This repository has been archived by the owner on Oct 30, 2018. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 1
/
KAM.cf
5077 lines (3997 loc) · 282 KB
/
KAM.cf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#KAM.cf - SpamAssassin Rules
#
#Author: Kevin A. McGrail with significant contributions from Joe Quinn
#
#Email: [email protected] - NOTE: Questions about spam are best submitted
# at https://raptor.pccc.com/raptor.cgim?template=report_problem
#
#HomePage: http://www.pccc.com/downloads/SpamAssassin/contrib/KAM.cf
#
#This is a collection of special rules that I have developed and use on my system.
#
#They are intended as live research for committal to SpamAssassin's SVN sandbox but
#often rely on my corpora so they do not fair well in masschecks.
#
#You are welcome and encouraged to email me directly regarding suggestions.
#
#To avoid being caught by our filters, False positives and negatives should be
#submitted to https://raptor.pccc.com/raptor.cgim?template=report_problem
#
#I believe the rules are safe and they are in use on production systems so I will
#do my best to respond to FPs *especially* if you can send me an email sample.
#
#This cf file is designed for systems with a threshold of 5.0 or higher.
#
#
#It is best to save an email sample in mbox format and zip it to attach to get
#around my filters. It is sometimes best to send samples in a second email so I
#know to go looking for it in my spam folders.
#
#NOTE: I do use some poison pill (i.e. Automatic HAM/SPAM rules).
#
# - I don't view many of my rules as single rules as I typically use meta rules.
# I view meta rules as multiple rules hence a larger score is acceptable.
#
# - Some content needs to be blocked either due to large number of complaints or
# for content. For example, thee sexually explicit items and the stock tips.
# FPs in these rules will be quickly addressed.
#
#For a free anti-spam consultation, fill out the form at the following URL:
#https://raptor.pccc.com/free_spam_consultation.cgim
#
#Copyright (c) 2015 Kevin A. McGrail
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# COURTESY OF Marcin Miros.aw <[email protected]>
body __KAM_MM_FOREX_1 /program.{0,10}ktory\ssam\sgra\sna\sgieldzie|program\sdo\sgry\sna\sgieldzie|Potega\stego\sprogramu\stkwi|program.{0,10}handluje.{0,10}zarabia.{0,10}gieldzie.{0,10}udzialu.{0,10}czlowieka|zarabiaj.{0,10}program.{0,10}nie.{0,10}jest.{0,10}zabroniony|Program.{0,10}zrobi.{0,10}wszystko.{0,10}sam|handluj.{0,10}na.{0,10}gieldzie.{0,10}programowi|100.{0,10}%.{0,10}pewnych.{0,10}transakcji|program.{0,10}100.{0,10}%.{0,10}zysk|handel.{0,10}bedzie.{0,10}zabroniony|program.{0,10}odmieni.{0,10}twoje.{0,10}zycie|system.{0,10}finansow.{0,10}przed.{0,10}upadkiem|grupa.{0,10}niemieckich.{0,10}matematykow.{0,10}inteligentny.{0,10}program|zostan\sobrzydliwie\sbogaty|technologia.{0,10}100%.{0,10}pewne.{0,10}decyzje|zarabianie.{0,10}w.{0,10}sieci|swoja.{0,10}szanse.{0,10}zarabianie|internet.{0,10}doprowadzil.{0,10}pieniedzy|zarabia.{0,10}(w|przez).{0,10}internet|karaluch.{0,10}dom.{0,10}brzeg.{0,10}morza|odmieni.{0,10}zycie|pieniadz|pieniedz|zarabia|zarobi/i
rawbody __KAM_MM_FOREX_2 /(\[|\<).{1,10}http:\/\/.{1,50}php\?.{1,30}\=.{1,30}(\]|\>).{0,20}(klik|odwiedz|dowiedz|przegap|odnosnik|zarobi|spiesz|majatek|wiecej\sinformacji\sna\sten\stemat\sznajdziesz\s-\stutaj|tutaj\sznajdziesz.{0,10}szczegolowe.{0,10}informacje|odwiedz|zarabia|wchodz)/i
meta KAM_MM_FOREX __KAM_MM_FOREX_1 && __KAM_MM_FOREX_2
score KAM_MM_FOREX 2.5
describe KAM_MM_FOREX Polish-language spam from the Forex botnet
#PHISHING TEST
rawbody KAM_PHISH1 /u style="cursor: pointer"/
describe KAM_PHISH1 Test for PHISH that changes the cursor
score KAM_PHISH1 0.01
header __KAM_PHISH4_1 From =~ /host|apple|amazon|microsoft|windows|express|app.serv|goodluck|bank/i
body __KAM_PHISH4_2 /dear.{0,50}customer|automated.message|spam.activities|attempted.gaining.access|your.account.expires|authorized.government|important.message|message.alert/i
body __KAM_PHISH4_3 /(confirm|verify|update).your.(identity|account)|account.password|credit.(bureau|profile)|identity.theft|accredited.commission|security.concern|kindly.find.enclosed/i
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __KAM_PHISH4_4 Content-Type =~ /(verification|information|form).htm/i
endif
meta KAM_PHISH4 (__KAM_PHISH4_1 + __KAM_PHISH4_2 + __KAM_PHISH4_3 + __KAM_PHISH4_4 >= 3)
score KAM_PHISH4 3.5
describe KAM_PHISH4 Another phishing attempt
#KAM REALESTATE / RE-FINANCE SCAM EMAILS - Thanks to David Goldsmith for pointing out my error in the meta rule!
body __KAM_REAL1 /(^|\b)RE market/is
body __KAM_REAL2 /(crashing|declining)/i
body __KAM_REAL3 /(vacation|second) (home|place)/is
meta KAM_REAL (__KAM_REAL1 + __KAM_REAL2 + __KAM_REAL3 >= 3)
describe KAM_REAL Real Estate or Re-Finance Spam
score KAM_REAL 0.5
#REFINANCE SCAM EMAILS
header __KAM_REFI1 Subject =~ /(refinance|rates) at \d\.\d*%|(?:I would like to offer you my help|Lower your house payment|follow up email|evaluation enclosed|submit a bid|fixed rates|ARM program|New Program|regardless of credit|loan request|accepting your application|refinance appl?ication|ready to (give a (business )?loan|lend)|good credit or not|refinance without perfect credit|financial independence|Loan Offer|Get a Loan|your urgent loan|credit report|time to refinance|refi.(rates|requirements|plus|program|plan|advice)|rates at historical low|EQUIFAX|TRANSUNION|Experian|rates can be cut|save your home)|Reverse.?Mortgage|obama (extends|waives)|VA loan|harp program|re.?fi.advice|homeowners.owe|harp.extension|\d+\.\d+%.fixed|\d+\.\d+.pct|this.rate|refi(nance)?.rate|lower.refi|refinance.your.mortgage|refinance.now|obama.?s?.refi|monthly.payment|house.payment|monthly.savings|modified.payment|new.payment|overpaying|calculate.your|your.saving|housing.plan|obama.?s.hous|l.f..insuranc.|offer.for.your.home|second.mortgage/i
body __KAM_REFI2 /(Free Evaluation (?:online|on your (?:current )?home loan)|No hidden costs|no strings attached|good credit or not|personalized consultation|in need of loan|consolidation loan|loan processing|apply by sending|loan of any amount|clean up any inacccuracies|lock in saving|save on monthly mortgage|absolutely no cost|underwater)|Reverse.?Mortgage|qualify for a VA loan|Refi now.? and Save|obama..?announces|rate.calculator|save.thousands|update: \d.\d\d..available|homeowner|over.your.head|rate.service|now.eligi?[bl]{2}e|a.second.mortgage|urgent.loan|loan.offer/is
body __KAM_REFI3 /(restructure (?:proposal|program|opportunity|your loan)|switch from an adjustable rate to a fixed|new lending program|(low|reasonable) interest (loan|rate)|lowest monthly payment|\d% interest|unsecured personal|better credit terms|lower your mortgage|low-interest refinance|see your credit score|credit score.{1,15}updated|refi with HARP)|obama announce(s|d) (the )?harp program|obama'?s.refi|a.fortune.off|lower.home.rate|your.home|home.loan|gov.program|official.harp|currently.overpaying/is
body __KAM_REFI4 /(\$\d{1,3},\d{1,3}|\d{2,3}k of funds|\d{4,6} USD|\d{4,6}\$ per month|\d{3,5}\/mo)|refinance at \d\.\d%|\$\d{3,}(\.\d\d)?.(a|per).year|extend.harp|spending.too.much|new.payment|better.rate/i
body __KAM_REFI5 /([\d,]{5,6}|\d{2}\s*%) savings|principal \d+% less|\d+\.\d+%.fixed|refi.calculator|lowered.requirements|home.?owner/is
body __KAM_REFI6 /((?:reduce your monthly payment|save you) (between )?\d{2}\s*%|save yourself hundreds of dollars|great rate available|completely unsecured|instantly connect with\s+lenders|get you back on the right financial|get report today|protect against identity|know your credit score|crazy payments)|u.?s.? homeowners|drop.your.rate|in.your.pocket|our.records|apply.for.your/is
body __KAM_REFI7 /(?:loan product|equity cash|house.payment|home.payment|no up front fees|seasoned equity|pay off high rate cards|ARM Program|credit is less than perfect|credit (score )?will not disqualify|plastic money|charge card balances|we offer out loans|floating loan scheme|unsecured guaranteed|President.?s new program|Home Affordable Refinance Program)|save $?[\d\.]+ per (year|month)|low.rate|harp.?2|rates.like.th(is|ese)/is
header __KAM_REFI8 From =~ /great loan|mortgage|financ|Delta|Rate\.?market|credit score|free.?score|harp|mtge|foreclosure|VA loan|lower.my.(bills|debt|mortgage|rate)|refi.(alert|advantage|quote|calc|rate)|obama|lendingtree|(house|home).?payment|home.?payment|lower.rate|\d+\.\d+%|saving|d.r.ct.l.f.|helpline/i
meta KAM_REFI (__KAM_REFI1 + __KAM_REFI2 + __KAM_REFI3 + __KAM_REFI4 + (__KAM_REFI5 + __KAM_REFI6 >= 1) + __KAM_REFI7 + __KAM_REFI8 + (__KAM_SHORT || AC_HTML_NONSENSE_TAGS || KAM_EU) >= 4)
describe KAM_REFI Real Estate / Re-Finance Spam
score KAM_REFI 4.0
meta KAM_REFI2 (__KAM_REFI1 + __KAM_REFI2 + __KAM_REFI3 + __KAM_REFI4 + (__KAM_REFI5 + __KAM_REFI6 >= 1) + __KAM_REFI7 + __KAM_REFI8 + (__KAM_SHORT || AC_HTML_NONSENSE_TAGS || KAM_EU) >= 6)
describe KAM_REFI2 Real Estate / Re-Finance Spam
score KAM_REFI2 3.0
#KAM ERADICATE DEBTS
body __KAM_DEBT1 /(debts disappear|reduce your payments|piling bills|creditors|late bills|vanish some of your bills|reduce your payments|looming bills|all that debt|outstanding debt|debt.{0,7}accumulated|all my debt|penalties,? and fees are gone|banking laws|select legal|change your life|get out of .?d.?e.?b.?t|Free[- ]Credit Report|debt relief options|are you in debt|pay off all your debt|get better rates|credit card debt|could.be.easy)/is
header __KAM_DEBT2 Subject =~ /(all that you owe|all you owe|everything you owe|eradicate|indebted|sick of bills|debt.{0,7}accumulated|tired of (the )?debt|looming debt|creditors|bank[ ]?rupt|debt ?free|out ?of ?debt|take control of your monthly payments|bills disappear|We can help|consultation regarding bills|get better rates|credit score|FICO Score|eliminate\s{1,2}debt|Erase the debt|loan offer|consolidating.debt)/i
body __KAM_DEBT3 /(bills keeping you|brink of bankruptcy|take all the (stress|pain) away|all the bills|tired of high credit card|make your bills disappear|improve your credit score|b.?a.?n.?k.?r.?u.?p.?t.?c?.?y|monitor your[- ]credit|Wipes out debt|being debt free|interest rates are reasonable|view your credit score|manage.your.finance)/is
meta KAM_DEBT ((__KAM_DEBT1 + __KAM_DEBT2 + __KAM_DEBT3) >= 3)
describe KAM_DEBT Debt eradication spams
score KAM_DEBT 2.5
meta KAM_DEBT2 ((__KAM_DEBT1 + __KAM_DEBT2 + __KAM_DEBT3 + __KAM_ADVERT2) >= 2)
describe KAM_DEBT2 Likely Debt eradication spams
score KAM_DEBT2 1.0
#XtraSize+ Penis Enlargement Scam
header __KAM_SILD1 Subject =~ /Sildenafil Citrate/i
body __KAM_SILD2 /(XtraSize+|Sildenafil Citrate)/i
meta KAM_SILD (__KAM_SILD1 + __KAM_SILD2 >= 1)
describe KAM_SILD Simple rule to block one more enhancement message
score KAM_SILD 5.0
#if (version < 3.002000)
# #HTML_SHORT_LENGTH DEPENDENCY RULE REMOVED FROM SA 3.2.X
# #KAM NUMBER EMAILS - Thanks to Mark Damrose for the NUMBER3 idea & Jan-Pieter Cornet
# header __KAM_NUMBER1 Subject =~ /^\d+$/
# body __KAM_NUMBER2 /\d{1,6}/
# header __KAM_NUMBER3 Message-ID =~ /\<[a-z]{19}\@/i
#
# meta KAM_NUMBER ((__KAM_NUMBER1 + __KAM_NUMBER2 + MIME_HTML_ONLY + HTML_SHORT_LENGTH + __KAM_NUMBER3) >= 5)
# describe KAM_NUMBER Silly Number Emails
# score KAM_NUMBER 1.0
#endif
#KAM MEDICATION KAM_OVERPAY
body KAM_OVERPAY /O . V . E . R . P . A . Y/i
describe KAM_OVERPAY Common Medicinal Ad Trick
score KAM_OVERPAY 3.5
#VIAGRA AD - CHANGED DUE TO FPS on 2010-05-06 - Replaced [VACLXPSI] with separate rules space separated
body KAM_VIAGRA1 /V I A G R A|C I A L I S|V A L I U M|X A N A X/i
describe KAM_VIAGRA1 Common Viagra and Medicinal Table Trick
score KAM_VIAGRA1 3.0
#VIAGRA AD 2
body KAM_VIAGRA2 /(?:Xan|Som|CIA|VAL|VIA|Pro|Amb|Lev|Mer) (?:Xan|Som|CIA|VAL|VIA|Pro|Amb|Lev|Mer) (?:Xan|Som|CIA|VAL|VIA|Pro|Amb|Lev|Mer)/i
describe KAM_VIAGRA2 Common Viagra and Medicinal Table Trick
score KAM_VIAGRA2 3.1
#VIAGRA AD 3 - REMOVED FOR LOW S/O - Thanks to Shane Williams for reporting the FP
#body KAM_VIAGRA3 /(?:Xan|Som|CIA|VAL|VIA|Pro|Amb|Lev|Mer)( \w )(?:ax|lis|ra|ium)/i
#describe KAM_VIAGRA3 Common Viagra and Medicinal Table Trick
#score KAM_VIAGRA3 3.1
#VIAGRA AD 4
body __KAM_VIAGRA4A /V (. )?A (. )?L (. )?[I\/t] (. )?U (. )?M/i
body __KAM_VIAGRA4B /V (. )?[I\/t] (. )?A (. )?G (. )?R (. )?A/i
body __KAM_VIAGRA4C /M (. )?E (. )?R (. )?[I\/t] (. )?D (. )?[I\/] (. )?A/i
# FP FOR "Les Iles du Monde Via Gramsci" OR ITALIAN "WE WISH YOU"
body __KAM_VIAGRA_FPS /via gra|i augur/i
meta KAM_VIAGRA4 ((__KAM_VIAGRA4A + __KAM_VIAGRA4B + __KAM_VIAGRA4C) >= 2)
describe KAM_VIAGRA4 Common Viagra and Medicinal Table Trick
score KAM_VIAGRA4 3.1
#VIAGRA AD 5
body KAM_VIAGRA5 /(V [1li|\]] [a&] G R A|VljAG+R+A)/i
describe KAM_VIAGRA5 Viagra Obfuscation Technique SPAM
score KAM_VIAGRA5 3.1
#VIAGRA AD 6
#Switch to [-_\. ]? to avoid FP's reported by Robin Tan
body __KAM_VIAGRA6A /V[-_\. ]?[IL1][-_\. ]?A.?G.?R.?A/i
body __KAM_VIAGRA6B /(\b|^)A.?M.?B.?[il1].?E.?N/i
body __KAM_VIAGRA6C /V.?A.?L.?[il1].?U.?M/i
body __KAM_VIAGRA6D /(\b|^)C.?[il1].?A.?L.?[Il1].?S($|\b)/i
header __KAM_VIAGRA6E From =~ /Viagra|Cialis(\b|$)/i
meta KAM_VIAGRA6 (__KAM_VIAGRA6A + __KAM_VIAGRA6B + __KAM_VIAGRA6C + __KAM_VIAGRA6D + __KAM_VIAGRA6E >= 2)
describe KAM_VIAGRA6 Viagra Obfuscation Technique SPAM
score KAM_VIAGRA6 3.1
#VIAGRA AD 7 - TWEAKING RULE 7B TO PREVENT HITS ON SPECIALIST
body __KAM_VIAGRA7A /V[ij]+AGRA/i
body __KAM_VIAGRA7B /C[ij]+AL[ij]+S($|\b)/i
body __KAM_VIAGRA7C /AMB[ij]+EN/i
body __KAM_VIAGRA7D /VAL[ij]+UM/i
meta KAM_VIAGRA7 ((__KAM_VIAGRA7A + __KAM_VIAGRA7B + __KAM_VIAGRA7C + __KAM_VIAGRA7D >= 2) && (KAM_VIAGRA6 < 1))
describe KAM_VIAGRA7 Viagra Obfuscation Technique SPAM
score KAM_VIAGRA7 3.1
#VIAGRA AD 8
body __KAM_VIAGRA8A /VI...?AGRA/i
body __KAM_VIAGRA8B /AM...?BIEN/i
body __KAM_VIAGRA8C /VA...?LIUM/i
body __KAM_VIAGRA8D /CI...?ALIS/i
meta KAM_VIAGRA8 ((__KAM_VIAGRA8A + __KAM_VIAGRA8B + __KAM_VIAGRA8C + __KAM_VIAGRA8D) >= 2)
describe KAM_VIAGRA8 Viagra Obfuscation Technique SPAM
score KAM_VIAGRA8 5.1
#VIAGRA AD 9
body __KAM_VIAGRA9A /V[IL1]A..GRA/i
body __KAM_VIAGRA9B /AMB..IEN/i
body __KAM_VIAGRA9C /VAL..IUM/i
body __KAM_VIAGRA9D /C[IL1]A..LIS/i
meta KAM_VIAGRA9 ((__KAM_VIAGRA9A + __KAM_VIAGRA9B + __KAM_VIAGRA9C + __KAM_VIAGRA9D) >= 2)
describe KAM_VIAGRA9 Viagra Obfuscation Technique SPAM
score KAM_VIAGRA9 5.1
#VIAGRA AD 10 - CONTENT-LESS EMAIL FROM "MALE ENHANCEMENT"
header __KAM_VIAGRA10A From =~ /male enhancement|mens.renewal/i
header __KAM_VIAGRA10B Subject =~ /your intimate partner will (thank|love)|grow.your.manhood|satisfy.your.woman/i
meta KAM_VIAGRA10 (__KAM_VIAGRA10A + __KAM_VIAGRA10B >= 1)
describe KAM_VIAGRA10 Male enhancement spam with no content
score KAM_VIAGRA10 8.0
#NITROXIN - A NEW AND SPAMMY COMPETITOR TO VIAGRA
header __KAM_NITROXIN1A From =~ /nitroxin/i
meta KAM_NITROXIN1 (__KAM_NITROXIN1A >= 1)
describe KAM_NITROXIN1 Another variant of Viagra spam
score KAM_NITROXIN1 8.0
#RE[#] SPAM
#NOTE: Thanks to Jason Haar" <[email protected]> for pointing out that I was only doing >=1!
header KAM_RE Subject =~ /^Re(?:\s)*\[\d\]+(?:\s)*:?$/i
describe KAM_RE Subject of Re[0]: etc prevalent in Spam
score KAM_RE 2.0
meta KAM_RE_PLUS (HTML_IMAGE_ONLY_08+KAM_RE >= 2)
describe KAM_RE_PLUS Bad Subject and Image Only rule hit == SPAM!
score KAM_RE_PLUS 4.0
#HOODIA
#RE-WEIGHTING - Thanks to Martin Kaempf and Gareth Blades for pointing out the False Positives!!
#Changed to escape + for 920\+ and changed to rawbody because we don't want to check the subject twice.
#thansk to Michael Denney for the FP report
header __KAM_HOODIA1 Subject =~ /(hoodia|920\+|serotonin|reduce your appetite)/i
rawbody __KAM_HOODIA2 /(?:hoodia|920\+)/i
body __KAM_HOODIA3 /(?:fat loss product|sur?p?press appetite|Reduce Your Appetite)/is
meta KAM_HOODIA (__KAM_HOODIA1 + __KAM_HOODIA2 + __KAM_HOODIA3 >= 2)
describe KAM_HOODIA Hoodia / Weight Loss Product Promotion Spam
score KAM_HOODIA 3.0
#STOCK TIPS
##1 through 120 disabld 5-12-2014 due to age
##body __KAM_STOCKTIP1 /(?:Reynaldo's Mexican Food|RYNL)/is
##body __KAM_STOCKTIP2 /(?:KOKO PETROLEUM|KKPT)/is
##body __KAM_STOCKTIP3 /(?:DARK DYNAMITE|DKDY|D K D Y)/is
##body __KAM_STOCKTIP4 /(?:Remington Ventures|RMVN)/is
##body __KAM_STOCKTIP5 /(?:m-Wise|MWIS|M W I S)/is
##body __KAM_STOCKTIP6 /(?:China World Trade Corporation|CWTD)/is
##body __KAM_STOCKTIP7 /(?:Packets International|IPKL)/is
##body __KAM_STOCKTIP8 /(?:Infinex Ventures|IFNX)/is
##body __KAM_STOCKTIP9 /(?:FacePrint Global Solutions|FCPG)/is
###THANKS TO HOMER PARKER FOR THE FALSE POSSITIVE NOTE!
##body __KAM_STOCKTIP10 /(?:Ever[-_ ~]{0,3}Gl[o0]ry|(^|\b)E[-_~\. =]{0,3}G[-_~\. =]{0,3}L[-_~\. =]{0,3}Y($|\b))/is
##body __KAM_STOCKTIP11 /(?:Gulf Petroleum|GFPE)/is
##body __KAM_STOCKTIP12 /(?:Patriot Mechanical Handling|PMHH)/is
##body __KAM_STOCKTIP13 /(?:KSW Industries|KSWJ)/is
##body __KAM_STOCKTIP14 /(?:Conforce International|CFRI)/is
##body __KAM_STOCKTIP15 /(?:Nano Superlattice Technology|NSLT)/is
##body __KAM_STOCKTIP16 /(?:Morgan Beaumont|MBEU)/is
##body __KAM_STOCKTIP17 /(?:Relay Capital|(^|\b)RLYC($|\b))/is
###THANKS TO DAVID GOLDSMITH FOR POINTING OUT THE POTENTIAL FPs FROM THIS RULE
##body __KAM_STOCKTIP18 /(?:Madison Explorations|(?:^|\b)MDEX(?:$|\b))/is
##body __KAM_STOCKTIP19 /(?:CTR Investments and Consulting|C ?I ?V ?X)/is
##body __KAM_STOCKTIP20 /(?:PREMIER INFORMATION|(?:^|\b)PIFR(?:$|\b))/is
##body __KAM_STOCKTIP21 /(?:Harbin Pingchuan|P G C N|PGCN)/is
##body __KAM_STOCKTIP22 /(?:CLIENT TRACK CORP|CTKR)/is
##body __KAM_STOCKTIP23 /(?:EXTREME INNOVATIONS|(^|\b)EXTI($|\b))/is
##body __KAM_STOCKTIP24 /(?:Medical Home Products|\bMHPT\b)/is
##body __KAM_STOCKTIP25 /(?:AmeraMex International|AMMX)/is
##body __KAM_STOCKTIP26 /(?:Equipment & Systems Engineering|EQUIPMENT & SYS ENGR|EQSE)/is
##body __KAM_STOCKTIP27 /(?:NANOFORCE|NNFC)/i
##body __KAM_STOCKTIP28 /(?:\b|^)(?:Resort Clubs (I|\|)nternational|R[ ]*T[ ]*C[ ]*(?:I|\|))(?:\b|$)/is
##body __KAM_STOCKTIP29 /(?:Innovation Holdings|IVHN)/is
##body __KAM_STOCKTIP30 /(?:GOLDEN APPLE OIL|GAPJ)/is
##body __KAM_STOCKTIP31 /(?:inZon Corporation|(^|\b)I ?Z ?O ?N($|\b))/is
##body __KAM_STOCKTIP32 /(?:Midland Baring Financial Group|MDBF)/is
##body __KAM_STOCKTIP33 /(?:Aradyme Corporation|A D Y E)/is
##body __KAM_STOCKTIP34 /(?:TRANSAKT CORP|TKTJF)/is
##body __KAM_STOCKTIP35 /(?:CTXE|CANTEX ENERGY CORP)/is
##body __KAM_STOCKTIP36 /(?:De Greko|DGKO)/is
##body __KAM_STOCKTIP37 /(?:Deep Earth Resource, Inc|CTFE|DPER)/is
##body __KAM_STOCKTIP38 /(?:Vemics|(\b|^)VMCI(\b|$)|Summit Financial Resources)/is
##body __KAM_STOCKTIP39 /Premium Petroleum/is
##body __KAM_STOCKTIP40 /(?:F ?a ?l ?c ?o ?n ?E ?n ?e ?r ?g ?y|F.?C.?Y.?I)/s
##body __KAM_STOCKTIP41 /(?:CHINA GOLD CORP|CGDC)/is
##body __KAM_STOCKTIP42 /DPEK/i
###FIXED FP THANKS TO BEN LENTZ - Also found that the X ?X ?X ?X concept is causing too many FPs thanks to Homer Parker
##body __KAM_STOCKTIP43 /(?:Amerossi International Group|A M S N(\b|$)|AMSN)/is
##body __KAM_STOCKTIP44 /(?:WATAIRE INDUSTRIES|W ?T ?A ?F)/is
##body __KAM_STOCKTIP45 /(?:ABSOLUTESKY|A ?B ?S ?Y)/i
##body __KAM_STOCKTIP46 /(?:Infinex Ventures|I ?N ? ?F ?X)/is
##body __KAM_STOCKTIP47 /(?:Holly ?wood Intermediate|HYWI|H Y W I)/is
###DISABLED DUPLICATE OF 40
###body __KAM_STOCKTIP48 /(?:Falcon Energy|F ?C ?Y ?I)/is
##body __KAM_STOCKTIP49 /(?:\b|^)(?:AGA Resources|A ?G ?A)(?:\b|$)/is
##body __KAM_STOCKTIP50 /(?:COSCO|CCPI)/i
##body __KAM_STOCKTIP51 /(?:PETRO([- ?])?SUN DRILLING|P[- ]?S[- ]?U[- ]?D)/is
##body __KAM_STOCKTIP52 /(?:KMA Global Solutions International|KMAG)/is
##body __KAM_STOCKTIP53 /(?:Advanced Powerline Technologies|APWL)/is
##body __KAM_STOCKTIP54 /(?:GOLDMARK INDUSTRIES|GDKI)/is
##body __KAM_STOCKTIP55 /(?:QUANTUM ENERGY|QEGY)/is
###FP FIXED THANKS TO Homer Parker
##body __KAM_STOCKTIP56 /(?:AAGA RESOURCE+S NEW|A G A O|(\b|^)AGAO(\b|$))/is
###FP FIXED THANKS TO Homer Parker
##body __KAM_STOCKTIP57 /(?:Bicoastal Communications|BCLC|B C L C)/is
##body __KAM_STOCKTIP58 /(?:Greater China Media \& Ent|G ?C ?M ?E)/is
##body __KAM_STOCKTIP59 /(?:Viva International|(\b|^)VIVI(\b|$))/s
##body __KAM_STOCKTIP60 /(?:WILON RESOURCES|(\b|^)WLON(\b|$))/is
##body __KAM_STOCKTIP61 /(?:Am+erica+n U+ni+ty I+nve+stments|(\b|^)A[ _]?U[ _]?N[ _]?I[ _]?(\b|$))/is
##body __KAM_STOCKTIP62 /(?:DEFENSE DIRECTIVE|(\b|^)DFSE(\b|$))/is
##body __KAM_STOCKTIP63 /(?:Cyberhand Technologies|(\b|^)CYHD(\b|$))/is
##body __KAM_STOCKTIP64 /(?:Texhoma Energy|(\b|^)TXHE(\b|$))/is
##body __KAM_STOCKTIP65 /(?:Equal Trading|(\b|^)EQTD(\b|$))/is
###DISABLED FOR FALSE POSITIVES AND AGE
###body __KAM_STOCKTIP66 /(?:\b|^)W.?B.?R.?S(?:\b|$)/is
##body __KAM_STOCKTIP67 /(?:Mobile Airwaves|(\b|^)M.?W.?B.?C.?(\b|$))/is
##body __KAM_STOCKTIP68 /(?:X-tra Petroleum|(\b|^)XTPT(\b|$))/is
###ADDED FP BOUNDARY CHECK THANKS TO Greg Troxel for reporting the issue
##body __KAM_STOCKTIP69 /(?:Red Reef Laboratories|(\b|^)RREF(\b|$))/is
##body __KAM_STOCKTIP70 /(?:Great American Food Chain|(\b|^)GAMN(\b|$))/is
##body __KAM_STOCKTIP71 /(?:Cana Petroleum|(\b|^)CNPM(\b|$))/is
##body __KAM_STOCKTIP72 /(?:China Health Management|(\b|^)CNHC(\b|$))/is
##body __KAM_STOCKTIP73 /(?:Makeup Limited|MAKU)/is
##body __KAM_STOCKTIP74 /(?:Premier Holdings Group|PMHD)/is
###FP FIXED THANKS TO Christopher X. Candreva
##body __KAM_STOCKTIP75 /(?:VSUS technologies|(\b|^)VSUS($|\b))/is
##body __KAM_STOCKTIP76 /(?:FLAIR PETROLEUM|FPMC)/is
##body __KAM_STOCKTIP77 /(?:Physician Adult Daycare|PHYA)/is
###FP FIXED THANKS TO Homer Parker
##body __KAM_STOCKTIP78 /(?:AlgoDyne Ethanol Energy|(\b|^)ADYN(\b|$))/is
##body __KAM_STOCKTIP79 /(?:Critical Care.{1,3}Inc|CTCX)/is
##body __KAM_STOCKTIP80 /(?:Aerofoam Metals|AFML)/is
##body __KAM_STOCKTIP81 /(?:Ten \& 10|(?:\b|^)TTEN)/is
##body __KAM_STOCKTIP82 /(?:Medical Institutional Services|MISJ(\b|$))/is
##body __KAM_STOCKTIP83 /(?:Harris Exploration|HXPN)/is
##body __KAM_STOCKTIP84 /(?:MARSHAL HOLDINGS|MHII)/is
##body __KAM_STOCKTIP85 /(?:ADVANCED GROWING SYSTEMS|AGWS)/is
##body __KAM_STOCKTIP86 /(?:WEST EXCELSIOR ENT|WEXE)/is
##body __KAM_STOCKTIP87 /(?:Hemisphere Gold|HPGI)/is
##body __KAM_STOCKTIP88 /(?:Victory Energy Corporation|VYEY)/is
##body __KAM_STOCKTIP89 /UTEV/i
##body __KAM_STOCKTIP90 /(?:CHINA BIOLIFE ENTERP|CBFE)/is
##body __KAM_STOCKTIP91 /(?:Critical Care|C ?T ?C ?X)/is
##body __KAM_STOCKTIP92 /CBRJ/i
##body __KAM_STOCKTIP93 /(?:LAS VEGAS CENTRAL RESERVATIONS|LVCC)/is
##body __KAM_STOCKTIP94 /GTAP/i
##body __KAM_STOCKTIP95 /(North American Energy Group|N-?N-?Y-?R)/is
###FP FIXED THANKS TO BRETT GARRETT
##body __KAM_STOCKTIP96 /(\b|^)C\.?C\.?T\.?I(\b|$)/i
##body __KAM_STOCKTIP97 /(C ?E ?O AMERICA|C ? E ? O ?A)/is
##body __KAM_STOCKTIP98 /PLMA/i
##body __KAM_STOCKTIP99 /CDYV/i
##body __KAM_STOCKTIP100 /(Fire (Mountain|Mtn) Beverage Company|(^|\b)F[ _]?B[ _]?V[ _]?G($|\b))/is
###Added boundary check thanks to Michael Denney
##body __KAM_STOCKTIP101 /(\b|^)WDSC(\b|$)/i
##body __KAM_STOCKTIP102 /(Distributed Power|DPWI)/is
##body __KAM_STOCKTIP103 /(HUMET-PBC|L9Z\.F)/is
##body __KAM_STOCKTIP104 /ASVP/is
##body __KAM_STOCKTIP105 /CHVC/is
##body __KAM_STOCKTIP106 /(China Datacom|CDPN)/is
##body __KAM_STOCKTIP107 /(ORAMED PHARMA|OJU\.F)/is
##body __KAM_STOCKTIP108 /(DSDI|DSI Direct Sales)/is
##body __KAM_STOCKTIP109 /(Monolith Athletic Club|M[-_ ]?N[-_ ]?A[-_ ]?B)/is
###DUPLICATED STOCKTIP #51
###body __KAM_STOCKTIP110 /(PETRO-SUN|P[- ]?S[- ]?U[- ]?D)/is
##body __KAM_STOCKTIP111 /(COMPLIANCE SYSTEMS|(\b|^)COPI(\b|$))/is
###FP Fixed thanks to Greg Troxel
##body __KAM_STOCKTIP112 /(Global Pay Solutions|(\b|^)GPSI(\b|$))/is
##body __KAM_STOCKTIP113 /(MEGOLA|MGOA)/i
###FP FIXED THANKS TO Antonio Falzarano
##body __KAM_STOCKTIP114 /(\b|^)ADOV(\b|$)/i
##body __KAM_STOCKTIP115 /(Oncology Med|(\b|^)ONCO(\b|$))/is
##body __KAM_STOCKTIP116 /(Strategy X|SGXI)/is
##body __KAM_STOCKTIP117 /(Spotlight Homes|COST CONTAINMENT TEC|SPHM)/is
###FALSE POSITIVE ON DANSREALESTATE.
##body __KAM_STOCKTIP118 /((\b|^)SREA(\b|$)|Score One)/is
##body __KAM_STOCKTIP119 /(Monster Motors|MRMT)/is
##body __KAM_STOCKTIP120 /(EntreMetrix|ERMX)/i
body __KAM_STOCKTIP121 /(VISION AIRSHIPS|(\b|^)VPSN(\b|$))/is
body __KAM_STOCKTIP122 /(Shandong Zhouyuan Seed and Nursery|(\b|^)SZSN(\b|$))/is
body __KAM_STOCKTIP123 /(Puerto Rico 7|(\b|^)P ?R ?T ?H(\b|$))/is
body __KAM_STOCKTIP124 /(VGPM|Vega Promotional Sys)/is
body __KAM_STOCKTIP125 /((\b|^)D[- ]?M[- ]?X[- ]?C(\b|$))/i
body __KAM_STOCKTIP126 /((\b|^)C\.?W\.?T\.?E(\b|$)|C'Watre International)/is
body __KAM_STOCKTIP127 /(Physical Property Holdings|(\b|^)PPYH(\b|$))/is
#FP ON MNUM IN PLAIN TEXT HTML CONVERSION - Thanks to Kevin Lewis
body __KAM_STOCKTIP128 /(MONUMENTAL MARKETING|(\b|^)MNUM(\b|$))/is
body __KAM_STOCKTIP129 /(EnerBrite Technologies Group|(\b|^)eTgU(\b|$))/is
body __KAM_STOCKTIP130 /(Pricester|(\b|^)PRCC(\b|$))/is
#Added boundary check thanks to Michael Denney
body __KAM_STOCKTIP131 /(Greenstone Holdings|(\b|^)GSHN(\b|$))/is
body __KAM_STOCKTIP132 /((\b|^)AGMS(\b|$)|Angstrom[- ]Microsystems)/is
body __KAM_STOCKTIP133 /(Pluris Energy|(\b|^)PEYG(\b|$))/is
body __KAM_STOCKTIP134 /(United Consortium|(\b|^)UCSO(\b|$))/is
body __KAM_STOCKTIP135 /(Dominion Minerals|(\b|^)DMNM(\b|$))/is
body __KAM_STOCKTIP136 /(PrimeGen Energy|(\b|$)PGNE(\b|^))/is
body __KAM_STOCKTIP137 /Dynamic Response Group|(\b|^)DRGZ(\b|$)/is
body __KAM_STOCKTIP138 /Cobra Oil (and|&) Gas|(\b|^)CGCA(\b|$)/is
body __KAM_STOCKTIP139 /Solanex Management|(\b|^)SLNX(\b|$)/is
body __KAM_STOCKTIP140 /BIO-SOLUTIONS|(\b|^)BISU(\b|$)/is
body __KAM_STOCKTIP141 /(\b|^)FORC(\b|$)/is
body __KAM_STOCKTIP142 /Hawk Systems Inc|(\b|^)HWSYD(\b|$)/is
body __KAM_STOCKTIP143 /AmeriLithium/is #|(\b|^)AMEL(\b|$)/is # FP 9/10/15
body __KAM_STOCKTIP144 /Fleet Management Solutions|(\b|^)FLMG(\b|$)/is
body __KAM_STOCKTIP145 /Nuvilex|(\b|^)N.?V.?L.?X.?(\b|$)/is
body __KAM_STOCKTIP146 /Plandai|(\b|^)PLPL(\b|$)/is
body __KAM_STOCKTIP147 /Beamz Interactive|(\b|^)B.?Z.?I.?C(\b|$)/is
body __KAM_STOCKTIP148 /(\b|^)STBV(\b|$)/i
body __KAM_STOCKTIP149 /LifeApps|(\b|^)LFAP(\b|$)/i
body __KAM_STOCKTIP150 /MONARCHY RESOURCES/i
body __KAM_STOCKTIP151 /Alanco Tech/i
body __KAM_STOCKTIP152 /Siga Resources/i
body __KAM_STOCKTIP153 /INSCOR|(\b|^)IOGA(\b|$)/is
body __KAM_STOCKTIP154 /mLight Tech|(\b|^)MLGT(\b|$)/is
body __KAM_STOCKTIP155 /Alanco Technologies/is
body __KAM_STOCKTIP156 /Progress Watch|(\b|^)PROW(\b|$)/is
body __KAM_STOCKTIP157 /(\b|^)PRFC(\b|$)/is
body __KAM_STOCKTIP158 /(\b|^)(RCHA|R\.+C\.+H\.+A|R\/C\/H\/A)(\b|$)/is
body __KAM_STOCKTIP159 /(\b|^)(RNBI|R.N.B.I)(\b|$)/is
body __KAM_STOCKTIP160 /(\b|^)(CNRMF|C.N.R.M.F)(\b|$)/is
body __KAM_STOCKTIP161 /(\b|^)(NUAN|N[- ]U[- ]A[- ]N)(\b|$)|NUANCE COMMUNICATIONS/is
body __KAM_STOCKTIP162 /(\b|^)(CHICF|C.H.I.C.F)(\b|$)/is
body __KAM_STOCKTIP163 /(\b|^)(brixmor)(\b|$)/is
body __KAM_STOCKTIP164 /(\b|^)(KBLB|K.B.L.B)(\b|$)/is
body __KAM_STOCKTIP165 /(\b|^)(SCRF|S.C.R.F)(\b|$)/is
body __KAM_STOCKOTC /(OTC|OTC ?BB|OTC Pink Sheets|NASDAQ|NYSE|StockWatch):/is
body __KAM_STOCKSYM /S[ ]?[iy][ ]?m[ ]?[ßb8][ ]?[o0][ ]?[l1]|Siymbol/i
body __KAM_STOCKSYM2 /(SYM[ ]?[-\:]|\bTicker|Pr+ice\s*\:|Volume\s*\:|Target\s*\:|Current(ly)? ?\??:|Projected:|Smybol:|Stcok\s*\:|Stock\s*\:|S\s*t\s*o\s*c\s*k\s*\:|Trad[ ]?e\:|short-?sell|book value|S\.umbol|Action:|Symb\s?[-:]|Price Today:|SYmN-|Lookup:|RADAR:|PK PAPER:|PINKSHEETS:|f[o0]rward ?l[0o]{2}king)/i
body __KAM_STOCKSHR /\b(Shares|Investments|invest|Stock|acquisitions?|broker|joint[ -]?venture|underperforming|(uncap|ventilated|public(ity)?) on friday|dividend opportunities|set your buy|financial safe haven|before the bell)\b/i
body __KAM_STOCKBULL /bull (run|market)|very.rich|high.return/is
body __KAM_STOCKSCTR /(energy sector|mineral rights|mineral wealth|natural resources|gold deposits)/is
header __KAM_STOCKHEAD Subject =~ /{stk-sub}|on your radar|st0ck|best.stocktip|huge.winner|breaking.news/i
body __KAM_STOCKJUMP /(up|jumps) \d\d(\.\d)?\%/i
body __KAM_INSTOCK /in stock/i
# ADDED A CAVEAT FOR in stock so gibberish links don't hit a stock symbol
meta KAM_STOCKTIP (__KAM_STOCKHEAD + __KAM_STOCKOTC + __KAM_STOCKSYM + __KAM_STOCKJUMP + __KAM_STOCKSHR + __KAM_STOCKSYM2 + __KAM_STOCKBULL + __KAM_STOCKSCTR >= 1) && (__KAM_INSTOCK < 1) && (__KAM_STOCKTIP121 + __KAM_STOCKTIP122 + __KAM_STOCKTIP123 + __KAM_STOCKTIP124 + __KAM_STOCKTIP125 + __KAM_STOCKTIP126 + __KAM_STOCKTIP127 + __KAM_STOCKTIP128 + __KAM_STOCKTIP129 + __KAM_STOCKTIP130 + __KAM_STOCKTIP131 + __KAM_STOCKTIP132 + __KAM_STOCKTIP133 + __KAM_STOCKTIP134 + __KAM_STOCKTIP135 + __KAM_STOCKTIP136 + __KAM_STOCKTIP137 + __KAM_STOCKTIP138 + __KAM_STOCKTIP139 + __KAM_STOCKTIP140 + __KAM_STOCKTIP141 + __KAM_STOCKTIP142 + __KAM_STOCKTIP143 + __KAM_STOCKTIP144 + __KAM_STOCKTIP145 + __KAM_STOCKTIP146 + __KAM_STOCKTIP147 + __KAM_STOCKTIP148 + __KAM_STOCKTIP149 + __KAM_STOCKTIP150 + __KAM_STOCKTIP151 + __KAM_STOCKTIP152 + __KAM_STOCKTIP153 + __KAM_STOCKTIP154 + __KAM_STOCKTIP155 + __KAM_STOCKTIP156 + __KAM_STOCKTIP157 + __KAM_STOCKTIP158 + __KAM_STOCKTIP159 + __KAM_STOCKTIP160 + __KAM_STOCKTIP161 + __KAM_STOCKTIP162 + __KAM_STOCKTIP163 + __KAM_STOCKTIP164 + __KAM_STOCKTIP165 >= 1)
describe KAM_STOCKTIP Email Contains Pump & Dump Stock Tip
score KAM_STOCKTIP 7.1
#KAM STOCK RULE #3 BASED HEAVILY ON WONDERFUL INPUT BY GARETH OF LINGUAPHONE
body __KAM_STOCK3 /([sS].?ymbol|Sym|SYM|SYMB|Symb|SYMBOL|SYmN|SYMN|Symn|Ticker|TICKER|Lookup|PINKSHEETS)\s*[-_:]\s*[A-Z0-9][-\._ ]?[A-Z0-9][-\._ ]?[A-Z0-9][-\._ ]?[A-Z0-9]/
score __KAM_STOCK3 0.1
describe __KAM_STOCK3 Email Looks like it references a 4 character stock symbol
#GENERIC STOCK RULE
meta KAM_STOCKGEN (__KAM_STOCKHEAD + __KAM_STOCKOTC + __KAM_STOCKSYM + __KAM_STOCKSHR + __KAM_STOCKSYM2 + __KAM_STOCKBULL + __KAM_STOCKSCTR >= 1) && (__KAM_STOCK3 >= 1) && (KAM_STOCKTIP < 1)
describe KAM_STOCKGEN Email Contains Generic Pump & Dump Stock Tip
score KAM_STOCKGEN 1.5
#KAM STOCK RULE #2
body __KAM_STOCK2_1 /(good trader|trading experience|bad trading day|hard trading day|FREE Stock Market Outlook|Market Watch)|more.than.\d+%|most.valuable|morning.report|real.?estate.authority|commercial.real.estate/i
body __KAM_STOCK2_2 /(easy cash|losses and victories|backstage trading|market facts|succeed in trading|destined to skyrocket|make traders rich|times your principal)|good.investment|overvalued.companies|company.is.soaring|economic.opportunity|amazing.company|take.notice|rental.yield|high.return/i
body __KAM_STOCK2_3 /stock/i
body __KAM_STOCK2_4 /trader|investor|analyst|royalties/i
header __KAM_STOCK2_5 Subject =~ /stock|bull market|penny|traders|go.getter|thousand.percent|this.company|opportunity|pct.rally|private.investment/i
header __KAM_STOCK2_6 From =~ /investment|daily.tip|bloomberg|selectedotc|penny|fortune|stock|finance|real.?estate|promotion/i
meta KAM_STOCK2 (__KAM_STOCK2_1 + __KAM_STOCK2_2 + __KAM_STOCK2_3 + __KAM_STOCK2_4 + __KAM_STOCK2_5 + __KAM_STOCK2_6) >= 4
score KAM_STOCK2 2.5
describe KAM_STOCK2 Another Round of Pump & Dump Stock Scams
#JUDGEMENTS
body __KAM_JUDGE1 /(unpaid court|(un-?collected|unsatisfied) judgments)/is
body __KAM_JUDGE2 /(funds|receive what) you are (due|owed)/is
#HALF-WEIGHTED RULES
body __KAM_JUDGE3 /collect your money/is
body __KAM_JUDGE4 /judgment/i
#FULL-WEIGHT
header __KAM_JUDGE5 Subject =~ /judgment/i
meta KAM_JUDGE (__KAM_JUDGE1 + __KAM_JUDGE2 + ((__KAM_JUDGE3 + __KAM_JUDGE4) / 2) + __KAM_JUDGE5 >= 2)
describe KAM_JUDGE Email Contains Judicial Judgment Solicitation
score KAM_JUDGE 2.5
#MEDS
body __KAM_MED1 /e.?c.?o.?n.?o.?m.?i.?z.?e.{1,10}med/i
body __KAM_MED2 /\d\d ?%/
describe KAM_MED Economizing your meds spam
meta KAM_MED (__KAM_MED1 + __KAM_MED2 >= 2)
score KAM_MED 1.5
#MEDS2- THANKS TO RES FOR POINTING OUT A REGEX STUPIDITY
header __KAM_MED2_1 Subject =~ /Pharmacy order \#\d{5}/i
describe KAM_MED2 More Medical SPAM
meta KAM_MED2 (__KAM_MED2_1 >= 1)
score KAM_MED2 1.0
#TIME PIECE
#ADDED A FIX FOR REPLICATION THANKS TO MARK ROLES
header __KAM_TIME1 Subject =~ /(replica(\b|$)|diamond|designer[-_ ](watch|piece|collection)|(old|replica|style|luxury|trendy|elegant) watch|time[-_ ](keeper|piece)|wrist|chronometer|watches are in fashion|low budget|deliver your watch|(number|amount) of watches)|excellent.watch/i
#0.50 WEIGHTED TESTS
body __KAM_TIME2 /(replica(\b|$)|diamond|designer[-_ ](piece|collections|watch)|time[-_ ]piece|wrist|time-keeper|\/\/atch)/is
header __KAM_TIME3 Subject =~ /time|watch/i
body __KAM_TIME4 /time|watch/i
body __KAM_TIME5 /(funny|low) price|treat.yourself/i
#REMOVED WORD OMEGA FROM BRANDS. TOO MANY FPs.
body __KAM_TIME6 /(Cx?ARTIER|Bx?REITLING|Px?ATEK|Rx?OLEX|Bx?VLGARI|Tx?IFFANY)/i
meta KAM_TIME ((__KAM_TIME1 + ((__KAM_TIME2 + __KAM_TIME3 + __KAM_TIME4 + __KAM_TIME5 + __KAM_TIME6)/2)) >= 2)
describe KAM_TIME Pssss. Hey Buddy, wanna buy a watch?
score KAM_TIME 3.0
meta KAM_TIMEGEO (KAM_GEO_STRING2 && KAM_TIME)
describe KAM_TIMEGEO Email references geocities & wrist watch sales
score KAM_TIMEGEO 3.5
#YOUR HOME
body __KAM_HOME1 /YOUR HOME|Federal Housing Assistance Program|near.your.area/i
body __KAM_HOME2 /Build your equity faster|refund is not reversible|rent.to.own/i
body __KAM_HOME3 /tax saving plans|\d+K Mortgage Credit|no.more.of/i
header __KAM_HOME4 From =~ /rent.?and.?own|rent.own.list/i
header __KAM_HOME5 Subject =~ /homes.near.you|near.your.city|\d+ (bed|bath)|low.monthly/i
meta KAM_HOME (__KAM_HOME1 + __KAM_HOME2 + __KAM_HOME3 + __KAM_HOME4 + __KAM_HOME5 >= 3)
describe KAM_HOME Mortage & Refinance Spam Rule
score KAM_HOME 3.5
#UNIVERSITY RULE
body __KAM_UNIV1 /(University Administration|University Enrollment|Education Assessment|Faculty Assessment|University Degree|Administration Office|Education office|Schools office|Enrollment Office|Online University)/is
body __KAM_UNIV2 /\d (week|month).{0,30}degree/is
body __KAM_UNIV3 /(past work|based on your|earned from|life|life and work|present work) experience/is
body __KAM_UNIV4 /not official degree|non[ -]?accredited/is
body __KAM_UNIV5 /novelty (degree|use)/is
body __KAM_UNIV6 /verifiable University Degree/is
body __KAM_UNIV7 /(life|work) experience (diploma|degree|transcript)/is
body __KAM_UNIV8 /Career Path/is
body __KAM_UNIV9 /non[- ]?ac(creditee?d)?.{1,10}universit/is
body __KAM_UNIV10 /(graduating|diploma) (within|in) (as little as)? (one|two|three|\d) (week|month)/is
body __KAM_UNIV11 /(degree|transcript) in any field|Field of yourr? ch[oò][iì]ce/is
body __KAM_UNIV12 /(obtain your diploma|diploma that you want|Criminal Justice or Homeland Security degree)/is
body __KAM_UNIV13 /(degree|field|diploma) of your (choice|expertise)/is
body __KAM_UNIV14 /(earn a|full) transcript/is
body __KAM_UNIV15 /(No Study Required|Without Exams|No (examinations|[eÉ]xams)|without attending a single class|no classes|no textbooks|no (?:required )?tests|degree .{0,30}you deserve)/is
body __KAM_UNIV16 /\d weeks.{0,30}graduated/is
header __KAM_UNIV17 Subject =~ /(dip(i|l)oma|degree|transcript|award|increase ?your ?income|degree online|Ph\.?D|Add an mba)/i
body __KAM_UNIV18 /100% discrete/is
body __KAM_UNIV1B /\d (months|weeks)/i
body __KAM_UNIV2B /d[_\. ]?e[_\. ]?g[_\. ]?r[_\. ]?e[_\. ]?e/i
body __KAM_UNIV3B /(dead end job|improve your future, and your income|high paying jobs|bec[óo]me a do[cç]tor|get your diploma today)/is
body __KAM_UNIV4B /1.?0.?0.?% (legit|verifiable|online|no pre|non[- ]?accredited)/is
body __KAM_UNIV5B /F A S T[ ]{0,4}T R A C K/is
body __KAM_UNIV6B /DIP\sLOMA/
meta KAM_UNIV ((__KAM_UNIV1 + __KAM_UNIV2 + __KAM_UNIV3 + __KAM_UNIV4 + __KAM_UNIV5 + __KAM_UNIV6 + __KAM_UNIV7 + __KAM_UNIV8 + __KAM_UNIV9 + __KAM_UNIV10 + __KAM_UNIV11 + __KAM_UNIV12 + __KAM_UNIV13 + __KAM_UNIV14 + __KAM_UNIV15 + __KAM_UNIV16 + __KAM_UNIV17 + __KAM_UNIV18) >= 2 || (__KAM_UNIV1B + __KAM_UNIV2B + __KAM_UNIV3B + __KAM_UNIV4B + __KAM_UNIV5B + __KAM_UNIV6B) >= 3)
describe KAM_UNIV Diploma Mill Rule
score KAM_UNIV 4.5
#URUNIT
body __KAM_URUNIT1 /\bur (unit|liveliness|energy level|endurance level)/is
body __KAM_URUNIT2 /\bur (gf|girl|wife|size|thing|partner|significant other)/is
body __KAM_URUNIT3A /\b(exasperated|fatigued|drained|tired) all the time/is
#HALF-WEIGHTED RULES
body __KAM_URUNIT3 /(unsatisfied|not satisfied|nagging|complaining|complaints|complained|unlimited prowess|increase your volume)/is
body __KAM_URUNIT4 /(bedroom|the bed|nighttime activit|male power|show your girl)/is
body __KAM_URUNIT5 /(size of (there|their|your) .{0,11}(unit|thing)|using them for a couple months|enhancing formula)/is
body __KAM_URUNIT6 /(majority of women|shrinking .{0,12} baby fat|winning guy|huge explosion)/is
#FULL-WEIGHT
header __KAM_URUNIT7 Subject =~ /(\b|^)ur (unit|wife|girlfriend|GF|size|thing|partner|significant other|livelyehood)/i
header __KAM_URUNIT8 Subject =~ /(pleasure|sensation|grow|your teeny|impress your mate|being small|how big|more intense)/i
meta KAM_URUNIT ((__KAM_URUNIT1 + __KAM_URUNIT2 + ((__KAM_URUNIT3 + __KAM_URUNIT4 + __KAM_URUNIT5 + __KAM_URUNIT6) / 2) + __KAM_URUNIT7 + __KAM_URUNIT8 + __KAM_URUNIT3A) >= 2)
describe KAM_URUNIT Recent penile and body enhancement spams
score KAM_URUNIT 0.5
#UR ZEST
body __KAM_URZEST1 /(?:your|ur) (?:power|strength|zal|zeal|liveliness|zest|intensity|spontaneity|activity)(?: level)?(?: been)?(?: feeling| down)? ?(?:lately|recently|anew)?/i
body __KAM_URZEST2 /or still (?:jaded|worn|drained|exasperated) all the time/i
body __KAM_URZEST3 /(?:(?:wanting|looking|seeking) to get in the gym|(?:dreaming|seeking|hoping) to get (?:into shape|fit))/i
body __KAM_URZEST4 /(wks it has been|been mos) since we('| ha)ve chatted/i
body __KAM_URZEST5 /(back into shape|made me healthier after my disease)/i
meta KAM_URZEST (__KAM_URZEST1 + __KAM_URZEST2 + __KAM_URZEST3 + __KAM_URZEST4 + __KAM_URZEST5 >= 2)
describe KAM_URZEST Recent penile and body enhancement spams
score KAM_URZEST 3.0
#JOB LET GO
body __KAM_JOB1 /let go from (a job|my employment) I held for.{1,19} (month|year|forever|life)/is
body __KAM_JOB2 /twice as much/is
meta KAM_JOB (__KAM_JOB1 + __KAM_JOB2 >=2)
describe KAM_JOB People let go, work at home, earn billions!
score KAM_JOB 4.3
#PERIMETERPARK
body KAM_PERPARK /P e r i m e t e r P a r k C e n t e r/i
describe KAM_PERPARK Obfuscated address appearing in SPAM Feb 06
score KAM_PERPARK 2.5
#HOLLYWOOD WAY
body KAM_HOLLY /1 0 2 0 N H o l l y w o o d W a y /i
describe KAM_HOLLY Obfuscated address appearing in SPAM Jun 06
score KAM_HOLLY 2.5
#PUMP & DUMP STOCK GRAPHICS
header __KAM_STOCKG1 Subject =~ /^Fw: \d{6}$/i
header __KAM_STOCKG2 Subject =~ /(^|\b)(stocks?|small-cap)(\b|$)/i
meta KAM_STOCKG ((HTML_IMAGE_ONLY_12 || HTML_IMAGE_ONLY_16 || HTML_IMAGE_ONLY_24) && HTML_MESSAGE && (__KAM_STOCKG1 || __KAM_STOCKG2))
describe KAM_STOCKG Graphical Pump and Dump Scams
score KAM_STOCKG 3.0
#CEP Diploma Mill
body __KAM_CEP1 /Job Prospect Newsletter|training.workshop/i
body __KAM_CEP2 /legitimate verifiable degree|build a better you|domain.knowledge/i
body __KAM_CEP3 /Career Education program|customize a learning program|certified.instructor/i
body __KAM_CEP4 /(MBA|CEP)/
body __KAM_CEP5 /degree\/certificates|certification/i
body __KAM_CEP6 /\d (week|month)/i
header __KAM_CEP7 From =~ /certificate program/i
meta KAM_CEP ((__KAM_CEP1 + __KAM_CEP2 + __KAM_CEP3 + __KAM_CEP4 + __KAM_CEP5 + __KAM_CEP6 + __KAM_CEP7) >= 3)
describe KAM_CEP CEP Diploma Mill Rule
score KAM_CEP 3.5
#Commented since 3.2.0 is pretty old now
#if (version < 3.200000)
# #BLANK EMAILS - CURRENTLY REQUIRES 99_FVGT_meta.cf for FM_NO_FROM AND NO_TO. UNDISC_RECIPS MIGHT BE REMOVED IN 3.2+
# #HTML_SHORT_LENGTH DEPENDENCY RULE REMOVED FROM SA 3.2
# meta KAM_BLANK01 (MISSING_SUBJECT && (UNDISC_RECIPS || FM_NO_FROM_OR_TO || FM_NO_TO))
# describe KAM_BLANK01 Blank emails
# score KAM_BLANK01 1.0
#
# #MSGID_FROM_MTA_ID REMOVED IN NEWER SPAMASSASSIN 3.2
# meta KAM_BLANK02 (KAM_BLANK01 && MSGID_FROM_MTA_ID)
# describe KAM_BLANK02 Blank emails with MTA Headers
# score KAM_BLANK02 1.0
#endif
#KAM GEOCITIES SPAM
# Updated by KAM based on Work by Dallas L. Engelken <[email protected]> (T_GEO_QUERY_STRING)
uri KAM_GEO_STRING2 /^http:\/\/(?:\w{1,5}\.)?geocities(?:\.yahoo)?\.com(?:\.\w{1,5})?(?::\d*)?\/.+?/i
describe KAM_GEO_STRING2 Use of geocities/yahoo very likely spam as of Dec 2005
score KAM_GEO_STRING2 4.7
#KAM GOOGLE SPAM
uri KAM_GOOGLE_STRING /^http:\/\/www.google.com\/url\?q=/i
describe KAM_GOOGLE_STRING Use of Google redir appearing in spam July 2006
score KAM_GOOGLE_STRING 1.0
#MSN Brasil REDIRECTOR - Known exploit since at least 2007!! http://www.xssed.com/mirror/14129/
uri KAM_MSNBR_REDIR /g.msn.com.br\/BR9\/1369.0/i
describe KAM_MSNBR_REDIR Use of MSN Brasil Redirector for Spam seen in 2011
score KAM_MSNBR_REDIR 5.0
#KAM MSN SPAM
uri __KAM_MSN_STRING1 /^http:\/\/spaces\.msn\.com(?::\d*)?\/.+\//i
uri __KAM_MSN_STRING2 /^http:\/\/.{0,20}\.spaces\.live\.com/i
meta KAM_MSN_STRING (__KAM_MSN_STRING1 + __KAM_MSN_STRING2 >=1)
describe KAM_MSN_STRING spaces.msn.com likely spam (Mar 2006) + spaces.live.com (Mar 2010)
score KAM_MSN_STRING 2.5
#KAM LIVEJOURNAL SPAM
uri __KAM_LIVE1 /^http:\/\/.{0,20}\.(blogspot|livejournal)\.com/i
meta KAM_LIVE (__KAM_LIVE1)
describe KAM_LIVE blogspot.com & livejournal.com likely spam (Apr 2010)
score KAM_LIVE 1.0
#KAM PAGE.TL SPAM - idea from Benny Pedersen
uri __KAM_PAGE1 /^http:\/\/.{0,20}\.(page\.tl)/i
meta KAM_PAGE (__KAM_PAGE1)
describe KAM_PAGE Page.TL likely spam (Nov 2011)
score KAM_PAGE 2.0
# This rule is to mark emails using the exploit of the URI parsing
uri KAM_URIPARSE /(\%0[01]|\0).{1,100}\@/i
describe KAM_URIPARSE Attempted use of URI bug-high probability of fraud
score KAM_URIPARSE 7.0
#Ebay Closed their Redirector - Disabled 4-9-05
# This rule is to mark emails using the exploit of the eBay redirector
#uri KAM_EBAYREDIR /.*.ebay.com.*RedirectToDomain/i
#describe KAM_EBAYREDIR Attempted use of eBay redirect-likely fraud
#score KAM_EBAYREDIR 7.0
# Rule based on Kelson Vibber's MD code for bogus AOL Addresses
# Check for bogus AOL addresses as described at
# http://postmaster.aol.com/faq/mailerfaq.html#syntax
# - all alphanumeric, starting with a letter, from 3 to 16 characters long.
header __KAM_AOL From =~ /\@aol.com/i
describe __KAM_AOL Partial Rule: Marks AOL Addresses
header __KAM_GOODAOL From =~ /[a-z][a-z0-9]{2,15}\@aol.com/i
describe __KAM_GOODAOL Partial Rule: Marks Bad AOL Addresses
meta KAM_COMBO_BADAOL __KAM_AOL && !(__KAM_GOODAOL)
describe KAM_COMBO_BADAOL Invalid AOL Email Address-High probability of spam
score KAM_COMBO_BADAOL 3.0
# Rule to mark emails from adv@somewhere accounts a bit higher on the SPAM scale
header KAM_ADV_EMAIL From =~ /(^| |<)ADV\@/i
describe KAM_ADV_EMAIL Marks adv@<domain.com> Addresses as likely SPAM
score KAM_ADV_EMAIL 16.0
#SEXUALLY EXPLICIT EMAILS - With updates courtesy of Mark Damrose
header __KAM_SEX_EXPLICIT1 Subject =~ /SEXUAL{2,3}Y[-_, ]{0,1}EXPL{1,2}I{1,2}CI{1,2}T/i
#EXPANDED TO INCLUDE HEADERS FOR SPAMS PREVALENT MAR 2007
header __KAM_SEX_EXPLICIT2 Subject =~ /(?:fuck .*suck|suck .*fuck|pussy .*cock|cock .*pussy|horny amateur|couch sex|slut fuck|naked celebrity|pissing babes|ass[- ]fuck|animal cock|(^|\b)P.O.R.N |exposes sexy ass|drunk babe nude|masturbate|looking.for.sex|breast.implants|pedophile|child predator|explore.being.bad|double.penetration|hardcore.slut|getting.laid|your.disco.stick|having.sex.*begging|f.ckbook|xxx gay|asian porn|blowjob|anal xxx|huge tits tube|xxx tube|porn tube|porn video|sexy.clip|portal for xxx|3d porn|hard(er)?.erect)|dreaming of f.?cking|(^|\b)sex.in.the.car|horny.virgin|sex.acts|best.intercourse|sex request|dripping wet and need to get/i
header __KAM_SEX_EXPLICIT3 From =~ /(?:better sex|sextrick|ashleymadison|booty.call|breast.(aug|surg|redu)|throbing.member|f[\*u]?ckbook|Local MILFs)/i
#MODIFIED TO FIX FP THANKS TO DOC SCHNEIDER AND MARK MARTINEC - REMOVED castrate|sexual.encounter|casual.sex|discreet.encounter 5/19/15
body __KAM_SEX_EXPLICIT4 /(?:fucked hardcore|dildoes her tight ass|kinky watersports|schoolgirls? slut|teens? porn|first anal(\b|$)|pussy lips|kinky lesbian|sucks? cock|rub puss|spreads? cunt|fetish babe|kinky pee|muffdived \& fuck|deepthroat on knees|hello.naughty.boy|certain.type.of.guy|girlfriend.trick|sexual.stamina|sex...toy|porn.link|cunt.fuck|c-o-c-k|non.stop.sex|porn.industry|stronger.erection|make.her.moan|extreme.pro.abortion|erection.problem|your.erection|get.an.erection|hardest.erection|get.erect|xxx gay|asian porn|blowjob porn|anal xxx|huge tits tube|xxx tube|porn tube|fuckbook|portal for xxx|3d porn|DrPEnterprise|girlfriends.porn|\bsex.galler|pussy.eaten|shemale|anal.adventure|black.girls.video|gay.porn|pussy.wet|make.her.horny|crave sex|women.fuck|women.horny|wanting.to.bang|getting.laid.is.simple|woman.on.her.knees|b r e a s t|generic.ed.product|best.sex|f[^a-z]cking.you|f[^a-z]ckbuddy|F\#ckFriends|Milf Selfies|need.a.horny.man|cute.sex.lover|horny.as.f.ck|fun.in.the.bedroom|my.tits.are|be.horny|horny.girl|horny.i.am|horny.latina|huge.dildo|made.me.climax|sex in my office|a.good.f\@ck|married.horny.woman|sucked.your.d\@ck|horny.milf|suck.you.off|horny.stories|all.my.h[o0]les|cum.heavily|sucking.your.c[o0]ck|to.get.f[^a-z]cked)|h00kup|s\*xy|h0rny|ch0ked|pu\$\$y|f\*cked|F\#ck|F\*ck_/i
header __KAM_SEX_EXPLICIT5 Subject =~ /(?:Babe.*dildo|milk.*pussy|licks.*lesbian.*tits|mud.*wrestling.*sluts|rock.*hard.*cock|working.*pussy|(anal|suck|lick|hot|cock|wife).*f.?u.?c.?k|sneaky.*upskirt.*shots|hairy.*(pussy|cunt)|chicks.*cum|shows.*off.*titties|tits.*milf.*sex|riding.*big.*dick|dildo.*pussy|slut.*sex|suck.*dick|show.*off.*pink.*slit|coed.*pussy|squirt.*pussy|polish.*cock|femdom.*fist|schoolgirl.*(f.?u.?c.?k|blowjob)|mistress.*finger.*slave|cervix.*examined|tits.*vibrator|licks.*lesbian|slut.*anal|slurp.*pecker|master.*hogtie|bitch.*stroke.*guy|huge.*cock.*bang|take.*dick.*ride|milf.*nailed|girl.*in.*panties|Slut.*Doing.*it|barely.*legal.*teen|perverted.*girl.*works.*ass|slut.*milking|caught.*fucking|F.?u.?c.?k.*(dick)|shemale.*strips|chick.*drilled|\bass.*screw|teen.*pussy|fucked.*hard|bimbo.*hooter|cuntbanged|tittyfucked|fuck.*cock|blowing and nailed|lesbians.*masturbat|shaking wet booty|pussy.*lip|lick.*asshole|kinky lesbian|suck.*cock|rub puss|tits.*cunt|kinky pee|fetish babe|exposes sexy ass|drunk babe nude|muff.*fuck|cock.?suck.*blonde|fuck.*vibrator|threeway.*orgy|sex.life.*new.level|your.sex.life|hotsex|f.cktonight|my.?pu[s\$]{1,5}y|InstaSext|SnapHookup|InstaAffair|InstaHookup|SexiSnap|SnapF.ck|snapbangmsg)/i
meta KAM_SEX_EXPLICIT (__KAM_SEX_EXPLICIT1 + __KAM_SEX_EXPLICIT2 + __KAM_SEX_EXPLICIT3 + __KAM_SEX_EXPLICIT4 + __KAM_SEX_EXPLICIT5 >= 1)
describe KAM_SEX_EXPLICIT Subject or body indicates Sexually Explicit material
score KAM_SEX_EXPLICIT 16.0
#SOLICITING AFFAIR SPAM
header __KAM_SEX_AFFAIR1 Subject =~ /Have an affair|Your Affair is Waiting|sick of your wife|find you a girlfriend/i
header __KAM_SEX_AFFAIR2 From =~ /Ashley.?Madison|Let's have fun/i
rawbody __KAM_SEX_AFFAIR3 /have an affair|ashleymadison/i
rawbody __KAM_SEX_AFFAIR4 /looking.for.affair/i
meta KAM_SEX_AFFAIR (__KAM_SEX_AFFAIR1 + __KAM_SEX_AFFAIR2 + __KAM_SEX_AFFAIR3 + __KAM_SEX_AFFAIR4 >= 2)
describe KAM_SEX_AFFAIR Subject or body soliciting an affair
score KAM_SEX_AFFAIR 8.0
#KAM_TELEWORK
body __KAM_TELEWORK1 /(generate|make) .{0,10}1.5K? (to|-) 3.5K (a day|daily|per day|per month)|makes? \$[\d,]+\/month|upgrade your salary/is
body __KAM_TELEWORK2 /have a (?:tele)?phone|money making challenge|has full internet/is
body __KAM_TELEWORK3 /return(?:ing)? (phone )?calls|working a few hours each day|positive work environment/is
body __KAM_TELEWORK4 /fully qualified|no experience needed|all the training|managing expectations|accountability|stronger results/is
body __KAM_TELEWORK5 /work (?:online )?from home|process(?:ing)? rebates (?:at|from) home|set your own hours|100% no risk|Western Union fees|new job or career/is
body __KAM_TELEWORK6 /earning up to \d+USD|earn thousands of dollars|\d% commission|get rich quick|manager training|real.payoff/is
header __KAM_TELEWORK7 Subject =~ /process rebates|easy work and great pay|making money today|earn money|vacancies in your city|internet jobs|bad ecomomy|(manager|supervisor).training|handling difficult|work.from.home/i
header __KAM_TELEWORK8 From =~ /training|online/i
meta KAM_TELEWORK (__KAM_TELEWORK1 + __KAM_TELEWORK2 + __KAM_TELEWORK3 + __KAM_TELEWORK4 + __KAM_TELEWORK5 + __KAM_TELEWORK6 + __KAM_TELEWORK7 + __KAM_TELEWORK8 >= 3)
describe KAM_TELEWORK Stupid telework and training scams
score KAM_TELEWORK 3.0
#.pw TLD - CHANGED TO AN ANCHOR AT THE END THANKS TO Stefan Botter
#.link TLD added - 2014-10-28
header SOMETLD_ARE_BAD_TLD From:addr =~ /\.(link|pw)$/
describe SOMETLD_ARE_BAD_TLD .PW & .LINK TLD Abuse
score SOMETLD_ARE_BAD_TLD 10.0
#CHANGED TO KAMOnly
ifplugin Mail::SpamAssassin::Plugin::KAMOnly
#TESTING RULE
body KAM_LOCAL_TEST1 /myspamtest12341234/
describe KAM_LOCAL_TEST1 This is a unique phrase to trigger a + score
score KAM_LOCAL_TEST1 50
#REVERSE DNS TESTS FROM MIMEDEFANG - UNLESS YOU HAVE A TEST FOR REVERSE POINTERS, YOU CAN COMMENT THIS OUT
header KAM_RPTR_FAILED X-KAM-Reverse =~ /^Failed/
describe KAM_RPTR_FAILED Failed Mail Relay Reverse DNS Test
score KAM_RPTR_FAILED 6.0
header KAM_RPTR_SUSPECT X-KAM-Reverse =~ /^Suspect/
describe KAM_RPTR_SUSPECT Suspected Dynamic IP/Bad TLD/Spammy TLD from Mail Relay Reverse DNS Test
score KAM_RPTR_SUSPECT 2.45
#REMOVED __URIBL_ANY DEPENDENCY AS THE RULE IS GONE. NOTED by David Goldsmith.
header __KAM_RPTR_PASSED X-KAM-Reverse =~ /^Passed/
meta KAM_RPTR_PASSED (__KAM_RPTR_PASSED && (URIBL_BLACK + URIBL_SBL + URIBL_PH_SURBL + RCVD_IN_BL_SPAMCOP_NET + RCVD_IN_SORBS_DUL + IN_BCUDA_RBL + RCVD_IN_BCUDA_RELAY + RCVD_IN_XBL + KAM_SPAMJDR + KAM_LOTTO3 + __KAM_URIBL_PCCC + __KAM_MX + SPF_SOFTFAIL + SPF_FAIL + KAM_INFOUSMEBIZ + KAM_TOLL < 1))
describe KAM_RPTR_PASSED Passed Mail Relay Reverse DNS Test
score KAM_RPTR_PASSED -1.0
header KAM_RPTR_MISSING X-KAM-Reverse =~ /^Missing/
describe KAM_RPTR_MISSING Mail Relay Reverse DNS Entry Missing!
score KAM_RPTR_MISSING 9.0
#DWDTECHSPAM /ETC
header KAM_RPTR_BADHOST X-KAM-Reverse =~ /dwdtechllc.com|inculloop.net|donapex.net|wriltay.com|raptornode.com|voicitr.us|premiumjobhunt.com|newsocialdeals.com|dailysummercoupons.com|nm-priorityhosting.com|hypernia.com|queryfoundry.net|colocrossing.com|pawlitenews.com|hosted-by-i3d.net/i
describe KAM_RPTR_BADHOST Very Spammy Hosting Company Identified
score KAM_RPTR_BADHOST 9.0
#CUSTOM SCORES THAT KAM LIKES
#score SARE_GIF_ATTACH 3.0
score CHARSET_FARAWAY_HEADER 1.6
score MIME_CHARSET_FARAWAY 1.25
score FH_FROM_CASH 2.0
score EWG_BAD_40 1.5
score EWG_BAD_47 1.5
score EWG_BAD_54 1.5
score FREEMAIL_ENVFROM_END_DIGIT 1.0
score FREEMAIL_REPLYTO 1.0
score KHOP_BIG_TO_CC 1.5
score URIBL_DBL_SPAM 5.0
score AC_HTML_NONSENSE_TAGS 4.0
#ENABLING DNSWL - BUG 6668
score RCVD_IN_DNSWL_NONE 0 -0.0001 0 -0.0001
score RCVD_IN_DNSWL_LOW 0 -0.7 0 -0.7
score RCVD_IN_DNSWL_MED 0 -2.3 0 -2.3
score RCVD_IN_DNSWL_HI 0 -5 0 -5
#COMPLETE WHOIS IS DOWN
#score __RCVD_IN_WHOIS 0
#score RCVD_IN_WHOIS_INVALID 0
#score URIBL_COMPLETEWHOIS 0
#Custom subject whitelist
#header FRANCHISE_JERRY Subject =~ /: (Franchise Application|Request Franchise Information)$/i
#score FRANCHISE_JERRY -99.0
#describe FRANCHISE_JERRY Jerry's Franchise Application or Request
header KAM_INVALID_FROM X-KAM-From =~ /From Header Missing Host/
describe KAM_INVALID_FROM From header missing host portion
score KAM_INVALID_FROM 4.0
#RAPTOR ALTERED EMAILS
body __KAM_RAPTOR1 /altered by our Raptor filters/i
header __KAM_RAPTOR2 X-KAM-Raptor-Alter =~ /True/
meta KAM_RAPTOR (__KAM_RAPTOR1 + __KAM_RAPTOR2 >= 1)
describe KAM_RAPTOR PCCC Raptor altered the email
score KAM_RAPTOR 3.5
#NJABL Shutdown Bug 6913 - Check after 3/3/2013 update if these can be removed
score RCVD_IN_NJABL_CGI 0
score RCVD_IN_NJABL_MULTI 0
score RCVD_IN_NJABL_PROXY 0
score RCVD_IN_NJABL_RELAY 0
score RCVD_IN_NJABL_SPAM 0
score __RCVD_IN_NJABL 0
if can(Mail::SpamAssassin::Conf::feature_dns_query_restriction)
dns_query_restriction deny njabl.org
endif
#KAM Bad Attach
header KAM_RPTR_MISSING X-KAM-Reverse =~ /^Missing/
describe KAM_RPTR_MISSING Mail Relay Reverse DNS Entry Missing!
score KAM_RPTR_MISSING 9.0
#KAM Bad Attach
header KAM_RPTR_MISSING X-KAM-Reverse =~ /^Missing/
describe KAM_RPTR_MISSING Mail Relay Reverse DNS Entry Missing!
score KAM_RPTR_MISSING 9.0
#KAM Bad Attach
header KAM_RPTR_MISSING X-KAM-Reverse =~ /^Missing/
describe KAM_RPTR_MISSING Mail Relay Reverse DNS Entry Missing!
score KAM_RPTR_MISSING 9.0
#KAM Bad Attach
header KAM_BADATTACH X-KAM-BadAttach =~ /^True/
describe KAM_BADATTACH Mail contains a bad attachment
score KAM_BADATTACH 15.0
#RHS_DOB not working 10/6/2014 - Resolved 10/9/2014
#score URIBL_RHS_DOB 0.0
else
# no KAMOnly, stub rules
meta KAM_RAPTOR 0
score KAM_RAPTOR 0
meta CBJ_GiveMeABreak 0
score CBJ_GiveMeABreak 0
meta KAM_RPTR_SUSPECT 0
score KAM_RPTR_SUSPECT 0
meta KAM_RPTR_FAILED 0
score KAM_RPTR_FAILED 0
meta KAM_RPTR_PASSED 0
score KAM_RPTR_PASSED 0
endif
#$6c822ecf@ - Idea from Jailer-Daemon on SARE
header KAM_6C822ECF Message-Id =~ /\$6c822ecf\@/i
describe KAM_6C822ECF $6c822ecf@ VERY prevalent message-ID header in SPAMs
score KAM_6C822ECF 7.0
#DRILLING & MUST READ - With updates courtesy of Mark Damrose
header __KAM_MUSTREAD1 Subject =~ /you (?:must|should|require|need|have) to read\.$/i
header __KAM_MUSTREAD2 Subject =~ /^(?:Weighty|Very important|Serious|Momentous|Significant|Grand|Essential) (?:message|letter|note)\./i
meta KAM_MUSTREAD (__KAM_MUSTREAD1 + __KAM_MUSTREAD2 >= 1)
describe KAM_MUSTREAD Subject indicative of a SPAM message
score KAM_MUSTREAD 1.25
body __KAM_DRILL1 /drilling/i
body __KAM_DRILL2 /oil (company|partnership|and gas rights)/i
body __KAM_DRILL3 /(exceed(ed)? .{0,10}expectations|see your brokers website)/i
body __KAM_DRILL4 /(buy today|Check this deal out)/i
meta KAM_DRILL (KAM_MUSTREAD + __KAM_DRILL1 + __KAM_DRILL2 + __KAM_DRILL3 + __KAM_DRILL4 >= 4)
describe KAM_DRILL Oil Drilling SPAM
score KAM_DRILL 1.5
#CHANGED TO KAMOnly
ifplugin Mail::SpamAssassin::Plugin::KAMOnly
#WE USE MIMEDEFANG TO DISABLE ANY IFRAME, OBJECT OR SCRIPT TAGS IN EMAILS
header KAM_IFRAME X-IframeWarning =~ /Iframe\/Object\/Script tag\(s\) deactivated by MIMEDefang/
describe KAM_IFRAME Email contained Iframe, Object or Script tags
score KAM_IFRAME 1.0
body KAM_IFRAME2 /you need a browser with javascript/i
describe KAM_IFRAME2 Email contains phrase instructing javascript use
score KAM_IFRAME2 1.0
meta KAM_IFRAME3 (KAM_IFRAME + KAM_IFRAME2 + T_HTML_ATTACH >=3)
score KAM_IFRAME3 5.0
describe KAM_IFRAME3 Likely email exploit - Email shouldn't require javascript in an email attachment
#XEROX SCANS
header __KAM_XEROX1 Subject =~ /Scan from a Xerox WorkCentre Pro \#\d+|Scanned from a Xerox Multifunction Device/i
meta KAM_XEROX (__KAM_XEROX1 + (KAM_IFRAME && T_HTML_ATTACH) + KAM_RAPTOR >= 2)
score KAM_XEROX 5.0
describe KAM_XEROX Likely Fake Xerox Attachment
else
# no KAMOnly, stub rules
meta KAM_IFRAME 0
score KAM_IFRAME 0
endif
#STUPID REMOVE "*" to make the link working.
body __KAM_STAR1 /REMOVE ("\*"|space) (in the above|to make the) link/i
meta KAM_STAR (__KAM_STAR1 >= 1)
describe KAM_STAR Stupid Obfuscated Link SPAMs
score KAM_STAR 2.0
#IN LATE FEB 2007, WE BEGAN RECEIVING TONS OF EMAILS FORMATED ALL THE SAME.
body __KAM_SPAMKING1 /This advertisement is presented by/is
body __KAM_SPAMKING2 /If you have any questions or concerns regarding this communication, please send correspondence/is
body __KAM_SPAMKING3 /To .{0,30}(?:unsubscribe|stop|remove) .{0,35}(?:email|messages) from third party advertisers/is
body __KAM_SPAMKING4 /notify .{0,30} that you no longer wish to receive (?:promotional )?messages/is
body __KAM_SPAMKING5 /This (communication|message) was delivered to you by/is
body __KAM_SPAMKING6 /(?:please send|Forward postal) correspondence to/is
meta KAM_SPAMKING (__KAM_SPAMKING1 + __KAM_SPAMKING2 + __KAM_SPAMKING3 + __KAM_SPAMKING4 + __KAM_SPAMKING5 + __KAM_SPAMKING6 >= 3)
describe KAM_SPAMKING SPAM using throw-away domains and addresses. SpamKing's Heir!
score KAM_SPAMKING 1.0
#THIS HEADER SEEMS TO BE PREVALENT IN SPAMS
header KAM_SPAMJDR X-Mailerinfo =~ /OTHR_JDR/
describe KAM_SPAMJDR Emails seen with SPAM containing this header X-Mailerinfo: OTHR_JDR1173771
score KAM_SPAMJDR 2.0
meta KAM_COMBOJDR (KAM_SPAMJDR + KAM_SPAMKING >= 2)
describe KAM_COMBOJDR Spam Test for Rules Combined with KAM_SPAMJDR
score KAM_COMBOJDR 5.0
#LOTTO CRUD
body __KAM_LOTTO1 /((you |e-?mail )(?:address,? )?(has |have )?(emerged as one of (the|our) winning|emerged as a category "A" Winner|came out as the winning coupon|emerged a winner|has won|(?:was |is )?attached( to)?\s+(winning number|serial|ticket|reference)|was one of the ten winners|has been selected as one of the lucky)|random selection in our computerized email selection system|procuring your prize|email id identified with coupon|e-mail addresses are picked randomly|send your winning identification|final recipients? of a cash|selected as the one of the beneficiaries|receiving your donation)/is
body __KAM_LOTTO2 /((ticket|serial|lucky) number|secret pin ?code|pin number|batch number|reference number|promotion date|lottery|sweepstake|\d+ lucky recipients|for claim and inquiring)/is
body __KAM_LOTTO3 /(won|claim|cash prize|pounds? sterling|over \$500|award sum of US\$|NOTIFICATION FOR CASH AID)/is
body __KAM_LOTTO4 /(claims (office|agent|manager)|lottery coordinator|(certificate|fiduciary) (officer|agent)|fiduaciary claims|accredited agent|payment agency board|promotion manager|promotions? department|Name of +Agent:|executive secretary|claims & Management|lottery approved courier|promo.team)/is
body __KAM_LOTTO5 /(POWERBALL LOTTO|freelotto group|Royal Heritage Lottery|(British|UK) National( Online)? Lottery|U\.?K\.? Grand Promotions|Lottery Department UK|Euromillion Loteria|Luckyday International Lottery|International Lottery|Euro - Afro Asian Sweepstake|urawinner|Free Lotto Sweepstakes|PROMOTION DEPARTMENT|PROMOTION\/PRIZE AWARD|Nederlandse Internationale Loterij|EURO MILLIONS|APPLE LOTTERY ONLINE|MSW MEGA JACKPOT|MICROSOFT EMAIL PROMO|MSNlottery|ECOWAS|Nigeria|National Lottery|claim.{1,10}your.gbp|won.you.{1,10]gbp)/is
body __KAM_LOTTO6 /(Dear (Award|Consultation Prize|Lucky) Winner|Winning Notification|Attention:Winner|Dear:? Winner|Amount won:|Sincere Congratulations|Lucky Numbers:|you are a winner|prize attached|prize notification|claims requirement|winning number|winning sum|payout of|qualification number)|attached.file|numbers.on.email/is
header __KAM_LOTTO7 Subject =~ /(Your Lucky Day|Final Notice|CONGRATULATION|(Attention:|ONLINE) WINNER|Winning Notification|Claim Fund|YOU HAVE WON|Online Notification|Your Winning Amount|PROMOTIONS MANAGER|Winnin?g Alert|NOTICE FOR YOUR CLAIM|WINNER|Reference Number)/i
header __KAM_LOTTO8 From =~ /Lottery|powerball|western.union/i
header __KAM_LOTTO9 Subject =~ /\d{3},\d{3}|eligibility.for.claims|promo.desk|deserves.\$\d/i
meta KAM_LOTTO1 (__KAM_LOTTO1 + __KAM_LOTTO2 + __KAM_LOTTO3 + __KAM_LOTTO4 + __KAM_LOTTO5 + __KAM_LOTTO6 + __KAM_LOTTO7 + __KAM_LOTTO8 + __KAM_LOTTO9 >= 3)
describe KAM_LOTTO1 Likely to be an e-Lotto Scam Email
score KAM_LOTTO1 0.5
meta KAM_LOTTO2 (__KAM_LOTTO1 + __KAM_LOTTO2 + __KAM_LOTTO3 + __KAM_LOTTO4 + __KAM_LOTTO5 + __KAM_LOTTO6 + __KAM_LOTTO7 + __KAM_LOTTO8 + __KAM_LOTTO9 >= 4)
describe KAM_LOTTO2 Highly Likely to be an e-Lotto Scam Email
score KAM_LOTTO2 1.0
meta KAM_LOTTO3 (__KAM_LOTTO1 + __KAM_LOTTO2 + __KAM_LOTTO3 + __KAM_LOTTO4 + __KAM_LOTTO5 + __KAM_LOTTO6 + __KAM_LOTTO7 + __KAM_LOTTO8 + __KAM_LOTTO9 >= 5)
describe KAM_LOTTO3 Almost certain to be an e-Lotto Scam Email
score KAM_LOTTO3 2.0
#ABOUT YOUR INTERNET ACTIVITIES SPYWARE CRUD
header __KAM_ABOUT1 Subject =~ /About your Internet (activities|activity)/i
body __KAM_ABOUT2 /Spyware/i
meta KAM_ABOUT (__KAM_ABOUT1 + __KAM_ABOUT2 >=2)
describe KAM_ABOUT Email Scam Hawking Anti-Spyware
score KAM_ABOUT 1.0
#EMAIL ADVERTISING