_freemail myway.com
- hashbl_acl_freemail mzgchaos.de
- hashbl_acl_freemail n2.com
- hashbl_acl_freemail n2business.com
- hashbl_acl_freemail n2mail.com
- hashbl_acl_freemail n2software.com
- hashbl_acl_freemail nabble.com
- hashbl_acl_freemail nabeul.cc
- hashbl_acl_freemail nabeul.info
- hashbl_acl_freemail nablus.cc
- hashbl_acl_freemail nador.cc
- hashbl_acl_freemail najaf.cc
- hashbl_acl_freemail name.com
- hashbl_acl_freemail nameplanet.com
- hashbl_acl_freemail nanamail.co.il
- hashbl_acl_freemail nanaseaikawa.com
- hashbl_acl_freemail nandomail.com
- hashbl_acl_freemail narod.ru
- hashbl_acl_freemail naseej.com
- hashbl_acl_freemail nastything.com
- hashbl_acl_freemail nate.com
- hashbl_acl_freemail national-champs.com
- hashbl_acl_freemail nativeweb.net
- hashbl_acl_freemail naveganas.com
- hashbl_acl_freemail naver.com
- hashbl_acl_freemail nebraska.usa.com
- hashbl_acl_freemail nemra1.com
- hashbl_acl_freemail nenter.com
- hashbl_acl_freemail nerd4life.de
- hashbl_acl_freemail nerdshack.com
- hashbl_acl_freemail nervhq.org
- hashbl_acl_freemail net-shopping.com
- hashbl_acl_freemail net-surf.com
- hashbl_acl_freemail net.hr
- hashbl_acl_freemail net4b.pt
- hashbl_acl_freemail net4jesus.com
- hashbl_acl_freemail net4you.at
- hashbl_acl_freemail netbounce.com
- hashbl_acl_freemail netbroadcaster.com
- hashbl_acl_freemail netbusiness.com
- hashbl_acl_freemail netcabo.pt
- hashbl_acl_freemail netcape.net
- hashbl_acl_freemail netcourrier.com
- hashbl_acl_freemail netexecutive.com
- hashbl_acl_freemail netfingers.com
- hashbl_acl_freemail netfirms.com
- hashbl_acl_freemail netkushi.com
- hashbl_acl_freemail netmongol.com
- hashbl_acl_freemail netpiper.com
- hashbl_acl_freemail netposta.net
- hashbl_acl_freemail netscape.com
- hashbl_acl_freemail netscape.net
- hashbl_acl_freemail netscapeonline.co.uk
- hashbl_acl_freemail netsquare.com
- hashbl_acl_freemail nettaxi.com
- hashbl_acl_freemail netti.fi
- hashbl_acl_freemail networld.com
- hashbl_acl_freemail netzero.com
- hashbl_acl_freemail netzero.net
- hashbl_acl_freemail neustreet.com
- hashbl_acl_freemail nevada.usa.com
- hashbl_acl_freemail newhampshire.usa.com
- hashbl_acl_freemail newjersey.usa.com
- hashbl_acl_freemail newmail.com
- hashbl_acl_freemail newmail.net
- hashbl_acl_freemail newmail.ok.com
- hashbl_acl_freemail newmail.ru
- hashbl_acl_freemail newmexico.usa.com
- hashbl_acl_freemail news-fanatic.com
- hashbl_acl_freemail newspaperemail.com
- hashbl_acl_freemail newspaperfan.com
- hashbl_acl_freemail newyork.com
- hashbl_acl_freemail newyork.usa.com
- hashbl_acl_freemail newyorkcity.com
- hashbl_acl_freemail nfmail.com
- hashbl_acl_freemail nicegal.com
- hashbl_acl_freemail nightimeuk.com
- hashbl_acl_freemail nightly.com
- hashbl_acl_freemail nightmail.com
- hashbl_acl_freemail nightmail.ru
- hashbl_acl_freemail ninfan.com
- hashbl_acl_freemail noavar.com
- hashbl_acl_freemail nocharge.com
- hashbl_acl_freemail noemail.com
- hashbl_acl_freemail nokiamail.com
- hashbl_acl_freemail nonomail.com
- hashbl_acl_freemail nonpartisan.com
- hashbl_acl_freemail noolhar.com
- hashbl_acl_freemail northcarolina.usa.com
- hashbl_acl_freemail northdakota.usa.com
- hashbl_acl_freemail nospammail.net
- hashbl_acl_freemail nowzer.com
- hashbl_acl_freemail null.net
- hashbl_acl_freemail ny.com
- hashbl_acl_freemail nyc.com
- hashbl_acl_freemail nycmail.com
- hashbl_acl_freemail nz11.com
- hashbl_acl_freemail nzoomail.com
- hashbl_acl_freemail o2.pl
- hashbl_acl_freemail oath.com
- hashbl_acl_freemail oceanfree.net
- hashbl_acl_freemail ocsnet.net
- hashbl_acl_freemail oddpost.com
- hashbl_acl_freemail odeon.pl
- hashbl_acl_freemail odmail.com
- hashbl_acl_freemail offcolormail.com
- hashbl_acl_freemail offshorewebmail.com
- hashbl_acl_freemail ofir.dk
- hashbl_acl_freemail ohio.usa.com
- hashbl_acl_freemail ohne-drogen-gehts.net
- hashbl_acl_freemail oicexchange.com
- hashbl_acl_freemail ok.ru
- hashbl_acl_freemail oklahoma.usa.com
- hashbl_acl_freemail ole.com
- hashbl_acl_freemail oleco.net
- hashbl_acl_freemail olympist.net
- hashbl_acl_freemail omani.ws
- hashbl_acl_freemail omaninfo.com
- hashbl_acl_freemail omdurman.cc
- hashbl_acl_freemail on-steroids.de
- hashbl_acl_freemail onatoo.com
- hashbl_acl_freemail ondikoi.com
- hashbl_acl_freemail onebox.com
- hashbl_acl_freemail onenet.com.ar
- hashbl_acl_freemail onet.pl
- hashbl_acl_freemail ongc.net
- hashbl_acl_freemail oninet.pt
- hashbl_acl_freemail online.ie
- hashbl_acl_freemail online.ru
- hashbl_acl_freemail onlinevideosrock.com
- hashbl_acl_freemail onlinewiz.com
- hashbl_acl_freemail onobox.com
- hashbl_acl_freemail open.by
- hashbl_acl_freemail openbg.com
- hashbl_acl_freemail openforyou.com
- hashbl_acl_freemail openmail.cc
- hashbl_acl_freemail opentransfer.com
- hashbl_acl_freemail operamail.com
- hashbl_acl_freemail operationivy.com
- hashbl_acl_freemail oplusnet.com
- hashbl_acl_freemail optician.com
- hashbl_acl_freemail oran.cc
- hashbl_acl_freemail orange.es
- hashbl_acl_freemail orange.fr
- hashbl_acl_freemail orange.jo
- hashbl_acl_freemail orange.pl
- hashbl_acl_freemail orangehome.co.uk
- hashbl_acl_freemail orbitel.bg
- hashbl_acl_freemail orcon.net.nz
- hashbl_acl_freemail oregon.usa.com
- hashbl_acl_freemail oreka.com
- hashbl_acl_freemail organizer.net
- hashbl_acl_freemail orgio.net
- hashbl_acl_freemail orthodontist.net
- hashbl_acl_freemail orthodox.com
- hashbl_acl_freemail osite.com.br
- hashbl_acl_freemail oso.com
- hashbl_acl_freemail oued.info
- hashbl_acl_freemail oued.org
- hashbl_acl_freemail oujda.biz
- hashbl_acl_freemail oujda.cc
- hashbl_acl_freemail ourbrisbane.com
- hashbl_acl_freemail ournet.md
- hashbl_acl_freemail ourprofile.net
- hashbl_acl_freemail ourwest.com
- hashbl_acl_freemail outgun.com
- hashbl_acl_freemail outlook.com
- hashbl_acl_freemail ownmail.net
- hashbl_acl_freemail oxfoot.com
- hashbl_acl_freemail ozu.es
- hashbl_acl_freemail pacer.com
- hashbl_acl_freemail pacific-ocean.com
- hashbl_acl_freemail pacificwest.com
- hashbl_acl_freemail paginasamarillas.com
- hashbl_acl_freemail paidoffers.net
- hashbl_acl_freemail pakistani.ws
- hashbl_acl_freemail pakistanmail.com
- hashbl_acl_freemail palmyra.cc
- hashbl_acl_freemail palmyra.ws
- hashbl_acl_freemail paltalk.ir
- hashbl_acl_freemail pandawa.com
- hashbl_acl_freemail pando.com
- hashbl_acl_freemail pandora.be
- hashbl_acl_freemail paris.com
- hashbl_acl_freemail parsimail.com
- hashbl_acl_freemail parspage.com
- hashbl_acl_freemail patmail.com
- hashbl_acl_freemail pattayacitythailand.com
- hashbl_acl_freemail pc4me.us
- hashbl_acl_freemail pcbee.com
- hashbl_acl_freemail pcpostal.com
- hashbl_acl_freemail pediatrician.com
- hashbl_acl_freemail penguinmaster.com
- hashbl_acl_freemail pennsylvania.usa.com
- hashbl_acl_freemail peoplepc.com
- hashbl_acl_freemail peopleweb.com
- hashbl_acl_freemail persian.com
- hashbl_acl_freemail personal.ro
- hashbl_acl_freemail personales.com
- hashbl_acl_freemail peru.com
- hashbl_acl_freemail petlover.com
- hashbl_acl_freemail petml.com
- hashbl_acl_freemail petrofind.com
- hashbl_acl_freemail photographer.net
- hashbl_acl_freemail phreaker.net
- hashbl_acl_freemail phunkybitches.com
- hashbl_acl_freemail physicist.net
- hashbl_acl_freemail pigeonportal.com
- hashbl_acl_freemail pikaguam.com
- hashbl_acl_freemail pilu.com
- hashbl_acl_freemail pimagop.com
- hashbl_acl_freemail pinkcity.net
- hashbl_acl_freemail pinoymail.com
- hashbl_acl_freemail pipni.cz
- hashbl_acl_freemail pisem.net
- hashbl_acl_freemail pitbullmail.com
- hashbl_acl_freemail planet-school.de
- hashbl_acl_freemail planetaccess.com
- hashbl_acl_freemail planetmail.com
- hashbl_acl_freemail planetmail.net
- hashbl_acl_freemail planetout.com
- hashbl_acl_freemail planetsmeg.com
- hashbl_acl_freemail plasa.com
- hashbl_acl_freemail playersodds.com
- hashbl_acl_freemail playful.com
- hashbl_acl_freemail pluno.com
- hashbl_acl_freemail plusmail.com.br
- hashbl_acl_freemail pmail.net
- hashbl_acl_freemail pnetmail.co.za
- hashbl_acl_freemail pobox.ru
- hashbl_acl_freemail pobox.sk
- hashbl_acl_freemail pochta.ru
- hashbl_acl_freemail pochtamt.ru
- hashbl_acl_freemail poczta.fm
- hashbl_acl_freemail poetic.com
- hashbl_acl_freemail pogowave.com
- hashbl_acl_freemail polandmail.com
- hashbl_acl_freemail polbox.com
- hashbl_acl_freemail politician.com
- hashbl_acl_freemail pookmail.com
- hashbl_acl_freemail poop.com
- hashbl_acl_freemail poormail.com
- hashbl_acl_freemail pop.co.th
- hashbl_acl_freemail pop3.ru
- hashbl_acl_freemail popmail.com
- hashbl_acl_freemail poppymail.com
- hashbl_acl_freemail popsmail.com
- hashbl_acl_freemail popstar.com
- hashbl_acl_freemail portafree.com
- hashbl_acl_freemail portaldosalunos.com
- hashbl_acl_freemail portsaid.cc
- hashbl_acl_freemail portugalmail.com
- hashbl_acl_freemail portugalmail.pt
- hashbl_acl_freemail post.com
- hashbl_acl_freemail post.cz
- hashbl_acl_freemail post.expart.ne.jp
- hashbl_acl_freemail post.pl
- hashbl_acl_freemail post.sk
- hashbl_acl_freemail posta.ge
- hashbl_acl_freemail postaccesslite.com
- hashbl_acl_freemail postiloota.net
- hashbl_acl_freemail postinbox.com
- hashbl_acl_freemail postino.ch
- hashbl_acl_freemail postino.it
- hashbl_acl_freemail postmaster.co.uk
- hashbl_acl_freemail postpro.net
- hashbl_acl_freemail potsmokersnet.com
- hashbl_acl_freemail powdermail.com
- hashbl_acl_freemail praize.com
- hashbl_acl_freemail presidency.com
- hashbl_acl_freemail press.co.jp
- hashbl_acl_freemail priest.com
- hashbl_acl_freemail primetap.com
- hashbl_acl_freemail primposta.com
- hashbl_acl_freemail printesamargareta.ro
- hashbl_acl_freemail private.21cn.com
- hashbl_acl_freemail probemail.com
- hashbl_acl_freemail profesional.com
- hashbl_acl_freemail profession.freemail.com.br
- hashbl_acl_freemail programmer.net
- hashbl_acl_freemail proinbox.com
- hashbl_acl_freemail project420.com
- hashbl_acl_freemail prolife.net
- hashbl_acl_freemail promessage.com
- hashbl_acl_freemail prontomail.com
- hashbl_acl_freemail protestant.com
- hashbl_acl_freemail protonmail.ch
- hashbl_acl_freemail protonmail.com
- hashbl_acl_freemail provincial.net
- hashbl_acl_freemail publicaccounting.com
- hashbl_acl_freemail publicist.com
- hashbl_acl_freemail puertoricowow.com
- hashbl_acl_freemail punkass.com
- hashbl_acl_freemail puppetweb.com
- hashbl_acl_freemail puppy.com.my
- hashbl_acl_freemail q.com
- hashbl_acl_freemail qassem.cc
- hashbl_acl_freemail qatar.io
- hashbl_acl_freemail qlmail.com
- hashbl_acl_freemail qq.com
- hashbl_acl_freemail qrio.com
- hashbl_acl_freemail qsl.net
- hashbl_acl_freemail qualityservice.com
- hashbl_acl_freemail quds.cc
- hashbl_acl_freemail qudsmail.com
- hashbl_acl_freemail queerplaces.com
- hashbl_acl_freemail quepasa.com
- hashbl_acl_freemail quick.cz
- hashbl_acl_freemail quickwebmail.com
- hashbl_acl_freemail r-o-o-t.com
- hashbl_acl_freemail r320.hu
- hashbl_acl_freemail raakim.com
- hashbl_acl_freemail rabat.cc
- hashbl_acl_freemail racingseat.com
- hashbl_acl_freemail radicalz.com
- hashbl_acl_freemail radiojobbank.com
- hashbl_acl_freemail radiologist.net
- hashbl_acl_freemail rafah.cc
- hashbl_acl_freemail ragingbull.com
- hashbl_acl_freemail raisingadaughter.com
- hashbl_acl_freemail rallye-webmail.com
- hashbl_acl_freemail ramallah.cc
- hashbl_acl_freemail rambler.ru
- hashbl_acl_freemail ranmamail.com
- hashbl_acl_freemail rapstar.com
- hashbl_acl_freemail rapworld.com
- hashbl_acl_freemail rastamall.com
- hashbl_acl_freemail ratedx.net
- hashbl_acl_freemail ravearena.com
- hashbl_acl_freemail ravemail.co.za
- hashbl_acl_freemail ravemail.com
- hashbl_acl_freemail ravermail.com
- hashbl_acl_freemail razormail.com
- hashbl_acl_freemail rbcmail.ru
- hashbl_acl_freemail rbox.co
- hashbl_acl_freemail rbox.me
- hashbl_acl_freemail real.ro
- hashbl_acl_freemail realbookfan.com
- hashbl_acl_freemail realemail.net
- hashbl_acl_freemail realhealthnut.com
- hashbl_acl_freemail realitytvaddict.net
- hashbl_acl_freemail realitytvnut.com
- hashbl_acl_freemail reallyfast.biz
- hashbl_acl_freemail reallyfast.info
- hashbl_acl_freemail reallyintomusic.com
- hashbl_acl_freemail realtravelfan.com
- hashbl_acl_freemail realtyagent.com
- hashbl_acl_freemail rebels.com
- hashbl_acl_freemail reborn.com
- hashbl_acl_freemail recife.net
- hashbl_acl_freemail recme.net
- hashbl_acl_freemail rediffmail.com
- hashbl_acl_freemail rediffmailpro.com
- hashbl_acl_freemail redseven.de
- hashbl_acl_freemail redskinscheer.com
- hashbl_acl_freemail redskinsfamily.com
- hashbl_acl_freemail redskinsfancentral.com
- hashbl_acl_freemail redskinshog.com
- hashbl_acl_freemail redskinsrule.com
- hashbl_acl_freemail redskinsspecialteams.com
- hashbl_acl_freemail redskinsultimatefan.com
- hashbl_acl_freemail redwhitearmy.com
- hashbl_acl_freemail reggaefan.com
- hashbl_acl_freemail registerednurses.com
- hashbl_acl_freemail reincarnate.com
- hashbl_acl_freemail relapsecult.com
- hashbl_acl_freemail relia.com
- hashbl_acl_freemail religious.com
- hashbl_acl_freemail remixer.com
- hashbl_acl_freemail repairman.com
- hashbl_acl_freemail representative.com
- hashbl_acl_freemail rescueteam.com
- hashbl_acl_freemail revenue.com
- hashbl_acl_freemail rexian.com
- hashbl_acl_freemail rhodeisland.usa.com
- hashbl_acl_freemail ritmes.net
- hashbl_acl_freemail rn.com
- hashbl_acl_freemail roanokemail.com
- hashbl_acl_freemail rochester-mail.com
- hashbl_acl_freemail rock.com
- hashbl_acl_freemail rockeros.com
- hashbl_acl_freemail rocketmail.com
- hashbl_acl_freemail rocketship.com
- hashbl_acl_freemail rockfan.com
- hashbl_acl_freemail rockinghamgateway.com
- hashbl_acl_freemail rojname.com
- hashbl_acl_freemail rol.ro
- hashbl_acl_freemail rollin.com
- hashbl_acl_freemail romance106fm.com
- hashbl_acl_freemail rome.com
- hashbl_acl_freemail romymichele.com
- hashbl_acl_freemail royal.net
- hashbl_acl_freemail rpharmacist.com
- hashbl_acl_freemail rt.nl
- hashbl_acl_freemail ru.ru
- hashbl_acl_freemail runbox.com
- hashbl_acl_freemail rushpost.com
- hashbl_acl_freemail russiamail.com
- hashbl_acl_freemail rxpost.net
- hashbl_acl_freemail s-mail.com
- hashbl_acl_freemail saabnet.com
- hashbl_acl_freemail sacbeemail.com
- hashbl_acl_freemail sacmail.com
- hashbl_acl_freemail safat.biz
- hashbl_acl_freemail safat.info
- hashbl_acl_freemail safat.us
- hashbl_acl_freemail safat.ws
- hashbl_acl_freemail safe-mail.net
- hashbl_acl_freemail safe-mailbox.com
- hashbl_acl_freemail safrica.com
- hashbl_acl_freemail saigonnet.vn
- hashbl_acl_freemail saint-mike.org
- hashbl_acl_freemail saintly.com
- hashbl_acl_freemail salalah.cc
- hashbl_acl_freemail salesperson.net
- hashbl_acl_freemail salmiya.biz
- hashbl_acl_freemail samerica.com
- hashbl_acl_freemail samilan.net
- hashbl_acl_freemail sanaa.cc
- hashbl_acl_freemail sandiego.com
- hashbl_acl_freemail sanfranmail.com
- hashbl_acl_freemail sanook.com
- hashbl_acl_freemail sanriotown.com
- hashbl_acl_freemail sapibon.com
- hashbl_acl_freemail sapo.pt
- hashbl_acl_freemail saturnfans.com
- hashbl_acl_freemail sayhi.net
- hashbl_acl_freemail sbcglobal.com
- hashbl_acl_freemail scfn.net
- hashbl_acl_freemail scheint.so
- hashbl_acl_freemail schweiz.org
- hashbl_acl_freemail sci.fi
- hashbl_acl_freemail sciaga.pl
- hashbl_acl_freemail scientist.com
- hashbl_acl_freemail scotlandmail.com
- hashbl_acl_freemail scoutmail.com
- hashbl_acl_freemail scrapbookscrapbook.com
- hashbl_acl_freemail seapole.com
- hashbl_acl_freemail search417.com
- hashbl_acl_freemail seark.com
- hashbl_acl_freemail sebil.com
- hashbl_acl_freemail secretary.net
- hashbl_acl_freemail secretservices.net
- hashbl_acl_freemail secure-jlnet.com
- hashbl_acl_freemail seductive.com
- hashbl_acl_freemail seeb.cc
- hashbl_acl_freemail sendmail.ru
- hashbl_acl_freemail sendme.cz
- hashbl_acl_freemail sent.as
- hashbl_acl_freemail sent.at
- hashbl_acl_freemail sent.com
- hashbl_acl_freemail serga.com.ar
- hashbl_acl_freemail sermix.com
- hashbl_acl_freemail server4free.de
- hashbl_acl_freemail serverwench.com
- hashbl_acl_freemail sesmail.com
- hashbl_acl_freemail sexmagnet.com
- hashbl_acl_freemail sexriga.lv
- hashbl_acl_freemail seznam.cz
- hashbl_acl_freemail sfax.ws
- hashbl_acl_freemail shadango.com
- hashbl_acl_freemail sharm.cc
- hashbl_acl_freemail she.com
- hashbl_acl_freemail shuf.com
- hashbl_acl_freemail siamlocalhost.com
- hashbl_acl_freemail siamnow.net
- hashbl_acl_freemail sify.com
- hashbl_acl_freemail sina.cn
- hashbl_acl_freemail sina.com
- hashbl_acl_freemail sinai.cc
- hashbl_acl_freemail sinamail.com
- hashbl_acl_freemail sinanail.com
- hashbl_acl_freemail singalongcenter.com
- hashbl_acl_freemail singapore.com
- hashbl_acl_freemail singmail.com
- hashbl_acl_freemail singnet.com.sg
- hashbl_acl_freemail siraj.org
- hashbl_acl_freemail siria.cc
- hashbl_acl_freemail sirindia.com
- hashbl_acl_freemail sirunet.com
- hashbl_acl_freemail sister.com
- hashbl_acl_freemail sistersbrothers.com
- hashbl_acl_freemail sizzling.com
- hashbl_acl_freemail sketchyfriends.com
- hashbl_acl_freemail skins4life.com
- hashbl_acl_freemail slamdunkfan.com
- hashbl_acl_freemail slayerized.com
- hashbl_acl_freemail slickriffs.co.uk
- hashbl_acl_freemail slingshot.com
- hashbl_acl_freemail slo.net
- hashbl_acl_freemail slomusic.net
- hashbl_acl_freemail smartemail.co.uk
- hashbl_acl_freemail smartstocks.com
- hashbl_acl_freemail smtp.ru
- hashbl_acl_freemail snail-mail.net
- hashbl_acl_freemail snakebite.com
- hashbl_acl_freemail sndt.net
- hashbl_acl_freemail sneakemail.com
- hashbl_acl_freemail snoopymail.com
- hashbl_acl_freemail snowboarding.com
- hashbl_acl_freemail so-simple.org
- hashbl_acl_freemail socamail.com
- hashbl_acl_freemail socialworker.net
- hashbl_acl_freemail sociologist.com
- hashbl_acl_freemail softhome.net
- hashbl_acl_freemail sohu.com
- hashbl_acl_freemail sol.dk
- hashbl_acl_freemail solidmail.com
- hashbl_acl_freemail solution4u.com
- hashbl_acl_freemail songwriter.net
- hashbl_acl_freemail soon.com
- hashbl_acl_freemail sos.lv
- hashbl_acl_freemail soulja-beatz.org
- hashbl_acl_freemail soundvillage.org
- hashbl_acl_freemail sousse.cc
- hashbl_acl_freemail southcarolina.usa.com
- hashbl_acl_freemail southdakota.usa.com
- hashbl_acl_freemail space.com
- hashbl_acl_freemail spacetowns.com
- hashbl_acl_freemail spain.ir
- hashbl_acl_freemail spainmail.com
- hashbl_acl_freemail spamex.com
- hashbl_acl_freemail spartapiet.com
- hashbl_acl_freemail specialoperations.com
- hashbl_acl_freemail speed-racer.com
- hashbl_acl_freemail speedpost.net
- hashbl_acl_freemail speedymail.net
- hashbl_acl_freemail speedymail.org
- hashbl_acl_freemail spells.com
- hashbl_acl_freemail spils.com
- hashbl_acl_freemail spinfinder.com
- hashbl_acl_freemail sportemail.com
- hashbl_acl_freemail spray.net
- hashbl_acl_freemail spray.no
- hashbl_acl_freemail spray.se
- hashbl_acl_freemail spymac.com
- hashbl_acl_freemail srbbs.com
- hashbl_acl_freemail srilankan.net
- hashbl_acl_freemail ssan.com
- hashbl_acl_freemail ssl-mail.com
- hashbl_acl_freemail staatsterrorist.de
- hashbl_acl_freemail stade.fr
- hashbl_acl_freemail stalag13.com
- hashbl_acl_freemail stampmail.com
- hashbl_acl_freemail starbuzz.com
- hashbl_acl_freemail stargate2.com
- hashbl_acl_freemail stargateatlantis.com
- hashbl_acl_freemail stargatefanclub.com
- hashbl_acl_freemail stargatesg1.com
- hashbl_acl_freemail stargateu.com
- hashbl_acl_freemail starline.ee
- hashbl_acl_freemail starmail.com
- hashbl_acl_freemail starmail.org
- hashbl_acl_freemail starmedia.com
- hashbl_acl_freemail starspath.com
- hashbl_acl_freemail start.com.au
- hashbl_acl_freemail start.no
- hashbl_acl_freemail streetracing.com
- hashbl_acl_freemail stribmail.com
- hashbl_acl_freemail strompost.com
- hashbl_acl_freemail student.com
- hashbl_acl_freemail student.ednet.ns.ca
- hashbl_acl_freemail studmail.com
- hashbl_acl_freemail subspacemail.com
- hashbl_acl_freemail sudanese.cc
- hashbl_acl_freemail sudanmail.net
- hashbl_acl_freemail suez.cc
- hashbl_acl_freemail sugarray.com
- hashbl_acl_freemail suisse.org
- hashbl_acl_freemail sunbella.net
- hashbl_acl_freemail sunmail1.com
- hashbl_acl_freemail sunpoint.net
- hashbl_acl_freemail sunrise.ch
- hashbl_acl_freemail sunumail.sn
- hashbl_acl_freemail sunuweb.net
- hashbl_acl_freemail suomi24.fi
- hashbl_acl_freemail super-gerissen.de
- hashbl_acl_freemail superbikeclub.com
- hashbl_acl_freemail superdada.it
- hashbl_acl_freemail supereva.com
- hashbl_acl_freemail supereva.it
- hashbl_acl_freemail superintendents.net
- hashbl_acl_freemail supermailbox.com
- hashbl_acl_freemail superposta.com
- hashbl_acl_freemail surf3.net
- hashbl_acl_freemail surfassistant.com
- hashbl_acl_freemail surfguiden.com
- hashbl_acl_freemail surfsupnet.net
- hashbl_acl_freemail surfy.net
- hashbl_acl_freemail surgical.net
- hashbl_acl_freemail surimail.com
- hashbl_acl_freemail surnet.cl
- hashbl_acl_freemail sverige.nu
- hashbl_acl_freemail svizzera.org
- hashbl_acl_freemail sweb.cz
- hashbl_acl_freemail sweden.ir
- hashbl_acl_freemail swedenmail.com
- hashbl_acl_freemail sweetwishes.com
- hashbl_acl_freemail swift-mail.com
- hashbl_acl_freemail swissinfo.org
- hashbl_acl_freemail swissmail.com
- hashbl_acl_freemail swissmail.net
- hashbl_acl_freemail switched.com
- hashbl_acl_freemail switzerland.org
- hashbl_acl_freemail syom.com
- hashbl_acl_freemail syriamail.com
- hashbl_acl_freemail t-mail.com
- hashbl_acl_freemail t-net.net.ve
- hashbl_acl_freemail t-online.de
- hashbl_acl_freemail t2mail.com
- hashbl_acl_freemail tabasheer.com
- hashbl_acl_freemail tabouk.cc
- hashbl_acl_freemail tajikistan.cc
- hashbl_acl_freemail talk21.com
- hashbl_acl_freemail talkcity.com
- hashbl_acl_freemail tangiers.cc
- hashbl_acl_freemail tangmonkey.com
- hashbl_acl_freemail tanta.cc
- hashbl_acl_freemail tatanova.com
- hashbl_acl_freemail tattoodesign.com
- hashbl_acl_freemail taxcutadvice.com
- hashbl_acl_freemail tayef.cc
- hashbl_acl_freemail teachers.org
- hashbl_acl_freemail teamster.net
- hashbl_acl_freemail tech-center.com
- hashbl_acl_freemail techemail.com
- hashbl_acl_freemail techie.com
- hashbl_acl_freemail technisamail.co.za
- hashbl_acl_freemail technologist.com
- hashbl_acl_freemail teenchatnow.com
- hashbl_acl_freemail teenmail.co.uk
- hashbl_acl_freemail teenmail.co.za
- hashbl_acl_freemail tejary.com
- hashbl_acl_freemail telebot.com
- hashbl_acl_freemail telefonica.net
- hashbl_acl_freemail telegraf.by
- hashbl_acl_freemail teleline.es
- hashbl_acl_freemail telenet.be
- hashbl_acl_freemail telinco.net
- hashbl_acl_freemail telkom.net
- hashbl_acl_freemail telpage.net
- hashbl_acl_freemail telstra.com
- hashbl_acl_freemail telusplanet.net
- hashbl_acl_freemail tempting.com
- hashbl_acl_freemail tenchiclub.com
- hashbl_acl_freemail tennessee.usa.com
- hashbl_acl_freemail terrapins.com
- hashbl_acl_freemail tetouan.cc
- hashbl_acl_freemail texas.usa.com
- hashbl_acl_freemail texascrossroads.com
- hashbl_acl_freemail tfz.net
- hashbl_acl_freemail thai.com
- hashbl_acl_freemail thaimail.com
- hashbl_acl_freemail thaimail.net
- hashbl_acl_freemail the-fastest.net
- hashbl_acl_freemail the-quickest.com
- hashbl_acl_freemail the5thquarter.com
- hashbl_acl_freemail theblackmarket.com
- hashbl_acl_freemail thegame.com
- hashbl_acl_freemail thegamefanatic.com
- hashbl_acl_freemail theinternetemail.com
- hashbl_acl_freemail theoffice.net
- hashbl_acl_freemail theplate.com
- hashbl_acl_freemail thepostmaster.net
- hashbl_acl_freemail theracetrack.com
- hashbl_acl_freemail therapist.net
- hashbl_acl_freemail theserverbiz.com
- hashbl_acl_freemail thewatercooler.com
- hashbl_acl_freemail thewebpros.co.uk
- hashbl_acl_freemail thinkpost.net
- hashbl_acl_freemail thirdage.com
- hashbl_acl_freemail thundermail.com
- hashbl_acl_freemail tightmail.com
- hashbl_acl_freemail tim.it
- hashbl_acl_freemail timemail.com
- hashbl_acl_freemail timor.cc
- hashbl_acl_freemail tin.it
- hashbl_acl_freemail tinati.net
- hashbl_acl_freemail tiscali.co.uk
- hashbl_acl_freemail tiscali.com
- hashbl_acl_freemail tiscali.it
- hashbl_acl_freemail tiscalinet.it
- hashbl_acl_freemail tjohoo.se
- hashbl_acl_freemail tkcity.com
- hashbl_acl_freemail tlcfan.com
- hashbl_acl_freemail tlen.pl
- hashbl_acl_freemail tmicha.net
- hashbl_acl_freemail todito.com
- hashbl_acl_freemail todoperros.com
- hashbl_acl_freemail toke.com
- hashbl_acl_freemail tokyo.com
- hashbl_acl_freemail tokyo.ir
- hashbl_acl_freemail tombstone.ws
- hashbl_acl_freemail toothandmail.com
- hashbl_acl_freemail toothfairy.com
- hashbl_acl_freemail topchat.com
- hashbl_acl_freemail topmail.co.ie
- hashbl_acl_freemail topmail.co.in
- hashbl_acl_freemail topmail.co.nz
- hashbl_acl_freemail topmail.co.uk
- hashbl_acl_freemail topmail.co.za
- hashbl_acl_freemail topmail.com.ar
- hashbl_acl_freemail topmail.dk
- hashbl_acl_freemail topsurf.com
- hashbl_acl_freemail toquedequeda.com
- hashbl_acl_freemail torba.com
- hashbl_acl_freemail torchmail.com
- hashbl_acl_freemail torontomail.com
- hashbl_acl_freemail total-techie.com
- hashbl_acl_freemail totalfoodnut.com
- hashbl_acl_freemail totally-into-cooking.com
- hashbl_acl_freemail totallyintobaseball.com
- hashbl_acl_freemail totallyintobasketball.com
- hashbl_acl_freemail totallyintocooking.com
- hashbl_acl_freemail totallyintofootball.com
- hashbl_acl_freemail totallyintogolf.com
- hashbl_acl_freemail totallyintohockey.com
- hashbl_acl_freemail totallyintomusic.com
- hashbl_acl_freemail totallyintoreading.com
- hashbl_acl_freemail totallyintosports.com
- hashbl_acl_freemail totallyintotravel.com
- hashbl_acl_freemail totalmail.com
- hashbl_acl_freemail totalmoviefan.com
- hashbl_acl_freemail totalsurf.com
- hashbl_acl_freemail totonline.net
- hashbl_acl_freemail tough.com
- hashbl_acl_freemail toughguy.net
- hashbl_acl_freemail trav.se
- hashbl_acl_freemail travel2newplaces.com
- hashbl_acl_freemail trevas.net
- hashbl_acl_freemail tripod-mail.com
- hashbl_acl_freemail triton.net
- hashbl_acl_freemail trmailbox.com
- hashbl_acl_freemail troamail.org
- hashbl_acl_freemail tsamail.co.za
- hashbl_acl_freemail tunisian.cc
- hashbl_acl_freemail tunome.com
- hashbl_acl_freemail turbonett.com
- hashbl_acl_freemail turkey.com
- hashbl_acl_freemail tushmail.com
- hashbl_acl_freemail tvchannelsurfer.com
- hashbl_acl_freemail tvnet.lv
- hashbl_acl_freemail tvstar.com
- hashbl_acl_freemail twc.com
- hashbl_acl_freemail typemail.com
- hashbl_acl_freemail u2club.com
- hashbl_acl_freemail u2tours.com
- hashbl_acl_freemail uae.ac
- hashbl_acl_freemail ubbi.com
- hashbl_acl_freemail ubbi.com.br
- hashbl_acl_freemail uboot.com
- hashbl_acl_freemail ugeek.com
- hashbl_acl_freemail uk2.net
- hashbl_acl_freemail uk2net.com
- hashbl_acl_freemail ukr.net
- hashbl_acl_freemail ukrpost.net
- hashbl_acl_freemail ukrpost.ua
- hashbl_acl_freemail uku.co.uk
- hashbl_acl_freemail ulimit.com
- hashbl_acl_freemail ultimateredskinsfan.com
- hashbl_acl_freemail ummah.org
- hashbl_acl_freemail umpire.com
- hashbl_acl_freemail unbounded.com
- hashbl_acl_freemail unendlich-schlau.de
- hashbl_acl_freemail unican.es
- hashbl_acl_freemail unicum.de
- hashbl_acl_freemail unimail.mn
- hashbl_acl_freemail unitedemailsystems.com
- hashbl_acl_freemail universal.pt
- hashbl_acl_freemail universia.cl
- hashbl_acl_freemail universia.edu.ve
- hashbl_acl_freemail universia.es
- hashbl_acl_freemail universia.net.co
- hashbl_acl_freemail universia.net.mx
- hashbl_acl_freemail universia.pr
- hashbl_acl_freemail universia.pt
- hashbl_acl_freemail universiabrasil.net
- hashbl_acl_freemail unofree.it
- hashbl_acl_freemail uol.com.ar
- hashbl_acl_freemail uol.com.br
- hashbl_acl_freemail uole.com
- hashbl_acl_freemail uolmail.com
- hashbl_acl_freemail uomail.com
- hashbl_acl_freemail uraniomail.com
- hashbl_acl_freemail urbi.com.br
- hashbl_acl_freemail urdun.cc
- hashbl_acl_freemail ureach.com
- hashbl_acl_freemail usa.com
- hashbl_acl_freemail usanetmail.com
- hashbl_acl_freemail userbeam.com
- hashbl_acl_freemail utah.usa.com
- hashbl_acl_freemail uymail.com
- hashbl_acl_freemail uyuyuy.com
- hashbl_acl_freemail v-sexi.com
- hashbl_acl_freemail v3mail.com
- hashbl_acl_freemail vegetarisme.be
- hashbl_acl_freemail velnet.com
- hashbl_acl_freemail velocall.com
- hashbl_acl_freemail vercorreo.com
- hashbl_acl_freemail verizonmail.com
- hashbl_acl_freemail vermont.usa.com
- hashbl_acl_freemail verticalheaven.com
- hashbl_acl_freemail veryfast.biz
- hashbl_acl_freemail veryspeedy.net
- hashbl_acl_freemail vfemail.net
- hashbl_acl_freemail videogamesrock.com
- hashbl_acl_freemail vietmedia.com
- hashbl_acl_freemail vip-client.de
- hashbl_acl_freemail vip.126.com
- hashbl_acl_freemail vip.163.com
- hashbl_acl_freemail vip.188.com
- hashbl_acl_freemail vip.gr
- hashbl_acl_freemail vip.qq.com
- hashbl_acl_freemail vip.sina.com
- hashbl_acl_freemail vip.sohu.com
- hashbl_acl_freemail vip.sohu.net
- hashbl_acl_freemail vip.tom.com
- hashbl_acl_freemail vipsohu.net
- hashbl_acl_freemail virgilio.it
- hashbl_acl_freemail virgin.net
- hashbl_acl_freemail virginia.usa.com
- hashbl_acl_freemail virtual-mail.com
- hashbl_acl_freemail visitmail.com
- hashbl_acl_freemail visto.com
- hashbl_acl_freemail vitalogy.org
- hashbl_acl_freemail vivelared.com
- hashbl_acl_freemail vjtimail.com
- hashbl_acl_freemail vnn.vn
- hashbl_acl_freemail vodafone.com
- hashbl_acl_freemail vodafone.it
- hashbl_acl_freemail vodamail.co.za
- hashbl_acl_freemail voila.fr
- hashbl_acl_freemail volkermord.com
- hashbl_acl_freemail volunteeringisawesome.com
- hashbl_acl_freemail vosforums.com
- hashbl_acl_freemail vsnl.com
- hashbl_acl_freemail vsnl.net
- hashbl_acl_freemail w.cn
- hashbl_acl_freemail walla.co.il
- hashbl_acl_freemail walla.com
- hashbl_acl_freemail wallet.com
- hashbl_acl_freemail wam.co.za
- hashbl_acl_freemail wanex.ge
- hashbl_acl_freemail wap.hu
- hashbl_acl_freemail wapda.com
- hashbl_acl_freemail wapicode.com
- hashbl_acl_freemail wappi.com
- hashbl_acl_freemail warpmail.net
- hashbl_acl_freemail washington.usa.com
- hashbl_acl_freemail wassup.com
- hashbl_acl_freemail waterloo.com
- hashbl_acl_freemail waumail.com
- hashbl_acl_freemail wayintocomputers.com
- hashbl_acl_freemail wazmail.com
- hashbl_acl_freemail wearab.net
- hashbl_acl_freemail web-mail.com.ar
- hashbl_acl_freemail web.de
- hashbl_acl_freemail web.nl
- hashbl_acl_freemail web2mail.com
- hashbl_acl_freemail webaddressbook.com
- hashbl_acl_freemail webbworks.com
- hashbl_acl_freemail webcity.ca
- hashbl_acl_freemail webdream.com
- hashbl_acl_freemail webemaillist.com
- hashbl_acl_freemail webindia123.com
- hashbl_acl_freemail webinfo.fi
- hashbl_acl_freemail webjump.com
- hashbl_acl_freemail webl-3.br.inter.net
- hashbl_acl_freemail webmail.co.yu
- hashbl_acl_freemail webmail.co.za
- hashbl_acl_freemail webmails.com
- hashbl_acl_freemail webmailv.com
- hashbl_acl_freemail webname.com
- hashbl_acl_freemail webpim.cc
- hashbl_acl_freemail webspawner.com
- hashbl_acl_freemail webstation.com
- hashbl_acl_freemail websurfer.co.za
- hashbl_acl_freemail webtopmail.com
- hashbl_acl_freemail webtribe.net
- hashbl_acl_freemail webtv.net
- hashbl_acl_freemail weedmail.com
- hashbl_acl_freemail weekonline.com
- hashbl_acl_freemail weirdness.com
- hashbl_acl_freemail westvirginia.usa.com
- hashbl_acl_freemail whale-mail.com
- hashbl_acl_freemail whatisthis.com
- hashbl_acl_freemail whatmail.com
- hashbl_acl_freemail when.com
- hashbl_acl_freemail whipmail.com
- hashbl_acl_freemail who.net
- hashbl_acl_freemail whoever.com
- hashbl_acl_freemail wild4music.com
- hashbl_acl_freemail wildaboutelectronics.com
- hashbl_acl_freemail wildcats.com
- hashbl_acl_freemail wildmail.com
- hashbl_acl_freemail will-keinen-spam.de
- hashbl_acl_freemail williams.net.ar
- hashbl_acl_freemail winning.com
- hashbl_acl_freemail winningteam.com
- hashbl_acl_freemail winwinhosting.com
- hashbl_acl_freemail wisconsin.usa.com
- hashbl_acl_freemail witelcom.com
- hashbl_acl_freemail witty.com
- hashbl_acl_freemail wolverines.com
- hashbl_acl_freemail wooow.it
- hashbl_acl_freemail worker.com
- hashbl_acl_freemail workingaroundthehouse.com
- hashbl_acl_freemail workingonthehouse.com
- hashbl_acl_freemail workmail.co.za
- hashbl_acl_freemail workmail.com
- hashbl_acl_freemail worldcrossing.com
- hashbl_acl_freemail worldemail.com
- hashbl_acl_freemail worldmedic.com
- hashbl_acl_freemail worldonline.de
- hashbl_acl_freemail wowmail.com
- hashbl_acl_freemail wp.pl
- hashbl_acl_freemail wprost.pl
- hashbl_acl_freemail wrestlezone.com
- hashbl_acl_freemail writeme.com
- hashbl_acl_freemail writesoon.com
- hashbl_acl_freemail wrongmail.com
- hashbl_acl_freemail wtonetwork.com
- hashbl_acl_freemail wurtele.net
- hashbl_acl_freemail www.com
- hashbl_acl_freemail www.consulcredit.it
- hashbl_acl_freemail wyoming.usa.com
- hashbl_acl_freemail x-mail.net
- hashbl_acl_freemail xasa.com
- hashbl_acl_freemail xemail.com
- hashbl_acl_freemail xfreehosting.com
- hashbl_acl_freemail xmail.net
- hashbl_acl_freemail xmasmail.com
- hashbl_acl_freemail xmsg.com
- hashbl_acl_freemail xnmsn.cn
- hashbl_acl_freemail xoom.com
- hashbl_acl_freemail xpectmore.com
- hashbl_acl_freemail xrea.com
- hashbl_acl_freemail xsmail.com
- hashbl_acl_freemail xtra.co.nz
- hashbl_acl_freemail xuite.net
- hashbl_acl_freemail xzapmail.com
- hashbl_acl_freemail y7mail.com
- hashbl_acl_freemail ya.com
- hashbl_acl_freemail ya.ru
- hashbl_acl_freemail yahala.co.il
- hashbl_acl_freemail yaho.com
- hashbl_acl_freemail yahoo.co.uk
- hashbl_acl_freemail yahoo.com
- hashbl_acl_freemail yahoomail.com
- hashbl_acl_freemail yalla.com.lb
- hashbl_acl_freemail yam.com
- hashbl_acl_freemail yamal.info
- hashbl_acl_freemail yanbo.cc
- hashbl_acl_freemail yandex.ru
- hashbl_acl_freemail yapost.com
- hashbl_acl_freemail yawmail.com
- hashbl_acl_freemail yeah.net
- hashbl_acl_freemail yebox.com
- hashbl_acl_freemail yehey.com
- hashbl_acl_freemail yellow-jackets.com
- hashbl_acl_freemail yellowstone.net
- hashbl_acl_freemail yemeni.cc
- hashbl_acl_freemail yenimail.com
- hashbl_acl_freemail yepmail.net
- hashbl_acl_freemail yifan.net
- hashbl_acl_freemail ymail.com
- hashbl_acl_freemail yopmail.com
- hashbl_acl_freemail your-mail.com
- hashbl_acl_freemail yours.com
- hashbl_acl_freemail yourwap.com
- hashbl_acl_freemail yunus.cc
- hashbl_acl_freemail yyhmail.com
- hashbl_acl_freemail z11.com
- hashbl_acl_freemail z6.com
- hashbl_acl_freemail zagazig.cc
- hashbl_acl_freemail zambia.cc
- hashbl_acl_freemail zednet.co.uk
- hashbl_acl_freemail zeeman.nl
- hashbl_acl_freemail ziplip.com
- hashbl_acl_freemail zipmail.com.br
- hashbl_acl_freemail zipmax.com
- hashbl_acl_freemail zmail.pt
- hashbl_acl_freemail zmail.ru
- hashbl_acl_freemail zoho.com
- hashbl_acl_freemail zona-andina.net
- hashbl_acl_freemail zonai.com
- hashbl_acl_freemail zoneview.net
- hashbl_acl_freemail zonnet.nl
- hashbl_acl_freemail zoomshare.com
- hashbl_acl_freemail zoznam.sk
- hashbl_acl_freemail zu-geil.de
- hashbl_acl_freemail zubee.com
- hashbl_acl_freemail zuvio.com
- hashbl_acl_freemail zwallet.com
- hashbl_acl_freemail zworg.com
- hashbl_acl_freemail zybermail.com
- hashbl_acl_freemail zzn.com
-
- hashbl_acl_freemail !notify@yahoogroups.com
- hashbl_acl_freemail !no-reply@yahoogroups.com
- hashbl_acl_freemail !groupsupdates@yahoogroups.com
- hashbl_acl_freemail !calendarnotification@outlook.com
- hashbl_acl_freemail !nsubscribe@googlegroups.com
- hashbl_acl_freemail !ubscribe@googlegroups.com
- hashbl_acl_freemail !unsubscribe@googlegroups.com
+ # Short URL in PCCC HashBL found
+ header PCCC_HASHBL_SHORT_URI eval:check_hashbl_uris('wild.pccc.com', 'md5', '^127\.0\.1\.4')
+ describe PCCC_HASHBL_SHORT_URI Message contains short URI found on PCCC HashBL (https://raptor.pccc.com/RBL)
+ tflags PCCC_HASHBL_SHORT_URI net
+ score PCCC_HASHBL_SHORT_URI 9.5
+ priority PCCC_HASHBL_SHORT_URI -100
+
endif
endif
endif
describe KAM_WATERHACK Diet Scams
score KAM_WATERHACK 5.0
+#Web forms used to submit shortened urls
+header __XMAIL_CODEIGN X-Mailer =~ /CodeIgniter/
+header __XMAIL_PHPMAIL X-Mailer =~ /PHPMailer/
+meta GB_WEBFORM ( ( __XMAIL_CODEIGN || __XMAIL_PHPMAIL ) && KAM_SHORT && FREEMAIL_FROM )
+describe GB_WEBFORM Webform with url shortener
+score GB_WEBFORM 2.0
+
#Sendgrid Exploits
#thanks to Chip for another Spample on 2020-03-07
header __KAM_SENDGRID1 EnvelopeFrom =~ /\@u\d+\.wl\d+\.sendgrid\.net|bounces.*\@sendgrid\.net/i
describe KAM_SENDGRID2 Sendgrid being exploited by scammers
score KAM_SENDGRID2 2.0
-#Political Spam
-header __KAM_2020_1 Subject =~ /Re-?elect Trump|(science|funny|election|christmas|personalized|mission) (t|tee)( |-)?shirt|ginsburg shirt|officially licensed/i
-body __KAM_2020_2 /T-?shirt|printed in the US|stink stank stunk|officially licensed|star wars/i
+#Political (and T-shirt Spam)
+header __KAM_2020_1 Subject =~ /Re-?elect Trump|(Guinea pig|science|funny|election|christmas|personalized|mission|collection|engineer|teacher|fishing) (t|tee)( |-)?shirt|ginsburg shirt|officially licensed|check out our new collection|let.?s go brandon/i
+header __KAM_2020_1A From:name =~ /(T|Tee).?shirt|Tee4u/i
+body __KAM_2020_2 /(Tee|T)-?shirt|printed in the US|stink stank stunk|officially licensed|star wars|funny (guinea pig|science|tee|teacher|fishing|halloween)|\d+ designs|let.?s go brandon/i
tflags __KAM_2020_2 nosubject
-meta KAM_2020 (__KAM_2020_1 + __KAM_2020_2 + FREEMAIL_FROM >= 3)
-describe KAM_2020 2020 Political (and Tshirt???) Spams - Vote for KAM & Pedro - donate today at www.mcgrail.com
+uri __KAM_GOOGLE_FORM /docs\.google\.com\/form/i
+
+meta KAM_2020 ((__KAM_2020_1 + __KAM_2020_1A >=1) + __KAM_2020_2 + __KAM_GOOGLE_FORM + FREEMAIL_FROM >= 3)
+describe KAM_2020 Political (and Tshirt???) Spams - Vote for KAM & Pedro - donate today at www.mcgrail.com
score KAM_2020 7.0
#WeTransfer Spam
score KAM_QUINFORCE1 6.0
#SPAMDUJOUR
-body __KAM_CBD1 /Meridian CBD/i
+body __KAM_CBD1 /(Prosper|Meridian) CBD/i
+header __KAM_CBD2 From:name =~ /CBD/i
-meta KAM_CBD (__KAM_CBD1 + __KAM_OTHER_BAD_TLD2 >= 2)
+meta KAM_CBD (__KAM_CBD1 + __KAM_CBD2 + __KAM_OTHER_BAD_TLD2 >= 2)
describe KAM_CBD Spam du jour for CBD
score KAM_CBD 4.5
#VOICEMAIL SCAM
replace_rules __KAM_VM3
-uri __KAM_VM1 /storage.googleapis.com\/.*?htm|appspot\.com|safesend\.|\/api\/v1\/click\|\.sharepoint\.com\/personal\/|evernote\.com|github\.io|netlify\.app|sendgrid\.net/i
+
+uri __KAM_VM1 /storage.googleapis.com\/.*?htm|appspot\.com|safesend\.|\/api\/v1\/click\|\.sharepoint\.com\/personal\/|evernote\.com|github\.io|netlify\.app|sendgrid\.net|dynamics\.com/i
header __KAM_VM2 Subject =~ /VN Audio|message for|voice Message|Voicemail|Fax Message|OneDrive File|voice note duration|voice-audio|telephone vm/i
-body __KAM_VM3 /(Voice.?Audio|VN Audio|VM Meant|Listen to (your )?Voice|voicemail message|Fax(ed)? (document|message)|new voicemail|Virtual <O1>ffice Extens<I1>on)/i
+header __KAM_VM2A From =~ /-xxxx|tele-mail/i
+body __KAM_VM3 /(Voice.?Audio|VN Audio|VM Meant|Listen to (your )?Voice|voicemail message|Fax(ed)? (document|message)|new voicemail|Virtual <O1>ffice Extens<I1>on)|ca<L1><L1>er left you a message/i
tflags __KAM_VM3 nosubject
-body __KAM_VM4 /recorded voice|audio message|Caller.?id|CID:|mailbox \d|sign document/i
+body __KAM_VM4 /recorded voice|audio message|Caller.?id|CID:|mailbox \d|sign document|new vm on/i
tflags __KAM_VM4 nosubject
+ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
+mimeheader __KAM_VM5 Content-Type =~ /.html?\"?$/i
+endif
-meta KAM_VM (__KAM_VM1 + __KAM_VM2 + __KAM_VM3 + __KAM_VM4 >= 3)
+meta KAM_VM (__KAM_VM1 + (__KAM_VM2A + __KAM_VM2 >= 1) + __KAM_VM3 + __KAM_VM4 + __KAM_VM5 + KAM_RAPTOR_EXTERNAL >= 3)
score KAM_VM 5.5
describe KAM_VM Voice Mail & Fax Scams
#BENEFICIARY
replace_rules __KAM_BENEFICIARY2
-header __KAM_BENEFICIARY1 Subject =~ /(your|Urgent) Help|refugee|Attention|Inherit|donation|refund|beloved|^Hello$|dear friend|compensated|get back to me|hope to hear|my dear|postal service|From.....|compliment|sincere apology|proposal|How are you|congratulations|ATM VISA Card|good (day|news)|beneficiary|cc|best regards|dearest one|^Att$|^Reply$|partnership|greeting'?s|atm fund|postmaster general|Investment/i
+header __KAM_BENEFICIARY1 Subject =~ /(your|Urgent) Help|refugee|Attention|Inherit|donation|refund|beloved|^Hello$|dear friend|compensated|get back to me|hope to hear|my dear|postal service|From.....|compliment|sincere apology|proposal|How are you|congratulations|ATM VISA Card|good (day|news)|beneficiary|cc|best regards|dearest one|^Att$|^Reply$|partnership|greeting'?s|atm fund|postmaster general|Investment|shipment|indicate your interest/i
#what
body __KAM_BENEFICIARY2 /(consignment|fund(\b|$)|person of trust|don't know me|emails only|apologize for intrud|formal relationship|diplomatic agent|ATM VISA CARD|unsolicited manner|proposition|solicit your|trustworthy relation|verily|random people|you a beneficiary|help<SPACE1>+widow|same last ?name|(same|similar) surname|investment manager)|level of maturity|important project|jackpot|investment opp|something important|unclaimed trunk|estate investment|donation recipient|bank draft|funding of your business/i
tflags __KAM_BENEFICIARY2 nosubject
#bus
-body __KAM_BENEFICIARY3 /(gold|diamonds|inherit|foreign customer|risk.?free|less.privilege|next of kin|nearest airport|certain funds|partnership to transfer|repatriation|co.fiscate|separate account|christian activit|receiving bank|donate the sum|money left|sweepstakes|lucky winner|get rich|\d% of the total|investment fund)|moving some money|god has blessed|contributions to humanity|partake in the deal|pledge dep|over-?due compensation|left your check|invest(ment)? in your country/i
+body __KAM_BENEFICIARY3 /(gold|diamonds|inherit|foreign customer|risk.?free|less.privilege|next of kin|nearest airport|certain funds|partnership to transfer|repatriation|co.fiscate|separate account|christian activit|receiving bank|donate the sum|money left|sweepstakes|lucky winner|get rich|\d% of the total|investment fund)|moving some money|god has blessed|contributions to humanity|partake in the deal|pledge dep|over-?due compensation|left your check|invest(ment)? in your country|abandoned shipment/i
#where
body __KAM_BENEFICIARY4 /(Ghana|South Africa|China|Greece|Estonia|United kingdom|foreign|(your|my) country|Benin|africa|Foreign Op|international Airport|portugal|business trip|Ivory Coast|Royal Bank|Syria|Libyan|Ministry of |Buffett Foundation|audit unit)|postmaster general|your country/i
#how much
-body __KAM_BENEFICIARY5 /\d+ ?(kilo|kg)|donat|assignment|last wishes|charity org|million dollars|secret account|overdue winnings|handsomely compensate|large amount|share of fund|one digit interest|beneficial business|anticipated cooperation|\d% (with|for) you|fiscal cash|huge amount|(half|99 percent) of (his|their|her) fortune|by proxy/i
+body __KAM_BENEFICIARY5 /\d+ ?(kilo|kg)|donat|assignment|last wishes|charity org|million dollars|secret account|overdue winnings|handsomely compensate|large amount|share of fund|one digit interest|beneficial business|anticipated cooperation|\d% (with|for) you|fiscal cash|huge amount|(half|99 percent) of (his|their|her) fortune|by proxy|\d million|investment in your country/i
#sob
-body __KAM_BENEFICIARY6 /(deceased|late) (customer|husband|client|father)|death of my husband|cancer|power of attorney|customer who died|orphan|no beneficiary|terminal|family treasure|not criminal|send (you )?more (information|details)|wife ran away|inability to release|terrorist attack|sterile|foreigner who died|corrupt officials|could not complete/i
+body __KAM_BENEFICIARY6 /(deceased|late) (customer|husband|client|father)|death of my husband|cancer|power of attorney|customer who died|orphan|no beneficiary|terminal|family treasure|not criminal|send (you )?more (information|details)|wife ran away|inability to release|terrorist attack|sterile|foreigner who died|corrupt officials|could not complete|Diplomat from|seized all my/i
meta KAM_BENEFICIARY ((LOTS_OF_MONEY + __KAM_BENEFICIARY5 >=1) + (KAM_BLANKSUBJECT + __KAM_BENEFICIARY1 >=1) + __KAM_BENEFICIARY2 + __KAM_BENEFICIARY3 + __KAM_BENEFICIARY4 + __KAM_BENEFICIARY6 + FREEMAIL_FROM >= 6)
describe KAM_BENEFICIARY Beneficiary scams
score KAM_JOB2 7.5
#WEB
-header __KAM_WEB2_1 Subject =~ /follow|next step|website work/i
-body __KAM_WEB2_2 /affordable (quot|price)|less than half/i
-body __KAM_WEB2_3 /web (designer|develop)|new website/i
-body __KAM_WEB2_4 /portfolio|sample|insights/i
+ #subject
+header __KAM_WEB2_1 Subject =~ /follow|next step|website (analysis|builder|work)|crazy offer|cRM solution/i
+
+ #price - purposefully looks at subject too
+body __KAM_WEB2_2 /affordable (quot|price)|cheap website|less than half|free of cost|low package price|indian web.?design/i
+
+ #product
+body __KAM_WEB2_3 /web (design|develop)|(better|new|refreshed) website|website audit|fresh look/i
+tflags __KAM_WEB2_3 nosubject
+
+ #sample/offer
+body __KAM_WEB2_4 /portfolio|sample|insights|special offer|page 1|your requirements/i
+tflags __KAM_WEB2_4 nosubject
meta KAM_WEB2 (FREEMAIL_FROM + __KAM_WEB2_1 + __KAM_WEB2_2 + __KAM_WEB2_3 + __KAM_WEB2_4 >=5)
describe KAM_WEB2 Unsolicited web workers
describe KAM_CELEB Celebrity Health Scams
score KAM_CELEB 4.5
-freemail_domains my.com
+#additional Freemail domains
+freemail_domains my.com mediacombb.net tutanota.com
#BEAL AND SIMILAR IMPERSONATOR
ifplugin Mail::SpamAssassin::Plugin::KAMOnly
#from
- header __KAM_BEAL1 From:name =~ /Geoff White|(Robert|Bob)( E.)? Beal|(James|Jim) Hoffman|Kevin (A\. )?Mc ?Grail|Chad Coney|Frederic Beuter|Chris(topher)? (K\.? )?Surprise|(mike|michael) Charvat|Sheryl Brissett Chapman|janet smith|Jeff Gardner|Geoff(rey)? White|Jason Davis|Al Nance/i
+ header __KAM_BEAL1 From:name =~ /Geoff White|(Robert|Bob)( E.)? Beal|(James|Jim) Hoffman|Kevin (A\. )?Mc ?Grail|Chad Coney|Frederic Beuter|Chris(topher)? (K\.? )?Surprise|(mike|michael) Charvat|Sheryl Brissett Chapman|janet smith|Jeff Gardner|Geoff(rey)? White|Jason Davis|Al Nance|Laura (C\.? )?Leach|Guy Neitz|Michael Rowland|Brenda MacDonald|Daram Van Oers|Pat(rick)? (A\. )?Campfield|toni Kerns|Tina L. Berger|Robert T. Lalka|Karen Holmes|Richard Manship|WILLIAM HYATT|Alex DiJohnson|Mike Rinaldi|Patrick Augustine|Randy Livingston|Michael Schoor|Amy Millar|Gino Renne/i
#in addition to freemail
- header __KAM_BEAL2 From:addr =~ /\@.+\.rr\.com|\@mail\.ru/i
+ header __KAM_BEAL2 From:addr =~ /\@.+\.rr\.com|\@mail\.ru|\@.*\.cz|\@cox\.net/i
#Name
- body __KAM_BEAL3 /(Robert|Bob).{1,4}Beal|Geoff White|(James|Jim).{1,4}Hoffman|Kevin (A\. )?Mc ?Grail|Frederic Beuter|Chris(topher)? (K\.? )?Surprise|(mike|michael) Charvat|SHERYL Brissett Chapman|Janet Smith|Jeff Gardner|Geoff(rey)? White|Jason Davis|Al Nance/i
+ body __KAM_BEAL3 /(Robert|Bob).{1,4}Beal|Geoff White|(James|Jim).{1,4}Hoffman|Kevin (A\. )?Mc ?Grail|Frederic Beuter|Chris(topher)? (K\.? )?Surprise|(mike|michael) Charvat|SHERYL Brissett Chapman|Janet Smith|Jeff Gardner|Geoff(rey)? White|Jason Davis|Al Nance|Laura (C\.? )?Leach|Guy Neitz|Michael Rowland|Brenda MacDonald|Daram Van Oers|Pat(rick)? (A\. )?Campfield|Toni Kerns|Tina L. Berger|Robert T. Lalka|Karen Holmes|Richard Manship|WILLIAM HYATT|Alex DiJohnson|Mike Rinaldi|Patrick Augustine|Randy Livingston|Michael Schoor|Amy Millar|Gino Renne/i
# Task
- body __KAM_BEAL4 /(reply with|forward|send me|let me have|give me) +your (Cell|Mobile)|task (real quick|quickly)|(urgent|quick|fast) (reply|errand|response|task|request)|make (some|a) purchase|reimburse you|do something for me fast|spare time right now|confirm if you are free|physical or electronic gift card|(done for me|send out|task done) ASAP|available at the moment|(desk|moment) right now|get some .{0,10}gift card|(reply me with|re-?confirm|drop) your cell|important task for me|certain task to be carried|purchase on my behalf|Immediate Assignment|quickly on my behalf|variety of gift card|something important for me/i
-# question / privatcy
- body __KAM_BEAL5 /can't talk on the phone|receivable aging report|summary of all w\-?2|look forward to my text|are you in the office|between you and I|confidentiality|closed-?door meeting|as soon as you can|get something done|you\'re unoccupied|accurately/i
+ body __KAM_BEAL4 /(reply with|forward|send me|let me have|give me) +your (Cell|Mobile)|task (real quick|quickly)|(urgent|quick|fast) (reply|errand|response|task|request)|make (some|a) purchase|reimburse you|do something for me fast|spare time right now|confirm if you are free|physical or electronic gift card|(done for me|send out|task done) ASAP|available at the moment|(desk|moment) right now|get some .{0,10}gift card|(reply me with|confirm|drop) your cell|(run a|important) task for me|certain task to be carried|purchase on my behalf|(urgent|Immediate) (Task|Assignment)|quickly on my behalf|variety of gift card|something important for me|carry out (urgently|swiftly)|codes electronically|make a payment|gifts for their hard|have a moment|assist me with a task|quick favor|gift cards? for staff|process a payment via Zelle|request I need|purchase done on my behalf|take care of something|handle (some )?task quickly|got a moment/i
+# question / privacy
+ body __KAM_BEAL5 /can't talk on the phone|receivable aging report|summary of all w\-?2|look forward to my text|are you (accessible|in the office|busy)|between you and I|closed-?door meeting|as soon as you can|get something done|you\'re unoccupied|accurately|I can brief|in a (conference|meeting)|personal (email|text phone|cell|number)|drop your number|reimburse if personal|what details do you need|(do|handle) discreetly|confidentiality|keep this private|get to a nearby store|confirm if you can get it done|no calls just reply|write me back|look out for my text|concise you about it|so much on your plate/i
- meta KAM_BEAL (__KAM_BEAL1 + __KAM_BEAL3 >= 1) && ((SPF_SOFTFAIL + FREEMAIL_FROM + FREEMAIL_FORGED_REPLYTO + __KAM_BEAL2 >= 1) + __KAM_BEAL4 + __KAM_BEAL5 >= 3)
+ meta KAM_BEAL (__KAM_BEAL1 + __KAM_BEAL3 >= 1) && ((SPF_SOFTFAIL + FREEMAIL_FROM + FREEMAIL_FORGED_REPLYTO + __KAM_BEAL2 + KAM_RAPTOR_EXTERNAL >= 1) + __KAM_BEAL4 + __KAM_BEAL5 >= 3)
describe KAM_BEAL IMPOSTER! Will the real Slim Shady, please stand up?
score KAM_BEAL 14.0
+ subjprefix KAM_BEAL [Imposter]
+
+ meta KAM_BEAL2 (__KAM_BEAL1 + __KAM_BEAL3 >= 1) && (KAM_RAPTOR_EXTERNAL + __KAM_BEAL4 + __KAM_BEAL5 >= 2) && (KAM_BEAL <= 0)
+ describe KAM_BEAL2 IMPOSTER! Will the real Slim Shady, please stand up?
+ score KAM_BEAL2 10.0
+ subjprefix KAM_BEAL2 [Imposter]
+
+#EXTERNAL SENDER
+ header KAM_RAPTOR_EXTERNAL X-Raptor-External =~ /Yes/i
+ describe KAM_RAPTOR_EXTERNAL Raptor identified an External Sender
+ score KAM_RAPTOR_EXTERNAL 0.1
endif
#PROJECT
#FAKEDROPBOX
header __KAM_FAKEDROPBOX2_1 Subject =~ /on Dropbox/i
-meta KAM_FAKEDROPBOX2 (__KAM_FAKEDROPBOX2_1 + __KAM_TINYDOMAIN + FREEMAIL_FROM >= 3)
+meta KAM_FAKEDROPBOX2 (__KAM_FAKEDROPBOX2_1 + KAM_SHORT + FREEMAIL_FROM >= 3)
describe KAM_FAKEDROPBOX2 Fake Dropbox Phish
score KAM_FAKEDROPBOX2 4.5
score KAM_FAKEMONEYGRAM 5.5
-#FAKESHAREPOINT
-header __KAM_FAKESHAREPOINT1 Subject =~ /by Sharepoint|payment reminder|shared|Request for Quot/i
-header __KAM_FAKESHAREPOINT2 from =~ /sharepoint|accounts? payable|RFQ/i
-uri __KAM_FAKESHAREPOINT3 /my\.sharepoint\.com|appdomain\.cloud/i
-body __KAM_FAKESHAREPOINT4 /Sharepoint Fileshare/i
-mimeheader __KAM_FAKESHAREPOINT5 Content-Type =~ /.html?\"?$/i
+#FAKESHAREPOINT - SEE FAKESHAREPOINT2 for Sexually explicit
+header __KAM_FAKE_SHAREPOINT1 Subject =~ /(via|by) Sharepoint|payment reminder|shared|Request for Quot|urgent|far from you/i
+header __KAM_FAKE_SHAREPOINT2 from =~ /sharepoint|accounts? payable|RFQ/i
+uri __KAM_FAKE_SHAREPOINT3 /my\.sharepoint\.com/i
+uri __KAM_FAKE_SHAREPOINT3A /appdomain\.cloud|discordapp\.com|netlify\.app/i
+body __KAM_FAKE_SHAREPOINT4 /Sharepoint Fileshare|open.me.{0,3}asap/i
+ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
+mimeheader __KAM_FAKE_SHAREPOINT5 Content-Type =~ /.html?\"?$/i
+endif
+
+meta KAM_FAKE_SHAREPOINT (__KAM_FAKE_SHAREPOINT1 + __KAM_FAKE_SHAREPOINT2 + (__KAM_FAKE_SHAREPOINT3 + __KAM_FAKE_SHAREPOINT3A + KAM_STORAGE_GOOGLE + __KAM_FAKE_SHAREPOINT4 >= 1) + __KAM_FAKE_SHAREPOINT5 >= 3)
+describe KAM_FAKE_SHAREPOINT Fake Sharepoint Phish
+score KAM_FAKE_SHAREPOINT 6.0
-meta KAM_FAKESHAREPOINT (__KAM_FAKESHAREPOINT1 + __KAM_FAKESHAREPOINT2 + (__KAM_FAKESHAREPOINT3 + KAM_STORAGE_GOOGLE + __KAM_FAKESHAREPOINT4 >= 1) + __KAM_FAKESHAREPOINT5 >= 3)
-describe KAM_FAKESHAREPOINT Fake Sharepoint Phish
-score KAM_FAKESHAREPOINT 4.0
+#MORE FAKE SHAREPOINT BAD LINKS IN A SHAREPOINT MESSAGE
+meta KAM_FAKE_SHAREPOINTLINK (__KAM_FAKE_SHAREPOINT1 + __KAM_FAKE_SHAREPOINT2 + (__KAM_FAKE_SHAREPOINT3A + KAM_STORAGE_GOOGLE) >= 3) && !KAM_FAKE_SHAREPOINT
+describe KAM_FAKE_SHAREPOINTLINK Fake Sharepoint Link Phish
+score KAM_FAKE_SHAREPOINTLINK 4.5
#ENCRYPTED ZIP
body __KAM_BADZIP1 /attached (to email|document)|take a look/i
score KAM_VERIZON 9.5
#Docusign SCAM
-header __KAM_DOCUSIGN1 Subject =~ /New e-DocuSign Signature|new e-signature docusign|docusign electronic signature|transfer notice|docusign (electronic|signature) service/i
+header __KAM_DOCUSIGN1 Subject =~ /New e-DocuSign Signature|new e-signature docusign|docusign electronic signature|transfer notice|docusign (electronic|signature) service|docusign document/i
header __KAM_DOCUSIGN2 From:name =~ /docusign/i
header __KAM_DOCUSIGN3 From:addr !~ /docusign/i
-uri __KAM_DOCUSIGN4 /\.weebly\.com|docs\.google\.com/i
+uri __KAM_DOCUSIGN4 /\.weebly\.com|docs\.google\.com|onedrive\.live\.com/i
meta KAM_DOCUSIGN ((__KAM_DOCUSIGN1 >= 1) + (__KAM_DOCUSIGN2 + __KAM_DOCUSIGN3 >= 2) + (FREEMAIL_FROM + LOTS_OF_MONEY + __KAM_DOCUSIGN4 >= 1) >= 3)
describe KAM_DOCUSIGN Fake Document Signature account notices
score KAM_DOCUSIGN 4.5
+meta KAM_DOCUSIGN_LOW (__KAM_DOCUSIGN1 + __KAM_DOCUSIGN4 >= 2)
+describe KAM_DOCUSIGN_LOW Lower score Fake Document Signature Account Notice
+score KAM_DOCUSIGN_LOW 3.0
+
#Invalid From
header __KAM_TWODOTS From:addr =~ /\@.*\.\./i
score KAM_FAKE_TRUST 3.5
#FAKE INVOICE
-header __KAM_FAKE_INVOICE1 Subject =~ /payment advice/i
-body __KAM_FAKE_INVOICE2 /Payment advice/i
+header __KAM_FAKE_INVOICE1 Subject =~ /(remittance|payment) advice|past.?due|purchase order|EFT payment/i
+body __KAM_FAKE_INVOICE2 /(remittance|Payment) advice|past due invoice|new proforma/i
+tflags __KAM_FAKE_INVOICE2 nosubject
-meta KAM_FAKE_INVOICE (T_HTML_ATTACH + __KAM_FAKE_INVOICE1 + __KAM_FAKE_INVOICE2 >= 3)
-describe KAM_FAKE_INVOICE Fake Invoice Scam
-score KAM_FAKE_INVOICE 6.0
+meta KAM_FAKE_INVOICE ((T_HTML_ATTACH + OLEMACRO_URI_TARGET >= 1) + __KAM_FAKE_INVOICE1 + __KAM_FAKE_INVOICE2 >= 3)
+describe KAM_FAKE_INVOICE Fake Invoice / Purchase Order Scam
+score KAM_FAKE_INVOICE 6.4
#BAD PRODUCTS
header __KAM_BAD_PRODUCT1 Subject =~ /Dolphin Vacuum|Warm any room|rapid thaw/i
score KAM_CITIZEN 7.5
#BAD PRODUCTS
-header __KAM_PRODUCT2_1 Subject =~ /meal delivery|no chopping|(sticker|Children'?s?) book|\$[\d,\.]{5,10} Fast|Car ?Shield|Top Vet|Chew a day|trugreen|(perfect|healthy|your) lawn|slice.?n.?seal|kitchen (device|gadget)|butter knive|small penis|make you bigger|increase size|ACs|Wifi Booster|anti.?snore|visceral fat|solar ?bright|mini a\/?c|portable (cooler|air.?condition)|keep cool|wife.caught/i
+header __KAM_PRODUCT2_1 Subject =~ /meal delivery|no chopping|(sticker|Children'?s?) book|\$[\d,\.]{5,10} Fast|Car ?Shield|Top Vet|Chew a day|trugreen|(perfect|healthy|your) lawn|slice.?n.?seal|kitchen (device|gadget)|butter knive|small penis|make you bigger|(explosive|increase) size|ACs|Wifi Booster|anti.?snore|visceral fat|solar ?bright|mini a\/?c|portable (cooler|air.?condition)|keep cool|wife.caught|banned technique/i
-body __KAM_PRODUCT2_2 /meal delivery|no chopping|i ?can ?read|zippy ?loan|car ?shield|Lick their paws|excessive scratching|trugreen|slice.?n.?seal|kitchen (device|gadget)|Better Butter|growth secret|savage.?grow|coolair|Wifi Booster|sleeplab|belly.flat|solar ?bright flood|space Cooler|coolair/i
+body __KAM_PRODUCT2_2 /meal delivery|no chopping|i ?can ?read|zippy ?loan|car ?shield|Lick their paws|excessive scratching|trugreen|slice.?n.?seal|kitchen (device|gadget)|Better Butter|(elongation|growth) secret|savage.?grow|coolair|Wifi Booster|sleeplab|belly.flat|solar ?bright flood|space Cooler|coolair/i
tflags __KAM_PRODUCT2_2 nosubject
-header __KAM_PRODUCT2_3 From =~ /veestro|i ?can ?read|zippy ?loan|car ?shieldi|petscy|trugreen|slice.?n.?seal|better.?butter|savage.?grow|CoolMe|wifi repeater|sleep.?lab|lost.?\d+lbs|solar ?bright|(mini|portable) ?A\/?C|air cooler/i
+header __KAM_PRODUCT2_3 From =~ /veestro|i ?can ?read|zippy ?loan|car ?shieldi|petscy|trugreen|slice.?n.?seal|better.?butter|savage.?grow|CoolMe|wifi repeater|sleep.?lab|lost.?\d+lbs|solar ?bright|(mini|portable) ?A\/?C|air cooler|savage.grow/i
meta KAM_PRODUCT2 ( __KAM_PRODUCT2_1 + __KAM_PRODUCT2_2 + __KAM_PRODUCT2_3 >= 3)
describe KAM_PRODUCT2 Scammy Products prevalent in spam
score KAM_INQUIRY 7.0
#FROM NAME SPAM
-header __KAM_FROM_NAME_FAKERBL From:name =~ /Sivagegrowplus\.com|Lifequote\.selectquote\.com|GoldAlliedTrust\.com|MeetAsianLady\.com|Betterbutterspreader\.com|americanhomewarranty\.com|Solarbrightfloodlight\.com/i
+header __KAM_FROM_NAME_FAKERBL From:name =~ /Sivagegrowplus\.com|Lifequote\.selectquote\.com|GoldAlliedTrust\.com|MeetAsianLady\.com|Betterbutterspreader\.com|americanhomewarranty\.com|Solarbrightfloodlight\.com|primevision\.website|FijiShowerSpa\.com|easylenders\.website|Burialinsurance\.com|curiousfinds\.com/i
meta KAM_FROM_NAME_FAKERBL (__KAM_FROM_NAME_FAKERBL >= 1)
describe KAM_FROM_NAME_FAKERBL From name contains a URL that is spammy
score KAM_FROM_NAME_FAKERBL 6.0
#FAKE NORTON
-replace_rules __KAM_FAKE_NORTON2 __KAM_FAKE_NORTON4
+replace_rules __KAM_FAKE_NORTON1 __KAM_FAKE_NORTON2 __KAM_FAKE_NORTON4
#subj
-header __KAM_FAKE_NORTON1 Subject =~ /IN.?VOICE *\#?NUMBER|ORDER\#|\#(ORDER|BILL)|Order Confirmation|INVOI?CE\#|software subscription|transaction.successful|amount.debited/i
-header __KAM_FAKE_NORTON1A To =~ /nortoncustomer/i
+header __KAM_FAKE_NORTON1 Subject =~ /IN.?VOICE *\#?NUMBER|(confirmation|ORDER|Invoice) ?(\#|Num|-?No)|\#(ORDER|BILL)|(Purchase|Order) Confirmation|(RECEIPT|INVOI?CE) ?\#|software subscription|transaction.successful|amount.debited|(subscription|service|Purchase) (renewal|request|serial) \#|renewal service \#|(Unique|Member|purchase|Bill|receipt|service|invoice) id ?(is|:|\#)|using protection|<O1>rder <I1>d|IN(\-|_)VOICE (Number|ID)|Product Id:|security renewal|(Buyer'?s|purchase) receipt|order worth \$|service notice.{0,3}\d+|antivirus activated/i
+header __KAM_FAKE_NORTON1A To =~ /norton/i
+header __KAM_FAKE_NORTON1B From =~ /norton|confirmation|renew|no.?reply/i
#Fuzz
-body __KAM_FAKE_NORTON2 /\#N<O1>RT<O1>N\#|360 (anti.?virus|Security|protection)|N<O1>rt<O1>N.?Life|norton (\- )?(360|security|deluxe|firewall)/i
+body __KAM_FAKE_NORTON2 /N<O1>RT<O1>N(\(?tm\)?|\#)|360 (anti.?virus|Security|protection)|N<O1>rt<O1>N.?Life|norton (\- )?(360|security|deluxe|protection|firewall|plus family)|(nort-.|norton|Mcafee) (Web Pro|Web|Plus(\+| Pro)|pro (net|plus|protection)|all.?round) ((Secure|Family) )?Protection|norton (plan|pro life lock)|(service (name)?|item|Product):?\s+(Norton|Nort.?Pro|geek.?squad)|norton secure plus|nort-(Advance|Pro)|nort-?one 360|life-?lock pro|mal-?ware bites|geeksquad-solutions/mi
#Oddlang
-body __KAM_FAKE_NORTON3 /Esteem your assessment|enhance our administration|recharged your club|looking for patron|delight and happiness|touch our group|confirmatory e?mail|customer service board|connect with expert|for transaction|confirmation range|did not place this order|cancel this subscription|team norton|(claim a|instant) refund|cancel the plan|for more query/i
+body __KAM_FAKE_NORTON3 /Esteem your assessment|enhance our administration|recharged your club|looking for patron|delight and happiness|touch our group|confirmatory e?mail|customer service board|connect with expert|for transaction|confirmation range|did not place this order|cancel (your|this) subscription|team norton|(claim a|instant) refund|cancel (or continue )?the plan|for more query|void (this|the) charge|account is debited|kindly activate the license|A\/C statement|you can trust them|drop you an email|don't want this plan|deactivate this plan|queries or doubt|issue with the transaction|feel free to contact|hesitate to call|appritiate your decesion|Warm (regards|respects)|(wish|want) (to )?cancel|order +worth +\$|plan has been enacted|change something|salutations|any query related|norton billing team|same has been processed|an confirmation|don\'t want to renew|remove auto-debit|auto renewal request|thanks\/norton|invalidate your subscription|precept copy|payment method.{1,10}on-?line/i
+tflags __KAM_FAKE_NORTON3 nosubject
#Order
-body __KAM_FAKE_NORTON4 /Auto.?(debit|renew)|Updated to premium|order is p<L1>aced|0rder|renewal/i
+body __KAM_FAKE_NORTON4 /Auto(matic)?-?.?-?(debit|renew)|Updated to premium|order is p<L1>aced|0rder|renewal|successfully (placed|renewed)|annual charge|have been modified|In_voice id|details pertain|auto pay|online\/card|joined our security program|payment_for_services/i
+tflags __KAM_FAKE_NORTON4 nosubject
-meta KAM_FAKE_NORTON (__KAM_FAKE_NORTON1 + __KAM_FAKE_NORTON1A + __KAM_FAKE_NORTON2 + __KAM_FAKE_NORTON3 + __KAM_FAKE_NORTON4 >= 4)
-describe KAM_FAKE_NORTON Fake Norton Notices
-score KAM_FAKE_NORTON 6.0
+meta KAM_FAKE_NORTON (__KAM_FAKE_NORTON1 + (__KAM_FAKE_NORTON1A + __KAM_FAKE_NORTON1B >= 1)+ __KAM_FAKE_NORTON2 + __KAM_FAKE_NORTON3 + __KAM_FAKE_NORTON4 + FREEMAIL_FROM >= 4)
+describe KAM_FAKE_NORTON Fake Norton / McAfee / Geek Squad Renewal Notices
+score KAM_FAKE_NORTON 8.0
-meta KAM_FAKE_NORTONLOW (__KAM_FAKE_NORTON1 + __KAM_FAKE_NORTON1A + __KAM_FAKE_NORTON2 + __KAM_FAKE_NORTON3 + __KAM_FAKE_NORTON4 >= 3) && !KAM_FAKE_NORTON
-describe KAM_FAKE_NORTONLOW Fake Norton Notices
-score KAM_FAKE_NORTONLOW 4.5
+meta KAM_FAKE_NORTONLOW (__KAM_FAKE_NORTON1 + (__KAM_FAKE_NORTON1A + __KAM_FAKE_NORTON1B >= 1) + __KAM_FAKE_NORTON2 + __KAM_FAKE_NORTON3 + __KAM_FAKE_NORTON4 + FREEMAIL_FROM >= 3) && !KAM_FAKE_NORTON
+describe KAM_FAKE_NORTONLOW Fake Norton / McAfee / Geek Squad Renewal Notices (Lower Confidence)
+score KAM_FAKE_NORTONLOW 6.5
#FAKE BANK
header __KAM_FAKE_BANK1 Subject =~ /unusual activit|security/i
score KAM_FAKE_CAN_POST 9.0
#CARING
-header __KAM_CARING1 Subject =~ /Great in Bed|(looking|Searching) +for +a +(shag|(determined|caring|loving) +(man|guy))/i
+header __KAM_CARING1 Subject =~ /Great in Bed|(looking|Searching) +for +a +(shag|(determined|caring|loving) +(man|guy|dude))/i
body __KAM_CARING2 /shagged|lovemate|online dating|affair|hook.?up/i
tflags __KAM_CARING2 nosubject
body __KAM_CARING3 /(recent|my) (contact|picture|photo)/i
#POLICY
body __KAM_POLICY3 /Attached policy|section can proceed/i
#Attach
-mimeheader __KAM_POLICY4 Content-Type =~ /\.html?"?$/i
+ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
+ mimeheader __KAM_POLICY4 Content-Type =~ /\.html?"?$/i
+endif
meta KAM_POLICY ((__KAM_POLICY1 + __KAM_POLICY4 >= 1) + __KAM_POLICY2 + __KAM_POLICY3 >= 3)
describe KAM_POLICY Fake policy email phish
score KAM_FOREX 6.0
#SkyTech Wifi
-header __KAM_SKYTECH1 From =~ /SkyTech Wifi Booster/i
-header __KAM_SKYTECH2 Subject =~ /Wifi Deadspots/i
-body __KAM_SKYTECH3 /skytech wifi/i
+header __KAM_SKYTECH1 From =~ /SkyTech Wifi Booster|ultraboost/i
+header __KAM_SKYTECH2 Subject =~ /Wifi Deadspots|buffering/i
+body __KAM_SKYTECH3 /skytech wifi|Wifi Booster/i
meta KAM_SKYTECH (__KAM_SKYTECH1 + __KAM_SKYTECH2 + __KAM_SKYTECH3 >= 3)
describe KAM_SKYTECH Wifi Booster Spam
#SEXUALLY EXPLICITY PHOTO
header __KAM_PHOTO1 Subject =~ /My name is/i
body __KAM_PHOTO2 /I am very lonely/i
+ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __KAM_PHOTO3 Content-Type =~ /\.jpe?g/i
+endif
body __KAM_PHOTO4 /This is my photo/i
body __KAM_PHOTO5 /get to know you/i
meta KAM_PHOTO (__KAM_PHOTO1 + __KAM_PHOTO2 + __KAM_PHOTO3 + __KAM_PHOTO4 + __KAM_PHOTO5 >=5)
describe KAM_PHOTO Sexually Explicit Photo Emails
score KAM_PHOTO 7.5
-# EOF
+
+#FOOTBALL
+header __KAM_FOOTBALL2_1 Subject =~ /Foo[ts]ball Table/i
+body __KAM_FOOTBALL2_2 /look at (the thing I brought|this product|what I sent you)/i
+body __KAM_FOOTBALL2_3 /foo[st]ball table pric/i
+
+meta KAM_FOOTBALL2 (__KAM_FOOTBALL2_1 + __KAM_FOOTBALL2_2 + __KAM_FOOTBALL2_3 + __KAM_SHOP1 >= 3)
+describe KAM_FOOTBALL2 Football table spams
+score KAM_FOOTBALL2 4.5
+
+#LAWSUIT
+header __KAM_LAWSUIT1 From:name =~ /lawsuit/i
+header __KAM_LAWSUIT2 Subject =~ /lawsuit/i
+body __KAM_LAWSUIT3 /you or a loved one/i
+body __KAM_LAWSUIT4 /(roundup|diagnosed with cancer)/i
+tflags __KAM_LAWSUIT4 nosubject
+
+meta KAM_LAWSUIT (__KAM_LAWSUIT1 + __KAM_LAWSUIT2 + __KAM_LAWSUIT3 + __KAM_LAWSUIT4 >= 4)
+describe KAM_LAWSUIT Ambulance chaser scams
+score KAM_LAWSUIT 6.0
+
+#ED SPAM
+header __KAM_CHEAT1 From:name =~ /Magnum/i
+header __KAM_CHEAT2 Subject =~ /women cheat/i
+body __KAM_CHEAT3 /(Erectile Dysfunction|erection)/i
+tflags __KAM_CHEAT3 nosubject
+
+meta KAM_CHEAT (__KAM_CHEAT1 + __KAM_CHEAT2 + __KAM_CHEAT3 >= 3)
+describe KAM_CHEAT ED Spams
+score KAM_CHEAT 4.5
+
+#DomainBroker
+body __KAM_DOMAINBROKER1 /DomainBroker/i
+header __KAM_DOMAINBROKER2 Subject =~ /Domain on sale/i
+header __KAM_DOMAINBROKER3 From:name =~ /Domain.?Agent/i
+
+meta KAM_DOMAINBROKER (__KAM_DOMAINBROKER1 + __KAM_DOMAINBROKER2 + __KAM_DOMAINBROKER3 + KAM_BODY_MARKETINGBL_PCCC >= 3)
+describe KAM_DOMAINBROKER Domain seller spams
+score KAM_DOMAINBROKER 4.5
+
+#FAKE SHAREPOINT 2 - Sexually explicit
+header __KAM_FAKE_SHAREPOINT2_1 From:addr =~ /no\-reply\@sharepointonline\.com|sex|69/i
+header __KAM_FAKE_SHAREPOINT2_2 Subject =~ /view my profile|(\b|^|\s)sex+y man|live chat|hook.?up|sweet.?heart|(\b|^|\s)sex|f a c e b o o k|i know you|just fun|my phone|for se+x+|tease|play with my pus|facebook|chat shared|horne?y/i
+body __KAM_FAKE_SHAREPOINT2_3 /REAL DATING NETWORK|bad partner|single.hot.mom|chat room|escort girl|hi there|hook.?up|flirty singles|sweet.?heart|(\b|^|\s)sex|(\b|^|\s)dick|escort|Open me\.? asap|intercourse|seeking male|real relationship|suck my kitty|F.ck me|single girl|real man|need a partner/i
+tflags __KAM_FAKE_SHAREPOINT2_3 nosubject
+
+meta KAM_FAKE_SHAREPOINT2 (__KAM_FAKE_SHAREPOINT2_1 + __KAM_FAKE_SHAREPOINT2_2 + __KAM_FAKE_SHAREPOINT2_3 >= 3)
+describe KAM_FAKE_SHAREPOINT2 Sexually Explicit Sharepoint Spam
+score KAM_FAKE_SHAREPOINT2 8.5
+
+#DRONE
+header __KAM_SHOP1 Reply-to =~ /\.shop|drone|\.xyz/i
+header __KAM_DRONE2 Subject =~ /follow up on last email|reminder again|drone|quick follow.?up/i
+#ODD LANG SHIP
+body __KAM_DRONE3 /arrange the (shipment|dispatch)|contact the logistics|logistics to arrange|address for shipping|touch with logistics|location of your shipment/i
+#DRONE HERE
+body __KAM_DRONE4 /new drone (information|here)|information about the drone|for (two|three) drones|email about this drone/i
+#ODD LANG GOODS
+body __KAM_DRONE5 /grasp our goods|take one or more|three or more|receiving one or two/i
+#DRONE DESC
+body __KAM_DRONE6 /GPS Brushless Drone|optical flow/i
+
+meta KAM_DRONE (__KAM_SHOP1 + __KAM_DRONE2 + __KAM_DRONE3 + __KAM_DRONE4 + __KAM_DRONE5 + __KAM_DRONE6 >= 5)
+describe KAM_DRONE Drone Spam Du Jour
+score KAM_DRONE 7.5
+
+#FAKE PAYPAL
+header __KAM_FAKE_PAYPAL1 From:name =~ /paypal|invoice|confirmation|payapl/i
+header __KAM_FAKE_PAYPAL2 Subject =~ /Order ?(\#|reference|Confirmation)|your (transaction|purchase)|(buyer'?s|purchase) (receipt|ref|id) \#|transaction|statement|shipping notification/i
+body __KAM_FAKE_PAYPAL3 /paypal/i
+tflags __KAM_FAKE_PAYPAL3 nosubject
+body __KAM_FAKE_PAYPAL4 /if any concern|in order to cancel|(any|open a) dispute|(exact|usual) location|used by someone else|regular IP address|not made this purchase|contact us immediately|trust & safety|not authorized/i
+body __KAM_FAKE_PAYPAL5 /(accepted|confirmed|USD|purchase) (at|to|by) (Walmart|Target)|(Walmart|Target),?( Inc.?)? has (accepted|received|confirmed)|charge will appear|auto debited/i
+body __KAM_FAKE_PAYPAL6 /help by phone|call paypal team|paypal fraud dep/i
+
+meta KAM_FAKE_PAYPAL (__KAM_FAKE_PAYPAL1 + __KAM_FAKE_PAYPAL2 + __KAM_FAKE_PAYPAL3 + __KAM_FAKE_PAYPAL4 + __KAM_FAKE_PAYPAL5 + FREEMAIL_FROM + __KAM_FAKE_PAYPAL6 >= 5)
+describe KAM_FAKE_PAYPAL Fake PayPal Message
+score KAM_FAKE_PAYPAL 6.0
+
+body __KAM_FAKE_PAYPAL2_1 /PayPal (customer service|Support) Team/i
+body __KAM_FAKE_PAYPAL2_2 /void this (transaction|order) within/i
+
+meta KAM_FAKE_PAYPAL2 (__KAM_FAKE_PAYPAL2_1 + __KAM_FAKE_PAYPAL2_2 + FREEMAIL_FROM >=3)
+describe KAM_FAKE_PAYPAL2 Fake PayPal Message
+score KAM_FAKE_PAYPAL2 4.5
+
+#FEEDPROXY ABUSE
+uri GB_G_FEEDPROXY /https?\:\/\/feedproxy\.google\.com\/~r\//
+describe GB_G_FEEDPROXY Google Feed Proxy Abuse
+score GB_G_FEEDPROXY 2.5
+
+#DISCORD ABUSE
+uri __KAM_DISCORDCDN1 /cdn\.discordapp\.com\/attachment/i
+header __KAM_DISCORDCDN2 From:addr !~ /\@discord\.com/i
+header __KAM_DISCORDCDN3 DKIM-Signature !~ / d=discord.com;/i
+
+meta KAM_DISCORDCDN (__KAM_DISCORDCDN1 + __KAM_DISCORDCDN2 + __KAM_DISCORDCDN3 >= 3)
+describe KAM_DISCORDCDN Abuse of Discord CDN in spams
+score KAM_DISCORDCDN 4.5
+
+uri __KAM_DISCORDCDN_BAD1 /cdn\.discordapp\.com\/attachment.*(docu.?sign|\.(iso|gz|exe|jar|zip|xlsm|docm|pptm))/i
+
+meta KAM_DISCORDCDN_BAD (KAM_DISCORDCDN + __KAM_DISCORDCDN_BAD1 >= 2)
+describe KAM_DISCORDCDN_BAD Extra Dangerous Discord CDN Content in spams
+score KAM_DISCORDCDN_BAD 6.0
+
+#PAYROLL SCAMS
+body __KAM_PAYROLL1 /(Leveragewages|Savingcredits)/i
+body __KAM_PAYROLL2 /(companies|businesses) in CA/i
+header __KAM_PAYROLL3 Subject =~ /payroll/i
+
+meta KAM_PAYROLL (__KAM_PAYROLL1 + __KAM_PAYROLL2 + __KAM_PAYROLL3 + FREEMAIL_FROM >= 4)
+describe KAM_PAYROLL Payroll spammers
+score KAM_PAYROLL 6.0
+
+#FAKE ZIX
+header __KAM_FAKE_ZIX1 From:addr !~ /zixmessagecenter.com/i
+header __KAM_FAKE_ZIX2 Subject =~ /Secure Zix message/i
+body __KAM_FAKE_ZIX3 /security system/i
+uri __KAM_FAKE_ZIX4 /dynamics\.com/i
+
+meta KAM_FAKE_ZIX ( __KAM_FAKE_ZIX1 + __KAM_FAKE_ZIX2 + __KAM_FAKE_ZIX3 + __KAM_FAKE_ZIX4 >=4)
+describe KAM_FAKE_ZIX Fake Zix Email
+score KAM_FAKE_ZIX 6.0
+
+#FAKE AMAZON
+header __KAM_FAKE_AMAZON1 Subject =~ /Quick Request/i
+body __KAM_FAKE_AMAZON2 /have an (Amazon account|account with amazon)/i
+
+meta KAM_FAKE_AMAZON ( __KAM_FAKE_AMAZON1 + __KAM_FAKE_AMAZON2 + FREEMAIL_FROM + __KAM_BODY_LENGTH_LT_512 >= 4)
+describe KAM_FAKE_AMAZON Amazon Account Phishes
+score KAM_FAKE_AMAZON 4.5
+
+#BINANCE
+header __KAM_BINANCE1A Subject =~ /income/i
+header __KAM_BINANCE1B Subject =~ /crypto.?currenc/i
+
+body __KAM_BINANCE2 /affiliate link/i
+body __KAM_BINANCE3 /lifetime commission/i
+body __KAM_BINANCE4 /Friends and associates/i
+body __KAM_BINANCE5 /Binance/i
+
+meta KAM_BINANCE (( __KAM_BINANCE1A + __KAM_BINANCE1B >=2) + (__KAM_BINANCE2 + __KAM_BINANCE3 + __KAM_BINANCE4 >=2) + ( __KAM_BINANCE5 >= 1) >= 3)
+score KAM_BINANCE 6.0
+describe KAM_BINANCE Pyramid crypto scams
+
+#FAKE DMCA
+header __KAM_FAKE_DMCA1 From:name =~ /DMCA.?Tech/i
+header __KAM_FAKE_DMCA2 From:addr =~ /DMCA/i
+body __KAM_FAKE_DMCA3 /text of the complaint/i
+body __KAM_FAKE_DMCA4 /your device violates/i
+body __KAM_FAKE_DMCA5 /cancel subscription/i
+
+meta KAM_FAKE_DMCA ( __KAM_FAKE_DMCA1 + __KAM_FAKE_DMCA2 + __KAM_FAKE_DMCA3 + __KAM_FAKE_DMCA4 + __KAM_FAKE_DMCA5 >=5 )
+describe KAM_FAKE_DMCA Fake DMCA Notice
+score KAM_FAKE_DMCA 7.5
+
+#Claritox
+header __KAM_CLARITOX1 From:name =~ /claritox/i
+header __KAM_CLARITOX2 Subject =~ /Brain infection/i
+body __KAM_CLARITOX3 /claritox/i
+tflags __KAM_CLARITOX3 nosubject
+body __KAM_CLARITOX4 /brain infection/i
+tflags __KAM_CLARITOX4 nosubject
+
+meta KAM_CLARITOX ( __KAM_CLARITOX1 + __KAM_CLARITOX2 + __KAM_CLARITOX3 + __KAM_CLARITOX4 >= 3 )
+describe KAM_CLARITOX Product du Jour Spam
+score KAM_CLARITOX 4.5
+
+#BAD Canva
+uri __KAM_BAD_CANVA1 /\.canva\.com/i
+body __KAM_BAD_CANVA2 /link will not work for only recipients/i
+
+meta KAM_BAD_CANVA ( __KAM_BAD_CANVA1 + __KAM_BAD_CANVA2 >= 2 )
+describe KAM_BAD_CANVA Fake link from Canva for phishing
+score KAM_BAD_CANVA 5.0
+
+#FAKE EXCEL
+ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
+body __KAM_FAKE_EXCEL1 /details is in Excel File/i
+mimeheader __KAM_FAKE_EXCEL2 Content-Type =~ /excel.html?/i
+
+meta KAM_FAKE_EXCEL ( __KAM_FAKE_EXCEL1 + __KAM_FAKE_EXCEL2 >= 2 )
+describe KAM_FAKE_EXCEL Excel Phishing Scam
+score KAM_FAKE_EXCEL 6.0
+endif
+
+#ZOHO EXPLOIT
+uri __KAM_ZOHO1 /zfrmz\.com|zohoinsights\.com/i
+body __KAM_ZOHO2 /congrats on win|selected as the winner|expiration notice/i
+body __KAM_ZOHO3 /sweepstakes|password/i
+
+meta KAM_ZOHO ( __KAM_ZOHO1 + __KAM_ZOHO2 + __KAM_ZOHO3 >= 3 )
+describe KAM_ZOHO Zoho form or insights exploit
+score KAM_ZOHO 4.5
+
+#FAKE AFFIL ADS
+header __KAM_FAKE_AFFIL1 From =~ /(eharmony|Get.?Gutter.?Protection|Hello.?Fresh).*(Affil|partner)|(American.?Home.?Warranty|Renewal.?by.?anders.n|TruGreen.?Lawn.?Service|Blissy|Energy.?Bill.?Cruncher|Amy.?Myers|1-ink|Tommy.?Chong|Burial.?Insurance|walk.?in.?tub)/i
+uri __KAM_FAKE_AFFIL2 /cdn\.mpp-stage\.com|cdn\.tedbvi\.com/i
+ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
+ mimeheader __KAM_FAKE_AFFIL3 Content-Type =~ /ATT\d+\.htm/i
+endif
+
+meta KAM_FAKE_AFFIL ( __KAM_FAKE_AFFIL1 + __KAM_FAKE_AFFIL2 + __KAM_FAKE_AFFIL3 >= 3)
+describe KAM_FAKE_AFFIL Fake Affiliates Garbage
+score KAM_FAKE_AFFIL 4.5
+
+
+#header __KAM_SIREN1 From =~ /Portable Defense Siren/i
+
+
+#TELEGRA.PH being exploited
+uri KAM_TELEGRA /https?:\/\/telegra\.ph/i
+describe KAM_TELEGRA Service being exploited by spammers
+score KAM_TELEGRA 5.0
+
+#PHARMA SPAMS
+ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
+ replace_rules __KAM_PHARMA_1
+
+ header __KAM_PHARMA_1 From =~ /Canad<I1>an Pharma/i
+ body __KAM_PHARMA_2 /Online Pharmacy|No Prescription/i
+
+ meta KAM_PHARMA ( __KAM_PHARMA_1 + __KAM_PHARMA_2 + KAM_TELEGRA >= 2)
+ describe KAM_PHARMA Online Pharmacy Spam
+ score KAM_PHARMA 3.0
+endif
+
+#TWO EMAILS OBFUSCATION
+ifplugin Mail::SpamAssassin::Plugin::KAMOnly
+ meta GB_2_EMAILS ( __PDS_FROM_2_EMAILS + KAM_IFRAME + MISSING_HEADERS >= 3)
+ describe GB_2_EMAILS Phishing Emails using 2 Emails and Other Tricks for Obfuscation
+ score GB_2_EMAILS 4.5
+endif
+
+#DRONE SPAM
+header __KAM_DRONE2_1 From:name =~ /x.?pro|drone/i
+header __KAM_DRONE2_2 Subject =~ /(best|4k) drone|drone x.?pro/i
+body __KAM_DRONE2_3 /(best|x.?pro) drone|drone x.?pro/i
+tflags __KAM_DRONE2_3 nosubject
+
+meta KAM_DRONE2 ( __KAM_DRONE2_1 + __KAM_DRONE2_2 + __KAM_DRONE2_3 + __KAM_SUBSCRIPTION_INFO >= 4)
+describe KAM_DRONE2 Drone Spam
+score KAM_DRONE2 6.0
+
+#SANDAL SPAM
+header __KAM_SANDAL1 From:name =~ /quickdry sandal/i
+header __KAM_SANDAL2 Subject =~ /on your feet|uncomfortable shoes|comfiest sandal|with any outfit|with every step/i
+body __KAM_SANDAL3 /quickdry sandal/i
+tflags __KAM_SANDAL3 nosubject
+
+meta KAM_SANDAL ( __KAM_SANDAL1 + __KAM_SANDAL2 + __KAM_SANDAL3 + __KAM_SUBSCRIPTION_INFO >= 4)
+describe KAM_SANDAL Shoe Spam (don't bother me...)
+score KAM_SANDAL 6.0
+
+#FAT SPAM
+header __KAM_FAT1 From:name =~ /fat/i
+header __KAM_FAT2 Subject =~ /melt \d.?(lb|pound)/i
+body __KAM_FAT3 /island tonic|maverick doctor/i
+tflags __KAM_FAT3 nosubject
+
+meta KAM_FAT ( __KAM_FAT1 + __KAM_FAT2 + __KAM_FAT3 + __KAM_SUBSCRIPTION_INFO >= 4)
+describe KAM_FAT Weightloss Spam
+score KAM_FAT 6.0
+
+#CAMERA SPAM
+header __KAM_CAMERA1 From:name =~ /ultrazoom/i
+header __KAM_CAMERA2 Subject =~ /(HD|Super) telescope/i
+body __KAM_CAMERA3 /super telephoto zoom/i
+tflags __KAM_CAMERA3 nosubject
+
+meta KAM_CAMERA ( __KAM_CAMERA1 + __KAM_CAMERA2 + __KAM_CAMERA3 + __KAM_SUBSCRIPTION_INFO >= 4)
+describe KAM_CAMERA Camera Lens Spam
+score KAM_CAMERA 6.0
+
+#SUBSCRIPTION META
+body __KAM_UNSUBSCRIBE /can always unsubscribe|unsubscribe here|stop receiving e?mail|send post-?mail/i
+
+meta __KAM_SUBSCRIPTION_INFO ( __SUBSCRIPTION_INFO + __KAM_UNSUBSCRIBE >= 1)
+
+
+ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
+ mimeheader __KAM_QUOTATION1 Content-Type =~ /quotation\.html?/i
+ header __KAM_QUOTATION2 Subject =~ /Quotation/i
+ header __KAM_QUOTATION3 From =~ /accounts/i
+
+ meta KAM_QUOTATION ( __KAM_QUOTATION1 + __KAM_QUOTATION2 + __KAM_QUOTATION3 + (SPF_SOFTFAIL + SPF_FAIL >=1) >= 4)
+ describe KAM_QUOTATION Quotation Phishes
+ score KAM_QUOTATION 6.0
+endif
+
+#Sexually Explicit Spam
+ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
+ header __KAM_SEX2_1 Subject =~ /ready for me|Hello|Wet Invitation|Hi I'm|have fun|ready for me|good evening|private hangout|sex chat/i
+ body __KAM_SEX2_2 /dating site|bad girls|sexual community|discreet dating|pay for a chat|lover|horny|(adult|sex) chat|free women/i
+ #LINK REL
+ body __KAM_SEX2_3 /flirt for free|Fuck.?Free|sex.?club|naked glory|free.?sex|start writing me|canada.?sex|hot greetings|private hangout/i
+ mimeheader __KAM_SEX2_4 Content-type =~ /\.(jpe?g|png)\"?$/i
+ uri __KAM_SEX2_5 /https?:\/\/(au|en|cad?|canada)\./i
+
+ meta KAM_SEX2 ( __KAM_SEX2_1 + __KAM_SEX2_2 + __KAM_SEX2_3 + __KAM_SEX2_4 + (KAM_SHORT + __KAM_SEX2_5 >=1) + FREEMAIL_FROM >= 5)
+ describe KAM_SEX2 Sexually Explicit Sapm
+ score KAM_SEX2 15.0
+endif
+
+#FAKE ADOBE
+header __KAM_FAKE_ADOBE1 Subject =~ /(file|Document) Received/i
+uri __KAM_FAKE_ADOBE2 /zohoinsights\.com/i
+body __KAM_FAKE_ADOBE3 /sign in required|download to view/i
+body __KAM_FAKE_ADOBE4 /received a pdf|pdf document has been shared/i
+
+meta KAM_FAKE_ADOBE ( __KAM_FAKE_ADOBE1 + __KAM_FAKE_ADOBE2 + __KAM_FAKE_ADOBE3 + __KAM_FAKE_ADOBE4 >= 4)
+describe KAM_FAKE_ADOBE Fake Adobe Email
+score KAM_FAKE_ADOBE 6.0
+
+#PEAK BUSINESS FINANCE
+header KAM_PEAK From:addr =~ /peak.*business.*financ/i
+describe KAM_PEAK Finance Spammer
+score KAM_PEAK 7.0
+
+#FROM PRODUCT SPAMs
+header KAM_FROM_SPAM From =~ /(blood.?pressure.?(fix|cure)|20.?amazing.?gadgets|2021.?gadget.?guide|your.?hormones|Be.?Free.?Of.?Your.?Timeshare|unique.?christmas.?gifts|youthful.?brain|veteran.?discounts|VieShield.?Sanitizer|Walgreens.?Shopper.?Feedback|Solar.?Bright|shocking.?truth:|(\b|^)ed.?solution|beauty.?digs|LED.?Beach.?Balls|Pelvic.?Floor.?strong|Leptitox|Clean.?cell|Gadget.?List)|Avoid.?melatonin|My.?Senior.?Perks|explosive.?size|savage.?grow|blood.?pressure.?roulette|ElectronX.?Ruler|Software.?Treats/i
+
+describe KAM_FROM_SPAM From Indicates a Product Spam
+score KAM_FROM_SPAM 4.0
+
+#
+#EOF
projects / proxmox-spamassassin.git / commitdiff