Devco1
Home
Console
Upload
New File
New Folder
Tools
Info
About
/
etc
/
mail
/
spamassassin
/
Filename :
KAM.cf
back
Copy
#KAM.cf aka the KAM ruleset - Apache SpamAssassin Rules #Authors: Kevin A. McGrail with key contributions from Joe Quinn, Karsten Bräckelmann, # Bill Cole & Giovanni Bechis #Email: Kevin.McGrail@McGrail.com #Questions: Questions about the KAM Ruleset are best submitted at: # https://raptor.pccc.com/raptor.cgim?template=report_problem #HomePage: https://mcgrail.com/template/projects#KAM1 #Installation: There are multiple files that make up the KAM ruleset including #heavyweight, deadweight, & nonKAMrules. The KAM ruleset is now a channel! # #Please see https://mcgrail.com/template/kam.cf_channel for more information #The ruleset includes internal rules so not every rule will be useful but #we encapsulate those in a RaptorOnly defined loop. #KAM.cf is maintained by The McGrail Foundation, a 501(c)(3) charity. Donations #are appreciated. See www.mcgrail.com for more information on donations and #sponsorships. #THANK YOU TO OUR SPONSORS (in Alphabetical Order): #Akamai Cloud Computing, cPanel, INKY, Invaluement, iSpark, PCCC, ShipShapeIT and Zix/Appriver #This is a collection of special rules that KAM developed and uses for #https://raptoremailsecurity.com/. # #The exact date is lost to the sands of time but we have been publishing this #ruleset since at least May 2004 at no charge for the benefit of all. # #They were intended as live research for committal to SpamAssassin's SVN sandbox but #often rely on our corpora so they do not fair well in masschecks. #Problems and suggestions are best sent by this form to avoid being caught by our #filters: #https://raptor.pccc.com/raptor.cgim?template=report_problem #We do respond to most problem reports *especially* if you send an email sample. #Samples in mbox format are preferred. #The KAM Ruleset is production ready and in use on production systems protecting #many millions of mailboxes every day. # #IMPORTANT: This ruleset cf file is designed for systems at a threshold of 5.0+. #NOTE: We do use some poison pill (i.e. Automatic HAM/SPAM rules). # # - Because we use meta rules, false positives are minimized and a larger score # is acceptable. # # - In developing these rules and the associated RBL, we use a consent litmus # test. We do not block solely based on content except for the sexually # explicit rules. You can, of course, locally disable these rules. #Copyright (c) 2022 Kevin A. McGrail and The McGrail Foundation # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # Thanks to Wolfgang Breyha for his help fixing a few rules # The KAM Ruleset is composed by the following files: # KAM.cf # KAM_deadweight3.cf # KAM_deadweight3_meta.cf # KAM_deadweight3_sub.cf # KAM_freemail.cf # KAM_hashbl_settings.cf # KAM_heavyweight.cf # KAM_redirectors.cf # KAM_tlds.cf # KAM_urlshorteners.cf # KAM_rescore.cf # nonKAMrules.cf ifplugin Mail::SpamAssassin::Plugin::RaptorOnly body __BODY_8BITS eval:check_body_8bits() meta BODY_8BITS ( __BODY_8BITS && EXTRACTTEXT ) describe BODY_8BITS Body includes 8 consecutive 8-bit characters score BODY_8BITS 0.25 tflags BODY_8BITS userconf body __TVD_LONG_WORD5 /^(?:(?:\w+,?\s+)\.)+\s*$/ meta TVD_LONG_WORD5 ( __TVD_LONG_WORD5 && EXTRACTTEXT ) describe TVD_LONG_WORD5 Long words in email body score TVD_LONG_WORD5 0.5 # reduce FPs on FREEMAIL_FORGED_REPLYTO header __LIST_UNSUB exists:List-Unsubscribe meta GB_FREEM_FORGED_UNSUB ( FREEMAIL_FORGED_REPLYTO && __LIST_UNSUB ) describe GB_FREEM_FORGED_UNSUB Freemail forged reply-to on mailing lists score GB_FREEM_FORGED_UNSUB -1.5 endif # COURTESY OF Marcin Miros body __KAM_MM_FOREX_1 /program.{0,10}ktory\ssam\sgra\sna\sgieldzie|program\sdo\sgry\sna\sgieldzie|Potega\stego\sprogramu\stkwi|program.{0,10}handluje.{0,10}zarabia.{0,10}gieldzie.{0,10}udzialu.{0,10}czlowieka|zarabiaj.{0,10}program.{0,10}nie.{0,10}jest.{0,10}zabroniony|Program.{0,10}zrobi.{0,10}wszystko.{0,10}sam|handluj.{0,10}na.{0,10}gieldzie.{0,10}programowi|100.{0,10}%.{0,10}pewnych.{0,10}transakcji|program.{0,10}100.{0,10}%.{0,10}zysk|handel.{0,10}bedzie.{0,10}zabroniony|program.{0,10}odmieni.{0,10}twoje.{0,10}zycie|system.{0,10}finansow.{0,10}przed.{0,10}upadkiem|grupa.{0,10}niemieckich.{0,10}matematykow.{0,10}inteligentny.{0,10}program|zostan\sobrzydliwie\sbogaty|technologia.{0,10}100%.{0,10}pewne.{0,10}decyzje|zarabianie.{0,10}w.{0,10}sieci|swoja.{0,10}szanse.{0,10}zarabianie|internet.{0,10}doprowadzil.{0,10}pieniedzy|zarabia.{0,10}(w|przez).{0,10}internet|karaluch.{0,10}dom.{0,10}brzeg.{0,10}morza|odmieni.{0,10}zycie|pieniadz|pieniedz|zarabia|zarobi/i rawbody __KAM_MM_FOREX_2 /(\[|\<).{1,10}http:\/\/.{1,50}php\?.{1,30}\=.{1,30}(\]|\>).{0,20}(klik|odwiedz|dowiedz|przegap|odnosnik|zarobi|spiesz|majatek|wiecej\sinformacji\sna\sten\stemat\sznajdziesz\s-\stutaj|tutaj\sznajdziesz.{0,10}szczegolowe.{0,10}informacje|odwiedz|zarabia|wchodz)/i meta KAM_MM_FOREX __KAM_MM_FOREX_1 && __KAM_MM_FOREX_2 score KAM_MM_FOREX 2.5 describe KAM_MM_FOREX Polish-language spam from the Forex botnet #PHISHING TEST rawbody KAM_PHISH1 /u style="cursor: pointer"/ describe KAM_PHISH1 Test for PHISH that changes the cursor score KAM_PHISH1 0.01 header __KAM_PHISH4_1 From =~ /host|apple|amazon|microsoft|windows|express|app.serv|goodluck|bank|support/i body __KAM_PHISH4_2 /dear.{0,50}customer|automated.message|spam.activities|attempted.gaining.access|your.account.expires|authorized.government|important.message|message.alert|suspended/i body __KAM_PHISH4_3 /(confirm|verify|update).your.(identity|account)|account.password|credit.(bureau|profile)|identity.theft|accredited.commission|security.concern|kindly.find.enclosed|owner of this account/i ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __KAM_PHISH4_4 Content-Type =~ /(verification|information|form)\.htm/i endif meta KAM_PHISH4 (__KAM_PHISH4_1 + __KAM_PHISH4_2 + __KAM_PHISH4_3 + __KAM_PHISH4_4 >= 3) score KAM_PHISH4 3.5 describe KAM_PHISH4 Another phishing attempt #KAM REALESTATE / RE-FINANCE SCAM EMAILS - Thanks to David Goldsmith for pointing out my error in the meta rule! body __KAM_REAL1 /(^|\b)RE market/is body __KAM_REAL2 /(crashing|declining)/i body __KAM_REAL3 /(vacation|second) (home|place)/is meta KAM_REAL (__KAM_REAL1 + __KAM_REAL2 + __KAM_REAL3 >= 3) describe KAM_REAL Real Estate or Re-Finance Spam score KAM_REAL 0.5 #REFINANCE SCAM EMAILS #subj header __KAM_REFI1 Subject =~ /(refinance|rates) at \d\.\d*%|(?:I would like to offer you my help|Lower your house payment|follow up email|evaluation enclosed|submit a bid|fixed rates|ARM program|New Program|regardless of credit|loan request|accepting your application|refinance appl?ication|ready to (give a (business )?loan|lend)|good credit or not|refinance without perfect credit|financial independence|Loan Offer|Get a Loan|your urgent loan|credit report|time to refinance|refi.(rates|requirements|plus|program|plan|advice)|rates at historical low|EQUIFAX|TRANSUNION|Experian|rates can be cut|save your home)|Reverse.?Mortgage|obama (extends|waives)|VA loan|harp program|re.?fi.advice|homeowners.owe|harp.extension|\d+\.\d+%.fixed|\d+\.\d+.pct|this.rate|refi(nance)?.rate|lower.refi|refinance.your.mortgage|refinance.now|obama.?s?.refi|monthly.payment|house.payment|monthly.savings|modified.payment|new.payment|overpaying|calculate.your|your.saving|housing.plan|obama.?s.hous|l.f..insuranc.|offer.for.your.home|second.mortgage/i body __KAM_REFI2 /(Free Evaluation (?:online|on your (?:current )?home loan)|No hidden costs|no strings attached|good credit or not|personalized consultation|in need of loan|consolidation loan|loan processing|apply by sending|loan of any amount|clean up any inacccuracies|lock in saving|save on monthly mortgage|absolutely no cost|underwater)|Reverse.?Mortgage|qualify for a VA loan|Refi now.? and Save|obama..?announces|rate.calculator|save.thousands|update: \d.\d\d..available|homeowner|over.your.head|rate.service|now.eligi?[bl]{2}e|a.second.mortgage|urgent.loan|loan.offer/is body __KAM_REFI3 /(restructure (?:proposal|program|opportunity|your loan)|switch from an adjustable rate to a fixed|new lending program|(low|reasonable) interest (loan|rate)|lowest monthly payment|\d% interest|unsecured personal|better credit terms|lower your mortgage|low\-interest refinance|see your credit score|credit score.{1,15}updated|refi with HARP)|obama announce(s|d) (the )?harp program|obama'?s.refi|a.fortune.off|lower.home.rate|home.loan|gov.program|official.harp|currently.overpaying/is body __KAM_REFI4 /(\$\d{1,3},\d{1,3}|\d{2,3}k of funds|\d{4,6} USD|\d{4,6}\$ per month|\d{3,5}\/mo)|refinance at \d\.\d%|\$\d{3,}(\.\d\d)?.(a|per).year|extend.harp|spending.too.much|new.payment|better.rate/i tflags __KAM_REFI4 nosubject body __KAM_REFI5 /([\d,]{5,6}|\d{2}\s*%) savings|principal \d+% less|\d+\.\d+%.fixed|refi.calculator|lowered.requirements/is body __KAM_REFI6 /((?:reduce your monthly payment|save you) (between )?\d{2}\s*%|save yourself hundreds of dollars|great rate available|completely unsecured|instantly connect with\s+lenders|get you back on the right financial|get report today|protect against identity|know your credit score|crazy payments)|u.?s.? homeowners|drop.your.rate|in.your.pocket|our.records|apply.for.your/is body __KAM_REFI7 /(?:loan product|equity cash|house.payment|home.payment|no up front fees|seasoned equity|pay off high rate cards|ARM Program|credit is less than perfect|credit (score )?will not disqualify|plastic money|charge card balances|we offer out loans|floating loan scheme|unsecured guaranteed|President.?s new program|Home Affordable Refinance Program)|save $?[\d\.]+ per (year|month)|low.rate|harp.?2|rates.like.th(is|ese)/is header __KAM_REFI8 From =~ /great loan|mortgage|financ|Delta|Rate\.?market|credit score|free.?score|harp|mtge|foreclosure|VA loan|lower.my.(bills|debt|mortgage|rate)|refi.(alert|advantage|quote|calc|rate)|obama|lendingtree|(house|home).?payment|home.?payment|lower.rate|\d+\.\d+%|saving|d.r.ct.l.f.|helpline/i meta KAM_REFI (__KAM_REFI1 + __KAM_REFI2 + __KAM_REFI3 + __KAM_REFI4 + (__KAM_REFI5 + __KAM_REFI6 >= 1) + __KAM_REFI7 + __KAM_REFI8 + (KAM_SHORT || AC_HTML_NONSENSE_TAGS || KAM_EU) >= 4) describe KAM_REFI Real Estate / Re-Finance Spam score KAM_REFI 3.0 meta KAM_REFI2 (__KAM_REFI1 + __KAM_REFI2 + __KAM_REFI3 + __KAM_REFI4 + (__KAM_REFI5 + __KAM_REFI6 >= 1) + __KAM_REFI7 + __KAM_REFI8 + (KAM_SHORT || AC_HTML_NONSENSE_TAGS || KAM_EU) >= 6) describe KAM_REFI2 Real Estate / Re-Finance Spam score KAM_REFI2 2.75 #KAM ERADICATE DEBTS body __KAM_DEBT1 /(debts disappear|reduce your payments|piling bills|creditors|late bills|vanish some of your bills|reduce your payments|looming bills|all that debt|outstanding debt|debt.{0,7}accumulated|all my debt|penalties,? and fees are gone|banking laws|select legal|change your life|get out of .?d.?e.?b.?t|Free[- ]Credit Report|debt relief options|are you in debt|pay off all your debt|get better rates|credit card debt|could.be.easy)/is header __KAM_DEBT2 Subject =~ /(all that you owe|all you owe|everything you owe|eradicate|indebted|sick of bills|debt.{0,7}accumulated|tired of (the )?debt|looming debt|creditors|bank[ ]?rupt|debt ?free|out ?of ?debt|take control of your monthly payments|bills disappear|We can help|consultation regarding bills|get better rates|credit score|FICO Score|eliminate\s{1,2}debt|Erase the debt|loan offer|consolidating.debt)/i body __KAM_DEBT3 /(bills keeping you|brink of bankruptcy|take all the (stress|pain) away|all the bills|tired of high credit card|make your bills disappear|improve your credit score|b.?a.?n.?k.?r.?u.?p.?t.?c?.?y|monitor your[- ]credit|Wipes out debt|being debt free|interest rates are reasonable|view your credit score|manage.your.finance)/is meta KAM_DEBT ((__KAM_DEBT1 + __KAM_DEBT2 + __KAM_DEBT3) >= 3) describe KAM_DEBT Debt eradication spams score KAM_DEBT 2.5 meta KAM_DEBT2 ((__KAM_DEBT1 + __KAM_DEBT2 + __KAM_DEBT3 + __KAM_ADVERT2) >= 2) describe KAM_DEBT2 Likely Debt eradication spams score KAM_DEBT2 1.0 #XtraSize+ Penis Enlargement Scam header __KAM_SILD1 Subject =~ /Sildenafil Citrate/i body __KAM_SILD2 /(XtraSize\+|Sildenafil Citrate)/i meta KAM_SILD (__KAM_SILD1 + __KAM_SILD2 >= 1) describe KAM_SILD Simple rule to block one more enhancement message score KAM_SILD 5.0 #if (version < 3.002000) # #HTML_SHORT_LENGTH DEPENDENCY RULE REMOVED FROM SA 3.2.X # #KAM NUMBER EMAILS - Thanks to Mark Damrose for the NUMBER3 idea & Jan-Pieter Cornet # header __KAM_NUMBER1 Subject =~ /^\d+$/ # body __KAM_NUMBER2 /\d{1,6}/ # header __KAM_NUMBER3 Message-ID =~ /\<[a-z]{19}\@/i # # meta KAM_NUMBER ((__KAM_NUMBER1 + __KAM_NUMBER2 + MIME_HTML_ONLY + HTML_SHORT_LENGTH + __KAM_NUMBER3) >= 5) # describe KAM_NUMBER Silly Number Emails # score KAM_NUMBER 1.0 #endif #KAM MEDICATION KAM_OVERPAY body KAM_OVERPAY /O . V . E . R . P . A . Y/i describe KAM_OVERPAY Common Medicinal Ad Trick score KAM_OVERPAY 3.5 #VIAGRA AD - CHANGED DUE TO FPS on 2010-05-06 - Replaced [VACLXPSI] with separate rules space separated ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_rules __KAM_VIAGRA2 body __KAM_VIAGRA1 /V I A G R A|C I A L I S|V A L I U M|X A N A X/i header __KAM_VIAGRA2 Subject =~ /<V1><I1><A1><G1><R1><A1>/i meta KAM_VIAGRA1 (__KAM_VIAGRA1 + __KAM_VIAGRA2 >= 1) describe KAM_VIAGRA1 Common Viagra and Medicinal Table Trick score KAM_VIAGRA1 3.0 endif #VIAGRA AD 2 body KAM_VIAGRA2 /(?:Xan|Som|CIA|VAL|VIA|Pro|Amb|Lev|Mer) (?:Xan|Som|CIA|VAL|VIA|Pro|Amb|Lev|Mer) (?:Xan|Som|CIA|VAL|VIA|Pro|Amb|Lev|Mer)/i describe KAM_VIAGRA2 Common Viagra and Medicinal Table Trick score KAM_VIAGRA2 3.1 #VIAGRA AD 3 - REMOVED FOR LOW S/O - Thanks to Shane Williams for reporting the FP #body KAM_VIAGRA3 /(?:Xan|Som|CIA|VAL|VIA|Pro|Amb|Lev|Mer)( \w )(?:ax|lis|ra|ium)/i #describe KAM_VIAGRA3 Common Viagra and Medicinal Table Trick #score KAM_VIAGRA3 3.1 #VIAGRA AD 4 body __KAM_VIAGRA4A /V (. )?A (. )?L (. )?[I\/t] (. )?U (. )?M/i body __KAM_VIAGRA4B /V (. )?[I\/t] (. )?A (. )?G (. )?R (. )?A/i body __KAM_VIAGRA4C /M (. )?E (. )?R (. )?[I\/t] (. )?D (. )?[I\/] (. )?A/i # FP FOR "Les Iles du Monde Via Gramsci" OR ITALIAN "WE WISH YOU" # FP for Via Great thanks to Shane Williams body __KAM_VIAGRA_FPS /via gre?a|i augur/i meta KAM_VIAGRA4 ((__KAM_VIAGRA4A + __KAM_VIAGRA4B + __KAM_VIAGRA4C) >= 2) describe KAM_VIAGRA4 Common Viagra and Medicinal Table Trick score KAM_VIAGRA4 3.1 #VIAGRA AD 5 body KAM_VIAGRA5 /(V [1li|\]] [a&] G R A|VljAG+R+A)/i describe KAM_VIAGRA5 Viagra Obfuscation Technique SPAM score KAM_VIAGRA5 3.1 #VIAGRA AD 6 #Switch to [-_\. ]? to avoid FP's reported by Robin Tan #Also added a few more boundary checks thanks to Daniele Duca body __KAM_VIAGRA6A /(^|\b)V[-_\. ]?[IL1][-_\. ]?A.?G.?R.?A($|\b)/i body __KAM_VIAGRA6B /(^|\b)A.?M.?B.?[il1].?E.?N($|\b)/i body __KAM_VIAGRA6C /(^|\b)V.?A.?L.?[il1].?U.?M($|\b)/i body __KAM_VIAGRA6D /(^|\b)C.?[il1].?A.?L.?[Il1].?S($|\b)/i header __KAM_VIAGRA6E From =~ /(Viagra|Cialis)($|\b)/i meta KAM_VIAGRA6 (__KAM_VIAGRA6A + __KAM_VIAGRA6B + __KAM_VIAGRA6C + __KAM_VIAGRA6D + __KAM_VIAGRA6E >= 2) describe KAM_VIAGRA6 Viagra Obfuscation Technique SPAM score KAM_VIAGRA6 3.1 #VIAGRA AD 7 - TWEAKING RULE 7B TO PREVENT HITS ON SPECIALIST body __KAM_VIAGRA7A /(^|\b)V[ij]+AGRA($|\b)/i body __KAM_VIAGRA7B /(^|\b)C[ij]+AL[ij]+S($|\b)/i body __KAM_VIAGRA7C /(^|\b)AMB[ij]+EN($|\b)/i body __KAM_VIAGRA7D /(^|\b)VAL[ij]+UM($|\b)/i meta KAM_VIAGRA7 ((__KAM_VIAGRA7A + __KAM_VIAGRA7B + __KAM_VIAGRA7C + __KAM_VIAGRA7D >= 2) && (KAM_VIAGRA6 < 1)) describe KAM_VIAGRA7 Viagra Obfuscation Technique SPAM score KAM_VIAGRA7 3.1 #VIAGRA AD 8 body __KAM_VIAGRA8A /VI...?AGRA/i body __KAM_VIAGRA8B /AM...?BIEN/i body __KAM_VIAGRA8C /VA...?LIUM/i body __KAM_VIAGRA8D /CI...?ALIS/i meta KAM_VIAGRA8 ((__KAM_VIAGRA8A + __KAM_VIAGRA8B + __KAM_VIAGRA8C + __KAM_VIAGRA8D) >= 2) describe KAM_VIAGRA8 Viagra Obfuscation Technique SPAM score KAM_VIAGRA8 5.1 #VIAGRA AD 9 body __KAM_VIAGRA9A /V[IL1]A..GRA/i body __KAM_VIAGRA9B /AMB..IEN/i body __KAM_VIAGRA9C /VAL..IUM/i body __KAM_VIAGRA9D /C[IL1]A..LIS/i meta KAM_VIAGRA9 ((__KAM_VIAGRA9A + __KAM_VIAGRA9B + __KAM_VIAGRA9C + __KAM_VIAGRA9D) >= 2) describe KAM_VIAGRA9 Viagra Obfuscation Technique SPAM score KAM_VIAGRA9 5.1 #VIAGRA AD 10 - CONTENT-LESS EMAIL FROM "MALE ENHANCEMENT" header __KAM_VIAGRA10A From =~ /male enhancement|mens.renewal/i header __KAM_VIAGRA10B Subject =~ /your intimate partner will (thank|love)|grow.your.manhood|satisfy.your.woman/i meta KAM_VIAGRA10 (__KAM_VIAGRA10A + __KAM_VIAGRA10B >= 1) describe KAM_VIAGRA10 Male enhancement spam with no content score KAM_VIAGRA10 8.0 #NITROXIN - A NEW AND SPAMMY COMPETITOR TO VIAGRA header __KAM_NITROXIN1A From =~ /nitroxin/i meta KAM_NITROXIN1 (__KAM_NITROXIN1A >= 1) describe KAM_NITROXIN1 Another variant of Viagra spam score KAM_NITROXIN1 8.0 #RE[#] SPAM #NOTE: Thanks to Jason Haar" <Jason.Haar@trimble.co.nz> for pointing out that I was only doing >=1! header KAM_RE Subject =~ /^Re(?:\s)*\[\d\]+(?:\s)*:?$/i describe KAM_RE Subject of Re[0]: etc prevalent in Spam score KAM_RE 2.0 meta KAM_RE_PLUS (HTML_IMAGE_ONLY_08+KAM_RE >= 2) describe KAM_RE_PLUS Bad Subject and Image Only rule hit == SPAM! score KAM_RE_PLUS 4.0 #HOODIA #RE-WEIGHTING - Thanks to Martin Kaempf and Gareth Blades for pointing out the False Positives!! #Changed to escape + for 920\+ and changed to rawbody because we don't want to check the subject twice. #thansk to Michael Denney for the FP report header __KAM_HOODIA1 Subject =~ /(hoodia|920\+|serotonin|reduce your appetite)/i rawbody __KAM_HOODIA2 /(?:hoodia|920\+)/i body __KAM_HOODIA3 /(?:fat loss product|sur?p?press appetite|Reduce Your Appetite)/is meta KAM_HOODIA (__KAM_HOODIA1 + __KAM_HOODIA2 + __KAM_HOODIA3 >= 2) describe KAM_HOODIA Hoodia / Weight Loss Product Promotion Spam score KAM_HOODIA 3.0 #STOCK TIPS ##1 through 120 disabld 5-12-2014 due to age ##body __KAM_STOCKTIP1 /(?:Reynaldo's Mexican Food|RYNL)/is ##body __KAM_STOCKTIP2 /(?:KOKO PETROLEUM|KKPT)/is ##body __KAM_STOCKTIP3 /(?:DARK DYNAMITE|DKDY|D K D Y)/is ##body __KAM_STOCKTIP4 /(?:Remington Ventures|RMVN)/is ##body __KAM_STOCKTIP5 /(?:m-Wise|MWIS|M W I S)/is ##body __KAM_STOCKTIP6 /(?:China World Trade Corporation|CWTD)/is ##body __KAM_STOCKTIP7 /(?:Packets International|IPKL)/is ##body __KAM_STOCKTIP8 /(?:Infinex Ventures|IFNX)/is ##body __KAM_STOCKTIP9 /(?:FacePrint Global Solutions|FCPG)/is ###THANKS TO HOMER PARKER FOR THE FALSE POSSITIVE NOTE! ##body __KAM_STOCKTIP10 /(?:Ever[-_ ~]{0,3}Gl[o0]ry|(^|\b)E[-_~\. =]{0,3}G[-_~\. =]{0,3}L[-_~\. =]{0,3}Y($|\b))/is ##body __KAM_STOCKTIP11 /(?:Gulf Petroleum|GFPE)/is ##body __KAM_STOCKTIP12 /(?:Patriot Mechanical Handling|PMHH)/is ##body __KAM_STOCKTIP13 /(?:KSW Industries|KSWJ)/is ##body __KAM_STOCKTIP14 /(?:Conforce International|CFRI)/is ##body __KAM_STOCKTIP15 /(?:Nano Superlattice Technology|NSLT)/is ##body __KAM_STOCKTIP16 /(?:Morgan Beaumont|MBEU)/is ##body __KAM_STOCKTIP17 /(?:Relay Capital|(^|\b)RLYC($|\b))/is ###THANKS TO DAVID GOLDSMITH FOR POINTING OUT THE POTENTIAL FPs FROM THIS RULE ##body __KAM_STOCKTIP18 /(?:Madison Explorations|(?:^|\b)MDEX(?:$|\b))/is ##body __KAM_STOCKTIP19 /(?:CTR Investments and Consulting|C ?I ?V ?X)/is ##body __KAM_STOCKTIP20 /(?:PREMIER INFORMATION|(?:^|\b)PIFR(?:$|\b))/is ##body __KAM_STOCKTIP21 /(?:Harbin Pingchuan|P G C N|PGCN)/is ##body __KAM_STOCKTIP22 /(?:CLIENT TRACK CORP|CTKR)/is ##body __KAM_STOCKTIP23 /(?:EXTREME INNOVATIONS|(^|\b)EXTI($|\b))/is ##body __KAM_STOCKTIP24 /(?:Medical Home Products|\bMHPT\b)/is ##body __KAM_STOCKTIP25 /(?:AmeraMex International|AMMX)/is ##body __KAM_STOCKTIP26 /(?:Equipment & Systems Engineering|EQUIPMENT & SYS ENGR|EQSE)/is ##body __KAM_STOCKTIP27 /(?:NANOFORCE|NNFC)/i ##body __KAM_STOCKTIP28 /(?:\b|^)(?:Resort Clubs (I|\|)nternational|R[ ]*T[ ]*C[ ]*(?:I|\|))(?:\b|$)/is ##body __KAM_STOCKTIP29 /(?:Innovation Holdings|IVHN)/is ##body __KAM_STOCKTIP30 /(?:GOLDEN APPLE OIL|GAPJ)/is ##body __KAM_STOCKTIP31 /(?:inZon Corporation|(^|\b)I ?Z ?O ?N($|\b))/is ##body __KAM_STOCKTIP32 /(?:Midland Baring Financial Group|MDBF)/is ##body __KAM_STOCKTIP33 /(?:Aradyme Corporation|A D Y E)/is ##body __KAM_STOCKTIP34 /(?:TRANSAKT CORP|TKTJF)/is ##body __KAM_STOCKTIP35 /(?:CTXE|CANTEX ENERGY CORP)/is ##body __KAM_STOCKTIP36 /(?:De Greko|DGKO)/is ##body __KAM_STOCKTIP37 /(?:Deep Earth Resource, Inc|CTFE|DPER)/is ##body __KAM_STOCKTIP38 /(?:Vemics|(\b|^)VMCI(\b|$)|Summit Financial Resources)/is ##body __KAM_STOCKTIP39 /Premium Petroleum/is ##body __KAM_STOCKTIP40 /(?:F ?a ?l ?c ?o ?n ?E ?n ?e ?r ?g ?y|F.?C.?Y.?I)/s ##body __KAM_STOCKTIP41 /(?:CHINA GOLD CORP|CGDC)/is ##body __KAM_STOCKTIP42 /DPEK/i ###FIXED FP THANKS TO BEN LENTZ - Also found that the X ?X ?X ?X concept is causing too many FPs thanks to Homer Parker ##body __KAM_STOCKTIP43 /(?:Amerossi International Group|A M S N(\b|$)|AMSN)/is ##body __KAM_STOCKTIP44 /(?:WATAIRE INDUSTRIES|W ?T ?A ?F)/is ##body __KAM_STOCKTIP45 /(?:ABSOLUTESKY|A ?B ?S ?Y)/i ##body __KAM_STOCKTIP46 /(?:Infinex Ventures|I ?N ? ?F ?X)/is ##body __KAM_STOCKTIP47 /(?:Holly ?wood Intermediate|HYWI|H Y W I)/is ###DISABLED DUPLICATE OF 40 ###body __KAM_STOCKTIP48 /(?:Falcon Energy|F ?C ?Y ?I)/is ##body __KAM_STOCKTIP49 /(?:\b|^)(?:AGA Resources|A ?G ?A)(?:\b|$)/is ##body __KAM_STOCKTIP50 /(?:COSCO|CCPI)/i ##body __KAM_STOCKTIP51 /(?:PETRO([- ?])?SUN DRILLING|P[- ]?S[- ]?U[- ]?D)/is ##body __KAM_STOCKTIP52 /(?:KMA Global Solutions International|KMAG)/is ##body __KAM_STOCKTIP53 /(?:Advanced Powerline Technologies|APWL)/is ##body __KAM_STOCKTIP54 /(?:GOLDMARK INDUSTRIES|GDKI)/is ##body __KAM_STOCKTIP55 /(?:QUANTUM ENERGY|QEGY)/is ###FP FIXED THANKS TO Homer Parker ##body __KAM_STOCKTIP56 /(?:AAGA RESOURCE+S NEW|A G A O|(\b|^)AGAO(\b|$))/is ###FP FIXED THANKS TO Homer Parker ##body __KAM_STOCKTIP57 /(?:Bicoastal Communications|BCLC|B C L C)/is ##body __KAM_STOCKTIP58 /(?:Greater China Media \& Ent|G ?C ?M ?E)/is ##body __KAM_STOCKTIP59 /(?:Viva International|(\b|^)VIVI(\b|$))/s ##body __KAM_STOCKTIP60 /(?:WILON RESOURCES|(\b|^)WLON(\b|$))/is ##body __KAM_STOCKTIP61 /(?:Am+erica+n U+ni+ty I+nve+stments|(\b|^)A[ _]?U[ _]?N[ _]?I[ _]?(\b|$))/is ##body __KAM_STOCKTIP62 /(?:DEFENSE DIRECTIVE|(\b|^)DFSE(\b|$))/is ##body __KAM_STOCKTIP63 /(?:Cyberhand Technologies|(\b|^)CYHD(\b|$))/is ##body __KAM_STOCKTIP64 /(?:Texhoma Energy|(\b|^)TXHE(\b|$))/is ##body __KAM_STOCKTIP65 /(?:Equal Trading|(\b|^)EQTD(\b|$))/is ###DISABLED FOR FALSE POSITIVES AND AGE ###body __KAM_STOCKTIP66 /(?:\b|^)W.?B.?R.?S(?:\b|$)/is ##body __KAM_STOCKTIP67 /(?:Mobile Airwaves|(\b|^)M.?W.?B.?C.?(\b|$))/is ##body __KAM_STOCKTIP68 /(?:X-tra Petroleum|(\b|^)XTPT(\b|$))/is ###ADDED FP BOUNDARY CHECK THANKS TO Greg Troxel for reporting the issue ##body __KAM_STOCKTIP69 /(?:Red Reef Laboratories|(\b|^)RREF(\b|$))/is ##body __KAM_STOCKTIP70 /(?:Great American Food Chain|(\b|^)GAMN(\b|$))/is ##body __KAM_STOCKTIP71 /(?:Cana Petroleum|(\b|^)CNPM(\b|$))/is ##body __KAM_STOCKTIP72 /(?:China Health Management|(\b|^)CNHC(\b|$))/is ##body __KAM_STOCKTIP73 /(?:Makeup Limited|MAKU)/is ##body __KAM_STOCKTIP74 /(?:Premier Holdings Group|PMHD)/is ###FP FIXED THANKS TO Christopher X. Candreva ##body __KAM_STOCKTIP75 /(?:VSUS technologies|(\b|^)VSUS($|\b))/is ##body __KAM_STOCKTIP76 /(?:FLAIR PETROLEUM|FPMC)/is ##body __KAM_STOCKTIP77 /(?:Physician Adult Daycare|PHYA)/is ###FP FIXED THANKS TO Homer Parker ##body __KAM_STOCKTIP78 /(?:AlgoDyne Ethanol Energy|(\b|^)ADYN(\b|$))/is ##body __KAM_STOCKTIP79 /(?:Critical Care.{1,3}Inc|CTCX)/is ##body __KAM_STOCKTIP80 /(?:Aerofoam Metals|AFML)/is ##body __KAM_STOCKTIP81 /(?:Ten \& 10|(?:\b|^)TTEN)/is ##body __KAM_STOCKTIP82 /(?:Medical Institutional Services|MISJ(\b|$))/is ##body __KAM_STOCKTIP83 /(?:Harris Exploration|HXPN)/is ##body __KAM_STOCKTIP84 /(?:MARSHAL HOLDINGS|MHII)/is ##body __KAM_STOCKTIP85 /(?:ADVANCED GROWING SYSTEMS|AGWS)/is ##body __KAM_STOCKTIP86 /(?:WEST EXCELSIOR ENT|WEXE)/is ##body __KAM_STOCKTIP87 /(?:Hemisphere Gold|HPGI)/is ##body __KAM_STOCKTIP88 /(?:Victory Energy Corporation|VYEY)/is ##body __KAM_STOCKTIP89 /UTEV/i ##body __KAM_STOCKTIP90 /(?:CHINA BIOLIFE ENTERP|CBFE)/is ##body __KAM_STOCKTIP91 /(?:Critical Care|C ?T ?C ?X)/is ##body __KAM_STOCKTIP92 /CBRJ/i ##body __KAM_STOCKTIP93 /(?:LAS VEGAS CENTRAL RESERVATIONS|LVCC)/is ##body __KAM_STOCKTIP94 /GTAP/i ##body __KAM_STOCKTIP95 /(North American Energy Group|N-?N-?Y-?R)/is ###FP FIXED THANKS TO BRETT GARRETT ##body __KAM_STOCKTIP96 /(\b|^)C\.?C\.?T\.?I(\b|$)/i ##body __KAM_STOCKTIP97 /(C ?E ?O AMERICA|C ? E ? O ?A)/is ##body __KAM_STOCKTIP98 /PLMA/i ##body __KAM_STOCKTIP99 /CDYV/i ##body __KAM_STOCKTIP100 /(Fire (Mountain|Mtn) Beverage Company|(^|\b)F[ _]?B[ _]?V[ _]?G($|\b))/is ###Added boundary check thanks to Michael Denney ##body __KAM_STOCKTIP101 /(\b|^)WDSC(\b|$)/i ##body __KAM_STOCKTIP102 /(Distributed Power|DPWI)/is ##body __KAM_STOCKTIP103 /(HUMET-PBC|L9Z\.F)/is ##body __KAM_STOCKTIP104 /ASVP/is ##body __KAM_STOCKTIP105 /CHVC/is ##body __KAM_STOCKTIP106 /(China Datacom|CDPN)/is ##body __KAM_STOCKTIP107 /(ORAMED PHARMA|OJU\.F)/is ##body __KAM_STOCKTIP108 /(DSDI|DSI Direct Sales)/is ##body __KAM_STOCKTIP109 /(Monolith Athletic Club|M[-_ ]?N[-_ ]?A[-_ ]?B)/is ###DUPLICATED STOCKTIP #51 ###body __KAM_STOCKTIP110 /(PETRO-SUN|P[- ]?S[- ]?U[- ]?D)/is ##body __KAM_STOCKTIP111 /(COMPLIANCE SYSTEMS|(\b|^)COPI(\b|$))/is ###FP Fixed thanks to Greg Troxel ##body __KAM_STOCKTIP112 /(Global Pay Solutions|(\b|^)GPSI(\b|$))/is ##body __KAM_STOCKTIP113 /(MEGOLA|MGOA)/i ###FP FIXED THANKS TO Antonio Falzarano ##body __KAM_STOCKTIP114 /(\b|^)ADOV(\b|$)/i ##body __KAM_STOCKTIP115 /(Oncology Med|(\b|^)ONCO(\b|$))/is ##body __KAM_STOCKTIP116 /(Strategy X|SGXI)/is ##body __KAM_STOCKTIP117 /(Spotlight Homes|COST CONTAINMENT TEC|SPHM)/is ###FALSE POSITIVE ON DANSREALESTATE. ##body __KAM_STOCKTIP118 /((\b|^)SREA(\b|$)|Score One)/is ##body __KAM_STOCKTIP119 /(Monster Motors|MRMT)/is ##body __KAM_STOCKTIP120 /(EntreMetrix|ERMX)/i body __KAM_STOCKTIP121 /(VISION AIRSHIPS|(\b|^)VPSN(\b|$))/is body __KAM_STOCKTIP122 /(Shandong Zhouyuan Seed and Nursery|(\b|^)SZSN(\b|$))/is body __KAM_STOCKTIP123 /(Puerto Rico 7|(\b|^)P ?R ?T ?H(\b|$))/is body __KAM_STOCKTIP124 /((\b|^)VGPM(\b|$)|Vega Promotional Sys)/is body __KAM_STOCKTIP125 /((\b|^)D[- ]?M[- ]?X[- ]?C(\b|$))/i body __KAM_STOCKTIP126 /((\b|^)C\.?W\.?T\.?E(\b|$)|C'Watre International)/is body __KAM_STOCKTIP127 /(Physical Property Holdings|(\b|^)PPYH(\b|$))/is #FP ON MNUM IN PLAIN TEXT HTML CONVERSION - Thanks to Kevin Lewis body __KAM_STOCKTIP128 /(MONUMENTAL MARKETING|(\b|^)MNUM(\b|$))/is body __KAM_STOCKTIP129 /(EnerBrite Technologies Group|(\b|^)eTgU(\b|$))/is body __KAM_STOCKTIP130 /(Pricester|(\b|^)PRCC(\b|$))/is #Added boundary check thanks to Michael Denney body __KAM_STOCKTIP131 /(Greenstone Holdings|(\b|^)GSHN(\b|$))/is body __KAM_STOCKTIP132 /((\b|^)AGMS(\b|$)|Angstrom[- ]Microsystems)/is body __KAM_STOCKTIP133 /(Pluris Energy|(\b|^)PEYG(\b|$))/is body __KAM_STOCKTIP134 /(United Consortium|(\b|^)UCSO(\b|$))/is body __KAM_STOCKTIP135 /(Dominion Minerals|(\b|^)DMNM(\b|$))/is body __KAM_STOCKTIP136 /(PrimeGen Energy|(\b|$)PGNE(\b|^))/is body __KAM_STOCKTIP137 /Dynamic Response Group|(\b|^)DRGZ(\b|$)/is body __KAM_STOCKTIP138 /Cobra Oil (and|&) Gas|(\b|^)CGCA(\b|$)/is body __KAM_STOCKTIP139 /Solanex Management|(\b|^)SLNX(\b|$)/is body __KAM_STOCKTIP140 /BIO\-SOLUTIONS|(\b|^)BISU(\b|$)/is #FP IN French email on 3/2/2017 #body __KAM_STOCKTIP141 /(\b|^)FORC(\b|$)/is body __KAM_STOCKTIP142 /Hawk Systems Inc|(\b|^)HWSYD(\b|$)/is body __KAM_STOCKTIP143 /AmeriLithium/is #|(\b|^)AMEL(\b|$)/is # FP 9/10/15 body __KAM_STOCKTIP144 /Fleet Management Solutions|(\b|^)FLMG(\b|$)/is body __KAM_STOCKTIP145 /Nuvilex|(\b|^)N.?V.?L.?X.?(\b|$)/is body __KAM_STOCKTIP146 /Plandai|(\b|^)PLPL(\b|$)/is #FP on Bozic 3/9/2021 - Thanks to Lars Einarsen body __KAM_STOCKTIP147 /Beamz Interactive|(\b|^)BZIC(\b|$)/is body __KAM_STOCKTIP148 /(\b|^)STBV(\b|$)/i body __KAM_STOCKTIP149 /LifeApps|(\b|^)LFAP(\b|$)/i body __KAM_STOCKTIP150 /MONARCHY RESOURCES/i body __KAM_STOCKTIP151 /Alanco Tech/i body __KAM_STOCKTIP152 /Siga Resources/i body __KAM_STOCKTIP153 /INSCOR|(\b|^)IOGA(\b|$)/is body __KAM_STOCKTIP154 /mLight Tech|(\b|^)MLGT(\b|$)/is body __KAM_STOCKTIP155 /Alanco Technologies/is body __KAM_STOCKTIP156 /Progress Watch|(\b|^)PROW(\b|$)/is #body __KAM_STOCKTIP157 /(\b|^)PRFC(\b|$)/is body __KAM_STOCKTIP158 /(\b|^)(RCHA|R\.+C\.+H\.+A|R\/C\/H\/A)(\b|$)/is body __KAM_STOCKTIP159 /(\b|^)(RNBI|R.N.B.I)(\b|$)/is body __KAM_STOCKTIP160 /(\b|^)(CNRMF|C.N.R.M.F)(\b|$)/is body __KAM_STOCKTIP161 /(\b|^)(NUAN|N[- ]U[- ]A[- ]N)(\b|$)|NUANCE COMMUNICATIONS/is body __KAM_STOCKTIP162 /(\b|^)(CHICF|C.H.I.C.F)(\b|$)/is body __KAM_STOCKTIP163 /(\b|^)(brixmor)(\b|$)/is body __KAM_STOCKTIP164 /(\b|^)(KBLB|K.B.L.B)(\b|$)/is body __KAM_STOCKTIP165 /(\b|^)(SCRF|S.C.R.F)(\b|$)/is body __KAM_STOCKTIP166 /(\b|^)(INCT|Incapta)(\b|$)/is body __KAM_STOCKTIP167 /(\b|^)(QSMS|Quest Science Management Gate)(\b|$)/is body __KAM_STOCKTIP168 /(\b|^)(QSMG|Q.S.M.G|Stemvax)(\b|$)/is body __KAM_STOCKTIP169 /(\b|^)E.?C.?G.?R(\b|$)/s body __KAM_STOCKOTC /(OTC|OTC ?BB|OTC Pink Sheets|NASDAQ|NYSE|StockWatch):/is body __KAM_STOCKSYM /S[ ]?[iy][ ]?m[ ]?[�b8][ ]?[o0][ ]?[l1]|Siymbol/i body __KAM_STOCKSYM2 /(SYM[ ]?[-\:]|\bTicker|Pr+ice\s*\:|Volume\s*\:|Target\s*\:|Current(ly)? ?\??:|Projected:|Smybol:|Stcok\s*\:|Stock\s*\:|S\s*t\s*o\s*c\s*k\s*\:|Trad[ ]?e\:|short\-?sell|book value|S\.umbol|Action:|Symb\s?[-:]|Price Today:|SYmN\-|Lookup:|RADAR:|PK PAPER:|PINKSHEETS:|f[o0]rward ?l[0o]{2}king)/i body __KAM_STOCKSHR /\b(Shares|Investments|invest|Stock|acquisitions?|broker|joint[ -]?venture|underperforming|(uncap|ventilated|public(ity)?) on friday|dividend opportunities|set your buy|financial safe haven|before the bell)\b/i body __KAM_STOCKBULL /bull (run|market)|very.rich|high.return/is body __KAM_STOCKSCTR /(energy sector|mineral rights|mineral wealth|natural resources|gold deposits)/is header __KAM_STOCKHEAD Subject =~ /{stk\-sub}|on your radar|st0ck|best.stocktip|huge.winner|breaking.news/i body __KAM_STOCKJUMP /(up|jumps) \d\d(\.\d)?\%/i body __KAM_INSTOCK /in stock/i # ADDED A CAVEAT FOR in stock so gibberish links don't hit a stock symbol meta KAM_STOCKTIP (__KAM_STOCKHEAD + __KAM_STOCKOTC + __KAM_STOCKSYM + __KAM_STOCKJUMP + __KAM_STOCKSHR + __KAM_STOCKSYM2 + __KAM_STOCKBULL + __KAM_STOCKSCTR >= 1) && (__KAM_INSTOCK < 1) && (__KAM_STOCKTIP121 + __KAM_STOCKTIP122 + __KAM_STOCKTIP123 + __KAM_STOCKTIP124 + __KAM_STOCKTIP125 + __KAM_STOCKTIP126 + __KAM_STOCKTIP127 + __KAM_STOCKTIP128 + __KAM_STOCKTIP129 + __KAM_STOCKTIP130 + __KAM_STOCKTIP131 + __KAM_STOCKTIP132 + __KAM_STOCKTIP133 + __KAM_STOCKTIP134 + __KAM_STOCKTIP135 + __KAM_STOCKTIP136 + __KAM_STOCKTIP137 + __KAM_STOCKTIP138 + __KAM_STOCKTIP139 + __KAM_STOCKTIP140 + __KAM_STOCKTIP142 + __KAM_STOCKTIP143 + __KAM_STOCKTIP144 + __KAM_STOCKTIP145 + __KAM_STOCKTIP146 + __KAM_STOCKTIP147 + __KAM_STOCKTIP148 + __KAM_STOCKTIP149 + __KAM_STOCKTIP150 + __KAM_STOCKTIP151 + __KAM_STOCKTIP152 + __KAM_STOCKTIP153 + __KAM_STOCKTIP154 + __KAM_STOCKTIP155 + __KAM_STOCKTIP156 + __KAM_STOCKTIP158 + __KAM_STOCKTIP159 + __KAM_STOCKTIP160 + __KAM_STOCKTIP161 + __KAM_STOCKTIP162 + __KAM_STOCKTIP163 + __KAM_STOCKTIP164 + __KAM_STOCKTIP165 + __KAM_STOCKTIP166 + __KAM_STOCKTIP167 + __KAM_STOCKTIP168 + __KAM_STOCKTIP169 >= 1) describe KAM_STOCKTIP Email Contains Pump & Dump Stock Tip score KAM_STOCKTIP 7.1 #KAM STOCK RULE #3 BASED HEAVILY ON WONDERFUL INPUT BY GARETH OF LINGUAPHONE body __KAM_STOCK3 /([sS].?ymbol|Sym|SYM|SYMB|Symb|SYMBOL|SYmN|SYMN|Symn|Ticker|TICKER|Lookup|PINKSHEETS)\s*[-_:]\s*[A-Z0-9][-\._ ]?[A-Z0-9][-\._ ]?[A-Z0-9][-\._ ]?[A-Z0-9]/ score __KAM_STOCK3 0.1 describe __KAM_STOCK3 Email Looks like it references a 4 character stock symbol #GENERIC STOCK RULE meta KAM_STOCKGEN (__KAM_STOCKHEAD + __KAM_STOCKOTC + __KAM_STOCKSYM + __KAM_STOCKSHR + __KAM_STOCKSYM2 + __KAM_STOCKBULL + __KAM_STOCKSCTR >= 1) && (__KAM_STOCK3 >= 1) && (KAM_STOCKTIP < 1) describe KAM_STOCKGEN Email Contains Generic Pump & Dump Stock Tip score KAM_STOCKGEN 1.5 #KAM STOCK RULE #2 body __KAM_STOCK2_1 /(good trader|trading experience|bad trading day|hard trading day|FREE Stock Market Outlook|Market Watch)|more.than.\d+%|most.valuable|morning.report|real.?estate.authority|commercial.real.estate/i body __KAM_STOCK2_2 /(easy cash|losses and victories|backstage trading|market facts|succeed in trading|destined to skyrocket|make traders rich|times your principal)|good.investment|overvalued.companies|company.is.soaring|economic.opportunity|amazing.company|take.notice|rental.yield|high.return/i body __KAM_STOCK2_3 /stock/i body __KAM_STOCK2_4 /trader|investor|analyst|royalties/i header __KAM_STOCK2_5 Subject =~ /stock|bull market|penny|traders|go.getter|thousand.percent|this.company|opportunity|pct.rally|private.investment/i header __KAM_STOCK2_6 From =~ /investment|daily.tip|bloomberg|selectedotc|penny|fortune|stock|finance|real.?estate|promotion/i meta KAM_STOCK2 (__KAM_STOCK2_1 + __KAM_STOCK2_2 + __KAM_STOCK2_3 + __KAM_STOCK2_4 + __KAM_STOCK2_5 + __KAM_STOCK2_6) >= 4 score KAM_STOCK2 2.5 describe KAM_STOCK2 Another Round of Pump & Dump Stock Scams #JUDGEMENTS body __KAM_JUDGE1 /(unpaid court|(un-?collected|unsatisfied) judgments)/is body __KAM_JUDGE2 /(funds|receive what) you are (due|owed)/is #HALF-WEIGHTED RULES body __KAM_JUDGE3 /collect your money/is body __KAM_JUDGE4 /judgment/i #FULL-WEIGHT header __KAM_JUDGE5 Subject =~ /judgment/i meta KAM_JUDGE (__KAM_JUDGE1 + __KAM_JUDGE2 + ((__KAM_JUDGE3 + __KAM_JUDGE4) / 2) + __KAM_JUDGE5 >= 2) describe KAM_JUDGE Email Contains Judicial Judgment Solicitation score KAM_JUDGE 2.5 #MEDS body __KAM_MED1 /e.?c.?o.?n.?o.?m.?i.?z.?e.{1,10}med/i body __KAM_MED2 /\d\d ?%/ describe KAM_MED Economizing your meds spam meta KAM_MED (__KAM_MED1 + __KAM_MED2 >= 2) score KAM_MED 1.5 #MEDS2- THANKS TO RES FOR POINTING OUT A REGEX STUPIDITY header __KAM_MED2_1 Subject =~ /Pharmacy order \#\d{5}/i describe KAM_MED2 More Medical SPAM meta KAM_MED2 (__KAM_MED2_1 >= 1) score KAM_MED2 1.0 #TIME PIECE header __KAM_TIME1 Subject =~ /(replica(\b|$)|designer[-_ ](watch|piece|collection)|(old|replica|style|luxury|trendy|elegant) watch|time[-_ ](keeper|piece)|wrist|chronometer|watches are in fashion|low budget|deliver your watch|(number|amount) of watches)|excellent.watch/i #0.50 WEIGHTED TESTS body __KAM_TIME2 /(replica(\b|$)|diamond|designer[-_ ](piece|collections|watch)|time[-_ ]piece|wrist|time\-keeper|\/\/atch)/is header __KAM_TIME3 Subject =~ /(\b|^)(time|watch)(\b|$)/i body __KAM_TIME4 /(\b|^)(time|watch)(\b|$)/i body __KAM_TIME5 /(funny|low) price|treat.yourself/i #REMOVED WORD OMEGA FROM BRANDS. TOO MANY FPs. body __KAM_TIME6 /(Cx?ARTIER|Bx?REITLING|Px?ATEK|Rx?OLEX|Bx?VLGARI|Tx?IFFANY)/i meta KAM_TIME __KAM_TIME1 + ((__KAM_TIME2 + __KAM_TIME3 + __KAM_TIME4 + __KAM_TIME5 + __KAM_TIME6)/2) >= 2 describe KAM_TIME Pssss. Hey Buddy, wanna buy a watch? score KAM_TIME 3.0 meta KAM_TIMEGEO (KAM_GEO_STRING2 && KAM_TIME) describe KAM_TIMEGEO Email references geocities & wrist watch sales score KAM_TIMEGEO 3.5 #YOUR HOME body __KAM_HOME1 /YOUR HOME|Federal Housing Assistance Program|near.your.area/i body __KAM_HOME2 /Build your equity faster|refund is not reversible|rent.to.own/i body __KAM_HOME3 /tax saving plans|\d+K Mortgage Credit|no.more.of/i header __KAM_HOME4 From =~ /rent.?and.?own|rent.own.list/i header __KAM_HOME5 Subject =~ /homes.near.you|near.your.city|\d+ (bed|bath)|low.monthly/i meta KAM_HOME (__KAM_HOME1 + __KAM_HOME2 + __KAM_HOME3 + __KAM_HOME4 + __KAM_HOME5 >= 3) describe KAM_HOME Mortage & Refinance Spam Rule score KAM_HOME 3.5 #UNIVERSITY RULE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_rules __KAM_UNIV11 __KAM_UNIV15 __KAM_UNIV3B body __KAM_UNIV1 /(University Administration|University Enrollment|Education Assessment|Faculty Assessment|University Degree|Administration Office|Education office|Schools office|Enrollment Office|Online University)/is endif body __KAM_UNIV2 /\d (week|month).{0,30}degree/is body __KAM_UNIV3 /(past work|based on your|earned from|life|life and work|present work) experience/is body __KAM_UNIV4 /not official degree|non[ -]?accredited/is body __KAM_UNIV5 /novelty (degree|use)/is body __KAM_UNIV6 /verifiable University Degree/is body __KAM_UNIV7 /(life|work) experience (diploma|degree|transcript)/is body __KAM_UNIV8 /Career Path/is body __KAM_UNIV9 /non[- ]?ac(creditee?d)?.{1,10}universit/is body __KAM_UNIV10 /(graduating|diploma) (within|in) (as little as)? (one|two|three|\d) (week|month)/is body __KAM_UNIV11 /(degree|transcript) in any field|Field of yourr? ch<O1>/is body __KAM_UNIV12 /(obtain your diploma|diploma that you want|Criminal Justice or Homeland Security degree)/is body __KAM_UNIV13 /(degree|field|diploma) of your (choice|expertise)/is body __KAM_UNIV14 /(earn a|full) transcript/is body __KAM_UNIV15 /(No Study Required|Without Exams|No ex<A1>ms|without attending a single class|no classes|no textbooks|no (?:required )?tests|degree .{0,30}you deserve)/is body __KAM_UNIV16 /\d weeks.{0,30}graduated/is header __KAM_UNIV17 Subject =~ /(dip(i|l)oma|degree|transcript|increase ?your ?income|degree online|Ph\.?D|Add an mba)/i body __KAM_UNIV18 /100% discrete/is body __KAM_UNIV1B /\d (months|weeks)/i body __KAM_UNIV2B /d[_\. ]?e[_\. ]?g[_\. ]?r[_\. ]?e[_\. ]?e/i body __KAM_UNIV3B /(dead end job|improve your future, and your income|high paying jobs|bec<O1>me a do<C1>|get your diploma today)/is body __KAM_UNIV4B /1.?0.?0.?% (legit|verifiable|online|no pre|non[- ]?accredited)/is body __KAM_UNIV5B /F A S T[ ]{0,4}T R A C K/is body __KAM_UNIV6B /DIP\sLOMA/ meta KAM_UNIV ((__KAM_UNIV1 + __KAM_UNIV2 + __KAM_UNIV3 + __KAM_UNIV4 + __KAM_UNIV5 + __KAM_UNIV6 + __KAM_UNIV7 + __KAM_UNIV8 + __KAM_UNIV9 + __KAM_UNIV10 + __KAM_UNIV11 + __KAM_UNIV12 + __KAM_UNIV13 + __KAM_UNIV14 + __KAM_UNIV15 + __KAM_UNIV16 + __KAM_UNIV17 + __KAM_UNIV18) >= 2 || (__KAM_UNIV1B + __KAM_UNIV2B + __KAM_UNIV3B + __KAM_UNIV4B + __KAM_UNIV5B + __KAM_UNIV6B) >= 3) describe KAM_UNIV Diploma Mill Rule score KAM_UNIV 4.5 #URUNIT body __KAM_URUNIT1 /\bur (unit|liveliness|energy level|endurance level)/is body __KAM_URUNIT2 /\bur (gf|girl|wife|size|thing|partner|significant other)/is body __KAM_URUNIT3A /\b(exasperated|fatigued|drained|tired) all the time/is #HALF-WEIGHTED RULES body __KAM_URUNIT3 /(unsatisfied|not satisfied|nagging|complaining|complaints|complained|unlimited prowess|increase your volume)/is body __KAM_URUNIT4 /(bedroom|the bed|nighttime activit|male power|show your girl)/is body __KAM_URUNIT5 /(size of (there|their|your) .{0,11}(unit|thing)|using them for a couple months|enhancing formula)/is body __KAM_URUNIT6 /(majority of women|shrinking .{0,12} baby fat|winning guy|huge explosion)/is #FULL-WEIGHT header __KAM_URUNIT7 Subject =~ /(\b|^)ur (unit|wife|girlfriend|GF|size|thing|partner|significant other|livelyehood)/i header __KAM_URUNIT8 Subject =~ /(pleasure|sensation|grow|your teeny|impress your mate|being small|how big|more intense)/i meta KAM_URUNIT ((__KAM_URUNIT1 + __KAM_URUNIT2 + ((__KAM_URUNIT3 + __KAM_URUNIT4 + __KAM_URUNIT5 + __KAM_URUNIT6) / 2) + __KAM_URUNIT7 + __KAM_URUNIT8 + __KAM_URUNIT3A) >= 2) describe KAM_URUNIT Recent penile and body enhancement spams score KAM_URUNIT 0.5 #UR ZEST body __KAM_URZEST1 /(?:your|ur) (?:power|strength|zal|zeal|liveliness|zest|intensity|spontaneity|activity)(?: level)?(?: been)?(?: feeling| down)? ?(?:lately|recently|anew)?/i body __KAM_URZEST2 /or still (?:jaded|worn|drained|exasperated) all the time/i body __KAM_URZEST3 /(?:(?:wanting|looking|seeking) to get in the gym|(?:dreaming|seeking|hoping) to get (?:into shape|fit))/i body __KAM_URZEST4 /(wks it has been|been mos) since we('| ha)ve chatted/i body __KAM_URZEST5 /(back into shape|made me healthier after my disease)/i meta KAM_URZEST (__KAM_URZEST1 + __KAM_URZEST2 + __KAM_URZEST3 + __KAM_URZEST4 + __KAM_URZEST5 >= 2) describe KAM_URZEST Recent penile and body enhancement spams score KAM_URZEST 3.0 #JOB LET GO body __KAM_JOB1 /let go from (a job|my employment) I held for.{1,19} (month|year|forever|life)/is body __KAM_JOB2 /twice as much/is meta KAM_JOB (__KAM_JOB1 + __KAM_JOB2 >=2) describe KAM_JOB People let go, work at home, earn billions! score KAM_JOB 4.3 #PERIMETERPARK body KAM_PERPARK /P e r i m e t e r P a r k C e n t e r/i describe KAM_PERPARK Obfuscated address appearing in SPAM Feb 06 score KAM_PERPARK 2.5 #HOLLYWOOD WAY body KAM_HOLLY /1 0 2 0 N H o l l y w o o d W a y /i describe KAM_HOLLY Obfuscated address appearing in SPAM Jun 06 score KAM_HOLLY 2.5 #PUMP & DUMP STOCK GRAPHICS header __KAM_STOCKG1 Subject =~ /^Fw: \d{6}$/i header __KAM_STOCKG2 Subject =~ /(^|\b)(stocks?|small-cap)(\b|$)/i meta KAM_STOCKG ((HTML_IMAGE_ONLY_12 || HTML_IMAGE_ONLY_16 || HTML_IMAGE_ONLY_24) && HTML_MESSAGE && (__KAM_STOCKG1 || __KAM_STOCKG2)) describe KAM_STOCKG Graphical Pump and Dump Scams score KAM_STOCKG 3.0 #CEP Diploma Mill body __KAM_CEP1 /Job Prospect Newsletter|training.workshop/i body __KAM_CEP2 /legitimate verifiable degree|build a better you|domain.knowledge/i body __KAM_CEP3 /Career Education program|customize a learning program|certified.instructor/i body __KAM_CEP4 /(MBA|CEP)/ body __KAM_CEP5 /degree\/certificates|certification/i body __KAM_CEP6 /\d (week|month)/i header __KAM_CEP7 From =~ /certificate program/i meta KAM_CEP (((__KAM_CEP1 + __KAM_CEP2 + __KAM_CEP3 + __KAM_CEP4 + __KAM_CEP5 + __KAM_CEP6 + __KAM_CEP7) >= 3) && ! __PDF_ATTACH && __KAM_BODY_LENGTH_LT_1024) describe KAM_CEP CEP Diploma Mill Rule score KAM_CEP 3.5 #Commented since 3.2.0 is pretty old now #if (version < 3.200000) # #BLANK EMAILS - CURRENTLY REQUIRES 99_FVGT_meta.cf for FM_NO_FROM AND NO_TO. UNDISC_RECIPS MIGHT BE REMOVED IN 3.2+ # #HTML_SHORT_LENGTH DEPENDENCY RULE REMOVED FROM SA 3.2 # meta KAM_BLANK01 (MISSING_SUBJECT && (UNDISC_RECIPS || FM_NO_FROM_OR_TO || FM_NO_TO)) # describe KAM_BLANK01 Blank emails # score KAM_BLANK01 1.0 # # #MSGID_FROM_MTA_ID REMOVED IN NEWER SPAMASSASSIN 3.2 # meta KAM_BLANK02 (KAM_BLANK01 && MSGID_FROM_MTA_ID) # describe KAM_BLANK02 Blank emails with MTA Headers # score KAM_BLANK02 1.0 #endif #KAM GEOCITIES SPAM # Updated by KAM based on Work by Dallas L. Engelken <dallase@nmgi.com> (T_GEO_QUERY_STRING) uri KAM_GEO_STRING2 /^http:\/\/(?:\w{1,5}\.)?geocities(?:\.yahoo)?\.com(?:\.\w{1,5})?(?::\d*)?\/.+?/i describe KAM_GEO_STRING2 Use of geocities/yahoo very likely spam as of Dec 2005 score KAM_GEO_STRING2 4.7 #KAM MSN SPAM uri __KAM_MSN_STRING1 /^http:\/\/spaces\.msn\.com(?::\d*)?\/.+\//i uri __KAM_MSN_STRING2 /^http:\/\/.{0,20}\.spaces\.live\.com/i meta KAM_MSN_STRING (__KAM_MSN_STRING1 + __KAM_MSN_STRING2 >=1) describe KAM_MSN_STRING spaces.msn.com likely spam (Mar 2006) + spaces.live.com (Mar 2010) score KAM_MSN_STRING 2.5 #KAM LIVEJOURNAL SPAM uri __KAM_LIVE1 /^http:\/\/.{0,20}\.(blogspot|livejournal)\.com/i meta KAM_LIVE (__KAM_LIVE1) describe KAM_LIVE blogspot.com & livejournal.com likely spam (Apr 2010) score KAM_LIVE 1.0 #KAM PAGE.TL SPAM - idea from Benny Pedersen uri __KAM_PAGE1 /^http:\/\/.{0,20}\.(page\.tl)/i meta KAM_PAGE (__KAM_PAGE1) describe KAM_PAGE Page.TL likely spam (Nov 2011) score KAM_PAGE 2.0 if (version >= 4.000000) if can(Mail::SpamAssassin::Conf::feature_capture_rules) header __GB_TO_ADDR To:addr =~ /(?<GB_TO_ADDR>.*)/ # Links to malware stored on Google storage uri GB_STORAGE_GOOGLE_EMAIL m|^https?://storage\.cloud\.google\.com/.{4,128}\#%{GB_TO_ADDR}|i describe GB_STORAGE_GOOGLE_EMAIL Google storage cloud abuse score GB_STORAGE_GOOGLE_EMAIL 2.000 uri GB_STORAGE_CUBBIT m|^https?://\w+\.s3\.cubbit\.eu/.{4,128}\#%{GB_TO_ADDR}|i describe GB_STORAGE_CUBBIT Cubbit storage cloud abuse score GB_STORAGE_CUBBIT 2.000 uri GB_YOUTUBE_EMAIL m|^https?://(?:www\.)?youtube\.com/attribution_link\?.{20,256}/%{GB_TO_ADDR}|i describe GB_YOUTUBE_EMAIL Youtube attribution links abuse score GB_YOUTUBE_EMAIL 2.000 # Links to malware uri __GB_CUSTOM_HTM_URI0 m;^https?://.{10,128}(?:\.html?|\.php|\/)?(?:\??\#|\?&e=)%{GB_TO_ADDR};i uri __GB_CUSTOM_HTM_URI1 m|^https?://.{10,64}\=https?://.{4,64}\#%{GB_TO_ADDR}|i uri __GB_CUSTOM_HTM_URI2 m;^https?://.{10,256}(?:\/\?)?(?:(?<!blocker)email=|audit\#|wapp\#|qrc=)%{GB_TO_ADDR};i uri __GB_CUSTOM_LOGIN_URI m;^https?://login\..{4,64}/\#%{GB_TO_ADDR};i uri __GB_ASWTRACK_URI m;^https?://.{10,20}\.awstrack\.me/L\d+/\=https?://.{4,64}\#%{GB_TO_ADDR};i uri __GB_DRUPAL_URI m|^https?://.{10,64}/default/files/(?:\@)?\#%{GB_TO_ADDR}|i meta GB_CUSTOM_HTM_URI ( __GB_CUSTOM_HTM_URI0 || __GB_CUSTOM_HTM_URI1 || __GB_CUSTOM_HTM_URI2 || __GB_CUSTOM_LOGIN_URI || __GB_DRUPAL_URI || __GB_ASWTRACK_URI ) describe GB_CUSTOM_HTM_URI Custom html uri score GB_CUSTOM_HTM_URI 1.500 uri __GB_ROUNDCUBE /\/roundcube/i meta GB_ROUNDCUBE_HTM ( GB_CUSTOM_HTM_URI && __GB_ROUNDCUBE ) describe GB_ROUNDCUBE_HTM Roundcube .html uri score GB_ROUNDCUBE_HTM 1.0 endif endif # This rule is to mark emails using the exploit of the URI parsing uri KAM_URIPARSE /(\%0[01]|\0).{1,100}\@/i describe KAM_URIPARSE Attempted use of URI bug-high probability of fraud score KAM_URIPARSE 7.0 #Ebay Closed their Redirector - Disabled 4-9-05 # This rule is to mark emails using the exploit of the eBay redirector #uri KAM_EBAYREDIR /.*.ebay.com.*RedirectToDomain/i #describe KAM_EBAYREDIR Attempted use of eBay redirect-likely fraud #score KAM_EBAYREDIR 7.0 # Rule based on Kelson Vibber's MD code for bogus AOL Addresses # Check for bogus AOL addresses as described at # http://postmaster.aol.com/faq/mailerfaq.html#syntax # - all alphanumeric, starting with a letter, from 3 to 16 characters long. # # #What is the correct syntax for AOL e-mail addresses? #The "user name" is the part of the address that appears before the @ symbol: username@aol.com. #Valid AOL e-mail addresses can not: #Be shorter than 3 or longer than 16 characters. #Begin with numbers. #Contain punctuation of any kind (such as periods, underscores, or dashes). # # #2017-10-24 upon evidence that AOL no longer follows their syntax. #Awaiting an updated version however KAM predicts that with the merger that this #is likely to accommodate other systems like Verizon coming under the same infrastructure. #UPDATED 2018-02-20 #THANKS to Angel from 16bits for this research: #Based on tests at https://i.aol.com/reg/signup shows: # #Username cannot # #a) "Be shorter than 3" # This is being enforced: «Please make sure that the username field is at #least 3 characters long # #b) or longer than 16 characters. #The userName field has a maxlength of 32 #(intriguingly, there's also a hidden usernameEmail of up to 97 #characters) # #c) Begin with numbers. #This is being enforced «Your username must begin with a letter.» # #d) Contain punctuation of any kind (such as periods, underscores, or #dashes). #Both periods and underscores are accepted (they are even offered in the #dropbox), dashes are not. #«Your username may not contain characters such as @, !, * or $.» # #Periods and underscores may not begin or end the username, or be #consecutive (not between themselves), ie. these two characters may only #appear when surrounded by alphanumeric ones. # #(this condition for periods actually comes from rfc5321, assuming you #want to avoid quoting the local part) # # #Basically, it seems they added . and _ to the allowed characters, and #doubled the username size. # # #The error messages at #https://sns-static.aolcdn.com/1.19/reg/resources/js/webreg_validate5-built.js also provide relevant information for gathering the rules: # #"Please make sure that the username field is at least 3 characters #long." #long." #"Your username may not exceed "+regPageData.snMax+" characters." #"Your username must begin with a letter." #"Your username may not contain characters such as @, !, * or $.", #"Your username may not contain characters such as @, !, * or $." (funnily, this is shown if you enter a space) #"Your username may not contain characters such as @, !, * or $." (this is if it is deemed "not alphanumeric") #"Usernames cannot end with a dot (.) or underscore (_)." #"Usernames cannot have consecutive dots (..) or underscores (__)." # #"Please make sure that the email address is at least 3 characters long." #"Your email address may not exceed 97 characters." #Missed updating the length to 32. Fixed thanks to Ramon Medina header __KAM_AOL From:addr =~ /\@aol\.(com|co\.uk)/i # username portion must be between 3 & 32 chars, starting with a letter header __KAM_GOODAOL1 From:addr =~ /^[a-z].{2,32}\@aol\.(com|co\.uk)/i # certain punctuation not allowed - This is likely not exhaustive header __KAM_BADAOL1 From:addr =~ /[-\!\*\$].*\@aol\.(com|co\.uk)/ # no consectutive periods or underscores header __KAM_BADAOL2 From:addr =~ /(\.\.|__).*\@aol\.(com|co\.uk)/ # cannot end with . or underscore header __KAM_BADAOL3 From:addr =~ /(\.|_)\@aol\.(com|co\.uk)/i meta KAM_BADAOL (__KAM_AOL && !__KAM_GOODAOL1) || (__KAM_BADAOL1 + __KAM_BADAOL2 + __KAM_BADAOL3 >= 1) describe KAM_BADAOL Invalid AOL Address score KAM_BADAOL 7.0 meta KAM_GOODAOL __KAM_AOL && (__KAM_GOODAOL1 && !KAM_BADAOL) && SPF_PASS describe KAM_GOODAOL Valid AOL Email Address score KAM_GOODAOL -1.0 # Rule to mark emails from adv@somewhere accounts a bit higher on the SPAM scale header KAM_ADV_EMAIL From:addr =~ /adv\@/i describe KAM_ADV_EMAIL Marks adv@<domain.com> Addresses as likely SPAM score KAM_ADV_EMAIL 5.0 #SEXUALLY EXPLICIT EMAILS - With updates courtesy of Mark Damrose header __KAM_SEX_EXPLICIT1 Subject =~ /SEXUAL{2,3}Y[-_, ]{0,1}EXPL{1,2}I{1,2}CI{1,2}T/i #EXPANDED TO INCLUDE HEADERS FOR SPAMS PREVALENT MAR 2007 header __KAM_SEX_EXPLICIT2 Subject =~ /(?:fuck .*suck|suck .*fuck|pussy .*cock|cock .*pussy|horny amateur|couch sex|slut fuck|naked celebrity|pissing babes|ass[- ]fuck|animal cock|(^|\b)P[^a-zA-Z\d]O[^a-zA-Z\d]R[^a-zA-Z\d]N |exposes sexy ass|drunk babe nude|masturbate|looking.for.sex|breast.implants|pedophile|child predator|explore.being.bad|double.penetration|hardcore.slut|getting.laid|your.disco.stick|having.sex.*begging|f.ckbook|xxx gay|asian porn|blow ?job|anal xxx|huge tits tube|xxx tube|porn tube|porn video|sexy.clip|portal for xxx|3d porn|hard(er)?.erect)|dreaming of f.?cking|(^|\b)sex.in.the.car|horny.virgin|sex.acts|best.intercourse|sex request|dripping wet and need to get|S*?exy granny|shagmate|her squirt|elongation secret|small member|g\-spot|XXX life|cart.?bloom.?jigsaw|clogged.?colon|Peppy.?Pet.?ball|derma.?correct|secret to squirting|monstrous cock|adult film star extension secret|inches to your manhood|lack of sex|harrys.?affiliate|numerologist|your prostate|stiffening tonic|need sex partner|manhood bigger|TPE sex.?doll|sex position|Penis Growth|partners who can't get it up|Penis Ritual|eating puss\*y|lemon\-sized prostate|touches your anus|shrink your prostrate|testicles removed|penis chopped/i #TRYING TO GET RID OF FPs WITH LAST NAMES header __KAM_SEX_EXPLICIT3 From =~ /(?:better sex|sextrick|ashleymadison|booty.call|breast.(aug|surg|redu)|throbing.member|f[\*u]?ckbook|Local MILFs|fuck(s|ing)?(\b|^)|Dating Granny|school.?of.?squirt)|hookup.?alert|bedroom.?partner|hookup.?online|lovely.?asian|squirting.?school|sex.?portal|sex.?club|liberator.?x2|instahard|eat me with your dick|(live|naughty).?.?sex|Erectile.?Dysfunction|penis.?(growth|enlargement)|Virility Amplifier|harderandlonger|dead penis|Ejaculation|dead penis|lifeless.{0,4}manhood/i #MODIFIED TO FIX FP THANKS TO DOC SCHNEIDER AND MARK MARTINEC - REMOVED castrate|sexual.encounter|casual.sex|discreet.encounter 5/19/15 body __KAM_SEX_EXPLICIT4 /(?:fucked hardcore|dildoes her tight ass|kinky watersports|schoolgirls? slut|teens? porn|first anal(\b|$)|pussy lips|kinky lesbian|sucks? cock|rub puss|spreads? cunt|fetish babe|kinky pee|muffdived \& fuck|deepthroat on knees|hello.naughty.boy|certain.type.of.guy|girlfriend.trick|sexual.stamina|sex...toy|porn.link|cunt.fuck|c\-o\-c\-k|non.stop.sex|porn.industry|stronger.erection|make.her.moan|extreme.pro.abortion|erection.problem|your.erection|get.an.erection|hardest.erection|get.erect|xxx gay|asian porn|blow ?job (comm?unity|porn)|anal xxx|huge tits tube|xxx tube|porn tube|fuckbook|portal for xxx|3d porn|DrPEnterprise|girlfriends.porn|\bsex.galler|pussy.eaten|shemale|(\b|^)anal.adventure|black.girls.video|gay.porn|pussy.wet|make.her.horny|crave sex|women.fuck|women.horny|wanting.to.bang|getting.laid.is.simple|woman.on.her.knees|b r e a s t|generic.ed.product|best.sex|f[^a-z]cking.you|f[^a-z]ckbuddy|F\#ckFriends|Milf Selfies|need.a.horny.man|cute.sex.lover|horny.as.f.ck|fun.in.the.bedroom|my.tits.are|be.horny|horny.girl|horny.i.am|horny.latina|huge.dildo|made.me.climax|sex in my office|a.good.f\@ck|married.horny.woman|sucked.your.d\@ck|(naughty|horny).milf|suck.you.off|horny.stories|all.my.h[o0]les|cum.heavily|sucking.your.c[o0]ck|to.get.f[^a-z]cked)|h00kup|s\*xy|\bh0rny|ch0ked|pu\$\$y|f\*cked|F\*ck_|find milfs|girls (from|in) your city|rock.?hard boner|reclaiming your manhood|sexy and horny|bad girls from your city|awesome in bed|turbo\-charge your bed|shocking erection|stiffening tonic|anal fun|fingering videos|willing to pay for sex|c\*ck size|penis pump/i #remove f\#ck for FPs tflags __KAM_SEX_EXPLICIT4 nosubject header __KAM_SEX_EXPLICIT5 Subject =~ /(?:Babe.*dildo|milk.*pussy|licks.*lesbian.*tits|mud.*wrestling.*sluts|rock.*hard.*cock|working.*pussy|(anal|suck|lick|hot|cock|wife).*f.?u.?c.?k|sneaky.*upskirt.*shots|hairy.*(pussy|cunt)|chicks.*cum|shows.*off.*titties|tits.*milf.*sex|riding.*big.*dick|dildo.*pussy|slut.*sex|suck.*dick|show.*off.*pink.*slit|coed.*pussy|squirt.*pussy|polish.*cock|femdom.*fist|schoolgirl.*(f.?u.?c.?k|blowjob)|mistress.*finger.*slave|cervix.*examined|tits.*vibrator|licks.*lesbian|slut.*anal|slurp.*pecker|master.*hogtie|bitch.*stroke.*guy|huge.*cock.*bang|take.*dick.*ride|milf.*nailed|girl.*in.*panties|Slut.*Doing.*it|barely.*legal.*teen|perverted.*girl.*works.*ass|slut.*milking|caught.*fucking|F.?u.?c.?k.*(dick)|shemale.*strips|chick.*drilled|\bass.*screw|teen.*pussy|fucked.*hard|bimbo.*hooter|cuntbanged|tittyfucked|fuck.*cock|blowing and nailed|lesbians.*masturbat|shaking wet booty|pussy.*lip|lick.*asshole|kinky lesbian|suck.*cock|rub puss|tits.*cunt|kinky pee|fetish babe|exposes sexy ass|drunk babe nude|muff.*fuck|cock.?suck.*blonde|fuck.*vibrator|threeway.*orgy|sex.life.*new.level|your.sex.life|hotsex|f.cktonight|my.?pu[s\$]{1,5}y|InstaSext|SnapHookup|InstaAffair|InstaHookup|SexiSnap|SnapF.ck|snapbangmsg)/i body __KAM_SEX_EXPLICIT6 /virus on a porn web/i meta KAM_SEX_EXPLICIT (__KAM_SEX_EXPLICIT1 + __KAM_SEX_EXPLICIT2 + __KAM_SEX_EXPLICIT3 + __KAM_SEX_EXPLICIT4 + __KAM_SEX_EXPLICIT5 + __KAM_SEX_EXPLICIT6 >= 1) describe KAM_SEX_EXPLICIT Subject or body indicates Sexually Explicit material score KAM_SEX_EXPLICIT 16.0 #SOLICITING AFFAIR SPAM header __KAM_SEX_AFFAIR1 Subject =~ /Have an affair|Your Affair is Waiting|sick of your wife|find you a girlfriend/i header __KAM_SEX_AFFAIR2 From =~ /Ashley.?Madison|Let's have fun/i rawbody __KAM_SEX_AFFAIR3 /have an affair|ashleymadison/i rawbody __KAM_SEX_AFFAIR4 /looking.for.affair/i meta KAM_SEX_AFFAIR (__KAM_SEX_AFFAIR1 + __KAM_SEX_AFFAIR2 + __KAM_SEX_AFFAIR3 + __KAM_SEX_AFFAIR4 >= 2) describe KAM_SEX_AFFAIR Subject or body soliciting an affair score KAM_SEX_AFFAIR 8.0 ifplugin Mail::SpamAssassin::Plugin::RaptorOnly body __GB_SEX_EXPLICIT_PHOTO /sending you my intimate photos/ meta GB_SEX_EXPLICIT_PHOTO ( __GB_SEX_EXPLICIT_PHOTO && KAM_RAPTOR_NEW ) describe GB_SEX_EXPLICIT_PHOTO Explicit content from new email address score GB_SEX_EXPLICIT_PHOTO 8.0 endif #KAM_TELEWORK body __KAM_TELEWORK1 /(generate|make) .{0,10}1.5K? (to|-) 3.5K (a day|daily|per day|per month)|makes? \$[\d,]+\/month|upgrade your salary/is body __KAM_TELEWORK2 /have a (?:tele)?phone|money making challenge|has full internet/is body __KAM_TELEWORK3 /return(?:ing)? (phone )?calls|working a few hours each day|positive work environment/is body __KAM_TELEWORK4 /fully qualified|no experience needed|all the training|managing expectations|accountability|stronger results/is body __KAM_TELEWORK5 /work (?:online )?from home|process(?:ing)? rebates (?:at|from) home|set your own hours|100% no risk|Western Union fees|new job or career/is body __KAM_TELEWORK6 /earning up to \d+USD|earn thousands of dollars|\d% commission|get rich quick|manager training|real.payoff/is header __KAM_TELEWORK7 Subject =~ /process rebates|easy work and great pay|making money today|earn money|vacancies in your city|internet jobs|bad ecomomy|(manager|supervisor).training|handling difficult|work.from.home/i header __KAM_TELEWORK8 From =~ /training|online/i meta KAM_TELEWORK (__KAM_TELEWORK1 + __KAM_TELEWORK2 + __KAM_TELEWORK3 + __KAM_TELEWORK4 + __KAM_TELEWORK5 + __KAM_TELEWORK6 + __KAM_TELEWORK7 + __KAM_TELEWORK8 >= 3) describe KAM_TELEWORK Stupid telework and training scams score KAM_TELEWORK 3.0 #SOME TLD ARE BAD #.online removed on 2025-04-05 header __KAM_SOMETLD_ARE_BAD_TLD_FROM From:addr =~ /\.(bar|beauty|buzz|cam|casa|cfd|club|date|guru|link|live|monster|pw|quest|rest|sbs|shop|stream|top|trade|wiki|work|xyz)$/i uri __KAM_SOMETLD_ARE_BAD_TLD_URI /:\/{2}([a-z0-9-\.]+)\.(bar|beauty|buzz|cam|casa|cfd|club|date|guru|link|live|monster|pw|quest|rest|sbs|shop|stream|top|trade|wiki|work|xyz)($|\/|\:)/i header __KAM_SOMETLD_ARE_BAD_TLD_FROM_PRESS From:addr =~ /\.press$/i uri __KAM_SOMETLD_ARE_BAD_TLD_URI_PRESS /:\/{2}([a-z0-9-\.]+)\.press($|\/|\:)/i #FPs uri __KAM_SOMETLD_ARE_BAD_TLD_URI_NEGATIVE /(^|\b)(input|td|lev)\.date|de[b|l]\.date|div\.top($|\/)|enable\.work|\/smart\.link|\.emailprotection\.link\/|\.goat\.com\/|\/mark\.link|\/square\.link\/|\.sng\.link\/|\.page\.link\/|\.app\.link|\.adm\.date($|\/)/i body __KAM_SOMETLD_ARE_BAD_TLD_PROGRAM_REF /\.date ?\{/i ifplugin Mail::SpamAssassin::Plugin::RaptorOnly header __RAPTOR_NOT_NEW X-Raptor-New =~ /no/i header KAM_RAPTOR_NEW X-Raptor-New =~ /yes/i describe KAM_RAPTOR_NEW Email from a new domain score KAM_RAPTOR_NEW 0.1 meta KAM_SOMETLD_ARE_BAD_NNEW (((__KAM_SOMETLD_ARE_BAD_TLD_FROM + __KAM_SOMETLD_ARE_BAD_TLD_FROM_PRESS >= 1) || (__KAM_SOMETLD_ARE_BAD_TLD_URI + __KAM_SOMETLD_ARE_BAD_TLD_URI_PRESS >= 1) && !(__KAM_SOMETLD_ARE_BAD_TLD_PROGRAM_REF + __KAM_SOMETLD_ARE_BAD_TLD_URI_NEGATIVE >= 1)) && __RAPTOR_NOT_NEW) score KAM_SOMETLD_ARE_BAD_NNEW 4.0 describe KAM_SOMETLD_ARE_BAD_NNEW not new emails from commonly abused domains meta KAM_SOMETLD_ARE_BAD_NEW (((__KAM_SOMETLD_ARE_BAD_TLD_FROM + __KAM_SOMETLD_ARE_BAD_TLD_FROM_PRESS >= 1) || (__KAM_SOMETLD_ARE_BAD_TLD_URI + __KAM_SOMETLD_ARE_BAD_TLD_URI_PRESS >= 1) && !(__KAM_SOMETLD_ARE_BAD_TLD_PROGRAM_REF + __KAM_SOMETLD_ARE_BAD_TLD_URI_NEGATIVE >= 1)) && !__RAPTOR_NOT_NEW) score KAM_SOMETLD_ARE_BAD_NEW 5.0 describe KAM_SOMETLD_ARE_BAD_NEW new emails from commonly abused domains meta KAM_SOMETLD_ARE_BAD_TLD ( KAM_SOMETLD_ARE_BAD_NNEW || KAM_SOMETLD_ARE_BAD_NEW ) score KAM_SOMETLD_ARE_BAD_TLD 0.001 else meta KAM_SOMETLD_ARE_BAD_TLD (__KAM_SOMETLD_ARE_BAD_TLD_FROM + __KAM_SOMETLD_ARE_BAD_TLD_FROM_PRESS >= 1) || ((__KAM_SOMETLD_ARE_BAD_TLD_URI + __KAM_SOMETLD_ARE_BAD_TLD_URI_PRESS >= 1) && !(__KAM_SOMETLD_ARE_BAD_TLD_PROGRAM_REF + __KAM_SOMETLD_ARE_BAD_TLD_URI_NEGATIVE >= 1)) score KAM_SOMETLD_ARE_BAD_TLD 5.0 endif describe KAM_SOMETLD_ARE_BAD_TLD .bar, .beauty, .buzz, .cam, .casa, .cfd, .club, .date, .guru, .link, .live, .monster, .press, .pw, .quest, .rest, .sbs, .shop, .stream, .top, .trade, .wiki, .work, .xyz TLD abuse #2019-11-24 - Test to do the SOMETLD with WLBLEval - Doesn't work because no uri check for the body #ifplugin Mail::SpamAssassin::Plugin::WLBLEval # enlist_addrlist (BADTLDS) *@*.pw # enlist_addrlist (BADTLDS) *@*.stream # enlist_addrlist (BADTLDS) *@*.trade # enlist_addrlist (BADTLDS) *@*.bid # enlist_addrlist (BADTLDS) *@*.press # enlist_addrlist (BADTLDS) *@*.top # enlist_addrlist (BADTLDS) *@*.date # # header __KAM_SOMETLD_ARE_BAD_TLD_FROM eval:check_from_in_list('BADTLDS') # body __KAM_SOMETLD_ARE_BAD_TLD_URI eval:check_uri_host_listed('BADTLDS') #endif #CHANGED TO RaptorOnly ifplugin Mail::SpamAssassin::Plugin::RaptorOnly #TESTING RULE body KAM_LOCAL_TEST1 /myspamtest12341234/ describe KAM_LOCAL_TEST1 This is a unique phrase to trigger a + score score KAM_LOCAL_TEST1 50 #REVERSE DNS TESTS FROM MIMEDEFANG - UNLESS YOU HAVE A TEST FOR REVERSE POINTERS, YOU CAN COMMENT THIS OUT header KAM_RPTR_FAILED X-Raptor-Reverse =~ /^Failed/ describe KAM_RPTR_FAILED Failed Mail Relay Reverse DNS Test score KAM_RPTR_FAILED 6.0 header __KAM_RPTR_SUSPECT X-Raptor-Reverse =~ /^Suspect/ meta KAM_RPTR_SUSPECT (KAM_BODY_MARKETINGBL_PCCC < 1 && __KAM_RPTR_SUSPECT >= 1) describe KAM_RPTR_SUSPECT Suspected Dynamic IP/Bad TLD/Spammy TLD from Mail Relay Reverse DNS Test score KAM_RPTR_SUSPECT 2.45 #REMOVED __URIBL_ANY DEPENDENCY AS THE RULE IS GONE. NOTED by David Goldsmith. header __KAM_RPTR_PASSED X-Raptor-Reverse =~ /^Passed/ meta KAM_RPTR_PASSED (__KAM_RPTR_PASSED && (URIBL_BLACK + URIBL_SBL + URIBL_PH_SURBL + RCVD_IN_BL_SPAMCOP_NET + IN_BRBL + RCVD_IN_BRBL_RELAY + RCVD_IN_XBL + KAM_SPAMJDR + KAM_LOTTO3 + __KAM_URIBL_PCCC + __KAM_MX + SPF_SOFTFAIL + SPF_FAIL + KAM_INFOUSMEBIZ + KAM_TOLL < 1)) describe KAM_RPTR_PASSED Passed Mail Relay Reverse DNS Test score KAM_RPTR_PASSED -1.0 header KAM_RPTR_MISSING X-Raptor-Reverse =~ /^Missing/ describe KAM_RPTR_MISSING Mail Relay Reverse DNS Entry Missing! score KAM_RPTR_MISSING 6.0 #Lowered to 6.0 temporarily #DWDTECHSPAM /ETC header KAM_RPTR_BADHOST X-Raptor-Reverse =~ /dwdtechllc.com|inculloop.net|donapex.net|wriltay.com|raptornode.com|voicitr.us|premiumjobhunt.com|newsocialdeals.com|dailysummercoupons.com|nm\-priorityhosting.com|hypernia.com|queryfoundry.net|colocrossing.com|pawlitenews.com|hosted\-by\-i3d.net/i describe KAM_RPTR_BADHOST Very Spammy Hosting Company Identified score KAM_RPTR_BADHOST 9.0 header KAM_NOTLS X-Raptor-TLS =~ /False/ describe KAM_NOTLS Mail has been sent using an unsecure connection score KAM_NOTLS 5.0 subjprefix KAM_NOTLS [NoTLS] #COMPLETE WHOIS IS DOWN #score __RCVD_IN_WHOIS 0 #score RCVD_IN_WHOIS_INVALID 0 #score URIBL_COMPLETEWHOIS 0 #Custom subject welcomelist #header FRANCHISE_JERRY Subject =~ /: (Franchise Application|Request Franchise Information)$/i #score FRANCHISE_JERRY -99.0 #describe FRANCHISE_JERRY Jerry's Franchise Application or Request #RAPTOR ALTERED EMAILS #body __KAM_RAPTOR1 /altered by our Raptor filters/i #header __KAM_RAPTOR2 X-Raptor-Alter =~ /True/ #meta KAM_RAPTOR (__KAM_RAPTOR1 + __KAM_RAPTOR2 >= 1) #describe KAM_RAPTOR PCCC Raptor altered the email #score KAM_RAPTOR 3.5 #NJABL Shutdown Bug 6913 - Check after 3/3/2013 update if these can be removed if can(Mail::SpamAssassin::Conf::feature_dns_query_restriction) dns_query_restriction deny njabl.org endif #KAM Bad Attach header KAM_RPTR_MISSING X-Raptor-Reverse =~ /^Missing/ describe KAM_RPTR_MISSING Mail Relay Reverse DNS Entry Missing! score KAM_RPTR_MISSING 9.0 #KAM Bad Attach header KAM_RPTR_MISSING X-Raptor-Reverse =~ /^Missing/ describe KAM_RPTR_MISSING Mail Relay Reverse DNS Entry Missing! score KAM_RPTR_MISSING 9.0 #KAM Bad Attach header KAM_RPTR_MISSING X-Raptor-Reverse =~ /^Missing/ describe KAM_RPTR_MISSING Mail Relay Reverse DNS Entry Missing! score KAM_RPTR_MISSING 9.0 #KAM Bad Attach header KAM_BADATTACH X-Raptor-BadAttach =~ /^True/ describe KAM_BADATTACH Mail contains a bad attachment score KAM_BADATTACH 15.0 #RHS_DOB not working 10/6/2014 - Resolved 10/9/2014 #score URIBL_RHS_DOB 0.0 else # no RaptorOnly, stub rules meta KAM_RAPTOR_ALTERED 0 score KAM_RAPTOR_ALTERED 0 meta CBJ_GiveMeABreak 0 score CBJ_GiveMeABreak 0 meta KAM_RPTR_SUSPECT 0 score KAM_RPTR_SUSPECT 0 meta KAM_RPTR_FAILED 0 score KAM_RPTR_FAILED 0 meta KAM_RPTR_PASSED 0 score KAM_RPTR_PASSED 0 endif #$6c822ecf@ - Idea from Jailer-Daemon on SARE header KAM_6C822ECF Message-Id =~ /\$6c822ecf\@/i describe KAM_6C822ECF $6c822ecf@ VERY prevalent message-ID header in SPAMs score KAM_6C822ECF 7.0 #DRILLING & MUST READ - With updates courtesy of Mark Damrose header __KAM_MUSTREAD1 Subject =~ /you (?:must|should|require|need|have) to read\.$/i header __KAM_MUSTREAD2 Subject =~ /^(?:Weighty|Very important|Serious|Momentous|Significant|Grand|Essential) (?:message|letter|note)\./i meta KAM_MUSTREAD (__KAM_MUSTREAD1 + __KAM_MUSTREAD2 >= 1) describe KAM_MUSTREAD Subject indicative of a SPAM message score KAM_MUSTREAD 1.25 body __KAM_DRILL1 /drilling/i body __KAM_DRILL2 /oil (company|partnership|and gas rights)/i body __KAM_DRILL3 /(exceed(ed)? .{0,10}expectations|see your brokers website)/i body __KAM_DRILL4 /(buy today|Check this deal out)/i meta KAM_DRILL (KAM_MUSTREAD + __KAM_DRILL1 + __KAM_DRILL2 + __KAM_DRILL3 + __KAM_DRILL4 >= 4) describe KAM_DRILL Oil Drilling SPAM score KAM_DRILL 1.5 #CHANGED TO RaptorOnly ifplugin Mail::SpamAssassin::Plugin::RaptorOnly #WE USE MIMEDEFANG TO DISABLE ANY IFRAME, OBJECT OR SCRIPT TAGS IN EMAILS header KAM_IFRAME X-Raptor-IframeWarning =~ /Iframe\/Object\/Script tag\(s\) deactivated by MIMEDefang/ describe KAM_IFRAME Email contained Iframe, Object or Script tags if can(Mail::SpamAssassin::Conf::feature_subjprefix) subjprefix KAM_IFRAME [Javascript] endif score KAM_IFRAME 2.0 body KAM_IFRAME2 /you need a browser with javascript/i describe KAM_IFRAME2 Email contains phrase instructing javascript use score KAM_IFRAME2 1.0 meta KAM_IFRAME3 (KAM_IFRAME + KAM_IFRAME2 + T_HTML_ATTACH >=3) score KAM_IFRAME3 5.0 describe KAM_IFRAME3 Likely email exploit - Email shouldn't require javascript in an email attachment #XEROX SCANS header __KAM_XEROX1 Subject =~ /Scan from a Xerox WorkCentre Pro \#\d+|Scanned from a Xerox Multifunction Device|document from xerox scanner/i meta KAM_XEROX (__KAM_XEROX1 + (KAM_IFRAME && T_HTML_ATTACH) + KAM_RAPTOR_ALTERED >= 2) score KAM_XEROX 5.0 describe KAM_XEROX Likely Fake Xerox Attachment else # no RaptorOnly, stub rules meta KAM_IFRAME 0 score KAM_IFRAME 0 endif ifplugin Mail::SpamAssassin::Plugin::RaptorOnly #WE USE MIMEDEFANG TO DISABLE TRACKING IMG TAGS header KAM_IMG_TRACKING X-Raptor-TrackingWarning =~ /remote tracking image\(s\) deactivated by MIMEDefang/ describe KAM_IMG_TRACKING Email contained a tracking img tag score KAM_IMG_TRACKING 0.001 endif #STUPID REMOVE "*" to make the link working. body __KAM_STAR1 /REMOVE ("\*"|space) (in the above|to make the) link/i meta KAM_STAR (__KAM_STAR1 >= 1) describe KAM_STAR Stupid Obfuscated Link SPAMs score KAM_STAR 2.0 #IN LATE FEB 2007, WE BEGAN RECEIVING TONS OF EMAILS FORMATED ALL THE SAME. body __KAM_SPAMKING1 /This advertisement is presented by/is body __KAM_SPAMKING2 /If you have any questions or concerns regarding this communication, please send correspondence/is body __KAM_SPAMKING3 /To .{0,30}(?:unsubscribe|stop|remove) .{0,35}(?:email|messages) from third party advertisers/is body __KAM_SPAMKING4 /notify .{0,30} that you no longer wish to receive (?:promotional )?messages/is body __KAM_SPAMKING5 /This (communication|message) was delivered to you by/is body __KAM_SPAMKING6 /(?:please send|Forward postal) correspondence to/is meta KAM_SPAMKING (__KAM_SPAMKING1 + __KAM_SPAMKING2 + __KAM_SPAMKING3 + __KAM_SPAMKING4 + __KAM_SPAMKING5 + __KAM_SPAMKING6 >= 3) describe KAM_SPAMKING SPAM using throw-away domains and addresses. SpamKing's Heir! score KAM_SPAMKING 1.0 #THIS HEADER SEEMS TO BE PREVALENT IN SPAMS header KAM_SPAMJDR X-Mailerinfo =~ /OTHR_JDR/ describe KAM_SPAMJDR Emails seen with SPAM containing this header X-Mailerinfo: OTHR_JDR1173771 score KAM_SPAMJDR 2.0 meta KAM_COMBOJDR (KAM_SPAMJDR + KAM_SPAMKING >= 2) describe KAM_COMBOJDR Spam Test for Rules Combined with KAM_SPAMJDR score KAM_COMBOJDR 5.0 #LOTTO CRUD body __KAM_LOTTO1 /((you |e\-?mail )(?:address,? )?(has |have )?(emerged as one of (the|our) winning|emerged as a category "A" Winner|came out as the winning coupon|emerged a winner|has won|(?:was |is )?attached( to)?\s+(winning number|serial|ticket|reference)|was one of the ten winners|has been selected as one of the lucky)|random selection in our computerized email selection system|procuring your prize|email id identified with coupon|e\-mail addresses are picked randomly|send your winning identification|final recipients? of a cash|selected as the one of the beneficiaries|receiving your donation|facebook name was selected)/is body __KAM_LOTTO2 /((ticket|serial|lucky) number|secret pin ?code|pin number|batch number|reference number|promotion date|lottery|sweepstake|\d+ lucky recipients|for claim and inquiring)|Micros(oft)? ID/is body __KAM_LOTTO3 /(won|claim|cash prize|pounds? sterling|over \$500|award sum of US\$|NOTIFICATION FOR CASH AID)/is body __KAM_LOTTO4 /(claims (office|agent|manager|requirement)|lottery coordinator|(certificate|fiduciary) (officer|agent|claims)|accredited agent|payment agency board|promotion manager|promotions? department|Name of +Agent:|executive secretary|claims & Management|lottery approved courier|promo.team)/is body __KAM_LOTTO5 /(POWERBALL\-?LOTTO|freelotto group|(microsoft|Royal Heritage) (promotion|Lottery)|(British|UK) National( Online)? Lottery|U\.?K\.? Grand Promotions|Lottery Department UK|Euromillion Loteria|Luckyday International Lottery|International Lottery|Euro \- Afro Asian Sweepstake|urawinner|Free Lotto Sweepstakes|PROMOTION DEPARTMENT|PROMOTION\/PRIZE AWARD|Nederlandse Internationale Loterij|EURO MILLIONS|APPLE LOTTERY ONLINE|MSW MEGA JACKPOT|MICROSOFT EMAIL PROMO|MSNlottery|ECOWAS|Nigeria|National Lottery|claim.{1,10}your.gbp|won.you.{1,10}gbp)|cola lotto online|on\-?line promotion/is body __KAM_LOTTO6 /(Dear (Award|Consultation Prize|Lucky) Winner|Winning Notification|Attention:Winner|Dear:? Winner|Amount won:|Sincere Congratulations|Lucky Numbers:|you are a winner|prize attached|prize notification|claims requirement|winning number|winning sum|payout of|qualification number)|attached.file|numbers.on.email|active email address|dear e\-?mail/is header __KAM_LOTTO7 Subject =~ /(Your Lucky Day|Final Notice|CONGRATULATION|(Attention:|ONLINE) WINNER|Winning Notification|Claim Fund|YOU HAVE WON|Online Notification|Your Winning Amount|PROMOTIONS MANAGER|Winnin?g Alert|NOTICE FOR YOUR CLAIM|WINNER|Reference Number|payment of (prize|claim))/i header __KAM_LOTTO8 From =~ /Lottery|powerball|western.union/i header __KAM_LOTTO9 Subject =~ /\d{3},\d{3}|eligibility.for.claims|promo.desk|deserves.\$\d/i meta KAM_LOTTO1 (__KAM_LOTTO1 + __KAM_LOTTO2 + __KAM_LOTTO3 + __KAM_LOTTO4 + __KAM_LOTTO5 + __KAM_LOTTO6 + __KAM_LOTTO7 + __KAM_LOTTO8 + __KAM_LOTTO9 >= 3) describe KAM_LOTTO1 Likely to be an e-Lotto Scam Email score KAM_LOTTO1 0.75 meta KAM_LOTTO2 (__KAM_LOTTO1 + __KAM_LOTTO2 + __KAM_LOTTO3 + __KAM_LOTTO4 + __KAM_LOTTO5 + __KAM_LOTTO6 + __KAM_LOTTO7 + __KAM_LOTTO8 + __KAM_LOTTO9 >= 4) describe KAM_LOTTO2 Highly Likely to be an e-Lotto Scam Email score KAM_LOTTO2 1.25 meta KAM_LOTTO3 (__KAM_LOTTO1 + __KAM_LOTTO2 + __KAM_LOTTO3 + __KAM_LOTTO4 + __KAM_LOTTO5 + __KAM_LOTTO6 + __KAM_LOTTO7 + __KAM_LOTTO8 + __KAM_LOTTO9 + LOTS_OF_MONEY >= 5) describe KAM_LOTTO3 Almost certain to be an e-Lotto Scam Email score KAM_LOTTO3 3.0 #ABOUT YOUR INTERNET ACTIVITIES SPYWARE CRUD header __KAM_ABOUT1 Subject =~ /About your Internet (activities|activity)/i body __KAM_ABOUT2 /Spyware/i meta KAM_ABOUT (__KAM_ABOUT1 + __KAM_ABOUT2 >=2) describe KAM_ABOUT Email Scam Hawking Anti-Spyware score KAM_ABOUT 1.0 #EMAIL ADVERTISING body __KAM_ADVERT1 /email advertising|\d{3}%.roi/is body __KAM_ADVERT2 /instant traffic (to your website|and sales)|demand.generation/is body __KAM_ADVERT3 /Email Ad Broadcast|Double OPT IN list|making.some.changes/is header __KAM_ADVERT4 Subject =~ /(get (instant|more) (sales|business|orders)|instant traffic, leads and sales|within 24 hours|increase in business|Ten Time Increase in Sales and Traffic|Emails Sent to Get You Sales)|sales.goal/i meta KAM_ADVERT (__KAM_ADVERT1 + __KAM_ADVERT2 + __KAM_ADVERT3 + __KAM_ADVERT4 >= 4) describe KAM_ADVERT Mailing List Scammers Hawking Their Lists / Services score KAM_ADVERT 2.5 #DOMAIN ADVERTISING body KAM_ADVERT3 /AllExpiringDomains.com/i describe KAM_ADVERT3 Traffic / Expiring Domain List Spam score KAM_ADVERT3 5.0 #ADVERTISEMENT body KAM_ADVERT2 /No longer interested in our offers|This (message|email)? is an Ad|Continue in your Secure Web Browser|Can\'t see the images( below|, continue)|To view this email as a webpage|see images for this offer|support best practices in responsible email marketing|This email is not unsolicited|You registered with one of our partners websites|a d v e r t i s (?:e )?m e n t|No\-?Images? Click|Program is not endorsed, sponsored by or affiliated|can\'t read or see this email|By clicking any image and\/or text link in this Email|This is a (commercial|commericial)|This message brought to you|THIS EMAIL IS A COMMERCIAL|If you no longer wish to receive further offers|business solicitation message|link is for removal|end these weekly ad\-messages|cancel these Ads go|This is an email advertisement|end all Advertisements go below|We are not spammers|Unsolicited email\?|Quit receiving these admail|I.{0,3}am not spamming|commercial.advertisement|adv.ertisement|if.you.are.not.interested|Brought to you by\:|This (message|entire message|communication) is an ad|removal from further update|inbox by requesting removal|No more incoming messages will be delivered|Never receive these again|This is an ad\-coresspondance|this page is an advertise?ment|this is an \(adver\-?tisement\)|this page are an.ad|statements above are an.ad|advertis.e.ment|share your contact/is describe KAM_ADVERT2 This is probably an unwanted commercial email... score KAM_ADVERT2 0.75 body KAM_ADVERT4 /This is an ad/i describe KAM_ADVERT4 This is probably an unwanted commercial email... score KAM_ADVERT4 0.75 #ONE LINE ADVERTISEMENTS body __KAM_1LINE1 /(free score and report|Did you overpay\?)/is header __KAM_1LINE2 Subject =~ /(free online score & report|I need tax savings? tip)/i meta KAM_1LINE (__KAM_1LINE1 + __KAM_1LINE2 >= 2) describe KAM_1LINE One liner SPAMs score KAM_1LINE 2.5 #CAN SPAM body KAM_CANSPAM /(full compliance with the U.S. Federal\-?Can\-?Spam\-Act|provides CAN\-SPAM compliant email|consistent with the provisions of the CAN\-SPAM Act|compliance with the CanSpam Act|no deceptive subject lines|compliant with all legal provisions of the CAN\-SPAM Act)/is describe KAM_CANSPAM SPAM = Lack of Consent (not a Legal Definition) score KAM_CANSPAM 1.0 #GIFTS / GIFT CARDS body __KAM_GIFT1 /(Claim your free \$500 Target Gift Card|complimentary gift\-?card|received a Victoria's Secret Giftcard|\$500 airline gift card|\$1000 gift card for you to shop|\$\d+.{0,50}gift card|Secret gift card)|costco.coupon|facebook.gift|claim.my.credit/is body __KAM_GIFT2 /(unsubscribe from this advertiseme(tn|nt)|exit future communications|to unsubscribe from this|to stop any offers from us)/is body __KAM_GIFT3 /every girl loves to buy|do you need a new|offer pass you by|shopping.online|best.price|activate.my|valued.{0,20}user|extra.deals|sign.up.today/i body __KAM_GIFT4 /card will be yours free|card on us|buy you the dyson animal|amazon.gift.?card|superstore|starbucks.card|card.egift|redeem.before|offering.you.this|enter.promo.code/i body __KAM_GIFT5 /member incentive program|complet(e|ing) the survey|your.customer.id|security.code|promotional.points/i header __KAM_GIFT6 From =~ /\$\d+ ?gift ?card|coupon|home.improvement|reward|voucher|starbucks|exclusive|amazon|ehost/i meta KAM_GIFT ((__KAM_GIFT1 + __KAM_GIFT2 + __KAM_GIFT3 + __KAM_GIFT4 + __KAM_GIFT5 + KAM_LOTSOFHASH + KAM_SHORT >= 3) && __KAM_GIFT6) describe KAM_GIFT Gift Card Scams score KAM_GIFT 3.5 meta KAM_GIFT2 ((__KAM_GIFT1 + __KAM_GIFT2 + __KAM_GIFT3 + __KAM_GIFT4 + __KAM_GIFT5 + KAM_LOTSOFHASH + KAM_ADVERT2 >= 4) && __KAM_GIFT6) describe KAM_GIFT2 Gift Card Scams score KAM_GIFT2 3.5 #MYSTERY SHOPPER body __KAM_SHOP1 /chosen to participate as a Mystery Shopper/is body __KAM_SHOP2 /Do you like to shop/is body __KAM_SHOP3 /make money while you shop/is meta KAM_SHOP (__KAM_SHOP1 + __KAM_SHOP2 + __KAM_SHOP3 >= 3) describe KAM_SHOP Mystery Shopper Scams score KAM_SHOP 2.0 #FAST CASH rawbody __KAM_FAST1 /make fast cash in real estate/is meta KAM_FAST (__KAM_FAST1 + KAM_ADVERT2 >=2) describe KAM_FAST Get Rich Quick, Make Money Fast Schemes score KAM_FAST 1.8 #BIZ CARDS FREE! body __KAM_BIZ1 /You always need new cards|free full color business cards|get 250 more ?\- ?free|business card offer|500 business cards/is header __KAM_BIZ2 Subject =~ /(do not pay for|Stop paying for|free) business cards|get( your)? 250 Free|BOGO|500 cards for|all for \$1\.99/i header __KAM_BIZ3 From =~ /Free Business Cards|Custom Printing|Premium Cards/i meta KAM_BIZ (__KAM_BIZ1 + __KAM_BIZ2 + __KAM_BIZ3 >= 2) describe KAM_BIZ Free Business Card Emails score KAM_BIZ 2.5 #FDA body __KAM_FDA1 /statements.{1,10}not.{1,10}evaluated.{1,10}(FDA|Food ?(and|&) ?Drug Administration)/i body __KAM_FDA2 /not intended to diagnose,? treat,? cure,? or prevent/i body __KAM_FDA3 /FDA Recall/i meta KAM_FDA (__KAM_FDA1 + __KAM_FDA2 + __KAM_FDA3 >= 3) describe KAM_FDA Carries a not evaluated by the FDA warning or recall warning score KAM_FDA 0.5 #WEIGHT LOSS body __KAM_WEIGHT1 /(overweight|extra weight|glutting|shed fat|burns fat|burn calories|appetite suppressant|stimulate your metabolism|unwanted weight|duet of the year|healthy energy boost|Suppresses Appetite|internal cleansing|detoxify|cellulite|unsightly bulges|fat burn|Diet of the year|acai|cuts cholesterol|cleanse excess waste|free sample|unwanted weight|Acai suppl[ie]ments|Diet\/Detox|\#1 Weight Loss|lose body fat|(lose|drop) (about )?\d+\s*[li]b|calorie burning machine|before eating carbs)|flush.fat.away|slimming.down|\d+.pounds.gone|lose.\dx|highest.rated.episode|unwanted..?gain|too.goo?d.to.be.true|get.slim|tv.segment|weird.solution/is body __KAM_WEIGHT2 /\b(\d pounds|lose[_ ]weight|suppress appetite|appetite out of control|Oprah|for cancer patients|colon cure|colon cleanse|colonmate|avai berry|acai burn|ultraslim|feel energized|excess[_ ]weight|no diet changes|no exercise|hollywood'?s hottest \-?diet|acai berry edge|Acai Diet|top secret diet|Power HCG|Sensa|shocking method|Jennifer Aniston|before eating carbs|all natural weight.?loss|green fruit|top celeb's diet)|one.secret|enjoying.food|f\-a\-t|melt.fat|squeeze into them|crazy.workout|celebs.everywhere|zero.effort|nothing.to.lose/is header __KAM_WEIGHT3 Subject =~ /(leaner|slimmer|stop gaining weight|fat loss|weight management|now available without a script|wuYi tea|(drop|lost|shed|knocked) \d+.?(pounds|[li]bs?)|FRS Healthy Energy|instant diet|colonmate|trimmer you|body cleanse|acai berry|acai burn|Fatburner|cholesterol reduction|cholestapro|Ephedra|W[EA]IGHT[- ]LOSS PRODUCT OF THE YEAR|t\-r\-i\-a\-l|try our trial|cleanse your system|no exc?ercise|Acai Advanced|toxic sludge|cleanse your body|Acai Diet|Acai Elite|Acai Super|losing weight fast|weight loss|detox product|Power HCG|Weight Loss System|shocking (?:weight|weihgt) loss)|before eating carbs|all natural weight.?loss|eat this fruit|Jennifer An+iston's secret|drop.\d.dress.sizes|fat.burning|burn..?fat|get.slim|drop.the.weight|(drop|shed).[li]bs?|move.\.*.?the scale|step.by.step|drop..?pounds|perfect.body|lose.the.weight|half.my.size|special.nutrition|workout|skinny|simple.way|to.get.slim|workout.for.the..?lazy|start.losing.weight|melt.fat|celebs.boycott|celebs.did|overeating|without.any.effort|doctors.tv|oprah|results.are.in|as.seen.on|slim.?spray|zero.effort/i #rawbody __KAM_WEIGHT4 /shocking method|Jennifer Aniston|nationally known|never.seen.anything.like.this|unusual.(new.)?tip|your.metabolism|need.a.boost|this.is.not.a."?(joke|hoax|fad|trend)|no working out|no starving|a trimmer you|celebrity.doctor|seen.on.(cnn|abc|cbs)|\d+%.?off|oprah.and.celeb|beer.belly|thunder.thigh|flush.fat.fast|get.skinny|Women's Health|dress.size|feel.good|physical.activity|starving|hit.a.plateau|flat.belly|brakes on your appetite/i header __KAM_WEIGHT5 From =~ /celeb.weightloss|no.work.workout|(drop|shed).pounds|(drop|shed).\d+[il]bs?|inches off|your.waist|nutrisystem|fat.burn|magic.slim|slim.pack|get.?slim|overweight|becomingslim|slimmer|skinny.tee|flush.fat|slimming.down|hot.trend|curves.?\dweek|stubborn.fat|\d+.pounds|look.great|lazy.workout|bikini|fit.community|slim.?spray|shave.off.(the.)?(pound|lb)|f\-a\-t|fit.in.\d+.day|days.to.slim|oprah|belly|biggestloser/i #ANATRIM / GREEN TEA / CORTITHERM / ETC body __KAM_ANA1 /(anatrim|Green ?Tea|cortitherm|PHENTERTHIN|Phentremine|Acai Ultra|Civ\-xR|WuYi Tea|Wu\-?Yi Source|FRS Healthy Energy|Acai Berry|Chinese secret|Ephedra|Cholestapro|ColonMedic|Pure Cleanse|AcaiBurn|Acai Elite|Garcinia|Chlorogenic Acid|green coffee)/i header __KAM_ANA2 From =~ /green ?tea|Ultra ?Energy|weight ?loss|colon? ?clean|colon ?aid|acai|As seen on|Garcinia|sensa/i meta KAM_ANA (__KAM_ANA1 + __KAM_ANA2 + (__KAM_OZ1 || __KAM_OZ2 || __KAM_OZ3) + __KAM_WEIGHT1 + __KAM_WEIGHT2 + __KAM_WEIGHT3 + __KAM_WEIGHT5 + KAM_FDA + (__KAM_HTML1 || KAM_INFOUSMEBIZ) >= 3) describe KAM_ANA Likely Weight-loss / Medical Spam score KAM_ANA 3.0 meta KAM_ANA2 (__KAM_ANA1 + __KAM_ANA2 + __KAM_OZ1 + __KAM_OZ2 + __KAM_OZ3 + __KAM_WEIGHT1 + __KAM_WEIGHT2 + __KAM_WEIGHT3 + __KAM_WEIGHT5 + KAM_FDA + (__KAM_HTML1 || KAM_INFOUSMEBIZ) >= 5) describe KAM_ANA2 Higher probability of Weight-loss / Medical Spam score KAM_ANA2 3.5 #REPLACE body __KAM_REP1 /Replace \[?[-!~\.]\]? with \./is body __KAM_REP2 /www\s+[-!~\.]/i body __KAM_REP2_1 /(Just|Please|all you need to do is to) (copy|type):? (www\s)?.{0,10}[\[\(]([-!~\.]|dot)[\]\)]/is body __KAM_REP2_2 /in your (IE|internet|explorer|browser)/i body __KAM_REP3_1 /\*omit empty spaces/is body __KAM_REP3_2 /.\s+(COM|org|net|info)$/i meta KAM_REPLACE (__KAM_REP1 + __KAM_REP2 >= 2) || (__KAM_REP2_1 + __KAM_REP2_2 >=2) || (__KAM_REP3_1 + __KAM_REP3_2 >=2) describe KAM_REPLACE Spams that use obfuscated URLs with instructions score KAM_REPLACE 2.0 #EVEN MORE NIGERIAN SCAMS AND VARIANTS body __KAM_NIGERIAN1 /(?:payment officer|personal treasurer|experienced marketers|Chairman of the Finance Committee|contact my secretary|field of Financial Services|Head of Human Resources|Public Relation Officer|field of Business Services|payment agent|representing partner|vacancy in my company|representative\/book ?keeper|executor|search and selection of both experienced|retired chief economist|foreign partner|diplomatic courier|senior auditor|online book\-?keeper)|in.your.country|united.state[^s]|states?.citizen|retired.ceo|nigeria|origin.finland|serious.illness|brain.(tumor|cancer)|former.minister|investment.partner|got.mugged|losing.my.(wife|only.son)/is body __KAM_NIGERIAN2 /(?:looking for dynamic representative|seek your partnership|new online business model|seek to transfer this money|completely legal activity|never ask you to pay or invest|in search of trustworthy representatives|establishing a new liaison network|rec[ei]{2}ving payment on our behalf|assist me in transferring those funds|make money at home|requiring rep to work on a part time|part time job\/full time|organization for the good work of the lord|job search directory|investor willing to invest in lebanon|invest in Real Estate|Your kind assistance|next of kin|gold.exportation|calgary.lotto)|oil.producing|import.firm|oil.and.gas|petroleum|asset.available|urgent.reply|(cash|credit.cards?|cell(.phone)?).(were|was).stolen/is body __KAM_NIGERIAN3 /(?:\d{1,2}\% (?:commission on each transaction|of the total will be set|will be mapped out|is made available to you|of the total sum for your partner|of the money for your effort|for\s+sales)|pay for performance|floating deficit|for your compensation|financial independence|their financial dreams|work from home part\s*\-?\s*time|employing your services|get extra income|deduct your weekly salary \d\d%|transfer of the funds|make successful career at us|you will get \d{1,2}% on each|funds can be directed to your account as a grant|reasonable parentage|dormant domiciliary account|share would be \d+\%|pay you \d+%)|invest|have.a.sum|make.a.donation|immense.benefits|transact.a?.?business|company.sponsor|loan me \$/is body __KAM_NIGERIAN4 /(?:American oil merchant|independent contractor|removallink|claim the funds|international corporation|bank draft|becoming our contract staff|contractual employment|customers\s*in Europe,\s*America|new partner from UK|great investment site|money orders|cashiers check|access to the funds|piloting the business|moving the funds|next of kin|syrian.refugees|reply.for.detail)|security.reason|(his|her).account|new.investor|directly.beneficial|business.discussion|promise.to|need.to.spend/is body __KAM_NIGERIAN5 /Western Union Money Transfer|Money Gram|form of Money Orders|to apply for this job, please send the following|process our payments|not traceable|risk free transation|transfer to a designated bank account|inheritance return|my.inheritance|my.wealth|donation.to.you|out.of.country|charitable.trust/i meta KAM_NIGERIAN (__KAM_NIGERIAN1 + __KAM_NIGERIAN2 + __KAM_NIGERIAN3 + __KAM_NIGERIAN4 + __KAM_NIGERIAN5 + (LOTS_OF_MONEY + __KAM_REFI4 >= 1) >= 4) describe KAM_NIGERIAN Nigerian Scam and Variants score KAM_NIGERIAN 2.25 #I LIKE YOUR SPAM body __KAM_LIKE1 /been working (extremely|very) hard on my friend's website/is body __KAM_LIKE2 /a link from .{1,54} would be greatly appreciated/is body __KAM_LIKE3 /(link exchange|in return to me linking back)/is body __KAM_LIKE4 /HTML code for the link/is body __KAM_LIKE5 /I apologize if this message was sent, in error/is meta KAM_LIKE (__KAM_LIKE1 + __KAM_LIKE2 + __KAM_LIKE3 + __KAM_LIKE4 + __KAM_LIKE5 >= 5) describe KAM_LIKE I like your website link exchange spam score KAM_LIKE 2.0 #PUBLICLY AVAILABLE LISTS? body KAM_PUBLIC /obtained your email address from a publicly available list|find your mail in public forum/is describe KAM_PUBLIC Obtained from Public List != to Consent == SPAM! score KAM_PUBLIC 9.0 #SEXUALLY EXPLICIT RULES ROUND TWO - Fixed some FPs from Scunthorpe thanks to Stefan Morrell body __KAM_SEX1 /(?:double[ -]?headed|pornstar|huge weenie|male power|\d\dper\. of men|male enhancement product|enlarge patch|boost up your virility|clinically tested|improve manhood|Bigger Pen..is|Big Penis|incredible gains to your manhood|muscular manhood|nights unsatisfied|climaxes|sensual enhancer|love instrument|bigger member|excitement with girls|fucker|animal sex)|adds \d inches to your manhood|pussy licked|hard.erection/i body __KAM_SEX2 /(?:(\b|^)cunt(\b|$)|busty|interracial|hardcore|peni(s|le) enlarge|generic quality|enlarge your manhood|stone\-hard manhood|XXL Dick|intense pleasure|spend a night with you|efficient medicine|turn on your wife|with your boner|dick dangl)|\d.(extra.)?inches.of.girth|best.sex/i header __KAM_SEX3 Subject =~ /(double dildo|bunsfuck|dominatrix|huge tits|anti\-ED|most confident man|for men over 30|peni(s|le) enlargement|interracial gobble|bitch sucking dong|product actually does work|update your penis|mans mall|endurerx|more excitement|love package|add more fire|her best male|average guys|monster cocks|first anal|anal fucking|love with monsters|horse sex|be the stud)|have an affair/i body __KAM_SEX4 /(?:bring your girlfriend back|satisfied with their size|penis so huge and heavy|more semen|volume of your loads|wondercum|ejaculate|bargain offers on medic|improve xxx|improve your lovemaking|youngest teen|teen pics|monster in his pants|(female|multiple) orgasms|extreme penetration)/i describe KAM_SEX Sexually Explicit SPAM / Penis Enlargement Scam score KAM_SEX 7.0 meta KAM_SEX (__KAM_SEX1 + __KAM_SEX2 + __KAM_SEX3 + __KAM_SEX4 + __HTML_IMG_ONLY + (__KAM_VIAGRA6A + __KAM_VIAGRA6E + __KAM_VIAGRA7A >= 1 && !__KAM_VIAGRA_FPS) >= 2) #STUPID PICTURE SPAMS body __KAM_PIC1 /(tired|bored) (this )?(today|tonight|evening|morning|afternoon)|saw your email address|online right now|can name me|found you on this site|I am alone|my next boyfriend|blonde with blue|like the girls|crush on you|(wish|hope) (you're|you are) (free|able) to talk/is body __KAM_PIC2 /(nice girl|2\d years old|25 y.o. girl|pretty russian|I russian girl|(\b|^)age is 25|long legs, cute|see my pictures|I'm 19|searching for a bad girl|meet with such attractive|(solitary|cute) lady|(female|girl born) in Russia)/is body __KAM_PIC3 /like to chat|feelings can be true|like to have friendship|friendly guy|gave me your photos|waiting on you|found your pictures|send me a note|more information about you|text me ASAP|corking male|(find a good|uncomparable|waiting for a good) (man|mister)/is body __KAM_PIC4 /(like to share some of my pics|some (?:great )?pictures of me|sending some of my pictures|To see my pic|hope you like my pic|will reply with my pics|show you some pic|chat with me and see|that's my photo)|(reply to|will send) you my picture|view my profile|describe yourself|chat with me|bad girl|view your snapshot|want to watch video|erotic pics|e.?mail to me at/is body __KAM_PIC5 /picture|photo|my pics|appended my pic/i body __KAM_PIC6 /where (are|r) (you|u) live/i describe KAM_PIC Share Pictures and Chat SPAM score KAM_PIC 6.0 meta KAM_PIC (__KAM_PIC1 + __KAM_PIC2 + __KAM_PIC3 + __KAM_PIC4 + __KAM_PIC5 + __KAM_PIC6 + __KAM_PRIV3 >= 4) #STUPID MAILING LIST SPAMS body __KAM_LIST1 /((Hospital|MD) directory|Nursing Home (List|directory)|doctor lists|marketing lists|Licensed Physicians|practicing MDs|practicing Medical doctors|Physicians in America|emails for every state|(vip|laywers|planners|Business Email|HR Directors Email|Sales & Marketing Directors|Managing Director Email) database)/is body __KAM_LIST2 /(?:hospital|dentist|chiropractor|physician|medical doctors|nursing directors|medical marketing|\d sortable fields|records all with emails|business director(y|ies)|direct marketing data)|nursing assistant/is body __KAM_LIST3 /price\:|prices for our director/is body __KAM_LIST4 /(?:database|list|[\d,]{1,32} (total records|e\-?mails))/is body __KAM_LIST5 /(reply with "stop" as a subject|Send an email with "rem" in the subject to discontinue|put "cease" in the subject of an email|for termination of this e?mail|reply with .{1,8} in the subject)|you will have your email taken off|for the datacard|send.a.reply/is header __KAM_LIST6 Subject =~ /Database of (neurological|surgeons|doctors|nurses|mds)|MD Database|looking for list|email database|we have that list|marketing database|list.of.\d/i describe KAM_LIST Mailing List Database SPAM score KAM_LIST 3.0 meta KAM_LIST ( (__KAM_LIST1 + __KAM_LIST2 + __KAM_LIST3 + __KAM_LIST4 + __KAM_LIST5 + __KAM_LIST6 >= 4) && !EXTRACTTEXT ) #YET MORE DRUG SCAMS body __KAM_DRUG1 /Quality and cheap|premier quality|supor\-collosal mixture|Discount\-?Pharmacy|hi.quality.drug/is body __KAM_DRUG2 /cheaper|redeem in bulk and save|bigger quantities and Save|drugstore accredi[dt]ations|economical (?:value|amount)|drug.online.supplies/is rawbody __KAM_DRUG3 /local drugstore|(hush\-hush|secret) with no waiting rooms|confidential package|distributed securely|shape is our main concern/is body __KAM_DRUG4 /click to buy|no previous doctors direction|No prescript[oi]{2}n needed|no script necessary|medicine assistance supplier|mail[- ]?order medicine/is describe KAM_DRUG More Viagra, Medicine, et al Scams score KAM_DRUG 2.5 meta KAM_DRUG (__KAM_DRUG1 + __KAM_DRUG2 + __KAM_DRUG3 + __KAM_DRUG4 + __KAM_VIAGRA6A + __KAM_VIAGRA7A + KAM_REPLACE >= 4) #DUE TO THE RASH OF IP BASED LINKS IN EMAILS DUE TO STORM BOTS, THESE ARE TESTS FOR IPS IN EMAILS #Thanks to Jamie for pointing out I missed a 1918 range. rawbody __KAM_GOODIPHTTP /https?:\/\/(192\.168\.|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)/i rawbody __KAM_IPHTTP /https?:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/i describe KAM_BADIPHTTP Due to the Storm Bot Network, IPs in emails is bad score KAM_BADIPHTTP 2.0 meta KAM_BADIPHTTP (__KAM_IPHTTP - __KAM_GOODIPHTTP >= 1) body __KAM_HIDDEN_URI1 /\[DOT\]com/is body __KAM_HIDDEN_URI2 /replace "?\[DOT\]/is meta KAM_HIDDEN_URI (__KAM_HIDDEN_URI1 + __KAM_HIDDEN_URI2 >= 2) describe KAM_HIDDEN_URI URI obfuscation techniques score KAM_HIDDEN_URI 4.0 #ODD INFO URL - MATCH A URL-LIKE STRING THAT ENDS IN A QUESTIONABLE TLD, FOLLOWED BY A WORD BOUNDARY OR A SLASH (BUT NOT A DOT, OR IT WILL FP ON SUBDOMAINS LIKE FOO.INFO.LEGIT.COM) # Thanks to Lucas Rolff for the https idea rawbody __KAM_INFOUSMEBIZ1 /https?:\/\/(?:www.)?.{4,30}\.(info|us|me|me\.uk|biz)(?![-\.])(\b|\/)/i header __KAM_INFOUSMEBIZ2 From:addr =~ /\.(info|us|me|me\.uk|biz|xyz|id|rocks|life)$/i header __KAM_INFOUSMEBIZ3 Return-Path =~ /\.(info|us|me|me\.uk|biz|xyz|id|rocks|life)>?$/i meta KAM_INFOUSMEBIZ (__KAM_INFOUSMEBIZ1 + __KAM_INFOUSMEBIZ2 + __KAM_INFOUSMEBIZ3 >= 1) score KAM_INFOUSMEBIZ 0.75 describe KAM_INFOUSMEBIZ Prevalent use of .info|.us|.me|.me.uk|.biz|xyz|id|rocks|life domains in spam/malware # OTHER QUESTIONABLE / CHEAP TLDS - .click, .work, .rocks, .science, .casa rawbody __KAM_OTHER_BAD_TLD1 /http:\/\/(?:www.)?.{4,30}\.(click|farm|work|rocks|science|club|casa)(?![-\.])(\b|\/)/i header __KAM_OTHER_BAD_TLD2 From:addr =~ /\.(click|farm|work|rocks|science|club|casa)$/i header __KAM_OTHER_BAD_TLD3 Return-Path =~ /\.(click|farm|work|rocks|science|club|casa)>?$/i meta KAM_OTHER_BAD_TLD (__KAM_OTHER_BAD_TLD1 + __KAM_OTHER_BAD_TLD2 + __KAM_OTHER_BAD_TLD3 >= 1) score KAM_OTHER_BAD_TLD 0.75 describe KAM_OTHER_BAD_TLD Other untrustworthy TLDs #RECENT RASH OF VIRII/TROJAN PAYLOADS USING GREETING CARD NOTICES - IPHTTP IDEA BY STEPHEN FORD body __KAM_CARD1 /(worshipper|friend|Neighbou?r|partner|mate|colleague|member|worshipper|cousin|pal|brother|somebody|father|mother|uncle|aunt|daughter|son|nephew)(\(.{0,35}\))?(?: has)? (?:sen[dt] you|created) (?:an|a)?\s*(?:funny|love|post|greeting|birthday|animated|musical|holiday|love|hallmark|thank you|e)\s*(e|post)?\-?card/i body __KAM_CARD2 /(laughing kitty|crazy cat) card|enjoy your awesome card|Click on your .{0,15}card('s)? (link|direct www address) below|To see your custom .{0,15}card, simply click on the (link below|following)|(as you can see on the ecard)|^your .{1,15}card link:$|I bet your wife won\'?t do this for you|Your temporary Login Info|temp\.? password id|pics I took of my Ex\-Wife|card will be aviailable|our.new.collection/i body __KAM_CARD3 /I['`]m in hurry, but i still love you...|has (issued you a greeting|made you an Ecard)|^(Follow this link:|click (here to enter our secure server:))?\s*?http:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|eCard, open attached/i header __KAM_CARD4 Subject =~ /Here is some pics to say thanks|do you like em?|here is my picture|bra is too tight|look what I like to do|hot news|(\s|^)e\-?cards?(\s|$)|greeting.e?card/i rawbody __KAM_CARD5 /postcard(\.gif)?\.exe|card.zip|groups.google.com|blaqseal/i describe KAM_CARD Trojan or Virus Payload from fake ecard notice score KAM_CARD 3.5 meta KAM_CARD (__KAM_CARD1 + __KAM_CARD2 + __KAM_CARD3 + __KAM_CARD4 + __KAM_CARD5 + KAM_INFOUSMEBIZ + __KAM_IPHTTP + KAM_RPTR_SUSPECT >= 3) #INSURANCE / CAR / LIFE / HEALTH SCAMS - fixed $ bug thanks to Mark Chaney header __KAM_INSURE1 Subject =~ /get (low )?affordable health (coverage|insurance)|reduce health costs|without health coverage|\d+K(?:.in)?.(term.)?life|overypay for auto insurance|Policy.Payment|GAs Prices|Auto Insurance|get your 20\d\d quote|\$\d00,000 coverage|no exam|Insurance.Payment|child's financial future|\d+K in coverage|health insurance (?:plans|coverage)|(Omaba|obama).?care|Secure \d+k coverage|\$\d\d\d,\d\d\d of term life|life insurance coverage|save up to \d+% on .{0,10}insurance|Protect.your.family|homeowners insurance|home.?.?protection|read.asap|auto.policy|protect your|\$\d+K..?term|auto.?insurance|\d+k.available|simplified.protection|policy.update|view.policy|med(ical)?.exam|term.life|protection|\d+k.available|policy.review|business.insurance|your.health|care.policy|life.cover|life.secure|life.insured/i body __KAM_INSURE2 /find better Health Insurance Rates Today|get information about health coverage|protect your family|overpay for auto insurance|been recently,? lowered|gas prices are going up|Auto Insurnace go with it|no examination|get (?:a )?free quote|have been.{0,2}reduced|AutoWarranty|plans as low as|plans starting at|complete your health profile|Secure \d+k coverage|growing.family|milestone|special.enroll|updated.rate|lifeinsurance|no.medical.exam|accuquote|no.tobacco.rate|denied.coverage|business.policy|reduced.rate|coverage.starts.immediately|obama|respect.your.privacy/i header __KAM_INSURE3 From =~ /Cheaper Auto|Insurance|health.quote.direct|fidelity|gerber|lifeplan|notice|warranty.expir|auto\-repairs.{0,30}no longer covered|affordable.?health|Health.?care|AIG|accuquote|life.?rate|eCoverage|humana|ahs.warranty|policy|farmer|qualify|term.life|milestone|payout|secure|out.of.pocket|\d+k|take.comfort/i body __KAM_INSURE4 /why pay more for.{0,30}coverage|save up to \d+%|accuquote|Life Insurance Coverage|protect.your.family.{1,20}insurance|Protect home and belonging|Affordable Care Act|new health insurance plan for you|home.?.?protection|\d+k.life.insurance|eligible for auto.coverage|set to expire|\$\d+\/mo|new.rate|your.auto.?insurance.policy|term.life|update.policy|legacy|estate|your.package|your.own.life|prepared.for.anything|paying.(far.)?too/i describe KAM_INSURE Life, Health, Auto, etc. Insurance SPAMs score KAM_INSURE 2.5 meta KAM_INSURE (__KAM_INSURE1 + __KAM_INSURE2 + __KAM_INSURE3 + __KAM_INSURE4 + (KAM_ADVERT2 || KAM_LOTSOFHASH || KAM_INFOUSMEBIZ || CBJ_GiveMeABreak) + FROM_FREEMAIL >= 4) describe KAM_INSURE2 Higher Probability of Life, Health, Auto, etc. Insurance SPAMs score KAM_INSURE2 2.5 meta KAM_INSURE2 (__KAM_INSURE1 + __KAM_INSURE2 + __KAM_INSURE3 + __KAM_INSURE4 + (KAM_ADVERT2 || KAM_LOTSOFHASH || KAM_INFOUSMEBIZ || CBJ_GiveMeABreak) + FROM_FREEMAIL >= 5) #HEALTH INSURANCE body __KAM_HEALTH1 /as low as \$\d+\s*(per|\/)\s*month|at \$\d+ including dental/i body __KAM_HEALTH2 /save up to \d+% on health insurance|affordable health coverage|quality term life insurance|nationalhealthxchange.com|view.rate|no.obligation|start.saving/i rawbody __KAM_HEALTH3 /easy and it's free|receive daily health news|check our rates|Call to qualify|no physical exam|set.to.expire|immediately.available|you.can.afford/i rawbody __KAM_HEALTH4 /health insurance (coverage|rates)|free .{0,3}personalized.quote|get a quote for health insurance|fast and easy term|life.milestone|instant.free.quote/i header __KAM_HEALTH5 Subject =~ /\$38 Health Insurance|health insurance quote|Save up to \d%|term.life|New Health Insurance|\$\d+\/mo|lifepolicy/i describe KAM_HEALTH Health/Life Insurance Spam Emails score KAM_HEALTH 3.0 meta KAM_HEALTH (__KAM_HEALTH1 + __KAM_HEALTH2 + __KAM_HEALTH3 + __KAM_HEALTH4 + __KAM_HEALTH5 + KAM_ADVERT2 >= 4) #HEALTH INSURANCE body __KAM_HEALTH2_1 /affordable health coverage/i header __KAM_HEALTH2_2 Subject =~ /health insurance quote/i describe KAM_HEALTH2 Health Insurance Spam Emails score KAM_HEALTH2 3.0 meta KAM_HEALTH2 (__KAM_HEALTH2_1 + __KAM_HEALTH2_2 + HTML_MESSAGE >= 3) #HEALTH INSURANCE header __KAM_HEALTH3_1 Subject =~ /Term Life Coverage/i header __KAM_HEALTH3_2 Subject =~ /\d\d\/mo/i header __KAM_HEALTH3_3 From =~ /fidelity/i describe KAM_HEALTH3 Term Life Insurance Spam score KAM_HEALTH3 3.0 meta KAM_HEALTH3 (__KAM_HEALTH3_1 + __KAM_HEALTH3_2 + __KAM_HEALTH3_3 >= 3) #REAL ESTATE INVESTMENT SCAMS body __KAM_REAL2_1 /(?:Property available|on the water|costa rica|mountain.top)/i body __KAM_REAL2_2 /(?:pre\-development prices|finish building|torn down to build|exclusive place|ready.for.construction)/i body __KAM_REAL2_3 /(?:unbelievable deals|buyer with CA[s\$]h|pennies.on.the.dollar)/i body __KAM_REAL2_4 /(?:home sites|raw land|vacation home|wooded.property)/i body __KAM_REAL2_5 /(?:developers|estates|buyer flying in|retirement plans|liquidation)/i describe KAM_REAL2 Real-estate investment scams score KAM_REAL2 1.0 meta KAM_REAL2 (__KAM_REAL2_1 + __KAM_REAL2_2 + __KAM_REAL2_3 + __KAM_REAL2_4 + __KAM_REAL2_5 >= 5) #BASED on JIM MCCULLARS' IDEA AND DALLAS' GREAT PDFINFO RULES ifplugin Mail::SpamAssassin::Plugin::PDFInfo #Thanks to Ben Lentz for pointing out a lint error with this. describe KAM_BADPDF Prevalent Junk PDF SPAMs - BAD SUBJECT score KAM_BADPDF 2.5 header KAM_BADPDF Subject =~ /(?:^.{0,15}(document|confirmation|marketwatch|pinksheets|wire info|pinksheets|investor_report|proposal|invest_today|alert|invoice|investor_letter|check)\-\d{5,12}$|^basic[- _]chart\-|^Active[- _](stocks|trader)|^Analyst[- _]Coverage|^Income[- _](report|details|statement)|^Market[- _](advice|watch)|^Investor[- _]news|^real\-?time[- _]quotes)/i describe KAM_BADPDF1 Prevalent Junk PDF SPAMs - EMPTY BODY & ENCRYPTED score KAM_BADPDF1 2.5 meta KAM_BADPDF1 (GMD_PDF_EMPTY_BODY + GMD_PDF_ENCRYPTED >= 2) #2009-03-11 - Found FP on this rule where a bad reverse PTR and a Subject triggered this rule. That was NOT the intent. describe KAM_BADPDF2 Prevalent Junk PDF SPAMs - 3 STRIKES score KAM_BADPDF2 2.5 ifplugin Mail::SpamAssassin::Plugin::RaptorOnly meta KAM_BADPDF2 (KAM_BADPDF + KAM_BADPDF1 + MISSING_SUBJECT >= 2) && (KAM_RPTR_SUSPECT + KAM_RPTR_FAILED >=1) else meta KAM_BADPDF2 (KAM_BADPDF + KAM_BADPDF1 + MISSING_SUBJECT >= 2) && (KAM_RPTR_SUSPECT >=1) endif endif #BAD PURCHASE ORDER ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __KAM_BADPO1 Content-Type =~ /Purchase.Order|New.Invoice|waiver|reconciliation/i mimeheader __KAM_BADPO2 Content-type =~ /PDF.{0,3}\.(rtf|s?html?)\"?$/i endif header __KAM_BADPO3 Subject =~ /New Order|PO(\b|$)|PO\d\d\d|Purchase Order|Invoice/i ifplugin Mail::SpamAssassin::Plugin::RaptorOnly meta KAM_BADPO (KAM_RAPTOR_ALTERED + __KAM_BADPO3 >= 2) describe KAM_BADPO Bad Purchase Orders or Financial Docs score KAM_BADPO 5.0 endif meta KAM_BADPO2 (__KAM_BADPO1 + __KAM_BADPO2 + T_HTML_ATTACH >= 3) describe KAM_BADPO2 Bad Purchase Orders score KAM_BADPO2 5.0 meta KAM_BADPDF3 (__KAM_BADPO2 >= 1) describe KAM_BADPDF3 Likely Fake PDF score KAM_BADPDF3 3.0 #PDFCOUNT #FAKE PDF READER/WRITE body __KAM_FAKEPDF1 /Download PDF Reader.Writer/is body __KAM_FAKEPDF2 /Reader 2010/is header __KAM_FAKEPDF3 From =~ /adobe/is header __KAM_FAKEPDF4 Subject =~ /reader.writer version 2010/is meta KAM_FAKEPDF (__KAM_FAKEPDF1 + __KAM_FAKEPDF2 + __KAM_FAKEPDF3 + __KAM_FAKEPDF4 >= 3) describe KAM_FAKEPDF Fake PDF Reader / Writer score KAM_FAKEPDF 4.0 #VACU AND VARIOUS PHISHING SCAMS #SUBJECTS header __KAM_PHISH2_1 Subject =~ /(VACU Message|Virgini?a Credit|Account Verification|account might be compromised|Account Status Notification|important.alert|payment.advice|important.update|card.declined)/i #BANKS body __KAM_PHISH2_2 /Virginia Credit Union|Lloyds|HSBC|usaa|barclay|credit card account/is #BAD LINKS rawbody __KAM_PHISH2_3 /https?:\/\/.{5,30}\.(kr|hk|edu|pl|ie|it|pro)\//i #STUPID STATEMENTS body __KAM_PHISH2_4 /unauthori[sz]ed use|security.enhancement|dropbox|hold.(on.)?your.fund/i body __KAM_PHISH2_5 /account suspension|temporary locked|temporarily.suspend|your.reference|accurately.detail/i body __KAM_PHISH2_6 /confirm your online banking details|payment.advice|online.fraud|billing.information/i body __KAM_PHISH2_7 /extra security check|security.tip/i describe KAM_PHISH2 Prevalent Phishing Scam emails score KAM_PHISH2 2.0 ifplugin Mail::SpamAssassin::Plugin::RaptorOnly meta KAM_PHISH2 (__KAM_PHISH2_1 + __KAM_PHISH2_2 >= 2) && ((__KAM_IPHTTP + __KAM_URIBL_PCCC + __KAM_PHISH2_3 >= 1) || (__KAM_PHISH2_4 + __KAM_PHISH2_5 + __KAM_PHISH2_6 + __KAM_PHISH2_7 >= 4)) else meta KAM_PHISH2 (__KAM_PHISH2_1 + __KAM_PHISH2_2 >= 2) && ((__KAM_IPHTTP + __KAM_PHISH2_3 >= 1) || (__KAM_PHISH2_4 + __KAM_PHISH2_5 + __KAM_PHISH2_6 + __KAM_PHISH2_7 >= 4)) endif #CRAZY HEX EMPTY MESSAGE body __KAM_HEX1 /^[a-f0-9]{8}(\b|$)/i header __KAM_HEX2 Subject =~ /^\d{5,6}$/ describe KAM_HEX Crazy Empty Hex Messages score KAM_HEX 5.5 meta KAM_HEX (__KAM_HEX1 + __KAM_HEX2 >= 2) #THE BAT! MAILER USED TOO MUCH FOR SPAM # I'VE LOOKED AT THIS AND JUST CAN'T ARGUE THAT IT LOOKS LIKE IT WILL HELP. header KAM_THEBAT X-Mailer =~ /The Bat!/i describe KAM_THEBAT Abused X-Mailer Header for The Bat! MUA score KAM_THEBAT 1.9 #MAILER BUGS body __KAM_MAILER1 /\{\!firstname_fix\}|\{\{email\}\}|\{\{name\}\}|\{id1?\}/i body __KAM_MAILER2 /(Hi|Dear) \[Recipient('s name)?\]/i meta KAM_MAILER ( __KAM_MAILER1 + __KAM_MAILER2 >= 1 ) score KAM_MAILER 2.0 describe KAM_MAILER Automated Mailer Tag Left in Email #YET ANOTHER NIGERIAN SCAM VARIANT body __KAM_CHECK1 /delivery fee for your che(que|ck) draft/i body __KAM_CHECK2 /let me know when you recieve your money/i describe KAM_CHECK Another Nigerian Bank Draft Scam score KAM_CHECK 3.0 meta KAM_CHECK (__KAM_CHECK1 + __KAM_CHECK2 + __KAM_REFI4 >= 3) #SEE OPRAH LIVE! body __KAM_OPRAH1 /airfare/i body __KAM_OPRAH2 /hotel/i body __KAM_OPRAH3 /oprah/i header __KAM_OPRAH4 Subject =~ /see\s+.*oprah\s+.*live/i describe KAM_OPRAH SPAMs re: Oprah Winfrey Show score KAM_OPRAH 2.5 meta KAM_OPRAH (__KAM_OPRAH1 + __KAM_OPRAH2 + __KAM_OPRAH3 + __KAM_OPRAH4 >= 4) #EBAY TIPS body __KAM_EBAY1 /Succeed on ebay|thousands with ebay|ebay success|money\-making secret/i body __KAM_EBAY2 /Auction success kit|Great Money Maker|documented program|Chuck Mullaney|more bills than money/i header __KAM_EBAY3 Subject =~ /ebay .*for dummies|ebay expert|work online|ebay business|secrets to ebay|Chuck Mullaney|living on ebay|build a business|huge cash flows/i describe KAM_EBAY SPAMs re: eBay Auction Tips score KAM_EBAY 3.5 meta KAM_EBAY (__KAM_EBAY1 + __KAM_EBAY2 + __KAM_EBAY3 >= 3) #GAS PRICES, GAS CARDS, OTHER FUEL-RELATED SPAM body __KAM_GAS1 /Gas prices are at an? all time high|\$\d per gallon|gasoline cards/i body __KAM_GAS2 /We have a solution|save \d+ cents per gallon|competitive rewards/i header __KAM_GAS3 Subject =~ /High Gas Prices|ripped off for gas|Save \d+c per gallon/i header __KAM_GAS4 From =~ /gas/i describe KAM_GAS SPAMs re: High Gas Prices score KAM_GAS 4.5 meta KAM_GAS (__KAM_GAS1 + __KAM_GAS2 + __KAM_GAS3 + __KAM_GAS4 >=3) #WEIRD BODY MESSAGES body KAM_BODY /{_BODY_HTML}/i score KAM_BODY 1.0 describe KAM_BODY Odd Erectile Dysfunction Messages with Poor Formatting #FREE TV, SATELLITE, CABLE INTERNET, ETC body __KAM_TV1 /watch unlimited television|DTV4PC|Online TV Code|Free DVD\-CD Burner|100% legal|Rabbit TV|reliable.cable.service|existing.smart.tv/i body __KAM_TV2 /without a monthly fee|pay a cable or satellite bill|no monthly fee|watch uncensored|movies online|no censorship|favorite.channels|online.television|\d{3}.channels|high.speed|sysview/i header __KAM_TV3 Subject =~ /watch uncensored tv|digital TV|internet TV|Free TV|tv online for free|(shows|movies).with.cable|less.than.dish|stream.*channels|\$\d{2}.mo|smart.tv/i header __KAM_TV4 From =~ /Unlock Internet TV|Movie Download|product alert|cable.tv|tv.stream|high.speed/i meta KAM_TV (__KAM_TV1 + __KAM_TV2 + __KAM_TV3 + __KAM_TV4 >= 2) score KAM_TV 3.0 describe KAM_TV Free TV/Cable/etc. Scams meta KAM_TV2 (KAM_TV + KAM_INFOUSMEBIZ >=2) score KAM_TV2 3.5 describe KAM_TV2 Higher probability of Free TV/Cable/etc. Spams #DEGREE SPAMS body __KAM_CAREER1 /Hospitals need you|Medical Billing and Coding|medical.coding/is body __KAM_CAREER2 /Get your Healthcare Degree|Billing and Coding degree|job.placement|great.opportunity|training.start(s|ing).soon|job.growth/is body __KAM_CAREER3 /unstable.economy|secure.a.position|fast.growing|extraordinary.benefits|work.from.home/is meta KAM_CAREER (__KAM_CAREER1 + __KAM_CAREER2 + __KAM_CAREER3 + KAM_ADVERT2 >= 3) score KAM_CAREER 5.0 describe KAM_CAREER Spam for Career/Diploma Mills #NURSE SPAMS header __KAM_NURSE1 From =~ /nursing|nurses|health.?care/i header __KAM_NURSE2 Subject =~ /nurses (?:are now in high.?demand|are needed)|become a nurse|open.position|training|cna.education/i body __KAM_NURSE3 /nurses (?:are NOW in high.?demand|are needed)|nursing Degree|indispensable.position|growing.career|nursing.assist|certified.nurs/i meta KAM_NURSE (__KAM_NURSE1 + __KAM_NURSE2 + __KAM_NURSE3 >= 3) score KAM_NURSE 3.0 describe KAM_NURSE Spam for Career/Diploma Mills #PILLS header __KAM_PILLS1 Subject =~ /save \d\d% on your (pills|drugs|medications)/i body __KAM_PILLS2 /be (thrifty|smart|clever), buy your (pills|drugs|medications)/i meta KAM_PILLS (__KAM_PILLS1 + __KAM_PILLS2 >=2) score KAM_PILLS 4.0 describe KAM_PILLS Spam for scam pharmacy #PILLS 2.0 header __KAM_PILLS2_1 From =~ /Enlarge|Men's Supplement/i header __KAM_PILLS2_2 From =~ /Free Sample/i meta KAM_PILLS2 (__KAM_PILLS2_1 + __KAM_PILLS2_2 >= 2) describe KAM_PILLS2 Male enhancement spams score KAM_PILLS2 2.5 #ALTERNATE EMAIL body __KAM_ALT1 /reply to my alternative E-?mail/is meta KAM_ALT (__KAM_ALT1 >= 1) score KAM_ALT 0.5 describe KAM_ALT Requests use of an alternate email which may indicate spam #POLITICAL SPAMS #AS WE ENTER AN ELECTION PERIOD, WE SEE UNSOLICITED MAILS FROM ORGS #Right vs Left header __KAM_POLITICS1 From =~ /Right vs Left|Minuteman|Senator|Pennsylvania Transportation Partners|Americans for Limited Government|special election|conservative|liberal|congress|judge|usa.?net|senate|fedup|sen\. |tea.party|the.right.to/i body __KAM_POLITICS2 /Minuteman Civil Defense Corps|National Campaign Fund|Right vs Left|Restore America PAC|penntransportation.com|getliberty.org|Americans for Limited Government|radical|true.conservative|true.liberal|job.killing|wasteful.spending|senate.takeover|liberal.agenda|smear.campaign|america.s future|liberty|obama|governor|election.day|v\-o\-t\-e|sign.the.petition|paid.for.by|dear.conservative|dear.liberal|winning.the.senate|election.cycle|return.power|failed.policy|(left|right).is.claiming|bigwigs|favorable.voters/i header __KAM_POLITICS3 Received =~ /\.politicalsystems\.net|republican\.com|democrat\.com|inboxfirst\.com/i header __KAM_POLITICS4 Subject =~ /alert:?.?election|(republican|democratic).party|and.vote|impeach|insanity|election.ad|liberals|conservatives|back.?room.deal|urgent.obama|social.security.mistake|big.social|absentee.info/i meta KAM_POLITICS (__KAM_POLITICS1 + __KAM_POLITICS2 + (__KAM_POLITICS3 + __KAM_POLITICS4 >= 1) >= 2) score KAM_POLITICS 3.75 describe KAM_POLITICS Political E-Mails #SPAMMING COMPANIES #Wall Street Media header __KAM_COMPANY1 From =~ /W\$[LM]( |_)(Insurance|Mortgage)( |_)New\$/i meta KAM_COMPANY1 (__KAM_COMPANY1 >= 1) score KAM_COMPANY1 5.0 describe KAM_COMPANY1 Egregious spammers that should also be on RBLs (and might be) #MGM,LLC body __KAM_COMPANY2_1 /Member Services MGM, LLC/is meta KAM_COMPANY2 (__KAM_COMPANY2_1 >= 1) score KAM_COMPANY2 5.0 describe KAM_COMPANY2 Egregious spammers that should also be on RBLs (and might be) #SpamEatingMoney's List ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ifplugin Mail::SpamAssassin::Plugin::RaptorOnly # SEM-FRESHZERO urirhssub SEM_FRESHZERO freshzero.spameatingmonkey.net. A 2 body SEM_FRESHZERO eval:check_uridnsbl('SEM_FRESHZERO') describe SEM_FRESHZERO Contains a domain never seen before tflags SEM_FRESHZERO net score SEM_FRESHZERO 0.25 # SEM-FRESH urirhssub SEM_FRESH fresh.spameatingmonkey.net. A 2 body SEM_FRESH eval:check_uridnsbl('SEM_FRESH') describe SEM_FRESH Contains a domain registered less than 5 days ago tflags SEM_FRESH net score SEM_FRESH 0.5 # SEM-FRESH10 urirhssub SEM_FRESH10 fresh10.spameatingmonkey.net. A 2 body SEM_FRESH10 eval:check_uridnsbl('SEM_FRESH10') describe SEM_FRESH10 Contains a domain registered less than 10 days ago tflags SEM_FRESH10 net score SEM_FRESH10 0.25 # Use same score for SEMFRESH and FMBLA rbls score FROM_FMBLA_NEWDOM 1.25 score FROM_FMBLA_NEWDOM14 1.0 score FROM_FMBLA_NEWDOM28 0.75 meta KAM_SEMFRESH (SEM_FRESHZERO || SEM_FRESH || SEM_FRESH10 || FROM_FMBLA_NEWDOM || FROM_FMBLA_NEWDOM14 || FROM_FMBLA_NEWDOM28 ) describe KAM_SEMFRESH Contains a domain recently registered tflags KAM_SEMFRESH net score KAM_SEMFRESH 0.001 endif endif ifplugin Mail::SpamAssassin::Plugin::URIDNSBL #PCCC WILD RBL, URIBL Check for bad URIs in body, Received, From and Reply-to #Thanks to AXB for his help with these! # allow URI rules to look at DKIM headers if they exist and our SA version supports it if (version >= 3.004001) parse_dkim_uris 1 endif # Check mailto links on rbl ifplugin Mail::SpamAssassin::Plugin::RaptorOnly if can(Mail::SpamAssassin::Plugin::URIDNSBL::has_uridnsbl_skip_mailto) uridnsbl_skip_mailto 0 endif endif #LAUNCH PCCC WILD RBL #2013-10-09 Note # #These RBL's below can contain domains that can cause collateral damage. #We try and only add these domains when the evidence is overwhelming and points to a culture or architecture prone to spaminess. #And this can include services that have legitimate and illegitimate users; servers for legitimate firms that are compromised; and hosting firms which fail to have adequate anti-spam procedures. #The lists have high scores which we believe are consistent with the veracity of the research used to compile the lists. #Additionally, we ONLY use this RBL to improve our scoring and it is not used to block emails outright. #However, your mileage may very and you might want to seriously dial down the scores especially if you do block/reject/blackhole emails. #Feedback is appreciated and requests to de-list can be sent via https://raptor.pccc.com/raptor.cgim?template=report_problem #Or to explicitly skip RBL testing for a domain, use uridnsbl_skip_domain example.com ifplugin Mail::SpamAssassin::Plugin::RaptorOnly # match on any Wild rbl rule excluding Marketing rbl meta __KAM_WILD_PCCC ( KAM_BODY_URIBL_PCCC || PCCC_BAD_FREE_URI || KAM_FROM_URIBL_PCCC || KAM_BODY_COMPROMISED_URIBL_PCCC || KAM_FROM_COMPROMISED_URIBL_PCCC || KAM_MESSAGE_HASHBL_FREEMAIL || PCCC_HDR_REPLYTO || PCCC_SENDER_COMPROMISED || PCCC_RECEIVED_HDR_COMPROMISED || PCCC_FROM_BAD_NS || PCCC_HASHBL_FREEMAIL || PCCC_HASHBL_EMAIL || PCCC_HASHBL_SHORT_URI || PCCC_HASHBL_LISTID || GB_PHONE_RBL || GB_PHONE_RBL_RAW ) endif #BAD URI IN BODY urirhssub KAM_BODY_URIBL_PCCC wild.pccc.com. A 127.0.0.4 body KAM_BODY_URIBL_PCCC eval:check_uridnsbl('KAM_URIBL_PCCC') describe KAM_BODY_URIBL_PCCC Body contains URI listed in PCCC WILD RBL (https://raptor.pccc.com/RBL) tflags KAM_BODY_URIBL_PCCC net score KAM_BODY_URIBL_PCCC 9.0 if (version >= 3.004001) #BAD URI IN FROM #all from addresses domains - This is a new check available in 3.4.1-rc1+ which will check bob.com for something like bob@test.bob.com - The old code did not properly handle octet subtests header KAM_FROM_URIBL_PCCC eval:check_rbl_from_domain('pccc-from-uribl', 'wild.pccc.com.', '127.0.0.4') describe KAM_FROM_URIBL_PCCC From address listed in PCCC WILD RBL (https://raptor.pccc.com/RBL) tflags KAM_FROM_URIBL_PCCC net score KAM_FROM_URIBL_PCCC 9.0 endif urirhssub PCCC_BAD_FREE_URI wild.pccc.com. A 127.0.0.6 body PCCC_BAD_FREE_URI eval:check_uridnsbl('PCCC_BAD_FREE_URI') describe PCCC_BAD_FREE_URI Body contains URI listed in PCCC WILD RBL (https://raptor.pccc.com/RBL) tflags PCCC_BAD_FREE_URI net score PCCC_BAD_FREE_URI 2.5 #MARKETING IN BODY - MARKETING RBL IS PRIMARILY FOR META TESTS urirhssub KAM_BODY_MARKETINGBL_PCCC wild.pccc.com. A 127.0.0.32 body KAM_BODY_MARKETINGBL_PCCC eval:check_uridnsbl('KAM_MARKETINGBL_PCCC') describe KAM_BODY_MARKETINGBL_PCCC Body contains URI associated with mass-marketing (https://raptor.pccc.com/RBL) tflags KAM_BODY_MARKETINGBL_PCCC net score KAM_BODY_MARKETINGBL_PCCC 0.001 if (version >= 3.004001) #MARKETING IN FROM header KAM_FROM_MARKETINGBL_PCCC eval:check_rbl_from_domain('pccc-marketing', 'wild.pccc.com.', '127.0.0.32') describe KAM_FROM_MARKETINGBL_PCCC From address associated with mass-marketing (https://raptor.pccc.com/RBL) tflags KAM_FROM_MARKETINGBL_PCCC net score KAM_FROM_MARKETINGBL_PCCC 0.001 meta KAM_MARKETINGBL_PCCC (KAM_BODY_MARKETINGBL_PCCC || KAM_FROM_MARKETINGBL_PCCC) describe KAM_MARKETINGBL_PCCC Message contains URI associated with mass-marketing (https://raptor.pccc.com/RBL) score KAM_MARKETINGBL_PCCC 1.0 tflags KAM_MARKETINGBL_PCCC net endif if (version >= 3.004001) #Compromised URI - In Body urirhssub KAM_BODY_COMPROMISED_URIBL_PCCC wild.pccc.com. A 127.0.1.2 body KAM_BODY_COMPROMISED_URIBL_PCCC eval:check_uridnsbl('KAM_URIBL2_PCCC') describe KAM_BODY_COMPROMISED_URIBL_PCCC Body contains URI listed in PCCC Compromised URIBL (https://raptor.pccc.com/RBL) tflags KAM_BODY_COMPROMISED_URIBL_PCCC net score KAM_BODY_COMPROMISED_URIBL_PCCC 9.0 #Contains a likely good URI but otherwise compromised by malware/hackers header KAM_FROM_COMPROMISED_URIBL_PCCC eval:check_rbl_from_domain('pccc-compromised-uribl', 'wild.pccc.com.', '127.0.1.2') describe KAM_FROM_COMPROMISED_URIBL_PCCC From address listed in PCCC Compromised URIBL (https://raptor.pccc.com/RBL) tflags KAM_FROM_COMPROMISED_URIBL_PCCC net score KAM_FROM_COMPROMISED_URIBL_PCCC 9.0 #Welcome List URI - In Body header __RAPTOR_LOOP To =~ /raptorloopback\@raptor\.us/ urirhssub __KAM_BODY_WELCOMELIST_URIBL_PCCC wild.pccc.com. A 127.0.1.8 body __KAM_BODY_WELCOMELIST_URIBL_PCCC eval:check_uridnsbl('KAM_URIBL2_PCCC') meta KAM_BODY_WELCOMELIST_URIBL_PCCC ( !__RAPTOR_LOOP && __KAM_BODY_WELCOMELIST_URIBL_PCCC ) describe KAM_BODY_WELCOMELIST_URIBL_PCCC Body contains URI listed in PCCC Welcome List URIBL (https://raptor.pccc.com/RBL) tflags KAM_BODY_WELCOMELIST_URIBL_PCCC net nice score KAM_BODY_WELCOMELIST_URIBL_PCCC -7.0 endif #Rules in Testing #PCCC Wild RBL Received - Currently disabled for more research on FPs #header KAM_RCVD_URIBL_PCCC eval:check_rbl_sub('pccc', '^127\.0\.0\.4$') #describe KAM_RCVD_URIBL_PCCC Received header contains URL listed in PCCC WILD RBL (https://raptor.pccc.com/RBL) #tflags KAM_RCVD_URIBL_PCCC net #score KAM_RCVD_URIBL_PCCC 5.0 #Test for any hits on PCCC WILD RBL Rules meta __KAM_URIBL_PCCC (KAM_BODY_URIBL_PCCC + KAM_FROM_URIBL_PCCC >= 1) #Test for URIBL Black and Spamhaus DBL per discussion with Alex Broens meta KAM_VERY_BLACK_DBL (URIBL_BLACK && URIBL_DBL_SPAM) describe KAM_VERY_BLACK_DBL Email that hits both URIBL Black and Spamhaus DBL score KAM_VERY_BLACK_DBL 5.0 tflags KAM_VERY_BLACK_DBL net endif #LAUNCH PCCC WILD RBL #EMAIL BLACKLIST CHECK FOR PCCC WILD RBL if (version >= 3.004003) ifplugin Mail::SpamAssassin::Plugin::HashBL header KAM_MESSAGE_HASHBL_FREEMAIL eval:check_hashbl_emails('wild.pccc.com', 'md5/max=10/shuffle', 'ALLFROM/Reply-To/Resent-from/body', '^127\.0\.0\.64', 'freemail') describe KAM_MESSAGE_HASHBL_FREEMAIL Message contains freemail address listed in PCCC WILD RBL (https://raptor.pccc.com/RBL) tflags KAM_MESSAGE_HASHBL_FREEMAIL net score KAM_MESSAGE_HASHBL_FREEMAIL 10.0 endif endif ifplugin Mail::SpamAssassin::Plugin::FreeMail header __GB_FREEMAIL_NUM0 From:addr =~ /[a-z]\.?\d{4}\@(gmail|hotmail|icloud|yahoo)\.com/i header __GB_FREEMAIL_NUMN0 From:addr =~ /[a-z]\.?(?:19|20)\d{2}\@(gmail|hotmail|icloud|yahoo)\.com/i header __GB_FREEMAIL_NUM1 From:addr =~ /[a-z]\.?(?:\d{3}|\d{5,10})\@(gmail|hotmail|icloud|yahoo)\.com/i header __GB_FREEMAIL_NUMN1 From:addr =~ /[a-z]\.?(?:123|321|456)\@(gmail|hotmail|icloud|yahoo)\.com/i header __GB_FREEMAIL_NUM2 From:addr =~ /[a-z]\.?(?:\d+)(?:[a-z])+(?:\d{3,10})\@(gmail|hotmail|icloud|yahoo)\.com/i meta GB_FREEMAIL_NUM ( ( __GB_FREEMAIL_NUM0 && ! __GB_FREEMAIL_NUMN0 ) || ( __GB_FREEMAIL_NUM1 && ! __GB_FREEMAIL_NUMN1 ) || __GB_FREEMAIL_NUM2 ) describe GB_FREEMAIL_NUM Freemail spammy address score GB_FREEMAIL_NUM 0.75 header __GB_FREEMAIL_GMAIL From:addr =~ /\@gmail\.com/i meta GB_GMAIL_NUM ( GB_FREEMAIL_NUM && __GB_FREEMAIL_GMAIL && ( KAM_DMARC_NONE || KAM_DMARC_QUARANTINE ) ) describe GB_GMAIL_NUM Spam from random Gmail address score GB_GMAIL_NUM 2.0 header __GB_FROM_CONSONANTS From =~ /^[^aeiou0-9]{8,24}\@/i meta GB_FROM_CONSONANTS ( __GB_FROM_CONSONANTS && FREEMAIL_FROM ) describe GB_FROM_CONSONANTS From: localpart with only consonants and freemail domain score GB_FROM_CONSONANTS 1.0 rawbody __GB_COLORTEXT /font\-family\:.{1,64};color\:/ meta GB_FREEMAIL_TEXTCOLOR ( GB_FREEMAIL_NUM && __GB_COLORTEXT && __KAM_BODY_LENGTH_LT_1024 ) describe GB_FREEMAIL_TEXTCOLOR Colored text spam from Freemail addresses score GB_FREEMAIL_TEXTCOLOR 1.5 endif ifplugin Mail::SpamAssassin::Plugin::RaptorOnly # SNB Hashbl freemail rbl not handled in KAM.cf else ifplugin Mail::SpamAssassin::Plugin::HashBL if can(Mail::SpamAssassin::Plugin::HashBL::has_hashbl_alldomains) header SNB_HASHBL_FREEMAIL eval:check_hashbl_emails('freemailbl-s.snb.it', 'md5/max=10/shuffle/alldomains', 'ALLFROM/Reply-To/body', '^127\.0\.0\.1', 'freemail') else if (version >= 3.004003) header SNB_HASHBL_FREEMAIL eval:check_hashbl_emails('freemailbl-s.snb.it', 'md5/max=10/shuffle', 'ALLFROM/Reply-To/body', '^127\.0\.0\.1', 'freemail') describe SNB_HASHBL_FREEMAIL Message contains email address found on SNB Freemail HashBL tflags SNB_HASHBL_FREEMAIL net score SNB_HASHBL_FREEMAIL 7.5 priority SNB_HASHBL_FREEMAIL -100 endif endif endif endif #FREEMAIL SPAMMY ADDRESSES IN UNWANTED LANGUAGES ifplugin Mail::SpamAssassin::Plugin::RaptorOnly meta GB_UNWANTED_FREE_NUM ( GB_FREEMAIL_NUM && UNWANTED_LANGUAGE_BODY ) describe GB_UNWANTED_FREE_NUM Freemail spammy address and unwanted language score GB_UNWANTED_FREE_NUM 3.0 meta GB_UNWANTED_GM_UNDIS ( __TO_UNDISCLOSED && __GB_FREEMAIL_GMAIL && UNWANTED_LANGUAGE_BODY ) describe GB_UNWANTED_GM_UNDIS Gmail email to undisclosed recipients in an unwanted language score GB_UNWANTED_GM_UNDIS 1.0 endif #FAKERBL MX RELATED RULES header __KAM_MX1 Reply-To =~ /\@mx\d+\./i header __KAM_MX2 Return-Path =~ /\@mx\d+\./i #Removing mta due to FP on 5-5-2025 header __KAM_MX3 Received =~ /(\(|\b)(?<!o\d\.)(pet|ptr|tech|host|mx|vps|vsp|colo|sox)\d+\./i header __KAM_MX4 Received =~ /(\(|\b)[0-9A-F]{8}\.ptr\./i # Thanks to Markus Clardy for feedback! header __KAM_MX5 Received =~ /(\(|\b)[a-z]{2,4}[0-9]{1,3}\.[^\s]{1,20}\.info\b/i meta __KAM_MX (__KAM_MX1 + __KAM_MX2 + __KAM_MX3 + __KAM_MX4 + __KAM_MX5 >= 1) describe __KAM_MX Odd prevalence of mx records associated with the FAKERBL Spammers #CHANGED RaptorOnly ifplugin Mail::SpamAssassin::Plugin::RaptorOnly meta KAM_MX (__KAM_MX + (__KAM_URIBL_PCCC + URIBL_BLACK >=1) >= 2) score KAM_MX 4.0 describe KAM_MX Spammers and MX Rule endif meta KAM_MXINFO (__KAM_MX5) score KAM_MXINFO 1.0 describe KAM_MXINFO MX Record and dot info domains associated with FAKERBL Spammers #BAD NAMES #Disabled 2024-11-12 as they are not used in any metas #body __KAM_BADNAME1 /CocoMedia|CMI Free Stuff|Vista Del Mar Productions|by SuperClub|Buil tech Services|eMarketing Alliance|aSHARPi Media|Satell Center for Executive Education|Pacific Shores Investments|R. Allen Media|The Only Virginia Team|Ban Amnesty Now|Intrust Domains|New Heights Development and Research|Red Base Interactive|RateMarketplace|WORLD COMPANY REGISTER|Mobie Concepts, Inc.|Clickingz IT Research Lab|Leadz[,\.].?Co|Pimsleur Approach|Business Who's Who|Who's Who Among Executives|Buena Vista Catalogue|Ashray Medical Center|Bethany Christian Services|Preston Energy|SteelCityAds|Beyond Human, LLC|Research Promo Center|OmegaK, Inc|Momentum.Ads|Dove Lighting Co|BrandRoot SEO|Team TPW|WEB ANALYTICS MEDIA LLC/i #header __KAM_BADNAME2 From =~ /CMI Free Stuff|Vista Del Mar Productions|Buil tech Services|eMarketing Alliance|aSHARPi Media|Plaza Neptuno|Satell Center for Executive Education|Pacific Shores Investments|rx ?unit|R. Allen Media|The Only Virginia Team|Intrust Domains|American Arbitration Association|Rate\.?Marketplace|Health.Quote.Direct|Pimsleur|Ethika Politika|Disney Movie Club/i #GRASS SEED header __KAM_GRASS1 From =~ /(Patch|Perfect|Lawn)/i header __KAM_GRASS2 Subject =~ /rich beautiful lawn|grow grass|grass seed on steroids/i body __KAM_GRASS3 /Grass Seed On Steroids|rich beautiful lawn|Patch Perfect Seeds|Grow Grass (anywhere|in the shade)/i meta KAM_GRASS (__KAM_GRASS1 + __KAM_GRASS2 + __KAM_GRASS3 >= 3) score KAM_GRASS 2.5 describe KAM_GRASS Spammers hawking lawn products #PED EGG / BELISI / SKIN PRODUCTS header __KAM_SKIN1 From =~ /(Ped ?Egg|Healthy Feet|beautiful feet|belisi|skin tightener|medical|Wrinkle|Face ?Lift|Skin Reju|Nuforia|LifeCEll|Miracle Hydrate|beauty tip|lifestyle lift|marine essentials|nufori?a)|skin transformer|lifecell|oz.show|botox|your.skin|rejuvenate|youth/i header __KAM_SKIN2 Subject =~ /Ped ?Egg|Healthy Feet|beautiful feet|tighter skin|works for wrinkles|Sera Concepts|Wrinkle Eraser|\d\d years younger|Hollywood(?:'s)? Secret|years younger|perfect skin|anti.?aging|look younger in \d+ day|regain your youthful|years off your appear|flawless.skin|youthful appear|fine.lines|collagen.production|dark.circles|your.skin|looks?.like.this|looks?.great|images?.leaked|looks.\d|ellen.looks/i rawbody __KAM_SKIN3 /Ped ?Egg|Belisi|Botox|Gabamed|Sera Concepts|Purelift|nuforia|natural collagen|complimentary trials|nugenics|marine essentials|Nufori?a|ellen.has.a|flawless.skin|phyto|facelift|hype.is.real|celeb.trend|twenty.years.younger|face.lift|pics.leaked|rejuvenate/i body __KAM_SKIN4 /feet feel smooth and healthy|calluses and dead skin|silky smooth skin|tighter skin|\d.years.younger|anti[- ]aging|look younger|free trial|lose 25 years|angered plastic surge|quick and easy trick|anti-?aging|blood pressure low|heart rate monitor|selfies|just.one.month|just.four.weeks|medical.research|rebuild.your.skin|decades.younger|erase.time|gossip|smooth.lines/i meta KAM_SKIN (KAM_ADVERT2 + __KAM_SKIN1 + __KAM_SKIN2 + __KAM_SKIN3 + __KAM_SKIN4 + __KAM_TRIAL + __KAM_OZ1 + __KAM_OZ2 + __KAM_OZ3 >= 3) score KAM_SKIN 3.5 describe KAM_SKIN Spammers hawking skin/medical/foot products meta KAM_SKIN2 (KAM_ADVERT2 + __KAM_SKIN1 + __KAM_SKIN2 + __KAM_SKIN3 + __KAM_SKIN4 + __KAM_TRIAL + __KAM_OZ1 + __KAM_OZ2 + __KAM_OZ3 >= 4) score KAM_SKIN2 2.5 describe KAM_SKIN2 Spammers hawking skin/medical/foot products #NEW CAR / WARRANTY SCAMS header __KAM_CAR1 Subject =~ /(save thousands|vehicle warranty|paying too much for auto|skyrocketing cost of car|car deals|deal on a new car|cheap(er)? auto insurance|warranty options|afford the car|blowout|auto repair bills)/i body __KAM_CAR2 /buying a new car|dream car|new car you want|free auto insurance(?:-| )quote|save money on your auto|roadside assistance|extended warranty/i body __KAM_CAR3 /unbelievable payment terms|no commitment|free price quote|get competitive quotes|offering better rates|no obligation quote|Pay Later|No risk|save up to \d+%/i header __KAM_CAR4 From =~ /warranty|lender|clearance/i meta KAM_CAR (__KAM_CAR1 + __KAM_CAR2 + __KAM_CAR3 + __KAM_CAR4 >= 2) score KAM_CAR 2.0 describe KAM_CAR Spammers hawking new car, insurance or warranties # MORE NEW CAR SPAMS header __KAM_AUTO1 Subject =~ /new.vehicle|biggest.discounts|clearance.event|must.go|half.off.auto|blue.book|cars.priced|dirt.cheap|new.car|new.truck|half.off|dealership|dealers.compete|trade.it.in|auto(motive)?.parts|inventory.must.go|\d\d%.off.msrp|all \d\d\d\d.s must go|time.to.drive|all.vehicle|clearance.pric|all.\d\d\d\d.(cars|trucks)/i header __KAM_AUTO2 From =~ /car.?saving|auto.?deals|%.off|half.(off|price)|ford|gm|clearing.lots|model.year|latest.auto|dealership|clearance|cars?.discount|\d+.model|\d+.half.off|auto.price|best.auto|motor|trade.in|auto.part|imotor|autotrend/i body __KAM_AUTO3 /(car|truck).dealer|clearance.price|shop.cars|\d+.vehicles|dealership|deep.discount|liquidating|vehicle.options|auto.news|old.clunker|dream.car|clearance.inventory|dealer.clearance|special.clearance|auto(mobile?).recall|clearance.pric|new.ride|dealers.{1,40}.scrambling|sell.yours.for.more|car.is.worth|auto.parts.brand|blowout|incredible.discount/i meta KAM_AUTO (__KAM_AUTO1 + __KAM_AUTO2 + __KAM_AUTO3 + (KAM_COUK || KAM_OTHER_BAD_TLD || CBJ_GiveMeABreak) >= 3) describe KAM_AUTO Spam for new cars score KAM_AUTO 4.5 #HOME WARRANTY SPAMS header __KAM_WARRANTY1 Subject =~ /home warrant|protect your home|home repair|homeowners insurance|repairing your house|have you covered/i body __KAM_WARRANTY2 /Protect your home|choice home warranty|unexpected repair/i body __KAM_WARRANTY3 /home warrant|complimentary insurance quote/i header __KAM_WARRANTY4 From =~ /Choice.?Home.?Warrant|TotalProtect|home.?Insurance|CHW Home Warranty|AHS.warranty/i meta KAM_WARRANTY (__KAM_WARRANTY1 + __KAM_WARRANTY2 + __KAM_WARRANTY3 + __KAM_WARRANTY4 + CBJ_GiveMeABreak >= 3) score KAM_WARRANTY 1.5 describe KAM_WARRANTY Spammers hawking home warranties meta KAM_WARRANTY2 (KAM_WARRANTY + KAM_INFOUSMEBIZ >= 2) score KAM_WARRANTY2 3.5 describe KAM_WARRANTY2 Spammers pushing home warranties meta KAM_WARRANTY3 (__KAM_WARRANTY1 + __KAM_WARRANTY2 + __KAM_WARRANTY3 + __KAM_WARRANTY4 + CBJ_GiveMeABreak >= 4) score KAM_WARRANTY3 1.5 describe KAM_WARRANTY3 Spammers hawking home warranties #AWESOME AUGER header __KAM_AUGER1 Subject =~ /Dig Holes|plant Trees/i body __KAM_AUGER2 /Awesome Auger/i meta KAM_AUGER (__KAM_AUGER1 + __KAM_AUGER2 >= 2) score KAM_AUGER 4.0 describe KAM_AUGER Spammers hawking Awesome Augers?!? #MOVIE EXTRA header __KAM_MOVIE1 Subject =~ /Movie Extra/i body __KAM_MOVIE2 /Movie Extra/i meta KAM_MOVIE (__KAM_MOVIE1 + __KAM_MOVIE2 >= 2) score KAM_MOVIE 3.0 describe KAM_MOVIE Spammers hawking Movie Extra positions #DEBT COLLECTION header __KAM_COLLECT1 Subject =~ /You Pay Nothing/i body __KAM_COLLECT2 /No Fee/i body __KAM_COLLECT3 /collection professionals/i body __KAM_COLLECT4 /recovery rate/i meta KAM_COLLECT (__KAM_COLLECT1 + __KAM_COLLECT2 + __KAM_COLLECT3 + __KAM_COLLECT4 + __KAM_SEARCH5 + KAM_ADVERT2 >= 4) score KAM_COLLECT 5.0 describe KAM_COLLECT Spammers hawking debt collection #SEARCH ENGINE SPAM #Subj header __KAM_SEARCH1 Subject =~ /be seen first on (google|msn|yahoo)|get ranked high|rank high|(no cost|free) website (analysis|search engine)|WEBSITE PROMOTION|social media|blog leads|infotech|(first|1st)(.page)?.result|seo.(optimiz|package|service)|seo.{1,30}expert|on.your.website|organic.seo|site.ranking|website.health|(first|1st) page|^proposal$|marketing proposal|top (o|i)n google|looking for an SEO|web design|on page 1|top rank|info & cost|seo$|\(SEO\)/i #what specific body __KAM_SEARCH2 /search (ranking|engine)|S\.?E\.?O|bring.traffic|business.development|marketing (manager|strateg)/i tflags __KAM_SEARCH2 nosubject #ranking body __KAM_SEARCH3 /(first on|all of) the major search|not ranked number one|Website promotion|popular keywords|mobile.website|complete.solution|back.link|company in india|india.based|\(India\)|surfing|not.ranking.on|(?:top in|page \d\-\d of) Google|1st page|more (clients|customers)|organic search|generate leads|specialization includes SEO|rank on page (1|one)|top page ranking|white.?hat SEO/i tflags __KAM_SEARCH3 nosubject #how body __KAM_SEARCH4 /guaranteed type of exposure|free website (analysis|report|search engine optimiz)|increase your revenue|improve your website traffice|website rank higher|marketing service|popular.keyword|media.presence|media.portal|brand.awareness|analytics.certified|optimized.content|white.label|website.optimization|digital.marketing|in.your.industry|high.revenue|plans? and pric|keyword|full proposal|online reputation|(blog|article|pr|search engine) (promotion|submission)|competitive quote|send you (our past work|quote)|website audit|seo (package|campaign)|package for \d+ keyword|website\'s high rank/i #who rawbody __KAM_SEARCH5 /Click2Call|a1-solutions|fast-response.net|action-pros.net|tops-1.com|vividinfotech.com|internet.marketing|web.solution|(development|marketing|business) (executive|consultant)|(search engine|SEO) (company|consultant|expert|Service)|(marketing|sales) manager/i #Obfu - AUTOMATIC SPAM header __KAM_SEARCH6 Subject =~ /Ist page of google/i meta KAM_SEARCH ( __KAM_SEARCH6 ) || ( __KAM_SEARCH1 + __KAM_SEARCH2 + __KAM_SEARCH3 + __KAM_SEARCH4 + __KAM_SEARCH5 + FREEMAIL_FROM >= 5 ) score KAM_SEARCH 7.5 describe KAM_SEARCH Spammers hawking SEO #SEO header __KAM_SEO1 Subject =~ /Idea for \[|can rank 1st on Google|Organic SEO|SEO (solution|rank|portfolio|proposal)|integrated marketing|optimization.service|SEO Outsourcing|affordable package|quick result|ranking report|why your website|getting online sales|send you quot|1st page on google/i #what we give you body __KAM_SEO2 /(?:top|(1st|first) page) (?:in|of) (?:Google|MSN|Yahoo|Bing)|rank number one|top page rank|guarantee you 1st|link.building|business SEO|(audit|ranking) report|higher search rank|top \d+ search engine rank|top rank(ings?)? (on|in) Google|free audit report|new clients every day/i tflags __KAM_SEO2 nosubject #what we do/fix body __KAM_SEO3 /(came across|never find) your web.?site|major search engines|paid access to tools|WEBSITE AUDIT REPORT|specific.keyword|targeted.email|visited.your.website|not ranking well|Google rankings|issues bugging your website|increase your organic traffic|targeted keywords on page|your website rank/i #SEO body __KAM_SEO4 /SEO Specialists|online marketing services|S.?E.?O.? Company in INDIA|google.panda|google.penguin|not.ranking|SEO Packages/i #costs body __KAM_SEO5 /more traffic guaranteed|results in thirty day|top 5 organic|high revenue|free.analysis|guaranteed.top|price.?list|completely free|No upfront fees|free trial|(plan of action|proposal) for your website/i #SEO Indicators body __KAM_SEO6 /will not get your website banned|Google.?s SEO policies|six month ongoing campaign|web.promotion|quality junk spam|promotional online marketing|panda.?safe|digital marketing/i # LEGITIMATE SEO EMAILS WOULD SURELY HAVE AT LEAST ONE URL TO THEIR WEBSITE... uri __KAM_SEO7 /./ meta KAM_SEO (__KAM_SEO1 + __KAM_SEO2 + __KAM_SEO3 + __KAM_SEO4 + __KAM_SEO5 + __KAM_SEO6 + !__KAM_SEO7 + KAM_ADVERT2 >= 5) score KAM_SEO 7.0 describe KAM_SEO Spammers hawking SEO meta KAM_SEO2 ( __KAM_SEO2 + !__KAM_SEO7 + FREEMAIL_FROM >= 3 ) describe KAM_SEO2 Spammers hawking SEO score KAM_SEO2 4.5 #ABUSED FREEMAIL ACCOUNTS #header __KAM_FREEMAIL1 From =~ /(?:websolution|seo).{0,15}\@gmail.com/i #header __KAM_FREEMAIL2 From =~ /speakeasylingerie\@gmail.com/i #meta __KAM_FREEMAIL (__KAM_FREEMAIL1 + __KAM_FREEMAIL2 >= 1) #LINGERIE VIDEOS #header __KAM_LINGERIE1 From =~ /lexi campbell/i #header __KAM_LINGERIE2 Subject =~ /Exotic modeling Videos/i #header __KAM_LINGERIE3 Subject =~ /Hustler Magazine/i #body __KAM_LINGERIE4 /Exotic modelling videos/i #meta KAM_LINGERIE (__KAM_FREEMAIL + __KAM_LINGERIE1 + __KAM_LINGERIE2 + __KAM_LINGERIE3 >= 4) #score KAM_LINGERIE 10.0 #describe KAM_LINGERIE Sexually Explicity Lingerie Spam #WEB DESIGN header __KAM_WEB1 Subject =~ /(app|Web(site)?|software).?(proposal|Design|programming|Development)/i #service body __KAM_WEB2 /indian?.based.(web|it)|certified.it.company|offering Website Design|(expert|based) in india|software development.{0,2}firm|develop your web|(app|android|pad|phone) development/i tflags __KAM_WEB2 nosubject #title body __KAM_WEB3 /Online Marketing (Executive|Consultant)|possible.redesign|seo.service|mobiles?.app|business.develop|commerce.solution/i meta KAM_WEB (__KAM_WEB1 + __KAM_WEB2 + __KAM_WEB3 + (FREEMAIL_FROM + KAM_ADVERT2 >= 1) >= 4) score KAM_WEB 6.0 describe KAM_WEB Web/App design / SEO spams #DOMAIN NAME AND OTHER RELATED SPAMS body __KAM_DOMAIN1 /Domain (opportunity|notification|release|Availability|club)|Notification for Domain|availability.notice|time.draws.near|submit.a.bid|exclusive.rights|free.registration|the.domain.provider|website.wizard|increase.your.{0,50}.traffic|domain.extension|brand.can.leverage|like.to.obtain|buy(ing)?.this.domain/i body __KAM_DOMAIN2 /(?:available|listed) (?:by|for|at|in) auction|confirm interest in (this domain|owning)|capturing this domain|proposal.on.the.domain|exclusive.owner|online.search|web.form|counting.down|potential.buyer|interested.parties|secure.{1,50}.today|drive.more.leads|targeted.traffic|similar.domain|exclusive.regis/i body __KAM_DOMAIN3 /(?:have|own) a domain (that is )?.{0,5}similar|(have|own) a similar domain|offer on the Domain|similar to your (current )?domain|Domain Division|all.domains|main.webpage|visibility.platform|solicitation|potential.owner|your.offer|domain.match|domain.notification|domain.will.be|interest.{1,20}.domain.name|fully.responsive|website.included|list.your.website|opportt?unity.regarding|courtesy.notification/i header __KAM_DOMAIN4 From =~ /domain|submit.site/i #header __KAM_DOMAIN5 Subject =~ /\.com$/i meta KAM_DOMAIN (__KAM_DOMAIN1 + __KAM_DOMAIN2 + __KAM_DOMAIN3 + (__KAM_DOMAIN4 + FREEMAIL_FROM >= 1) >= 4) score KAM_DOMAIN 8.5 describe KAM_DOMAIN Domain Selling Spams #MEDICAL TOURISM SPAM body __KAM_MEDTOUR1 /medical.tourism/i body __KAM_MEDTOUR2 /lowest cost in India/i header __KAM_MEDTOUR3 Subject =~ /Medical.Tourism/i meta KAM_MEDTOUR (__KAM_MEDTOUR1 + __KAM_MEDTOUR2 + __KAM_MEDTOUR3 >= 3) score KAM_MEDTOUR 3.0 describe KAM_MEDTOUR Medical Tourism Spam #ACNE SPAM header __KAM_ACNE1 Subject =~ /Proactiv/i header __KAM_ACNE2 From =~ /Acne/i body __KAM_ACNE3 /proactiv/i body __KAM_ACNE4 /Online Gift Rewards/i meta KAM_ACNE (__KAM_ACNE1 + __KAM_ACNE2 + __KAM_ACNE3 + __KAM_ACNE4 >= 4) score KAM_ACNE 5.0 describe KAM_ACNE Spammers hawking Acne products #SOFTWARE SPAM header __KAM_SOFTWARE1 Subject =~ /fix Windows File Errors/i header __KAM_SOFTWARE2 From =~ /registry/i body __KAM_SOFTWARE3 /Fix file errors/i body __KAM_SOFTWARE4 /download for no cost|FREE Software|Free Analysis|Free Report/i meta KAM_SOFTWARE (__KAM_SOFTWARE1 + __KAM_SOFTWARE2 + __KAM_SOFTWARE3 + __KAM_SOFTWARE4 >= 4) score KAM_SOFTWARE 5.0 describe KAM_SOFTWARE Spammers hawking Software products #NIGERIAN SCAM SCAN header __KAM_NIGERIAN2_1 Subject =~ /high court|contact fedex courier|WIRE TRANSFER/i body __KAM_NIGERIAN2_2 /barrister|director of central bank|bank director|former.minister|gold.dealer/i body __KAM_NIGERIAN2_3 /high court|central bank|payment center|customs?.officer/i body __KAM_NIGERIAN2_4 /e\-?mail id is found among those that have been scammed|paid the fee for your cheque draft|contact the bank director/i body __KAM_NIGERIAN2_5 /fund code|cheque|bank draft|oil.and.gas/i body __KAM_NIGERIAN2_6 /full contact information requested|need your contacts informations|your bank account information|out.of.the.country/i body __KAM_NIGERIAN2_7 /bank|smuggle/i body __KAM_NIGERIAN2_8 /courier|diplomat agent|direct wire transfer|my.gold|the.gold/i body __KAM_NIGERIAN2_9 /scam|don't let them know that it is money|bank transfer charges/i meta KAM_NIGERIAN2 (__KAM_REFI4 + __KAM_NIGERIAN2_1 + __KAM_NIGERIAN2_2 + __KAM_NIGERIAN2_3 + __KAM_NIGERIAN2_4 + __KAM_NIGERIAN2_5 + __KAM_NIGERIAN2_6 + __KAM_NIGERIAN2_7 + __KAM_NIGERIAN2_8 + __KAM_NIGERIAN2_9 >= 6) score KAM_NIGERIAN2 5.0 describe KAM_NIGERIAN2 Yet more Nigerian scams. Some even explaining the scam. #MEDICAL body __KAM_MEDICAL1 /million who suffer from|suffered from organ failure|Medical Billing and Coding|medical doctor/i body __KAM_MEDICAL2 /Safe \- Natural \- Effective/i header __KAM_MEDICAL3 From =~ /Medical/i header __KAM_MEDICAL4 Subject =~ /Medical Billing/i meta KAM_MEDICAL (__KAM_MEDICAL1 + __KAM_MEDICAL2 + __KAM_MEDICAL3 + __KAM_MEDICAL4 >= 3) score KAM_MEDICAL 4.0 describe KAM_MEDICAL Misc medical spam #EAR RINGING body __KAM_TINNI1 /TinniFix/i body __KAM_TINNI2 /Stop the ringing in your ears/i header __KAM_TINNI3 Subject =~ /(ringing|buzz) in your ears/i meta KAM_TINNI (__KAM_MEDICAL1 + __KAM_MEDICAL2 + __KAM_TRIAL + __KAM_TINNI1 + __KAM_TINNI2 + __KAM_TINNI3 >= 5) score KAM_TINNI 5.0 describe KAM_TINNI Another Medical Scam #GIVEAWAY body __KAM_GIVE1 /receive your gift/i body __KAM_GIVE2 /laptop giveaway|deliver your dell.? laptop/i body __KAM_GIVE3 /answering a short survey/i body __KAM_GIVE4 /verify your shipping address/i meta KAM_GIVE (__KAM_GIVE1 + __KAM_GIVE2 + __KAM_GIVE3 + __KAM_GIVE4 >= 4) score KAM_GIVE 4.0 describe KAM_GIVE Free stuff "giveaway" scam #GOVERNMENT MONEY header __KAM_GOVT1 Subject =~ /Government Funding/i body __KAM_GOVT2 /government funding/i body __KAM_GOVT3 /complimentary information kit/i body __KAM_GOVT4 /No.Money?.{0,4}No.Problem/i meta KAM_GOVT (__KAM_GOVT1 + __KAM_GOVT2 + __KAM_GOVT3 + __KAM_GOVT4 >= 4) score KAM_GOVT 4.0 describe KAM_GOVT Your tax dollars at work scam... #RBL TRUST RULES meta KAM_RBL (URIBL_BLACK + RCVD_IN_PBL >=2) score KAM_RBL 2.0 describe KAM_RBL Higher scores for hitting multiple trusted RBLs #KAM CNN header __KAM_CNN1 Subject =~ /CNN.com Daily Top/i meta KAM_CNN (__KAM_CNN1 == 1) score KAM_CNN 2.0 describe KAM_CNN CNN Daily Top 10 Link Obfuscation spams #SNUGGIE BLANKETS / SHAM WOW header __KAM_SHAM1 Subject =~ /Hold 20 times|ShamWow/i header __KAM_SHAM2 From =~ /Sham ?Wow/i body __KAM_SHAM3 /ShamWow/i body __KAM_SHAM4 /20(X| times) its weight/i meta KAM_SHAM (__KAM_SHAM1 + __KAM_SHAM2 + __KAM_SHAM3 + __KAM_SHAM4 + KAM_ADVERT2 >= 3) score KAM_SHAM 2.0 describe KAM_SHAM More product scams... #SANTA LETTERS header __KAM_SANTA1 Subject =~ /Santa Letter|Letter from Santa|Santa send a letter|Sent by Santa/i body __KAM_SANTA2 /Santa Letter|Letter from Santa|sent by Santa/i body __KAM_SANTA3 /the .?perfect.? gift|personalized letter/i meta KAM_SANTA (__KAM_SANTA1 + __KAM_SANTA2 + __KAM_SANTA3 >= 3) score KAM_SANTA 3.5 describe KAM_SANTA Ho Ho Holy smokes Batman another Santa Letter spam... #WORK FOR / LEARN GOOGLE header __KAM_GOOGLE1 Subject =~ /Learn Google|Google Starter Kit|with Google|Use Google|Google Work|google millionaire|Google Business|Google Pro Sucess|with my Google|Google Home Business|Google ATM|One Hour On Google|Free Money Making|make a fortune on ?line/i body __KAM_GOOGLE2 /learn how to earn|automated income kit|online from home|as much money as you wish|be the boss/i body __KAM_GOOGLE3 /tons of money|making \$[\d,]*s with Google|extra cash|making serious money/i body __KAM_GOOGLE4 /with Google|Google Pie|Google Cash/i header __KAM_GOOGLE5 From =~ /Google Money/i meta KAM_GOOGLE (__KAM_GOOGLE1 + __KAM_GOOGLE2 + __KAM_GOOGLE3 + __KAM_GOOGLE4 + __KAM_GOOGLE5 >= 3) score KAM_GOOGLE 3.5 describe KAM_GOOGLE Google Pyramid Scams #SECURITY / ALARM header __KAM_ALARM1 Subject =~ /Free Alarm Quotes|home security|protect your.(house|home)|protect.what.matters.most|adt monitor|keep.watch|monitor.the.home|home.alarm|feel safe|burglar|high.crime|free.security|with.this.offer|crime.can|watching.your.home|adt.is.here|ADT\-monitoring/i body __KAM_ALARM2 /free Quote|burglaries|wireless.security.camera|(Guard|protect) Your Family|ADT is Number One|monitored security system|install from ADT|with ADT security|keep(ing)?.your.home.safe|home.is.your.castle|sleep.with.security|home.security.system|remote.access|video.security/i rawbody __KAM_ALARM3 /Great rates on Home Security|(1|one) in Alarm System Monitoring|protect your loved ones|protect your business|your source for home security|event on home security|keep.the.home.safe|night.vision|online.monitoring|surveill?ance.camera|ADT.monitor|top.notch.security|exclusive.to.you|home security system/i header __KAM_ALARM4 From =~ /adt|security.?cam|home.security|wireless.security|security.?camera|author.zed|home.?alarm/i meta KAM_ALARM (__KAM_ALARM1 + __KAM_ALARM2 + __KAM_ALARM3 + __KAM_ALARM4 + KAM_COUK >= 3) score KAM_ALARM 4.5 describe KAM_ALARM Security and Alarm Company Spams rawbody __KAM_ALARM5 /gaylord/i meta KAM_ALARM2 (KAM_ALARM && __KAM_ALARM5) score KAM_ALARM2 2.5 describe KAM_ALARM2 High Probability of Security and Alarm Company Spams #SELL CARDS header __KAM_SELL1 Subject =~ /Market Credit Cards/i body __KAM_SELL2 /Easy Money/i body __KAM_SELL3 /Selling Credit Cards/i meta KAM_SELL (__KAM_SELL1 + __KAM_SELL2 + __KAM_SELL3 >= 3) score KAM_SELL 3.5 describe KAM_SELL Selling Cards Marketing Scams #WHITEN TEETH header __KAM_WHITEN1 Subject =~ /whiten your teeth/i body __KAM_WHITEN2 /whitener/i body __KAM_WHITEN3 /(Celebrity Smile|Carbamide Peroxide)/i meta KAM_WHITEN (__KAM_WHITEN1 + __KAM_WHITEN2 + __KAM_WHITEN3 >= 3) score KAM_WHITEN 3.5 describe KAM_WHITEN Teeth Whitening Scams #URONLINE body __KAM_URONLINE1 /(chat|chat with me|hook ?up) on Y ?A ?H ?O ?O (tonight|or MSN)|add me with yahoo or msn|view now|press this web link|send me your? photo|can u turn me on|kissing you|begin.a.chat/i body __KAM_URONLINE2 /wanna talk|ur info|found your mail|found ur profile|mutual friend|katya from russia|you came to russia|my gentle sun|see this page I made|match making heaven|meet that special|comee see it over here|hexten.net|looking for a man|waiting for ur mail|found ur account|waiting for your message|casual.hookup/i body __KAM_URONLINE3 /get (naked|naughty)|horny|naughty toys|I will do anything|TOTALLY msg me on MSN|tell me your mobile|I remember you|let's talk|ran across someone like u|sexywebdating|chatting with someone|saw you by BJs|private e\-?mail|dating portal|looking.for.fun/i header __KAM_URONLINE4 Subject =~ /i'?m so ho?rny|ur really cute|flirt with u|get the party|lets hookup|MSN messanger|\d\d y.o.|russian soul\-?mate|my handsome|want you now|russian girl|costs you nothing|can you feel this|came to russia|I remember you|sexual Russia|take a look|attractive girl writes|found u by accident|tell u something special|hookups.waiting/i meta KAM_URONLINE (__KAM_URONLINE1 + __KAM_URONLINE2 + __KAM_URONLINE3 + __KAM_URONLINE4 >= 3) score KAM_URONLINE 4.5 describe KAM_URONLINE Chat Scams #TIMESHARE body __KAM_TIMESHARE1 /Get[- ]Cash for Your Timeshare|not using your timeshare|(unwanted|ugly) timeshare|cash out quickly/is body __KAM_TIMESHARE2 /goldmine|sell or rent it|we pay cash|sell\/rent your time|own a timeshare or condo|get.cash|find.your.value/is header __KAM_TIMESHARE3 Subject =~ /(rent|sell|buy) your Timeshare|have a timeshare|timeshare money|unwanted timeshare/i header __KAM_TIMESHARE4 From =~ /Resort.*sales|timeshare/i meta KAM_TIMESHARE (__KAM_TIMESHARE1 + __KAM_TIMESHARE2 + __KAM_TIMESHARE3 + __KAM_TIMESHARE4>= 3) score KAM_TIMESHARE 4.0 describe KAM_TIMESHARE Timeshare Scams #AQUA GLOBE body __KAM_AQUA1 /Aqua Globe/is body __KAM_AQUA2 /watering your plants/is body __KAM_AQUA3 /while on vacation/is header __KAM_AQUA4 Subject =~ /Waters your Plants/i meta KAM_AQUA (__KAM_AQUA1 + __KAM_AQUA2 + __KAM_AQUA3 + __KAM_AQUA4 >= 3) score KAM_AQUA 3.0 describe KAM_AQUA Spams of yet another product du jour #GEVALIA body __KAM_GEVALIA1 /Gevalia Kaffe|premium coffee delivered/is body __KAM_GEVALIA2 /(Gevalia coffee lover's|I love coffee) kit/is body __KAM_GEVALIA3 /No Further Obligation/is header __KAM_GEVALIA4 Subject =~ /gevalia|cup of coffee/i meta KAM_GEVALIA (__KAM_GEVALIA1 + __KAM_GEVALIA2 + __KAM_GEVALIA3 + __KAM_GEVALIA4 >=3) score KAM_GEVALIA 3.0 describe KAM_GEVALIA Spams of yet another product du jour #SIMPLYINK body __KAM_INK1 /Ink (and|&|n) Toner|SimplyInk|101 inks|1ink|printer ink sale|full.price/is header __KAM_INK2 From =~ /Simply ?Ink|Ink and toner|1ink|ink.*budget|ink.?saver|printer[- ]{0,4}ink/i header __KAM_INK3 Subject =~ /Ink (and|&) Toner|SimplyInk|printer ink/i meta KAM_INK (__KAM_INK1 + __KAM_INK2 + __KAM_INK3 >=3) score KAM_INK 4.0 describe KAM_INK Spams of yet another product du jour meta KAM_INK2 (KAM_INK + KAM_INFOUSMEBIZ >= 2) score KAM_INK2 3.0 describe KAM_INK2 Spams for Ink refills #TITAN PEELER body __KAM_PEEL1 /Titan Peeler/is header __KAM_PEEL2 From =~ /Titan Peeler/i header __KAM_PEEL3 Subject =~ /peeler|stainless|titan peeler/i meta KAM_PEEL (__KAM_PEEL1 + __KAM_PEEL2 + __KAM_PEEL3 >=2) score KAM_PEEL 3.0 describe KAM_PEEL Spams of yet another product du jour #HTML EMAIL REQUIRING IMAGES? rawbody __KAM_HTML1 /Please enable image viewing in order to view this message/is #RATWARE header __KAM_RAT1_1 From =~ /\@fromname\@/i header __KAM_RAT1_2 Subject =~ /(\[FName\]|\%\{AUTOVALS)/i meta KAM_RAT1 (__KAM_RAT1_1 + __KAM_RAT1_2 >= 1) score KAM_RAT1 5.0 describe KAM_RAT1 Variable Replacements Indicative of RatWare/Mass Mailing body __KAM_RAT2_1 /job description/i body __KAM_RAT2_2 /dear shopper/i header __KAM_RAT2_3 From =~ /mystery/i meta KAM_RAT2 (__KAM_RAT2_1 + __KAM_RAT2_2 + __KAM_RAT2_3 >= 3) score KAM_RAT2 5.0 describe KAM_RAT2 Another ratware mistake, uninterpolated text #TITAN EGGER body __KAM_EGG1 /Egg Genie/is header __KAM_EGG2 From =~ /Egg Genie/i header __KAM_EGG3 Subject =~ /medium eggs/i meta KAM_EGG (__KAM_EGG1 + __KAM_EGG2 + __KAM_EGG3 >=2) score KAM_EGG 3.0 describe KAM_EGG Spams of yet another product du jour #USBDRIVES body __KAM_USB1 /(debi|deborah brown|Melissa Sylvan)/i body __KAM_USB2 /person (that|who) handles the promotions/i body __KAM_USB3 /usbsmg.com/i meta KAM_USB (__KAM_USB1 + __KAM_USB2 + __KAM_USB3 >= 2) score KAM_USB 4.0 describe KAM_USB USB Promotion Spammer #GOVT GRANT body __KAM_GRANT1 /government grant/i body __KAM_GRANT2 /find out if you qualify/i body __KAM_GRANT3 /discontinue from this promotion/i meta KAM_GRANT (__KAM_GRANT1 + __KAM_GRANT2 + __KAM_GRANT3 + __KAM_REFI4 >= 3) score KAM_GRANT 5.0 describe KAM_GRANT Government Grant Scams #SEX SCAMS #MEDICINE REFERENCES body __KAM_SEX04_1 /(curative|medicinal|salutary|wholesome|beneficial|satisfaction) effect|(first\-rated|splendid) drugs|(yellow|blue|famos) (tablet|pill)|good medical supplies|(commendable|valuable) medicines|canadian pharmacy|GNC|nugenix/is #BED REFERENCES body __KAM_SEX04_2 /fun in bed|(bed|night) adventures|aid your bed|(lift|heave|ascent|hoist|raise|boost|aid) your (belove|love|darling|sex|sweet)|sexuality with assistance|ascent your sweet|bed experience|love sexuality/is #SUBJECT REFERENCES header __KAM_SEX04_3 Subject =~ /your manhood|(bed|night) adventures|sexual experience|empower your (belove|sex)|sweet sex|bed (event|experience)|lover sexuality|(lift|heave|ascent|hoist|raise|boost|aid) your (belove|love|darling|sex|sweet)|discounted drugs/i #SEXUAL REFENCES body __KAM_SEX04_4 /longer your tool|sexual experience|empower your (belove|sex)|sweet sex|(not bad|great|nice|special|awesome|free) bonus|sex all night|lovers package|male.vitality|sex with new boys/is meta KAM_SEX04 (__KAM_SEX04_1 + __KAM_SEX04_2 + __KAM_SEX04_3 + __KAM_SEX04_4 >= 3) score KAM_SEX04 10.0 describe KAM_SEX04 Sexually Explicit SPAM meta KAM_SEX04_2 (__KAM_SEX04_1 + __KAM_SEX04_2 + __KAM_SEX04_3 + __KAM_SEX04_4 >= 2 && (KAM_SEX04 < 1)) score KAM_SEX04_2 2.0 describe KAM_SEX04_2 Likely Sexually Explicit SPAM #Another Sexually Explicit Email meta KAM_SEX07 (__KAM_SUBJECT_SINGLEWORD + __KAM_SEX04_4 >= 2) score KAM_SEX07 5.0 describe KAM_SEX07 Sexually Explicit SPAM #SEX SCAMS ROUND 5 header __KAM_SEX05_1 Subject =~ /upgrade your virility|become a man|bigger instrument|admire your stick|enlarge your member|you have a tiny tool|with more inches|your mega size|improve your love/i body __KAM_SEX05_2 /buy rubber friends|big bait in your pants|she sees your size|women will be funk|biggest tool|immense monster|women will be daydreaming|have so much meat|prolonging your size|last a lot longer/i meta KAM_SEX05 (__KAM_SEX05_1 + __KAM_SEX05_2 >= 2) score KAM_SEX05 5.0 describe KAM_SEX05 Sexually Explicit SPAM #FOOTBALL CLUB SPAMS header __KAM_FOOTBALL1 Subject =~ /Amateur Club|Seeks? Player/i header __KAM_FOOTBALL2 From =~ /Football/i body __KAM_FOOTBALL3 /Mercato/i body __KAM_FOOTBALL4 /Football/i meta KAM_FOOTBALL (__KAM_FOOTBALL1 + __KAM_FOOTBALL2 + __KAM_FOOTBALL3 + __KAM_FOOTBALL4 >= 4) score KAM_FOOTBALL 4.0 describe KAM_FOOTBALL Spammy Football Club #DISH NETWORK SPAMS AND OTHER TV SPAM header __KAM_DISH1 From =~ /Dish Network|TVUpgrade|Satellite|Satellite|Dish.*Promo|dish.author|Wireless.Internet|cable.tv|tv.\&|tv.cable|tv.internet|liveteam/i header __KAM_DISH2 Subject =~ /Free Next Day Install|Free HD Receiver|Free HBO|free w\/Dish|Holiday Special|Redzone is back|Web\-Only Offer|Free HD|with DISH|dish gives you|dish.offers|Wireless Internet provider|sports.package|dish.vs.cable|switch.to.satellite|dish.just|watch.everything|satellite.dish|cable.bill|satellite.bill|paying.too.much|try.satellite|stream.live.tv/i rawbody __KAM_DISH3 /(American Satellite|Wireless Internet) Provider|gethdsat|free dvr|Satellite Deals|Dish Network|dish.gives.you.more|packages under \$\d+|compare plans|internet service provider|premium.channel|best.cable.deals|fit.your.budget|deals.near.you|online.television|quality.tv/i meta KAM_DISH (__KAM_DISH1 + __KAM_DISH2 + __KAM_DISH3 >=3) score KAM_DISH 4.0 describe KAM_DISH Dish Network Spams meta KAM_DISH2 (KAM_DISH + KAM_INFOUSMEBIZ >= 2) score KAM_DISH2 4.0 describe KAM_DISH2 Dish Network Spams #IDENTITY NETWORK header __KAM_IDENTNET1 From =~ /\@identitynetwork.net/i body __KAM_IDENTNET2 /ADVERTISE WITH IDENTITY NETWORK/i meta KAM_IDENTNET (__KAM_IDENTNET1 + __KAM_IDENTNET2 >=2) score KAM_IDENTNET 8.0 describe KAM_IDENTNET Identity Network Spams #HONEYPOT HITS #body __KAM_HONEY1 /Intacct Corporation|Miles Technologies|EcoPhones|businessbrief\.com|pbpinfo\.com|pbp-executivereports\.net|b21pubs\.com|sonar6\.com|cheetahsend\.com|voip-news|microcappress.com|myrtlebeachnow|sosonlinebackup.com|Landslide Technologies|The Performance Institute|ASMI Corporate|Kaseya|Cascio|CarProperty|HSRUpdates.com/i #header __KAM_HONEY2 From =~ /\@intacct\.com|\@(staff\.)?milestechnologies\.com|\@greenschoolfundraiser\.org|\@business-brief\.(net|com)|\@b21pubs\.com|\@pbp-executivereports\.net|\@sonar6\.com|\@cheetahsend\.com|\@ripple.us.com|\@voip-news\.com|\@.{0,8}.microcappress.com|\@BetterBuysReports.com|\@MyrtleBeachNow.com|\@sosonlinebackup.com|\@next-gen-crm.com|\@TheInstituteWeb.org|\@ASMIweb.com|\@performanceinstitute.org|\@kaseya.com|\@news.interstatemusic.com|\@interstatemusic.com|\@carproperty.com|\@hsrupdates.com/i #meta KAM_HONEY (__KAM_HONEY1 + __KAM_HONEY2 >= 2) #score KAM_HONEY 12.0 #describe KAM_HONEY Spammer sending to a honeypot or known spammer through other means #MEDIA DUCHESS header __KAM_DUCHESS1 Received =~ /mediaduchessstore.info|mediaduchesslive.info|mymediaduchess.info|mediaduchessonline.info|mytvduchess.info|mediaduchesspro.info|mileshop.info|freegrampro.info|radioduchess.info|acreforyou.info|mileblog.info/i header __KAM_DUCHESS2 From =~ /mediaduchessstore.info|mediaduchesslive.info|mymediaduchess.info|mediaduchessonline.info|mytvduchess.info|mediaduchesspro.info|mileshop.info|freegrampro.info|radioduchess.info|acreforyou.info|mileblog.info/i body __KAM_DUCHESS3 /Mr. Media Group|BLM Marketing Services|4801 l[yi]nton b/i rawbody __KAM_DUCHESS4 /duchess/i rawbody __KAM_DUCHESS5 /http:\/\/.{4,30}\.info\/[A-Za-z]{30}("|\/)/i body __KAM_DUCHESS6 /For account number:/i meta KAM_DUCHESS ((__KAM_DUCHESS1 + __KAM_DUCHESS2 >= 1) + __KAM_DUCHESS3 + __KAM_DUCHESS4 + __KAM_DUCHESS5 + __KAM_DUCHESS6 >= 4) score KAM_DUCHESS 5.0 describe KAM_DUCHESS Spammer sending emails using a variety of domains and linked images #UPS header __KAM_UPS1 Subject =~ /UPS Delivery problem|UPS Rewards/i header __KAM_UPS2 From !~ /\@ups\.com[ |>]/i body __KAM_UPS3 /invoice copy attached|\d in UPS Rewards/i meta KAM_UPS (__KAM_UPS1 + __KAM_UPS2 + __KAM_UPS3 >=3) score KAM_UPS 6.0 describe KAM_UPS Fake UPS Notice, e.g. UPS doesn't send invoices with delivery problem notes #Free Calls header __KAM_SKYPE1 Subject =~ /Free Calls/i header __KAM_SKYPE2 Received =~ /releasesourcek.com/i header __KAM_SKYPE3 From =~ /VOIP News/i body __KAM_SKYPE4 /Promo Code: \d/i meta KAM_SKYPE (__KAM_SKYPE1 + __KAM_SKYPE2 + __KAM_SKYPE3 + __KAM_SKYPE4 >=3) score KAM_SKYPE 5.0 describe KAM_SKYPE Skype/Voip scams likely to spread malware #OWA/EMAIL PHISH rawbody KAM_OWAPHISH1 /http:\/\/.{5,30}\/owa\/service_directory\/settings.php/i score KAM_OWAPHISH1 6.0 describe KAM_OWAPHISH1 Rash of OWA setting change emails for phishing #MORE DRUG SPAM - 2009-05-03 header __KAM_DRUG2_1 Subject =~ /Viagra|male enhanc|easier time making her|hot infatuations|bed tempera?ment|resigned slaves|prick be soft|increased performance|guys in bed|bedroom fun|love more passion|cure ED|(bed|sex) games|spices? (it up in|to the) bed|(bedroom|nights of) pleasure|ladies love|stay hard|satis?fy (your spouse|her)|(problems|strong|help|good) (in|for) bed|bedtime enhanc|p[0o]rn ?star|blue ?pill|great sex|please your gf|(help in the|king of the|great time in|strong night in|performance in|advice for the) bed|intimate life|gain 3\+? inches|sexual (excitement|anxiety|act)|love tool|sexual treatment|make love|make your girl happ|completely impotent|do.you.suffer/i header __KAM_DRUG2_2 Subject =~ /ambien|Percocet|vicod[i1]n|Meridia|look slim|Phentermin|adderall|codeine|Hydrocodone|Phetermin|oxycodone|no prescription need|(help|trouble) falling asleep|overpriced pharmacy|prescript.medz|Xanx?ax|RxMed|your.rx.meds|fill your meds|pharmacy offers|international pharm|(loved|preferred|favor[ite]{3}) (rx)?med|pain killer|Medi?cati[o0]ns|canadianrx|weightl0ss|no ?prescription|weight l0ss|l0seweight|ritalin|look great|brain.function|cognition|enhance.memory|amazing.energy|joint.pain|nerve.pain/i body __KAM_DRUG2_3 /Medi?cati[o0]ns|desired meds|favou?red (rx)?med|buy remedies|drug store|medicants|medicaments|sexual stim|sex stim|pain killer|(purchase|loved|preferred|favou?rite) (?:rx.?)?(deal|med)[sz]|rx.?Meds?.?deal|buy your meds|choice of meds|Rx.?(deal|Med|Sale)|v[i1]agra|medz.special|loved meds|(rx|medication) ?discount|Get the edge|joint.pain.relief|neuropathy|nerve.pain/i body __KAM_DRUG2_4 /grab hold|at[_ ~]your[_ ~]finger[_ ~]?tip|placing your order|questions about drugs|prescription is not|don't care about prescription|without a doctor|no need for a doctor|affor[df]able.prices|best daily rx|Fav.Prescript|unmatched.prices|rx.med|millions.are.praising/i body __KAM_DRUG2_5 /0nline|hassle[~-]free|favored rx|branded solutions|branded remedies|v[1i]cod[!i]n|Penhtremine|prxpills|ultimaterxhere|insanerx|speedymed4u|mightymeds1|coolestrxhere|hotrxmedspot|topshoprx|mightyrxhere|qualityrxmedz|legitrxlife|dealsformeds|simplyrxdeals|bestrxlight|ezprescriptz|reliablerxsource1|freetrusted\-rx|hotmedsourcehere|CabinetOfMeds|mytrusted\-rx|RxwarehouseHere|WarehouseofRxMeds|GreatrxMedsRus|rxmedsrus|(come by|Come to|Check Out) our web site|browse [0o]ur (website|selection)|Visit_0ur Web|Order_Now|available_this week|(buy|order) (n[0o]w|today|right.now|instantly|at [0o]nce|immediately)|check it out today|ord3r|0rder|0rd3r|browseour|rx ?unit/i body __KAM_DRUG2_6 /\b(Express|Prompt|Day|Trusty|Trustworthy|Reliable|fast|true|discreet|confidential|rapid)[_ ~\.]?Shippin|anonymous packing|shipped.right.away|adderrx|clinically.proven|support.formula/i header __KAM_DRUG2_7 Subject =~ / {4}[a-z0-9]{2,4}$/i header __KAM_DRUG2_8 From =~ /aquaflexin/i meta KAM_DRUG2 (( __KAM_DRUG2_1 + __KAM_DRUG2_2 + __KAM_DRUG2_3 + __KAM_DRUG2_4 + __KAM_DRUG2_5 + __KAM_DRUG2_6 + __KAM_DRUG2_7 + __KAM_DRUG2_8 >= 2) + KAM_SHORT + KAM_UNSUB1 >= 3) score KAM_DRUG2 3.5 describe KAM_DRUG2 More online Drug Scams meta KAM_DRUG2_2 (( __KAM_DRUG2_1 + __KAM_DRUG2_2 + __KAM_DRUG2_3 + __KAM_DRUG2_4 + __KAM_DRUG2_5 + __KAM_DRUG2_6 + __KAM_DRUG2_7 + __KAM_DRUG2_8 >= 4) + KAM_SHORT + KAM_UNSUB1 >= 3) score KAM_DRUG2_2 3.0 describe KAM_DRUG2_2 Higher Certainty of Drug Scam meta KAM_SEXSUBJECT __KAM_DRUG2_1 score KAM_SEXSUBJECT 2.0 describe KAM_SEXSUBJECT Sexually Explicit Subject #RUSSIAN WIFE/BRIDE SCAMS - Raising to >= 3 for FPs due to Russian Invasion of Ukraine 2/25/2023 header __KAM_WIFE1 Subject =~ /Remember me|(Russian|asian|Ukrai?nian) ?(dating|beaut|single|women|bride|lad|babe|girls)|(Ukrainian|russian|asian) wom[ae]n (are )?near you/i body __KAM_WIFE2 /marry a Russian|sizzling photos|(russian|asian|ukrai?nian) (women|beaut|bride|girl)|Slavic babes|Russian ?lad(y|ies)|sexy photos|actively seeking men/i tflags __KAM_WIFE2 nosubject header __KAM_WIFE3 From =~ /(asian|russian|ukrai?nian).?(dat|bride|single|women|beaut|lad)|(date|nice|hot).?(russian|asian)/i meta KAM_WIFE ( __KAM_WIFE1 + __KAM_WIFE2 + ( FREEMAIL_FROM + __KAM_WIFE3 >= 1) >= 3) score KAM_WIFE 8.0 describe KAM_WIFE Mail order bride scams #PRODUCT SCAMS header __KAM_PRODUCT1 Subject =~ /Beauty Phone/i body __KAM_PRODUCT2 /phones for discerning individuals/i meta KAM_PRODUCT ( __KAM_PRODUCT1 + __KAM_PRODUCT2 >= 2) score KAM_PRODUCT 3.0 describe KAM_PRODUCT Product scams often used with MSN/Live URIs #SPACES / LIVE / MSN / ETC. SCAMS meta KAM_LIVEURI2 ( (KAM_PRODUCT + KAM_DRUG2 + KAM_WIFE >=1) + (KAM_WEBS + KAM_MSN_STRING + KAM_BADSWF >=1) >= 2) score KAM_LIVEURI2 3.0 describe KAM_LIVEURI2 More online Scams + Known URI #WEBS.COM uri KAM_WEBS /.{3,25}\.webs.com/i score KAM_WEBS 0.5 describe KAM_WEBS webs.com links used in Spams #IMAGESHACK SWF Files uri KAM_BADSWF /imageshack.us\/.{3,25}.swf$/i score KAM_BADSWF 3.0 describe KAM_BADSWF SWF embedded links in Email Scams #EXE LINK uri KAM_EXEURI /.exe$/i score KAM_EXEURI 0.5 describe KAM_EXEURI EXE embedded link #SETTINGS FILE PHISH header __KAM_SETTING1 Subject =~ /settings file|maintenance!!/i body __KAM_SETTING2 /security upgrade|Maintenance Process on our email system /i body __KAM_SETTING3 /settings?.zip/i meta KAM_SETTING ( __KAM_SETTING1 + __KAM_SETTING2 >= 2) score KAM_SETTING 2.5 describe KAM_SETTING Phishing scams w/Setting Files or Webmail #Fixed small misspelling thanks to Jameel Akari meta KAM_SETTING2 ( KAM_SETTING + (KAM_EXEURI + __KAM_SETTING3 >=1) >= 2) score KAM_SETTING2 4.0 describe KAM_SETTING2 Phishing scams w/Setting Files or Webmail + Bad File link #FARM SPAM header __KAM_FARM1 Subject =~ /supersized (blueberr|tomato)|(blueberry|tomatoe?) giant|grows in sun or shade|giant (blueberry|tomatoe?)/i header __KAM_FARM2 From =~ /blueberr|tomato|DIY|garden/i body __KAM_FARM3 /(blueberry|Tomatoe?) giant/i meta KAM_FARM (__KAM_FARM1 + __KAM_FARM2 + __KAM_FARM3 >= 3) score KAM_FARM 4.0 describe KAM_FARM Farming related Spams #MX URI - Scored lowered from 2.5 to 1.5 due to FPs reported by Christopher X. Candreva - see https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6700 for bug on issue uri KAM_MXURI /^(?:http:\/\/)?(mail|mx)\.(?!microsoft).{1,40}\..{1,8}/i score KAM_MXURI 1.5 describe KAM_MXURI URI begins with a mail exchange prefix, i.e. mx.[...] #FLASH PLAYER body __KAM_FLASH1 /Flash Player Code: \d\d/i body __KAM_FLASH2 /Flash Player Update/i header __KAM_FLASH3 Subject =~ /Flash Player/i header __KAM_FLASH4 Subject =~ /activation code/i header __KAM_FLASH5 From =~ /Flash Player/i meta KAM_FLASH (__KAM_FLASH1 + __KAM_FLASH2 + __KAM_FLASH3 + __KAM_FLASH4 + __KAM_FLASH5 >= 3) score KAM_FLASH 4.0 describe KAM_FLASH Fake Flash Player Phishing Scam #CHANGED TO RaptorOnly ifplugin Mail::SpamAssassin::Plugin::RaptorOnly #FAKE ADWORDS body __KAM_ADWORD1 /(Advertisement|Adwords) Campaign/i header __KAM_ADWORD2 From =~ /adwords.com|salesdirect.com/i header __KAM_ADWORD3 Subject =~ /adwords campaign|ads in adwords/i body __KAM_ADWORD4 /adwords\.php|index\.php\?isgoogle/i meta KAM_ADWORD (__KAM_ADWORD1 + __KAM_ADWORD2 + __KAM_ADWORD3 + __KAM_ADWORD4 >= 3) + (KAM_RPTR_SUSPECT + KAM_RPTR_FAILED >= 1) >= 2 score KAM_ADWORD 10.0 describe KAM_ADWORD Fake Adword Campaign notices endif #DON NOB & WORK FROM HOME SCAMS header __KAM_DON1 X-Raptor-Reverse =~ /donnob\.(?:biz|net)|emarketnow.com/i header __KAM_DON2 Subject =~ /(?:\b|^)ATM(?:\b|$)|Just Over Broke|J\.O\.B\./ body __KAM_DON3 /donnob\.(?:biz|net)|emarketnow.com|watersolutiontoday.com/i body __KAM_DON4 /\$1,000 A Day ATM|J\.O\.B\./i meta KAM_DON (__KAM_DON1 + __KAM_DON2 + __KAM_DON3 + __KAM_DON4 + __KAM_MED2 + __KAM_REFI4 + __KAM_TV2 >= 4) score KAM_DON 6.0 describe KAM_DON Work at Home Scams meta KAM_DON2 (__KAM_DON1 + __KAM_DON2 + __KAM_DON3 + __KAM_DON4 + __KAM_MED2 + __KAM_REFI4 + __KAM_TV2 >= 6) score KAM_DON2 4.0 describe KAM_DON2 Egregious Work at Home Scams #GINA SCAMS header __KAM_GINA1 From =~ /GINA deadline|GINA Update|compliance/i header __KAM_GINA2 Subject =~ /GINA deadline/i body __KAM_GINA3 /Genetic Information Nondiscrimination Act/i body __KAM_GINA4 /mandatory poster|remain in compliance|GINA regulations/i meta KAM_GINA (__KAM_GINA1 + __KAM_GINA2 + __KAM_GINA3 + __KAM_GINA4 + __KAM_REFI4 >= 4) score KAM_GINA 6.0 describe KAM_GINA Employment Poster Marketing Spams #TAX SCAMS header __KAM_TAX1 Subject =~ /Free (IRS )?Tax Filing|Tax Filing Exten[st]ion|taxes online|irs audit|wage garnish|collections|tax.relief|tax.penalt|tax.resolution|settlement.option|remove.tax|irs.penalt|payback.package|get.help|down.your.neck|tax.research|urgent.tax/i header __KAM_TAX2 From =~ /tax|HRBlock|marketing|garnish|settlement|installment|IRS|debt|advisory|government|payback|protection.agency/i body __KAM_TAX3 /File your taxes for free|need more time|back.taxes|tax relief|irs offer|avoid penalty|stop.aggressive.collections|relief.(program|package)|tax.settlement|settlement.package|paying.bills|paying.tax|back.tax|wage..?garnish|tax.help|remove.lien|bankrupt|urgent.tax.notice|could.change.everything|instantly.save.you/i body __KAM_TAX4 /MSNBC|fox news|\bCNN\b|please.confirm|you.qualify|obtain.now|must.see.tax/i meta KAM_TAX (__KAM_TAX1 + __KAM_TAX2 + __KAM_TAX3 + __KAM_TAX4 + KAM_LOTSOFHASH >=3) score KAM_TAX 2.5 describe KAM_TAX Tax Filing Scams meta KAM_TAX2 (__KAM_TAX1 + __KAM_TAX2 + __KAM_TAX3 + __KAM_TAX4 + KAM_LOTSOFHASH >=4) score KAM_TAX2 2.5 describe KAM_TAX2 Higher Probability of Tax Filing Scams #SEX SCAM body __KAM_SEX06_1 /more fire and passion/i meta KAM_SEX06 (__KAM_SEX06_1 + KAM_MSN_STRING >= 2) score KAM_SEX06 5.0 describe KAM_SEX06 Sexual Stimulant Spam #DOG BARK AND OTHER DOG SPAM body __KAM_BARK1 /Bark.Off|petzoom sonic|comfy control harness|dogs? behavior|four legged/i header __KAM_BARK2 Subject =~ /Barking|petzoom sonic|dogs any size|dog (is )?misbehaving/i header __KAM_BARK3 From =~ /Bark.Off|petzoom|control harnesss|dog whisperer/i meta KAM_BARK (__KAM_BARK1 + __KAM_BARK2 + __KAM_BARK3 >=2) score KAM_BARK 3.5 describe KAM_BARK Dog Product Scam #CASINO SPAM body __KAM_CASINO1 /Elite World Casino/i body __KAM_CASINO2 /Online Casino/i header __KAM_CASINO3 Subject =~ /chances to win/i meta KAM_CASINO (__KAM_CASINO1 + __KAM_CASINO2 + __KAM_CASINO3 >= 3) score KAM_CASINO 3.5 describe KAM_CASINO Online Casino Spam #TWITTER PHISHING header __KAM_TWIT1 From =~ /twitter/i header __KAM_TWIT2 Subject =~ /twitter \d{3}-\d{2}/i meta KAM_TWIT (__KAM_TWIT1 + __KAM_TWIT2 + KAM_THEBAT >= 3) score KAM_TWIT 10 describe KAM_TWIT Twitter bogus phishing emails #FACEBOOK PHISHING header __KAM_FACE1 From =~ /password/i header __KAM_FACE2 Subject =~ /reset your facebook/i header __KAM_FACE3 X-Mailer =~ /Zuckmail/i meta KAM_FACE (__KAM_FACE1 + __KAM_FACE2 + __KAM_FACE3 >= 3) score KAM_FACE 10 describe KAM_FACE Facebook bogus phishing emails header __KAM_PHISH3_1 Subject =~ /account notification/i body __KAM_PHISH3_2 /accessed by someone else./ meta KAM_PHISH3 (__KAM_PHISH3_1 + __KAM_PHISH3_2 + __KAM_CLICK >= 3) score KAM_PHISH3 4 describe KAM_PHISH3 Phishing emails for account notification #GENERIC TEST FOR CLICK NOTICES INDICATIVE OF SPAM IN META RULES BUT NOT BY ITSELF body __KAM_CLICK /Please click on the link below|Copy and paste this link into your internet browser/i #DIRECT BUY header __KAM_DIRECT1 From =~ /Direct ?Buy|Wholesale/i header __KAM_DIRECT2 Subject=~ /complimentary|visitor|settle for retail|top .rands at wholesale|guest pass and catalog|direct.?buy/i body __KAM_DIRECT3 /(Complimentary|Visitor|attend our open house|30\-day member|VIP Pass|Wholesale Direct Pricing|guest pass and catalog)/i body __KAM_DIRECT4 /Direct.?Buy/i meta KAM_DIRECT (__KAM_DIRECT1 + __KAM_DIRECT2 + __KAM_DIRECT3 + __KAM_DIRECT4 >= 3) score KAM_DIRECT 3.0 describe KAM_DIRECT DirectBuy Spam #SWIPE BIDS header __KAM_SWIPE1 From =~ /SwipeBids|Auction|Deal ?hunter|bigger.bid|bidder|Overstocked|daily.?deals|quibids|iphone|penny.stock/i header __KAM_SWIPE2 Subject=~ /auction|bid on great|\d% off retail|Iphones for Under|Big Items|ipads|Macbook Pro|top.?.?of the line..?electronic|buy or sell|never.pay.retail|2011 line up|ebay|pay retail|ipad for \$\d\d\.|bids in real.?time|penny.stock|exclusive.savings|economic|prediction:/i body __KAM_SWIPE3 /pennies on the dollar|join, bid|penny (auctions|stock)|\d% .{0,10}retail|ipads on auction|bid now|factory sealed ipads|cheap ipads|for pennies|ebay killer|Inventory Clearance on iPads|crazy auctions|XPS for \d\dUSD|iphone.{1,10}clearance|the.hottest/i body __KAM_SWIPE4 /SwipeBids|Swipe Auction|CIRCLE MEDIA BIDS|Wavee|BIGGER BIDDER|Bidooka|Sellmoo|overstocked auctions|for pennies|\d{1,2} cent/i meta KAM_SWIPE (__KAM_SWIPE1 + __KAM_SWIPE2 + __KAM_SWIPE3 + __KAM_SWIPE4 >= 3) score KAM_SWIPE 2.0 describe KAM_SWIPE SwipeBid Spam / Penny Auction Spams meta KAM_SWIPE2 (__KAM_SWIPE1 + __KAM_SWIPE2 >= 2) score KAM_SWIPE2 0.5 describe KAM_SWIPE2 SwipeBid Spam / Penny Auction Spams #WE THE SPAMMERS header __KAM_WTA1 From =~ /@(wethealliance\.(org|com|net)|wta\d\d\d\.com|socalsecurityinstitute.org)|Lawrence.{0,4}Hunter/i body __KAM_WTA2 /Alliance for Retirement Prosperity Association|Social Security Institute/is meta KAM_WTA (__KAM_WTA1 + __KAM_WTA2 >= 2) score KAM_WTA 9.0 describe KAM_WTA Ridiculous campaign by unapologetic spammers purposefully using throwaway domains #SMOKELESS body __KAM_SMOKE1 /smoke.anywhere|electronic cig|smoking alternative|prado|\be.?\-?cig|wanting to quit/i header __KAM_SMOKE2 Subject =~ /smoke|\be\-cig|perfect.?.gift|no cancer|electronic cig|never smoke|\be.?\-?cig/i header __KAM_SMOKE3 From =~ /smoke|smoking|\be.?\-?cig|electronic cig|vapex|vapor|starter.kit/i body __KAM_SMOKE4 /No carbon monoxide|Smokeless Direct|No Tobacco|no tar|no cancer|quit smoking|electronic cig|sinless.vapor/i body __KAM_SMOKE5 /you have qualified/i meta KAM_SMOKE (__KAM_CLICK + __KAM_SMOKE1 + __KAM_SMOKE2 + __KAM_SMOKE3 + __KAM_SMOKE4 + __KAM_SMOKE5 >= 3) score KAM_SMOKE 4.5 describe KAM_SMOKE Smokeless cigarette and quitting spam meta KAM_SMOKE2 (__KAM_CLICK + __KAM_SMOKE1 + __KAM_SMOKE2 + __KAM_SMOKE3 + __KAM_SMOKE4 + __KAM_SMOKE5 >= 4) score KAM_SMOKE2 3.0 describe KAM_SMOKE2 Higher probability of spam #OBF URL - need to make this more generic and perhaps something for RBL lookups when these techniques are used. body __KAM_OBFURL1 /A\s+D\s+I\s+L\s+I\s+Z\+E\s+R\s+.\s+C\s+O\s+M|insidesaleswiz\.\s+com/i meta KAM_OBFURL (__KAM_OBFURL1 >= 1) score KAM_OBFURL 15.0 describe KAM_OBFURL Obfuscated URL #SHARP FOR LIFE body __KAM_SHARP1 /sharp for life/i body __KAM_SHARP2 /yoshiblade/i body __KAM_SHARP3 /zirconium oxide/i body __KAM_SHARP4 /ceramic knife/i header __KAM_SHARP5 Subject =~ /ceramic knief|yoshiblade|sharp for life/i header __KAM_SHARP6 From =~ /yoshi/i meta KAM_SHARP (__KAM_SHARP1 + __KAM_SHARP2 + __KAM_SHARP3 + __KAM_SHARP4 + __KAM_SHARP5 + __KAM_SHARP6 >= 4) score KAM_SHARP 4.5 describe KAM_SHARP Ceramic Blade Spam #HIP REPLACEMENT body __KAM_HIP1 /hip replacement|medical alert/i body __KAM_HIP2 /implant recall|recall list/i header __KAM_HIP3 Subject =~ /dupuy recall|hip recall|hip implants|hip replacement/i header __KAM_HIP4 From =~ /recall/i meta KAM_HIP (__KAM_HIP1 + __KAM_HIP2 + __KAM_HIP3 + __KAM_HIP4 >= 3) score KAM_HIP 4.5 describe KAM_HIP Hip Replacement Recall Spam #WORK AT HOME body __KAM_WORKHOME1 /online jobs|Full\-time (and|&) Part\-time|at home employment/i body __KAM_WORKHOME2 /\#1 site|view here|information here/i header __KAM_WORKHOME3 Subject =~ /work at home|work \@ home|home positions/i meta KAM_WORKHOME (__KAM_WORKHOME1 + __KAM_WORKHOME2 + __KAM_WORKHOME3 >= 3) score KAM_WORKHOME 4.5 describe KAM_WORKHOME Work at Home Spam meta KAM_WORKHOME2 (__KAM_WORKHOME3 + KAM_SHORT + __KAM_REFI4 >=3) score KAM_WORKHOME2 4.5 describe KAM_WORKHOME2 Work at Home Spam #HSR UPDATES body __KAM_HSR1 /hsrupdates.com|progressiverailroading.com/i header __KAM_HSR2 Subject =~ /hi\-speed rail|HSR Funds|U.?S.? DOT|railroads/i header __KAM_HSR3 From =~ /HSRUpdates.com|progressive ?railroading/i meta KAM_HSR (__KAM_HSR1 + __KAM_HSR2 + __KAM_HSR3 >= 3) score KAM_HSR 4.5 describe KAM_HSR High Speed Rail Spam #SELLPHONE body __KAM_SELLPHONE1 /Turn iphones into cash/i body __KAM_SELLPHONE2 /used or broken|pre\-paid envelope/i header __KAM_SELLPHONE3 Subject =~ /sell your old iphone/i meta KAM_SELLPHONE (__KAM_SELLPHONE1 + __KAM_SELLPHONE2 + __KAM_SELLPHONE3 >= 3) score KAM_SELLPHONE 4.5 describe KAM_SELLPHONE Used Equipment Spam #STORAGE LIMIT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_rules __KAM_MAILBOX1 __KAM_MAILBOX2 __KAM_MAILBOX3 #ISSUE body __KAM_MAILBOX1 /mailbox .{0,12}exceeded|(storage|e\-?mail|mailbox|bandwidth).(limit|quota|size|capacity)|(box|quota) is (a<L1>most )?(exhausted|fu<L1><L1>)|have been rejected|new version|(prevented|pending) (the )?(delivery|messages)|quota is low|annual upgrade|(held|important) message|messages pending|messages (are|placed|have been put) on.?hold|upgrade to our service|recent attack|(request(ed)? to|account) de\-?activat|de\-?activat(ed|e|ing) (from using|all mailbox)|close down.{0,10}account|(sync|communication) failure|de<A1>ctiv<A1>ted if no <A1>ction|invalid users|request .{0,13}shutdown|migrating all email|del<I1>v<E1>ry <O1>f \d|messages.{0,6}returned|\d.{0,2}(unreceived|failed|undelivered|incoming|valid) (undelivered|incoming|message|e?mail)|synchronize \d email|messages.{1,10}suspend|report your account|(validation|configuration|service|mail) error|updating stage|blacklisted|(?<!returned )(server|quota|quarantine|suspension|mail|upgrade) (alert|noti)|mailbox agreement|(system|security|server) (reasons|update|upgrade|alert)|system malfunction|due for an update|mailbox managment|automatically renew|.\d. pending|due for (upgrade|update|reconfirmation)|has been outdated|(due|about|set) to expire|not confirmed the email|(failed|couldn't be|refused to) deliver|temporarily suspend|failure to proceed|data plan limit|blocked from (sending|receiving|your inbox)|sending unsolicited|\d\% full|confirm your request|security turned off|blocked or suspended|update warning|account .{1,9}?(restricted|closed)|old versions|mail malfunction|messages now queue|password expir|virus|expire on \d+\/|DNS Upgrad|encountered error|will be (locked|shut ?down)|unauthorized (person|access)|prevent (further reject|loss of account)|ensure safety|problem occurred|wrong password|suspicious sign.?in|\d quarantined? (e?mail|message|incoming)|deactivated tempor|low disk space|shutdown robot|suspended email|webmail security|account hijacked|(has been|will be) (hacked|suspended)|will.{0,2}expire.{0,2}(today|soon)|IP below was used|password.{1,5}expires? today|server is totally full|account is almost full|(irregular|suspicious) activit|locked out of your account|login (interruption|problem)|automatic shut.?down|lose your contact|not receive (more|new) e?mail|deactivation of the email|Expired today|exceeded the limit|disruption of your email|message might be pre<V1>ented|mail delivery blocked|email gets locked|shut down on your account|refusal in updating your email|avoid (lose access|shut.?down|being barred)|losing (of )?your account|undelivered e?\-?mail|SSL Port server error|refusal of email security|blocked access to your inbox|web\-?mail support|change your password|pending (some|e\-?mail|mail) message|terminated in \d+ hour|messages were rejected|server error|platform is outdated|need to validate.{2,40}owned by you|password notification|expires today|Reconfirm(?: your) password|out of storage|mail quota full|email password will expire|mailbox termination|failed to sync|permanent deletion|password has been disabled|mailbox \".{5,35}\" has expired|deleted after \d+ hour|expires in less than \d+h|risk of being locked out|e\-?mail service deletion request|password for .{10,60} expire|password is set to expire|discontinue support on your account|generate a new password|word for .{1,30} is set expire|confirm your own|upgraded our security|p<A1><SPACE1>*ssword<SPACE1>*is<SPACE1>*s<E1><SPACE1>*t to <E1><SPACE1>*xpir<E1>|address verification is required|credentials? is due to update|placed a temporary suspension|notification of pending \d+ message|all users to update their email|password is expiring today/i tflags __KAM_MAILBOX1 nosubject #ACTION body __KAM_MAILBOX2 /(verify|update|upgrade|increase|validate|confirm|disable)"? (their|your)? {0,5}(address|password|<A1>ccount|(web\-?)?mail|info|email|web ?mail|ownership|mailbox)|(increase|upgrade) (my|your?) (inbox |email )?quota|quota (configuration|upgrade)|(increase disk|create some additional|update|add|increase) storage|(setup|upgrade) (your )?mailbox|mail malfunction|update (email )?account|validated within \d\d|deleted (automatically|in our server)|release .{0,40}(sent e.?mail|message|pending mess)|account to be close|remain active|termination of your account|choose what happens|blacklisting inactive|continue (using|the usage)|untrusted activity|(retrieve|review) (message|e?mail)|(verify|validate) (it )?(here|now)|reset below|verification (check|process)|email disk usage|auto extend your disk|confirm your (email|details)|mandetory file|retrieve here|expected to reactivate|keep your webmail|data will be lost|(block|release|review) (them|below)|view undelivered sent|reconfirm .{0,40}password|will be deactivat|avoid suspension|start the process|fake payment|(will be|automatically) cancel|mail verification|turn on (security|authentication)|Office 365\-?Secure|an usual location|(avoid|automatically) delet|(retrieve|review|reload) (your )?(undelivered|pending)|view, release or delete|reload below|unblock (your )?incoming|rectify below|fix now|Company.Assigned Outlook|fix delivery|restore your roundcube|re\-?authenticate (now|below)|manage your quarantine|manually fi|manually fix|review and take action|view (your )?(pending|withheld|recent) (incoming|message|e?mail)|use the button|reduce your mai<L1>|deliver recent mail|(use|using|keep) (current|same|my) password|change password|stop (this action|account removal)|fix (the problem here|your email)|(maintain|keep).{0,6}current.{0,2}(signing|password)|verify login|apply update|deliver pending message|archive emails|initiate the upgrad|(approve|continue with) (the )?(current|same) password|free up space|quick re\-?validation|cancel the request|prevent lock of account|back under the limit|update no<W1>|re<A1>ctiv<A1>te <A1>ccess|consider keeping your password|account will work effectively|portal to prompt delivery|open the attachment|Reload Email message|secure your account|authenticate.{1,35} account|keep (the )?same password|(keep|use) (the|your) current password|proper verification|restoration of your account|systematically updated|synchronization errors|activate Improved security|(restore|recover) messages (here|below)|recover your delayed messages|validate your (?:mailbox|e\-mail)|conveyed to each sender|Please security access key|account password is due to expire|avoid missing important e?\-?mail|pending e?\-?mail message|clear cache quick|avoid loss of e?mail|upgrade inbox|enable your password|retrieve your file|view and accept messages|keep my access|re\-?active current pass|call support helpline|attend to our notice|clear up space setting|retain your existing password|avoid mailbox disconnection|confirm active account|keep using the existing pass|maintain current credential|unblock message|verification portal|refresh (your account|e?.?mail server)|Keep your details|resolve errors now|recover your account|keep your current one/i tflags __KAM_MAILBOX2 nosubject #SUBJECT header __KAM_MAILBOX3 Subject =~ /(mail|exceeded|insufficient) (storage|quota|upgrade)|(@.*?is|Inbox) almost full|(urgent|important|admin|last|suspension|server|account|administrator|system|disk ?usage|max size) (alert|rectification|attention|warning|noti)|needs to be upgraded|(incoming|pending|unreceived) +((e\-?)?mail|document|m[ae]ssage)|(del<I1>v<E1>ry|synchronization|processing) (problem|is blocked|failure|err<O1>r)|(mailbox|storage) (is )?full|(disc|disk|inbox) full|(unread|upgrade|delayed) (messages|e?mail)|release your message|pending (new )?((e\-?)?mail|message)|365 .{0,10} Update|new privacy policy|mandatory up|(sign in|Final|account|password|emails?) (closing|removal|update|upgrade|alert|notification|review)|quarantine|rejected|undelivered|(mailbox|limit|quota) .{0,10}exceeded|(action|\..{2,6} update).?required|(mail|mailbox|account|password) (error|shutdown|verification|Veirification|Verfication|account)|(blocked|held) message|technology services|(server|mail|account).{1,8}err<O1>r|messages.{1,10}(suspend|hinder)|account (is )?(blocked|limited|closing)|please verify.{1,10}account|mail.{1,6}Notice|email account.{1,11}full|final warning|help\-?desk|mail ownership|point files|(d|r)e\-?activation|delayed for \d+ (hour|day)|undeliverable|closure of.{1,15}(\@|account)|(password|mail) (has|will) expire|did you make|password.(due|recovery|expir)|recovery option|(confirm|email) activity|Immediate action|action required|avoid block|review recent e?mail|final +alert|storage (error|limit)|ver<I1>f<I1>cat<I1>on|\@.{1,25}notification|notification \d+\/\d+\/|notification for .{1,25}\@|New Sign\-in|deliver.{1,4}(cancel|issue|error|fail)|Unsuccessful Email|Mail DNS|ICT Maintenance|sync err|mailer un.?delivery|unauthorized (person|access)|configuration setting|reminder +for|re\-?authenticate|change in your ip|shutdown request|Failure.{0,2}Report|(mail delivery|\d emails?) suspended|error sync|(e\-?mails?|messages) (are )?pending|\d \(?new\)? notice|new IP address|expir(y|ation) notif|reached their disk quota|webmail support|notification for|change.{0,30}account password now|(mail|mail\-?box) termination|office? ?365 access|(Attention|urgent):? update (required|needed)|(full|out of) storage|quota (limit|reached)|access.{1,4}expire|renew your e?\-?mail pass|mail protection update|e\-?mail .{0,30}still pending|unauthorized (login|logging) attempt|^suspended$|message failed|security upgrade|password.*expires? today|password activity|mail (access blocked|delayed)|account has been hacked|prevent account malfunction|password change notification|Critical(?:\-|\s)Status on|(storage|upgrade) notice|mail not sent|mailbox.{0,4}update settings|\-notification\:\w|access has been suspended|Activities account|Alert\!\!|do not ignore this notification|trying to contact you|validation notic|pass(word|wrod) expire|email configuration|e\-?mail service deletion|cpanel notification|password for .{10,60} expire|message expiry error|message failure delivery notice|e-?mail account validat|^Your .{1,30} notification$|Final Notice\!|email expiration|^\s*update required\s*$|^\s*IT Support\s*$|Please validate|Review Required|verify email address|Confirm if this user is active|password is set for cancellation|cancel your registered email|refresh e?.?mail server|account disabled due to recent activity|your .*\@.* rectification|Password expiry alert|Update your.*account to ensure security|password reset\:/i #NON OBFUSCATED VARIANT NOT A SPAM INDICATOR header __KAM_MAILBOX3FP Subject =~ /verification|Approaching pooled storage/i #COMPROMISED SYSTEMS uri __KAM_WPADMIN /\/wp\-admin\//i meta KAM_MAILBOX (__KAM_MAILBOX1 + __KAM_MAILBOX2 + (__KAM_MAILBOX3 && !__KAM_MAILBOX3FP) >=2) && (T_FREEMAIL_DOC_PDF + (KAM_SENDGRID + KAM_SENDGRID2 >= 1) + HTML_MIME_NO_HTML_TAG + T_HTML_ATTACH + __KAM_WPADMIN) >= 2 score KAM_MAILBOX 8.75 describe KAM_MAILBOX Mailbox Quota Phishing Scams meta KAM_MAILBOX2 (__KAM_MAILBOX1 + __KAM_MAILBOX2 + (__KAM_MAILBOX3 && !__KAM_MAILBOX3FP) + KAM_SHORT >= 3) && !KAM_MAILBOX score KAM_MAILBOX2 5.5 describe KAM_MAILBOX2 Mailbox Quota Phishing Scams meta KAM_MAILBOX3 (KAM_MAILBOX + KAM_MAILBOX2 >= 1) && (KAM_SENDGRID + KAM_SENDGRID2 >= 1) describe KAM_MAILBOX3 Enhanced Scoring for Mailbox Quota Phishing score KAM_MAILBOX3 4.75 endif meta KAM_SHORT (__KAM_SHORT + __KAM_TINYDOMAIN >= 1) tflags KAM_SHORT net score KAM_SHORT 0.001 describe KAM_SHORT Use of a URL Shortener for very short URL #URL SHORTENER - META RULE TO SEE IF URL SHORTENER IS IN USE - THANKS TO SHANE WILLIAMS and RW for HELP - More thanks to Giovanni Bechis ifplugin Mail::SpamAssassin::Plugin::DecodeShortURLs if can(Mail::SpamAssassin::Plugin::DecodeShortURLs::has_short_url) # use DecodeShortURLs plugin and disable __KAM_TINYDOMAIN body __KAM_SHORT eval:short_url() tflags __KAM_SHORT net else #OLDER RULE, SHOULD USE DecodeShortURLS and the kam_urlshorterners.cf which is more comprehensive than this. uri __KAM_SHORT /^https?:\/\/(?:bit\.(do|ly)|tinyurl\.com|ow\.ly|is\.gd|tumblr\.com|formspring\.me|ff\.im|youtu\.be|tl\.gd|plurk\.com|migre\.me|j\.mp|cli\.gs|urlshortener\.teams\.microsoft\.com|goo\.gl|yfrog\.com|lnk\.ms|su\.pr|fb\.me|alturl\.com|wp\.me|ping\.fm|chatter\.com|post\.ly|twurl\.nl|tiny\.cc|4sq\.com|ustre\.am|short\.to|u\.nu|flic\.kr|budurl\.com|digg\.com|twitvid\.com|gowal\.la|om\.ly|justin\.tv|icio\.us|p\.gs|loopt\.us|tcrn\.ch|xrl\.us|wpo\.st|bkite\.com|t\.cn|t\.co|x\.co|hop\.kz|urla\.ru|fw\.to|back\.ly|justpaste\.it|l\.linklyhq\.com)\/[^\/]{3}\/?/ endif else #OLDER RULE, SHOULD USE DecodeShortURLS and the kam_urlshorterners.cf which is more comprehensive than this. uri __KAM_SHORT /^https?:\/\/(?:bit\.(do|ly)|tinyurl\.com|ow\.ly|is\.gd|tumblr\.com|formspring\.me|ff\.im|youtu\.be|tl\.gd|plurk\.com|migre\.me|j\.mp|cli\.gs|urlshortener\.teams\.microsoft\.com|goo\.gl|yfrog\.com|lnk\.ms|su\.pr|fb\.me|alturl\.com|wp\.me|ping\.fm|chatter\.com|post\.ly|twurl\.nl|tiny\.cc|4sq\.com|ustre\.am|short\.to|u\.nu|flic\.kr|budurl\.com|digg\.com|twitvid\.com|gowal\.la|om\.ly|justin\.tv|icio\.us|p\.gs|loopt\.us|tcrn\.ch|xrl\.us|wpo\.st|bkite\.com|t\.cn|t\.co|x\.co|hop\.kz|urla\.ru|fw\.to|back\.ly|justpaste\.it|l\.linklyhq\.com)\/[^\/]{3}\/?/ endif # GENERIC RULE FOR TINY DOMAINS, WHICH WILL LIKELY BE URL SHORTENERS uri __KAM_TINYDOMAIN /https?:\/\/(?!aka\.ms)(?:[^\/]{1,4})\.(?!avg|ibm|gov).{2,7}\//i #POWER CHAIRS body __KAM_POWER1 /hoveround/i header __KAM_POWER2 Subject =~ /Get your freedom|power Chairs/i header __KAM_POWER3 From =~ /Get your freedom|power Chairs/i meta KAM_POWER (__KAM_POWER1 + __KAM_POWER2 + __KAM_POWER3 >= 3) score KAM_POWER 3.0 describe KAM_POWER Motorized Chair Spams #GUN ALERTS body __KAM_GUN1 /Keep and Bear Arms/i header __KAM_GUN2 From =~ /gunalerts.com/i header __KAM_GUN3 Subject =~ /gun/i meta KAM_GUN (__KAM_GUN1 + __KAM_GUN2 + __KAM_GUN3 >= 3) score KAM_GUN 2.0 describe KAM_GUN Gun Alert Spams #GET RICH QUICK SCHEME body __KAM_RICH1 /financial.success story/i body __KAM_RICH2 /see me on the channel \d news/i body __KAM_RICH3 /talking about my blog/i body __KAM_RICH4 /bec.me financially independent/i meta KAM_RICH (__KAM_RICH1 + __KAM_RICH2 + __KAM_RICH3 + __KAM_RICH4 >= 4) score KAM_RICH 3.5 describe KAM_RICH Get Rich Quick Schemes #YAHOO GROUP EMAIL RULE BASED ON WORK FROM Jim McCullars - University of Alabama in Huntsville header __KAM_UAH_YAHOOGR_4 X-Mailer =~ /Yahoo Groups Message Poster/ ifplugin Mail::SpamAssassin::Plugin::DKIM meta KAM_UAH_YAHOOGROUP_SENDER __DOS_HAS_LIST_UNSUB && __ML2 && __DOS_HAS_MAILING_LIST && __KAM_UAH_YAHOOGR_4 && !FORGED_YAHOO_RCVD && DKIM_VALID else meta KAM_UAH_YAHOOGROUP_SENDER __DOS_HAS_LIST_UNSUB && __ML2 && __DOS_HAS_MAILING_LIST && __KAM_UAH_YAHOOGR_4 && !FORGED_YAHOO_RCVD endif describe KAM_UAH_YAHOOGROUP_SENDER Sender appears to be a legit Yahoo! Group Mail score KAM_UAH_YAHOOGROUP_SENDER -20.0 #GALLERY header __KAM_GALLERY1 Subject =~ /(Infinite|Multi|Elite|Extreme|Complete|Instant|Ultimate|Multi|approved|Free|HD|Guaranteed|Unreal) Access|(Ultimate|Babes|Elite|Extreme|P.?o.?r.?n) Collection|(Girls|Adu.?lt|Babes|Celeb.?rities) Passwords|(Ultimate|p.?o.?r.?n|extreme|elite|Girls) gallery|HD Video|Access Now/i body __KAM_GALLERY2 /(?:Infinite|Multi|Elite|Extreme|Complete|Instant|Ultimate|Multi|approved|Free|HD|Guaranteed|Unreal) Access|(?:Ultimate|Babes|Elite|Extreme|P.?o.?r.?n) Collection|(?:Girls|Adu.?lt|Babes|Celeb.?rities) Passwords|(?:Ultimate|p.?o.?r.?n|extreme|elite|Girls) gallery|HD Video|Access Now/i header __KAM_GALLERY3 Subject =~ /(Fantastic|Insane|Mega|Extreme|Extreme|New|Many|Fresh|Your|Check) P.?o.?r.?n|cele.?brities elite|(Insane|P.?o.?r.?n|More|Awesome|All|Mega) Model|(Your|Mega|Asian|Bad|Cool|Fresh|Real|Awesome|More) Girl|(Sweet|Incredible|Insane|The|Grand) chick|(Many|New|Infinite|Cool|All) Cele.?b|The N.?u.?des|(Infinite|Awesome|Many|Sweet|Bad|Get|Fresh|Hot|More|Black) Babe|Amat.?e.?urs|(All|Fresh|Fantastic|The|Mega) Adu.?lt|(Extraordinary) Chicks/i body __KAM_GALLERY4 /(Fantastic|Insane|Mega|Extreme|Extreme|New|Many|Fresh|Your|Check) P.?o.?r.?n|cele.?brities elite|(Insane|P.?o.?r.?n|More|Awesome|All|Mega) Model|(Your|Mega|Asian|Bad|Cool|Fresh|Real|Awesome|More) Girl|(Sweet|Incredible|Insane|The|Grand) chick|(Many|New|Infinite|Cool|All) Cele.?b|The N.?u.?des|(Infinite|Awesome|Many|Sweet|Bad|Get|Fresh|Hot|More|Black) Babe|Amat.?e.?urs|(All|Fresh|Fantastic|The|Mega) Adu.?lt|(Extraordinary) Chicks/i rawbody __KAM_GALLERY5 /wp\-content|_vti_cnf|cache|wp\-admin|wordpress/i meta KAM_GALLERY (__KAM_GALLERY1 + __KAM_GALLERY2 + __KAM_GALLERY3 + __KAM_GALLERY4 + __KAM_GALLERY5 >=4) describe KAM_GALLERY Exploited Gallery with Porn score KAM_GALLERY 5.0 meta KAM_GALLERY2 (__KAM_GALLERY1 + __KAM_GALLERY2 + __KAM_GALLERY3 + __KAM_GALLERY4 + __KAM_GALLERY5 >=5) describe KAM_GALLERY2 Higher Likelihood of Exploited Gallery with Porn score KAM_GALLERY2 2.0 #CHANGELOG header __KAM_CHANGELOG1 Subject =~ /^Re: Changelog (Oct.|Nov.|Dec.)$/i body __KAM_CHANGELOG2 /as promised chnglog update/i meta KAM_CHANGELOG (__KAM_CHANGELOG1 + __KAM_CHANGELOG2 >= 2) describe KAM_CHANGELOG Phishing Email score KAM_CHANGELOG 2.5 #NIGERIAN VARIANT body __KAM_BUS1 /business proposal/i body __KAM_BUS2 /sensitive by nature/i body __KAM_BUS3 /have not met/i body __KAM_BUS4 /view my attach/i meta KAM_BUS (__KAM_BUS1 + __KAM_BUS2 + __KAM_BUS3 + __KAM_BUS4 >= 4) describe KAM_BUS Yet another Nigerian Scam/Phishing Variant score KAM_BUS 4.0 #PRIVATE MESSAGE body __KAM_PRIV1 /private message|horny|sweet ass/i body __KAM_PRIV2 /(personal|private) video/i body __KAM_PRIV3 /the attache?ment|attached file/i meta KAM_PRIV (__KAM_PRIV1 + __KAM_PRIV2 + __KAM_PRIV3 >=2 && T_HTML_ATTACH) describe KAM_PRIV Private Messages using Exploits in attached HTML files score KAM_PRIV 5.0 #DIV rawbody __KAM_DIV1 /(Viagr?|Cial?)<div/i rawbody __KAM_DIV2 /<\/div>r?a\|l?is/i meta KAM_DIV (__KAM_DIV1 + __KAM_DIV2 >= 2) describe KAM_DIV Use of divs to hide Medical Spams score KAM_DIV 2.0 #CREDIT SCORE header __KAM_CREDIT1 Subject =~ /CRITICAL:.*change to.* (EXPERIAN|Transunion|Equifax) score|Recent 3 Bureau Credit|(credit|score).score|credit has changed|check your rating|yearly review|scores?.(?:may.have|has.been|have.been).changed|(?:EXPERIAN|Transunion|Equifax) scores? delivered|your credit report|all three sources|credit (may )?ha(ve|s) been revised|credit ?card ?processing|merchant account|TransUnion..?Experian . Equifax Scores|all 3 scores|update to your score|your 3 scores|is your score correct|score (report|review)|latest.score|updated.score|update:|derogatory.(info|item)|affecting.your.score|scores.this.week|EQUIFAX..?EXPERIAN..?(and|&).TRANSUNION|(EXPERIAN|Transunion|Equifax)..?score|\d{4}.scores?.detail|((equifax|experian|transunion)..?){3}|score.today|score.w\//i body __KAM_CREDIT2 /View (all 3 reports|your credit score|your up.to.the.minute credit)|(EXPERIAN|Transunion|Equifax) report|check my credit score|3.free credit scores|credit restoration|changes in your.score|get your \d+ score online|3 major sources|all three bureau|all 3 credit score|credit (may )?ha(ve|s) been revised|payment.options|complimentary 3 scores|credit scores? in seconds|TRANSUNION,\s+EQUIFAX,\s+(and|.)\s+EXPERIAN|just (been )?changed|score.breakdown|credit.summary|score.is.waiting|confirmation \#\d+|average.credit.score|what.?s.your.score|(3|three).free.score|check.your.score|we.can.help|credit.record|complimentary.score/i body __KAM_CREDIT3 /NO COST|it's on us|3 companies for free|freescore360|Scoresense|score.report(?:ing)?.team|stand in the rating scales|view your higher credit|(score|credit).alert|provide.faster.service|your credit score|free.credit.score|score.generation|new.score.immediately|score.notification|your report/i body __KAM_CREDIT4 /CHANGES TO YOUR CREDIT[- ]SCORE|credit score has changed|Triple Bureau Credit Alerts|score\s+may\s+have\s+(been)?\s*changed|ThinkCredit|Debunk Credit Card Processing Myths|costs for your business|TransUnion,? Experian and Equifax Scores|ha(s|ve).been.updated|what.?s.your.credit|sensitive.information/i header __KAM_CREDIT5 From =~ /Credit|score|bureau|finance|report|advisory/i #EXPERIMENTAL UTF-8 # SecureCRT in UTF-8 Session Options - terminal>appearance>character encoding and set to utf-8 & Set this in VI :set encoding=utf-8 :set fileencodings=utf-8 #Useful Resources for Tags #https://www.utf8-chartable.de/unicode-utf8-table.pl?start=1024&number=128&names=-&utf8=string-literal #https://www.branah.com/unicode-converter #look at the encoding type and the charset. For base64 utf-8, something like this tool will help https://www.base64decode.org/ then hexdump -C or something like https://onlineutf8tools.com/convert-utf8-to-hexadecimal or perl -e '$u=unpack("H*",$ARGV[0]);print "[\\x$1]" while ($u=~/(..)/g)' '<PASTE>' ifplugin Mail::SpamAssassin::Plugin::ReplaceTags #renamed to A1, C1, etc. to avoid collissions with stock rules #Thanks to John Hardin for his help! and thanks to Giovanni for the help with the 4-byte chars #thanks as well to Henrik Krohns #Write a very broad regex like g.*k.?squ.* and the debug outputs something like G\x{CF}\x{B5}\x{CF}\x{B5}k Squ" Then you can Edit the tag for E1 to add |[\xcf][\xb5] # replace_tag A1 (?:a|[\xf0\x9d\x97\xae]|[\xf0\x9d\x9a\x8a]|[\xd0][\xb0]|[\xc9][\x91]|α|\@) #Thanks to Kent Oyer for his review of the replace tags replace_tag A1 (?:a|\xf0\x9d\x97\xae|\xc3\xa3|\xf0\x9d\x9a\x8a|\xd0\xb0|\xc9\x91|\xce\xb1|\xc3\x81|\@|\xc8\xa6) replace_tag B1 (?:b|\xce\x92|\xce\xb2|\xf0\x9d\x97\xaf|\xf0\x9d\x9a\x8b|\xd0\x92) replace_tag C1 (?:c|\xd0\xa1|\xd1\x81|\xf0\x9d\x97\xb0|\xf0\x9d\x9a\x8c) replace_tag D1 (?:d|\xf0\x9d\x9a\x8d) replace_tag E1 (?:e|\xd0\xb5|\xc4\x97|\xf0\x9d\x97\xb2|\xf0\x9d\x9a\x8e|\xc3\xaa|\xcf\xb5|\xc3\xab) replace_tag G1 (?:g|\xf0\x9d\x97\x80) replace_tag I1 (?:i|\xd1\x96|\xc4\xab|\xce\xb9|\xf0\x9d\x97\xb6|\xf0\x9d\x9a\x92|l|1) replace_tag K1 (?:k|\xd0\xba) replace_tag L1 (?:l|i) replace_tag M1 (?:m|\xca\x8d|\xf0\x9d\x97\xba|\x9b\x96|\xd0\xbc) replace_tag N1 (?:n|\xf0\x9d\x9a\x97|\xd5\xb8) replace_tag O1 (?:o|0|\xd0\xbe|\xce\xbf|\xf0\x9d\x97\xbc|\xf0\x9d\x9a\x98|\xd0\x9e|\xc3\xb4) replace_tag P1 (?:p|\xd1\x80|\xc7\xb7|\xcf\x81|\xf0\x9d\x97\xbd|\xf0\x9d\x9a\x99|\xd0\xa0) replace_tag R1 (?:r|\xf0\x9d\x97\xbf|\xf0\x9d\x9a\x9b) replace_tag S1 (?:s|\xd0\x85|\xf0\x9d\x98\x80|\xf0\x9d\x9a\x9c|\xd1\x95) replace_tag T1 (?:t|\xcf\x84|\xf0\x9d\x98\x81|\xf0\x9d\x9a\x9d) replace_tag U1 (?:u|\xf0\x9d\x98\x82) replace_tag V1 (?:v|\xf0\x9d\x96\xb5|\xce\xbd|\xd1\xb5) replace_tag W1 (?:w|\xf0\x9d\x98\x84|\xf0\x9d\x9a\xa0|\xd1\xa1) replace_tag Y1 (?:y|\xf0\x9d\x9a\xa2|\&\#7823\;|\xd1\x83) replace_tag SPACE1 (?: |\xc2\xa0|\xef\xbb\xbf) #OBFU ONLY replace_tag A2 (?:[\xf0\x9d\x97][\xae]|[\xc3][\xa3]|[\xf0\x9d\x9a][\x8a]|[\xd0][\xb0]|[\xc9][\x91]|α|\@) replace_tag D2 (?:\xf0\x9d\x9a\x8d|\xf0\x9d\x90\x9d) replace_tag E2 (?:[\xd0][\xb5]|[\xc4][\x97]|\xf0\x9d\x97\xb2|\xf0\x9d\x9a\x8e|[\xc3][\xaa]|[\xcf][\xb5]|[\xc3][\xab]|[\xc3][\xa8]|\xf0\x9d\x90\x9e) replace_tag K2 (?:[\xd0][\xba]) replace_tag O2 (?:O|\xd0\xbe|\xce\xbf|\xf0\x9d\x97\xbc|\xf0\x9d\x9a\x98|\xd0\x9e|\xc3\xb4|\xf0\x9d\x90\xa8) replace_tag R2 (?:\xf0\x9d\x97\xbf|\xf0\x9d\x9a\x9b|\xf0\x9d\x90\xab) replace_tag U2 (?:\xf0\x9d\x98\x82) replace_tag NUM1 (?:\xf0\x9d\x9f\x8f|\xf0\x9d\x9f\xad) replace_tag NUM8 (?:\xf0\x9d\x9f\x96) #NUMBERS replace_tag N0 (?:0|O|\xf0\x9d\x9f\x8e) replace_tag N1 (?:1|l|I|\xf0\x9d\x9f\x8a|\xf0\x9d\x9f\xadf) replace_tag N2 (?:2|\xf0\x9d\x9f\x90) replace_tag N3 (?:3|\xf0\x9d\x9f\x91) replace_tag N4 (?:4|\xf0\x9d\x9f\x92) replace_tag N5 (?:5|\xf0\x9d\x9f\x93) replace_tag N6 (?:6|\xf0\x9d\x9f\x94) replace_tag N7 (?:7|\xf0\x9d\x9f\x95) replace_tag N8 (?:8|\xf0\x9d\x9f\x96) replace_tag N9 (?:9|\xf0\x9d\x9f\x97) header __KAM_CREDIT6 Subject =~ /<C1>ompl<I1>mentary (<C1>red<I1>t|EXPERIAN|Transunion|Equifax)/i header __KAM_CREDIT7 From =~ /<S1>core.?<S1>ense/i replace_rules __KAM_CREDIT6 __KAM_CREDIT7 endif meta KAM_CREDIT (__KAM_CREDIT1 + __KAM_CREDIT2 + __KAM_CREDIT3 + __KAM_CREDIT4 + __KAM_CREDIT5 + __KAM_CREDIT6 + __KAM_CREDIT7 + (__KAM_THIRD || KAM_LOTSOFHASH || KAM_INFOUSMEBIZ) >= 4) describe KAM_CREDIT Credit Score Spams score KAM_CREDIT 4.5 #LAUNCH PCCC WILD RBL meta KAM_CREDIT2 (__KAM_CREDIT1 + __KAM_CREDIT5 + __KAM_CREDIT6 + __KAM_CREDIT7 + KAM_INFOUSMEBIZ + __KAM_URIBL_PCCC >= 3 && KAM_CREDIT < 1) describe KAM_CREDIT2 Credit Score Spams score KAM_CREDIT2 4.5 #OBFUSCATED URI rawbody KAM_OBFURI /http:\/\/.{2,30}\.c=E2=93=9Em?/ describe KAM_OBFURI Obfuscated URI trick score KAM_OBFURI 4.0 #ADVANCE header __KAM_ADVANCE1 Subject =~ /Advance for \d.\d\d\d/i body __KAM_ADVANCE2 /Advance Details/i body __KAM_ADVANCE3 /Pre\-Approved/i header __KAM_ADVANCE4 From =~ /Advance|Approv|Financ/i meta KAM_ADVANCE (__KAM_ADVANCE1 + __KAM_ADVANCE2 + __KAM_ADVANCE3 + __KAM_ADVANCE4 >= 3) describe KAM_ADVANCE Advance Spams score KAM_ADVANCE 3.5 #PAYPAL NON SPF - FP fixed by Piper Andreas header __KAM_PAYPAL1A From =~ /\@[a-z\.]*paypal.com>?$/i meta KAM_PAYPAL1 (__KAM_PAYPAL1A + SPF_FAIL >=2) describe KAM_PAYPAL1 rampant paypal phishing scams score KAM_PAYPAL1 16.0 ifplugin Mail::SpamAssassin::Plugin::RaptorOnly #PAYPAL IMPERSONATING MALWARE body __KAM_PAYPAL2A /paypal/i body __KAM_PAYPAL2B /protection services department|download(ing)?.the.attach/i meta KAM_PAYPAL2 (__KAM_PAYPAL2A + __KAM_PAYPAL2B + KAM_RAPTOR_ALTERED >= 3) describe KAM_PAYPAL2 Malware disguised as a paypal email score KAM_PAYPAL2 8.0 endif #PAYPAL PHISH header __KAM_PAYPAL3A From =~ /paypal/i header __KAM_PAYPAL3B From !~ /paypal(\.com|\.com\.au|\.co\.uk)?>?$/i header __KAM_PAYPAL3C Subject =~ /your.paypal.account|Invoice PP|order Confirmation/i body __KAM_PAYPAL3D /security.process|more.information|has.limitation|verify.your.information|bitcoin|\d\d hours from today/i meta KAM_PAYPAL3 ((__KAM_PAYPAL3A && __KAM_PAYPAL3B) + __KAM_PAYPAL3C + __KAM_PAYPAL3D + KAM_LAZY_DOMAIN_SECURITY >= 3) score KAM_PAYPAL3 8.0 describe KAM_PAYPAL3 Phish disguised as a paypal email ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_rules __GB_OBFU_PHONE body __GB_OBFU_PHONE /(?:\b|\s)(?:\+<NUM1>(?:\s|\-)?\(|\+?(?:<NUM1>)?(?:\(|\-)?(?:<NUM8>)|[.(]\d<O2>\d{1,2}[.)]\s)|contact(?:ing)? us at \d<O2>\d |\+\.1\.\s?\.\(\.\d\.\d\.\d\.\)/ meta GB_OBFU_PHONE ( __GB_OBFU_PHONE || __MXG_PHONE_OBFU ) describe GB_OBFU_PHONE Obfuscated phone number score GB_OBFU_PHONE 4.0 meta GB_OBFU_FREE_PHONE ( GB_OBFU_PHONE && FREEMAIL_FROM ) describe GB_OBFU_FREE_PHONE Obfuscated phone number from a freemail address score GB_OBFU_FREE_PHONE 1.5 body __GB_PAYPAL_PHONE /(?:\b|\s)(?:\+<NUM1>(?:\s|\-)?\(|\+?(?:<NUM1>)?(?:\(|\-)?(?:<NUM8>)|\d<O2>\d|Call-I\(|I\(888\))/ meta GB_PAYPAL_OBFU_PHONE ( ( GB_OBFU_PHONE || __GB_PAYPAL_PHONE ) && ( FUZZY_PAYPAL || FROM_PAYPAL_SPOOF ) ) describe GB_PAYPAL_OBFU_PHONE Paypal email with obfuscated content score GB_PAYPAL_OBFU_PHONE 0.5 endif # Thanks to Jim Brandt for the regexp fix ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_rules __GB_FRAUD_PAYPAL header __GB_TO_ONMICROSOFT_TO To:addr =~ /.{3,32}\.onmicrosoft\.com/ header __GB_YAHOO_ONMICRO_FWD X-Yahoo-Forwarded =~ /\sTo\s.{3,32}\.onmicrosoft\.com/ meta __GB_TO_ONMICROSOFT ( __GB_TO_ONMICROSOFT_TO || __GB_YAHOO_ONMICRO_FWD ) header __GB_TO_TEST_GOOGLE To:addr =~ /\.test\-google\-a\.com/ header __GB_TO_NOREPLY To:addr =~ /(?:\w+\-)?norepla?y.{0,16}\@/ header __GB_TO_PURCHASE To:addr =~ /(?:(?:purchase|confirmed).{0,16}\d+|order.?(?:record|status)(?:\d+)?|pending.?order(?:\d+)?|company|supportupdate\d+)\@/ header __GB_TO_LOCAL_NOVOWEL To:addr =~ /[bcdfgjklmnpqrstvwxz]{6}\S*\@/i header __GB_FROM_PAYPAL From:addr =~ /\@(?:intl\.)?paypal.com(?:\.au|\.mx)?/ header __GB_FROM_DOCUSIGN From:addr =~ /\@docusign\.net/ header __GB_FROM_ZELLEPAY From:addr =~ /\@zellepay\.com/ header __GB_FROM_BESTBUY From:addr =~ /\@emailinfo\.bestbuy\.com/ header __GB_FROM_ADOBE From:addr =~ /\@adobe(?:sign)?\.com/ header __GB_FROM_YOUSIGN From:addr =~ /\@yousign\.(?:app|com)/ header __GB_FROM_INTUIT From:addr =~ /\@notification\.intuit\.com/ body __GB_PHONE /(?:\+[0-9])?\s?(?:\()?(?:[0-9]{3})(?:\))?\s?(?:[0-9\-]{8,9})/ body __GB_FRAUD_PAYPAL /Fraud\s+Alert|<O2><R2><D2><E2><R2>|recognize\s+the\s+seller|Quickly\s+inform\s+us|(?:PayPal)(?:Support)?(?:Team)?\s+Immediately|we do\s?n.{1,3}t (?:hear|receive any communication) from you|unauthorized charge|made in error|BTC order|Crypto currency|do.{1,3}t hesitate to contact us immediately|did\s?n.{1,3}t made this order|seconds? for your account to reflect this transaction|Bitcoin|Blockchain/i endif ifplugin Mail::SpamAssassin::Plugin::RaptorOnly meta GB_FAKE_INVOICE ( ( __GB_FROM_PAYPAL || __GB_FROM_DOCUSIGN || __GB_FROM_ZELLEPAY || __GB_FROM_BESTBUY || __GB_FROM_ADOBE || __GB_FROM_YOUSIGN || __GB_FROM_INTUIT ) + ( __GB_TO_ONMICROSOFT || __GB_TO_TEST_GOOGLE || __GB_TO_NOREPLY || __GB_TO_PURCHASE || __GB_TO_LOCAL_NOVOWEL ) + ( __GB_PHONE || GB_OBFU_PHONE ) >= 3 ) score GB_FAKE_INVOICE 5.5 else meta GB_FAKE_INVOICE ( ( __GB_FROM_PAYPAL || __GB_FROM_DOCUSIGN || __GB_FROM_ZELLEPAY || __GB_FROM_BESTBUY || __GB_FROM_ADOBE || __GB_FROM_YOUSIGN || __GB_FROM_INTUIT ) + ( __GB_TO_ONMICROSOFT || __GB_TO_TEST_GOOGLE || __GB_TO_NOREPLY || __GB_TO_PURCHASE || __GB_TO_LOCAL_NOVOWEL ) + ( __GB_PHONE || GB_OBFU_PHONE ) + __GB_FRAUD_PAYPAL >= 4 ) score GB_FAKE_INVOICE 7.0 endif describe GB_FAKE_INVOICE Fake Docusign or Paypal invoice body __GB_BTC1 /\b(?:BTC|Bitcoin)\b/i meta GB_FAKE_INVOICE_BTC ( GB_FAKE_INVOICE && __GB_BTC1 ) describe GB_FAKE_INVOICE_BTC Fake Docusign or Paypal invoice mentioning Bitcoins score GB_FAKE_INVOICE_BTC 4.5 header __GB_FROM_ZOHOINVOICE From:addr =~ /\@(?:sender\.zohoinvoice\.com|zohosign\.com)/ meta GB_FAKE_ZOHOINVOICE ( __GB_FROM_ZOHOINVOICE + FREEMAIL_REPLYTO_END_DIGIT + ( __GB_PHONE || GB_OBFU_PHONE ) >= 3 ) describe GB_FAKE_ZOHOINVOICE Fake Zoho invoice score GB_FAKE_ZOHOINVOICE 3.0 header __GB_FROM_VENMO From:addr =~ /\@venmo\.com/ header __GB_ORG_ONMICROSOFT X-OriginatorOrg =~ /\.onmicrosoft\.com/ meta GB_FAKE_VENMO ( __GB_FROM_VENMO + ( __GB_ORG_ONMICROSOFT || __GB_TO_PURCHASE ) + GB_OBFU_PHONE >= 3 ) describe GB_FAKE_VENMO Fake Venmo invoice score GB_FAKE_VENMO 3.0 header __GB_FROM_PAYPAL From:name =~ /Paypal/i header __GB_ENVFROM_PAYPAL From:addr =~ /\@paypal\.com/ meta GB_PAYPAL_BTC_PHONE ( ( __GB_FROM_PAYPAL && !__GB_ENVFROM_PAYPAL ) && __GB_BTC1 && ( __GB_PHONE || GB_OBFU_PHONE ) && MONEY_NOHTML ) describe GB_PAYPAL_BTC_PHONE Paypal scam score GB_PAYPAL_BTC_PHONE 3.0 body __GB_PAYPAL_INVOICE /Paypal Invoice|Sales receipt/i meta GB_PAYPAL_BTC_INV ( __GB_PAYPAL_INVOICE && __KAM_PAYPAL2A && __GB_BTC1 && ( __GB_PHONE || GB_OBFU_PHONE ) ) describe GB_PAYPAL_BTC_INV Paypal BTC scam score GB_PAYPAL_BTC_INV 2.0 ifplugin Mail::SpamAssassin::Plugin::RaptorOnly meta GB_PAYPAL_SHORT ( ( __GB_FROM_PAYPAL && !__GB_ENVFROM_PAYPAL ) && ( KAM_IFRAME || __KAM_SHORT ) && KAM_RAPTOR_NEW ) describe GB_PAYPAL_SHORT Fake Paypal email with an url shortener score GB_PAYPAL_SHORT 2.0 endif ifplugin Mail::SpamAssassin::Plugin::URIDetail uri_detail GB_INVOICE_GDRIVE cleaned =~ /drive\.google\.com\/uc\?export\=download/ text =~ /pay\s+invoice/i describe GB_INVOICE_GDRIVE Invoice link to GDrive score GB_INVOICE_GDRIVE 2.0 uri_detail GB_INVOICE_DROPBOX cleaned =~ /dropbox\.com\/.{3,128}\.html/ text =~ /invoice|receipt/i describe GB_INVOICE_DROPBOX Invoice link to Dropbox score GB_INVOICE_DROPBOX 2.0 uri_detail GB_PASS_GTRANSLATE cleaned =~ /\.translate\.goog\// text =~ /same password/i describe GB_PASS_GTRANSLATE Google Translate service abuse score GB_PASS_GTRANSLATE 1.5 uri_detail GB_WEBCORE_PASS cleaned =~ /\.web\.core\.windows\.net\// text =~ /same password/i describe GB_WEBCORE_PASS Windows web core service abuse score GB_WEBCORE_PASS 1.5 endif #COMPROMISED ACCOUNT SPAMS - SCORED HIGH BECAUSE THESE ARE COMPROMISED ACCOUNTS header __KAM_COMPROMISED1A From =~ /\@(yahoo.com|yahoo.com.id|rocketmail.com)/i header __KAM_COMPROMISED1B X-Mailer =~ /Yahoo/i header __KAM_COMPROMISED2 Subject =~ /^(FOR |Hey$|hi$|look at this$|great!?$|amazing!?|the best!?$|excellent!?$|very good!?$|great!?$|question?$|Fwd: (?:latest |top )?news$)|have a look/ body __KAM_COMPROMISED3 /\d{1,2}[\\\/]\d{1,2}[\\\/]\d{2,4} \d{1,2}\:\d{1,2}\:\d{1,2} (AM|PM)/ body __KAM_COMPROMISED4 /How are you\? Look at this.{0,70}Do you know about this site|look at this site right now|I found (an amazing|great) site|hey\. please have a look|have a look right now|breaking news/i meta KAM_COMPROMISED ((__KAM_COMPROMISED1A + __KAM_COMPROMISED1B >=1 ) + __KAM_COMPROMISED2 + __KAM_COMPROMISED3 + __KAM_COMPROMISED4 + __KAM_BODY_LENGTH_LT_128 + MISSING_SUBJECT >= 4) describe KAM_COMPROMISED Compromised Accounts Sending Spam score KAM_COMPROMISED 8.25 #GROUPS THAT ARE BAD - RENAMED TO AVOID COLLISSION - THANKS TO DAVID FUNK header __KAM_LIST2A List-ID =~ /^<?(wareeed\d*|ArabBusinessmen\-and\-DecisionMakers\-Network|MediaJO\d*|arabjo\d*|prime\-?media\d*|mediajoshoot\d*|bareedw\d*|mghadeh\d*|tawzeef\-online|jordanianadd\d*|ssjo\d*|jaracast|ads\-shooter\-j\d*|jomarketing\d*|jomedia\d*|jobird\d*info|uhrda\-\d*|mohanndahad\d*|caragcom\d*|marwahr\d*|sonjobonjo\d*|golrozz\d*|golbanoo\d*|reka\-ppe|(google|seo)\-ranking\-service\-provider\-s\d+)\.googlegroups.com>?$/i header __KAM_LIST2B Sender =~ /(mediajo\d*|aloulaonline\d*|jomedia\d*|golbanoo\d*)\@googlegroups\.com/i meta KAM_LIST2 (__KAM_LIST2A + __KAM_LIST2B >= 1) describe KAM_LIST2 Known Bad Groups score KAM_LIST2 60.0 #LIMITED ACCESS/QUOTA SCAMS - ISP THAT SEND LEGITIMATE NOTICES MIGHT WANT TO LOWER THE SCORE body __KAM_QUOTA1 /Mailbox Quota Has Exceeded|exceeded its storage limit/i body __KAM_QUOTA2 /Limited Access|termination of your email|restore.your.account|will.not.be.able/i meta KAM_QUOTA (__KAM_QUOTA1 + __KAM_QUOTA2 >= 2) describe KAM_QUOTA Limited Access / Quota Phishing Scam score KAM_QUOTA 3.0 # BACKGROUND CHECK SPAM body __KAM_BACK1 /backgrounds in seconds|Instant..?Checkmate|federal.record|background.report|reputation/i body __KAM_BACK2 /(Property & Personal history|Asset & Background) (Investigation|Search)|check anyone|know.anything|registered.offense|publicly.available|their name/is body __KAM_BACK3 /(background check|detective|investigator|investigate backgrounds|arrest.record|public.record)|remain.anonymous|anonymous.report|says.about.you|instant.database|the.truth|reveal.the.information|screening.services/is header __KAM_BACK4 Subject =~ /background..?check|date\-smart|detective|finding people|instant checkmate|pedophile|who.lives.next.?door|reports.are.now.posted|screening.results|police.record|confirm.identity|records.enclosed|local.report|criminal|public.record|complete.record|arrest|posted.online|information.posted|info.updated|who.they.are|uncover.any|private.eye|investigate.background/i header __KAM_BACK5 From =~ /Background.?check|instant.?check|arrest.record|pedophile|trust|criminal|urgent.info|find.out|who.is.s?he|trouble|shady|public.record|private.?eye/i describe KAM_BACK Background Check SPAM meta KAM_BACK ( __KAM_BACK1 + __KAM_BACK2 + __KAM_BACK3 + __KAM_BACK4 + __KAM_BACK5 >= 5 ) score KAM_BACK 4.5 #ARREST RECORD SCAMS header __KAM_ARREST1 Subject =~ /arrest record|with.a.criminal|child.predator|public.safety.alert|full.report|reports?.now.posted|records?.(now.)?(available|posted)|predator.identified/i body __KAM_ARREST2 /Instant Checkmate|dirty Truth|\brapist\b|criminal.(background|record)|predator|stay.safe|child.offender|think.you.know|know.everything|database.screening|know.something|wanted.to.know|arrest.record/i header __KAM_ARREST3 From =~ /Checkmate|alert|protect|arrest|neighborhood|criminal|live.safe/i meta KAM_ARREST (__KAM_ARREST1 + __KAM_ARREST2 + __KAM_ARREST3 >=3) || (__KAM_ARREST1 + KAM_SHORT + __KAM_BODY_LENGTH_LT_128 >=3) describe KAM_ARREST Arrest Record Scams score KAM_ARREST 5.0 #MORE DIET SCAMS header __KAM_DIET2_1 From =~ /Coffee.?Bean|Fat.?Burning.?Hormone|Saffron|Lifestyle|burn.fat|slim|dieting/i header __KAM_DIET2_2 Subject =~ /diet|flatten your belly|calorie count|metabolism|lose the belly|belly flub/i body __KAM_DIET2_3 /secret to being skinny|doctors? are raving|testosterone|could be \d+ ?lbs? lighter|feeling chubby|burn stubborn fat|lose weight fast/i meta KAM_DIET2 (__KAM_DIET2_1 + __KAM_DIET2_2 + __KAM_DIET2_3 + KAM_INFOUSMEBIZ >=3) describe KAM_DIET2 Diet Scams score KAM_DIET2 5.0 #CIGAR SCAMS header __KAM_CIGAR1 Subject =~ /Premium Cigar|Essentials for Dad|cigar lover/i header __KAM_CIGAR2 From =~ /Cigar/i body __KAM_CIGAR3 /Thompson Cigar|Premium Cigar/i meta KAM_CIGAR (__KAM_CIGAR1 + __KAM_CIGAR2 + __KAM_CIGAR3 + __KAM_THIRD >= 3) describe KAM_CIGAR Cigar Scam Emails score KAM_CIGAR 6.0 #TK DOMAINS rawbody KAM_TK /https?:\/\/.{5,30}\.tk\//i describe KAM_TK Abuse of .tk domain registrar which offers free domains score KAM_TK 5.0 #THIRD PARTY / SENT BY XXXX body __KAM_THIRD /advertisement.{0,12}sent by a third\-?party|sent.by.tb.systems|is.an.advert[il]se?ment/i #LASIK header __KAM_LASIK1 From =~ /Lasik/i header __KAM_LASIK2 Subject =~ /Lasik|free eval|A great use for your Tax Refund|eye.surgery/i body __KAM_LASIK3 /free (?:Lasik )?eval|\d+ per eye|get lasik info|L.SI. V....n In.t.tut. Summ.r S.v.ng.|works.faster.than/i uri __KAM_LASIK4 /lasik\.php/i meta KAM_LASIK (__KAM_LASIK1 + __KAM_LASIK2 + __KAM_LASIK3 + (__KAM_LASIK4 || KAM_EU) >= 3) describe KAM_LASIK Lasik Treatment Spams score KAM_LASIK 4.5 #FAKE NOTIFIES header __KAM_NOTIFY1 From =~ /Support|Notifier|Reminder|Assistance|Administrator|RuneScape|Wells ?Fargo|Scotia|Diablo|MAILER\-DAEMON|Notifications/i body __KAM_NOTIFY2 /[2-9] friend request( |\b)|sell your personal|mandatory validation|verify your Account|unread messages/i header __KAM_NOTIFY3 From =~ /\.br>/i meta KAM_NOTIFY (__KAM_NOTIFY1 + __KAM_PHISH2_3 + __KAM_NOTIFY2 + __KAM_NOTIFY3 >= 3) describe KAM_NOTIFY Fake Notifications score KAM_NOTIFY 4.0 meta KAM_NOTIFY2 (KAM_NOTIFY + (KAM_IFRAME || HEADER_FROM_DIFFERENT_DOMAINS) >= 2) describe KAM_NOTIFY2 Higher likelihood of fake notification score KAM_NOTIFY2 3.0 #LANGUAGE header __KAM_LANG1 From =~ /Pimsleur|learnalanguage/i header __KAM_LANG2 Subject =~ /language barrier|(?:learn|speak)(?:ing)? (?:a|any) (?:new )?language|Pimsleur/i body __KAM_LANG3 /pimsleur|Language in just \d+ Day/i meta KAM_LANG (__KAM_LANG1 + __KAM_LANG2 + __KAM_LANG3 + KAM_INFOUSMEBIZ >= 3) describe KAM_LANG Language Method Spams score KAM_LANG 4.5 #FAKE TRACK header __KAM_TRACK1 From =~ /Worldwide Express|Priority Mail|First\-Class Mail|Express Mail/i meta KAM_TRACK (__KAM_PHISH2_3 + __KAM_TRACK1 >= 2) describe KAM_TRACK Fake Tracking Emails score KAM_TRACK 3.0 #BACK TO SCHOOL header __KAM_SCHOOL1 From =~ /Classes/i header __KAM_SCHOOL2 Subject =~ /(?:Return|Back) to School/i meta KAM_SCHOOL (__KAM_SCHOOL1 + __KAM_SCHOOL2 + KAM_INFOUSMEBIZ >= 3) describe KAM_SCHOOL School Spams score KAM_SCHOOL 5.0 #MEMBERS header __KAM_MEMBER1 From =~ /(\b|^|)Date|(\b|^|)Dating|eharmony(.com)?.?partner|(..?en..?or|black)..?e.ple..?eet|cougars|singles|match|our.?time|lonely|affair/i header __KAM_MEMBER2 Subject =~ /naughty|looking for love|single & dating|Dating.site|free.this.weekend|free.communication.weekend|True Love|(Older|black|available|latin[oa]|jewish) Single|single.women|single.photo|local.cougar|want to date|fall in love|meet...1000s|dream.date|meet.single|your.matches|for.single|singles|eharmony(.com)?.match|50\+.{0,5}ngles|your.ex.back|married.dating|(anonymous|secret).affair|unlimited.pics|dating.(video|movie)|fetish|still.single/i body __KAM_MEMBER3 /(\b|^)dating\b(?! service)|eharmony|Find.Your.Perfect.Match|thousands.of.single.women|singles?.photos?|local.cougar|successfully matched|blind date|(available|black|latin[oa]|jewish).singles|photos of 50\+/i rawbody __KAM_MEMBER4 /special promotion|free.this.weekend|personal matchmaker|dating service|fall in love|looking.for.someone|kindle.the.passion|cheating.member|dating.mega.site|free.dating|free.fetish/i meta __KAM_MEMBER5 (KAM_INFOUSMEBIZ || KAM_COUK) #header __KAM_MEMBER6 From =~ /Updat/i meta KAM_MEMBER (__KAM_MEMBER1 + __KAM_MEMBER2 + __KAM_MEMBER3 + __KAM_MEMBER4 + __KAM_MEMBER5 >= 3) describe KAM_MEMBER Dating Scams score KAM_MEMBER 4.5 #MEDICARE header __KAM_MEDICARE1 From =~ /(Medicare|health.?options|enrollment)/i header __KAM_MEDICARE2 Subject =~ /medicare|message for senior|baby\-boomer|save up to|compare.quotes|enrollment.plan/i body __KAM_MEDICARE3 /medicare.(plan|recipient|annual election)/i tflags __KAM_MEDICARE3 nosubject body __KAM_MEDICARE4 /over.(65|sixty.?five)|most.affordable|lower.your.premium|medicare basics guide/i meta KAM_MEDICARE (__KAM_MEDICARE1 + __KAM_MEDICARE2 + (__KAM_MEDICARE3 + __KAM_MEDICARE4 >= 1) + (KAM_INFOUSMEBIZ || KAM_COUK) >= 3) describe KAM_MEDICARE Medicare Scams score KAM_MEDICARE 4.0 #BILLS header __KAM_BILLS1 From =~ /LowerMyBills|mortgage/i header __KAM_BILLS2 Subject =~ /Save up to \$\d|refi requirement|refi.program/i meta KAM_BILLS (__KAM_BILLS1 + __KAM_BILLS2 + KAM_INFOUSMEBIZ >= 3) describe KAM_BILLS Bill Pay Spams score KAM_BILLS 4.0 #HOSE header __KAM_HOSE1 From:name =~ /Pocket Hose|gardening|hydroeasy/i header __KAM_HOSE1A From:addr =~ /\.(house|co|store)$/i header __KAM_HOSE2 Subject =~ /(best|garden|expandable) hose|garden(ing)? and lawn|hose is ready|hose gets tangled/i body __KAM_HOSE3 /(pocket|garden|expandable).hose|(anti|never).kink|FLEX Technology|hydroeasy/i tflags __KAM_HOSE3 nosubject meta KAM_HOSE (__KAM_HOSE1 + __KAM_HOSE2 + __KAM_HOSE3 + (__KAM_HOSE1A + KAM_INFOUSMEBIZ + KAM_SOMETLD_ARE_BAD_TLD + DKIM_INVALID >=1) >= 3) describe KAM_HOSE Garden Hose Spams score KAM_HOSE 4.5 #FLEXHOSE #header __KAM_FLEXHOSE1 Subject =~ /stretch but not kink|flex.{0,8}hose|expands.and.contracts|\d-in-\d.hose/i #header __KAM_FLEXHOSE2 From =~ /hose/i #body __KAM_FLEXHOSE3 /stretch but not kink|flex.?hose|expanding.hose|garden.hose/i #meta KAM_FLEXHOSE (__KAM_FLEXHOSE1 + __KAM_FLEXHOSE2 + __KAM_FLEXHOSE3 >= 3) #describe KAM_FLEXHOSE Product Spam du Jour #score KAM_FLEXHOSE 3.5 #AV header __KAM_AV1 From =~ /Norton/i header __KAM_AV2 Subject =~ /Update now|Are you protected/i meta KAM_AV (__KAM_AV1 + __KAM_AV2 + KAM_INFOUSMEBIZ >= 3) describe KAM_AV Anti-Virus Spams score KAM_AV 4.0 #MASCARA header __KAM_MASCARA1 From =~ /smartlash/i header __KAM_MASCARA2 Subject =~ /mascara/i body __KAM_MASCARA3 /smartlash/i meta KAM_MASCARA (__KAM_MASCARA1 + __KAM_MASCARA2 + __KAM_MASCARA3 + KAM_INFOUSMEBIZ >= 3) describe KAM_MASCARA Make-up Spams score KAM_MASCARA 4.5 #LAUNCH PCCC WILD RBL #COLLEGE header __KAM_COLLEGE1 From =~ /degree|doctorate|online/i header __KAM_COLLEGE2 Subject =~ /college|ph\.?d|earning your degree|online doctorate|advance your career/i rawbody __KAM_COLLEGE3 /online degree|ph\.?d online|online doctorate|advance your career with a degree/i meta KAM_COLLEGE (__KAM_COLLEGE1 + __KAM_COLLEGE2 + __KAM_COLLEGE3 + KAM_INFOUSMEBIZ + __KAM_URIBL_PCCC >= 3) describe KAM_COLLEGE Online Degree/Aid Spams score KAM_COLLEGE 4.0 #SURVEY header __KAM_SURVEY1 From =~ /Survey|safecount|privacy/i header __KAM_SURVEY2 Subject =~ /win an ipad/i body __KAM_SURVEY3 /Do You Use Instagram|Complete the survey|win a great prize/i meta KAM_SURVEY (__KAM_SURVEY1 + __KAM_SURVEY2 + __KAM_SURVEY3 + KAM_INFOUSMEBIZ >= 3) describe KAM_SURVEY Online Survey Spams score KAM_SURVEY 4.5 #LAKE #REMOVED 1/7/2014 #rawbody KAM_LAKE /http:\/\/.{0,13}(lak|ake|iver).{0,10}\.(com|info)\//i #describe KAM_LAKE Odd spamming engine LAKE signature on URLs #score KAM_LAKE 0.25 #SNORE header __KAM_SNORE1 From =~ /snoring|zquiet/i header __KAM_SNORE2 Subject =~ /zquiet|Jaw Supporter|z{6}|the.only.thing/i body __KAM_SNORE3 /stop snoring|zquiet|Jaw Supporter|get.rest|end.snoring|more.rest|to.be.tired/i meta KAM_SNORE (__KAM_SNORE1 + __KAM_SNORE2 + __KAM_SNORE3 + KAM_INFOUSMEBIZ >= 3) describe KAM_SNORE Snoring Aid Spams score KAM_SNORE 4.0 #VACATION header __KAM_VACATION1 From =~ /Promotions|cruise|vacation/i header __KAM_VACATION2 Subject =~ /Free Florida vacation|(carr?ibb?ean|alaskan?).cruise|european destination/i body __KAM_VACATION3 /Resorts FOR FREE|(carr?ibb?ean|alaskan?).cruise|top deals/i meta KAM_VACATION (__KAM_VACATION1 + __KAM_VACATION2 + __KAM_VACATION3 + KAM_INFOUSMEBIZ >= 3) describe KAM_VACATION Vacation Spams score KAM_VACATION 4.0 #BLOOD PRESSURE header __KAM_BLOOD1 From =~ /Marine Essent|blood.pressure/i header __KAM_BLOOD2 Subject =~ /Blood Pressure|the.(nurse|doctor).said|do.this.or.die|bp.med/i body __KAM_BLOOD3 /Secret Big Pharma|conspiracy|Breaking.Health.Stories/i body __KAM_BLOOD4 /Marine Essentials|this mineral|drug.companies.hate/i body __KAM_BLOOD5 /Anti\-Aging Expert|worst.food/i body __KAM_BLOOD6 /Blood pressure/i meta KAM_BLOOD ( __KAM_BLOOD1 + __KAM_BLOOD2 + __KAM_BLOOD3 + __KAM_BLOOD4 + __KAM_BLOOD5 + __KAM_BLOOD6 + KAM_INFOUSMEBIZ >= 4) describe KAM_BLOOD Blood Pressure Spams score KAM_BLOOD 4.75 #SCOOTER header __KAM_SCOOTER1 From =~ /Scooter Store/i header __KAM_SCOOTER2 Subject =~ /lack of mobility/i body __KAM_SCOOTER3 /the scooter store/i meta KAM_SCOOTER ( __KAM_SCOOTER1 + __KAM_SCOOTER2 + __KAM_SCOOTER3 + __KAM_MEDICARE2 + KAM_INFOUSMEBIZ >= 4) describe KAM_SCOOTER Blood Pressure Spams score KAM_SCOOTER 4.75 #ANATABLOC header __KAM_ANATA1 From:name =~ /Anatabloc|joint.?pain/i header __KAM_ANATA2 Subject =~ /(back|joint) pain|arthritis/i body __KAM_ANATA3 /Doctor (expose|shock|fix)|conglomerates threatening/i tflags __KAM_ANATA3 nosubject meta KAM_ANATA (__KAM_ANATA1 + __KAM_ANATA2 + __KAM_ANATA3 >= 3) describe KAM_ANATA Drug Spam score KAM_ANATA 4.5 ifplugin Mail::SpamAssassin::Plugin::RaptorOnly #BBB Phish header __KAM_BBB1 From =~ /bbb.org/i body __KAM_BBB2 /consumer's *(?:worry|uneasiness|anxiety|disturbance|concern|trouble)/i body __KAM_BBB3 /has been registered the above|(?:visiting|review at) a link below|above\-referenced complaint/i body __KAM_BBB4 /about your *(?:glance|belief|judgment)/i header __KAM_BBB5 Subject =~ /(?:client|customer).{0,5}preten|(?:Appeal|Claim|Case|No\.|Complaint).{0,3}[A-Z\d]{5}/i meta KAM_BBB (__KAM_BBB1 + __KAM_BBB2 + __KAM_BBB3 + __KAM_BBB4 + __KAM_BBB5 + SPF_FAIL + __KAM_GALLERY5 + KAM_RAPTOR_ALTERED >= 4) describe KAM_BBB Better Business Bureau Phishing score KAM_BBB 5.0 endif #PREV MARK header __KAM_MARK1 Subject =~ /[\[\<]ADV[\>\]]/i header __KAM_MARK2 Subject =~ /[\(\[\<\{\*]\s*(BULK|SPAM)\??\s*[\*\>\]\)\}]|\[\#+ ?SPAM\]/i header __KAM_MARK3 Subject =~ /[\[\<\*]\s*VIRUS\s*[\*\>\]]/i header __GB_M365_SPAM x-forefront-antispam-report =~ /SFV:SPM\;/ meta KAM_MARKADV (__KAM_MARK1 >= 1) describe KAM_MARKADV Email arrived marked as an Advertisement score KAM_MARKADV 10.0 meta KAM_MARKSPAM (__KAM_MARK2 >= 1) describe KAM_MARKSPAM Email arrived marked as Spam score KAM_MARKSPAM 10.0 meta GB_M365_SPAM ( __GB_M365_SPAM >= 1 ) describe GB_M365_SPAM Email arrived marked as Spam by M365 score GB_M365_SPAM 10.0 meta KAM_MARKVIRI (__KAM_MARK3 >= 1) describe KAM_MARKVIRI Email arrived marked as Virus score KAM_MARKVIRI 10.0 #H1QNUM ENGINE rawbody __KAM_H1QNUM1 /<h1>(vv5|ORG1|IN2|OR3|AR1|FO1|Q22)<\/h1>/i header __KAM_H1QNUM2 Subject =~ /Russian Women|Free Lasik|Criminal Records|Background Check|Stop Alcoholism|Alcohol Addiction|Hybrid cars|solar energy|electrical bill|fly in luxury/i uri __KAM_H1QNUM3 /\.co\.uk/i meta KAM_H1QNUM (__KAM_H1QNUM1 >= 1) describe KAM_H1QNUM H1 Qnum indicator score KAM_H1QNUM 4.0 meta KAM_H1QNUM2 ( KAM_H1QNUM + __KAM_H1QNUM2 + __KAM_H1QNUM3 >= 2 ) describe KAM_H1QNUM2 H1 Qnum higher spamminess indicators score KAM_H1QNUM2 5.0 #AP header __KAM_AP1 From =~ /AP/ header __KAM_AP2 Subject =~ /Community & educational development/i body __KAM_AP3 /American Grants and Loans Catalog/i meta KAM_AP (__KAM_AP1 + __KAM_AP2 + __KAM_AP3 >= 3) describe KAM_AP American Publishing Spam score KAM_AP 4.5 #CO.UK header KAM_COUK From =~ /\@.{1,30}\.co\.uk/i describe KAM_COUK Scoring .co.uk emails higher due to poor registry security. score KAM_COUK 0.15 #FAKE FACEBOOKMAIL #REAL FB DOMAIN header __KAM_FACEBOOKMAIL1 From =~ /\@facebookmail.com/i #SPECIFIC PEOPLE header __KAM_FACEBOOKMAIL2 From =~ /Ramakanth Raavi/i meta KAM_FACEBOOKMAIL ((__KAM_FACEBOOKMAIL2 >= 1) || (__KAM_FACEBOOKMAIL1 >=1 && (SPF_FAIL + DKIM_ADSP_ALL >=1))) describe KAM_FACEBOOKMAIL Fake or Abused Facebook Mail score KAM_FACEBOOKMAIL 8.0 #FAKE DHL/FEDEX/ETC body __KAM_FAKE_DELIVER1 /courier couldn.?t make the delivery|Courier was unable to deliver|courier company was not able to deliver|memo.of.application|delivering.address|make.the.delivery|see.attached.file|attention.please|event.invitation|could not deliver|delivery.label|postal.noti(fication|ce)|parcels.(has|have).been.shipped|shipment.label.is.attached|confirm your shipping|view file in attach|unable to locate your address|stored in our local depot|delivery failed/i header __KAM_FAKE_DELIVER2 Subject =~ /Invalid Address|shipping service|(ship|postal|delivery) notification|Delivery Failure|Delivery Information|Delivery status|(pending|Package) Delivery|package is available for pickup|your.package.(has.)?arrived|attention.please|delivery.(attempt|problem)|id.\d{6}|deliver.(your|the).parcel|shipping confirmation|confirm your address|shipment request|parcel is on hold/i #DHL header __KAM_FAKE_DELIVER3 From:name =~ /DHL/i header __KAM_FAKE_DELIVER4 From:addr !~ /dhl\.com/i body __KAM_FAKE_DELIVER4A /dhl team/i #FEDEX rawbody __KAM_FAKE_DELIVER5 /Fed ?ex/i header __KAM_FAKE_DELIVER6 From !~ /fedex\.com|narvar\.com/i #USPS body __KAM_FAKE_DELIVER7 /USPS/i header __KAM_FAKE_DELIVER8 From !~ /usps\.com/i #CARGO body __KAM_FAKE_DELIVER9 /CARGO/ header __KAM_FAKE_DELIVER10 From =~ /shipping|economy|priority/i #USPS body __KAM_FAKE_DELIVER11 /DPD/i header __KAM_FAKE_DELIVER12 From !~ /dpd\.com|dpd\.co\.uk/i #ODD DELIVERY uri __KAM_FAKE_DELIVER13 /(cdn\.discordapp\.com|wp\-conten|wp\d+\.server|onedrive\.live\.com)/i body __KAM_FAKE_DELIVER13A /open the enclosed receipt|print the receipt/i meta KAM_FAKE_DELIVER (__KAM_FAKE_DELIVER1 + __KAM_FAKE_DELIVER2 + ((__KAM_FAKE_DELIVER3 + __KAM_FAKE_DELIVER4 + __KAM_FAKE_DELIVER4A >= 2) + (__KAM_FAKE_DELIVER5 + __KAM_FAKE_DELIVER6 >= 2) + (__KAM_FAKE_DELIVER7 + __KAM_FAKE_DELIVER8 >= 2) + (__KAM_FAKE_DELIVER11 + __KAM_FAKE_DELIVER12 >= 2) + (__KAM_FAKE_DELIVER9 + __KAM_FAKE_DELIVER10 >= 2) >= 1) + (HEADER_FROM_DIFFERENT_DOMAINS + SPF_SOFTFAIL + KAM_RAPTOR_ALTERED + __KAM_FAKE_DELIVER13 + __KAM_FAKE_DELIVER13A >= 1) >= 3) describe KAM_FAKE_DELIVER Fake delivery notifications score KAM_FAKE_DELIVER 6.25 meta KAM_REALLY_FAKE_DELIVER (KAM_FAKE_DELIVER + KAM_RPTR_PASSED + (__KAM_FAKE_DELIVER4 && __KAM_FAKE_DELIVER6 && __KAM_FAKE_DELIVER8) >= 3) score KAM_REALLY_FAKE_DELIVER 2.5 describe KAM_REALLY_FAKE_DELIVER Definitely fake delivery notifications #SOLAR POWER header __KAM_SOLAR1 From =~ /Solar|electric|regard|energy|.olar..etwork/i header __KAM_SOLAR2 Subject =~ /power bill|sells power|electric(al)? bill|subsidize your solar|switching to solar|save \d+\%|solar system saves|solar power plant|solar.america|energy.use|solar.incentive|utility.option|go.solar|govt.rebate|.overnment.incentive|electricity|obama.rebate/i body __KAM_SOLAR3 /power bill in half|go solar|approved for solar|solar system saves|reduce your electric|energy.cost|energy.bill|government.incentive|can.profit|utility.bill|switch(ing)?.to.solar|solar.incentive|solar.now|US Solar Dept|your.electric.bill|your.home.qualifies|yard lights|solarglow/i meta KAM_SOLAR (__KAM_SOLAR1 + __KAM_SOLAR2 + __KAM_SOLAR3 >=2) describe KAM_SOLAR Solar Power Spams score KAM_SOLAR 1.0 meta KAM_SOLAR_HIGH (__KAM_SOLAR1 + __KAM_SOLAR2 + __KAM_SOLAR3 >=3) describe KAM_SOLAR_HIGH Definite Solar Power Spams score KAM_SOLAR_HIGH 2.5 #ASIAN BRIDE header __KAM_ASIAN1 Subject =~ /(Chinese|Asian) (girl|Lad|Bride)|heart?beat when seeing her|such a beauty/i body __KAM_ASIAN2 /Adoring Asian|(\d\+|thousands of) Asian (women|Girls)|Asian Girlfriend|pics of hot|date an? asian|chat and cam/i header __KAM_ASIAN3 From =~ /asian/i meta KAM_ASIAN (__KAM_ASIAN1 + __KAM_ASIAN2 + __KAM_ASIAN3 >= 3) describe KAM_ASIAN Asian Bride/Dating Spams score KAM_ASIAN 3.5 #DR OZ SPAM header __KAM_OZ1 From =~ /(Dr|Doc).{0,2}[o0]z|[o0]z.([a-z]+.)?(daily|tip|show|weight)|rapid.loss|ellen|drop.lbs/i #NOTE THE ZERO header __KAM_OZ2 Subject =~ /Fatburning|healthy?.tip|melt your fat|must.read.tip|i can help|fat to flat|perfect.skin|workout|drop.\d+.?[il]bs?|without.exercise|must.read|oz.in.your.corner|It (does not|doesn't) have to be hard|racha?el and oz|doc.?oz insid|life.changing|\d+%.increase|anti.aging|she.looks.\d+|ellen.did.this|(Dr|Doc).{0,2}[o0]z|[o0]z.([a-z]+.)?(daily|tip|show)/i body __KAM_OZ3 /burn off your (?:body.?)?fat|(?:burn away|burn|melt) your fat|fox news video|melt the extra pounds|lost (an average of )?\d+ lbs|body.flab|look years younger|get perfect skin|healthy tips|without diet|it was just gossip|weight.loss|dropping.pounds|losing.weight|\d+.years|facelift|(Dr|Doc).{0,2}[o0]z/i #meta KAM_OZ (__KAM_OZ1 + __KAM_OZ2 + __KAM_OZ3 >= 3) #describe KAM_OZ Fake Dr. Oz Spam's #score KAM_OZ 3.5 #STUDENT LOAN header __KAM_STUDENT1 From =~ /Student.?Loan|government/i header __KAM_STUDENT2 Subject =~ /NEW GOVERNMENT PROGRAM|payback.package|assistance.package|student.loan|consolidate.loan/i body __KAM_STUDENT3 /penalt(y|ies)|garnish|your.debt|president.loan|reduce.(your.)?(student.)?loan|forgiveness.plan|qualify.for|federal.program|low.monthly/i meta KAM_STUDENT (__KAM_STUDENT1 + __KAM_STUDENT2 + __KAM_STUDENT3 + (KAM_INFOUSMEBIZ || KAM_COUK || KAM_HTMLNOISE || KAM_SHORT) >= 3) describe KAM_STUDENT Student Loan Forgiveness Spams score KAM_STUDENT 4.0 #TIP header __KAM_TIP1 From =~ /Beauty Tips/i header __KAM_TIP2 Subject =~ /Dark\-Circles|undereye bags/i body __KAM_TIP3 /undereye bags/i body __KAM_TIP4 /Find Out This Quick New Trick/i meta KAM_TIP (__KAM_TIP1 + __KAM_TIP2 + __KAM_TIP3 + __KAM_TIP4 >= 3) describe KAM_TIP Beauty Tip Spams score KAM_TIP 4.3 #WhatsApp header __KAM_WHATS1 From =~ /WhatsApp/i header __KAM_WHATS2 Subject =~ /Voice Message Notification/i body __KAM_WHATS3 /WhatsApp/ meta KAM_WHATS (__KAM_WHATS1 + __KAM_WHATS2 + __KAM_WHATS3 >= 3) describe KAM_WHATS WhatsApp Spams score KAM_WHATS 3.0 #QTJars header __KAM_QTJARS1 From =~ /qtjar/i header __KAM_QTJARS2 Subject =~ /qtjar|left you a message|new message/i body __KAM_QTJARS3 /qtjars/ body __KAM_QTJARS4 /private message/ meta KAM_QTJARS (__KAM_QTJARS1 + __KAM_QTJARS2 + __KAM_QTJARS3 + __KAM_QTJARS4 >= 3) describe KAM_QTJARS QTJars Spams score KAM_QTJARS 3.0 #GOOGLE DOCS PHISH # view the agreement. body __KAM_GOOGLEPHISH1 /copy of the signed agreement/i rawbody __KAM_GOOGLEPHISH2 /http:\/\/.{5,50}\/http\/docs\.google\.com\/login\//i meta KAM_GOOGLEPHISH (__KAM_GOOGLEPHISH1 + __KAM_GOOGLEPHISH2 >= 2) describe KAM_GOOGLEPHISH Google Login Phishing Scam score KAM_GOOGLEPHISH 5.0 #POLITICAL SPAM header __KAM_POLY1 Subject =~ /Barack Obama/i body __KAM_POLY2 /The End of Barack Obama/i meta KAM_POLY (__KAM_POLY1 + __KAM_POLY2 >= 2) describe KAM_POLY Political Spams score KAM_POLY 3.0 #MAID header __KAM_MAID1 Subject =~ /Maid Services|housekeeping.service/i header __KAM_MAID2 From =~ /Maid|Housekeeper/i body __KAM_MAID3 /Pre\-Screened Housekeepers|local.maid/i meta KAM_MAID (__KAM_MAID1 + __KAM_MAID2 + __KAM_MAID3 >= 3) describe KAM_MAID Maid Service Spams score KAM_MAID 3.0 #TUB header __KAM_TUB1 Subject =~ /Walk.?in.*tub|bath and massage/i header __KAM_TUB2 From =~ /jacuzzi|walk.?in.?tub|premier.?care|improvement.center|bathing..?easy/i body __KAM_TUB3 /Walk.?in (hot.?|bath.?)?tub|bath and massage|easy transfer from a wheelchair/i meta KAM_TUB (__KAM_TUB1 + __KAM_TUB2 + __KAM_TUB3 >= 3) describe KAM_TUB Tub Spams score KAM_TUB 4.0 #OBFUSCATE PORN header __KAM_OBF1 Subject =~ /(\b|^)(P.{0,2}O.{0,2}R.{0,2}N|S.{0,2}E.{0,2}.X.{0,2})/i header __KAM_OBF2 Subject =~ /[-:\#\/_\(\)].{0,10}[-:\#\/_\(\)].{0,10}[-:\#\/_\(\)]/ header __KAM_OBF3 Subject =~ /(\b|^)P.{0,2}r.{0,2}e.{0,2}m.{0,2}i.{0,2}u.{0,2}m/i header __KAM_OBF4 Subject =~ /(\b|^)P.{0,2}a.{0,2}s.{0,2}s.{0,2}/i header __KAM_OBF5 Subject =~ /(\b|^)S.{0,2}i.{0,2}t.{0,2}e.{0,2}/i header __KAM_OBF6 Subject =~ /(\b|^)F.{0,2}r.{0,2}e.{0,2}e.{0,2}/i header __KAM_OBF7 Subject =~ /(\b|^)F.{0,2}i.{0,2}l.{0,2}m.{0,2}/i header __KAM_OBF8 Subject =~ /X.X.X/ meta KAM_OBF ((__KAM_OBF3 + __KAM_OBF4 + __KAM_OBF5 + __KAM_OBF6 + __KAM_OBF7 >= 1) + __KAM_OBF1 + (__KAM_OBF2 - BODY_8BITS) >= 3) describe KAM_OBF Obfuscated Porn Spams score KAM_OBF 4.0 meta KAM_OBF (__KAM_OBF8 + __KAM_OBF2 >= 2) describe KAM_OBF Obfuscated Porn Spams score KAM_OBF 2.0 #SHARK TANK header __KAM_SHARKTANK_SUBJ Subject =~ /shark tank/i body __KAM_SHARKTANK_BODY /shark tank/i meta KAM_SHARKTANK (__KAM_SHARKTANK_SUBJ + __KAM_SHARKTANK_BODY >= 1) score KAM_SHARKTANK 1.0 describe KAM_SHARKTANK Mentions Shark Tank rawbody __KAM_SHARKPROD /high blood pressure|Dermabellix|follicles|drop 20|(^|\b)IQ($|\b)|keto SS/is meta KAM_SHARKPROD (__KAM_SHARKPROD + KAM_SHARKTANK >= 2) score KAM_SHARKPROD 5.0 describe KAM_SHARKPROD Shark Tank Spam #ICU TLD PROBLEMS header __KAM_ICUTLD_FROM From:addr =~ /\.icu$/i uri __KAM_ICUTLD_URI /\.icu($|\/)/i meta KAM_ICU_BAD_TLD (__KAM_ICUTLD_FROM + __KAM_ICUTLD_URI) >= 1 describe KAM_ICU_BAD_TLD .icu TLD Abuse score KAM_ICU_BAD_TLD 2.0 #HAIR LOSS / GREYING / REMOVAL header __KAM_HAIR1 Subject =~ /(Regrows?|restore your|regain your|thinning) hair|Get Your Hair Back|hair regrowth|masculine|gr[ae]y hair|hair.loss|the.hottest.concept|hair.removal|all.your.hair|(fuller|thicker).hair|hair growth/i header __KAM_HAIR2 From =~ /K.ranique|Hair Loss Solutions|hair transplant|bosley|gr[ae]y hair|hair.removal|preserve|keranique|hair.?news/i rawbody __KAM_HAIR3 /k.ranique|Hair Los Solution|Get Your Hair Back|restore your hair naturally and permanently|hair restoration|original color|dye gr[ae]y hair|defeat.your.hair.loss|stop.hair.loss|fda.approve|hair will return|reactivate dormant hair/i rawbody __KAM_HAIR4 /Hair Regrowth|Hair Club for Men|Bosley|Rejuvalex/i rawbody __KAM_NEWSLETTER /<title>Newsletter<\/title>/i meta KAM_HAIR (__KAM_HAIR1 + __KAM_HAIR2 + __KAM_HAIR3 + __KAM_HAIR4 + __KAM_TRIAL + __KAM_NEWSLETTER + KAM_WEIRDTRICK1 + KAM_SHARKTANK + KAM_ADVERT2 >=4) describe KAM_HAIR Hair Loss / Removal Spams score KAM_HAIR 4.5 #TRIAL body __KAM_TRIAL /RISK-FREE Trial|Free \d+ day trial|try it free|free.dvd.info|free.info.kit|limited..?trial|claim.package/i #UNSUB body __KAM_UNSUB1 /cancel 0ffers/i #note the zero body __KAM_UNSUB2 /u +n +s +u +b +s +c +r +i +b +e/i meta KAM_UNSUB (__KAM_UNSUB1 + __KAM_UNSUB2 >= 1) describe KAM_UNSUB Completely ridiculous unsubscribe text found score KAM_UNSUB 5.0 #MAINTENANCE / Email Phish Scams body __KAM_EMAILPHISH1 /Please login to complete update process/i meta KAM_EMAILPHISH (__KAM_EMAILPHISH1 + KAM_SHORT >= 2) describe KAM_EMAILPHISH Email Phishing Scams score KAM_EMAILPHISH 3.5 #MASSMAILER ERRORS header __KAM_MASSERROR1 Reply-to =~ /\@domain\]\]/i meta KAM_MASSERROR (__KAM_MASSERROR1 >= 1) describe KAM_MASSERROR Error in usage of a mass mailing software score KAM_MASSERROR 2.0 #CAR DEAL SPAMS header __KAM_CARDEAL1 Subject =~ /great car deal|new vehicles near you|brand new cars|cars on clearance/i header __KAM_CARDEAL2 From =~ /dealer|clearance|veh.cle/i body __KAM_CARDEAL3 /201\d Closeout pricing|New Vehicles near you|new automobiles|brand new car|\d{4} makes and models/i meta KAM_CARDEAL (__KAM_CARDEAL1 + __KAM_CARDEAL2 + __KAM_CARDEAL3 >= 3) describe KAM_CARDEAL Car Deal Spams score KAM_CARDEAL 3.0 #Quick Sale Scams header __KAM_HOMESALE1 Subject =~ /buyer interested in your ho/i header __KAM_HOMESALE2 From =~ /Fastcash/i body __KAM_HOMESALE3 /Cash Offer for Your Home/i meta KAM_HOMESALE (__KAM_HOMESALE1 + __KAM_HOMESALE2 + __KAM_HOMESALE3 >= 3) describe KAM_HOMESALE Home Sale Spams score KAM_HOMESALE 3.5 #ADVERTISEMENTS FOR LOANS header __KAM_LOAN1 Subject =~ /pay bills|borrow|business loan|help your business grow|small business|propel your business goals|with a loan|results you need|\$[\d.,]+ (tomorrow|down loan)|loan.fund|lender|are.you.broke|get.cash|approval.notice|loan \d.\d% offer|money by tomorrow|one monthly payment/i header __KAM_LOAN2 From =~ /payday|loans for you|approval|small.?business|direct.wire|cash|loan offer|loan department|zippy ?loan|clear ?one/i body __KAM_LOAN3 /Financial Relief|need to borrow|Business Loan|instant.funds|approval department|\$\d+ down|loan option|offer.loan|expenses|times.are.tough|money.problems|zippy ?loan|advanced lender|pay off debt|development.project|just.been.approved|for.your.business|loan.solution|ease your stress/i ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __KAM_LOAN5A Content-Type =~ /loan offer/i mimeheader __KAM_LOAN5B Content-Disposition =~ /loan offer/i endif meta KAM_LOAN (__KAM_LOAN1 + __KAM_LOAN2 + __KAM_LOAN3 + (__KAM_LOAN5A + __KAM_LOAN5B >= 1) >= 3) describe KAM_LOAN Payday and other loan spams score KAM_LOAN 4.5 #HANGOVER SPAM header __KAM_HANGOVER1 Subject =~ /hangover patch/i header __KAM_HANGOVER2 From =~ /hangover/i body __KAM_HANGOVER3 /hangover patch/i meta KAM_HANGOVER (__KAM_HANGOVER1 + __KAM_HANGOVER2 + __KAM_HANGOVER3 >= 3) describe KAM_HANGOVER Hangover Patch Spams score KAM_HANGOVER 3.5 #RX PLAN SPAM header __KAM_RXPLAN1 Subject =~ /Medigap|prescription drug plan/i header __KAM_RXPLAN2 From =~ /Better.?Rx|medigap/i body __KAM_RXPLAN3 /gap coverage/i meta KAM_RXPLAN (__KAM_RXPLAN1 + __KAM_RXPLAN2 + __KAM_RXPLAN3 >= 3) describe KAM_RXPLAN Rx Plan Spams score KAM_RXPLAN 3.5 #SIDE SOCKET header __KAM_SOCKET1 Subject =~ /tangled mess|socket capacity|messy cords/i header __KAM_SOCKET2 From =~ /side.?socket/i body __KAM_SOCKET3 /side socket/i meta KAM_SOCKET (__KAM_SOCKET1 + __KAM_SOCKET2 + __KAM_SOCKET3 >= 3) describe KAM_SOCKET Product Spam du Jour score KAM_SOCKET 3.5 #TESTOSTERONE header __KAM_TESTOSTERONE1 Subject =~ /Boost your testosterone|Testoril|turning you into a woman|men into women|low.testosterone/i header __KAM_TESTOSTERONE2 From =~ /Testoril|mens health|low\-T|for.men/i body __KAM_TESTOSTERONE3 /Boost your testosterone|get your body back|low.testosterone/i body __KAM_TESTOSTERONE4 /Testoril|sexual confidence|androgel|axiron+androderm/i meta KAM_TESTOSTERONE (__KAM_TESTOSTERONE1 + __KAM_TESTOSTERONE2 + __KAM_TESTOSTERONE3 + __KAM_TESTOSTERONE4 >= 3) describe KAM_TESTOSTERONE Product Spam du Jour score KAM_TESTOSTERONE 4.5 #PET header __KAM_PET1 Subject =~ /pet health insurance|dog.product.coupon/i header __KAM_PET2 From =~ /pet.?insurance|dog.?coupon/i body __KAM_PET3 /pet health insurance|doggy.loot|coupon.notice|reduce.your.cost/i meta KAM_PET (__KAM_PET1 + __KAM_PET2 + __KAM_PET3 >= 3) describe KAM_PET Insurance and other pet-related spam score KAM_PET 4.5 meta KAM_PET2 (KAM_PET + KAM_INFOUSMEBIZ >= 2) describe KAM_PET2 Even more likely insurance and other pet-related spam score KAM_PET2 3.5 #COBRA header __KAM_COBRA1 Subject =~ /Cobra Health/i header __KAM_COBRA2 From =~ /Cobra|Health/i body __KAM_COBRA3 /find cobra health/i meta KAM_COBRA (__KAM_COBRA1 + __KAM_COBRA2 + __KAM_COBRA3 >= 3) describe KAM_COBRA Cobra Insurance Spam score KAM_COBRA 3.5 #Discount Air header __KAM_DISCAIR1 Subject =~ /Fly Cheap|Discount Air/i header __KAM_DISCAIR2 From =~ /Discount Air/i body __KAM_DISCAIR3 /Fly Cheap in Business Class/i meta KAM_DISCAIR (__KAM_DISCAIR1 + __KAM_DISCAIR2 + __KAM_DISCAIR3 >= 3) describe KAM_DISCAIR Discount Airfare Spam score KAM_DISCAIR 3.5 #PEST header __KAM_PEST1 Subject =~ /pes?t control system/i header __KAM_PEST2 From =~ /Riddex|pest/i body __KAM_PEST3 /revolutionary pes?t control system/i meta KAM_PEST (__KAM_PEST1 + __KAM_PEST2 + __KAM_PEST3 >= 3) describe KAM_PEST Spam for Pest Control score KAM_PEST 3.5 #PROPHET header __KAM_PROPHET1 Subject =~ /beezelbub|communique|prophecy|Christian Media/i header __KAM_PROPHET2 From =~ /christian.*(media|prophe)|twintongues|spiritualisraelnumber\d|TheLeastOfThese\d/i body __KAM_PROPHET3 /Dear Christian Friend|revelation \d+\:/i body __KAM_PROPHET4 /Christian ?Media\*? ?(Daily|Ministry|Prophecy)|spiritualisraelnumber\d/i body __KAM_PROPHET5 /prophecy|rapture/i meta KAM_PROPHET (__KAM_PROPHET1 + __KAM_PROPHET2 + __KAM_PROPHET3 + __KAM_PROPHET4 + __KAM_PROPHET5 >= 4) describe KAM_PROPHET Spam for Prophecy score KAM_PROPHET 8.5 #HEART header __KAM_HEART1 Subject =~ /save your life|prevent (a|your)?.?heart attacks?|\d+ second trick|sudden death|easy trick|heart health secret/i header __KAM_HEART2 From =~ /He.rt.?Att.ck|omegaK/i body __KAM_HEART3 /Knowing this could very well save your life|\d+.second trick|\#1 Trick|Prevent(ing)? A Heart Attack|will you be killed|heart disease|silent heart attack/i meta KAM_HEART (__KAM_HEART1 + __KAM_HEART2 + __KAM_HEART3 >= 3) describe KAM_HEART Spam for Heart Attack prevention score KAM_HEART 4.5 #JOINT header __KAM_JOINT1 Subject =~ /joint relief/i header __KAM_JOINT2 From =~ /Tfx/i body __KAM_JOINT3 /TFX.?(?:health|flex)|tflex/i body __KAM_JOINT4 /Joint Relief|effective as glucosamine/i body __KAM_JOINT5 /free bottle/i meta KAM_JOINT (__KAM_JOINT1 + __KAM_JOINT2 + __KAM_JOINT3 + __KAM_JOINT4 + __KAM_JOINT5 + __KAM_SKIN4 >= 4) describe KAM_JOINT Joint relief Spam score KAM_JOINT 4.0 #REHAB header __KAM_REHAB1 Subject =~ /(?:drug|alcohol) (recovery|rehab|dependenc|addict|treatment)|choose sobriety|battling alcohol|stop drinking|addiction|drinking problem|normal life|tr..?at..?ng.alcohol|overcome..lcohol|change.your.life/i header __KAM_REHAB2 From =~ /(?:drug|alcohol).?(recovery|rehab|dependenc|add..?ct|treatment)|alcoholism|rehab center|.lc.h.lism|rehabdirectory/i body __KAM_REHAB3 /(?:drug|alcohol) (recovery|rehab|dependenc|addict|treatment)|help for alcoholism|life from alcohol|end your drinking|think about rehab/i meta KAM_REHAB (__KAM_REHAB1 + __KAM_REHAB2 + (__KAM_REHAB3 || KAM_OTHER_BAD_TLD) >= 2) describe KAM_REHAB Rehab Spam score KAM_REHAB 3.0 #HAIRTRANS header __KAM_HAIRTRANS1 Subject =~ /hair restoration|man look as young|losing your hair|hair ?loss|consultations?.available/i header __KAM_HAIRTRANS2 From =~ /Bosley|hair restoration|hair.loss.expert/i body __KAM_HAIRTRANS3 /hair restoration|man look as young|losing your hair|hair ?loss|get.your.hair|(look|feel).younger/i meta KAM_HAIRTRANS (__KAM_HAIRTRANS1 + __KAM_HAIRTRANS2 + __KAM_HAIRTRANS3 + KAM_GIFT >= 2) describe KAM_HAIRTRANS Spam for Hair Restoration score KAM_HAIRTRANS 3.5 meta KAM_HAIRTRANS2 (__KAM_HAIRTRANS1 + __KAM_HAIRTRANS2 + __KAM_HAIRTRANS3 + (KAM_GIFT || KAM_UNSUB1) >= 3) describe KAM_HAIRTRANS2 Higher probability of spam for Hair Restoration score KAM_HAIRTRANS2 2.0 #OUR GIFT body __KAM_GIFTCERT1 /Our gift to you/i body __KAM_GIFTCERT2 /\$\d+ gift certificate/i header __KAM_GIFTCERT3 Subject =~ /Our gift to you/i meta KAM_GIFTCERT (__KAM_GIFTCERT1 + __KAM_GIFTCERT2 + __KAM_GIFTCERT3 >= 2) score KAM_GIFTCERT 1.5 describe KAM_GIFTCERT Gift Certificate Spams #TIRES header __KAM_TIRES1 Subject =~ /discount tire|tire coupon|tire offers|best deals/i header __KAM_TIRES2 From =~ /Tire/i body __KAM_TIRES3 /savings on tire|new tires/i meta KAM_TIRES (__KAM_TIRES1 + __KAM_TIRES2 + __KAM_TIRES3 >= 3) describe KAM_TIRES Spam for Tires score KAM_TIRES 3.0 #SLICEOMATIC header __KAM_SLICEOMATIC1 Subject =~ /Slice\-O\-Matic|Precision Cutting Blade/i header __KAM_SLICEOMATIC2 From =~ /Slice\-o\-matic/i body __KAM_SLICEOMATIC3 /Slice\-o\-matic/i meta KAM_SLICEOMATIC (__KAM_SLICEOMATIC1 + __KAM_SLICEOMATIC2 + __KAM_SLICEOMATIC3 >= 3) describe KAM_SLICEOMATIC Spam for Kitchen Tools score KAM_SLICEOMATIC 3.0 #FINDYOURWINDOWS AND OTHER WINDOW SPAM header __KAM_WINDOWS1 Subject =~ /Top Window Companies|(old|your|bedroom|new|replacement|discounted|awning|cheap).window|allow.(light|ventilation)|window.(installation|discount|replacement)|home.depot|anders.n.window/i header __KAM_WINDOWS2 From =~ /FindYourWindows|(old|your|bedroom|new|replacement|discounted).?window|window.?(install|discount|replacement)|install.windows|remodel/i body __KAM_WINDOWS3 /Find Your Windows|replacement.window|window.design|home.a.new.look|dingy.old.windows|high.heating|high.cooling|let a draft|energy.efficient|double.pane.window|shop.windows|energy.tax|window.(installation|discount|replacement)|summer.is.coming/i meta KAM_WINDOWS (__KAM_WINDOWS1 + __KAM_WINDOWS2 + __KAM_WINDOWS3 + KAM_ADVERT2 >= 3) describe KAM_WINDOWS Spam for House Windows score KAM_WINDOWS 4.5 #EMMAPP.WEB.COM - DUE TO SA SILLINESS WE ARE UNABLE TO RBL THIS PARTICULAR SUBDOMAIN WITHOUT BLOCKING ALL OF WEB.COM #POISON PILL uri __KAM_EMMAP_WEB_COM1 /emmapp\.web\.com/i meta KAM_EMMAPP_WEB_COM (__KAM_EMMAP_WEB_COM1 >= 1) describe KAM_EMMAPP_WEB_COM Spam from emmapp.web.com score KAM_EMMAPP_WEB_COM 20.0 #NEW CREDIT CARD header __KAM_NEW_CREDITCARD1 Subject =~ /with this credit card|charge card|credit card|cards?.reward|cards?.rate|top.rated/i header __KAM_NEW_CREDITCARD2 From =~ /Spend-Charge|platinum credit|business credit|card.approval|approval.match/i body __KAM_NEW_CREDITCARD3 /Select your new card|Increase Your Spending|Higher Limit|rewards|business credit|which.credit.card|find.out.now/i meta KAM_NEW_CREDITCARD (__KAM_NEW_CREDITCARD1 + __KAM_NEW_CREDITCARD2 + __KAM_NEW_CREDITCARD3 >= 3) describe KAM_NEW_CREDITCARD Spam for new credit cards score KAM_NEW_CREDITCARD 4.0 #WEIRD GERMAN SPAM header __KAM_GERMAN_BUSINESS_CONTACTS1 Subject =~ /Wichtige Nach?richt|Important message/i header __KAM_GERMAN_BUSINESS_CONTACTS2 From =~ /Merkel/i body __KAM_GERMAN_BUSINESS_CONTACTS3 /German business phone numbers/i body __KAM_GERMAN_BUSINESS_CONTACTS4 /Unlimited exportation capabilities/i meta KAM_GERMAN_BUSINESS_CONTACTS (__KAM_GERMAN_BUSINESS_CONTACTS1 + __KAM_GERMAN_BUSINESS_CONTACTS2 + __KAM_GERMAN_BUSINESS_CONTACTS3 + __KAM_GERMAN_BUSINESS_CONTACTS4 >= 3) describe KAM_GERMAN_BUSINESS_CONTACTS Weird German business contact info spam score KAM_GERMAN_BUSINESS_CONTACTS 3.0 #WEIRD SENIOR DATING SPAM header __KAM_SENIOR_DATING1 From =~ /SeniorPeopleMeet/i meta KAM_SENIOR_DATING (__KAM_SENIOR_DATING1 >= 1) describe KAM_SENIOR_DATING Senior dating spam score KAM_SENIOR_DATING 2.0 #NEWS! header __KAM_NEWS1 Subject =~ /^(?:Fwd: ?)?(?:NEWS|WEBSITE|ARTICLE)$|how.are.you/i body __KAM_NEWS2 /(?:Hello|hey|hi)!/i meta KAM_NEWS (__KAM_NEWS1 + __KAM_NEWS2 + __KAM_BODY_LENGTH_LT_128 + KAM_MANYTO >= 3) describe KAM_NEWS Forged Emails with NEWS! score KAM_NEWS 9.0 #URI COUNT - REQUIRES 3.3 OR LATER if (version >= 3.003000) uri __KAM_COUNT_URIS /^./ tflags __KAM_COUNT_URIS multiple maxhits=16 describe __KAM_COUNT_URIS A multiple match used to count URIs in a message, including http:// and email@email.com - use one of the meta rules below instead of directly using this one meta __KAM_HAS_0_URIS (__KAM_COUNT_URIS == 0) meta __KAM_HAS_1_URIS (__KAM_COUNT_URIS >= 1) meta __KAM_HAS_2_URIS (__KAM_COUNT_URIS >= 2) meta __KAM_HAS_3_URIS (__KAM_COUNT_URIS >= 3) meta __KAM_HAS_4_URIS (__KAM_COUNT_URIS >= 4) meta __KAM_HAS_5_URIS (__KAM_COUNT_URIS >= 5) meta __KAM_HAS_10_URIS (__KAM_COUNT_URIS >= 10) meta __KAM_HAS_15_URIS (__KAM_COUNT_URIS >= 15) endif #DISCLAIMER STUB FOR FUTURE RESOURCE body __KAM_DISCLAIMER1 /receives compensation/i #FAKE AT&T #header __KAM_FAKE_ATT1 From =~ /AT.?T/i #header __KAM_FAKE_ATT2 Subject =~ /AT.?T cordless phone|deals.at.at.?t|phone.from.at.?t/i #uri __KAM_FAKE_ATT3 /att-mail.com/i # #meta KAM_FAKE_ATT (__KAM_FAKE_ATT1 + __KAM_FAKE_ATT2 + __KAM_FAKE_ATT3 >= 2) #describe KAM_FAKE_ATT Fake AT&T newsletters #score KAM_FAKE_ATT 3.0 #YOU HAVE BEEN CHOSEN header __KAM_CHOSEN1 Subject =~ /Invitation to|open.house|come.join.me/i header __KAM_CHOSEN2 From =~ /marketing|invitation/i body __KAM_CHOSEN3 /You (were|have been|are) (recently )?(chosen|invited)|you.are.(very.)?welcome/i meta KAM_CHOSEN (__KAM_CHOSEN1 + __KAM_CHOSEN2 + __KAM_CHOSEN3 >= 3) describe KAM_CHOSEN Spam claiming the recipient has been chosen for something score KAM_CHOSEN 2.0 #JURY DUTY AND OTHER FAKE COURT NOTICES header __KAM_JURY1 Subject =~ /in court|court (hearing )?notice|judicial summons|hearing.of.your.case|case.in.court|notice.of.appearance/i header __KAM_JURY2 From =~ /Notice (to|of) Appear|court attendance|pretrial notice|lawyer/i header __KAM_JURY3 From !~ /\.gov/i body __KAM_JURY4 /in Court|hearing date|notice to appear|Pretrial notice|compulsory.attendance|court.notice/i meta KAM_JURY (__KAM_JURY1 + __KAM_JURY2 + __KAM_JURY3 + __KAM_JURY4 + KAM_RAPTOR_ALTERED >= 4) describe KAM_JURY Spam claiming the recipient must serve jury duty score KAM_JURY 8.0 #BITCOIN header __KAM_BITCOIN1 Subject =~ /bitcoin|dumping.?their.?gold|dumped.?the.?dollar/i body __KAM_BITCOIN2 /price.of.bitcoin|bitcoin.price|crypto.?currenc(y|ies)|currency.pioneer|cartel|financial.security|abandoned.our.dollar|money.map/i header __KAM_BITCOIN3 From =~ /bitcoin/i meta KAM_BITCOIN (KAM_INFOUSMEBIZ + __KAM_BITCOIN1 + __KAM_BITCOIN2 + __KAM_BITCOIN3 >= 3) describe KAM_BITCOIN Spam related to investing in bitcoin and other cryptocurrency score KAM_BITCOIN 4.5 #RELIGIOUS header __KAM_RELIGION1 Subject =~ /Christian Media/i header __KAM_RELIGION2 From =~ /Bible Prophecy/i body __KAM_RELIGION3 /Dear Christian|Christian Media/i meta KAM_RELIGION (__KAM_RELIGION1 + __KAM_RELIGION2 + __KAM_RELIGION3 >= 3) describe KAM_RELIGION Generic religious spam score KAM_RELIGION 2.5 #BUSINESS PHONE header __KAM_BUSINESSPHONE1 Subject =~ /customer calls|phone system|phone system upgrade|business success/i header __KAM_BUSINESSPHONE2 From =~ /business phone/i body __KAM_BUSINESSPHONE3 /business phone system/i meta KAM_BUSINESSPHONE (__KAM_BUSINESSPHONE1 + __KAM_BUSINESSPHONE2 + __KAM_BUSINESSPHONE3 >= 3) describe KAM_BUSINESSPHONE Advertising for business phone systems score KAM_BUSINESSPHONE 5.5 #NUMEROLOGY header __KAM_NUMEROLOGY1 Subject =~ /success and joy in life/i header __KAM_NUMEROLOGY2 From =~ /Numerology/i body __KAM_NUMEROLOGY3 /Control your destiny/i meta KAM_NUMEROLOGY (__KAM_NUMEROLOGY1 + __KAM_NUMEROLOGY2 + __KAM_NUMEROLOGY3 >= 3) describe KAM_NUMEROLOGY Pseudo-scientific spam score KAM_NUMEROLOGY 3.5 ifplugin Mail::SpamAssassin::Plugin::RaptorOnly #VOICEMAIL SPAM header __KAM_VOICEMAIL1 Subject =~ /new voice.?mail message|news|Fax Message for/i header __KAM_VOICEMAIL2 From =~ /voice.?mail|news/i body __KAM_VOICEMAIL3 /new voice.?mail message|voice.redirected/i meta KAM_VOICEMAIL (__KAM_VOICEMAIL1 + __KAM_VOICEMAIL2 + __KAM_VOICEMAIL3 + KAM_RAPTOR_ALTERED >= 3) describe KAM_VOICEMAIL Common malware that tricks the user into opening a fake VOIP voicemail score KAM_VOICEMAIL 5.0 endif #SPAM ADVERTISING SPAM - HAS SCIENCE GONE TOO FAR? header __KAM_SPAMFORSPAM1 Subject =~ /email marketing|marketing solution|connect with your audience|reaching your customers|marketing ideas|business.contacts/i header __KAM_SPAMFORSPAM2 From =~ /email marketing|mailing lists|listz/i rawbody __KAM_SPAMFORSPAM3 /email marketing|Keep your customers informed|expand your brand|(grow|improve) your business|Acquire New Customers|business reach|your.customer.base|demand.generation/i meta KAM_SPAMFORSPAM (__KAM_SPAMFORSPAM1 + __KAM_SPAMFORSPAM2 + __KAM_SPAMFORSPAM3 + KAM_INFOUSMEBIZ >= 3) describe KAM_SPAMFORSPAM Spam advertising spam services score KAM_SPAMFORSPAM 5.5 #ALZHEIMERS / NEUROLOGICAL MEDICAL SPAM header __KAM_NEUROLOGICAL1 Subject =~ /alzheimers|doctors hate him/i header __KAM_NEUROLOGICAL2 From =~ /alzheimers|cognizine/i body __KAM_NEUROLOGICAL3 /at risk for alzheimers|alzheimers conspiracy|doctors hate him/i meta KAM_NEUROLOGICAL (__KAM_NEUROLOGICAL1 + __KAM_NEUROLOGICAL2 + __KAM_NEUROLOGICAL3 >= 3) describe KAM_NEUROLOGICAL Variant of medical spam targeting neurological ailments score KAM_NEUROLOGICAL 3.5 #EXCESSIVE HASHES AND OTHER IDENTIFIER STRINGS body __KAM_LOTSOFHASH /[abcdef1234567890]{20}/i tflags __KAM_LOTSOFHASH multiple maxhits=10 meta KAM_LOTSOFHASH (__KAM_LOTSOFHASH >= 10) describe KAM_LOTSOFHASH Emails with lots of hash-like gibberish score KAM_LOTSOFHASH 0.25 #SPAM THAT SHOWS SEVERAL QUESTIONABLE BEHAVIORS IN COMBINATION meta KAM_GRABBAG1 (__KAM_THIRD + __KAM_DOMAINDOTCOM + __KAM_TILDEFROM + HTML_FONT_LOW_CONTRAST + T_REMOTE_IMAGE + __KAM_EPISODE + __KAM_LOTSOFNBSP + __KAM_IPUNSUB + (__KAM_LOTSOFHASH >= 6) >= 4) describe KAM_GRABBAG1 A combination of tricks that when combined indicate spam score KAM_GRABBAG1 3.5 #TV DOCTOR TRASH header __KAM_TVDOCTOR1 Subject =~ /hormones|(dr.?|doc.?) [o0]z|flatter belly|anti.?.?aging.tip|\d+.years.younger|wrinkle.(reduction|prevention)|weight.loss|models.use.this|reverse.\d+.years/i header __KAM_TVDOCTOR2 From =~ /(dr.?|doc.?) ?[o0]z|dr.? steve|oz skin tip|skinny|drop \d+lb/i body __KAM_TVDOCTOR3 /clinical|miracle|dermatologist|anti.?.?aging.tip|\d+.years.younger|wrinkle.(reduction|prevention)|\bOMG!\b|loose.\d+.lb|tv.doctor/i meta KAM_TVDOCTOR (__KAM_TVDOCTOR1 + __KAM_TVDOCTOR2 + __KAM_TVDOCTOR3 + (KAM_INFOUSMEBIZ || KAM_WEIRDTRICK1) >= 3) describe KAM_TVDOCTOR Spam for TV doctor stuff score KAM_TVDOCTOR 3.5 # 1-800-DENTIST header __KAM_DENTIST1 Subject =~ /dentist/i header __KAM_DENTIST2 From =~ /1-?800-?dentist/i body __KAM_DENTIST3 /Find a dentist/i meta KAM_DENTIST (__KAM_DENTIST1 + __KAM_DENTIST2 + __KAM_DENTIST3 + KAM_INFOUSMEBIZ >= 3) describe KAM_DENTIST Spam for 1-800-DENTIST score KAM_DENTIST 3.5 # GOLD AND DIAMOND JEWELRY header __KAM_JEWELRY1 Subject =~ /jewell?rey online|shop now/i header __KAM_JEWELRY2 From =~ /bluestone.com/i meta KAM_JEWELRY (__KAM_JEWELRY1 + __KAM_JEWELRY2 >= 2) describe KAM_JEWELRY Spam for Gold and Diamond Jewelry score KAM_JEWELRY 3.5 # PSSST, WANNA BUY SOME POT body __KAM_MARIJUANA1 /marijuana|cannabis/i body __KAM_MARIJUANA2 /medicinal|recreational|legal.cannabis/i body __KAM_MARIJUANA3 /colorado|washington|profit|without.a.(prescription|doctor)|lets.you.vape|no.doctor/i header __KAM_MARIJUANA4 From =~ /marijuana|cannabis/i meta KAM_MARIJUANA (__KAM_MARIJUANA1 + __KAM_MARIJUANA2 + (__KAM_MARIJUANA3 + KAM_INFOUSMEBIZ >= 1) >= 3) describe KAM_MARIJUANA Spam pertaining to marijuana score KAM_MARIJUANA 3.5 meta KAM_MARIJUANA2 (__KAM_MARIJUANA4 + (__KAM_MARIJUANA3 || __KAM_MARIJUANA2) >= 2) score KAM_MARIJUANA2 8.0 describe KAM_MARIJUANA2 Definitely spam for marijuana ifplugin Mail::SpamAssassin::Plugin::RaptorOnly # EVICTION NOTICE header __KAM_EVICTION1 From =~ /eviction|vacate immediately/i header __KAM_EVICTION2 Subject =~ /notice|notification|occupant/i body __KAM_EVICTION3 /eviction|foreclosed|trespasser/i meta KAM_EVICTION (__KAM_EVICTION1 + __KAM_EVICTION2 + __KAM_EVICTION3 + KAM_RAPTOR_ALTERED >= 4) describe KAM_EVICTION Malware disguised as eviction notice score KAM_EVICTION 4.5 endif # WALK IN TUBS header __KAM_WALKINTUB1 From =~ /walk.?in.?tub/i header __KAM_WALKINTUB2 Subject =~ /walk.?in.?tub/i body __KAM_WALKINTUB3 /walk.?in.?tub/i meta KAM_WALKINTUB (__KAM_WALKINTUB1 + __KAM_WALKINTUB2 + __KAM_WALKINTUB3 >= 3) describe KAM_WALKINTUB Ads for walk-in tubs score KAM_WALKINTUB 3.5 # SUBJECTS BEGINNING WITH "EMAIL - QUESTION" AND OTHER VARIANTS header __KAM_EMAILQUESTION1 Subject =~ /^(<)?([^@\s]+@[^@\s]+)( - |> )/i header __KAM_EMAILQUESTION2 Subject =~ /break away from the pack|make your own wine|\d figures a day|unlock the secret|you need to see|let me show you|at their own game|drop \d+ pounds|potty trained|you can actually|your dog is being poisoned|control your destiny|buy a new|check out these|arthritis/i meta KAM_EMAILQUESTION (__KAM_EMAILQUESTION1 + __KAM_EMAILQUESTION2 >= 2) describe KAM_EMAILQUESTION Subjects beginning with an email address and followed by a spammy subject score KAM_EMAILQUESTION 3.5 # BECOME BEYOND SUPERHUMAN / SUPERMAN header __KAM_SUPERHUMAN1 From =~ /(become[ _]?)?(beyond[ _]?)?(super|hu)man/i header __KAM_SUPERHUMAN2 Subject =~ /relationship problems|better sex|regain your former glory|(male|men) over (\d\d|fou?rty)/i body __KAM_SUPERHUMAN3 /reclaim your glory|stay hot and sexy|unfair.advantage|better sex|weird trick|testosterone/i meta KAM_SUPERHUMAN (__KAM_SUPERHUMAN1 + __KAM_SUPERHUMAN2 + __KAM_SUPERHUMAN3 >= 3) describe KAM_SUPERHUMAN Male enhancement of the day score KAM_SUPERHUMAN 8.0 # VALENTINES header __KAM_VALENTINE1 From =~ /smartbuys|valentine|ecard|flower|fingerhut/i header __KAM_VALENTINE2 Subject =~ /valentine|(bouquets|expressions) of love|win her over|swoon.?worthy bouquet|grow more in love|\$\d\d.\d\d bouquet|love at (the )?first/i rawbody __KAM_VALENTINE3 /amazing gifts|perfect for valentine|irresist.ble perfume|send an ecard|most memorable flowers|(bouquets|expressions) of love|valentine.?s?.(day.)?(gift|ecard|flower|delivery|is february 14|bouquet)|grow more in love|Saint Valentine|your valentine/i meta KAM_VALENTINE (__KAM_VALENTINE1 + __KAM_VALENTINE2 + __KAM_VALENTINE3 + KAM_INFOUSMEBIZ >= 3) describe KAM_VALENTINE Spam for valentine gifts and other holiday stuff score KAM_VALENTINE 4.5 header __KAM_MOTHER1 From =~ /flower|seventeen/i header __KAM_MOTHER2 Subject =~ /mother.?s.?day|\d+%.off.flower|pro.?flowers|guaranteed.delivery|beautiful bouquets|celebrate.mom/i body __KAM_MOTHER3 /pro.?flowers|flowers.fresh|freshness.guarantee|shop.now|mom.?s.delight/i meta KAM_MOTHER (__KAM_MOTHER1 + __KAM_MOTHER2 + __KAM_MOTHER3 >= 3) describe KAM_MOTHER Spam for mother's day score KAM_MOTHER 4.5 # WHO'S WHO header __KAM_WHOSWHO1 From =~ /whos_who|who.?s.who/i header __KAM_WHOSWHO2 Subject =~ /your exclusive invitation|who.?s.who|your invitation|you have been selected/i body __KAM_WHOSWHO3 /(global|executive) who.s who|represent your community|you have been selected|complete your listing|prominent registry|accomplished individuals/i uri __KAM_WHOSWHO4 /whoswho/i meta KAM_WHOSWHO (__KAM_WHOSWHO1 + __KAM_WHOSWHO2 + __KAM_WHOSWHO3 >= 2) describe KAM_WHOSWHO Ads for network of important people score KAM_WHOSWHO 5.0 meta KAM_WHOSWHO2 (KAM_WHOSWHO && __KAM_WHOSWHO4) describe KAM_WHOSWHO2 Definitely ads for network of important people score KAM_WHOSWHO2 1.0 # GARAGE FLOOR COATING header __KAM_GARAGE1 From =~ /garage|surface.protection|protection.plus|esurface/i header __KAM_GARAGE2 Subject =~ /garage floor coating|industrial strength|protect your floors|protect.and.beautify|esurface|what.you.should.know/i body __KAM_GARAGE3 /surface protection plus|industrial strength|Concrete.{0,5}metal.{0,8}wood|protect.and.beautify|industrial.grade|common.flooring|treat.your.deck|professional.coating/i meta KAM_GARAGE (__KAM_GARAGE1 + __KAM_GARAGE2 + __KAM_GARAGE3 + (HTML_FONT_LOW_CONTRAST || SPF_FAIL || SPF_HELO_FAIL) >= 3) describe KAM_GARAGE Garage floor coating product of the day score KAM_GARAGE 4.0 meta KAM_GARAGE2 (KAM_GARAGE + (HTML_FONT_LOW_CONTRAST || SPF_FAIL) >= 2) score KAM_GARAGE2 1.0 describe KAM_GARAGE2 More likely garage floor coating spam #PAINT - NEED TO LOOK FOR CROSSOVER ON KAM_GARAGE AND KAM_PAINT header __KAM_PAINT1 From =~ /Coating|Paint|Surface|Sealer/i header __KAM_PAINT2 Subject =~ /surface Paint/i meta KAM_PAINT (__KAM_PAINT1 + __KAM_PAINT2 + KAM_INFOUSMEBIZ >= 3) describe KAM_PAINT Paint Spams score KAM_PAINT 4.0 # HURRICANE MOP header __KAM_MOP1 From =~ /hurricane mop/i header __KAM_MOP2 Subject =~ /filthy floor|cut cleaning time|absorbs \d+x its own weight|the mop that/i body __KAM_MOP3 /filthy floor|cut cleaning time+absorbs \d+x its own weight|the mop that/i meta KAM_MOP (__KAM_MOP1 + __KAM_MOP2 + __KAM_MOP3 >= 3) describe KAM_MOP Hurricane mop product of the day score KAM_MOP 3.5 # DATING TIPS header __KAM_DATINGTIPS1 From =~ /girlfriendtrick|seduction|the.real/i header __KAM_DATINGTIPS2 Subject =~ /girlfriend.trick|women.excited|real.moment/i body __KAM_DATINGTIPS3 /seduction|certain.type.of.guy|secret to their hearts|women.excited|real.love|one.night.stand/i meta KAM_DATINGTIPS (__KAM_DATINGTIPS1 + __KAM_DATINGTIPS2 + __KAM_DATINGTIPS3 >= 3) describe KAM_DATINGTIPS Tips for dating score KAM_DATINGTIPS 4.5 # CANDY header __KAM_CANDY1 From =~ /candy/i header __KAM_CANDY2 Subject =~ /candy/i body __KAM_CANDY3 /you deserve a treat|sweet tooth/i meta KAM_CANDY (__KAM_CANDY1 + __KAM_CANDY2 + __KAM_CANDY3 >= 3) describe KAM_CANDY Ads for candy score KAM_CANDY 4.5 # EXCESSIVE TEXT IN THE FORMAT OF =## - http://en.wikipedia.org/wiki/Quoted-printable # MATCH ONLY ESCAPES THAT ARE LESS THAN 0x80 - HIGH BIT NOT SET - THESE CAN BE EXPRESSED JUST FINE AS ASCII # DISABLED PENDING UPDATES TO SA - RAWBODY IS NOT RAW ENOUGH TO GET UN-DECODED QP #rawbody KAM_EXCESSIVEQP /(=[0-7][a-f0-9]){10}/i #score KAM_EXCESSIVEQP 2.5 #describe KAM_EXCESSIVEQP Excessive use of pointless Quoted-printable # ONE WEIRD THING THAT GETS YOU MARKED AS SPAM header __KAM_WEIRDTRICK1 Subject =~ /(one|ten|\d+) '?weird'?|'?weird'? trick|strange trick|shocking.truth|\d.words.that/i body __KAM_WEIRDTRICK2 /'?(weird|odd|strange)'?.(new.)?(trick|tip)|strange trick|shocking.truth/i header __KAM_WEIRDTRICK3 Subject =~ /girlfriend|aging|old.age|cut \d+ years|PSA|horny/i header __KAM_WEIRDTRICK4 From =~ /girlfriend|freedom/i meta KAM_WEIRDTRICK1 __KAM_WEIRDTRICK2 describe KAM_WEIRDTRICK1 Huge family of spam that uses the word weird to grab attention score KAM_WEIRDTRICK1 1.5 meta KAM_WEIRDTRICK2 (__KAM_WEIRDTRICK1 + __KAM_WEIRDTRICK2 + (KAM_INFOUSMEBIZ + KAM_LOTSOFHASH + AC_HTML_NONSENSE_TAGS + HTML_FONT_LOW_CONTRAST + T_REMOTE_IMAGE >= 3) >= 3) describe KAM_WEIRDTRICK2 Huge family of spam that uses the word weird to grab attention score KAM_WEIRDTRICK2 3.5 meta KAM_WEIRDTRICK3 (__KAM_WEIRDTRICK1 + __KAM_WEIRDTRICK2 + __KAM_WEIRDTRICK3 + __KAM_WEIRDTRICK4 >= 3) describe KAM_WEIRDTRICK3 Weird/Strange Trick score KAM_WEIRDTRICK3 3.0 #MATCH MAKER SPAM header __KAM_MATCH1 From =~ /Match/i header __KAM_MATCH2 Subject =~ /Find love|available singles|free.to.look|meet.singles/i meta KAM_MATCH (__KAM_MATCH1 + __KAM_MATCH2 + (HTML_IMAGE_RATIO_06 || SPF_FAIL) >= 3) describe KAM_MATCH Match Maker Spams score KAM_MATCH 3.5 #CAR INSURANCE header __KAM_CARINSURE1 From =~ /insurance/i header __KAM_CARINSURE2 Subject =~ /save on car insurance|smarter.way/i meta KAM_CARINSURE (__KAM_CARINSURE1 + __KAM_CARINSURE2 >= 2) describe KAM_CARINSURE Car Insurance Spams score KAM_CARINSURE 3.0 #DATA IMG rawbody __KAM_DATAIMG /<img src="data:image/i #FAKE MMS rawbody __KAM_MMS1 /base64,G011K60C12QKQ9790AIFQ5L/s meta KAM_MMS (__KAM_DATAIMG + __KAM_MMS1 >= 2) describe KAM_MMS Fake MMS Spam score KAM_MMS 6.0 #LEARNMORE rawbody __KAM_LEARN1 /base64,R0lGODlh3gA9APcAAAFlmUK/ meta KAM_LEARN (__KAM_DATAIMG + __KAM_LEARN1 >= 2) describe KAM_LEARN Learn More Spam score KAM_LEARN 6.0 #UNSUB1 header __KAM_UNSUB1_1 List-Unsubscribe =~ /^\<(?:mailto:)?unsub1\@/i rawbody __KAM_UNSUB1_2 /:\s?unsub1\@|unsubscribe<[^\/]|click here<h/i meta KAM_UNSUB1 (__KAM_UNSUB1_1 + __KAM_UNSUB1_2 >= 1) describe KAM_UNSUB1 Unsubscription Spams score KAM_UNSUB1 0.1 uri __KAM_DOMAINDOTCOM /domain\.com/i meta KAM_UNSUB2 ((KAM_UNSUB1 || KAM_ADVERT2) + __KAM_DOMAINDOTCOM >= 2) score KAM_UNSUB2 3.5 describe KAM_UNSUB2 Improperly configured spam engines that leave placeholder domains in the body # DUTCH GLOW AND OTHER WOODWORKING SPAM header __KAM_DUTCHGLOW1 From =~ /dutch.?glow|original.?dutch|easy.woodwork/i header __KAM_DUTCHGLOW2 Subject =~ /wood milk|cleaning the wood|woodwork|cleaning.formula|repel.dust|natural.beauty|furniture|amish|woodworking.plans/i body __KAM_DUTCHGLOW3 /wood milk|dutch glow|wood's natural beauty|nourish wood|wax build up|your furniture|woodworking.plans/i meta KAM_DUTCHGLOW (__KAM_DUTCHGLOW1 + __KAM_DUTCHGLOW2 + __KAM_DUTCHGLOW3 >= 3) describe KAM_DUTCHGLOW Woodworking spam score KAM_DUTCHGLOW 3.0 # FUNERAL HOME SPAM header __KAM_FUNERAL1 From =~ /Funeral/i header __KAM_FUNERAL2 Subject =~ /condolence|funeral announcement|funeral of your friend|death notification|burial.(life.)?insurance/i body __KAM_FUNERAL3 /untimely death|death notification|funeral.costs/i uri __KAM_FUNERAL4 /\/home\.php\?funeral/i meta KAM_FUNERAL (__KAM_FUNERAL1 + __KAM_FUNERAL2 + __KAM_FUNERAL3 >= 3) describe KAM_FUNERAL Likely Fake funeral notices score KAM_FUNERAL 2.0 meta KAM_FUNERAL2 (__KAM_FUNERAL4 >= 1) describe KAM_FUNERAL2 Fake funeral notices score KAM_FUNERAL2 3.0 # WEB VIEW OBFUSCATION body __KAM_WEB_OBFUSCATION1 /check over this commercial|see the commercial.advertisement/i rawbody __KAM_WEB_OBFUSCATION2 /(you'll have to press me)\s*<\/a>/i meta KAM_WEB_OBFUSCATION (__KAM_WEB_OBFUSCATION1 + __KAM_WEB_OBFUSCATION2 >= 2) describe KAM_WEB_OBFUSCATION Obfuscated web view links score KAM_WEB_OBFUSCATION 0.1 # TUPPERWARE header __KAM_TUPPERWARE1 From =~ /Mr\. Lid|Food Storage|Storage Container/i header __KAM_TUPPERWARE2 Subject =~ /tupperware|food storage|storage container/i body __KAM_TUPPERWARE3 /tupperware lid|food storage|storage container/i meta KAM_TUPPERWARE (__KAM_TUPPERWARE1 + __KAM_TUPPERWARE2 + __KAM_TUPPERWARE3 >= 3) describe KAM_TUPPERWARE Ads for tupperware score KAM_TUPPERWARE 3.5 # PATRIOT SURVIVAL AND OTHER DISASTER / NATIONALISM / CONSPIRACY SPAM header __KAM_PATRIOT1 From =~ /patriot|disaster|emergency|USAF|shocking|for.truth|nwo|expat|special.op|christianmedia/i header __KAM_PATRIOT2 Subject =~ /the truth about|financial collapse|your guns|hidden (agenda|truth)|unprecedented.crisis|worst.crisis|obama.?care|do not ignore|get a lot worse|coffins.ordered.by.fema|depression|prepared.for.war|free.our.marine|survival.guide|beloved.usa|civil war|shocking.footage|cia.economist|collapse.is.imminent|attack.on|wants.war|disturbing.issue|plane.crash|nuke.deal|extortion|prophecy/i body __KAM_PATRIOT3 /the truth about|financial collapse|your guns|hidden agenda|unprecedented.crisis|disaster|fema (stock.?piling|storing)|Gor?vernment Not Telling|survival.plan|nation.gone.under|blind.with.patriotism|government shutdown|only chance|civil.unrest|high.crimes|behind.our.back|know.the.truth|PatriotNewsNet|second civil war|for.the.cia|market.crash|american.meltdown|concerned.american|military force|we.were.right|our.suspicions|vindicated|abuse.of.power|american.empire/i body __KAM_PATRIOT4 /projectprophet|financial.threat|nuke.deal/i meta KAM_PATRIOT (__KAM_PATRIOT1 + __KAM_PATRIOT2 + __KAM_PATRIOT3 + __KAM_PATRIOT4 >= 3) describe KAM_PATRIOT conspiracy spam score KAM_PATRIOT 4.0 meta KAM_PATRIOT2 (__KAM_PATRIOT1 + __KAM_PATRIOT2 + __KAM_PATRIOT3 + __KAM_PATRIOT4 >= 2) describe KAM_PATRIOT2 Likely conspiracy spam score KAM_PATRIOT2 1.5 # PAYMENT LOWERED header __KAM_PAYMENT_LOWERED1 Subject =~ /insurance payment/i body __KAM_PAYMENT_LOWERED2 /new monthly payment|just.recently.been..?lowered/i body __KAM_PAYMENT_LOWERED3 /ID.?\#.?[\da-f]{20}/i meta KAM_PAYMENT_LOWERED (__KAM_PAYMENT_LOWERED1 + __KAM_PAYMENT_LOWERED2 + __KAM_PAYMENT_LOWERED3 + KAM_LOTSOFHASH >= 3) describe KAM_PAYMENT_LOWERED Spam that says your insurance payment has already been lowered score KAM_PAYMENT_LOWERED 4.5 meta KAM_PAYMENT_LOWERED (__KAM_PAYMENT_LOWERED1 + __KAM_PAYMENT_LOWERED2 + __KAM_PAYMENT_LOWERED3 + KAM_LOTSOFHASH >= 4) describe KAM_PAYMENT_LOWERED Higher probability of lowered payment spam score KAM_PAYMENT_LOWERED 2.0 #NEW NOTICE body __KAM_NEWNOTICE1 /- - -\s?(start |begin )?(of |new )?(notification|notice)( \d\d\/\d\d\/\d\d)?\s?- - -|notice of/i body __KAM_NEWNOTICE2 /- - -\s?(finish |end )?(of |new )?(notification|notice)( \d\d\/\d\d\/\d\d)?\s?- - -|end notice:/i header __KAM_NEWNOTICE3 From =~ /Notice|Notification|Credit/i meta KAM_NEWNOTICE (__KAM_NEWNOTICE1 + __KAM_NEWNOTICE2 + __KAM_NEWNOTICE3 >= 3) describe KAM_NEWNOTICE New Notice Spam score KAM_NEWNOTICE 4.25 meta KAM_NEWNOTICE2 (KAM_NEWNOTICE + KAM_LOTSOFHASH >= 2) describe KAM_NEWNOTICE2 Higher Probability of New Notice Spam score KAM_NEWNOTICE2 2.0 #REFI NEW NOTICE header __KAM_REFINEW1 Subject =~ /refl.rates|Rates.(now.)?Dropped.Again|score.*recently.changed/i body __KAM_REFINEW2 /(rate|payment).reduction|score-update/i meta KAM_REFINEW (__KAM_REFINEW1 + __KAM_REFINEW2 >=2) describe KAM_REFINEW New Refi/Credit Notice spam score KAM_REFINEW 2.0 meta KAM_REFINEW2 (KAM_REFINEW) && (KAM_NEWNOTICE + KAM_LOTSOFHASH >= 1) describe KAM_REFINEW2 Higher Probability Refi Spam score KAM_REFINEW2 2.0 #AUTO INSURE / LOAN header __KAM_AUTONEW1 Subject =~ /Auto.{0,2}(Insurance|policy).{0,2}Payment|auto.warranty|finance|policy.saving|your.quote|car.loan|bad..credit.ok/i body __KAM_AUTONEW2 /car.{1,2}insurance.{1,2}payment|monthly.payment|plan.has.expired|auto.loan|auto.coverage|coverage.benefits|premium.reduc|compare.quote|financing.your.way/i body __KAM_AUTONEW3 /just.{1,2}been.{1,2}lowered|reduced.recently|has been reduced|free.repair|easy.steps|overpaying|view.plan|overpaid.your|premiums?.as.low|lenders.compete/i header __KAM_AUTONEW4 From =~ /notice|credit|coverag3|auto.cover|lower.auto|auto.finance/i meta KAM_AUTONEW (__KAM_AUTONEW1 + __KAM_AUTONEW2 + __KAM_AUTONEW3 + __KAM_AUTONEW4 >= 3) describe KAM_AUTONEW New Auto insurance spam score KAM_AUTONEW 3.0 meta KAM_AUTONEW2 (KAM_AUTONEW) && (KAM_NEWNOTICE + KAM_SUBJECTNOTICE + KAM_LOTSOFHASH + KAM_INFOUSMEBIZ + KAM_ASCII_DIVIDERS >= 1) describe KAM_AUTONEW2 Higher Probability Insurance Spam score KAM_AUTONEW2 2.0 #STATLER header __KAM_STATLER1 Subject =~ /Mike Statler|finance news|invest in ....(\b)/i header __KAM_STATLER2 Subject =~ /quintuple/i body __KAM_STATLER3 /Mike Statler/i meta KAM_STATLER (__KAM_STATLER1 + __KAM_STATLER2 + __KAM_STATLER3 >= 3) describe KAM_STATLER Mike Statler Spams score KAM_STATLER 6.0 #LEARNING TO WRITE header __KAM_WRITING1 From =~ /writing/i header __KAM_WRITING2 Subject =~ /writing resources|get published/i body __KAM_WRITING3 /Professional Writing|world famous (writer|poet)/i meta KAM_WRITING (__KAM_WRITING1 + __KAM_WRITING2 + __KAM_WRITING3 >= 3) describe KAM_WRITING Spam for writing lessons score KAM_WRITING 3.5 #RASH OF .EU EXPLOITS rawbody KAM_EU /https?:\/\/(?:www.)?.{4,30}\.(eu)(\b|\/)/i score KAM_EU 0.50 describe KAM_EU Prevalent use of .eu in spam/malware #CSS USING A 12-BIT RGBA COLOR, WHICH IS NOT WIDELY SUPPORTED rawbody __KAM_12BITCOLOR /color: \#[\da-f]{12}/i meta KAM_GRABBAG2 KAM_EU && (__KAM_12BITCOLOR + KAM_ADVERT2 + AC_HTML_NONSENSE_TAGS + URIBL_BLACK + URIBL_RED >= 1) score KAM_GRABBAG2 3.0 describe KAM_GRABBAG2 Grabbag of Spams hitting EU domains and other indicators #END DIABETES SPAM body __KAM_DIABETES1 /Diabetes News Today|diabetes.health|blood.sugar/i tflags __KAM_DIABETES1 nosubject body __KAM_DIABETES2 /Reverse.{0,10}(Diabetes|type.2|type.1)|reverse.type.2|beat.type.2|conventional.medical|doctors don't know|home solution|yellow spice|shocked doctors/i tflags __KAM_DIABETES2 nosubject header __KAM_DIABETES3 Subject =~ /End Diabetes|diabetes.association|every.diabetic|blood sugar|yellow spice/i header __KAM_DIABETES4 From:name =~ /blood.?sugar|clean.?cell/ meta KAM_DIABETES (__KAM_DIABETES1 + __KAM_DIABETES2 + __KAM_DIABETES3 + __KAM_DIABETES4 >= 3) score KAM_DIABETES 4.5 describe KAM_DIABETES End Diabetes Spam #SPY CAMERAS, ETC header __KAM_SPY1 From =~ /spy.?camera|smartcam/i header __KAM_SPY2 Subject =~ /spy.?camera|small size video/i body __KAM_SPY3 /spy.?camera.?system|hidden.spy.camera|valuables.safe|protect.your.children|smartcam pro/i meta KAM_SPY (__KAM_SPY1 + __KAM_SPY2 + __KAM_SPY3 >= 3) describe KAM_SPY Spy cameras and similar products score KAM_SPY 3.5 #HARP header __KAM_HARP1 From =~ /\bharp\b|obamacare|save|healthcare/i header __KAM_HARP2 Subject =~ /\bHARP\b|obamacare|tax benefit|age bracket|protect yourself|mortgage|save.thousands/i header __KAM_HARP3 From !~ /\.gov>?$/i meta KAM_HARP (__KAM_HARP1 + __KAM_HARP2 + __KAM_HARP3 + KAM_SUBJECTNOTICE >= 3) describe KAM_HARP HARP Refinance Spams score KAM_HARP 4.5 #LUNAR SLEEP AND OTHER SLEEPING AIDS header __KAM_LUNAR1 From =~ /lunar.?sleep|peak.life/i header __KAM_LUNAR2 Subject =~ /tired again|sleep(ing)? aid|miracle.sleep|free.sample|sleep.well|fall.asleep|waking.up|sleep.?spray|doctors.discover|the.secret|nights?.sleep/i uri __KAM_LUNAR3 /lunar.?sleep/i body __KAM_LUNAR4 /sleep you really need|sleep(ing)? aid|trouble.sleeping|miracle.sleep|lunar.?sleep|all.natural|fall.asleep|refreshed|sleep.cycle|sleep.aid|lack.of.sleep|stay.asleep|somnapure|weird.trick/i meta KAM_LUNAR (__KAM_LUNAR1 + __KAM_LUNAR2 + MISSING_HEADERS + __KAM_LUNAR3 + __KAM_LUNAR4 >= 3) describe KAM_LUNAR Sleeping aid spam score KAM_LUNAR 4.5 meta KAM_LUNAR2 (__KAM_LUNAR1 + __KAM_LUNAR2 + MISSING_HEADERS + __KAM_LUNAR3 + __KAM_LUNAR4 >= 4) describe KAM_LUNAR2 Definitely sleeping aid spam score KAM_LUNAR2 2.0 #OCEANS BOUNTY header __KAM_OCEANSBOUNTY1 From =~ /oceans.?bounty/i header __KAM_OCEANSBOUNTY2 Subject =~ /pain.free|turn.back.the.clock|reactivate.your.heart/i body __KAM_OCEANSBOUNTY3 /years.of.aging|medical.doctor|age.revers|turn.back.the.clock|reactivate.your.heart/i meta KAM_OCEANSBOUNTY (__KAM_OCEANSBOUNTY1 + __KAM_OCEANSBOUNTY2 + __KAM_OCEANSBOUNTY3 >= 3) describe KAM_OCEANSBOUNTY More medical spam score KAM_OCEANSBOUNTY 4.5 #ANDROGEL header __KAM_ANDROGEL1 From =~ /testosterone|androgel|entitled|enclosed|medwatch|axiron|fda|natural.man|mega.product|\.mobi/i header __KAM_ANDROGEL2 Subject =~ /androgel|axiron|product.of.the.year|free.sample|raise.your.testosterone/i body __KAM_ANDROGEL3 /healthcare|medwatch|drug|testosterone|therapy|manhood|your.woman/i meta KAM_ANDROGEL (__KAM_ANDROGEL1 + __KAM_ANDROGEL2 + __KAM_ANDROGEL3 >= 3) describe KAM_ANDROGEL More medical spam score KAM_ANDROGEL 4.5 #CELL PHONES header __KAM_CELL1 From =~ /phone/i header __KAM_CELL2 Subject =~ /cell.?phone|mobile.communication|newest.mobile|smartphone|phones.*get.one|phone.bargain|hottest.phone|new.phone/i body __KAM_CELL3 /phone.(information|deals|reviews)|(free|latest|hottest)..?(cell)?.?phone|selection.of.phones|hottest.(brands|models)|check.out.these.smartphones|smartphones.do.more|refurbished.phone|bored.with.your.phone/i meta KAM_CELL (__KAM_CELL1 + __KAM_CELL2 + __KAM_CELL3 >= 3) describe KAM_CELL Ads for cell phones score KAM_CELL 3.5 header __KAM_FOUNTAINOFYOUTH1 From =~ /deepseasecret/i header __KAM_FOUNTAINOFYOUTH2 Subject =~ /fountain.of.youth/i body __KAM_FOUNTAINOFYOUTH3 /look & feel old|\d+.years.of.aging|weird.\d+.second.trick/i meta KAM_FOUNTAINOFYOUTH (__KAM_FOUNTAINOFYOUTH1 + __KAM_FOUNTAINOFYOUTH2 + __KAM_FOUNTAINOFYOUTH3 >= 3) score KAM_FOUNTAINOFYOUTH 5.0 describe KAM_FOUNTAINOFYOUTH Anti-aging ad #HERPES header __KAM_HERPES1 From =~ /herpes/i header __KAM_HERPES2 Subject =~ /your.herpes/i body __KAM_HERPES3 /permanent.remedy|ugly.sores|herpes.episode|got.herpes|your.herpes|herpes.issue/i meta KAM_HERPES (__KAM_HERPES1 + __KAM_HERPES2 + __KAM_HERPES3 >= 2) describe KAM_HERPES Ads for herpes medication score KAM_HERPES 5.0 #FAKE VOUCHER/REWARD EMAIL header __KAM_FAKEVOUCHER1 From =~ /(amazon|target).*(reward|voucher|appreciation|customer)|\$\d+ gift|(spring|summer|fall|autumn|winter) (reward|bonus)|(january|february|march|april|may|june|july|august|september|october|november|december).?(reward|bonus)|day.reward|macy.?s?.reward|rewards?.?center/i body __KAM_FAKEVOUCHER2 /\$\d+ amazon(.com)? Card|redeem.your.\$\d+|join.amazon|bonus voucher|spring.rewards|new.gift.card|exclusive.for|shopper.bucks|activate.here|cash.in.your/i header __KAM_FAKEVOUCHER3 Subject =~ /special.thanks|thank.you|amazon.appreciation|(spring|summer|fall|autumn|winter) .?(reward|bonus|bucks)|short.survey|\$\d+..?(gift|issued|voucher|e.?gift)|register.reward|target.reward|\d+.(dollar.)?gift.card|claim.your.*reward/i body __KAM_FAKEVOUCHER4 /your.opinion|submit.your.email/i meta KAM_FAKEVOUCHER (__KAM_FAKEVOUCHER1 + __KAM_FAKEVOUCHER2 + __KAM_FAKEVOUCHER3 + __KAM_FAKEVOUCHER4 >= 3) describe KAM_FAKEVOUCHER Fake voucher/reward email score KAM_FAKEVOUCHER 4.5 #ATTORNEY SPAM header __KAM_ATTORNEY1 From =~ /attorney/i header __KAM_ATTORNEY2 Subject =~ /right.attorney|quick.divorce|advertisement/i body __KAM_ATTORNEY3 /find.a.\b[a-z]+\b.attorney/i meta KAM_ATTORNEY (__KAM_ATTORNEY1 + __KAM_ATTORNEY2 + __KAM_ATTORNEY3 >= 3) score KAM_ATTORNEY 3.5 describe KAM_ATTORNEY Ads for legal services #PRODUCT RECALL header __KAM_RECALL1 From =~ /dog.?food/i header __KAM_RECALL2 Subject =~ /recall|thousands.of.dogs.die/i body __KAM_RECALL3 /protect.your.dog|recall?s.on.dog.?food|processing.standards|commercial.food/i meta KAM_RECALL (__KAM_RECALL1 + __KAM_RECALL2 + __KAM_RECALL3 >= 3) score KAM_RECALL 3.5 describe KAM_RECALL Spam for product recall notices #REMOTE IMAGES WITH ENORMOUS SRC URLS - COMMONLY USED FOR IMAGE TRACKING rawbody __KAM_HUGEIMGSRC /<img[^>]*\ssrc=["']?http[^\s>"']{120}/i tflags __KAM_HUGEIMGSRC multiple maxhits=6 meta KAM_HUGEIMGSRC (__KAM_HUGEIMGSRC >= 6) score KAM_HUGEIMGSRC 0.2 describe KAM_HUGEIMGSRC Message contains many image tags with huge http urls describe KAM_REALLYHUGEIMGSRC Spam with image tags with ridiculously huge http urls rawbody KAM_REALLYHUGEIMGSRC /<img[^>]*\ssrc=["']?http[^\s]{300}/i score KAM_REALLYHUGEIMGSRC 0.5 rawbody KAM_TRACKIMAGE /<img[^>]*\ssrc=["']?https?:\/\/track/i describe KAM_TRACKIMAGE Message has a remote image explicitly meant for tracking score KAM_TRACKIMAGE 0.2 #BAG OF SPAM THAT TRIES DESPERATELY TO TRACK RECIPIENTS meta KAM_GRABBAG3 (KAM_TRACKIMAGE + KAM_HUGEIMGSRC + (KAM_UNSUB1 || __KAM_IMGMAP_LINK_OBFU || __KAM_HAS_10_URIS) >= 3) score KAM_GRABBAG3 2.0 describe KAM_GRABBAG3 Grab bag of spam that employs multiple tricks that indicate tracking of recipients #MANY SEQUENTIAL EMPTY <A HREF> TAGS WITH NOTHING IN BETWEEN #IMPORTANTLY, DO NOT MATCH ON EMPTY <A LINK> TAGS, WHICH ARE MEANT TO BE EMPTY rawbody __KAM_EMPTYLINK /(?:<a[^>]*\shref=[^>]*><\/a>\s*){10}/i meta KAM_EMPTYLINK (__KAM_EMPTYLINK) describe KAM_EMPTYLINK Many empty a tags with href all in a row score KAM_EMPTYLINK 3.5 header __KAM_TILDEFROM From =~ /^\s*"'?\s*~/i describe __KAM_TILDEFROM Spam with a from name that starts with tilde # WORDS THAT "A R E S P A C E D O U T" LIKE SO body __KAM_SPACEY_WORDS /a +v +e +n +u +e/i # SPAM THAT WOULD LIKE TO INVEST IN YOUR COUNTRY header __KAM_INVESTCOUNTRY1 Subject =~ /Confidential Contract Proposal|invest in your country/i body __KAM_INVESTCOUNTRY2 /invest in your country|investment purpose/i tflags __KAM_INVESTCOUNTRY2 nosubject meta KAM_INVESTCOUNTRY (__KAM_INVESTCOUNTRY1 + __KAM_INVESTCOUNTRY2 + FREEMAIL_FROM >= 3) score KAM_INVESTCOUNTRY 4.5 describe KAM_INVESTCOUNTRY Spam for investing in your country # SPAM FOR FLAGS header __KAM_FLAG1 From =~ /flag/i header __KAM_FLAG2 Subject =~ /find.the.flag|what flags|new.flag|patriotism|looking.for.a.flag/i body __KAM_FLAG3 /performance.flags|shopping.online|scoop on flags|need your flag|best flag|flag design|new flag|flag.needs|flags?.you.need/i meta KAM_FLAG (__KAM_FLAG1 + __KAM_FLAG2 + __KAM_FLAG3 >= 3) score KAM_FLAG 3.5 describe KAM_FLAG Spam that sells flags rawbody __KAM_BIGSMALL /<small><big>|<big><small>/i describe __KAM_BIGSMALL Spam engine that is using nested big and small tags rawbody __KAM_DIVTITLE /<div (title|alt)/i describe __KAM_DIVTITLE Div tag with custom alt text rawbody __KAM_IMGMAP_LINK_OBFU /<map[^>]+><area[^>]+><\/map>/i describe __KAM_IMGMAP_LINK_OBFU Image links obfuscated by an image map with a single area meta KAM_GRABBAG4 (__KAM_DIVTITLE + __KAM_IMGMAP_LINK_OBFU + KAM_HUGEIMGSRC >= 3) describe KAM_GRABBAG4 Another spam engine that displays unique quirks score KAM_GRABBAG4 3.5 header __KAM_KORS1 From =~ /Michael Kors/i header __KAM_KORS2 Subject =~ /Michael Kors|out.of.the.ordinary/i body __KAM_KORS3 /sent you this item|register to receive|latest updates|win great prizes|shop michael kors|kors insider|handbag collection/i meta KAM_KORS (__KAM_KORS1 + __KAM_KORS2 + __KAM_KORS3 >= 3) score KAM_KORS 3.5 describe KAM_KORS Spam for Michael Kors header __KAM_HOLIDAY1 From =~ /holidays/i header __KAM_HOLIDAY2 Subject =~ /\d\d\d\d offers/i body __KAM_HOLIDAY3 /star special|Hotel Opening|(Request|order) a brochure/i meta KAM_HOLIDAY (__KAM_HOLIDAY1 + __KAM_HOLIDAY2 + __KAM_HOLIDAY3 >= 3) describe KAM_HOLIDAY Generic holiday deals score KAM_HOLIDAY 3.5 #MANY TO - DOES AN EMAIL HAVE MULTIPLE TO HEADERS OR A LOT OF RECIPIENTS? #Thanks to Dave Wreski for his idea on commas and also to Bill Cole for this version using the "ALL" Pseudo Header as a multiline block #OLD VERSION #header __KAM_MANYTO To =~ />,/i #tflags __KAM_MANYTO multiple maxhits=5 #NEW VERSION header __KAM_MANYTO ALL =~ /^To: /m header __KAM_MANYTO2 To =~ /, / tflags __KAM_MANYTO2 multiple maxhits=25 meta KAM_MANYTO (__KAM_MANYTO >= 5 || __KAM_MANYTO2 >= 25) score KAM_MANYTO 0.2 describe KAM_MANYTO Email has more than one To Header or more than 25 recipients meta KAM_GRABBAG5 (KAM_MANYTO && FORGED_YAHOO_RCVD) score KAM_GRABBAG5 5.0 describe KAM_GRABBAG5 Forged Yahoo emails that are sent to lots of recipients body __KAM_MILLIONAIRE1 /internet millionai?re/i body __KAM_MILLIONAIRE2 /huge success stor(y|ies)|controversial/i header __KAM_MILLIONAIRE3 Subject =~ /see this video/i meta KAM_MILLIONAIRE (__KAM_MILLIONAIRE1 + __KAM_MILLIONAIRE2 + __KAM_MILLIONAIRE3 + LOTS_OF_MONEY >= 3) score KAM_MILLIONAIRE 4.5 describe KAM_MILLIONAIRE Internet millionaire guarantees money header __KAM_OILCHANGE1 From =~ /oil.?change|coupon|vehicle service/i header __KAM_OILCHANGE2 Subject =~ /oil change|vehicle service/i body __KAM_OILCHANGE3 /fresh savings|find your favorite|discount.coupons|oil.change.is.due|local.provider|favorite.location|coupon/i meta KAM_OILCHANGE (__KAM_OILCHANGE1 + __KAM_OILCHANGE2 + __KAM_OILCHANGE3 >= 3) score KAM_OILCHANGE 4.5 describe KAM_OILCHANGE Spam for oil changes header __KAM_ADHD1 From =~ /ADH?D/i header __KAM_ADHD2 Subject =~ /know.the.signs|could.have.adh?d|adult adh?d/i body __KAM_ADHD3 /struggling with adh?d|treatment options/i meta KAM_ADHD (__KAM_ADHD1 + __KAM_ADHD2 + __KAM_ADHD3 >= 3) score KAM_ADHD 3.5 describe KAM_ADHD Spam for ADD and ADHD treatment # AUTO REPAIR header __KAM_REPAIR1_1 From =~ /repair.your.auto|auto.expert|auto.repair|warranty|support|pops.a.dent|vehicle.protect/i header __KAM_REPAIR1_2 Subject =~ /auto.service|auto.repair|having.problems|all.repair|take.care.of|car.trouble|save.\d+%|repair.bill|fix.dents/i body __KAM_REPAIR1_3 /car.repair|Auto Protection|repair.bill|lowest.rates|need.repairs|cost.you.thousands|auto.warranty|costs.keep.rising|repair.cost|do.it.yourself|auto.body|body.repair|protection.quote/i meta KAM_REPAIR1 (__KAM_REPAIR1_1 + __KAM_REPAIR1_2 + __KAM_REPAIR1_3 >= 3) score KAM_REPAIR1 3.5 describe KAM_REPAIR1 Spam for auto repair services # HOME REPAIR header __KAM_REPAIR2_1 From =~ /warranty|support|home.repair|your.roof/i header __KAM_REPAIR2_2 Subject =~ /roof.repair|warranty.plan|home.warranty|never.pay.for|home.repair|repairing.your|new.roof/i body __KAM_REPAIR2_3 /never.pay|covered.home.repair|the.trouble|warning.signs|roofing.problem|roof.repair/i meta KAM_REPAIR2 (__KAM_REPAIR2_1 + __KAM_REPAIR2_2 + __KAM_REPAIR2_3 >= 3) score KAM_REPAIR2 3.5 describe KAM_REPAIR2 Spam for home repair services body __KAM_EPISODE /episode \d+/i header __KAM_CLOUD1 From =~ /cloud.?(storage|computing|provider)|efolder/i header __KAM_CLOUD2 Subject =~ /private.cloud|data.loss.happens|share.securely/i body __KAM_CLOUD3 /big data|powering apps|reduce.tech.costs|backup.solution|bundling.the.service/i body __KAM_CLOUD4 /hacking|complimentary.(lunch|breakfast)/i meta KAM_CLOUD (__KAM_CLOUD1 + __KAM_CLOUD2 + __KAM_CLOUD3 + __KAM_CLOUD4 >= 3) score KAM_CLOUD 3.5 describe KAM_CLOUD Spam for cloud services #FAX AND PAPERLESS SPAM header __KAM_PAPERLESS1 From =~ /paperless|fax|admin/i header __KAM_PAPERLESS2 Subject =~ /paperless|fax (document|thru email|to email|message)|send document|(receive|send|new) fax|voice.message|have.received/i body __KAM_PAPERLESS3 /fax service|service plan|view.(fax|this.fax)|\d.page.fax|voice.message/i body __KAM_PAPERLESS4 /link expires/i meta KAM_PAPERLESS (__KAM_PAPERLESS1 + __KAM_PAPERLESS2 + __KAM_PAPERLESS3 + __KAM_PAPERLESS4 + HEADER_FROM_DIFFERENT_DOMAINS >= 4) score KAM_PAPERLESS 4.5 describe KAM_PAPERLESS Paperless spam for the paperless office rawbody __KAM_LOTSOFNBSP /( ?){30}/i header __KAM_IPUNSUB List-Unsubscribe =~ /http:\/\/\d+\.\d+\.\d+\.\d+/i # PASSWORD PHISH - Fixed FP thanks to Thijs Eilander header __KAM_PASSWORD1 Subject =~ /password/i body __KAM_PASSWORD2 /validate.your.email/i meta KAM_PASSWORD (__KAM_PASSWORD1 + __KAM_PASSWORD2 >= 2) score KAM_PASSWORD 1.5 describe KAM_PASSWORD Message tries to phish for password # SEMINARS AND WORKSHOPS SPAM header __KAM_WEBINAR1 From =~ /education|career|manage|learning|webinar|project|efolder/i header __KAM_WEBINAR2 Subject =~ /last chance|increase productivity|workplace morale|payroll dept|trauma.training|case.study|issues|follow.up|service.desk|vip.(lunch|breakfast)|manage.your|private.business|professional.checklist|customers.safer|great.timesaver|prep.course|crash.course|hunger.to.learn|(keys|tips).(to|for).smarter/i header __KAM_WEBINAR3 Subject =~ /webinar|strateg|seminar|owners.meeting|webcast|our.\d.new|sales.video/i body __KAM_WEBINAR4 /executive.education|contactid|register now|\d+.minute webinar|management.position|supervising.skills|discover.tips|register.early|take.control|marketing.capabilit|drive.more.sales|leveraging.cloud|solution.provider|have.a.handle|plan.to.divest|being.informed|upcoming.webinar|spearfishing.email|increase.revenue|industry.podcast|\d+.in.depth.tips|early.bird.offer|pmp.certified|lunch.briefing/i meta KAM_WEBINAR (__KAM_WEBINAR1 + __KAM_WEBINAR2 + __KAM_WEBINAR3 + __KAM_WEBINAR4 >= 3) describe KAM_WEBINAR Spam for webinars score KAM_WEBINAR 2.5 meta KAM_WEBINAR2 (__KAM_WEBINAR1 + __KAM_WEBINAR2 + __KAM_WEBINAR3 + __KAM_WEBINAR4 >= 4) && !KAM_WEBINAR describe KAM_WEBINAR2 Spam for webinars score KAM_WEBINAR2 5.0 header __KAM_CONTACTME1 Subject =~ /^contact me$/i body __KAM_CONTACTME2 /read the attached letter/i meta KAM_CONTACTME (__KAM_CONTACTME1 + __KAM_CONTACTME2 >= 2) score KAM_CONTACTME 3.5 describe KAM_CONTACTME Spam that wants you to reply header __KAM_MESH1 From =~ /consumer|connect|claim/i header __KAM_MESH2 Subject =~ /surgical mesh|serious injuries|increased risk|experiencing problems|mesh recall/i body __KAM_MESH3 /have a mesh implant|entitled to compensation|consumer injury|injured consumer/i meta KAM_MESH (__KAM_MESH1 + __KAM_MESH2 + __KAM_MESH3 >= 3) describe KAM_MESH Spam for surgical mesh score KAM_MESH 3.5 header __KAM_ALERT1 From =~ /medical.?alert/i header __KAM_ALERT2 Subject =~ /medical.alert|emergency coverage/i body __KAM_ALERT3 /help button/i meta KAM_ALERT (__KAM_ALERT1 + __KAM_ALERT2 + __KAM_ALERT3 >= 3) score KAM_ALERT 3.5 describe KAM_ALERT Spam for medical alerts # SPAM FOR RECENT HEARTBLEED CVE AND OTHER SECURITY STUFF header __KAM_SECURITY1 From =~ /Digital Defense/i header __KAM_SECURITY2 Subject =~ /heartbleed|hijack/i body __KAM_SECURITY3 /information.security|cyber.?criminal/i meta KAM_SECURITY (__KAM_SECURITY1 + __KAM_SECURITY2 + __KAM_SECURITY3 >= 3) describe KAM_SECURITY Spam related to online security score KAM_SECURITY 6.0 body __KAM_JESUS1 /jesus lovely|the.lord|touched.by.christ/i body __KAM_JESUS2 /sister.in.the.lord|need for bible/i body __KAM_JESUS3 /nigeria|muslim.women/i meta KAM_JESUS (__KAM_JESUS1 + __KAM_JESUS2 >= 2) describe KAM_JESUS Christian spam score KAM_JESUS 4.5 header __KAM_CLAIMS1 From =~ /claims.payment/i header __KAM_CLAIMS2 Subject =~ /confirm/i body __KAM_CLAIMS3 /claim.payment|claim.processing|kindly.confirm/i meta KAM_CLAIMS (__KAM_CLAIMS1 + __KAM_CLAIMS2 + __KAM_CLAIMS3 >= 3) describe KAM_CLAIMS Spam for claims processing score KAM_CLAIMS 4.5 # VISION SPAM header __KAM_VISION1 From =~ /clear.?vision|20.20|glasses|perfect.vision|mind.blowing|my.vision|oakley|quantum.vision/i header __KAM_VISION2 Subject =~ /20\/20|vision|your.glasses|your.contacts|your.eyes|dangers?.of.glasses|focus.on.here/i body __KAM_VISION3 /100%.natural|vision.restored|currently.wear.(glasses|contacts)|perfect.vision|risky.surgery|corrective.surgery|dangers.of.surgery|laser.eye|eye.care|making.your.eyes.worse|your.glasses|worsen.your.vision|special.prices|vision.in.\d+.day|vision.in.\d+.week/i meta KAM_VISION (__KAM_VISION1 + __KAM_VISION2 + __KAM_VISION3 + (KAM_WEIRDTRICK1 || RDNS_NONE) >= 3) describe KAM_VISION Spam for vision improvement score KAM_VISION 4.5 body KAM_TRUTHINESS /[Tt]he TRUTH/ describe KAM_TRUTHINESS Spam that wants you to learn "The TRUTH" score KAM_TRUTHINESS 1.5 header __KAM_KITCHEN1 From =~ /sears|kitchen|cabinet/i header __KAM_KITCHEN2 Subject =~ /kitchen.upgrade|kitchen.remodel|cabinet.install|new.kitchen/i body __KAM_KITCHEN3 /special.gift|kitchen.remodel|special.offer/i meta KAM_KITCHEN (__KAM_KITCHEN1 + __KAM_KITCHEN2 + __KAM_KITCHEN3 >= 3) score KAM_KITCHEN 4.5 describe KAM_KITCHEN Spam for kitchen improvement # ALL-ENCOMPASSING RULES FOR HEALTH RELATED SPAM, INCLUDING SKIN, WEIGHT, VISION, ETC header __KAM_GENERICHEALTH1 From =~ /(dr.?|doc.?)[ -]?([o0]z|gupta)|skinny|\d+.?(pounds|[li1]bs?)|[o0]z.([a-z]+.)?(daily|tip|show|weight)|ellen|rapid|vision|20.20|perfect|mind.blowing|healthy|beaut|medical|wrinkle|miracle|energy|weight|as.seen.on|celeb|workout|inches.off|slim|overweight|skinny|trend|curve|stubborn|bikini|f-a-t|trim|youth|belly|unwanted.pounds|gone.easily|heavy|diabetes|oz.?report|years.younger|anti.?aging|look.\d|old.age|without.trying|annoying.pounds|fat.melt|women.?s.health|forskolin|phyto|garcinia|mayo.clinic|gain.mass|nuforia|miracle.cure|notify|champion|healthly|food.health|health.news|nutrisystem|doctor.s.choice|age..prevention|diet.{0,4}report|sharp..?mind|face.?lift/i header __KAM_GENERICHEALTH2 Subject =~ /PSA|\[video\]|doctor|\d+.day|(zero|any).effort|oprah|(Dr|Doc).{0,2}[o0]z|[o0]z.([a-z]+.)?(daily|tip|show|weight|quick)|ellen|most.viewed|metabolism|danger|hormone|must.read|life.changing|healthy|perfect|younger|beautiful|hollywood|secret|aging|youth|flawless|as.seen.on|simple.way|workout|nutrition|shocking|detox|exercise|cleanse|diet|\d+(\+?).?(pounds|[li1]bs?)|images?.leaked|wow,|the.pics|don.t.tell|makeup|f-a-t|of.skin|on.(cnn|abc|cbs)|for.(summer|fall|autumn|winter|spring)|unwanted.fat|oz: |backfire|and.oz|and.racha?el|racha?el.talk|your.legs|slim.and.tone|fit.wom[ea]n|tummy|dress.size|wrinkle.reduc|younger.skin|solid.meds|belly.fat|your.calories|champion|is.it.possible|worse.than.smok|meds.online|jump-start.your.weightloss|cure.your.diabetes|weight.loss..?cure|magic.weight.loss|youth.and.vitality|get.thin.with|mental.decline|by.exercising|kidney.beans|drinking.this|treats?.the.(root.)?cause|reverse.\d+.years/i body __KAM_GENERICHEALTH3 /aging|clinical|dermatologist|aging|younger|wrinkle|omg|reduction|prevention|(body|your).fat|extra.pounds|perfect.skin|healthy|diet|gossip|\d{1,32}.years|facelift|(Dr|Doc).{0,2}[o0]z|weight|calories|metabolism|appetite|detox|unsightly|cholesterol|free.sample|\d{1,32}\s*[li]b|slimming|episode|tv.segment|oprah|colon|hollywood|shocking|workout|trend|starving|\d{1,32}%.?off|dress.size|flat.belly|silky|younger|free.trial|\d{1,32}.years|easy.trick|selfies|medical|\d{1,32}.?(lb|pounds)|exercise|the.mirror|fda.approved|slimmer|oz.blog|the.bulge|plant.based|online.store|respected.doctor|cure.your.diabete|with.forskolin|belly.fat|miracle.pill|burn.fat.fast|the.root.cause|drink(ing)?.this.shake/i meta KAM_GENERICHEALTH (__KAM_GENERICHEALTH1 + __KAM_GENERICHEALTH2 + __KAM_GENERICHEALTH3 + (KAM_EU || KAM_OTHER_BAD_TLD) >= 3) score KAM_GENERICHEALTH 1.75 describe KAM_GENERICHEALTH Matches generic health-related advert/blurbs header __KAM_SALE1 From =~ /ipad|hdtv|\$\d+|auction|laptop|easyviewing/i header __KAM_SALE2 Subject =~ /blowout|became.perfect|great.products|your.ipad.forever|weird.device|change.how.you.use|transform.your.piad|laptop.replacement/i body __KAM_SALE3 /\d{1,32}%.off|just.shipped|touch.?fire|just.became.perfect|transform.your.ipad/i header __KAM_SALEA_1 From =~ /touch.?fire/i header __KAM_SALEA_2 Received =~ /touchfire|tfire/i body __KAM_SALEA_3 /touchfire|just.became.perfect|never.be.the.same/i meta KAM_SALE (__KAM_SALE1 + __KAM_SALE2 + (__KAM_SALE3 || BODY_8BITS) >= 3) score KAM_SALE 4.0 describe KAM_SALE Spam for things on sale meta KAM_SALEA ((__KAM_SALEA_1 || __KAM_SALE1 || __KAM_SALEA_2) + __KAM_SALEA_3 >= 2) score KAM_SALEA 8.0 describe KAM_SALEA A very persistent ipad spam campaign # SPAM THAT USES ASCII FORMATTING TRICKS TO EVADE HTML-BASED RULES body __KAM_ASCII_DIVIDERS /[-~<>=_]{20}/i tflags __KAM_ASCII_DIVIDERS multiple maxhits=4 meta KAM_ASCII_DIVIDERS ((__KAM_ASCII_DIVIDERS >= 4) && !HTML_MESSAGE) describe KAM_ASCII_DIVIDERS Email that uses ascii formatting dividers and possible spam tricks score KAM_ASCII_DIVIDERS 0.8 # RATWARE THAT CAN'T EVEN PRETEND TO BE AUTHORIZED header __KAM_NOTINMYNETWORK1 X-No-Relay =~ /./i rawbody __KAM_HTMLNOISE1 /<big><\/big>|<small><\/small>|<style><\/style>/i meta KAM_HTMLNOISE (__KAM_HTMLNOISE1 + __KAM_BIGSMALL >= 1) score KAM_HTMLNOISE 1.0 describe KAM_HTMLNOISE Spam containing useless HTML padding header __KAM_CHICKEN1 From =~ /coop/i header __KAM_CHICKEN2 Subject =~ /chicken.coop|cost.of.buying/i body __KAM_CHICKEN3 /your.own.chicken|fresh.egg|chicken.coop|build.your.own/i meta KAM_CHICKEN (__KAM_CHICKEN1 + __KAM_CHICKEN2 + __KAM_CHICKEN3 >= 3) score KAM_CHICKEN 4.5 describe KAM_CHICKEN Spam for chicken coops # SPAM THAT TRIES TO BYPASS RULES LIKE CBJ_GiveMeABreak rawbody __KAM_LINEPADDING /(\n[^\n]){8}/ meta KAM_LINEPADDING ( __KAM_LINEPADDING && !__CBJ_GiveMeABreak1 && !__CBJ_GiveMeABreak2 ) score KAM_LINEPADDING 1.2 describe KAM_LINEPADDING Spam that tries to get past blank line filters # DRAPES SPAM header __KAM_DRAPES1 From =~ /drapes/i header __KAM_DRAPES2 Subject =~ /table.drapes|visibility/i body __KAM_DRAPES3 /banner.stand|print.project/i meta KAM_DRAPES (__KAM_DRAPES1 + __KAM_DRAPES2 + __KAM_DRAPES3 >= 3) score KAM_DRAPES 3.5 describe KAM_DRAPES Spam for drapes header __KAM_NUWAVE1 From =~ /nuwave|cooktop/i header __KAM_NUWAVE2 Subject =~ /cooking.needs/i body __KAM_NUWAVE3 /nuwave|energy.saving|temperature.control|meal.prep|cooktop/i meta KAM_NUWAVE (__KAM_NUWAVE1 + __KAM_NUWAVE2 + __KAM_NUWAVE3 >= 3) describe KAM_NUWAVE Spam for cooking tools score KAM_NUWAVE 3.5 rawbody __KAM_MANYCOMMENTS /<!--[^>]{200,}-->/i tflags __KAM_MANYCOMMENTS multiple maxhits=6 meta KAM_MANYCOMMENTS (__KAM_MANYCOMMENTS >= 6) describe KAM_MANYCOMMENTS Spam engine that uses large html noise comments score KAM_MANYCOMMENTS 1.2 header __KAM_HIRE1 From =~ /recruit/i header __KAM_HIRE2 Subject =~ /checking.in/i body __KAM_HIRE3 /hiring.situation|recruiting|plans.to.hire|altera.staff/i meta KAM_HIRE (__KAM_HIRE1 + __KAM_HIRE2 + __KAM_HIRE3 >= 3) describe KAM_HIRE Spam for hiring services score KAM_HIRE 4.5 header __KAM_DEALS1 From =~ /deal.?hunter/i header __KAM_DEALS2 Subject =~ /exclusive.saving|the.hottest/i body __KAM_DEALS3 /exclusive.savings/i meta KAM_DEALS (__KAM_DEALS1 + __KAM_DEALS2 + __KAM_DEALS3 >= 3) score KAM_DEALS 3.5 describe KAM_DEALS Generic advertising for deals header __KAM_CONTRACT1 From =~ /samanage/i header __KAM_CONTRACT2 Subject =~ /contract cost|itsm contract/i body __KAM_CONTRACT3 /buy you out|service management|management solution/i meta KAM_CONTRACT (__KAM_CONTRACT1 + __KAM_CONTRACT2 + __KAM_CONTRACT3 >= 3) score KAM_CONTRACT 4.5 describe KAM_CONTRACT Spam that will buy your service contract #KAM_TOLL header __KAM_TOLL1 From =~ /e.?z.?pass|collection/i header __KAM_TOLL2 Subject =~ /on.(the.)?toll.road|(pay|indebted).for.driving/i body __KAM_TOLL3 /have.not.paid|your.debt|invoice/i meta KAM_TOLL (__KAM_TOLL1 + __KAM_TOLL2 + __KAM_TOLL3 >= 3) describe KAM_TOLL Spam for road tolls score KAM_TOLL 8.0 ifplugin Mail::SpamAssassin::Plugin::RaptorOnly #KAM_AMAZON header __KAM_AMAZON1 From =~ /amazon\.com/i header __KAM_AMAZON2 From:addr !~ /amazon\.com/i header __KAM_AMAZON3 From:name =~ /amazon\.com/i meta KAM_AMAZON (__KAM_AMAZON1 + KAM_RAPTOR_ALTERED >= 2) || (__KAM_AMAZON2 + __KAM_AMAZON3 >= 2) score KAM_AMAZON 4.5 describe KAM_AMAZON Fake Amazon email with malware endif # LANDSCAPING header __KAM_LANDSCAPE1 From =~ /landscaping/i header __KAM_LANDSCAPE2 Subject =~ /turn.your.yard|mtv.crib|swimming.pool/i body __KAM_LANDSCAPE3 /landscape.designs|(simple|cheap).strategies|design.troph/i body __KAM_LANDSCAPE4 /stone.carving/i meta KAM_LANDSCAPING (__KAM_LANDSCAPE1 + __KAM_LANDSCAPE2 + __KAM_LANDSCAPE3 + __KAM_LANDSCAPE4 >= 3) describe KAM_LANDSCAPING Spam for landscaping score KAM_LANDSCAPING 3.5 # SINGING LESSONS header __KAM_SINGING1 From =~ /singing/i header __KAM_SINGING2 Subject =~ /professional.singer/i body __KAM_SINGING3 /terrible.singer|more.talent|love.songs/i meta KAM_SINGING (__KAM_SINGING1 + __KAM_SINGING2 + __KAM_SINGING3 >= 3) describe KAM_SINGING Spam for singing lessons score KAM_SINGING 4.5 # SPAM FOR ADS header __KAM_ADVERTISE1 From =~ /gmail/i header __KAM_ADVERTISE2 Subject =~ /samsung..galaxy.s\d/i body __KAM_ADVERTISE3 /advertising.for.samsung|no.application.fee|carry.this.advert/i meta KAM_ADVERTISE (__KAM_ADVERTISE1 + __KAM_ADVERTISE2 + __KAM_ADVERTISE3 >= 3) describe KAM_ADVERTISE Spam that wants you to advertise for them score KAM_ADVERTISE 4.5 # RULE FOR DOMAINS THAT HAVE NOT IMPLEMENTED ANY ANTI-FORGERY MECHANISMS - Thanks to Christian Kueppers for the request to encapsulate with DKIM and SPF plugin checks! if (version >= 3.003002) ifplugin Mail::SpamAssassin::Plugin::DKIM ifplugin Mail::SpamAssassin::Plugin::SPF # We may recommend people start raising the score for this to force more people to use SPF or DKIM Since Gmail and AOL work much better with / require SPF. header __KAM_SPF_NONE eval:check_for_spf_none() tflags __KAM_SPF_NONE net meta KAM_LAZY_DOMAIN_SECURITY (!__DKIM_EXISTS && __KAM_SPF_NONE) tflags KAM_LAZY_DOMAIN_SECURITY net score KAM_LAZY_DOMAIN_SECURITY 1.0 describe KAM_LAZY_DOMAIN_SECURITY Sending domain does not have any anti-forgery methods endif endif endif ifplugin Mail::SpamAssassin::Plugin::RaptorOnly ifplugin Mail::SpamAssassin::Plugin::DKIM header __KAM_TRUNCATE exists:X-Raptor-Truncate meta DKIM_FAILED_TRUNCATE ( DKIM_INVALID && __KAM_TRUNCATE ) describe DKIM_FAILED_TRUNCATE DKIM invalid but message truncated by Raptor score DKIM_FAILED_TRUNCATE -0.1 tflags DKIM_FAILED_TRUNCATE nice meta EMPTY_FAILED_TRUNCATE ( DKIM_FAILED_TRUNCATE && EMPTY_MESSAGE ) describe EMPTY_FAILED_TRUNCATE Empty message FP score EMPTY_FAILED_TRUNCATE -2.3 tflags EMPTY_FAILED_TRUNCATE nice endif endif ifplugin Mail::SpamAssassin::Plugin::RaptorOnly # FORGED EMAILS WITH A VIRUS ATTACHED meta KAM_FORGED_ATTACHED (SPF_HELO_FAIL + KAM_RAPTOR_ALTERED >= 2) score KAM_FORGED_ATTACHED 4.5 describe KAM_FORGED_ATTACHED Forged email with a malware attachment endif # LOTS OF PERIODS IN SUBJECT header __KAM_MANYDOTS1 Subject =~ /\.{20}/i meta KAM_MANYDOTS (__KAM_MANYDOTS1 + KAM_HUGEIMGSRC >= 2) describe KAM_MANYDOTS Spam with lots of periods in subject score KAM_MANYDOTS 3.5 # FINAL NOTICE SPAM header __KAM_SUBJECTNOTICE1 Subject =~ /Notice: \d+$|final.notice|rpt: \d+$/i meta KAM_SUBJECTNOTICE __KAM_SUBJECTNOTICE1 describe KAM_SUBJECTNOTICE Spam notices score KAM_SUBJECTNOTICE 1.0 # SPAM FOR BACKUP SERVICE header __KAM_BACKUP1 From =~ /backup/i header __KAM_BACKUP2 Subject =~ /continuity|\d.reasons|traditional.backup/i body __KAM_BACKUP3 /backup.necessary|marketing|infographic|charge.more/i meta KAM_BACKUP (__KAM_BACKUP1 + __KAM_BACKUP2 + __KAM_BACKUP3 >= 3) describe KAM_BACKUP Spam for backup services score KAM_BACKUP 4.5 # SPAM THAT TRIES TO AVOID DETECTION WITH NUMBERS IN THE FROM header KAM_FROMNUM From:name =~ /\.\d{7,}$/ describe KAM_FROMNUM Spam with large numbers in the from header score KAM_FROMNUM 1.0 # LAZY SPAM WITH BARELY MORE THAN A LINK TO A BAD DOMAIN meta KAM_LINKBAIT (KAM_LAZY_DOMAIN_SECURITY + __KAM_BODY_LENGTH_LT_512 + (__KAM_COUNT_URIS >= 1) >= 3) score KAM_LINKBAIT 2.5 describe KAM_LINKBAIT Short messages containing little more than a link, from a domain with no security in place uri __KAM_WP_INCLUDES /(?:wp-includes|wp-content)/i meta KAM_LINKBAIT2 KAM_LINKBAIT + __KAM_WP_INCLUDES >= 2 score KAM_LINKBAIT2 1.5 describe KAM_LINKBAIT2 Linkbait that points to wordpress - usually means a compromised site # FREEMAIL LINKBAIT meta KAM_LINKBAIT3 (KAM_SHORT + FREEMAIL_FROM + __KAM_BODY_LENGTH_LT_512 >= 3) score KAM_LINKBAIT3 1.5 describe KAM_LINKBAIT3 Freemail linkbait with a url shortener ifplugin Mail::SpamAssassin::Plugin::RaptorOnly # MALWARE IN EMAILS THAT MENTION LOTS OF MONEY meta KAM_PHISHY_DOLLARS (KAM_RAPTOR_ALTERED + LOTS_OF_MONEY >= 2) score KAM_PHISHY_DOLLARS 3.5 describe KAM_PHISHY_DOLLARS Emails with malware and large dollar amounts endif # RATWARE DU JOUR, MULTIPLE FROM HEADERS AND WONKY SUBJECT LINE header __KAM_MULTIPLE_FROM From =~ /^./ tflags __KAM_MULTIPLE_FROM multiple maxhits=2 header __KAM_SUBJECT_WHITESPACE_START Subject =~ /^\s{10}/ meta KAM_GRABBAG6 ((__KAM_MULTIPLE_FROM >= 2) + __KAM_SUBJECT_WHITESPACE_START >= 2) describe KAM_GRABBAG6 Ratware with multiple from headers and subject beginning with whitespace score KAM_GRABBAG6 4.5 # GENERIC GREETINGS THAT YOU WOULD NEVER GET FROM A LEGIT EMAIL header KAM_GENERICHELLO Subject =~ /dear.email.user|hi.there/i score KAM_GENERICHELLO 1.5 describe KAM_GENERICHELLO Spam with generic greetings in the subject # FAKE GOOGLE EMAILS - Thanks to Marc Jouan for pointing out the double rule / T_HK rule name change header __KAM_GOOGLE2_1 From =~ /google\+/i header __KAM_GOOGLE2_2 From !~ /google.com/i meta KAM_GOOGLE2 (__KAM_GOOGLE2_1 + __KAM_GOOGLE2_2 + (HK_SPAMMY_FILENAME || KAM_LAZY_DOMAIN_SECURITY) >= 3) score KAM_GOOGLE2 4.5 describe KAM_GOOGLE2 Fake Google spam # MORE NIGERIAN VARIANTS body __KAM_NIGERIAN3_1 /congo/i meta KAM_NIGERIAN3 (__KAM_NIGERIAN3_1 + DEAR_SOMETHING + LOTS_OF_MONEY >= 3) score KAM_NIGERIAN3 4.5 describe KAM_NIGERIAN3 Nigerian scam variant # FINGERHUT SPAMS header __KAM_FINGERHUT1 From =~ /finger.?hut/i header __KAM_FINGERHUT2 Subject =~ /your.budget|credit.account|qualify|finger.?hut|credit|your.account/i body __KAM_FINGERHUT3 /important.message|what.you.want|monthly.pay|your.account|credit.account|holiday.shopping|are.you.approved|fingerhut.buying/i meta KAM_FINGERHUT (__KAM_FINGERHUT1 + __KAM_FINGERHUT2 + __KAM_FINGERHUT3 >= 3) score KAM_FINGERHUT 4.5 describe KAM_FINGERHUT Spam for fingerhut # FRIEND REQUEST SPAM header __KAM_FRIEND1 Subject =~ /new.notification/i body __KAM_FRIEND2 /wants.to.follow/i meta KAM_FRIEND (__KAM_FRIEND1 + __KAM_FRIEND2 >= 2) score KAM_FRIEND 1.5 describe KAM_FRIEND Friend request spam # ELIMINATE A BUNCH OF RECENT BAD ATTACHMENT SPAM ifplugin Mail::SpamAssassin::Plugin::RaptorOnly meta KAM_VERY_MALWARE (KAM_LAZY_DOMAIN_SECURITY && KAM_RAPTOR_ALTERED >= 2) score KAM_VERY_MALWARE 3.5 describe KAM_VERY_MALWARE A message with malware that is definitely unwanted endif #MERCHANT ACCOUNTS SPAM header __KAM_MERCHANT1 Subject =~ /finance.department/i body __KAM_MERCHANT2 /business.owner|merchant.processor|processing.fee|average.bank|interchange.fee/i body __KAM_MERCHANT3 /merchant.processing|small.business|yearly.credit|monthly.fee|100%.free/i meta KAM_MERCHANT (__KAM_MERCHANT1 + __KAM_MERCHANT2 + __KAM_MERCHANT3 >= 3) score KAM_MERCHANT 4.5 describe KAM_MERCHANT Spam for merchant processing # ZERO DAY ATTACHMENTS THAT ARE OBVIOUSLY CRAP BUT NOT CAUGHT BY AV ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __KAM_ZERODAY1 Content-Type =~ /msword|ms-excel|spreadsheet|office|octet/i header __KAM_ZERODAY2 X-Mailer =~ /foxmail/i # DISABLED 7/16 FOR NO LONGER BEING RELEVANT #meta KAM_ZERODAY (__SUBJECT_ENCODED_B64 + __KAM_ZERODAY1 + __KAM_ZERODAY2 >= 3) #describe KAM_ZERODAY obviously a malware email that was not caught #score KAM_ZERODAY 8.0 # ANOTHER ONE header __KAM_ZERODAY3 Subject =~ /remittance advice|invoice|resume|the.open.message|please.the.open|visa.chip/i meta KAM_ZERODAY2 (__KAM_ZERODAY1 + __KAM_ZERODAY3 + KAM_LAZY_DOMAIN_SECURITY >= 3) score KAM_ZERODAY2 1.0 describe KAM_ZERODAY2 Another obvious zero-day malware meta KAM_ZERODAY3 (KAM_ZERODAY2 + T_OBFU_DOC_ATTACH >= 2) score KAM_ZERODAY3 3.5 describe KAM_ZERODAY3 Another obvious zero-day malware endif #MORE ACCOUNTING DANGEROUS SPAMS meta KAM_DANGEROUSXLS (__KAM_ZERODAY3 + KAM_OLEMACRO_ENCRYPTED + KAM_OLEMACRO_RENAME >= 3) describe KAM_DANGEROUSXLS Dangerous accounting emails with zero day payloads score KAM_DANGEROUSXLS 6.0 # FAMILY TREE SPAM header __KAM_ANCESTOR1 From =~ /ancestry/i header __KAM_ANCESTOR2 Subject =~ /free.family.tree|find.your.ancestor/i body __KAM_ANCESTOR3 /family.history|your family|share.the.stories/i meta KAM_ANCESTOR (__KAM_ANCESTOR1 + __KAM_ANCESTOR2 + __KAM_ANCESTOR3 >= 3) describe KAM_ANCESTOR Spam for family trees score KAM_ANCESTOR 3.5 # REMEMBER WHEN YOU GOT THAT SPAM header __KAM_REMEMBERWHEN1 Subject =~ /sup|hello|for.you.bro|how.are.you/i body __KAM_REMEMBERWHEN2 /hello.brother|remember(ed)?.you|i.remember/i body __KAM_REMEMBERWHEN3 /medication|\d+%.discount|lots?.of.drug/i meta KAM_REMEMBERWHEN (__KAM_REMEMBERWHEN1 + __KAM_REMEMBERWHEN2 + __KAM_REMEMBERWHEN3 >= 3) score KAM_REMEMBERWHEN 4.5 describe KAM_REMEMBERWHEN Reminder of something that never happened # THE LATEST TRAILING NOISE FORMAT body __KAM_NOISE1 /([a-z0-9],){12}/i body __KAM_NOISE2 /([a-z]{1,10},){10}/i ifplugin Mail::SpamAssassin::Plugin::RaptorOnly meta KAM_NOISE1 (__KAM_NOISE1 + __KAM_NOISE2 + (CBJ_GiveMeABreak || __CBJ_GiveMeABreak2) >= 3) describe KAM_NOISE1 Pattern of noise words at the end of an email score KAM_NOISE1 2.5 endif # FREE PIZZA WOO! header __KAM_PIZZA1 From =~ /pizza/i header __KAM_PIZZA2 Subject =~ /^free pizza$/i body __KAM_PIZZA3 /free.pizza.coupon/i meta KAM_PIZZA (__KAM_PIZZA1 + __KAM_PIZZA2 + __KAM_PIZZA3 >= 3) score KAM_PIZZA 3.5 describe KAM_PIZZA Spam for free pizza # ENGINEERING SPAM header __KAM_ENGINEER1 Subject =~ /engineering . architect|engineering.industry/i body __KAM_ENGINEER2 /email.list|target.audience|databank|verified.email/i body __KAM_ENGINEER3 /construction.engineering|engineering . architect|marketing.manager/i meta KAM_ENGINEER (__KAM_ENGINEER1 + __KAM_ENGINEER2 + __KAM_ENGINEER3 >= 3) score KAM_ENGINEER 3.5 describe KAM_ENGINEER Spam for engineering contact information # SUNGLASSES header __KAM_SUNGLASSES1 Subject =~ /rayban/i body __KAM_SUNGLASSES2 /great ray|hot.deal/i body __KAM_SUNGLASSES3 /style rocks|today.only/i meta KAM_SUNGLASSES (__KAM_SUNGLASSES1 + __KAM_SUNGLASSES2 + __KAM_SUNGLASSES3 >= 3) describe KAM_SUNGLASSES Spam for sunglasses score KAM_SUNGLASSES 3.5 # INVOICE SPAM OF THE DAY header __KAM_INVOICE1 From =~ /billing/i header __KAM_INVOICE2 Subject =~ /past.due|invoice/i header __KAM_INVOICE3 Subject =~ /invoice (error|issue)/i body __KAM_INVOICE4 /(billing error|problem with the address).{2,10}invoice/i uri __KAM_INVOICE5 /overdue|final.account/i meta KAM_INVOICE (__KAM_INVOICE1 + __KAM_INVOICE2 + SPF_FAIL >= 3) score KAM_INVOICE 4.5 describe KAM_INVOICE Phishing invoice spam meta KAM_INVOICE2 (__KAM_INVOICE1 + __KAM_INVOICE3 + __KAM_INVOICE4 + __KAM_INVOICE5 + SPF_FAIL >= 3) score KAM_INVOICE2 5.5 describe KAM_INVOICE2 Phishing invoice spam meta GB_INVOICE3 ( __WORD_INVIS_2 && __KAM_INVOICE2 ) describe GB_INVOICE3 Phishing invoice spam score GB_INVOICE3 0.5 header __GB_INV_SHIP Subject =~ /invoice|shipment/ meta GB_INVOICE4 ( PCCC_BAD_FREE_URI && ( __GB_INV_SHIP || __KAM_INVOICE2 || __KAM_INVOICE3 ) >= 2 ) describe GB_INVOICE4 Invoice spam with free hosting links score GB_INVOICE4 0.25 # GRIPEEZ header __KAM_GRIPPY1 From =~ /gripeez/i header __KAM_GRIPPY2 Subject =~ /bonus.offer|gripeez/i body __KAM_GRIPPY3 /gripeez.bonus|interior.decorator|sticky.grip/i meta KAM_GRIPPY (__KAM_GRIPPY1 + __KAM_GRIPPY2 + __KAM_GRIPPY3 >= 3) score KAM_GRIPPY 4.5 describe KAM_GRIPPY Spam for sticky grip products # LIMITED / DISABLED ACCOUNT, ACTIVATION, SECURITY ALERTS, AND OTHER ACCOUNT PHISHES header __KAM_ACCOUNTPHISH1 From =~ /[il]tunes|account|costco|walgreen|amazon|ebay|internal|admin|gold|webmail|provider|marketing|Bank of America/i header __KAM_ACCOUNTPHISH2 Subject =~ /your.account|is.limited|activate|recover|acknowledgment|of.order|buying.from|order.(status|confirm)|help.?desk|update.your|security|document|(^secure$)|download.failed|click.to.activate|status.approved|notification.message|storage.exceeded|maintenance routine|storage.warning|size.notification|administrative.notice/i body __KAM_ACCOUNTPHISH3 /update.your.information|problems.with.your|billing.information|order.details|personal.data|detailed.order|order.information|for.activation|account.{1,30}.inactive|information.required|secure.browser|recently.compromised|classified.document|with.your.email|complete.your.account|account.confirmed|claim.your.order|free.money|forced.to.cancel|immediate.access|upgrading.all.staff|advice.to.update|confirm.your.account/i body __KAM_ACCOUNTPHISH4 /webmail|all.systems|storage.limit|get.back.into|update.your.account|kindly.click|very.private.message|this.is.honest|fill.the.form|click.on.send|follow.here|for.all.user|one.click.away|mail.desk/i meta KAM_ACCOUNTPHISH ((__KAM_ACCOUNTPHISH1 || FREEMAIL_FROM || KAM_LAZY_DOMAIN_SECURITY) + __KAM_ACCOUNTPHISH2 + __KAM_ACCOUNTPHISH3 + __KAM_ACCOUNTPHISH4 >= 3) score KAM_ACCOUNTPHISH 3.20 describe KAM_ACCOUNTPHISH Spam that tries to get account information # BUY PROPERTY header __KAM_PROPERTY1 From =~ /high.rise|condo/i header __KAM_PROPERTY2 Subject =~ /condo|move.in.soon|developer/i body __KAM_PROPERTY3 /convenient.location/i meta KAM_PROPERTY (__KAM_PROPERTY1 + __KAM_PROPERTY2 + __KAM_PROPERTY3 >= 3) score KAM_PROPERTY 2.5 describe KAM_PROPERTY Spam for buying property # FAKE AMEX header __KAM_FAKEAMEX1 From =~ /aexp.com/i meta KAM_FAKEAMEX (__KAM_FAKEAMEX1 + SPF_FAIL >= 2) score KAM_FAKEAMEX 8.0 describe KAM_FAKEAMEX A rash of spam that is phishing for American Express information # HUGE SUBJECT header KAM_HUGESUBJECT Subject =~ /^.{500}/ score KAM_HUGESUBJECT 2.5 describe KAM_HUGESUBJECT Email with a subject longer than any mail client would let you enter #HOOKUP header __KAM_HOOKUP1 Subject =~ /hookup with local singles/i uri __KAM_HOOKUP2 /justhookup/i body __KAM_HOOKUP3 /match.?me.?networks/i meta KAM_HOOKUP (__KAM_HOOKUP1 + __KAM_HOOKUP2 + __KAM_HOOKUP3 >= 3) score KAM_HOOKUP 10.5 describe KAM_HOOKUP Spam for Local Hookup Service #PSYCHIC header __KAM_PSYCHIC1 Subject =~ /horoscope|psychic/i uri __KAM_PSYCHIC2 /free.psychic/i body __KAM_PSYCHIC3 /psychic Chris|free psychic reading/i meta KAM_PSYCHIC (__KAM_PSYCHIC1 + __KAM_PSYCHIC2 + __KAM_PSYCHIC3 >= 3) score KAM_PSYCHIC 4.5 describe KAM_PSYCHIC Current Psychic Product Spam du Jour #UNSUB BADDIES body __KAM_BADUNSUB /(?:remove|Unsubscribe) from (?:MindTCommunications|LunarMessages)/i meta KAM_BADUNSUB (__KAM_BADUNSUB >= 1) score KAM_BADUNSUB 3.0 describe KAM_BADUNSUB Bad Unsubscribe Messages #GRABBAG FOR A ROUND OF WORDPRESS HACKS rawbody __KAM_GRABBAG7_1 /wp-content|wp-includes|\/plugins\// meta KAM_GRABBAG7 ((HTML_MIME_NO_HTML_TAG || MIME_HTML_ONLY) + __KAM_GRABBAG7_1 + (SPF_FAIL || SPF_HELO_FAIL) >= 3) score KAM_GRABBAG7 3.0 describe KAM_GRABBAG7 Spam pattern with bad HTML message #TINYURL OBFUSCATION uri __KAM_TINYURL1 /tinyurl.com\/.{0,10}(hookup|sexual|online-riches|predator-zipcode|nothnx|imtaken)/i meta KAM_TINYURL (__KAM_TINYURL1) score KAM_TINYURL 4.0 describe KAM_TINYURL Spammy urls that hide behind a link shortener # FAKE DROPBOX - Adding _ to DROPBOX2 for badly configured ESS servers header __KAM_DROPBOX1 From =~ /dropbox/i header __KAM_DROPBOX2 From !~ /dropbox.com/i body __KAM_DROPBOX3 /shared.a.folder|download the file/i meta KAM_DROPBOX (__KAM_DROPBOX1 + __KAM_DROPBOX2 + __KAM_DROPBOX3 >= 3) score KAM_DROPBOX 4.5 describe KAM_DROPBOX Fake Dropbox emails # BAD YAHOO! DON'T SEND EMAIL FROM A MULTICAST IP! ifplugin Mail::SpamAssassin::Plugin::RaptorOnly header __KAM_YAHOO_MISTAKE1 From =~ /\@yahoo\./i meta KAM_YAHOO_MISTAKE (SPF_PASS && __KAM_YAHOO_MISTAKE1 && RCVD_ILLEGAL_IP) describe KAM_YAHOO_MISTAKE Reversing score for some idiotic Yahoo received headers score KAM_YAHOO_MISTAKE -3.0 endif # GARBAGE FREEMAIL meta KAM_GRABBAG9 (MALFORMED_FREEMAIL + SUBJ_ALL_CAPS + FREEMAIL_ENVFROM_END_DIGIT >= 3) score KAM_GRABBAG9 4.5 describe KAM_GRABBAG9 Garbage email from a garbage freemail account # AQUA RUG header __KAM_AQUARUG1 From =~ /aqua.?rug/i header __KAM_AQUARUG2 Subject =~ /(bath|shower).mat|for.your.shower/i body __KAM_AQUARUG3 /stop.slipping|unique.carpet|aqua.rug|bare.feet.love/i meta KAM_AQUARUG (__KAM_AQUARUG1 + __KAM_AQUARUG2 + __KAM_AQUARUG3 >= 3) score KAM_AQUARUG 3.5 describe KAM_AQUARUG Spam for aqua rug product # FAKE ITC SPAM # Fixed FP thanks to j.marshall header __KAM_ITC1 From =~ /thetradecouncil.com/i body __KAM_ITC2 /International Trade Council/i body __KAM_ITC3 /enclosed/i meta KAM_ITC (__KAM_ITC1 < 1) && (__KAM_ITC2 >= 1) && (__KAM_ITC3 + KAM_BADIPHTTP >= 1) score KAM_ITC 4.5 describe KAM_ITC Fake email from International Trade Council # HAVE YOU SEEN THIS body __KAM_SEENTHIS1 /have.you.seen|seen.this/i meta KAM_SEENTHIS (__KAM_SEENTHIS1 + __KAM_OPRAH3 + (KAM_LAZY_DOMAIN_SECURITY || KAM_MANYTO) >= 3) score KAM_SEENTHIS 4.5 describe KAM_SEENTHIS Have you seen this spam? # DETOX header __KAM_DETOX1 From =~ /detox/i header __KAM_DETOX2 Subject =~ /detox.service|discover.detox|clear.your.system|how.detox.(could|can)/i body __KAM_DETOX3 /detox.program|right.for.you|clean(ing)? up your life|a.little.easier/i meta KAM_DETOX (__KAM_DETOX1 + __KAM_DETOX2 + __KAM_DETOX3 >= 3) score KAM_DETOX 2.5 describe KAM_DETOX Spam for trendy detox stuff # DEATH INSURANCE header __KAM_DEATHINSURE1 From =~ /live.sure/i header __KAM_DEATHINSURE2 Subject =~ /life.will|cheaper.than.today/i body __KAM_DEATHINSURE3 /inheritance.tax|your.loved.ones|funeral.costs/i meta KAM_DEATHINSURE (__KAM_DEATHINSURE1 + __KAM_DEATHINSURE2 + __KAM_DEATHINSURE3 >= 3) describe KAM_DEATHINSURE Spam for death insurance score KAM_DEATHINSURE 3.5 # REACHBASE body KAM_REACHBASE /ReachBase is committed to providing you with relevant business information/i score KAM_REACHBASE 2.5 describe KAM_REACHBASE Marketing email pretending to be business info # DIGITAL WALLET SPAM header __KAM_DIGITALWALLET1 From =~ /apple.?pay/i header __KAM_DIGITALWALLET2 Subject =~ /(ready.for|introducing|complimentary).apple.?pay|paying.too.much/i body __KAM_DIGITALWALLET3 /business.ready|no.setup.fee|only.$?[\d\.]+%?.(per|a).swipe|apple.?pay.equipment|free,equipment/i meta KAM_DIGITALWALLET (__KAM_DIGITALWALLET1 + __KAM_DIGITALWALLET2 + __KAM_DIGITALWALLET3 + (HELO_DYNAMIC_DHCP || KAM_EU || KAM_INFOUSMEBIZ) >= 3) score KAM_DIGITALWALLET 3.5 describe KAM_DIGITALWALLET Spam for digital wallet services # BAD PHP header __KAM_BADPHP1 X-PHP-Originating-Script =~ /eval..'d code/i header __KAM_BADPHP2 X-Source-Args =~ /css.php/i meta KAM_BADPHP (__KAM_BADPHP1 || __KAM_BADPHP2) score KAM_BADPHP 3.5 describe KAM_BADPHP Questionable PHP mailer headers # TINNITUS header __KAM_TINNITUS1 From =~ /tinnitus.?(solution|911|breakthrough|ringing)|silencil|tinnitus/i header __KAM_TINNITUS2 Subject =~ /new.tip|only.(1|one).week|pandemic|ears? ring|removes? tinnitus/i body __KAM_TINNITUS3 /scientifically.proven|end.tinnitus|get rid of the ringing|shocking presentation|IVY League|doctors are baffled|restores your hearing|no more buzzing/i tflags __KAM_TINNITUS3 nosubject meta KAM_TINNITUS (__KAM_TINNITUS1 + __KAM_TINNITUS2 + __KAM_TINNITUS3 >= 3) describe KAM_TINNITUS Tinnitus spam score KAM_TINNITUS 4.5 # KIWIBANK header __KAM_KIWIBANK1 From =~ /kiwibank/i header __KAM_KIWIBANK2 Subject =~ /verification.required/i body __KAM_KIWIBANK3 /security.procedure|customer.safety|security.details/i meta KAM_KIWIBANK (__KAM_KIWIBANK1 + __KAM_KIWIBANK2 + __KAM_KIWIBANK3 >= 3) describe KAM_KIWIBANK Account phish for Kiwibank score KAM_KIWIBANK 3.5 # HAPPY TALK header __KAM_HAPPYTALK1 Subject =~ /^hello$/i body __KAM_HAPPYTALK2 /honest.and.nice/i body __KAM_HAPPYTALK3 /beautiful.mail/i meta KAM_HAPPYTALK (__KAM_HAPPYTALK1 + __KAM_HAPPYTALK2 + __KAM_HAPPYTALK3 >= 3) score KAM_HAPPYTALK 3.5 describe KAM_HAPPYTALK Weirdly happy spam # SETTLEMENT SPAM header __KAM_SETTLEMENT1 From =~ /xarelto/i header __KAM_SETTLEMENT2 Subject =~ /settlements?.available/i body __KAM_SETTLEMENT3 /lawsuit.information/i meta KAM_SETTLEMENT (__KAM_SETTLEMENT1 + __KAM_SETTLEMENT2 + __KAM_SETTLEMENT3 >= 3) score KAM_SETTLEMENT 3.5 describe KAM_SETTLEMENT Spam offering lawsuit settlement # CAD SPAM header __KAM_CAD1 Subject =~ /cad.drawing/i body __KAM_CAD2 /we.specialize.in/i body __KAM_CAD3 /our.products/i meta KAM_CAD (__KAM_CAD1 + __KAM_CAD2 + __KAM_CAD3 >= 3) describe KAM_CAD Spam for CAD services score KAM_CAD 3.5 ifplugin Mail::SpamAssassin::Plugin::RaptorOnly #SPAM WITH OFFICE MACROS header __KAM_VBMACRO X-Raptor-VBMacro =~ /True/i meta KAM_VBMACRO ((__KAM_VBMACRO >= 1) && !KAM_OLEMACRO) describe KAM_VBMACRO Message contains attachment with VB macro score KAM_VBMACRO 6.5 #SPAM THAT INDICATES DYNAMIC IP header KAM_DYNIP X-Raptor-DynamicIndicator =~ /True/i describe KAM_DYNIP Message contains Dynamic IP Address Indicator score KAM_DYNIP 6.5 endif # YELP AND OTHER REVIEW SITES header __KAM_REVIEW1 From =~ /contractor/i header __KAM_REVIEW2 Subject =~ /verify.accuracy|your.listing|listing.on.yelp/i body __KAM_REVIEW3 /unverified|major.local.search|search.sites|company(.s)?.information/i meta KAM_REVIEW (__KAM_REVIEW1 + __KAM_REVIEW2 + __KAM_REVIEW3 >= 3) describe KAM_REVIEW Spam for review sites score KAM_REVIEW 4.5 # TOURS AND EVENTS header __KAM_TOURS1 From =~ /festival/i header __KAM_TOURS2 Subject =~ /adventure.tour/i body __KAM_TOURS3 /your.adventure.tour|your.event/i meta KAM_TOURS (__KAM_TOURS1 + __KAM_TOURS2 + __KAM_TOURS3 >= 3) score KAM_TOURS 3.5 describe KAM_TOURS Spam for tours and events # NO MORE SPAM ENGINES body __KAM_NOMORE1 /no.more.of.this/i body __KAM_NOMORE2 /no.more.at.all/i meta KAM_NOMORE (__KAM_NOMORE1 + __KAM_NOMORE2 >= 2) describe KAM_NOMORE Another predictable spam engine score KAM_NOMORE 3.5 # NOT REALLY CONFIDENTIAL body __KAM_NOCONFIDENCE1 /confidential.information/i meta KAM_NOCONFIDENCE (KAM_LAZY_DOMAIN_SECURITY + __KAM_NOCONFIDENCE1 >= 2) score KAM_NOCONFIDENCE 0.5 describe KAM_NOCONFIDENCE Confidential information sent with no security # YER GON GET SASSINATED header __KAM_ASSASSIN1 Subject =~ /want you dead/i body __KAM_ASSASSIN2 /my identity/i body __KAM_ASSASSIN3 /assassinate/i body __KAM_ASSASSIN4 /like.an.accident/i meta KAM_ASSASSIN (__KAM_ASSASSIN1 + __KAM_ASSASSIN2 + __KAM_ASSASSIN3 + __KAM_ASSASSIN4 >= 3) score KAM_ASSASSIN 4.5 describe KAM_ASSASSIN Assassination spam # GIMME FLASH DRIVES header __KAM_DRIVE1 From =~ /purchase|manager/i header __KAM_DRIVE2 Subject =~ /quotation/i body __KAM_DRIVE3 /to.be.furnished|office.equipment.item/i meta KAM_DRIVE (__KAM_DRIVE1 + __KAM_DRIVE2 + __KAM_DRIVE3 >= 3) score KAM_DRIVE 3.5 describe KAM_DRIVE Spam for ordering office equipment #BAD TLD - TESTING NEW blacklist_uri_host feature #PASSED TEST BUT THIS IS 100 points - Instead modify SOMETLD_ARE_BAD_TLD TO PREVENT FPs #if (version >= 3.004000) # blacklist_uri_host link #endif #LOOKING TO SHUTDOWN MISUSE OF DNSWL AND HOSTKARMA ifplugin Mail::SpamAssassin::Plugin::RaptorOnly meta KAM_QUITE_BAD_DNSWL (URIBL_BLACK + URIBL_SBL + URIBL_PH_SURBL + RCVD_IN_BL_SPAMCOP_NET + IN_BRBL + RCVD_IN_BRBL_RELAY + RCVD_IN_XBL + __KAM_URIBL_PCCC >= 1) && (RCVD_IN_DNSWL_HI + RCVD_IN_HOSTKARMA_W >= 1) score KAM_QUITE_BAD_DNSWL 2.5 describe KAM_QUITE_BAD_DNSWL Removing HostKarma and DNSWL HI Scoring for Emails in various RBL else meta KAM_QUITE_BAD_DNSWL (URIBL_BLACK + URIBL_SBL + URIBL_PH_SURBL + RCVD_IN_BL_SPAMCOP_NET + RCVD_IN_XBL >= 1) && (RCVD_IN_DNSWL_HI + RCVD_IN_HOSTKARMA_W >= 1) score KAM_QUITE_BAD_DNSWL 2.5 describe KAM_QUITE_BAD_DNSWL Removing HostKarma and DNSWL HI Scoring for Emails in various RBL endif ifplugin Mail::SpamAssassin::Plugin::RaptorOnly meta KAM_BAD_DNSWL (URIBL_BLACK + URIBL_SBL + URIBL_PH_SURBL + RCVD_IN_BL_SPAMCOP_NET + IN_BRBL + RCVD_IN_BRBL_RELAY + RCVD_IN_XBL + __KAM_URIBL_PCCC >= 1) && (RCVD_IN_DNSWL_HI + RCVD_IN_HOSTKARMA_W >= 2) score KAM_BAD_DNSWL 7.0 describe KAM_BAD_DNSWL Removing HostKarma and DNSWL HI Scoring for Emails in various RBL else meta KAM_BAD_DNSWL (URIBL_BLACK + URIBL_SBL + URIBL_PH_SURBL + RCVD_IN_BL_SPAMCOP_NET + RCVD_IN_XBL >= 1) && (RCVD_IN_DNSWL_HI + RCVD_IN_HOSTKARMA_W >= 2) score KAM_BAD_DNSWL 7.0 describe KAM_BAD_DNSWL Removing HostKarma and DNSWL HI Scoring for Emails in various RBL endif # HEARING LOSS header __JMQ_HEARINGLOSS1 From =~ /hearing.?loss|deaf \& angry|sharpear/i header __JMQ_HEARINGLOSS2 Subject =~ /reverse.your.hearing|hearing.loss|\d+.year.old.method|hearing.aids|restore your hearing/i body __JMQ_HEARINGLOSS3 /going.crazy|natural.formula|restore.your.hearing|click.here.to.see|off.hearing.aid|mineral to restore/i meta JMQ_HEARINGLOSS (__JMQ_HEARINGLOSS1 + __JMQ_HEARINGLOSS2 + __JMQ_HEARINGLOSS3 >= 3) score JMQ_HEARINGLOSS 3.5 describe JMQ_HEARINGLOSS Spam for hearing loss solutions # TRACKR header __JMQ_TRACKR1 From =~ /trackr/i header __JMQ_TRACKR2 Subject =~ /trackr|never.lose|find.any|lost.items/i body __JMQ_TRACKR3 /locate anything|find.anything|never.lose.anything|new.invention|never.lose.your|tired.of.losing|find.any.lost/i meta JMQ_TRACKR (__JMQ_TRACKR1 + __JMQ_TRACKR2 + __JMQ_TRACKR3 >= 3) score JMQ_TRACKR 4.5 describe JMQ_TRACKR Spam for TrackR # CONGRATULATION header __JMQ_CONGRAT1 From =~ /award|claim/i header __JMQ_CONGRAT2 Subject =~ /congratulation|open.attachment|good.news.for/i meta JMQ_CONGRAT (__JMQ_CONGRAT1 + __JMQ_CONGRAT2 + (KAM_RAPTOR_ALTERED || T_FREEMAIL_DOC_PDF || HK_SPAMMY_FILENAME) >= 3) score JMQ_CONGRAT 3.5 describe JMQ_CONGRAT Open attachment to claim your free spam # PICKUP header __JMQ_PICKUP1 Subject =~ /hey there|(^hey$)/i body __JMQ_PICKUP2 /(dirty|freaky|naughty|good)(pix|pic)|hey.cutie/i header __JMQ_PICKUP3 X-Mailer =~ /php/i body __JMQ_PICKUP4 /\d+.year.old|female/i meta JMQ_PICKUP (__JMQ_PICKUP1 + __JMQ_PICKUP2 + __JMQ_PICKUP3 + __JMQ_PICKUP4 >= 3) score JMQ_PICKUP 8.0 describe JMQ_PICKUP spam that wants your number # COMPROMISED DROPBOX header __JMQ_DROPBOX1 Subject =~ /(payment|transfer)/i header __JMQ_DROPBOX2 Subject =~ /\([a-z]\d+\)/i body __JMQ_DROPBOX3 /ach.(payment|transfer)/i meta JMQ_DROPBOX (__JMQ_DROPBOX1 + __JMQ_DROPBOX2 + __JMQ_DROPBOX3 >= 3) score JMQ_DROPBOX 3.0 describe JMQ_DROPBOX Spam from what appears to be compromised dropbox accounts #FIX BAD REVIEW header __KAM_BAD_REVIEW1 Subject =~ /fix bad reviews/i body __KAM_BAD_REVIEW2 /Reputation Giant/i meta KAM_BAD_REVIEW (__KAM_BAD_REVIEW1 + __KAM_BAD_REVIEW2 >= 2) score KAM_BAD_REVIEW 4.0 describe KAM_BAD_REVIEW Online reputation spammers #GOOGLE AWARD header __KAM_GOOGLE_AWARD1 From =~ /Google UK/i body __KAM_GOOGLE_AWARD2 /selected as a winner/i body __KAM_GOOGLE_AWARD3 /Dear Google/i body __KAM_GOOGLE_AWARD4 /Official Notification Letter/i ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __KAM_GOOGLE_AWARD5A Content-Type =~ /Google Award/i mimeheader __KAM_GOOGLE_AWARD5B Content-Disposition =~ /Google Award/i endif meta KAM_GOOGLE_AWARD (__KAM_GOOGLE_AWARD1 + __KAM_GOOGLE_AWARD2 + __KAM_GOOGLE_AWARD3 + __KAM_GOOGLE_AWARD4 + (__KAM_GOOGLE_AWARD5A + __KAM_GOOGLE_AWARD5B >= 1) >= 4) score KAM_GOOGLE_AWARD 5.0 describe KAM_GOOGLE_AWARD Fake Google Awards #OBFUSCATED LOANS body KAM_OBFU_LOANS /Stüdént Lóans/i score KAM_OBFU_LOANS 5.0 describe KAM_OBFU_LOANS Obfuscated Loan Verbiage #WORK FROM HOME body __KAM_WORKFROMHOME1 /work from home/i meta KAM_WORKFROMHOME (KAM_SHORT + __KAM_WORKFROMHOME1 >= 2) score KAM_WORKFROMHOME 1.75 describe KAM_WORKFROMHOME Work from Home Spams #STUDENT LOAN body __KAM_STUDENTLOAN1 /(National|Federal) Student Loan Status/i body __KAM_STUDENTLOAN2 /consolidate your loan/i body __KAM_STUDENTLOAN3 /doesn't injured/i body __KAM_STUDENTLOAN4 /866-351-4693/i body __KAM_STUDENTLOAN5 /(financial troubles|debt) is (understood|forgiven)/i meta KAM_STUDENTLOAN (__KAM_STUDENTLOAN1 + __KAM_STUDENTLOAN2 + __KAM_STUDENTLOAN3 + __KAM_STUDENTLOAN4 + __KAM_STUDENTLOAN5 >= 3) score KAM_STUDENTLOAN 4.5 describe KAM_STUDENTLOAN Student Loan Scam #RESUME ifplugin Mail::SpamAssassin::Plugin::MIMEHeader header __JMQ_RESUME1 Subject =~ /resume/i body __JMQ_RESUME2 /hello my name|my name is/i body __JMQ_RESUME3 /appreciate.your.cooperation|my.resume.is.pdf|resume.attach|pdf.file.is|is.my.resume/i mimeheader __JMQ_RESUME4 Content-Type =~ /x-zip-comp/i mimeheader __JMQ_RESUME5 Content-Type =~ /my_resume\.zip/i meta JMQ_RESUME ((__JMQ_RESUME1 + __JMQ_RESUME2 + __JMQ_RESUME3 + __JMQ_RESUME5 >= 3) && __JMQ_RESUME4) score JMQ_RESUME 4.5 describe JMQ_RESUME Spam for bad attached resumes endif #LED/SOLAR LIGHTS header __KAM_LED1 From =~ /light? ?bulb|garage ?light|Sun.?like?.?Bulb|LED.?Sun|flood ?light/i body __KAM_LED2 /(garage|LED Fan) Light|sun-?like|\dx the brightness|security "?must have/i tflags __KAM_LED2 nosubject header __KAM_LED3 Subject =~ /LED Lighting|L\.E\.D\.? Bulb|Innovative Light|energy bill|one bulb|Garage LED|security "?must have/i meta KAM_LED (__KAM_LED1 + __KAM_LED2 + __KAM_LED3 >= 3) describe KAM_LED LED Lighting Spams score KAM_LED 4.5 # REAL ESTATE header __JMQ_REALESTATE1 From =~ /tom.brice/i header __JMQ_REALESTATE2 Subject =~ /real.estate/i body __JMQ_REALESTATE3 /preferred.choice|looking.for.real.estate|online.platform|systems.placement/i meta JMQ_REALESTATE (__JMQ_REALESTATE1 + __JMQ_REALESTATE2 + __JMQ_REALESTATE3 >= 3) describe JMQ_REALESTATE Real estate spam score JMQ_REALESTATE 4.5 # IP IN FROM header JMQ_IPINFROM From =~ /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/ score JMQ_IPINFROM 2.5 describe JMQ_IPINFROM Spam with IP in the from address # IFFY PAYPAL OF THE DAY header __JMQ_PAYPAL2 From =~ /paypai/i meta JMQ_PAYPAL2 (JMQ_IPINFROM + __JMQ_PAYPAL2 >= 2) score JMQ_PAYPAL2 4.5 describe JMQ_PAYPAL2 PayPal spam of the day # RESUME SPAM REDUX PART 2 (WOOHOO) meta JMQ_RESUME3 (__JMQ_RESUME1 && __JMQ_RESUME2 && KAM_THEBAT) score JMQ_RESUME3 3.5 describe JMQ_RESUME3 Yet more resume spam # SPF THAT DOESN'T REALLY CARE IF EMAIL IS A FORGERY - ifplugin Mail::SpamAssassin::Plugin::AskDNS askdns JMQ_SPF_NEUTRAL _SENDERDOMAIN_ TXT /^v=spf1 .*\?all/ describe JMQ_SPF_NEUTRAL SPF set to ?all score JMQ_SPF_NEUTRAL 0.5 tflags JMQ_SPF_NEUTRAL net askdns JMQ_SPF_ALL _SENDERDOMAIN_ TXT /^v=spf1 .*\+all/ describe JMQ_SPF_ALL SPF set to +all! score JMQ_SPF_ALL 0.5 tflags JMQ_SPF_ALL net endif # IMPORTANT MESSAGE header __JMQ_IMPORTANT1 Subject =~ /(fw|re):? important/i body __JMQ_IMPORTANT2 /important message/i body __JMQ_IMPORTANT3 /please visit/i meta JMQ_IMPORTANT (__JMQ_IMPORTANT1 + __JMQ_IMPORTANT2 + __JMQ_IMPORTANT3 + KAM_LAZY_DOMAIN_SECURITY >= 4) score JMQ_IMPORTANT 4.5 describe JMQ_IMPORTANT Spam that thinks it is important # IMAGE TRACKERS uri __JMQ_TRACKER1 /sidekickopen\d*\.com/i meta JMQ_TRACKER (__JMQ_TRACKER1 >= 1) score JMQ_TRACKER 0.5 describe JMQ_TRACKER Message uses image-based tracker # WIRE TRANSFERS header __JMQ_WIRE1 Subject =~ /wire.*fund|request.*wire|(fwd|re): request/i body __JMQ_WIRE2 /medical.support|payment.sent/i body __JMQ_WIRE3 /bank.wire|sent.out.asap/i meta JMQ_WIRE (__JMQ_WIRE1 + __JMQ_WIRE2 + __JMQ_WIRE3 + (LOTS_OF_MONEY || KAM_LAZY_DOMAIN_SECURITY || HEADER_FROM_DIFFERENT_DOMAINS) >= 3) score JMQ_WIRE 4.5 describe JMQ_WIRE Attempt to steal money via wire transfer #bindata code in RTF #rawbody __KAM_BADRTF1 /<w:binData/ #rawbody __KAM_BADRTF2 /QWN0aXZlTWltZQ/ #meta KAM_BADRTF (__KAM_BADRTF1 + __KAM_BADRTF2 >= 2) #describe KAM_BADRTF Message contains binary data in RTF format #score KAM_BADRTF 5.0 #Fake Order body __KAM_ORDER1 /Please find document attached/i header __KAM_ORDER2 Subject =~ /Order \d+ (\(Acknowledgement\))?/i meta KAM_ORDER __KAM_ORDER1 + __KAM_ORDER2 + __BODY_LE_200 >= 3 score KAM_ORDER 3.0 describe KAM_ORDER Fraudulent Order Emails rawbody __RB_LE_200 /^.{2,200}$/s tflags __RB_LE_200 multiple maxhits=2 rawbody __RB_GT_200 /^.{201}/s meta __BODY_LE_200 (__RB_LE_200 == 1) && !__RB_GT_200 #SHOCKING BEVERAGE body __KAM_SHOCK1 /shocking.beverage/i header __KAM_SHOCK2 Subject =~ /(Bill O.Reilly|Donald Trump)/i body __KAM_SHOCK3 /drinking this beverage/i meta KAM_SHOCK __KAM_SHOCK1 + __KAM_SHOCK2 + __KAM_SHOCK3 >= 2 score KAM_SHOCK 4.0 describe KAM_SHOCK Spams with energy drinks #BEAUTY SCAM body __KAM_BEAUTY1 /she now looks \d+/i body __KAM_BEAUTY2 /reveals exactly/i body __KAM_BEAUTY3 /most amazing transformation/i header __KAM_BEAUTY4 Subject =~ /now looks \d+/i meta KAM_BEAUTY __KAM_BEAUTY1 + __KAM_BEAUTY2 + __KAM_BEAUTY3 + __KAM_BEAUTY4 >= 3 score KAM_BEAUTY 4.0 describe KAM_BEAUTY Youth and Beauty Product Scams #WEED body __KAM_WEED1 /legal.weed|jim kramer|kevin james/i header __KAM_WEED2 Subject =~ /Legal.Weed|pot.stock/i body __KAM_WEED3 /doubled? (there|their) money|Triple this afternoon/i body __KAM_WEED4 /(weed|pot).stock/i meta KAM_WEED __KAM_WEED1 + __KAM_WEED2 + __KAM_WEED3 + __KAM_WEED4 >= 3 score KAM_WEED 8.0 describe KAM_WEED Legal Weed and related investment scams #LOGOS body __KAM_LOGO1 /guru.level logo/i header __KAM_LOGO2 Subject =~ /guru.level logo/i body __KAM_LOGO3 /(guru.level|ready.made) logo/i meta KAM_LOGO __KAM_LOGO1 + __KAM_LOGO2 + __KAM_LOGO3 >= 3 score KAM_LOGO 5.25 describe KAM_LOGO Logo Spam #TRUMP COIN body __KAM_TRUMPCOIN1 /Donald Trump/i header __KAM_TRUMPCOIN2 Subject =~ /trump.coin/i body __KAM_TRUMPCOIN3 /special colored coin/i meta KAM_TRUMPCOIN __KAM_TRUMPCOIN1 + __KAM_TRUMPCOIN2 + __KAM_TRUMPCOIN3 >= 3 score KAM_TRUMPCOIN 5.25 describe KAM_TRUMPCOIN Trump Coin Spam #WATER body __KAM_WATER1 /Never Drink Water/i header __KAM_WATER2 Subject =~ /bottled water/i body __KAM_WATER3 /filtered tap water/i meta KAM_WATER __KAM_WATER1 + __KAM_WATER2 + __KAM_WATER3 >= 3 score KAM_WATER 5.25 describe KAM_WATER Water Poison Scam #BANK body __KAM_RUIN1 /do not deposit/i header __KAM_RUIN2 Subject =~ /money into your bank/i body __KAM_RUIN3 /banking institutions/i meta KAM_RUIN __KAM_RUIN1 + __KAM_RUIN2 + __KAM_RUIN3 >= 3 score KAM_RUIN 5.25 describe KAM_RUIN Bank Phishing Scam #WEIGHT body __KAM_WEIGHT2_1 /goodbye to her waist|wild transformation|researcher has just discovered|weight loss is wrong/i tflags __KAM_WEIGHT2_1 nosubject header __KAM_WEIGHT2_2 Subject =~ /looks \d+ overnight|no gym|fat hack|doctor shocked/i body __KAM_WEIGHT2_3 /melissa mccarthy|now looks \d+|lbs every \d+ hour|(pound|lb)s in \d+ days|melts pounds/i header __KAM_WEIGHT2_4 From:name =~ /eat this seed|flat.?belly|big.?stomach/i meta KAM_WEIGHT2 __KAM_WEIGHT2_1 + __KAM_WEIGHT2_2 + __KAM_WEIGHT2_3 + __KAM_WEIGHT2_4 >= 3 score KAM_WEIGHT2 5.25 describe KAM_WEIGHT2 Weight loss process du jour #AMAZING LENS body __KAM_LENS1 /pro quality (pho|pic)|Bill gates|best camera/i header __KAM_LENS2 Subject =~ /(amazing|incredible) photos|gadget of the year|coolest product|camera/i body __KAM_LENS3 /amazing lens|hdx-lens|hdrx/i header __KAM_LENS4 From =~ /hdcam|lens|inhd/i meta KAM_LENS __KAM_LENS1 + __KAM_LENS2 + __KAM_LENS3 + __KAM_LENS4 >= 3 score KAM_LENS 5.25 describe KAM_LENS Amazing Lens Scam #HONOR body __KAM_HONOR1 /greatest thing of your life/i header __KAM_HONOR2 Subject =~ /Congrats, on the honor/i body __KAM_HONOR3 /profession women/i body __KAM_HONOR4 /invitation/i meta KAM_HONOR __KAM_HONOR1 + __KAM_HONOR2 + __KAM_HONOR3 + __KAM_HONOR4 >= 3 score KAM_HONOR 6.25 describe KAM_HONOR Professional Network Scam #Rule Dev #Idea from John Hardin so you can see all URI's - ONLY for rule development - Then all the detected URIs appear in the rule hits debug output. #uri __ALL_URI /.*/ #tflags __ALL_URI multiple #Bad UTF-8 content type and transfer encoding - Thanks to Pedro David Marco for alerting to issue header __KAM_BAD_UTF8_1 Content-Type =~ /text\/html; charset=\"utf-8\"/i header __KAM_BAD_UTF8_2 Content-Transfer-Encoding =~ /base64/i full __RW_BAD_UTF8_3 /^(?:[^\n]|\n(?!\n))*\nContent-Transfer-Encoding:\s+base64(?:[^\n]|\n(?!\n))*\n\n[\s\n]{0,300}[^\s\n].{0,300}[^a-z0-9+\/=\n][^\s\n]/si meta KAM_BAD_UTF8 (__KAM_BAD_UTF8_1 + __KAM_BAD_UTF8_2 + __RW_BAD_UTF8_3 >= 3) score KAM_BAD_UTF8 14.0 describe KAM_BAD_UTF8 Bad Content Type and Transfer Encoding that attempts to evade SA scanning #DEATH body __KAM_DEATH1 /prevent early.death/i header __KAM_DEATH2 Subject =~ /(early|unexpected).death/i body __KAM_DEATH3 /Eating this|before it.?s too late/i body __KAM_DEATH4 /heart.(attack|stops)/i meta KAM_DEATH __KAM_DEATH1 + __KAM_DEATH2 + __KAM_DEATH3 + __KAM_DEATH4 >= 4 score KAM_DEATH 6.25 describe KAM_DEATH Supplement Scam #REWARD body __KAM_REWARD1 /walgreens|ikea|sephora|sams.?club/i header __KAM_REWARD2 Subject =~ /weekend.*reward|reward.*weekend|(reward|perk).{0,60}(expiring|ending)/i header __KAM_REWARD3 Subject =~ /(Cert|coup|ending now|ending|expiring|expiring.now)(..)?(\d+|\[num)/i header __KAM_REWARD4 From =~ /ikea|sephora|shopper|walgreen|sale/i meta KAM_REWARD __KAM_REWARD1 + __KAM_REWARD2 + __KAM_REWARD3 + __KAM_REWARD4 + KAM_NUMSUBJECT >= 4 score KAM_REWARD 5.25 describe KAM_REWARD Coupon Scam #PACKAGE body __KAM_PACKAGE1 /dysfunction|\dx longer/i body __KAM_PACKAGE2 /sexual.performance|longer.in.bed/i header __KAM_PACKAGE3 Subject =~ /sex/i header __KAM_PACKAGE4 From =~ /function|fivex/i meta KAM_PACKAGE __KAM_PACKAGE1 + __KAM_PACKAGE2 + __KAM_PACKAGE3 + __KAM_PACKAGE4 >= 3 score KAM_PACKAGE 4.25 describe KAM_PACKAGE Sexual Enhancement Scam #NUM header __KAM_NUMSUBJECT Subject =~ /(?<!day)\s\d+$/i header __KAM_SUBJECTYEAR Subject =~ /20[1-2][0-9]$/ meta KAM_NUMSUBJECT (__KAM_NUMSUBJECT >=1 && __KAM_SUBJECTYEAR <= 0) score KAM_NUMSUBJECT 0.5 describe KAM_NUMSUBJECT Subject ends in numbers excluding current years ifplugin Mail::SpamAssassin::Plugin::MIMEHeader #BAD PDF mimeheader KAM_MGCS Content-Type =~ /\+\-\+\-\+\-MGCS\-\+\-\+\-\+|[\xC2\xB7]pdf(?=)?"$/i score KAM_MGCS 10.0 describe KAM_MGCS Boundary Content Indicative of Ratware endif #NetWeaver - Disabled 7/24 #header KAM_NW X-Mailer =~ /SAP NetWeaver/i #score KAM_NW 2.75 #describe KAM_NW Spam Indicator #STOCKTIP OBFU body __KAM_STOCKOBFU1 /make up the \d letter symbol/i body __KAM_STOCKOBFU2 /first letter/i header __KAM_STOCKOBFU3 Subject =~ /less than \d days|ten bagger|ten ?fold your principle/i meta KAM_STOCKOBFU (__KAM_STOCKOBFU1 + __KAM_STOCKOBFU2 + __KAM_STOCKOBFU3 >= 3) describe KAM_STOCKOBFU Stock Spam Tips that are being sneaky score KAM_STOCKOBFU 4.5 #FAKE BBB/FLSA NOTICES header __KAM_FAKEBBB1 Subject =~ /(incident:|case:)?[\d:;]{5}/i body __KAM_FAKEBBB2 /(Fair Labor Standards Act|Safety and Health act|Better Business Bureau|(\b|$)BBB(\b|^))/i body __KAM_FAKEBBB3 /(complaint|compliant|Abuse) ID/i body __KAM_FAKEBBB4 /(incident:|case:)[\d:;]{6,}/i meta KAM_FAKEBBB (__KAM_FAKEBBB1 + __KAM_FAKEBBB2 + KAM_SHORT + __KAM_FAKEBBB3 + __KAM_FAKEBBB4>= 4) describe KAM_FAKEBBB Fake Notices for Various Business Violations score KAM_FAKEBBB 12.0 #HOWRU #header __KAM_HOWRU1 Subject =~ /How are you?|Hi|What's Up|Hey, Sweety/i body __KAM_HOWRU2 /My name is|what's your name|ask your name|keep company with you/i body __KAM_HOWRU3 /visit the site|visit this site|visiting this website|have some social networks|meet you in private|write me tomorrow/i body __KAM_HOWRU4 /gmx.com|rambler.ru/i meta KAM_HOWRU (__KB_WAM_SUBJECT_HELLO_ONLY + __KAM_HOWRU2 + __KAM_HOWRU3 + __KAM_HOWRU4 >=4) describe KAM_HOWRU Female Chat Scam score KAM_HOWRU 8.0 # 2017-11-01, note 56146 body __KAM_DOMAIN_SALE1 /\b(related|similar) domain\b/i body __KAM_DOMAIN_SALE2 /\b(interested in|obtaining) .{5,20} domain\b/i body __KAM_DOMAIN_SALE3 /\bdomain (name owner|advanced avail|backordering)\b/i body __KAM_DOMAIN_SALE4 /\b(domain you might be interested|interested in the domain|interested in obtain|benefit acquiring|complete ownership transfer|brokering the domain)\b/i body __KAM_INTRUDE /\b(hope I am not intruding|out of the blue|I will never contact you again if you go here)\b/i meta KAM_DOMAIN_SALE_2 (__KAM_DOMAIN_SALE1 + __KAM_DOMAIN_SALE2 + __KAM_DOMAIN_SALE3 + __KAM_DOMAIN_SALE4 >=2) meta KAM_DOMAIN_SALE_3 (__KAM_DOMAIN_SALE1 + __KAM_DOMAIN_SALE2 + __KAM_DOMAIN_SALE3 + __KAM_DOMAIN_SALE4 >=3) score KAM_DOMAIN_SALE_2 3.0 score KAM_DOMAIN_SALE_3 1.0 meta KAM_DOMAIN_SALE_INTRUDE (__KAM_INTRUDE && KAM_DOMAIN_SALE_2) score KAM_DOMAIN_SALE_INTRUDE 1.0 describe KAM_DOMAIN_SALE_2 Domain Selling Spam describe KAM_DOMAIN_SALE_3 Domain Selling Spam describe KAM_DOMAIN_SALE_INTRUDE Domain Selling Spam # 2017-11-08, lonely russian women Whack-A-Mole # Likely Overlap with HOWRU rules, similar target. No real-life # overlap in rules hit observed so far, KB_WAM_OVERLAP to look out for # it. header __KB_WAM_FROM_NAME_SINGLEWORD From:name =~ /^[a-z]+$/i header __KAM_SUBJECT_SINGLEWORD Subject =~ /^[a-z]+$/i header __KB_WAM_SUBJECT_HELLO_ONLY Subject =~ /^(hi|hi there|hello|hey|yo|how are you|What's Up|Hey, Sweety)[?!\.]?$/i meta KB_WAM_LONELY_WOMEN (__KB_WAM_FROM_NAME_SINGLEWORD + __KB_WAM_SUBJECT_HELLO_ONLY + __KAM_HOWRU4 + (__KAM_HOWRU2 || __KB_WAM_LONELY_WOMEN_PHRASE_01) >= 4) score KB_WAM_LONELY_WOMEN 5.0 describe KB_WAM_LONELY_WOMEN Lonely Women Scam of the Day body __KB_WAM_LONELY_WOMEN_PHRASE_01 /\b(I am missing you all the time|I am waiting for your answer|I send you my tender love|I would really like to know you|quest of love|I am lonely and tired)\b/i #meta KB_WAM_OVERLAP ( KAM_HOWRU && KB_WAM_LONELY_WOMEN ) #score KB_WAM_OVERLAP -0.01 #describe KB_WAM_OVERLAP Rule to test for overlap with another similar ruleset #MAILSPLOIT CONTROL CHARACTER - Thanks to Jan-Pieter Cornet for the idea #All Control chars like NUL except \n which should exist once legitimately #Investigating double-byte language FP. Reverting back to just \0 #header __KAM_MAILSPLOIT1 From =~ /[\x00-\x09\x0b-\x1f]/ header __KAM_MAILSPLOIT1 From =~ /[\0]/ describe __KAM_MAILSPLOIT1 RFC2047 Exploit https://www.mailsploit.com/index #\n Multiple in the From Header header __KAM_MAILSPLOIT2 From =~ /[\n]/ describe __KAM_MAILSPLOIT2 RFC2047 Exploit https://www.mailsploit.com/index tflags __KAM_MAILSPLOIT2 multiple maxhits=2 meta KAM_MAILSPLOIT (__KAM_MAILSPLOIT1 || (__KAM_MAILSPLOIT2 >= 2)) describe KAM_MAILSPLOIT Mail triggers known exploits per mailsploit.com score KAM_MAILSPLOIT 10.0 #cc in From - Thanks to Dave Jones for idea header KAM_CCFROM1 From =~ /\b(to|cc|bcc|from):/i describe KAM_CCFROM1 Addition of cc: and similar as a phishing tactic score KAM_CCFROM1 5.0 #MailBox Verify Phish - Also See KAM_MAILBOX header __KAM_BOXWARNING_SUBJECT Subject =~ /FINAL WARNING/i header __KAM_BOXVERIFICATION_SUBJECT Subject =~ /VERIFICATION.{4,20}MAIL.?BOX/i body __KAM_BOXVERIFY /Verify.{0,10}Mail.?box|retrieve messages/i body __KAM_BOXQUOTA /mailbox.{0,5}exceeded.{4,14}quota|low email storage/i header __KAM_MAILBOXFROM From =~ /mailbox/i meta KAM_BOXPHISH ((__KAM_BOXWARNING_SUBJECT + __KAM_BOXVERIFICATION_SUBJECT >= 1) + __UPGR_MAILBOX + __KAM_MAILBOXFROM + __KAM_BOXVERIFY + __KAM_BOXQUOTA + __KAM_MAILBOX1 >= 4) describe KAM_BOXPHISH Mailbox verification phishing scams score KAM_BOXPHISH 6.5 #SWISSCOIN, ETC. body __KAM_CRYPTO1 /swiss.?coin|[{(]SIC[)}]/i header __KAM_CRYPTO2 Subject =~ /forget about bitcoin|crypto (currency|coin) .{0,10}could (turn|go)/i meta KAM_CRYPTO (__KAM_CRYPTO1 + __KAM_CRYPTO2 >= 2) describe KAM_CRYPTO Crypto Currency Spam Du Jour score KAM_CRYPTO 8.0 #COMPROMISED CMS - Thanks to Jing Shan for the idea uri __KAM_CMS1 /VALIDATE\/mail\.htm/i uri __KAM_CMS2 /\/erroreng\/erroreng\//i uri __KAM_CMS3 /twentythirteen\/Upgrade\/?email=/i meta KAM_CMS (__KAM_CMS1 + __KAM_CMS2 + __KAM_CMS3) >= 1 describe KAM_CMS Indicators that a CMS has been exploited for Spammers score KAM_CMS 1.0 #WESTERN UNION SCANS header __KAM_WU1 from:addr !~ /\@westernunion\.com/i header __KAM_WU2 Subject =~ /WUMT|Western.?Union/i uri __KAM_WU3 /western.umt/i meta KAM_WU (__KAM_WU1 + __KAM_WU2 + __KAM_WU3 + LOTS_OF_MONEY >= 3) describe KAM_WU Western Union Scam score KAM_WU 5.0 #WEB CRIMINALS ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_rules __KAM_CRIM1 __KAM_CRIM2 __KAM_CRIM3 __KAM_CRIM4 __KAM_CRIM5 __KAM_CRIM6 __KAM_CRIM7 body __KAM_CRIM1 /(group|team) of (hackers|web criminals)|(erase|eliminate|destroy|delete) (the|this) (compromising|promising)? ?(videotape|evidence|evidence)|(visit|complain to|call to) (the )?(cops|police)|m<A1>lw<A1>r<E1> <O1>n th<E1> w<E1>b|footage of you|you do not know who I am|mercenary|hack phones|(monitored|infected) your device|double.screen video|keylogger|ruin your life|collection officer|turned on your c<A1>mera|cameras? and a mic|I am a hacker|brows(er|ing) history|trojan virus|automatically infect|inject some code|google translator|<P1>l<A1><C1><E1>d (a )?m<A1>lw<A1>r<E1>|<S1><P1><Y1><W1><A1><R1><E1>|hacked y<O1>ur (website|OS|operating)|got hacked|hidden app|managed to hack|thr(u|ough) (ur|your) web.?cam|broke\s+into\s+your\s+system|infected your system|data security hack|hide (yo)?ur web.?camera|device was infected|i recorded you|gained access to your device|I know a\s?lot about you|installed it on all your devices|<Y1>our s<Y1>stem was breached|<I1>n<S1>t<A1>lled a troj<A1><N1>/i #Bitcoin / Etc. body __KAM_CRIM2 /(<B1><I1><T1>\-?<C1><O1><I1><N1>|(\b|^)(BTC|DSH|LTC)(\b|$)|cryptocurrency|\b(?<!=)([13][a-km-zA-HJ-NP-Z1-9]{25,34}|bc1[acdefghjklmnpqrstuvwxyz234567890]{30,62})\b)|(remove|manually) (any|all) spaces|contains spaces|Litecoin|shoprite|instant money/i #Payment body __KAM_CRIM3 /make (<T1>he|a) paymen<T1>|deliver dispatch|have to pay|finish a transaction|transfer me \d+ euro|use my bitcoin|BTC (wallet|cryptocurrency|address)|bit<C1><O1><I1>n w<A1>ll|(m<A1>k<I1>ng|<C1><O1>mpl<E1>et<E1>) th<E1> tr<A1>ns<A1><C1>t<I1><O1>n|send me \d+ dollars|send [\d\.]+ USD|addr<E1>ss f<O1>r p<A1>ym<E1>nt|(dollars|euros) (worth )?in bit-?coin|wallet number|bitcoin network|BTC to this Bitcoin|paym<E1>nt by b<I1>tco<I1>n|\d\d\d usd|DSH\)? address|Address part|<D1><O1><N1><A1><T1><I1><O1><N1>|negotiation|USD.? in bitcoin|transfer\s+me\s+\d+|\d+ in bitcoins|receive the compensation|talking price|reputation will be ruin|buy bitcoin \(BTC\) here|your Bitcoin QR code|Transfer \$\d+ in Bitcoin|\$\d+ tr<A1><N1><S1>f<E1>r to <M1><Y1> w<A1>llet|send \$?\d+ dollars to my (L|B)TC/i #Sexually explicit body __KAM_CRIM4 /erotica|<P1><O1><R1><N1>|p(ro|or)nographic movie|promising evidence|<M1><A1><S1><T1><U1><R1><B1><A1><T1>|playing with yourself|wanking|l<I1>f<E1> <C1><A1>n b<E1> ru<I1>n<E1>d|explosi|lead azide|hexogen|banana|perversion|secured \d+ video|passion for jerk|creepy addiction|wank off|site for adult|spy on you over your cam|pleasuring yourself|adult site|jerking off|mature content|explicit material|intimate footage|highly controversial video/i #TIME body __KAM_CRIM5 /(twenty.?four|24).?h<O1>urs|(72|24|32|30|12) ?h\. (since|from) (now|this moment)|one day after opening|tracking pixel|(24|32|30|12) ?h(<O1>urs)? <A1>ft<E1>r y<O1><U> <O1>p<E1>n|hours for payment|days?\)? to (send|perform|make|transfer) the (amount|payment|dash|fund)|short-term support|48h plz|deadline|hours *(only )?to send the (pay|fund)|address immediately|tr<A1>nsfer the (amount|funds)|get back to me now|\d\s+working\s+days|make payment within \d+ day|indicated da(y|te)|\d hours from this moment|\d hours (yo)?ur contacts|not more than \d+ days?|\d hours to make a pay|you have \d+ hour|give you \d+ hours.{0,20} to pay|have one day to sort this out|crucial you respond swiftly|time is almost up|within \d+ hours|Second option is to pay|one day to sort this out/i #Subject header __KAM_CRIM6 Subject =~ /remember.the.lesson|reputation.is.at.stake|we can be silent|very interesting content|compromising video|hide your camera|Y<O1><U> <A1>r<E1> my v<I1><C1>t<I1>m|visit the police|hi. vi<C1>tim|bomb|rescue|your building|<M1>asturbat|hi perv|(site|account) has been (compromised|hacked)|(final|last) warning|dirty little secret|bad news|central intelligence|pervert|hackers|access to your account|your hobby|video of you|<P1>orn|(share|forward|leak) (your|the) video|Read me now|want to read this|i have you|exfiltrated|everybody will know|check the information|Regarding you |suspected harmful activit|account is hacked|data is stolen/i header __KAM_NOT_CRIM6 Subject =~ /Bomb.?cyclone/i #From header __KAM_CRIM7 From =~ /h<A1>ck<E1>r|know/i meta KAM_CRIM (__KAM_CRIM1 + __KAM_CRIM2 + __KAM_CRIM3 + __KAM_CRIM4 + __KAM_CRIM5 + (__KAM_CRIM6 && ! __KAM_NOT_CRIM6) + __KAM_CRIM7 + FUZZY_BITCOIN >= 4) describe KAM_CRIM Extortion Email score KAM_CRIM 8.5 endif #KAM_CRIM_V2 body __KAM_CRIM2_1 /bit.{0,2}coin/i body __KAM_CRIM2_2 /address\:/i body __KAM_CRIM2_3 /adult.{0,2}video|sex.{0,2}sites|site for adult/is meta KAM_CRIM2 (__KAM_CRIM2_1 + __KAM_CRIM2_2 + __KAM_CRIM2_3 + HTML_FONT_LOW_CONTRAST >= 4) describe KAM_CRIM2 Extortion Email score KAM_CRIM2 7.5 #ZWNJ - Zero Width Null Joiner #ZWNJ 200C 157 https://en.wikipedia.org/wiki/Windows-1256 # Also want to look at Unicode U+200C. # Also 'zero-width joiner' which is Windows-1256 0x9E and Unicode U+200D. $a # Per RW, switching for this to work with 'normalize_charset 1', \x9d needs to be replaced with (?:\x9d|\xe2\x80\x8c) ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __KAM_ZWNJ1 Content-Type =~ /charset.+windows-1256/i endif body __KAM_ZWNJ2 /(?:\x9D|\xe2\x80\x8c)/ tflags __KAM_ZWNJ2 multiple maxhits=16 body __KAM_ZWNJ3 /\&\#x200B;/i describe KAM_ZWNJ Use of zero width null characters indicates a goal to elude scanners meta KAM_ZWNJ (__KAM_ZWNJ1 + (__KAM_ZWNJ2 >= 16) >= 2) describe KAM_ZWNJ Use of null characters indicates a goal to elude scanners score KAM_ZWNJ 2.5 #LOWERED FROM 5.25 describe KAM_ZWNJBAD Attempted & failed Use of zero-width characters indicates a goal to elude scanners meta KAM_ZWNJBAD (__KAM_ZWNJ3 >=1) score KAM_ZWNJBAD 1.25 #LOWERED FROM 2.0 #ZWNS - Zero Width Non-Breaking Space body __KAM_ZWNS1 /\xef\xbb\xbf/ tflags __KAM_ZWNS1 multiple maxhits=16 meta KAM_ZWNS ( __KAM_ZWNS1 >= 16 ) describe KAM_ZWNS Use of zero width space characters indicates a goal to elude scanners score KAM_ZWNS 1.25 #LOWERED FROM 2.5 #GIRLS body __KAM_GIRLS1 /Lack of sex/i meta KAM_GIRLS ( __SINGLE_WORD_SUBJ + __KAM_GIRLS1 >= 2) describe KAM_GIRLS Girl Chat Scam du Jour score KAM_GIRLS 7.0 #SKINCELL PRO Spam Du Jour body __KAM_SKINCELL1 /Skincell.Pro/i header __KAM_SKINCELL2 Subject =~ /Skincell.Pro/i meta KAM_SKINCELL (__KAM_SKINCELL1 + __KAM_SKINCELL2 >= 1) describe KAM_SKINCELL Skincare Scam du Jour score KAM_SKINCELL 7.0 #UK INVOICE - Thanks to Andy Smith for his help on this uri __KAM_UKINV1 /\/(client|share|documentview)$/i body __KAM_UKINV2 /View (and pay )?(scan|invoice)/i body __KAM_UKINV3 /INV-\d+|Check out what .{4,30} shared with you/i body __KAM_UKINV4 /£/i header __KAM_UKINV5 Subject =~ /(invoice INV-\d+|wants to share scan)/i header __KAM_UKINV6 Subject =~ /invoice/i meta KAM_UKINV (__KAM_UKINV1 + __KAM_UKINV2 + __KAM_UKINV3 + __KAM_UKINV4 + __KAM_UKINV5 >= 4) || (__KAM_UKINV1 + __KAM_UKINV2 + __KAM_UKINV3 + __KAM_UKINV4 + __KAM_UKINV6 + HTML_TITLE_SUBJ_DIFF && HTML_OBFUSCATE_10_20 >= 6) describe KAM_UKINV Fake Invoice/Scan Scams score KAM_UKINV 5.5 #LIST SELLERS body __KAM_LISTSALE1 /interested in acquiring/i body __KAM_LISTSALE2 /contact list|list of customers|list of decision makers|list for marketing/i body __KAM_LISTSALE3 /share counts and samples|send focused campaigns|compiled a dataset/i header __KAM_LISTSALE4 Subject =~ /users|leads/i header __KAM_LISTSALE5 From =~ /leads/i meta KAM_LISTSALE (__KAM_LISTSALE1 + __KAM_LISTSALE2 + __KAM_LISTSALE3 >=2) && (__KAM_LISTSALE4 + __KAM_LISTSALE5 >= 1) describe KAM_LISTSALE List sellers score KAM_LISTSALE 5.0 #Google Short? uri KAM_GOOGLESHORT /\/www.google.com\/url\?q=.{4,16}bit\.ly/i describe KAM_GOOGLESHORT Obfuscated links using Google and URL Shorteners score KAM_GOOGLESHORT 9.0 #HEART ATTACK SPAM body __KAM_HEARTPROD1 /heart ?attack/i body __KAM_HEARTPROD2 /enzyme/i header __KAM_HEARTPROD3 Subject =~ /heart attack|healthy.{4,10}cells/i header __KAM_HEARTPROD4 From =~ /clear 7/i meta KAM_HEARTPROD (__KAM_HEARTPROD1 + __KAM_HEARTPROD2 + __KAM_HEARTPROD3 + __KAM_HEARTPROD4 >= 4) describe KAM_HEARTPROD Snake Oil Heart Health du Jour score KAM_HEARTPROD 7.0 # LINES FULL OF SHORT WORDS. SCC='SOLID CLUES CONSULTING'=BILL COLE # NOTE: Some languages and people using things like ZWNJ repeatedly will cause FPs for this rule. # This rule disabled in deadweight anyway! describe __SCC_SHORT_WORDS A line with lots of short words body __SCC_SHORT_WORDS /\W(\D\w{1,3}\W{1,3}){11}/ tflags __SCC_SHORT_WORDS multiple maxhits=40 describe SCC_5_SHORT_WORD_LINES 5 lines with many short words meta SCC_5_SHORT_WORD_LINES __SCC_SHORT_WORDS >= 5 describe SCC_10_SHORT_WORD_LINES 10 lines with many short words meta SCC_10_SHORT_WORD_LINES __SCC_SHORT_WORDS >= 10 describe SCC_20_SHORT_WORD_LINES 20 lines with many short words meta SCC_20_SHORT_WORD_LINES __SCC_SHORT_WORDS >= 20 describe SCC_35_SHORT_WORD_LINES 35 lines with many short words meta SCC_35_SHORT_WORD_LINES __SCC_SHORT_WORDS >= 35 # Redefine WORD_INVIS_MANY to get rid of FPs meta WORD_INVIS_MANY ( __WORD_INVIS_2 && ! __BODY_TEXT_LINE ) # A pattern seen in subscription-bombings describe SCC_SUBBOMB_SUBJ_1 An unusual string pattern seen in subscription bombing subjects header SCC_SUBBOMB_SUBJ_1 Subject =~ /[sxz][vwz]usa[fly]me[a-z0-9]{7}GP/ score SCC_SUBBOMB_SUBJ_1 5 # cPanel Phishing header __SCC_HELO_CPANELNET X-Spam-Relays-Untrusted =~ / helo=cpanel\.net / describe __SCC_HELO_CPANELNET HELO is bare cpanel.net meta SCC_FAKE_CPANEL __SCC_HELO_CPANELNET && ! (SPF_PASS || SPF_HELO_PASS) score SCC_FAKE_CPANEL 6 header KAM_PHISHCP From =~ /\@cpanel\d+\.com/i describe KAM_PHISHCP Fraudulent notices purporting to be from cPanel score KAM_PHISHCP 15.0 uri KAM_PHISHCP2 /(\.|\/)cpanel\d+\.com(\/|\b|\?)/i describe KAM_PHISHCP2 Fraudulent notices purporting to be from cPanel score KAM_PHISHCP2 15.0 body __KAM_PHISHCP3_1 /cPanel Cloud Service/ meta KAM_PHISHCP3 (KAM_SHORT + __KAM_PHISHCP3_1 >=2) describe KAM_PHISHCP3 Fraudulent notices purporting to be from cPanel score KAM_PHISHCP3 15.0 uri __KAM_PHISHCP4_1 /defender\.php/i meta KAM_PHISHCP4 ((KAM_MAILBOX + KAM_MAILBOX2 >= 1) + __KAM_PHISHCP4_1 >= 2) describe KAM_PHISHCP4 Fraudulent cPanel Notices score KAM_PHISHCP4 15.0 #https://www.csoonline.com/article/3333916/windows-security/i-can-get-and-crack-your-password-hashes-from-email.html?upd=1547922397157 body KAM_FILE /file:\/\/\/\//i describe KAM_FILE Potential attempt for NTLM attack score KAM_FILE 4.5 #FUN SPAM RUN header __KAM_FUN1 From =~ /\.fun|\.icu|\.pro|\.stream|\.world|\.monster|\.best|\.store|\.surf|\.rest|\.bar|\.asia|\.casa|\.uno|\.london|\.info|\.cam|\.work|\.cyou|\.quest>?$/i header __KAM_FUN1A From:name =~ /Bite Pro|Diabetes|Blood Sugar|Sugar Disease|Fish Oil|ultra ?boost|Gutter|time ?share|Affiliate|arctic ?blast|splash ?wine|date|fat ?loss|nutrisystem|Silver ?Single|Insta ?Heater|Canvas?Print|LeptiSense|Hello.?Fresh/i body __KAM_FUN2 /Addify Link|Kennett Pike|PetPlan|Newton Sq|1st Avenue|Jones Blvd|permanently opt-out from our all newsletters|(wish|prefer) (to not|not to|to) receive (these|future) (messages|emails)|purehealth|leave any time|too good to be true|try(ing)? this trick|doesn?'t like this update|(click here|wish) +to unsub|send post-mail to|to be removed from receiving|to unsubscribe.+click|no longer like to receive/i body __KAM_FUN3 /This Offer is (only )?for (unite. state|USA)|(can ?not|won\'t|can\'t|unable to) see (the|this)? ?image|visit the page below|Continue Reading|watch now|this is an ad|click here now/i uri __KAM_FUN3A /imgstore.host/i #Subject header __KAM_FUN4 Subject =~ /Gutter|Assisted Living|Refinance|rate|livewave|mortgage|E\.D\.|Single|Superfood|tax|debt|mastercard|safety charge|supplement|pillow|Inogenone|learn a language|Roadside safety|carry a gun|minute survey|roofing Deals|fungus|insurance|pain|gold|hair|knife|warranty|reflexology|accufeet|keto|sound|heartburn|skincare|terminix|zippy|sneeze|healthcare|yoga|heal|jesus|virus|neuropathy|BP med|perfect vision|parasites|wine|willie nelson|InstaFresh|InstaSavings|carriers|CPAP|melt your belly|heart attack|power of plants|immunity|smart.?watch|fever|hearing aids|diabetes|gum problem|bad breath|fish oil|ultra ?boost|boost your internet|christmas list|(energy|cooling) (bill|cost)|time ?share|interstate move|vanishes pain|wine order|chat rooms|\d+ ?lbs|dementia|nutrisystem|personal plan|Printer Ink|america strong|perfect gifts|Someone Special|Insta ?heater|asian girls|audiobooks|memories into art|losing weight|CBD Gum/i #How many/How Soon body __KAM_FUN5 /\d million americans|less than \d{1,32} (weeks|days|hours)|temporary feeling|\d{1,32} ?lbs|[\d+,]{1,32} Asian babes/i #miracle! body __KAM_FUN6 /finds the secret|new discovery|natural medicine|health channel|medicinal plants|simple tweak|doctors are shocked|mysterious liquid|massive mistake|scientifically shown|chronic pain/i #what body __KAM_FUN7 /nerve pain|poor vision|lasik|sleep deeper|smart.?watch|fever|hearing aids|diabetes|gum problem|blood sugar|sugar disease|bad breath|fish oil|ultra ?boost|soothing relief|older women|belly fat|reverse alzheimer|personal safety|gadget.?junk|Insta ?heater|need boyfriends|audiobooks/i tflags __KAM_FUN7 nosubject meta KAM_FUN ((__KAM_FUN1 + __KAM_FUN1A >=1) + __KAM_FUN2 + (__KAM_FUN3 + __KAM_FUN3A >= 1) + __KAM_FUN4 >=3) describe KAM_FUN Spam Engine Hawking Various Goods and Abusing a Lot of Domains score KAM_FUN 7.75 meta KAM_FUN2 ((__KAM_FUN1 + __KAM_FUN1A >= 1) + __KAM_FUN4 + __KAM_FUN5 + __KAM_FUN6 + __KAM_FUN7 >= 5) describe KAM_FUN2 Spam Engine Hawking Various Goods and Abusing a Lot of Domains score KAM_FUN2 7.5 #GOOGLE DRIVE PORN - Thanks to Mark Sapiro for the bug fix uri KAM_DRIVENUM /\d+\.drive\.google.com/i describe KAM_DRIVENUM Drive Links Prevalent in Spam score KAM_DRIVENUM 5.0 #SWIFT PAYMENT SCAMS header __KAM_SWIFT1 Subject =~ /Swift/i body __KAM_SWIFT2 /swift copy/i body __KAM_SWIFT3 /balance payment/i meta KAM_SWIFT (__KAM_SWIFT1 + __KAM_SWIFT2 + __KAM_SWIFT3 >= 3) describe KAM_SWIFT SWIFT payment scam score KAM_SWIFT 3.0 ifplugin Mail::SpamAssassin::Plugin::FromNameSpoof # Custom score score FROMNAME_SPOOFED_EMAIL 0.3 meta GB_FROMNAME_SPOOF_EQUALS_TO (PDS_FROMNAME_SPOOFED_EMAIL && __PLUGIN_FROMNAME_EQUALS_TO) describe GB_FROMNAME_SPOOF_EQUALS_TO From:name is spoof to look like To: address score GB_FROMNAME_SPOOF_EQUALS_TO 0.3 meta GB_FROMNAME_SPOOF_FREEMAIL (FREEMAIL_FROM && PDS_FROMNAME_SPOOFED_EMAIL) describe GB_FROMNAME_SPOOF_FREEMAIL From:name spoof and Freemail From:address score GB_FROMNAME_SPOOF_FREEMAIL 0.4 rawbody __GB_REGEX_BR /{\:REGEX\:\((<br>){1,3}\|(<br>){1,3}/ meta GB_REGEX_BR_SPOOF ( __GB_REGEX_BR && PDS_FROMNAME_SPOOFED_EMAIL && __ANY_TEXT_ATTACH_DOC ) describe GB_REGEX_BR_SPOOF Office document from spoofed email score GB_REGEX_BR_SPOOF 2.0 endif ifplugin Mail::SpamAssassin::Plugin::RaptorOnly header KAM_RAPTOR_ALTERED X-Raptor-Alter =~ /True/i describe KAM_RAPTOR_ALTERED Raptor identified a dangerous, possible zero day attachment risk score KAM_RAPTOR_ALTERED 2.0 header GB_RAPTOR_ZEROSVG X-Raptor-ZeroDay =~ /svg/i describe GB_RAPTOR_ZEROSVG Raptor identified a dangerous, possible zero day SVG attachment score GB_RAPTOR_ZEROSVG 1.0 endif #BAD INVOICE SCAMS header __KAM_PROFORMA1 Subject =~ /Proforma/i body __KAM_PROFORMA2 /no responds/i body __KAM_PROFORMA3 /highly encrypted/i body __KAM_PROFORMA4 /Proforma Invoice/i uri __KAM_PROFORMA5 /\.php/i meta KAM_PROFORMA (__KAM_PROFORMA1 + __KAM_PROFORMA2 + __KAM_PROFORMA3 + __KAM_PROFORMA4 + __KAM_PROFORMA5 >= 5) describe KAM_PROFORMA Invoice scam score KAM_PROFORMA 7.5 #BAD INVOICE SCAMS ifplugin Mail::SpamAssassin::Plugin::MIMEHeader header __KAM_INVOICEPO1 Subject =~ /Invoice copies|EFT +Process|signed +contract|inquiry|PO-\d+|payment receipt/i body __KAM_INVOICEPO2 /invoice copies|EFT PROCESS|contract signed|attached enquiry|see the attached|Company name\:/i tflags __KAM_INVOICEPO2 nosubject meta KAM_INVOICEPO (__KAM_INVOICEPO1 + __KAM_INVOICEPO2 + (KAM_HTMLINVOICE + KAM_HTMLINVOICE2 + T_HTML_ATTACH >= 1) >= 3) describe KAM_INVOICEPO Invoice scam score KAM_INVOICEPO 4.5 mimeheader KAM_HTMLINVOICE Content-Type =~ /(remittance|invoice|contract|order|scan).{0,100}\.(rar|html?)/i describe KAM_HTMLINVOICE Invoice scam score KAM_HTMLINVOICE 3.0 mimeheader KAM_HTMLINVOICE2 Content-Type =~ /(order confirmation|po attachments.{0,100})\.xls\.html/i describe KAM_HTMLINVOICE2 Invoice scam score KAM_HTMLINVOICE2 3.0 endif # Spear phishing rules ifplugin Mail::SpamAssassin::Plugin::FreeMail header __GB_TO_ADDR_FREEMAIL eval:check_freemail_header('To:addr') header __GB_TO_NAME_FREEMAIL eval:check_freemail_header('To:name') meta GB_TO_NAME_FREEMAIL ( !__GB_TO_ADDR_FREEMAIL && __GB_TO_NAME_FREEMAIL ) describe GB_TO_NAME_FREEMAIL Freemail spear phish with free mail score GB_TO_NAME_FREEMAIL 0.01 header __GB_FROM_ADDR_FREEMAIL eval:check_freemail_header('From:addr') header __GB_FROM_NAME_FREEMAIL eval:check_freemail_header('From:name') header __GB_FROM_NAME_EMAIL From:name =~ /\@/ meta GB_FROM_NAME_FREEMAIL ( __GB_FROM_NAME_EMAIL && __GB_FROM_ADDR_FREEMAIL && !__GB_FROM_NAME_FREEMAIL ) describe GB_FROM_NAME_FREEMAIL Freemail spear phish with free mail score GB_FROM_NAME_FREEMAIL 0.01 endif # Disable possible CPU burning rule, reported to SA users list -- 2019-05-29 # FIXED rule distributed via sa-update since 2019-05-31 # meta __STYLE_GIBBERISH_1 0 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL # Allow googleapis.com to be blocklisted due to spam runs in June 2019 exploiting it clear_uridnsbl_skip_domain googleapis.com # Allow t.co to be blocklisted due to spam seem in April 2024 exploiting it clear_uridnsbl_skip_domain t.co endif # Need a favor phishing header __KAM_FAVOR1 Subject =~ /Request|Quick Reply/i body __KAM_FAVOR2 /I need a favor from you|Are you available to work on a request for me today/i body __KAM_FAVOR3 /email me back as soon as possible|send me your personal cell phone number/i meta KAM_FAVOR (__KAM_FAVOR1 + __KAM_FAVOR2 + __KAM_FAVOR3 + FREEMAIL_FROM >= 4) describe KAM_FAVOR Phishing Attempt score KAM_FAVOR 7.5 # WELCOMELIST PCCC/MCGRAIL if can(Mail::SpamAssassin::Conf::feature_welcomelist_blocklist) welcomelist_auth *@pccc.com *@mcgrail.com endif if !can(Mail::SpamAssassin::Conf::feature_welcomelist_blocklist) whitelist_auth *@pccc.com *@mcgrail.com endif #trusted_networks 69.171.29.0/25 #trusted_networks 38.124.232.0/24 # CONTACTS / LISTS header __KAM_LIST3_1 Subject =~ /(accou?nt|Contacts?|buyers?|registrants?|attendees?|B2B|B2C|mailing|industries).(data|list|information)|reach qualified buyers|potential prospects|(potential|reach your) client|(list|lead) prospecting|build customer|(bitdefender|Acronis) Users|reach clients|Clients records|users accounts|Attendees info|marketing opp|(expo|Summit) Leads|Free Samples|email database|sales prospect|(construction|business) +(executives|professionals)|prospects|decision.?makers|(email|lead) list|increase your TAM|Booth.?\#\d+|data that you need|(audience|geography)\?|contact details|professional industry clients|easy contacts of|school districts? contacts|list\-2025|Visitor Profiles|contacts 20\d\d/i #title body __KAM_LIST3_2 /list (consultant|services)|email campaign|global marketing|(event|campaign|success|purchasing) mana?ger|(tradeshow|marketing) (coordinator|campaign|manager|exec|project|team)|(lead|demand) gen|(business|Data|event|research|marketing) (analyst|coordinator)|(potential|professionals?|qualified) lead|(business development|marketing|lead|attendees?|data|prospect|intelligence|event).(executive|consultant|specialist)|(marketing|Business) Co-?ordinator|marketing (\&|and) comm|inside sales|pre-?sales|global leads|data dep(t|artment)|marketing exec|(right|appropriate) person|info solutions|Sales executive|database coordinator|list provider|(leads|business development|BD|Biz.?Dev) manager|cd services|data intelligence specialist/i tflags __KAM_LIST3_2 nosubject #db for sale body __KAM_LIST3_3 /(information|data|list\'s) (count|field)|verified e?-?mail|with email address|counts and pric|decision maker|specific parameters|job titles|Specific lists|each record|post show attendee|(List|contacts|fields) (consists?|Contains?|includes?)|visitors and price|pricing, counts|information about the list|sample (file|record)|direct email|100\% populated|installed users|(compiled|selling) (a )?list|pricing and further|(validated|buy a) dataset|counts, pricing|procure the list|samples for (your )?review|attendees who might|decision.makers|samples and pricing|pricing details|demographics|few (examples|samples)|database (organization|provider)|(cost|expense) (\&|and) count|(samples|counts?) and cost|multichannel marketing|count of email|users of the following|your marketing campaign|\d\d% on emails|acquiring (email|the) list|list of retailers|decision maker mailing list|B2B( data)? list|acquiring email|interested (in )?acquiring|quality lists|potential (client|customer)|database and list management|pricing and count|audience you would like to reach|data cleansing|job titles you wish to contact|leverage competitive intelligence|business contacts? list|verified direct contact numbers|our list comes with|(industry|comprehensive) email list|purchasing the vistor\'?s list/i tflags __KAM_LIST3_3 nosubject #db what body __KAM_LIST3_4 /contacts and email|(visitors?|contacts?|attendee.?s?|users?) (contacts? |mailing )?(list|record|database)|end users|our lists|\d\+? (attendee|contact)|users? database|Opt-in email list|(professionals?|user'?s|attendees?) (contact|list)|not spammer|marketing (analyst|campaigns)|(complete|emailed) list|unique account|contacts\:|titles\:|business profiles|database of|list from USA|(complete|contact) (Name|details|information)|geography|list.database|data (intelligence|include)|emails, phone|marketing list|unlimited usage|target (audience|geograph|attendees|audience|industry)|opt-?in (contact|emails|list)|offices and clinics|specialties\:|showcase our capabilit|share samples|sample file|recently compiled|contact details|targeted (criteria|market)|marketing needs|Users of the following|100\% populated|b2b (mailing list|contact)|targeted business list|data list|(job profile|attendees|counts|list contains|Contacts include)\:|Consumer database|every industry sector|quality email list|email list of|titles? includes?\:|including their names|contacts available\:|curated list|fields? includes?\:|contact validation|opt-in dataset|90% on that list type|enence|Lejeune.?Lawsuits|smart.?timeshare|number of attendees|tester file|list of organi[sz]ation|Mailing list includes/i tflags __KAM_LIST3_4 nosubject meta KAM_LIST3 ( (__KAM_LIST3_1 + __KAM_LIST3_2 + __KAM_LIST3_3 + __KAM_LIST3_4 >= 4) && !EXTRACTTEXT ) describe KAM_LIST3 Mailing List Purveyor Spam score KAM_LIST3 12.25 #NO SUBJ MATCH meta KAM_LIST3_1 ( (KAM_LIST3 < 1) && (__KAM_LIST3_1 + __KAM_LIST3_2 + __KAM_LIST3_3 + __KAM_LIST3_4 >= 3) && !EXTRACTTEXT ) describe KAM_LIST3_1 Likely Mailing List Purveyor Spam score KAM_LIST3_1 3.75 #MONCLER header __KAM_MONCLER1 Subject =~ /moncler/i header __KAM_MONCLER2 From =~ /moncler/i meta KAM_MONCLER (__KAM_MONCLER1 + __KAM_MONCLER2 + KAM_SOMETLD_ARE_BAD_TLD >= 3) describe KAM_MONCLER Fashionista Spammers score KAM_MONCLER 6.0 #ERP header __KAM_ERP1 Subject =~ /ERP/ body __KAM_ERP2 /K9ERP/i meta KAM_ERP (__KAM_ERP1 + __KAM_ERP2 >=2) describe KAM_ERP ERP Spammers score KAM_ERP 4.0 #DMARC POLICY RULES - Thanks to Giovanni Bechis for the original idea plus Jesse Norell and Amir Caspi for additional suggestions & testing! # #https://tools.ietf.org/html/rfc7489 and https://blog.returnpath.com/how-to-explain-dmarc-in-plain-english/ # #"To pass DMARC, a message must pass SPF authentication and SPF alignment and/or DKIM authentication and DKIM alignment. A message will fail DMARC if the message fails both (1) SPF or SPF alignment and (2) DKIM or DKIM alignment." # # We expect edge cases with DKIM where a parent (gateway) domain signing for a subdomain author (e.g., parent.gov signing for sub.parent.gov). This is a common and a sane implementation of DKIM, but is not supported in the current SA DKIM/DMARC implementation -- it results in DKIM_VALID but not DKIM_VALID_AU. The SPF || DKIM logic below will allow this scenario. # # Note: Certain glues like MailScanner will modify an email before testing. That will cause many DKIM failures. If you have a known broken system for DKIM like this, you should likely disable the plugin. #Newer Systems with DMARC Plugin ifplugin Mail::SpamAssassin::Plugin::Dmarc #Override the default scores score DMARC_MISSING 0.1 score DMARC_PASS -0.1 score DMARC_REJECT 0.1 score DMARC_QUAR 0.1 score DMARC_NONE 0.1 ifplugin Mail::SpamAssassin::Plugin::AskDNS ifplugin Mail::SpamAssassin::Plugin::DKIM ifplugin Mail::SpamAssassin::Plugin::SPF askdns __KAM_DMARC_POLICY_NONE _dmarc._AUTHORDOMAIN_ TXT /^v=DMARC1;.*\bp=none;/ askdns __KAM_DMARC_POLICY_QUAR _dmarc._AUTHORDOMAIN_ TXT /^v=DMARC1;.*\bp=quarantine;/ askdns __KAM_DMARC_POLICY_REJECT _dmarc._AUTHORDOMAIN_ TXT /^v=DMARC1;.*\bp=reject;/ askdns __KAM_DMARC_POLICY_DKIM_STRICT _dmarc._AUTHORDOMAIN_ TXT /^v=DMARC1;.*\badkim=s;/ #Checks if either DKIM Passed with Alignment and the policy is strict or VALID and alignment didn't pass meta KAM_DMARC_STATUS !((DKIM_VALID_AU && __KAM_DMARC_POLICY_DKIM_STRICT) || (DKIM_VALID && !__KAM_DMARC_POLICY_DKIM_STRICT)) describe KAM_DMARC_STATUS Test Rule for DKIM or SPF Failure with Strict Alignment score KAM_DMARC_STATUS 0.01 header KAM_DMARC_REJECT eval:check_dmarc_reject() priority KAM_DMARC_REJECT 500 tflags KAM_DMARC_REJECT net reuse KAM_DMARC_REJECT describe KAM_DMARC_REJECT DKIM has Failed or SPF has failed on the message and the domain has a DMARC reject policy score KAM_DMARC_REJECT 7.0 header KAM_DMARC_QUARANTINE eval:check_dmarc_quarantine() priority KAM_DMARC_QUARANTINE 500 tflags KAM_DMARC_QUARANTINE net reuse KAM_DMARC_QUARANTINE describe KAM_DMARC_QUARANTINE DKIM has Failed or SPF has failed on the message and the domain has a DMARC quarantine policy score KAM_DMARC_QUARANTINE 4.0 header KAM_DMARC_NONE eval:check_dmarc_none() priority KAM_DMARC_NONE 500 tflags KAM_DMARC_NONE net reuse KAM_DMARC_NONE describe KAM_DMARC_NONE DKIM has Failed or SPF has failed on the message and the domain has no DMARC policy score KAM_DMARC_NONE 0.25 ifplugin Mail::SpamAssassin::Plugin::RaptorOnly # Add a negative score if email hits Dmarc rules but is truncated # scores must be kept in sync with Dmarc rules meta KAM_DMARC_REJECT_TRUNCATE ( KAM_DMARC_REJECT && DKIM_FAILED_TRUNCATE ) describe KAM_DMARC_REJECT_TRUNCATE Dmarc reject on truncated email priority KAM_DMARC_REJECT_TRUNCATE 500 score KAM_DMARC_REJECT_TRUNCATE -7.0 tflags KAM_DMARC_REJECT_TRUNCATE net nice reuse KAM_DMARC_REJECT_TRUNCATE meta KAM_DMARC_QUARANTINE_TRUNCATE ( KAM_DMARC_QUARANTINE && DKIM_FAILED_TRUNCATE ) describe KAM_DMARC_QUARANTINE_TRUNCATE Dmarc quarantine on truncated email priority KAM_DMARC_QUARANTINE_TRUNCATE 500 score KAM_DMARC_QUARANTINE_TRUNCATE -4.0 tflags KAM_DMARC_QUARANTINE_TRUNCATE net nice reuse KAM_DMARC_QUARANTINE_TRUNCATE meta KAM_DMARC_NONE_TRUNCATE ( KAM_DMARC_NONE && DKIM_FAILED_TRUNCATE ) describe KAM_DMARC_NONE_TRUNCATE Dmarc none on trucated email priority KAM_DMARC_NONE_TRUNCATE 500 score KAM_DMARC_NONE_TRUNCATE -0.25 tflags KAM_DMARC_NONE_TRUNCATE net nice reuse KAM_DMARC_NONE_TRUNCATE header __KAM_FROM_RAPTORSRV From:addr =~ /\@server\d+\.raptoremailsecurity\.com$/i meta KAM_FROM_RAPTOR_DMARCFAIL ( __KAM_FROM_RAPTORSRV && KAM_DMARC_QUARANTINE ) describe KAM_FROM_RAPTOR_DMARCFAIL Email from Raptor servers with DMARC failure score KAM_FROM_RAPTOR_DMARCFAIL 5.0 priority KAM_FROM_RAPTOR_DMARCFAIL 500 tflags KAM_FROM_RAPTOR_DMARCFAIL net endif endif endif endif else #Older systems without the DMARC Plugin - Less accurate ifplugin Mail::SpamAssassin::Plugin::AskDNS ifplugin Mail::SpamAssassin::Plugin::DKIM ifplugin Mail::SpamAssassin::Plugin::SPF askdns __KAM_DMARC_POLICY_NONE _dmarc._AUTHORDOMAIN_ TXT /^v=DMARC1;.*\bp=none;/ tflags __KAM_DMARC_POLICY_NONE net askdns __KAM_DMARC_POLICY_QUAR _dmarc._AUTHORDOMAIN_ TXT /^v=DMARC1;.*\bp=quarantine;/ tflags __KAM_DMARC_POLICY_QUAR net askdns __KAM_DMARC_POLICY_REJECT _dmarc._AUTHORDOMAIN_ TXT /^v=DMARC1;.*\bp=reject;/ tflags __KAM_DMARC_POLICY_REJECT net askdns __KAM_DMARC_POLICY_DKIM_STRICT _dmarc._AUTHORDOMAIN_ TXT /^v=DMARC1;.*\badkim=s;/ tflags __KAM_DMARC_POLICY_DKIM_STRICT net #Checks if either DKIM Passed with Alignment and the policy is strict or VALID and alignment didn't pass meta KAM_DMARC_STATUS !((DKIM_VALID_AU && __KAM_DMARC_POLICY_DKIM_STRICT) || (DKIM_VALID && !__KAM_DMARC_POLICY_DKIM_STRICT)) describe KAM_DMARC_STATUS Test Rule for DKIM or SPF Failure with Strict Alignment score KAM_DMARC_STATUS 0.01 tflags KAM_DMARC_STATUS net meta KAM_DMARC_REJECT !(DKIM_VALID_AU || SPF_PASS) && __KAM_DMARC_POLICY_REJECT describe KAM_DMARC_REJECT DKIM has Failed or SPF has failed on the message and the domain has a DMARC reject policy score KAM_DMARC_REJECT 3.0 tflags KAM_DMARC_REJECT net meta KAM_DMARC_QUARANTINE !(DKIM_VALID_AU || SPF_PASS) && __KAM_DMARC_POLICY_QUAR describe KAM_DMARC_QUARANTINE DKIM has Failed or SPF has failed on the message and the domain has a DMARC quarantine policy score KAM_DMARC_QUARANTINE 1.5 tflags KAM_DMARC_QUARANTINE net meta KAM_DMARC_NONE !(DKIM_VALID_AU || SPF_PASS) && __KAM_DMARC_POLICY_NONE describe KAM_DMARC_NONE DKIM has Failed or SPF has failed on the message and the domain has no DMARC policy score KAM_DMARC_NONE 0.25 tflags KAM_DMARC_NONE net endif endif endif endif #OLE/VB MACROs ifplugin Mail::SpamAssassin::Plugin::OLEVBMacro # increase number of mime parts checked olemacro_num_mime 10 olemacro_max_file 2048000 # skip psd and other files from macro checks olemacro_skip_exts (?:dotx|potx|ppsx|pptx|psd|sldx|xltx|oxps)$ if (version >= 3.004005) body KAM_OLEMACRO eval:check_olemacro() describe KAM_OLEMACRO Attachment has an Office Macro score KAM_OLEMACRO 7.5 body KAM_OLEMACRO_MALICE eval:check_olemacro_malice() describe KAM_OLEMACRO_MALICE Potentially malicious Office Macro score KAM_OLEMACRO_MALICE 10.0 body KAM_OLEMACRO_ENCRYPTED eval:check_olemacro_encrypted() describe KAM_OLEMACRO_ENCRYPTED Has an Office doc that is encrypted score KAM_OLEMACRO_ENCRYPTED 3.0 #This may cause more CPU usage olemacro_extended_scan 1 olemacro_exts ((?:doc|docx|dot|one|pot|ppa|pps|ppt|rtf|sldm|xl|xla|xls|xlsx|xlt|xltx|xslb)$) body KAM_OLEMACRO_RENAME eval:check_olemacro_renamed() describe KAM_OLEMACRO_RENAME Has an Office doc that has been renamed score KAM_OLEMACRO_RENAME 2.5 meta GB_OLEMACRO_REN_VIR ( KAM_OLEMACRO_RENAME && FORGED_OUTLOOK_HTML ) describe GB_OLEMACRO_REN_VIR Olemacro and fake Outlook score GB_OLEMACRO_REN_VIR 10 if (version >= 3.004006) if (version >= 4.000000) # olemacro_download_marker ((?:cmd(?:\.exe)? \/c ms\^h\^ta ht\^tps?:\/\^\/)|SysWow.{1,15}\s.{1,5}RETURN|RET.{1,4}URN.{1,25}\.exe) olemacro_download_marker ((?:cmd(?:\.exe)? \/c ms\^h\^ta ht\^tps?:\/\^\/)|SysWow.{1,15}\s.{1,5}RETURN|RET.{1,4}URN.{1,25}\.exe|powershell\s+Invoke\-WebRequest) endif #NO good reason to add a "cmd.exe" invocation inside an Excel file. body GB_OLEMACRO_DOWNLOAD_EXE eval:check_olemacro_download_exe() describe GB_OLEMACRO_DOWNLOAD_EXE Malicious code inside the Office doc that tries to download a .exe file detected score GB_OLEMACRO_DOWNLOAD_EXE 10 endif endif body KAM_OLEMACRO_ZIP_PW eval:check_olemacro_zip_password() describe KAM_OLEMACRO_ZIP_PW Has an Office doc that is password protected in a zip score KAM_OLEMACRO_ZIP_PW 2.0 body KAM_OLEMACRO_CSV eval:check_olemacro_csv() describe KAM_OLEMACRO_CSV Macro in csv file score KAM_OLEMACRO_CSV 5.0 #meta KAM_OLEMACRO_ZIP_PW_NOMID ( KAM_OLEMACRO_ZIP_PW && MISSING_MID ) #describe KAM_OLEMACRO_ZIP_PW_NOMID OLE macro sent by a bot / ratware #score KAM_OLEMACRO_ZIP_PW_NOMID 5.0 meta KAM_OLEMACRO_ZIP_BOT ( KAM_OLEMACRO_ZIP_PW && ( MISSING_MID || PDS_FROMNAME_SPOOFED_EMAIL ) ) describe KAM_OLEMACRO_ZIP_BOT OLE macro sent by a bot / ratware score KAM_OLEMACRO_ZIP_BOT 5.0 if (version >= 4.000000) if can(Mail::SpamAssassin::Plugin::OLEVBMacro::has_olemacro_redirect_uri) body OLEMACRO_URI_TARGET eval:check_olemacro_redirect_uri() describe OLEMACRO_URI_TARGET Code inside the Office doc that tries to redirect to an uri score OLEMACRO_URI_TARGET 0.001 endif if can(Mail::SpamAssassin::Plugin::OLEVBMacro::has_olertfobject) body OLEMACRO_RTF eval:check_olertfobject() describe OLEMACRO_RTF Rtf file embedded in an Office document score OLEMACRO_RTF 0.01 endif endif endif #Testing Rule for Subject Prefixes - See note 58397 #if can(Mail::SpamAssassin::Conf::feature_subjprefix) # enlist_addrlist (INTERNAL) *@pccc.com # header __FROM_INTERNAL eval:check_from_in_list('INTERNAL') # # meta EXTERNAL (!__FROM_INTERNAL) # describe EXTERNAL External users to PCCC Test Rule # score EXTERNAL 0.001 # subjprefix EXTERNAL [EXTERNAL] #endif #Testing Rule for NoSubject Rules - See note 58246 #if (version >= 3.004003) # #SHOULD HIT # body NOSUBJECT_TEST_HIT /example/i # describe NOSUBJECT_TEST_HIT This should hit on an email with example in the subject but not in the body because subjects are automatically prepending for testing. # # #SHOULD NOT HIT # body NOSUBJECT_TEST_FAIL /example/i # describe NOSUBJECT_TEST_FAIL This should NOT hit on an email with example in the subject not not in the body because the tflags nosubject will stop the automatic prepending of subjects for testing. # tflags NOSUBJECT_TEST_FAIL nosubject #endif if (version >= 3.004003) ifplugin Mail::SpamAssassin::Plugin::HashBL # BTC address present in BTC blocklist # thanks to Henrik Krohns for the regexp body BTC_HASHBL_BLACK eval:check_hashbl_bodyre('bl.btcblack.it', 'raw/max=10/shuffle', '\b(?<!=)([13][a-km-zA-HJ-NP-Z1-9]{25,34}|bc1[acdefghjklmnpqrstuvwxyz234567890]{30,62})\b') priority BTC_HASHBL_BLACK -100 tflags BTC_HASHBL_BLACK net describe BTC_HASHBL_BLACK Message contains BTC address found on BTC blocklist score BTC_HASHBL_BLACK 8.0 endif endif #Testing of HASHBL Additions - Note 58246 if (version >= 3.004003) #LAUNCH PCCC WILD RBL ifplugin Mail::SpamAssassin::Plugin::HashBL rbl_headers EnvelopeFrom,Reply-To,Resent-from,X-Sender,X-Source-IP # mass-marketing domain found in headers (EnvelopeFrom,Reply-To,X-Sender,X-Source-IP) header PCCC_HDR_MARKETINGBL eval:check_rbl_headers('pccc-hdr-marketing', 'wild.pccc.com.', '127.0.0.32') describe PCCC_HDR_MARKETINGBL Address in email headers associated with mass-marketing (https://raptor.pccc.com/RBL) tflags PCCC_HDR_MARKETINGBL net score PCCC_HDR_MARKETINGBL 0.001 priority PCCC_HDR_MARKETINGBL -100 header PCCC_HDR_REPLYTO eval:check_rbl_headers('pccc-hdr-repto', 'wild.pccc.com.', '127.0.0.4', 'Reply-To,Resent-from') describe PCCC_HDR_REPLYTO Address in email headers associated with compromised uris (https://raptor.pccc.com/RBL) tflags PCCC_HDR_REPLYTO net score PCCC_HDR_REPLYTO 7.5 priority PCCC_HDR_REPLYTO -100 # compromised domain found in headers (X-Sender,X-Source-IP,X-SRS-Sender) header PCCC_SENDER_COMPROMISED eval:check_rbl_headers('pccc-sender', 'wild.pccc.com.', '127.0.1.2', 'X-Sender,X-Source-IP,X-SRS-Sender') describe PCCC_SENDER_COMPROMISED Sender address associated with compromised uris (https://raptor.pccc.com/RBL) tflags PCCC_SENDER_COMPROMISED net score PCCC_SENDER_COMPROMISED 2.0 priority PCCC_SENDER_COMPROMISED -100 # compromised domain found in received headers header PCCC_RECEIVED_HDR_COMPROMISED eval:check_rbl_rcvd('pccc-rcvd', 'wild.pccc.com.', '127.0.1.2') describe PCCC_RECEIVED_HDR_COMPROMISED Compromised domain found in received headers found on PCCC WILD RBL (https://raptor.pccc.com/RBL) tflags PCCC_RECEIVED_HDR_COMPROMISED net score PCCC_RECEIVED_HDR_COMPROMISED 2.0 priority PCCC_RECEIVED_HDR_COMPROMISED -100 # dns server of From address found on PCCC WILD RBL header PCCC_FROM_BAD_NS eval:check_rbl_ns_from('pccc-ns', 'wild.pccc.com.', '127.0.1.1') describe PCCC_FROM_BAD_NS DNS server of From address found on PCCC WILD RBL (https://raptor.pccc.com/RBL) tflags PCCC_FROM_BAD_NS net score PCCC_FROM_BAD_NS 2.0 priority PCCC_FROM_BAD_NS -100 # Freemail address in Reply-To header found on PCCC HashBL # this rule needs 99_hashbl.cf to work header PCCC_HASHBL_FREEMAIL eval:check_hashbl_emails('wild.pccc.com', 'md5', 'Reply-To,Resent-from', '^127\.', 'freemail') describe PCCC_HASHBL_FREEMAIL Message contains freemail address in reply-to found on PCCC HashBL (https://raptor.pccc.com/RBL) tflags PCCC_HASHBL_FREEMAIL net score PCCC_HASHBL_FREEMAIL 4.5 priority PCCC_HASHBL_FREEMAIL -100 # Email address in X-Sender header found on PCCC HashBL header PCCC_HASHBL_EMAIL_SEND eval:check_hashbl_emails('wild.pccc.com', 'md5', 'X-Sender', '^127\.', 'all') describe PCCC_HASHBL_EMAIL_SEND Message contains sender email address found on PCCC HashBL (https://raptor.pccc.com/RBL) tflags PCCC_HASHBL_EMAIL_SEND net score PCCC_HASHBL_EMAIL_SEND 3.5 priority PCCC_HASHBL_EMAIL_SEND -100 # Email address in X-SRS-Sender header found on PCCC HashBL header PCCC_HASHBL_EMAIL_SRS eval:check_hashbl_emails('wild.pccc.com', 'md5', 'X-SRS-Sender', '^127\.', 'all') describe PCCC_HASHBL_EMAIL_SRS Message contains srs email address found on PCCC HashBL (https://raptor.pccc.com/RBL) tflags PCCC_HASHBL_EMAIL_SRS net score PCCC_HASHBL_EMAIL_SRS 1.5 priority PCCC_HASHBL_EMAIL_SRS -100 # Email address in email headers found on PCCC HashBL header PCCC_HASHBL_EMAIL eval:check_hashbl_emails('wild.pccc.com', 'md5') describe PCCC_HASHBL_EMAIL Message contains email address found on PCCC HashBL (https://raptor.pccc.com/RBL) tflags PCCC_HASHBL_EMAIL net score PCCC_HASHBL_EMAIL 2.5 priority PCCC_HASHBL_EMAIL -100 # Email address in custom email headers found on PCCC HashBL header PCCC_HASHBL_HDR_EMAIL eval:check_hashbl_emails('wild.pccc.com', 'md5', 'Reply-To/Resent-from/Disposition-Notification-To/X-Original-Sender/X-Sender', '^127\.', 'all') describe PCCC_HASHBL_HDR_EMAIL Message contains email address found on PCCC HashBL (https://raptor.pccc.com/RBL) tflags PCCC_HASHBL_HDR_EMAIL net score PCCC_HASHBL_HDR_EMAIL 3.5 priority PCCC_HASHBL_HDR_EMAIL -100 # Short URL in PCCC HashBL found header PCCC_HASHBL_SHORT_URI eval:check_hashbl_uris('wild.pccc.com', 'md5', '^127\.0\.1\.4') describe PCCC_HASHBL_SHORT_URI Message contains short URI found on PCCC HashBL (https://raptor.pccc.com/RBL) tflags PCCC_HASHBL_SHORT_URI net score PCCC_HASHBL_SHORT_URI 9.5 priority PCCC_HASHBL_SHORT_URI -100 if (version >= 4.000000) header __GB_LISTID List-ID =~ /(?:^|\s)(?<LISTID>.{1,64})$/ header PCCC_HASHBL_LISTID eval:check_hashbl_tag('wild.pccc.com', 'md5', 'LISTID', '^127\.0\.0\.5') describe PCCC_HASHBL_LISTID Message contains List-ID found on PCCC HashBL (https://raptor.pccc.com/RBL) tflags PCCC_HASHBL_LISTID net score PCCC_HASHBL_LISTID 9.0 priority PCCC_HASHBL_LISTID -100 endif endif endif #END of TEST OF HASHBL ADDITIONS #LABEL # SUBJ header __KAM_LABEL1 Subject =~/(Checking in|Appointment|(this|next) week|thoughts|availability|consultation|introduction|let me know|schedule|meeting|tailor)/i # MEET body __KAM_LABEL2 /meet (you )?at your (home|office)|quick lead time/i # CUSTOM body __KAM_LABEL3 /(custom.?tailored|make custom) (shirts|sports|jackets|suits)/i # SHIRTS /WARDROBE body __KAM_LABEL4 /(suits start at \$|shirts at \$|upgrad(e|ing) your wardrobe)|refreshing your work wardrobe/i # FABRIC body __KAM_LABEL5 /(premier|top|luxury) (clothing|fabric)|fortune 500/i # LABEL body __KAM_LABEL6 /\| Label|Company, Label,/i meta KAM_LABEL (__KAM_LABEL1 + __KAM_LABEL2 + __KAM_LABEL3 + __KAM_LABEL4 + __KAM_LABEL5 + __KAM_LABEL6 >= 6) describe KAM_LABEL Tailored clothier spam score KAM_LABEL 9.0 #RBLOBFU body __KAM_RBL_OBFU1 /b2b.{1,4}salesprospects.{1,4}com/i body __KAM_RBL_OBFU2 /quin.{0,3}for.{0,3}ce.com/i body __KAM_RBL_OBFU3 /jrgpartners\(\.\)com/i meta KAM_RBL_OBFU ((__KAM_RBL_OBFU1 + __KAM_RBL_OBFU2 >=1) + FREEMAIL_FROM >= 2) describe KAM_RBL_OBFU Spammers obfuscating their domain and abusing freemail score KAM_RBL_OBFU 12.0 meta KAM_RBL_OBFU2 __KAM_RBL_OBFU3 describe KAM_RBL_OBFU2 Spammers obfuscating their domain score KAM_RBL_OBFU2 9.0 #Shady CC's body __KAM_SHADYCC1 /(transactions?|purchases?) from your (online store|web-?shop)/i header __KAM_SHADYCC2 Subject =~ /(illegal|shady) (purchases?|transactions?).*?(credit ?card|mastercard|visa).*?at your site/i body __KAM_SHADYCC3 /(four|4) of (my|the) (master)?card/i body __KAM_SHADYCC4 /(detailed|full) statement/i meta KAM_SHADYCC (__KAM_SHADYCC1 + __KAM_SHADYCC2 + __KAM_SHADYCC3 + __KAM_SHADYCC4 >= 4) describe KAM_SHADYCC Scam predicated around reporting fraudulent purchase score KAM_SHADYCC 6.0 #Expo Scams header __KAM_EXPOPIRATE1 Subject =~ /Hotel Booking/i body __KAM_EXPOPIRATE2 /Business Traveller/i meta KAM_EXPOPIRATE (__KAM_EXPOPIRATE1 + __KAM_EXPOPIRATE2 + __KAM_LIST3_2 >= 2) describe KAM_EXPOPIRATE Scam Pirates trying to Hijack Event Hotel Bookings score KAM_EXPOPIRATE 4.5 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader #Domain Expiry Scams header __KAM_DOMAINEXPIRY1 Subject =~ /Domain.*Expiration/i body __KAM_DOMAINEXPIRY2 /Attached letter/i meta KAM_DOMAINEXPIRY (__KAM_DOMAINEXPIRY1 + __KAM_DOMAINEXPIRY2 + __KAM_ZERODAY1 >= 3) describe KAM_DOMAINEXPIRY Domain Expiration Scams score KAM_DOMAINEXPIRY 4.5 #Payment Scams header __KAM_PAYMENTSCAM1 Subject =~ /Payment.*(INV|Bookings|Reference|\/201)/i body __KAM_PAYMENTSCAM2 /attached (payment|herewith)|ready for release/i mimeheader __KAM_PAYMENTSCAM3 Content-Type =~ /\.doc/i full __KAM_PAYMENTSCAM4 /\{\\rtf/ meta KAM_PAYMENTSCAM (__KAM_ZERODAY1 + __KAM_PAYMENTSCAM1 + __KAM_PAYMENTSCAM2 + (__KAM_PAYMENTSCAM3 + __KAM_PAYMENTSCAM4 >=2) >= 4) describe KAM_PAYMENTSCAM Payment Scams with Malware Payloads score KAM_PAYMENTSCAM 6.5 meta KAM_PAYMENTSCAM2 (DEAR_BENEFICIARY + __KAM_PAYMENTSCAM1 + __KAM_PAYMENTSCAM2 >= 3) && !(KAM_PAYMENTSCAM) describe KAM_PAYMENTSCAM2 Payment scams score KAM_PAYMENTSCAM2 4.5 #Password Scams body __KAM_PASSWORDSCAM1 /pass word/i meta KAM_PASSWORDSCAM (__KAM_PASSWORDSCAM1 + __SINGLE_WORD_SUBJ + __PDF_ATTACH + __BODY_LE_200 >= 4) describe KAM_PASSWORDSCAM Password extortion spams score KAM_PASSWORDSCAM 6.0 endif #Training Scams header __KAM_TRAINING1 Subject =~ /mandatory.*training/i body __KAM_TRAINING2 /intranet|training calendar/i body __KAM_TRAINING3 /Human Resources/i meta KAM_TRAINING (__KAM_TRAINING1 + __KAM_TRAINING2+ __KAM_TRAINING3 >= 3) describe KAM_TRAINING Training Phishing score KAM_TRAINING 4.5 #Trump Medicare header __KAM_MEDICARE2_1 Subject =~ /Trump Medicare/i meta KAM_MEDICARE2 __KAM_MEDICARE2_1 >= 1 describe KAM_MEDICARE2 Medicare Scams score KAM_MEDICARE2 2.0 #Water hack header __KAM_WATERHACK1 Subject =~ /Water Hack/i body __KAM_WATERHACK2 /water hack/i meta KAM_WATERHACK (__KAM_WATERHACK1 + __KAM_WATERHACK2 + KAM_SHORT >= 3) describe KAM_WATERHACK Diet Scams score KAM_WATERHACK 5.0 #Web forms used to submit shortened urls header __XMAIL_CODEIGN X-Mailer =~ /CodeIgniter/ header __XMAIL_PHPMAIL X-Mailer =~ /PHPMailer/ meta GB_WEBFORM ( ( __XMAIL_CODEIGN || __XMAIL_PHPMAIL ) && KAM_SHORT && FREEMAIL_FROM ) describe GB_WEBFORM Webform with url shortener score GB_WEBFORM 2.0 #Sendgrid Exploits #thanks to Chip for another Spample on 2020-03-07 header __KAM_SENDGRID1 EnvelopeFrom =~ /\@u\d+\.wl\d+\.sendgrid\.net|bounces.*\@sendgrid\.net/i header __KAM_SENDGRID1A Return-Path =~ /\@u\d+\.wl\d+\.sendgrid\.net/i header __KAM_SENDGRID2 Received =~ /ismtp.*?.sendgrid\.net|outbound\-mail\.sendgrid\.net \[/i meta KAM_SENDGRID ((HEADER_FROM_DIFFERENT_DOMAINS || SPF_HELO_NONE) + ((__KAM_SENDGRID1 + __KAM_SENDGRID1A >= 1) + __KAM_SENDGRID2 >= 1) >= 2) describe KAM_SENDGRID Sendgrid being exploited by scammers score KAM_SENDGRID 1.50 header __KAM_EDU_FROM From:addr =~ /\.edu$/i header __KAM_SENDGRID3 Subject =~ /Amex|Wells ?Fargo|American Express|Security (Review|Message)|Quickbooks|Sign-?in Blocked|unusual activity|payment pending|online Payment|Intuit|security Upgrade|you have a document|verify your card|email alert/i header __KAM_SENDGRID4 From =~ /Amex|Wells ?Fargo|American Express|Schwab|bank|USAA|stripe|intuit|chase/i meta KAM_SENDGRID2 ((__KAM_EDU_FROM + KAM_SENDGRID >= 1) + (TO_IN_SUBJ + __KAM_SENDGRID3 + __KAM_SENDGRID4 >=1) >= 2) describe KAM_SENDGRID2 Sendgrid being exploited by scammers score KAM_SENDGRID2 2.0 #Political (and T-shirt Spam) header __KAM_2020_1 Subject =~ /Re-?elect Trump|(Guinea pig|science|funny|election|christmas|personalized|mission|collection|engineer|teacher|fishing|jesus|202\d) (tee|(t|tee)( |-)?shirt)|ginsburg shirt|officially licensed|check out our new collection|let.?s go brandon|support truckers|freedom convoy/i header __KAM_2020_1A From:name =~ /(T|Tee).?shirt|Tee4u/i #removing (Tee|T)-?shirt for FPs body __KAM_2020_2 /printed in the US|stink stank stunk|officially licensed|star wars|funny (guinea pig|science|tee|teacher|fishing|halloween)|\d+ designs|let.?s go brandon|blood of jesus|support truckers|freedom convoy/i tflags __KAM_2020_2 nosubject uri __KAM_GOOGLE_FORM /docs\.google\.com\/form/i meta KAM_2020 ((__KAM_2020_1 + __KAM_2020_1A >=1) + __KAM_2020_2 + (__KAM_GOOGLE_FORM + KAM_SHORT >= 1) + FREEMAIL_FROM >= 3) describe KAM_2020 Political (and Tshirt???) Spams - Vote for KAM & Pedro - donate today at www.mcgrail.com score KAM_2020 7.0 #WeTransfer Spam uri __KAM_WETRANSFER1 /wetransferfiledownload|\?email=|redirecturl/i header __KAM_WETRANSFER2 From:name =~ /WeTransfer/i header __KAM_WETRANSFER3 From:addr !~ /wetransfer\.com/i header __KAM_WETRANSFER4 Subject =~ /via WeTransfer/i meta KAM_WETRANSFER (__KAM_WETRANSFER1 + __KAM_WETRANSFER2 + __KAM_WETRANSFER3 + (__KAM_WETRANSFER4 + SPF_FAIL >= 1) >= 4) score KAM_WETRANSFER 6.0 describe KAM_WETRANSFER WeTransfer Impersonators #Grey Eagle header __KAM_GREYEAGLE_1 From =~ /greyeagle|funding|capital|banking|lending/i body __KAM_GREYEAGLE_2 /grey eagle funding/i meta KAM_GREYEAGLE (__KAM_GREYEAGLE_1 + __KAM_GREYEAGLE_2 >= 2) describe KAM_GREYEAGLE Spammy Funding Company w/lots of Domains score KAM_GREYEAGLE 10.0 #Google Storage APIs uri __KAM_STORAGE_GOOGLE /storage\.googleapis\.com|\.web\.app\//i meta KAM_STORAGE_GOOGLE ( __KAM_STORAGE_GOOGLE && !__URI_GOOG_STO_IMG ) describe KAM_STORAGE_GOOGLE Google Storage API being abused by spammers score KAM_STORAGE_GOOGLE 1.70 uri GB_URI_FLEEK_STO_HTM m,^https?://storageapi\.fleek\.co/.*\.html?,i describe GB_URI_FLEEK_STO_HTM Html file stored on Fleek cloud score GB_URI_FLEEK_STO_HTM 4.25 tflags GB_URI_FLEEK_STO_HTM multiple maxhits=5 uri GB_URI_BACKBLAZE_HTM m,^https?://(?:\w+.s3.\w{2}\-\w+\-|\w)\d{3}\.backblazeb2\.com/.*\.html?,i describe GB_URI_BACKBLAZE_HTM Html file stored on Backblaze score GB_URI_BACKBLAZE_HTM 4.25 tflags GB_URI_BACKBLAZE_HTM multiple maxhits=5 #Spam Du Jour header __KAM_DUJOUR1 Subject =~ /(Worst Food|Tinnitus|Reflux|Gift Card)/i body __KAM_DUJOUR2 /(Worst Food|Tinnitus|Reflux|CVS Gift Card)/i tflags __KAM_DUJOUR2 nosubject header __KAM_DUJOUR3 From =~ /(Probio|Tinnitus|Reflux|CVS)/i meta KAM_DUJOUR (KAM_STORAGE_GOOGLE + __KAM_DUJOUR1 + __KAM_DUJOUR2 + __KAM_DUJOUR3 >= 3) describe KAM_DUJOUR Spam of the Day hocking various products score KAM_DUJOUR 4.5 #QUINFORCE body __KAM_QUINFORCE1 /q.?u.?i.?n.?f.?o.?r.?c.?e/i meta KAM_QUINFORCE1 (__KAM_QUINFORCE1 >= 1) describe KAM_QUINFORCE1 Obfuscating spamming firm score KAM_QUINFORCE1 6.0 #SPAMDUJOUR body __KAM_CBD1 /(Prosper|Meridian) CBD/i header __KAM_CBD2 From:name =~ /CBD/i meta KAM_CBD (__KAM_CBD1 + __KAM_CBD2 + __KAM_OTHER_BAD_TLD2 >= 2) describe KAM_CBD Spam du jour for CBD score KAM_CBD 4.5 #COVID SCAMS body __KAM_COVID1 /International Monetary fund|world health organization|empowerment fund/i header __KAM_COVID2 Subject =~ /COVID?.{0,12}(payment|fund)/i body __KAM_COVID3 /COVID.{0,12}(empowerment|payment)|W\.?H\.?O\.? trust.?fund/i tflags __KAM_COVID3 nosubject header __KAM_COVID4 From =~ /COVID|world ?Health|WHO/i body __KAM_COVID5 /00 ?(EUR|USD|Dollar)/i meta KAM_COVID ((__KAM_COVID5 + LOTS_OF_MONEY >= 1) + __KAM_COVID1 + __KAM_COVID2 + __KAM_COVID3 + __KAM_COVID4 >= 4) describe KAM_COVID Scams revolving around the pandemic score KAM_COVID 6.0 #COVID SCAMS body __KAM_COVID2_1 /COVID-19 (CHARITY )?(fund|donated relief)/i tflags __KAM_COVID2_1 nosubject header __KAM_COVID2_2 Subject =~ /(little|COVID-19) (fund|donation)/i meta KAM_COVID2 (__KAM_COVID2_1 + __KAM_COVID2_2 + LOTS_OF_MONEY >= 2) describe KAM_COVID2 Scams revolving around the pandemic score KAM_COVID2 7.5 #COVID SCAMS body __KAM_COVID3_1 /Prince/i body __KAM_COVID3_2 /reliable source/i body __KAM_COVID3_3 /\$[\d\.,]+ mil/i body __KAM_COVID3_4 /assist me/i body __KAM_COVID3_5 /Saudi Arabia/i meta KAM_COVID3 (__KAM_COVID3_1 + __KAM_COVID3_2 + __KAM_COVID3_3 + __KAM_COVID3_4 + __KAM_COVID3_5 >= 5) describe KAM_COVID3 Scams revolving around the pandemic score KAM_COVID3 7.5 #URI uri __KAM_VM1 /storage.googleapis.com\/.*?htm|appspot\.com|safesend\.|\/api\/v1\/click\|\.sharepoint\.com\/personal\/|evernote\.com|github\.io|netlify\.app|sendgrid\.net|dynamics\.com/i #Subject or FROM header __KAM_VM2 Subject =~ /VN Audio|message for|voice Message|Voicemail|Fax Message|OneDrive File|voice note duration|voice-audio|telephone vm|portal/i header __KAM_VM2A From =~ /-xxxx|tele-mail/i #Body ifplugin Mail::SpamAssassin::Plugin::ReplaceTags #VOICEMAIL SCAM replace_rules __KAM_VM3 body __KAM_VM3 /(Voice.?Audio|VN Audio|VM Meant|Listen to (your )?Voice|voicemail message|Fax(ed)? (document|message)|new voicemail|Virtual <O1>ffice Extens<I1>on)|ca<L1><L1>er left you a message|play voice/i tflags __KAM_VM3 nosubject endif body __KAM_VM4 /recorded voice|audio message|Caller.?id|CID:|mailbox \d|sign document|new vm on/i tflags __KAM_VM4 nosubject #Content Type ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __KAM_VM5 Content-Type =~ /.s?html?\.?\"?$/i endif meta KAM_VM (__KAM_VM1 + (__KAM_VM2A + __KAM_VM2 >= 1) + __KAM_VM3 + __KAM_VM4 + __KAM_VM5 + KAM_RAPTOR_EXTERNAL >= 4) score KAM_VM 5.5 describe KAM_VM Voice Mail & Fax Scams meta KAM_VM_HTML (KAM_VM + __KAM_VM5 >= 2) describe KAM_VM_HTML Likely Phish for VM score KAM_VM_HTML 3.0 #Admin Notice Fraud header __KAM_ADMIN1 From =~ /admin/i header __KAM_ADMIN2 Subject =~ /For /i body __KAM_ADMIN3 /next tax return/i body __KAM_ADMIN4 /read this document/i meta KAM_ADMIN (HEADER_FROM_DIFFERENT_DOMAINS + HTML_OBFUSCATE_10_20 + __KAM_ADMIN1 + __KAM_ADMIN2 + __KAM_ADMIN3 + __KAM_ADMIN4 >= 6) describe KAM_ADMIN Phishing attempt spoofing admins score KAM_ADMIN 9.0 #BENEFICIARY header __KAM_BENEFICIARY1 Subject =~ /(your|Urgent) Help|refugee|Attention|Inherit|donation|refund|beloved|^Hello$|dear friend|compensated|get back to me|hope to hear|my dear|postal service|From.....|compliment|sincere apology|proposal|How are you|congratulations|ATM VISA Card|good (day|news)|beneficiary|\bcc\b|best regards|dearest one|^Att$|^Reply$|partnership|greeting'?s|atm fund|postmaster general|Investment|shipment|indicate your interest/i #what #removed fund(\b|$) on 1/12 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_rules __KAM_BENEFICIARY2 body __KAM_BENEFICIARY2 /consignment|person of trust|don't know me|emails only|apologize for intrud|formal relationship|diplomatic agent|ATM VISA CARD|unsolicited manner|proposition|solicit your|trustworthy relation|verily|random people|you a beneficiary|help<SPACE1>+widow|same last ?name|(same|similar) surname|investment manager|level of maturity|important project|jackpot|investment opp|something important|unclaimed trunk|estate investment|donation recipient|bank draft|funding of your business/i tflags __KAM_BENEFICIARY2 nosubject endif #bus body __KAM_BENEFICIARY3 /(gold|diamonds|inherit|foreign customer|risk.?free|less.privilege|next of kin|nearest airport|certain funds|partnership to transfer|repatriation|co.fiscate|separate account|christian activit|receiving bank|donate the sum|money left|sweepstakes|lucky winner|get rich|\d% of the total|investment fund)|moving some money|god has blessed|contributions to humanity|partake in the deal|pledge dep|over-?due compensation|left your check|invest(ment)? in your country|abandoned shipment/i #bus fp body __KAM_BENEFICIARY3A /(e\-|ELECTRONIC )TICKET RECeipt/i #where body __KAM_BENEFICIARY4 /(Ghana|\b(?:South\s)?Africa\b|China|Greece|Estonia|United kingdom|foreign|(your|my) country\b|\bBenin\b|Foreign Op|international Airport|portugal|business trip|Ivory Coast|Royal Bank|\bSyria\b|Libyan|Ministry of |Buffett Foundation|audit unit)|postmaster general/i #how much body __KAM_BENEFICIARY5 /\d{1,32} ?(kilo|kg)|donat|assignment|last wishes|charity org|million dollars|secret account|overdue winnings|handsomely compensate|large amount|share of fund|one digit interest|beneficial business|anticipated cooperation|\d% (with|for) you|fiscal cash|huge amount|(half|99 percent) of (his|their|her) fortune|by proxy|\d million|investment in your country/i #sob body __KAM_BENEFICIARY6 /(deceased|late) (customer|husband|client|father)|death of my husband|cancer|power of attorney|customer who died|orphan|no beneficiary|terminal|family treasure|not criminal|send (you )?more (information|details)|wife ran away|inability to release|terrorist attack|sterile|foreigner who died|corrupt officials|could not complete|Diplomat from|seized all my/i meta KAM_BENEFICIARY ((LOTS_OF_MONEY + __KAM_BENEFICIARY5 >=1) + (KAM_BLANKSUBJECT + __KAM_BENEFICIARY1 >=1) + __KAM_BENEFICIARY2 + __KAM_BENEFICIARY3 + __KAM_BENEFICIARY4 + __KAM_BENEFICIARY6 + FREEMAIL_FROM >= 6) && (__KAM_BENEFICIARY3A + EXTRACTTEXT <= 0) describe KAM_BENEFICIARY Beneficiary scams score KAM_BENEFICIARY 10.5 meta KAM_BENEFICIARYLOW ((LOTS_OF_MONEY + __KAM_BENEFICIARY5 >=1) + (KAM_BLANKSUBJECT + __KAM_BENEFICIARY1 >=1) + __KAM_BENEFICIARY2 + __KAM_BENEFICIARY3 + __KAM_BENEFICIARY4 + __KAM_BENEFICIARY6 + FREEMAIL_FROM >= 5) && !KAM_BENEFICIARY && !__KAM_NPO1 && (__KAM_BENEFICIARY3A + EXTRACTTEXT <= 0) describe KAM_BENEFICIARYLOW Beneficiary scams (Lower Confidence) score KAM_BENEFICIARYLOW 6.0 #NPO body __KAM_NPO1 /501\(?c\)?\(?3\)?|501 c 3/i #BENEFICIARY meta KAM_BENEFICIARY2 (GMD_PDF_EMPTY_BODY + DEAR_BENEFICIARY >= 2) describe KAM_BENEFICIARY2 Beneficiary scams score KAM_BENEFICIARY2 3.0 #Person Beneficiary body __KAM_BENEFICIARY3_1 /Mikhail Fridman/i header __KAM_BENEFICIARY3_2 From =~ /Mikhail Fridman/i uri __KAM_BENEFICIARY3_3 /www.rt.com/i meta KAM_BENEFICIARY3 (__KAM_BENEFICIARY3_1 + __KAM_BENEFICIARY3_2 + __KAM_BENEFICIARY3_3 + __KAM_DIDYOUSUBJ >= 3) describe KAM_BENEFICIARY3 Beneficiary scams score KAM_BENEFICIARY3 4.5 #Did you get my message? header __KAM_DIDYOUSUBJ Subject =~ /Did you (receive it|get my message)/i body __KAM_DIDYOUBODY /Did you (receive it|get my message)/i tflags __KAM_DIDYOUBODY nosubject #Blank Subject header KAM_BLANKSUBJECT Subject =~ /^\s*$/i describe KAM_BLANKSUBJECT Message has a blank Subject score KAM_BLANKSUBJECT 0.25 #Job #what header __KAM_JOB2_1 Subject =~ /doing the job/i body __KAM_JOB2_2 /represent the company/i #Where body __KAM_JOB2_3 /Singapore/i #how much body __KAM_JOB2_4 /\d,?000 USD (monthly|weekly)/i meta KAM_JOB2 (FREEMAIL_FROM + __KAM_JOB2_1 + __KAM_JOB2_2 + __KAM_JOB2_3 + __KAM_JOB2_4 >= 5) describe KAM_JOB2 Employment scams score KAM_JOB2 7.5 #WEB #subject header __KAM_WEB2_1 Subject =~ /follow|next step|web(site)? (analysis|builder|design|work)|crazy offer|cRM solution|CMS|worrdpress|inquiry web.?site|prices|developing mobile innovation|new web|develoment|web development offer/i #price or person - purposefully looks at subject too body __KAM_WEB2_2 /(inexpensive|affordable) (quot|price)|cheap website|less than half|free of cost|low package price|indian web.?design|\(India\)|i am a professional|team of experts|i am from india|development company|developer from India/i #product body __KAM_WEB2_3 /web(site)? (design|develop)|(better|new|refreshed) website|website audit|fresh look|redesign your website|mobile application devel|redesign your existing web|apps solution/i tflags __KAM_WEB2_3 nosubject #sample/offer body __KAM_WEB2_4 /portfolio|sample|insights|special offer|page 1|(any|your) requirements|anything you can imagine|send you a quote|share a few example|you'?re? requirement|share your requirement|discuss how I can assist/i tflags __KAM_WEB2_4 nosubject meta KAM_WEB2 (FREEMAIL_FROM + __KAM_WEB2_1 + __KAM_WEB2_2 + __KAM_WEB2_3 + __KAM_WEB2_4 >=5) describe KAM_WEB2 Unsolicited web workers score KAM_WEB2 7.5 #BANK header __KAM_BANK_1 Subject =~ /Welcome to (Central )?(Money ?Gram|Bank)|Funding|Banker|congratulations|d\x{C3}\x{A9}p\x{C3}\x{B4}t direct/i body __KAM_BANK_2 /beneficiary|agent|investment group|deceased|\x{C3}\x{A9}viter tout inconv\x{C3}\x{A9}nient/i body __KAM_BANK_3 /re\-?verification|clearance tax|possible funding|same last name|nominated bank account|mes informations bancaires/i meta KAM_BANK (FREEMAIL_FROM + LOTS_OF_MONEY + __KAM_BANK_1 + __KAM_BANK_2 + __KAM_BANK_3 >= 5) describe KAM_BANK Bank scams score KAM_BANK 7.5 meta KAM_BANK2 (LOTS_OF_MONEY + __KAM_BANK_1 + __KAM_BANK_2 + __KAM_BANK_3 >= 3) describe KAM_BANK2 Bank scams score KAM_BANK2 3.0 #FAKE CERTIFICATES header __KAM_CERT1 Subject =~ /Medical Certificate/i body __KAM_CERT2 /review this certificate/i body __KAM_CERT3 /link below/i meta KAM_CERT (__KAM_CERT1 + __KAM_CERT2 + __KAM_CERT3 + __PLUGIN_FROMNAME_SPOOF >= 3) describe KAM_CERT Fake Certificate Scams score KAM_CERT 4.5 #URGENT header __KAM_URGENT1 Subject =~ /^Hello$/i body __KAM_URGENT2 /urgent respond/i body __KAM_URGENT3 /private e?mail/i body __KAM_URGENT4 /god bless/i body __KAM_URGENT5 /address still valid/i meta KAM_URGENT ( __KAM_URGENT1 + __KAM_URGENT2 + __KAM_URGENT3 + __KAM_URGENT4 + __KAM_URGENT5 >= 5) describe KAM_URGENT Urgent Scams score KAM_URGENT 7.5 #INVESTMENT header __KAM_INVEST1 Subject =~ /Investment|(hello|congrats|dear) friend|urgent\b|greetings|^HELLO$|mutual business|contact him|mail for you|confirming your email|business opportunity|important|interest|^proposal$/i #looking/why body __KAM_INVEST2 /apprehensive|unstable investment|(honest|well.?established|reliable) (individual|partner|person)|wealthy client|legal paper|branch manager|director finance|business man|family asset|personal assistant|found your (detail|contact)|consultant|project financing|my name is|i am the lawyer|need your assistance|investment officer/i #money/deal body __KAM_INVEST3 /earn \d+\%|(more|full|elaborate) details|discuss further|risk.?free|give details|profitable|\% (yearly|ROI|commission)|bank draft|remuneration|(needs|seek|seeks|seeking) fund|employ you|split.?ration|(receive|secure) my fund/i #what/where body __KAM_INVEST4 /malta|oil company|joint venture|(fund|business) proposal|dubai|mutual business|bahrain|compensation fund|barrister|minister of|ghana|strategic development|your region|Mineral.Rich|non.?european|your country|outside UAE/i tflags __KAM_INVEST4 nosubject meta KAM_INVEST ( (LOTS_OF_MONEY + FREEMAIL_FROM + __KAM_INVEST1 + __KAM_INVEST2 + __KAM_INVEST3 + __KAM_INVEST4 >= 4) && !EXTRACTTEXT ) describe KAM_INVEST Investment Scams score KAM_INVEST 6.0 #SIGNON header __KAM_SIGN1 Subject =~ /New Sign-?[io]n/i body __KAM_SIGN2 /review your account/i body __KAM_SIGN3 /verification is processed/i meta KAM_SIGN (KAM_STORAGE_GOOGLE + __KAM_SIGN1 + __KAM_SIGN2 + __KAM_SIGN3 >= 4) describe KAM_SIGN Sign-in Verification Scams score KAM_SIGN 6.0 #COVID SPAM header __KAM_WEIRDC19_1 Subject =~ /The virus that causes COVID-19/i header __KAM_WEIRDC19_2 From =~ /John Robert/i body __KAM_WEIRDC19_3 /The virus that causes COVID-19/i tflags __KAM_WEIRDC19_3 nosubject meta KAM_WEIRDC19 (FREEMAIL_FROM + __KAM_BODY_LENGTH_LT_512 + __KAM_WEIRDC19_1 + __KAM_WEIRDC19_2 + __KAM_WEIRDC19_3 >= 5) describe KAM_WEIRDC19 Odd Covid-19 spam with information score KAM_WEIRDC19 7.5 #PRODUCT DUJOUR header __KAM_CELEB1 Subject =~ /Celebrity Doc/i body __KAM_CELEB2 /resugar/i body __KAM_CELEB3 /fat.burning/i meta KAM_CELEB (__KAM_CELEB1 + __KAM_CELEB2 + __KAM_CELEB3 >= 3) describe KAM_CELEB Celebrity Health Scams score KAM_CELEB 4.5 #BEAL AND SIMILAR IMPERSONATOR ifplugin Mail::SpamAssassin::Plugin::RaptorOnly # remove Daram Van Oers temporarily replace_tag KAM_BEAL_NAMES (?:(Robert|Bob).{1,4}Beal|Geoff White|(James|Jim).{1,4}Hoffman|Kevin (A\. )?Mc ?Grail|Frederic Beuter|Chris(topher)? (K\.? )?Surprise|(mike|michael) Charvat|Sheryl( Brissett)? Chapman|Sheryl Brissett|Janet Smith|Jeff Gardner|Geoff(rey)? White|Jason Davis|Al Nance|Laura (C\.? )?Leach|Guy Neitz|Michael Rowland|Brenda MacDonald|Pat(rick)? (A\. )?Campfield|Toni Kerns|Tina L. Berger|Robert T. Lalka|Karen Holmes|Richard Manship|WILLIAM HYATT|Alex DiJohnson|Mike Rinaldi|Patrick Augustine|Randy Livingston|Michael Schoor|Amy Millar|Gino Renne|Edward Kroman|Bill Stynes|Ralph Belk|gino renne|scott allen|Paula Sherman|Peter Turcik|Chip Anastasi|erik howard|Dyana Forester|Ryan Gardner|Yvan (cote|C\x{C3}\x{B4}t\x{C3}\x{A9}|C\x{C3}\x{83}\x{C2}\x{B4}t\x{C3}\x{83}\x{C2}\x{A9})|morris adler|Gary (A. )?Smith|Peggy White|Sunny Kim|Jayran Farzanega|Kristin Kirkpatrick|Michael Davison|John Meis|Mitchell Forbes|Kate Syson|Bryan Plumlee|Janet Smith|Christian Gardner|Calvin Johnson|rick cole|(James A.|Andy) Sheppard|M?athieu Fournier|Aaron Rash|William Schoor|Morris Adler|Paul Lefebvre|Bobby Boursiquot|Josepth Cimino|Victor (M.?)? Glasberg|Joseph Cimino) replace_rules __KAM_BEAL1 __KAM_BEAL3 __KAM_NOT_BEAL3 #from header __KAM_BEAL1 From:name =~ /<KAM_BEAL_NAMES>|TIME.?SENSITIVE|HASTE.?FEEDBACK|one.?moment|Urgent.?(message|task)|QUICK RESPONSE|REQUEST|TIMELY RESPONSE/i #in addition to freemail header __KAM_BEAL2 From:addr =~ /\@.+\.rr\.com|\@mail\.ru|\@.*\.cz|\@cox\.net/i #Name body __KAM_BEAL3 /<KAM_BEAL_NAMES>/i body __KAM_NOT_BEAL3 /((From|Cc|To)\:\s+).*<KAM_BEAL_NAMES>/i # Task #removed personal (email|text phone|cell|number) on 7/31/2024 for FP body __KAM_BEAL4 /(reply with|forward|send me|let me have|give me|drop) +your (Cell|Mobile|text)|task (real quick|quickly)|(urgent|quick|fast) (reply|errand|response|task|request|assistance)|(handle|make) (some|a) purchase|reimburse you|do something for me fast|spare time right now|confirm if you are free|physical or electronic gift card|(done for me|send out|task done) ASAP|available at the moment|(desk|moment) right now|get some .{0,10}gift card|(run a|important) task for me|certain task to be carried|purchase on my behalf|(urgent|Immediate) (Task|Assignment)|quickly on my behalf|variety of gift card|something important for me|carry out (urgently|swiftly)|codes electronically|make a payment|organiser le paiement|gifts for their hard|assist me with a task|quick favor|gift cards? for staff|process a payment via Zelle|request I need|purchase done on my behalf|take care of something|handle (some )?task quickly|(have|got) a moment|run an errand|are you in\?|purchase urgently|assignment for (me|you)|change my direct deposit|(leave|have|drop) your (phone )?number|(reply me with|confirm|drop|need|attach|email)( (me|with))? your (mobil|cell)|send me your text|get all the gifts purchase|direct deposit authorization form|list of all unpaid|can you get (?:this\s)?paid|help me with something|if (you are|you're) available|(send|drop) me your (direct|personal) (cell|phone)|free time for you|you available today|bancaires actuelles|ask you for a favor|get physical gift card|(include|confirm) your mobile|Task\!|CONFERENCE MEETING|cartes\-cadeaux|talk a little via email|surprise gift|account balances|in the office today|just respond to my email|send a cell number|aging report|complete an outstanding request|Visa, Apple or Amazon card|purchas(e|ing) these gifts on my behalf|souhaite modifier (?:le|mon\s+)?compte|(set up ACH for|take care of) the attached invoice|need you to take care of right now|in need of gift cards|what knowledge do you have of gift card|re-?confirm your personal cell|forward(ing)? your personal contact|provide your cell(phone) (no|number)|treasurer is unfamiliar with (Zelle|Paypal)|take care of this now|get your help today|delight some staff with gift.?card|Merci pour votre attention rapide|proceed with the payment via (wire|ACH)|aging report|do something for me right away|provide an alternate personal contact|(send me|give me|re\-?affirm|share)( with me)? your (personal )?(e.?mail|cell|num)|chat via email/i # question / privacy body __KAM_BEAL5 /can't talk on the phone|receivable aging report|summary of all w\-?2|look forward to my text|are you (accessible|in the office|busy)|between you and I|closed-?door meeting|get something done|you\'re unoccupied|accurately|I can brief|in a (conference|meeting)|reimburse if personal|what details do you need|(do|handle) discreetly|confidentiality|keep this private|get to a nearby store|(let me know|confirm) if you (are available|can get it done)|no calls just reply|write me back|look out for my text|concise you about it|so much on your plate|let me know if you are free|trust you on this|worry about your reimburse|after the surprise|limited cell service|can you assist|convey a message|entrust you|not want to disclose this|planning a surprise event|confidential assignment|respond back via email|going into a meeting|no calls|reach you at|lookout to my message|dans la confidence|wait for my text|immediate assistance|swift discussion|an emergency|prompt (response|reply)|laryngitis|(let me know when|as soon as) you are available|limited access to phone|kindly send me emails|plan to surprise|reach you urgent|need a work done|give me a number|comme une surprise|no call, just write|ruin this surprise|currently in session|assistance with an assignment|where we stand with cash|help is needed with an assignment|secretly handle|calls are off.?limit|number I can contact you|it\'s now overdue|can you handle|email back regarding|executive meeting currently|engaged in a virtual meeting|limited to call|Puis(?:\-|\s)je envoyer .{8,32} maintenant|handle the payment today|(provide|include) your whatsapp number|middle of a conference|d\x{C3}\x{BB}\s+aupr\x{C3}\x{A8}s|I\'m currently unavailable to handle this myself|assistance in purchasing these gift|(watch|look|eye) ?out for my text|have any of these payment platform|please set up the vendor and make payment|handled confidentially|confidential until|in a virtual meeting|traiter pour paiement|before my next appointment|find the attached invoice|prompt attention to this request|in a long zoom|just for emergency purpose|appreciate your discretion|no access to phone/i # oddlang body __KAM_BEAL6 /sent from my ?mail|depuis mon smartphone|\- Forwarded Message \-|I\'ll need you run/i meta KAM_BEAL (__KAM_BEAL1 + (__KAM_BEAL3 && ! __KAM_NOT_BEAL3) >= 1) && ((SPF_SOFTFAIL + FREEMAIL_FROM + FREEMAIL_FORGED_REPLYTO + __KAM_BEAL2 + KAM_RAPTOR_EXTERNAL >= 1) + __KAM_BEAL4 + __KAM_BEAL5 + __KAM_BEAL6 >= 3) && !EXTRACTTEXT describe KAM_BEAL IMPOSTER! Will the real Slim Shady, please stand up? score KAM_BEAL 16.0 if can(Mail::SpamAssassin::Conf::feature_subjprefix) subjprefix KAM_BEAL [Imposter] endif meta KAM_BEAL2 (__KAM_BEAL1 >= 1) && (__KAM_BEAL3 >= 1 && ! __KAM_NOT_BEAL3) && (KAM_RAPTOR_EXTERNAL + __KAM_BEAL4 + __KAM_BEAL5 + __KAM_BEAL6 >= 2) && (KAM_BEAL <= 0) && !EXTRACTTEXT describe KAM_BEAL2 IMPOSTER! Will the real Slim Shady, please stand up? score KAM_BEAL2 12.0 if can(Mail::SpamAssassin::Conf::feature_subjprefix) subjprefix KAM_BEAL2 [Imposter] endif meta KAM_BEAL3 (__KAM_BEAL1 + __KAM_BEAL3 + FREEMAIL_FROM + KAM_RAPTOR_EXTERNAL >= 4) && ! KAM_BEAL && ! KAM_BEAL2 describe KAM_BEAL3 Likely Imposter email score KAM_BEAL3 6.0 meta KAM_FREENEW_BEAL ( __KAM_BEAL1 && KAM_RAPTOR_EXTERNAL && KAM_RAPTOR_NEW && FREEMAIL_FROM ) && ! KAM_BEAL && ! KAM_BEAL2 && ! KAM_BEAL3 describe KAM_FREENEW_BEAL Likely Imposter email score KAM_FREENEW_BEAL 1.5 endif ifplugin Mail::SpamAssassin::Plugin::RaptorOnly #EXTERNAL SENDER header KAM_RAPTOR_EXTERNAL X-Raptor-External =~ /Yes/i describe KAM_RAPTOR_EXTERNAL Raptor identified an External Sender score KAM_RAPTOR_EXTERNAL 0.1 endif #PROJECT header __KAM_PROJECT1 Subject =~ /Project/i body __KAM_PROJECT2 /business project/i body __KAM_PROJECT3 /email is active/i body __KAM_PROJECT4 /please respond/i meta KAM_PROJECT (__KAM_PROJECT1 + __KAM_PROJECT2 + __KAM_PROJECT3 + __KAM_PROJECT4 >= 4) describe KAM_PROJECT Scam inquiries about amorphous projects score KAM_PROJECT 6.0 #FAKEWESTERN header __KAM_FAKEWEST1 Subject =~ /Attention/i body __KAM_FAKEWEST2 /Western Union/i body __KAM_FAKEWEST3 /United Nation/i body __KAM_FAKEWEST4 /Wrong Transfer/i body __KAM_FAKEWEST5 /0[\.,]?000[\.,]?00\s?USD/i meta KAM_FAKEWEST (__KAM_FAKEWEST1 + __KAM_FAKEWEST2 + __KAM_FAKEWEST3 + __KAM_FAKEWEST4 + (__KAM_FAKEWEST5 + LOTS_OF_MONEY >= 1) >= 5) describe KAM_FAKEWEST Fake money Transfer Scam score KAM_FAKEWEST 6.0 #FAKEDROPBOX header __KAM_FAKEDROPBOX2_1 Subject =~ /on Dropbox/i meta KAM_FAKEDROPBOX2 (__KAM_FAKEDROPBOX2_1 + KAM_SHORT + FREEMAIL_FROM >= 3) describe KAM_FAKEDROPBOX2 Fake Dropbox Phish score KAM_FAKEDROPBOX2 4.5 header __KAM_FAKEDROPBOX3_1 Subject =~ /new dropbox message/i uri __KAM_FAKEDROPBOX3_2 /wp\-includes/i meta KAM_FAKEDROPBOX3 (__KAM_FAKEDROPBOX3_1 + __KAM_FAKEDROPBOX3_2 >= 2) describe KAM_FAKEDROPBOX3 Fake Dropbox Phish score KAM_FAKEDROPBOX3 6.0 #FAKEMONEYGRAM header __KAM_FAKEMONEYGRAM1 From =~ /Money.?Gram/i meta KAM_FAKEMONEYGRAM (__KAM_FAKEMONEYGRAM1 + FREEMAIL_FROM >= 2) describe KAM_FAKEMONEYGRAM Fake Moneygram Phish score KAM_FAKEMONEYGRAM 5.5 #FAKESHAREPOINT - SEE FAKE_SHAREPOINT2 for Sexually explicit header __KAM_FAKE_SHAREPOINT1 Subject =~ /(via|by) Sharepoint|payment reminder|shared|Request for Quot|urgent|far from you|unopened invoice/i header __KAM_FAKE_SHAREPOINT2 from =~ /sharepoint|accounts? payable|RFQ/i uri __KAM_FAKE_SHAREPOINT3 /my\.sharepoint\.com/i uri __KAM_FAKE_SHAREPOINT3A /appdomain\.cloud|discordapp\.com|netlify\.app/i body __KAM_FAKE_SHAREPOINT4 /Sharepoint Fileshare|open.me.{0,3}asap|link will only work|our automated system noticed/i ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __KAM_FAKE_SHAREPOINT5 Content-Type =~ /.html?\"?$/i endif # meta KAM_FAKE_SHAREPOINT (__KAM_FAKE_SHAREPOINT1 + __KAM_FAKE_SHAREPOINT2 + (__KAM_FAKE_SHAREPOINT3 + __KAM_FAKE_SHAREPOINT3A + KAM_STORAGE_GOOGLE + __KAM_FAKE_SHAREPOINT4 + KAM_SHORT >= 1) + __KAM_FAKE_SHAREPOINT5 >= 3) meta KAM_FAKE_SHAREPOINT ( ( __KAM_FAKE_SHAREPOINT1 + __KAM_FAKE_SHAREPOINT2 + __KAM_FAKE_SHAREPOINT5 >= 2 ) && (__KAM_FAKE_SHAREPOINT3 + __KAM_FAKE_SHAREPOINT3A + __KAM_FAKE_SHAREPOINT4 + KAM_STORAGE_GOOGLE + KAM_SHORT + GOOG_REDIR_NOTRDNS >= 2 ) ) describe KAM_FAKE_SHAREPOINT Fake Sharepoint Phish score KAM_FAKE_SHAREPOINT 6.0 #MORE FAKE SHAREPOINT BAD LINKS IN A SHAREPOINT MESSAGE meta KAM_FAKE_SHAREPOINTLINK (__KAM_FAKE_SHAREPOINT1 + __KAM_FAKE_SHAREPOINT2 + (__KAM_FAKE_SHAREPOINT3A + KAM_STORAGE_GOOGLE + KAM_SHORT) >= 3) && !KAM_FAKE_SHAREPOINT describe KAM_FAKE_SHAREPOINTLINK Fake Sharepoint Link Phish score KAM_FAKE_SHAREPOINTLINK 4.5 #Fake document share ifplugin Mail::SpamAssassin::Plugin::RaptorOnly header __GB_SUBJ_DOC_FROM Subject =~ /^Document from/i body __GB_SECURE_DOC /SECURED DOCUMENT/ meta GB_FAKE_SECURE_DOC ( KAM_RAPTOR_NEW && __GB_SECURE_DOC && __GB_SUBJ_DOC_FROM ) score GB_FAKE_SECURE_DOC 3.5 endif #ENCRYPTED ZIP body __KAM_BADZIP1 /attached (to email|document)|take a look|send this fax/i body __KAM_BADZIP2 /Encrypted zip|File password/i uri __KAM_BADZIP2A /drive.google.com.*export=download/i body __KAM_BADZIP3 /(order|urgent|report|dialogue|reminder)/i body __KAM_BADZIP4 /password:/i meta KAM_BADZIP (__KAM_BADZIP1 + (__KAM_BADZIP2 + __KAM_BADZIP2A >= 1) + __KAM_BADZIP3 + __KAM_BADZIP4 >= 4) describe KAM_BADZIP Encrypted Zip File Indicating a Scam score KAM_BADZIP 6.0 #VERIZON SCAM header __KAM_VERIZON1 Subject =~ /verizon wireless security message/i header __KAM_VERIZON2 From:name =~ /Verizon/i header __KAM_VERIZON3 From:addr !~ /verizon/i #What body __KAM_VERIZON4 /Update required immediately/i #how body __KAM_VERIZON5 /update your account information/i #Problem body __KAM_VERIZON6 /deactivated/i #Money body __KAM_VERIZON7 /credit card|bank account/i meta KAM_VERIZON (__KAM_VERIZON1 + __KAM_VERIZON2 + __KAM_VERIZON3 >= 3) && (__KAM_VERIZON4 + __KAM_VERIZON5 + __KAM_VERIZON6 + __KAM_VERIZON7 >= 3) describe KAM_VERIZON Fake Wireless account notices score KAM_VERIZON 9.5 #Docusign SCAM header __KAM_DOCUSIGN1 Subject =~ /New e-DocuSign Signature|new e-signature docusign|docusign electronic signature|transfer notice|docusign (electronic|signature) service|docusign document|please_complete_document|Complete via DocuSign/i header __KAM_DOCUSIGN2 From:name =~ /docusign/i header __KAM_DOCUSIGN2A From:name =~ /docusign|docshare/i header __KAM_DOCUSIGN3 From:addr !~ /docusign/i uri __KAM_DOCUSIGN4 /\.weebly\.com|docs\.google\.com|onedrive\.live\.com|\.linodeobjects\.com|\.oraclecloud\.com|\.cubbit\.eu/i body __KAM_DOCUSIGN5A /scan the QR Code/i body __KAM_DOCUSIGN5B /secure link to docusign/i meta KAM_DOCUSIGN ((__KAM_DOCUSIGN1 >= 1) + (__KAM_DOCUSIGN2 + __KAM_DOCUSIGN3 >= 2) + (FREEMAIL_FROM + LOTS_OF_MONEY + __KAM_DOCUSIGN4 >= 1) >= 3) describe KAM_DOCUSIGN Fake Document Signature account notices score KAM_DOCUSIGN 4.5 meta KAM_DOCUSIGN_LOW (__KAM_DOCUSIGN1 + __KAM_DOCUSIGN4 >= 2) describe KAM_DOCUSIGN_LOW Lower score Fake Document Signature Account Notice score KAM_DOCUSIGN_LOW 3.0 meta KAM_DOCUSIGN_QR ((__KAM_DOCUSIGN1 >= 1) + (__KAM_DOCUSIGN2 + __KAM_DOCUSIGN3 >= 2) + (__KAM_DOCUSIGN5A + __KAM_DOCUSIGN5B >= 2) >= 3) describe KAM_DOCUSIGN_QR Qishing scam with Docusign score KAM_DOCUSIGN_QR 4.5 ifplugin Mail::SpamAssassin::Plugin::URIDetail header __GB_DOCUSIGN_TOPIC Thread-Topic =~ /Complete via DocuSign/i body __GB_FAKE_DOCUSIGNB /review(?:\s+|\_)document|view (completed\s+)?document|document to review/i uri_detail __GB_FAKE_DOCUSIGNU cleaned =~ /\.google\.(?:com|es|it|hu)|demo\.docusign\.net|\.pages\.dev|\.html/ text =~ /(?:review|view completed) document|review and sign|review document|view_doc/i meta GB_FAKE_DOCUSIGN ( ( __KAM_DOCUSIGN2A + __GB_DOCUSIGN_TOPIC >= 1) && ( __KAM_DOCUSIGN3 || __GB_M365_SPAM ) && __GB_FAKE_DOCUSIGNB && ( __KAM_FAKE_EFAX4 || __GB_FAKE_DOCUSIGNU || GOOG_REDIR_DOCUSIGN || __GB_ANY_REDIR ) ) describe GB_FAKE_DOCUSIGN Fake Docusign email score GB_FAKE_DOCUSIGN 6.0 endif uri __GB_SHAREPOINT /\.sharepoint\.com\//i meta GB_DOCUSIGN_G_SHARE ( GOOG_REDIR_DOCUSIGN && __GB_SHAREPOINT ) describe GB_DOCUSIGN_G_SHARE Google redirector to Docusign and a Sharepoint link score GB_DOCUSIGN_G_SHARE 1.0 header __GB_FROM_MICROSOFT From:addr =~ /\@microsoft\.com/ meta GB_FAKE_SIGNED_MICROSOFT ( __GB_FROM_MICROSOFT && KAM_ONMICROSOFT_RF && DKIM_VALID_AU ) describe GB_FAKE_SIGNED_MICROSOFT Fake Microsoft signed emails score GB_FAKE_SIGNED_MICROSOFT 3.0 #Client Fake Invoice ifplugin Mail::SpamAssassin::Plugin::MIMEHeader header __KAM_FAKEINV1 From =~ /headoffice/i header __KAM_FAKEINV1A Reply-to =~ /no.?reply\@/i body __KAM_FAKEINV2 /dearest client/i mimeheader __KAM_FAKEINV3 Content-Type =~ /.xls\"?$/i meta KAM_FAKEINV ((__KAM_FAKEINV1 + __KAM_FAKEINV1A >=1) + __KAM_FAKEINV2 + __KAM_FAKEINV3 >=3) describe KAM_FAKEINV Fake Customer Invoices score KAM_FAKEINV 4.5 endif #IMAGE ONLY meta KAM_IMAGEONLY ( PDS_OTHER_BAD_TLD && HTML_IMAGE_ONLY_08 ) describe KAM_IMAGEONLY Email from a questionable TLD that contains primarily just an image score KAM_IMAGEONLY 0.75 #HOLIDAY 2020 GIFTS header __KAM_HOLIDAY2020_1 Subject =~ /holiday item|blac.?k friday|(vortex|illusional|this|3d).*rug|canvas print|get your (personalized christmas )?ornament|Christmas sale|novelty household|(perfect|seasonal) gift|Rising.? Stand.?|endoscope/i body __KAM_HOLIDAY2020_2 /(illusional|Vortex|3d) Rug|wireless earbuds|canvas print|get your (personalized christmas )?ornament|holiday novelty|personalized ornament|rising laptop|HOME Ear endoscope|Gadget ?Junk/i tflags __KAM_HOLIDAY2020_2 nosubject header __KAM_HOLIDAY2020_3 From =~ /vortex|christmas|novelty|(laptop|new).?tech|rising.?stand|Clean.?ear|Massager/i meta KAM_HOLIDAY2020 (__KAM_HOLIDAY2020_1 + __KAM_HOLIDAY2020_2 + __KAM_HOLIDAY2020_3 >= 2) describe KAM_HOLIDAY2020 Holiday Gifts 2020 Spam score KAM_HOLIDAY2020 4.0 #GOOGLE FORM uri __KAM_GOOGLEFORM_1 /docs\.google\.com\/forms\//i body __KAM_GOOGLEFORM_2 /Untitled|Formulaire sans titre/i body __KAM_GOOGLEFORM_3 /foundation is donating/i meta KAM_GOOGLEFORM (__KAM_GOOGLEFORM_1 + (__KAM_GOOGLEFORM_2 + __KAM_GOOGLEFORM_3 >= 1) >= 2) describe KAM_GOOGLEFORM Untitled or Spam Google Form score KAM_GOOGLEFORM 4.0 header __GB_RETPATH_GOOG_TRIX Return-Path =~ /\@trix\.bounces\.google\.com/ meta GB_RETPATH_GOOG_TRIX ( __GB_RETPATH_GOOG_TRIX && !ENVFROM_GOOG_TRIX ) describe GB_RETPATH_GOOG_TRIX Email from Google subdomain being abused by spammers score GB_RETPATH_GOOG_TRIX 1.00 #BENEFICIARY FAKE FORM body __KAM_DISCLOSE1 /enable me disclose|indicate your? interest|something important/i meta KAM_FAKEFORM ((__KAM_DISCLOSE1 + LOTS_OF_MONEY >= 1) + (__KAM_BENEFICIARY2 + __KAM_BENEFICIARY4 + __KAM_BENEFICIARY6 >= 1) + (__KAM_GOOGLEFORM_1 >= 1) >= 3) describe KAM_FAKEFORM Fake Form for Scams score KAM_FAKEFORM 4.0 #2ND AMMENDMENT body __KAM_2ND_1 /police can no longer be trusted|protect yourself|anti-?gun ban|no classes/i body __KAM_2ND_2 /2nd am?mendment|concealed carry|right to carry/i header __KAM_2ND_3 From =~ /2nd amm?endment|Concealed/i meta KAM_2ND ((__KAM_FUN1 + __KAM_FUN1A >= 1) + __KAM_2ND_1 + __KAM_2ND_2 + __KAM_2ND_3 >= 3) describe KAM_2ND Political / 2nd Ammendement Spam score KAM_2ND 4.5 #SPAM DU JOUR - MASKS body __KAM_KN_1 /(respirator|KN95) .{0,25}Mask|Ultramasx|upgrade your mask/i tflags __KAM_KN_1 nosubject body __KAM_KN_2 /get your|for the public|biden wants to curb|Prevent Corona|quick delivery|do your part|while supplies last|(smart|your) mask/i tflags __KAM_KN_2 nosubject header __KAM_KN_3 Subject =~ /KN95 .{0,25}Mask|(curb|curve?)(ing)? C<O1>vid|(your|mandates?) mask|ultimate protection|Protective (face )?mask/i header __KAM_KN_4 From =~ /KN95|(smart|Face) ?Mask|Mask.?(dept|Special)|Stay ?safe|protective ?gear|World ?safe/i meta KAM_KN (__KAM_KN_1 + __KAM_KN_2 + __KAM_KN_3 + __KAM_KN_4 >= 3) describe KAM_KN Spam Du Jour for Masks score KAM_KN 4.5 #SPAM DU JOUR - BAD CREDIT body __KAM_BADCRED_1 /bad credit/i tflags __KAM_BADCRED_1 nosubject header __KAM_BADCRED_2 Subject =~ /bad credit.*off track/ meta KAM_BADCRED (__KAM_BADCRED_1 + __KAM_BADCRED_2 >= 2) describe KAM_BADCRED Spam Du Jour for Bad Credit score KAM_BADCRED 3.0 #SPAM DU JOUR - SPO2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_rules __KAM_SPO2_2 __KAM_SPO2_3 body __KAM_SPO2_1 /pulse oximeter|touchless thermometer/i body __KAM_SPO2_2 /C<O1>VID/i tflags __KAM_SPO2_2 nosubject header __KAM_SPO2_3 Subject =~ /C<O1>VID.*(screening|oximeter)|Laser Thermometer|(detecting|screening) C<O1>VID/i header __KAM_SPO2_4 From =~ /health|infrared|oximeter|Painless/i meta KAM_SPO2 (__KAM_SPO2_1 + __KAM_SPO2_2 + __KAM_SPO2_3 + __KAM_SPO2_4 >= 3) describe KAM_SPO2 COVID Spams score KAM_SPO2 4.5 endif #SPAM DU JOUR - HEATED VEST body __KAM_VEST1 /(heated|thermal) vest/i tflags __KAM_VEST1 nosubject header __KAM_VEST2 Subject =~ /stay toasty/i header __KAM_VEST3 From =~ /thermal vest/i meta KAM_VEST (__KAM_VEST1 + __KAM_VEST2 + __KAM_VEST3 >= 3) describe KAM_VEST Spam Du Jour for Vests score KAM_VEST 4.5 #FAKE CVS header __KAM_CVS1 From =~ /CVS Pharm/i header __KAM_CVS1A From:addr !~ /\@cvs.com/i body __KAM_CVS2 /CVS/ tflags __KAM_CVS2 nosubject header __KAM_CVS3 Subject =~ /CVS Pharm/i meta KAM_CVS ((__KAM_CVS1 + (FREEMAIL_FROM + __KAM_CVS1A >= 1) >= 2) + __KAM_CVS2 + __KAM_CVS3 >= 3) describe KAM_CVS Fake CVS Spams score KAM_CVS 6.0 #HACKED EXPLOIT body __KAM_HACK1 /(phone|electronic|computer) have been hacked|suspected online scam/i body __KAM_HACK2 /read attached|click here for verification/i body __KAM_HACK3 /save yourself|lead to your arrest/i header __KAM_HACK4 From:name =~ /justice dep/i meta KAM_HACK (__KAM_HACK1 + __KAM_HACK2 + __KAM_HACK3 + __KAM_HACK4 >= 3) describe KAM_HACK Hacker Exploitation Email score KAM_HACK 4.5 #FAKE INVOICES ifplugin Mail::SpamAssassin::Plugin::MIMEHeader header __KAM_FAKEINV2_1 Subject =~ /lnv (remittance|\& check)/i body __KAM_FAKEINV2_2 /(find|see) (the )?attach/i body __KAM_FAKEINV2_3 /not mail the check|typeform\.com/i mimeheader __KAM_FAKEINV2_4 Content-Type =~ /(ACH W[il]re|Rem[il]ttance adv[il]ce).*xls/i meta KAM_FAKEINV2 (__KAM_FAKEINV2_1 + __KAM_FAKEINV2_2 + __KAM_FAKEINV2_3 + __KAM_FAKEINV2_4 >= 3) describe KAM_FAKEINV2 Fake Invoice Scams score KAM_FAKEINV2 6.0 endif #FAKE ADS header __KAM_FAKEAD1 Subject =~ /brand medication|stubborn fat/i body __KAM_FAKEAD2 /click here to UNSUBSCRIBE|start shopping|here\'s how/i uri __KAM_FAKEAD3 /\/bit\.ly/i body __KAM_FAKEAD4 /Sweet passion|no plastic surgery/i meta KAM_FAKEAD (__KAM_FAKEAD1 + __KAM_FAKEAD2 + __KAM_FAKEAD3 + __KAM_FAKEAD4 >= 4) describe KAM_FAKEAD Fake Advertisements score KAM_FAKEAD 6.0 #FAKE REGISTRY SCAMS body __KAM_FAKE_REGISTRY1 /www(\.|\(dot\))(chinanameregistry|china\-registry|domainregistryasia)(\.|\(dot\))(net|com)|www\(dot\)domainregistry\(dot\)org\(dot\)cn/i uri __KAM_FAKE_REGISTRY2 /domainregistryasia\.net|domainregistryasia\.cn/i meta KAM_FAKE_REGISTRY (__KAM_FAKE_REGISTRY1 + __KAM_FAKE_REGISTRY2 >= 1) describe KAM_FAKE_REGISTRY Fake Domain Registry Scammers trying to get you to buy unneeded domains score KAM_FAKE_REGISTRY 5.0 #FAKE Fax ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __KAM_FAKE_FAX1 Content-Type =~ /.*(fax).*\.htm/i endif body __KAM_FAKE_FAX2 /(new|incoming) fax|fax received/i header __KAM_FAKE_FAX3 Subject =~ /Fax|new (message|document)/i body __KAM_FAKE_FAX4 /invoice|xerox scanner|recipient view only|click below to view your fax|refer to attachment/i tflags __KAM_FAKE_FAX4 nosubject uri __KAM_FAKE_FAX5 /\/s3\.|quarantine|myqcloud/i meta KAM_FAKE_FAX ((T_HTML_ATTACH + __KAM_FAKE_FAX1 + __KAM_FAKE_FAX5 >= 1) + __KAM_FAKE_FAX2 + __KAM_FAKE_FAX3 + __KAM_FAKE_FAX4 >= 4) describe KAM_FAKE_FAX Fake Fax Scam score KAM_FAKE_FAX 8.0 meta KAM_FAKE_FAX2 ( T_HTML_ATTACH + GB_BADJS + __KAM_FAKE_FAX1 + __KAM_FAKE_FAX3 >= 4 ) && !KAM_FAKE_FAX describe KAM_FAKE_FAX2 Fake Fax Scam score KAM_FAKE_FAX2 8.0 #FAKE TRUST body __KAM_FAKE_TRUST1 /Message is from a .{0,40}trusted source/i meta KAM_FAKE_TRUST (__KAM_FAKE_TRUST1 >= 1 ) describe KAM_FAKE_TRUST Scams about trusted sources score KAM_FAKE_TRUST 3.5 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader #SHTML ATTACHMENT ADD TO T_HTML_ATTACH! - 2022-01-14 mimeheader __KAM_SHTML_ATTACH Content-Type =~ /\b(application\/octet-string|text\/html)\b.+\.shtml?\b/i endif #HTML ATTACHMENTS WITH FUNCTIONS AND EVALS rawbody __GB_JS_UNESCAPE /document\.write(?:\s+)?\((?:\s+)?(?:atob|unescape|decodeURIComponent)|\=unescape\(.{1,10}\;document\.write|\=\s+atob\(|document\.createElement\(\"script\"/ rawbody __GB_JS_FUNCTION /(?:\=|\:)"?(?:function|eval)\(/ rawbody __GB_JS_OBFU /(?:script\s+src|onload)="?(?:\&\#x|data\:text\/javascript)|\<svg\s+onload\=|var\s+_0x[a-z0-9]{1,6}(?:\s+)?\=|window\.(?:atob|location|href)/ meta GB_BADJS ( ( __GB_JS_UNESCAPE || __GB_JS_FUNCTION || __GB_JS_OBFU ) && ( __KAM_SHTML_ATTACH || T_HTML_ATTACH || T_OBFU_HTML_ATTACH || UNICODE_OBFU_ASC ) ) describe GB_BADJS Bad html attachment score GB_BADJS 4.0 #HTML FORM ATTACHED rawbody __GB_HTML_FORM /\<form\s+.{1,250}(?:method\=|action\=|id\=).{0,100}>/is meta GB_HTML_FORM ( __GB_HTML_FORM && ( T_HTML_ATTACH || T_OBFU_HTML_ATTACH || UNICODE_OBFU_ASC ) ) describe GB_HTML_FORM Html form attached score GB_HTML_FORM 4.0 #FAKE INVOICE header __KAM_FAKE_INVOICE1 Subject =~ /(remittance|payment) (receipt|advice)|past.?due|purchase order|(ACH|EFT) (remittance|payment)|invoice (\#|copy)|swift confirmation|overdue invoice|attached receipt|payment confirmation/i body __KAM_FAKE_INVOICE2 /(remittance|Payment) (advice|confirmation|breakdown)|past due invoice|new pro.?forma|attach(ed|ment)|balance paid|proforma invoice/i tflags __KAM_FAKE_INVOICE2 nosubject meta KAM_FAKE_INVOICE ((T_HTML_ATTACH + __KAM_SHTML_ATTACH + KAM_RAPTOR_ALTERED + OLEMACRO_URI_TARGET >= 1) + __KAM_FAKE_INVOICE1 + __KAM_FAKE_INVOICE2 >= 3) describe KAM_FAKE_INVOICE Fake Invoice / Purchase Order Scam score KAM_FAKE_INVOICE 6.4 #BAD PRODUCTS header __KAM_BAD_PRODUCT1 Subject =~ /Dolphin Vacuum|Warm any room|rapid thaw/i body __KAM_BAD_PRODUCT2 /Dolphin sealer|hotstreak plug|Rapid thaw tray/i meta KAM_BAD_PRODUCT (__KAM_BAD_PRODUCT1 + __KAM_BAD_PRODUCT2 >= 2) describe KAM_BAD_PRODUCT Spammy Products score KAM_BAD_PRODUCT 3.0 #BAD LINK uri __KAM_BAD_LINK1 /\.pdf\.iso$/i meta KAM_BAD_LINK (__KAM_BAD_LINK1 >= 1) describe KAM_BAD_LINK Potentially dangerous link in email score KAM_BAD_LINK 10.0 #.WELL KNOWN uri __KAM_WELL_KNOWN1 /\.well\-known\//i meta KAM_WELL_KNOWN ( __KAM_WELL_KNOWN1 >= 1 ) describe KAM_WELL_KNOWN Link to .well-known directory found in email score KAM_WELL_KNOWN 2.5 #BAD CITIZENS header __KAM_FAKE_CITIZEN1 Subject =~ /Citizens Bank Ealert/i body __KAM_FAKE_CITIZEN2 /Important (message|Notice) From Citizens/i uri __KAM_FAKE_CITIZEN3 /phpmailer|wp-admin/i header __KAM_FAKE_CITIZEN4 From:name =~ /Citizens ?Bank/i header __KAM_FAKE_CITIZEN5 From:addr !~ /citizen/i meta KAM_FAKE_CITIZEN (__KAM_FAKE_CITIZEN1 + __KAM_FAKE_CITIZEN2 + (KAM_SHORT + __KAM_FAKE_CITIZEN3 + KAM_WELL_KNOWN >= 1) + __KAM_FAKE_CITIZEN4 + (__KAM_FAKE_CITIZEN5 + SPF_FAIL >= 1) >= 5) describe KAM_FAKE_CITIZEN Fake Bank Alert Scam score KAM_FAKE_CITIZEN 7.5 #BAD PRODUCTS header __KAM_PRODUCT2_1 Subject =~ /meal delivery|no chopping|(sticker|Children'?s?) book|\$[\d,\.]{5,10} Fast|Car ?Shield|Top Vet|Chew a day|trugreen|(perfect|healthy|your) lawn|slice.?n.?seal|kitchen (device|gadget)|butter knive|small penis|make you bigger|(explosive|increase) size|ACs|Wifi Booster|anti.?snore|visceral fat|solar ?bright|mini a\/?c|portable (cooler|air.?condition)|keep cool|wife.caught|banned technique/i body __KAM_PRODUCT2_2 /meal delivery|no chopping|i ?can ?read|zippy ?loan|car ?shield|Lick their paws|excessive scratching|trugreen|slice.?n.?seal|kitchen (device|gadget)|Better Butter|(elongation|growth) secret|savage.?grow|coolair|Wifi Booster|sleeplab|belly.flat|solar ?bright flood|space Cooler|coolair/i tflags __KAM_PRODUCT2_2 nosubject header __KAM_PRODUCT2_3 From =~ /veestro|i ?can ?read|zippy ?loan|car ?shieldi|petscy|trugreen|slice.?n.?seal|better.?butter|savage.?grow|CoolMe|wifi repeater|sleep.?lab|lost.?\d+lbs|solar ?bright|(mini|portable) ?A\/?C|air cooler|savage.grow/i meta KAM_PRODUCT2 ( __KAM_PRODUCT2_1 + __KAM_PRODUCT2_2 + __KAM_PRODUCT2_3 >= 3) describe KAM_PRODUCT2 Scammy Products prevalent in spam score KAM_PRODUCT2 4.5 #BAD_PDF_LINK #uri_detail KAM_PDF_FAKE text =~ /\.PDF/i cleaned =~ /\.github.io\//i #describe KAM_PDF_FAKE Links to Fake PDFs #score KAM_PDF_FAKE 5.0 #SCAM INQUIRY #what body __KAM_INQUIRY_1 /inquiry for purchase|product catalog|price list|reply with catalog/i #subj header __KAM_INQUIRY_2 Subject =~ /Purchase Order|Urgent (i|e)nquiry/i #oddities body __KAM_INQUIRY_3 /terms? (\&|and) conditions?|rightful dep/i #Forwarder body __KAM_INQUIRY_4 /certificate of origin|import\export|trading company/i meta KAM_INQUIRY (__KAM_INQUIRY_1 + __KAM_INQUIRY_2 + __KAM_INQUIRY_3 + __KAM_INQUIRY_4 >= 4) describe KAM_INQUIRY Product Inquiry Scams score KAM_INQUIRY 7.0 #FROM NAME SPAM header __KAM_FROM_NAME_FAKERBL From:name =~ /Sivagegrowplus\.com|Lifequote\.selectquote\.com|GoldAlliedTrust\.com|MeetAsianLady\.com|Betterbutterspreader\.com|americanhomewarranty\.com|Solarbrightfloodlight\.com|primevision\.website|FijiShowerSpa\.com|easylenders\.website|Burialinsurance\.com|curiousfinds\.com|professionalwhosiswho\.com/i meta KAM_FROM_NAME_FAKERBL (__KAM_FROM_NAME_FAKERBL >= 1) describe KAM_FROM_NAME_FAKERBL From name contains a URL that is spammy score KAM_FROM_NAME_FAKERBL 6.0 #FAKE NORTON ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_rules __KAM_FAKE_NORTON1 __KAM_FAKE_NORTON2 __KAM_FAKE_NORTON3 __KAM_FAKE_NORTON4 #subj header __KAM_FAKE_NORTON1 Subject =~ /IN.?VOICE *\#?NUMBER|(confirmation|ORDER|Invoice|plan.?status) ?(ID_\*|\#|Num|-?No)|\#(ORDER|BILL)|(Purchase|Order|Payment) Confirmation|(RECEIPT|INVOI?CE) ?\#|software subscription|transaction.successful|amount.debited|(subscription|service|Purchase) (renewal|request|serial) \#|renew(al|ing) (id|service) \#|(Unique|Member|purchase|Bill|receipt|service|invoice) id ?(is|:|\#)|using protection|<O1>rder <I1>d|IN(\-|_)VOICE (Number|ID)|Product Id:|security renewal|(Buyer'?s|purchase) receipt|order worth \$|service notice.{0,3}\d+|antivirus activated|order has been (confirmed|processed)|subscription expired|your bill|auto renewal|new message|renewal notice:|annual subscription|transaction code|account key verif|billing team|service required|g-?squad|plan (upgraded|activated)|protection alert|order process|payment success|renewal complete|Purchase order for \$\d|payment is processed|confirmation of your product|upcoming due date/i header __KAM_FAKE_NORTON1A To =~ /norton|billing\@geeksquad/i header __KAM_FAKE_NORTON1B From =~ /norton|confirmation|no.?reply|service.?updates|billing|devices.?support|service.?dep|order|device.?alert|biliing|receipt|(payment|account).?team/i #Fuzzy Prod body __KAM_FAKE_NORTON2 /N<O1>RT<O1>N(\(?tm\)?|\#)|360 (anti.?virus|Security|protection)|N<O1>rt<O1>N.?Life|norton (\- )?(360|security|deluxe|protection|firewall|plus family)|(nort-.|norton|Mcafee) (Web Pro|Web|Plus(\+| Pro)|pro (net|plus|protection)|all.?round) ((Secure|Family) )?Protection|norton (plan|pro life lock)|(service (name)?|item|Product):?\s+(Norton|Nort.?Pro|geek.?squad)|norton secure plus|nort-(Advance|Pro)|nort-?one 360|life-?lock pro|mal-?ware bites|geeksquad-solutions|Geek(squad)? 360|renewal through geeksquad|Geek Secure Premium|Shield Protection Renewal|G<E1><E1><K1>.?squad security|(symantec|mcafee|norton|geek).{0,3}total (secure|protection)|geek.?squad.?corp|norton billing team|firewall defender|geek.? advanced network|pro geek PC protection|SQUAD anti-?virus|Norton,? Inc|G<E1><E1>k\s+squ<A1>d|Windows Defender Advanced|Netwrk Shield Protection|(pc|network) (security|protection) (service|shield)|previous annual subscription|windows defender security|norton Tech pc support|\(defender\)|premium protection|norton membership|ant<I1>v<I1>rus \(?ultimate|geek standard upfront|Select Powerful Protection|<M1>cA\&fnof\;ee|<M1><C1><A1>Fee Subscription|PC Guard Protection|mcafee as your security software|Your security.{0,2} now safeguarded|InsightSecure Scanners|delux protection|Stealthsecure cyber|Office 365 - Abc|service\: Security Measure/mi #Oddlang body __KAM_FAKE_NORTON3 /Esteem your assessment|enhance our administration|recharged your club|looking for patron|delight and happiness|touch our group|confirmatory e?mail|customer service board|connect with expert|for transaction|confirmation range|did not place this order|cancel (your|this|the) (membership|service|subscription)|team norton|(claim a|instant) refund|cancel (or continue )?the plan|for more query|void (this|the) charge|account is debited|kindly activate the license|A\/C statement|you can trust them|drop you an email|don't want this plan|deactivate this plan|queries or doubt|issues? with (your order|the transaction)|feel free to contact|hesitate to call|appritiate your decesion|Warm (regards|respects)|(wish|want) (to )?cancel|order +worth +\$|plan has been enacted|change something|salutations|any query related|norton billing team|same has been processed|an confirmation|don\'t want to renew|remove auto-debit|auto renewal request|thanks\/norton|invalidate your subscription|precept copy|payment method.{1,10}on-?line|drop the membership|generously go ahead|want a refund|renewal tenure|believe an unauthorized|contact microsoft for a full refund|\*\-\* (8\-8\-8|8\-5\-0) \*\-\*|really want further explanation|disc<O1>unt benevolently|upgrade or postpone|get the full refund|valued member of us|find the attachment of your invoice|drop the charges|norton.{0,2}helpdesk|cancel service|not placed the order|within the next two hour|payment network regulation|open a dispute|cancellation, call us|think this is not authorized|process withing \d+ hour|renewed for four year,/i tflags __KAM_FAKE_NORTON3 nosubject #Order body __KAM_FAKE_NORTON4 /(bank|Auto(matic)?)-?.?-?(debit|renew)|Updated to premium|order is p<L1>aced|0rder|renewal|successfully (placed|renewed)|(repetitive|annual) charge|have been modified|In_voice id|details pertain|auto pay|online\/card|joined our security program|payment_for_services|yearly payment|\$[\d\.]+ will appear|renewed your product|subscription has been renewed/i tflags __KAM_FAKE_NORTON4 nosubject meta KAM_FAKE_NORTON (__KAM_FAKE_NORTON1 + (__KAM_FAKE_NORTON1A + __KAM_FAKE_NORTON1B + FREEMAIL_FROM >= 1)+ __KAM_FAKE_NORTON2 + __KAM_FAKE_NORTON3 + __KAM_FAKE_NORTON4 + FREEMAIL_FROM >= 4) && __KAM_FAKE_NORTON2 describe KAM_FAKE_NORTON Fake Norton / McAfee / Geek Squad / Symantec / etc. Renewal Notices score KAM_FAKE_NORTON 8.0 meta KAM_FAKE_NORTONLOW (__KAM_FAKE_NORTON1 + (__KAM_FAKE_NORTON1A + __KAM_FAKE_NORTON1B + FREEMAIL_FROM >= 1) + __KAM_FAKE_NORTON2 + __KAM_FAKE_NORTON3 + __KAM_FAKE_NORTON4 >= 3) && !KAM_FAKE_NORTON && __KAM_FAKE_NORTON2 describe KAM_FAKE_NORTONLOW Fake Norton / McAfee / Geek Squad / Symantec / etc. Renewal Notices (Lower Confidence) score KAM_FAKE_NORTONLOW 6.5 meta KAM_FAKE_NORTON2 (__KAM_FAKE_NORTON3 + KAM_EVIL_NUMBERS4 + FREEMAIL_FROM >= 3) describe KAM_FAKE_NORTON2 Fake Norton / McAfee / Geek Squad / Symantec / etc. Renewal Notices score KAM_FAKE_NORTON2 5.0 endif #FAKE NORTON WITH OBFU #SUPPORT body __KAM_FAKE_NORTON_OBFU1 /contact Norton Support at/i #OBFU # body __KAM_FAKE_NORTON_OBFU2 /\+[I1].?\((\d|I){3}\).?(\d|I){3}.?(\d|I){4}/i #Pay body __KAM_FAKE_NORTON_OBFU3 /Requesting Payment/i #__KAM_FAKE_NORTON_OBFU4 TBD: Capture OBFU2 and see if I is in it as a condition meta KAM_FAKE_NORTON_OBFU ( __KAM_FAKE_NORTON_OBFU1 + __KAM_FAKE_NORTON_OBFU2 + __KAM_FAKE_NORTON_OBFU3 >= 3) describe KAM_FAKE_NORTON_OBFU Fake Norton Renewal Notices score KAM_FAKE_NORTON_OBFU 4.5 #FAKE CHASE BANK header __KAM_FAKE_CHASE1 Subject =~ /unusual activit|security/i body __KAM_FAKE_CHASE2 /chase online/i body __KAM_FAKE_CHASE3 /Fraud Protection|unusual activity/i header __KAM_FAKE_CHASE4 From:name =~ /chase online/i header __KAM_FAKE_CHASE5 From:addr !~ /chase/i meta KAM_FAKE_CHASE (__KAM_FAKE_CHASE1 + __KAM_FAKE_CHASE2 + __KAM_FAKE_CHASE3 + __KAM_FAKE_CHASE4 + __KAM_FAKE_CHASE5 >= 5) describe KAM_FAKE_CHASE Fake Bank Notice score KAM_FAKE_CHASE 4.5 #FAKE CANADA POST body __KAM_FAKE_CAN_POST1 /package is (waiting|on hold)/i ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_rules __KAM_FAKE_CAN_POST2 body __KAM_FAKE_CAN_POST2 /<C1><A1>n<A1>d<A1>.{0,2}<P1><O1>st/i endif body __KAM_FAKE_CAN_POST3 /require additional details|online verification/i body __KAM_FAKE_CAN_POST4 /redelivery|confirm the payment/i header __KAM_FAKE_CAN_POST5 From:addr !~ /\.ca$/i header __KAM_FAKE_CAN_POST6 From:name =~ /canada.?post|Postes.?Canada/i header __KAM_FAKE_CAN_POST6B From:addr =~ /shipping/i meta KAM_FAKE_CAN_POST (__KAM_FAKE_CAN_POST1 + __KAM_FAKE_CAN_POST2 + __KAM_FAKE_CAN_POST3 + __KAM_FAKE_CAN_POST4 + __KAM_FAKE_CAN_POST5 + (__KAM_FAKE_CAN_POST6 + __KAM_FAKE_CAN_POST6B >= 1) >= 6) describe KAM_FAKE_CAN_POST Fake Canada Post Scam score KAM_FAKE_CAN_POST 9.0 #CARING header __KAM_CARING1 Subject =~ /Great in Bed|(looking|Searching) +for +a +(shag|(determined|caring|loving) +(man|guy|dude))/i body __KAM_CARING2 /shagged|lovemate|online dating|affair|hook.?up/i tflags __KAM_CARING2 nosubject body __KAM_CARING3 /(recent|my) (contact|picture|photo)/i body __KAM_CARING4 /unsub/i meta KAM_CARING (__KAM_CARING1 + __KAM_CARING2 + __KAM_CARING3 + __KAM_CARING4 >= 4) describe KAM_CARING Catfishing and related scams score KAM_CARING 6.0 #FAKE POLICY #OBFU HEADER header __KAM_POLICY1 Subject =~ /PoIicy Update/i #HR header __KAM_POLICY2 From:name =~ /HR/i #POLICY body __KAM_POLICY3 /Attached policy|section can proceed/i #Attach ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __KAM_POLICY4 Content-Type =~ /\.html?"?$/i endif meta KAM_POLICY ((__KAM_POLICY1 + __KAM_POLICY4 >= 1) + __KAM_POLICY2 + __KAM_POLICY3 >= 3) describe KAM_POLICY Fake policy email phish score KAM_POLICY 4.5 #CBT Scraper body KAM_CBTSCRAP /CBT (website scraper|Email Extractor)/i describe KAM_CBTSCRAP Spamming tool score KAM_CBTSCRAP 5.0 #PIP/FOREX header __KAM_FOREX1 From =~ /pip ?builder/i body __KAM_FOREX2 /1000pipbuilder/i body __KAM_FOREX3 /Forex (trading|signals)/i header __KAM_FOREX4 Subject =~ /Forex (trading|signals)/i meta KAM_FOREX (__KAM_FOREX1 + __KAM_FOREX2 + __KAM_FOREX3 + __KAM_FOREX4 >= 4) describe KAM_FOREX Forex Trading spam score KAM_FOREX 6.0 #SkyTech Wifi header __KAM_SKYTECH1 From =~ /SkyTech Wifi Booster|ultraboost/i header __KAM_SKYTECH2 Subject =~ /Wifi Deadspots|buffering/i body __KAM_SKYTECH3 /skytech wifi|Wifi Booster/i meta KAM_SKYTECH (__KAM_SKYTECH1 + __KAM_SKYTECH2 + __KAM_SKYTECH3 >= 3) describe KAM_SKYTECH Wifi Booster Spam score KAM_SKYTECH 4.5 #FAKE Paypal header __KAM_FAKEPP1 From:name =~ /PayPal/i header __KAM_FAKEPP2 From:addr =~ /wordpress/i meta KAM_FAKEPP ( __KAM_FAKEPP1 + __KAM_FAKEPP2 + KAM_SHORT >= 3) describe KAM_FAKEPP Fake PayPal Notice score KAM_FAKEPP 4.5 #SEXUALLY EXPLICITY PHOTO header __KAM_PHOTO1 Subject =~ /My name is/i body __KAM_PHOTO2 /I am very lonely/i ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __KAM_PHOTO3 Content-Type =~ /\.jpe?g/i endif body __KAM_PHOTO4 /This is my photo/i body __KAM_PHOTO5 /get to know you/i meta KAM_PHOTO (__KAM_PHOTO1 + __KAM_PHOTO2 + __KAM_PHOTO3 + __KAM_PHOTO4 + __KAM_PHOTO5 >=5) describe KAM_PHOTO Sexually Explicit Photo Emails score KAM_PHOTO 7.5 #FOOTBALL header __KAM_FOOTBALL2_1 Subject =~ /Foo[ts]ball Table/i body __KAM_FOOTBALL2_2 /look at (the thing I brought|this product|what I sent you)/i body __KAM_FOOTBALL2_3 /foo[st]ball table pric/i meta KAM_FOOTBALL2 (__KAM_FOOTBALL2_1 + __KAM_FOOTBALL2_2 + __KAM_FOOTBALL2_3 + __KAM_SHOP1 >= 3) describe KAM_FOOTBALL2 Football table spams score KAM_FOOTBALL2 4.5 #LAWSUIT header __KAM_LAWSUIT1 From:name =~ /lawsuit/i header __KAM_LAWSUIT2 Subject =~ /lawsuit/i body __KAM_LAWSUIT3 /you or a loved one/i body __KAM_LAWSUIT4 /(roundup|diagnosed with cancer)/i tflags __KAM_LAWSUIT4 nosubject meta KAM_LAWSUIT (__KAM_LAWSUIT1 + __KAM_LAWSUIT2 + __KAM_LAWSUIT3 + __KAM_LAWSUIT4 >= 4) describe KAM_LAWSUIT Ambulance chaser scams score KAM_LAWSUIT 6.0 #ED SPAM header __KAM_CHEAT1 From:name =~ /Magnum/i header __KAM_CHEAT2 Subject =~ /women cheat/i body __KAM_CHEAT3 /(Erectile Dysfunction|erection)/i tflags __KAM_CHEAT3 nosubject meta KAM_CHEAT (__KAM_CHEAT1 + __KAM_CHEAT2 + __KAM_CHEAT3 >= 3) describe KAM_CHEAT ED Spams score KAM_CHEAT 4.5 #DomainBroker body __KAM_DOMAINBROKER1 /DomainBroker/i header __KAM_DOMAINBROKER2 Subject =~ /Domain on sale/i header __KAM_DOMAINBROKER3 From:name =~ /Domain.?Agent/i meta KAM_DOMAINBROKER (__KAM_DOMAINBROKER1 + __KAM_DOMAINBROKER2 + __KAM_DOMAINBROKER3 + KAM_BODY_MARKETINGBL_PCCC >= 3) describe KAM_DOMAINBROKER Domain seller spams score KAM_DOMAINBROKER 4.5 #FAKE SHAREPOINT 2 - Sexually explicit header __KAM_FAKE_SHAREPOINT2_1 From:addr =~ /no\-reply\@sharepointonline\.com|sex|69/i header __KAM_FAKE_SHAREPOINT2_2 Subject =~ /view my profile|(\b|^|\s)sex+y man|live chat|hook.?up|sweet.?heart|(\b|^|\s)sex|f a c e b o o k|i know you|just fun|my phone|for se+x+|tease|play with my pus|facebook|chat shared|horne?y|see my nu(t|d)e|Video.M(a|e)ssage|bang.?meetup|private massage|confirm your e.?mail|tiktok for sex|firstsheba/i body __KAM_FAKE_SHAREPOINT2_3 /REAL DATING NETWORK|bad partner|single.hot.mom|chat room|escort girl|hi there|hook.?up|flirty singles|sweet.?heart|(\b|^|\s)sex|(\b|^|\s)dick|escort|Open me\.? asap|intercourse|seeking male|real relationship|suck my kitty|F.ck me|single girl|real man|need a partner|lonely mom|adults? classified|screw many girls|bang.?meetup|(chat|meet) for sex/i tflags __KAM_FAKE_SHAREPOINT2_3 nosubject meta KAM_FAKE_SHAREPOINT2 (__KAM_FAKE_SHAREPOINT2_1 + __KAM_FAKE_SHAREPOINT2_2 + __KAM_FAKE_SHAREPOINT2_3 >= 3) describe KAM_FAKE_SHAREPOINT2 Sexually Explicit Sharepoint Spam score KAM_FAKE_SHAREPOINT2 8.5 #DRONE header __KAM_SHOP1 Reply-to =~ /\.shop|drone|\.xyz/i header __KAM_DRONE2 Subject =~ /follow up on last email|reminder again|drone|quick follow.?up/i #ODD LANG SHIP body __KAM_DRONE3 /arrange the (shipment|dispatch)|contact the logistics|logistics to arrange|address for shipping|touch with logistics|location of your shipment/i #DRONE HERE body __KAM_DRONE4 /new drone (information|here)|information about the drone|for (two|three) drones|email about this drone/i #ODD LANG GOODS body __KAM_DRONE5 /grasp our goods|take one or more|three or more|receiving one or two/i #DRONE DESC body __KAM_DRONE6 /GPS Brushless Drone|optical flow/i meta KAM_DRONE (__KAM_SHOP1 + __KAM_DRONE2 + __KAM_DRONE3 + __KAM_DRONE4 + __KAM_DRONE5 + __KAM_DRONE6 >= 5) describe KAM_DRONE Drone Spam Du Jour score KAM_DRONE 7.5 #FAKE PAYPAL header __KAM_FAKE_PAYPAL1 From:name =~ /paypal|invoice|confirmation|payapl|receipt|reciept|help.?desk/i header __KAM_FAKE_PAYPAL2 Subject =~ /Order ?(\#|reference|Confirmation)|your (transaction|purchase)|(buyer'?s|purchase) (receipt|ref|id) \#|transaction|statement|shipping notification|0rder|\$\d\d\d\.\d\d charged|payment info|subscription|paid the invoice/i body __KAM_FAKE_PAYPAL3 /paypal/i tflags __KAM_FAKE_PAYPAL3 nosubject body __KAM_FAKE_PAYPAL4 /if any concern|in order to cancel|(any|open a) dispute|(exact|usual) location|used by someone else|regular IP address|(haven'?t|not) made this purchase|contact us immediately|trust & safety|not authorized|file an issue|cancellation|to cancel|did\s?n.{1,3}t made this order/i body __KAM_FAKE_PAYPAL5 /(accepted|confirmed|USD|purchase) (at|to|by) (Walmart|Target)|(Walmart|Target),?( Inc.?)? has (accepted|received|confirmed)|charge will appear|auto debited|paid instantly|credit wallet balance/i body __KAM_FAKE_PAYPAL6 /help by phone|call paypal ?(usa|team)|paypal fraud dep|paypal support immediately|before dispatch|paypal consumer credit/i meta KAM_FAKE_PAYPAL (__KAM_FAKE_PAYPAL1 + __KAM_FAKE_PAYPAL2 + __KAM_FAKE_PAYPAL3 + __KAM_FAKE_PAYPAL4 + __KAM_FAKE_PAYPAL5 + FREEMAIL_FROM + __KAM_FAKE_PAYPAL6 >= 5) describe KAM_FAKE_PAYPAL Fake PayPal Message score KAM_FAKE_PAYPAL 6.0 body __KAM_FAKE_PAYPAL2_1 /PayPal (customer service|Support) Team/i body __KAM_FAKE_PAYPAL2_2 /void this (transaction|order) within/i meta KAM_FAKE_PAYPAL2 (__KAM_FAKE_PAYPAL2_1 + __KAM_FAKE_PAYPAL2_2 + FREEMAIL_FROM >=3) describe KAM_FAKE_PAYPAL2 Fake PayPal Message score KAM_FAKE_PAYPAL2 4.5 #FEEDPROXY ABUSE uri GB_G_FEEDPROXY /https?\:\/\/feedproxy\.google\.com\/~r\// describe GB_G_FEEDPROXY Google Feed Proxy Abuse score GB_G_FEEDPROXY 2.5 #b-cdn abuse uri GB_PULLZONE_B_CDN /https?\:\/\/pullzone-v[0-9]\.b\-cdn\.net/ describe GB_PULLZONE_B_CDN B-Cdn abuse score GB_PULLZONE_B_CDN 3.0 #DISCORD ABUSE uri __KAM_DISCORDCDN1 /cdn\.discordapp\.com\/attachment/i header __KAM_DISCORDCDN2 From:addr !~ /\@discord\.com/i header __KAM_DISCORDCDN3 DKIM-Signature !~ / d=discord.com;/i meta KAM_DISCORDCDN (__KAM_DISCORDCDN1 + __KAM_DISCORDCDN2 + __KAM_DISCORDCDN3 >= 3) describe KAM_DISCORDCDN Abuse of Discord CDN in spams score KAM_DISCORDCDN 4.5 uri __KAM_DISCORDCDN_BAD1 /cdn\.discordapp\.com\/attachment.*(docu.?sign|\.(iso|gz|exe|jar|zip|xlsm|docm|pptm))/i meta KAM_DISCORDCDN_BAD (KAM_DISCORDCDN + __KAM_DISCORDCDN_BAD1 >= 2) describe KAM_DISCORDCDN_BAD Extra Dangerous Discord CDN Content in spams score KAM_DISCORDCDN_BAD 6.0 #PAYROLL SCAMS body __KAM_PAYROLL1 /(Leveragewages|Savingcredits)/i body __KAM_PAYROLL2 /(companies|businesses) in CA/i header __KAM_PAYROLL3 Subject =~ /payroll/i meta KAM_PAYROLL (__KAM_PAYROLL1 + __KAM_PAYROLL2 + __KAM_PAYROLL3 + FREEMAIL_FROM >= 4) describe KAM_PAYROLL Payroll spammers score KAM_PAYROLL 6.0 #FAKE ZIX header __KAM_FAKE_ZIX1 From:addr !~ /zixmessagecenter.com/i header __KAM_FAKE_ZIX2 Subject =~ /Secure Zix message|remittance advice/i body __KAM_FAKE_ZIX3 /security system|view document/i uri __KAM_FAKE_ZIX4 /dynamics\.com|\.html?/i meta KAM_FAKE_ZIX ( __KAM_FAKE_ZIX1 + __KAM_FAKE_ZIX2 + __KAM_FAKE_ZIX3 + __KAM_FAKE_ZIX4 >=4) describe KAM_FAKE_ZIX Fake Zix Email score KAM_FAKE_ZIX 6.0 #FAKE AMAZON header __KAM_FAKE_AMAZON1 Subject =~ /Quick Request/i body __KAM_FAKE_AMAZON2 /have an (Amazon account|account with amazon)/i meta KAM_FAKE_AMAZON ( __KAM_FAKE_AMAZON1 + __KAM_FAKE_AMAZON2 + FREEMAIL_FROM + __KAM_BODY_LENGTH_LT_512 >= 4) describe KAM_FAKE_AMAZON Amazon Account Phishes score KAM_FAKE_AMAZON 4.5 #BINANCE header __KAM_BINANCE1A Subject =~ /income/i header __KAM_BINANCE1B Subject =~ /crypto.?currenc/i body __KAM_BINANCE2 /affiliate link/i body __KAM_BINANCE3 /lifetime commission/i body __KAM_BINANCE4 /Friends and associates/i body __KAM_BINANCE5 /Binance/i meta KAM_BINANCE (( __KAM_BINANCE1A + __KAM_BINANCE1B >=2) + (__KAM_BINANCE2 + __KAM_BINANCE3 + __KAM_BINANCE4 >=2) + ( __KAM_BINANCE5 >= 1) >= 3) score KAM_BINANCE 6.0 describe KAM_BINANCE Pyramid crypto scams #FAKE DMCA header __KAM_FAKE_DMCA1 From:name =~ /DMCA.?Tech/i header __KAM_FAKE_DMCA2 From:addr =~ /DMCA/i body __KAM_FAKE_DMCA3 /text of the complaint/i body __KAM_FAKE_DMCA4 /your device violates/i body __KAM_FAKE_DMCA5 /cancel subscription/i meta KAM_FAKE_DMCA ( __KAM_FAKE_DMCA1 + __KAM_FAKE_DMCA2 + __KAM_FAKE_DMCA3 + __KAM_FAKE_DMCA4 + __KAM_FAKE_DMCA5 >=5 ) describe KAM_FAKE_DMCA Fake DMCA Notice score KAM_FAKE_DMCA 7.5 #Claritox header __KAM_CLARITOX1 From:name =~ /claritox/i header __KAM_CLARITOX2 Subject =~ /Brain infection/i body __KAM_CLARITOX3 /claritox/i tflags __KAM_CLARITOX3 nosubject body __KAM_CLARITOX4 /brain infection/i tflags __KAM_CLARITOX4 nosubject meta KAM_CLARITOX ( __KAM_CLARITOX1 + __KAM_CLARITOX2 + __KAM_CLARITOX3 + __KAM_CLARITOX4 >= 3 ) describe KAM_CLARITOX Product du Jour Spam score KAM_CLARITOX 4.5 #BAD Canva uri __KAM_BAD_CANVA1 /\.canva\.com/i body __KAM_BAD_CANVA2 /link will not work for only recipients/i meta KAM_BAD_CANVA ( __KAM_BAD_CANVA1 + __KAM_BAD_CANVA2 >= 2 ) describe KAM_BAD_CANVA Fake link from Canva for phishing score KAM_BAD_CANVA 5.0 #FAKE EXCEL ifplugin Mail::SpamAssassin::Plugin::MIMEHeader body __KAM_FAKE_EXCEL1 /details is in Excel File/i mimeheader __KAM_FAKE_EXCEL2 Content-Type =~ /excel.html?/i meta KAM_FAKE_EXCEL ( __KAM_FAKE_EXCEL1 + __KAM_FAKE_EXCEL2 >= 2 ) describe KAM_FAKE_EXCEL Excel Phishing Scam score KAM_FAKE_EXCEL 6.0 endif #ZOHO EXPLOIT uri __KAM_ZOHO1 /zfrmz\.com|zohoinsights\.com/i body __KAM_ZOHO2 /congrats on win|selected as the winner|expiration notice/i body __KAM_ZOHO3 /sweepstakes|password/i meta KAM_ZOHO ( __KAM_ZOHO1 + __KAM_ZOHO2 + __KAM_ZOHO3 >= 3 ) describe KAM_ZOHO Zoho form or insights exploit score KAM_ZOHO 4.5 #FAKE AFFIL ADS header __KAM_FAKE_AFFIL1 From =~ /(eharmony|Get.?Gutter.?Protection|Hello.?Fresh).*(Affil|partner)|(American.?Home.?Warranty|Renewal.?by.?anders.n|TruGreen.?Lawn.?Service|Blissy|Energy.?Bill.?Cruncher|Amy.?Myers|1-ink|Tommy.?Chong|Burial.?Insurance|walk.?in.?tub)/i uri __KAM_FAKE_AFFIL2 /cdn\.mpp-stage\.com|cdn\.tedbvi\.com/i ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __KAM_FAKE_AFFIL3 Content-Type =~ /ATT\d+\.htm/i endif meta KAM_FAKE_AFFIL ( __KAM_FAKE_AFFIL1 + __KAM_FAKE_AFFIL2 + __KAM_FAKE_AFFIL3 >= 3) describe KAM_FAKE_AFFIL Fake Affiliates Garbage score KAM_FAKE_AFFIL 4.5 ifplugin Mail::SpamAssassin::Plugin::RaptorOnly ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader GB_BAD_SVG Content-Type =~ /Employee\sHandbook.{0,16}\.svg/i describe GB_BAD_SVG Dangerous svg file attached score GB_BAD_SVG 10.0 endif endif #header __KAM_SIREN1 From =~ /Portable Defense Siren/i #TELEGRA.PH being exploited uri KAM_TELEGRA /https?:\/\/telegra\.ph/i describe KAM_TELEGRA Service being exploited by spammers score KAM_TELEGRA 5.0 #PHARMA SPAMS ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_rules __KAM_PHARMA_1 header __KAM_PHARMA_1 From =~ /Canad<I1>an Pharma/i body __KAM_PHARMA_2 /Online Pharmacy|No Prescription/i meta KAM_PHARMA ( __KAM_PHARMA_1 + __KAM_PHARMA_2 + KAM_TELEGRA >= 2) describe KAM_PHARMA Online Pharmacy Spam score KAM_PHARMA 3.0 endif #TWO EMAILS OBFUSCATION ifplugin Mail::SpamAssassin::Plugin::RaptorOnly meta GB_2_EMAILS ( __PDS_FROM_2_EMAILS + KAM_IFRAME + MISSING_HEADERS >= 3) describe GB_2_EMAILS Phishing Emails using 2 Emails and Other Tricks for Obfuscation score GB_2_EMAILS 4.5 endif #DRONE SPAM header __KAM_DRONE2_1 From:name =~ /x.?pro|drone/i header __KAM_DRONE2_2 Subject =~ /(best|4k) drone|drone x.?pro/i body __KAM_DRONE2_3 /(best|x.?pro) drone|drone x.?pro/i tflags __KAM_DRONE2_3 nosubject meta KAM_DRONE2 ( __KAM_DRONE2_1 + __KAM_DRONE2_2 + __KAM_DRONE2_3 + __KAM_SUBSCRIPTION_INFO >= 4) describe KAM_DRONE2 Drone Spam score KAM_DRONE2 6.0 #SANDAL SPAM header __KAM_SANDAL1 From:name =~ /quickdry sandal/i header __KAM_SANDAL2 Subject =~ /on your feet|uncomfortable shoes|comfiest sandal|with any outfit|with every step/i body __KAM_SANDAL3 /quickdry sandal/i tflags __KAM_SANDAL3 nosubject meta KAM_SANDAL ( __KAM_SANDAL1 + __KAM_SANDAL2 + __KAM_SANDAL3 + __KAM_SUBSCRIPTION_INFO >= 4) describe KAM_SANDAL Shoe Spam (don't bother me...) score KAM_SANDAL 6.0 #FAT SPAM header __KAM_FAT1 From:name =~ /fat/i header __KAM_FAT2 Subject =~ /melt \d.?(lb|pound)/i body __KAM_FAT3 /island tonic|maverick doctor/i tflags __KAM_FAT3 nosubject meta KAM_FAT ( __KAM_FAT1 + __KAM_FAT2 + __KAM_FAT3 + __KAM_SUBSCRIPTION_INFO >= 4) describe KAM_FAT Weightloss Spam score KAM_FAT 6.0 #CAMERA SPAM header __KAM_CAMERA1 From:name =~ /ultrazoom/i header __KAM_CAMERA2 Subject =~ /(HD|Super) telescope/i body __KAM_CAMERA3 /super telephoto zoom/i tflags __KAM_CAMERA3 nosubject meta KAM_CAMERA ( __KAM_CAMERA1 + __KAM_CAMERA2 + __KAM_CAMERA3 + __KAM_SUBSCRIPTION_INFO >= 4) describe KAM_CAMERA Camera Lens Spam score KAM_CAMERA 6.0 #SUBSCRIPTION META body __KAM_UNSUBSCRIBE /can always unsubscribe|unsubscribe here|stop receiving e?mail|send post-?mail/i meta __KAM_SUBSCRIPTION_INFO ( __SUBSCRIPTION_INFO + __KAM_UNSUBSCRIBE >= 1) ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __KAM_QUOTATION1 Content-Type =~ /quotation\.html?/i header __KAM_QUOTATION2 Subject =~ /Quotation/i header __KAM_QUOTATION3 From =~ /accounts/i meta KAM_QUOTATION ( __KAM_QUOTATION1 + __KAM_QUOTATION2 + __KAM_QUOTATION3 + (SPF_SOFTFAIL + SPF_FAIL >=1) >= 4) describe KAM_QUOTATION Quotation Phishes score KAM_QUOTATION 6.0 endif #Sexually Explicit Spam ifplugin Mail::SpamAssassin::Plugin::MIMEHeader header __KAM_SEX2_1 Subject =~ /ready for me|Hello|Wet Invitation|Hi I'm|have fun|ready for me|good evening|private hangout|sex chat|call me on whatsapp/i body __KAM_SEX2_2 /dating site|bad girls|sexual community|discreet dating|pay for a chat|lover|horny|(adult|sex) chat|free women|i am discreet/i #LINK REL body __KAM_SEX2_3 /flirt for free|Fuck.?Free|sex.?club|naked glory|free.?sex|start writing me|canada.?sex|hot greetings|private hangout|get a massage/i mimeheader __KAM_SEX2_4 Content-type =~ /\.(jpe?g|png)\"?$/i body __KAM_SEX2_4A /my pics/i uri __KAM_SEX2_5 /https?:\/\/(au|en|cad?|canada)\./i meta KAM_SEX2 ( __KAM_SEX2_1 + __KAM_SEX2_2 + __KAM_SEX2_3 + (__KAM_SEX2_4 + __KAM_SEX2_4A >= 1) + (KAM_SHORT + __KAM_SEX2_5 >=1) + FREEMAIL_FROM >= 5) describe KAM_SEX2 Sexually Explicit Sapm score KAM_SEX2 15.0 endif #FAKE ADOBE header __KAM_FAKE_ADOBE1 Subject =~ /(file|Document) Received/i uri __KAM_FAKE_ADOBE2 /zohoinsights\.com/i body __KAM_FAKE_ADOBE3 /sign in required|download to view/i body __KAM_FAKE_ADOBE4 /received a pdf|pdf document has been shared/i meta KAM_FAKE_ADOBE ( __KAM_FAKE_ADOBE1 + __KAM_FAKE_ADOBE2 + __KAM_FAKE_ADOBE3 + __KAM_FAKE_ADOBE4 >= 4) describe KAM_FAKE_ADOBE Fake Adobe Email score KAM_FAKE_ADOBE 6.0 #PEAK BUSINESS FINANCE header KAM_PEAK From:addr =~ /peak.*business.*financ/i describe KAM_PEAK Finance Spammer score KAM_PEAK 7.0 #FROM PRODUCT SPAMs header __KAM_FROM_SPAM_NOV21 From =~ /(blood.?pressure.?(fix|cure)|20.?amazing.?gadgets|2021.?gadget.?guide|your.?hormones|Be.?Free.?Of.?Your.?Timeshare|unique.?christmas.?gifts|youthful.?brain|veteran.?discounts|VieShield.?Sanitizer|Walgreens.?Shopper.?Feedback|Solar.?Bright|shocking.?truth:|(\b|^)ed.?solution|beauty.?digs|LED.?Beach.?Balls|Pelvic.?Floor.?strong|Leptitox|Clean.?cell|Gadget.?List)|Avoid.?melatonin|My.?Senior.?Perks|explosive.?size|savage.?grow|blood.?pressure.?roulette|ElectronX.?Ruler|Software.?Treats|Grease.?Your.?Knee|late.?night.?peeing|Landscaping.?Ideas|hot.?new.?gadget|Tetrus.?LED.?Lighting|Weedkiller.?Injury|Compressa.?Relief|Shed.?Building.?Guide|plans?.?for.?shed|increase.?size|herpes.?cure|Human.?reproductive.?system|body.?shaper|ear.?wax.?remover|vital.?flow|curious.?finds|get.?skinny.?chocolate|Home.?Depot.?Shopper.?Feedback|modern.?woman|EU.?Business.?Register|comfy.?shoes/i header __KAM_FROM_SPAM_DEC21 From =~ /Heater.?Pro.?X|Neck.?Massager|Cinna.?Chroma|Sibgazinvest|Striction.?Blood|blood.?pressure.?warning|stamina.?pro|Smart.?Holder.?Pro|Smart.?phone.?Gloves|WiFi.?Ultraboost|HD.?telescope|Doctor.?Holmes\'s.?co.?op|variety.?store.?kerry|Suzi\'s.?potion|Antiseptic.?cathy|flat.?tummy.?recipe|bye.?big.?tummy|Skincell.?2|nail.?dry.?pro|muscle.?relax.?pro|easy.?slippers/i #removed \@advid for FPs header __KAM_FROM_SPAM_JAN22 From =~ /Puppy.?Pet.?Ball|ultimate.?keto.?meal|steel.?bite.?pro|he?rpa.?greens|HAIR.?REVITAL|peak.?biome|energy.?cube.?system|perfect.?flush|make.?money.?online|Stops?.?Herpes|blood.?pressure.?911|Fat.?Burning|Personal.?power.?plant|sqribblee.?book.?creator|special.?launch.?price|ringing.?ears|fading.?memory|big.?stomach|apple.?cider.?vinegar|glucofort|do.?this.?at.?breakfast|immune.?defense|sonus.?complete.?basic|introducing.?exi.?pure|blood.?sugar.?defense|shed.?plan|obsession.?method|5g.?male|cold.?war.?generator|tinnitus.?(terminator|guard)|keto.?advantage|senior.?saving.?club|exipure|gold.?plated.?coin|trump.?coin|Prostate.?relief|acida.?burn|back.?pain|fungus.?treat|herpa.?green|neck.?massage|Silencil|kishor.?exports|fatty.?liver|gluca.?fix|reservation.?diet|high.?blood.?pressure|energy.?bill.?crunch|muscle.?care|fast charger pro|Tv.?Share.?Max|bar.?x.?health|canad(a|ian).?drug.?store|Duramax.?Fence|vid.?toon|online.?pharmacy|viagra.?shop|circa.?knee|Shoppers.?Drug.?Mart|royal.?numerology/i header __KAM_FROM_SPAM_FEB22 From =~ /Swag.?Envy|Turn.?Text.?to.?speech|cart.?bloom|Pierre.?Omidyar|copper.?zen.?socks|Muama.?Ryoko|Mindinsole|clipper.?pro|nerve.?control|arthritis.?relief|sleep.?connection|lose.?it.?now|Pioneer.?Travels|bathroom.?remodel/i header __KAM_FROM_SPAM_FEB22_TLD From =~ /solar.?panels/i header __KAM_FROM_SPAM_MAR22 From =~ /Whos.?who|ray.?ban|simple.?home.?quotes|laundry.?masher|embarr?ass?ing.?toe|miracle.?sheets|nail.?fungus|Smartcam|tactical.?drone|owl.?vision|hulk.?heater|wifi.?repeater|gluco.?flow.?supplement|blood.?sugar.?blaster|dr\..?phil.?news|Muama.?Ryok|usmile.?pro|power.?pod|never.?snore|snore.?stop|(^|\")usmile|bye.?bye.?fat|chemist.?s.?shop|married.?women|potent.?CBD|diabetes.?gone|US.?concealed.?online|gift.?card.?chance|cardio.?clear|one.?monthly.?fee|online.?learn.?piano|coffee.?secret|shark.?tank.?keto|rots.?your.?teeth|stronger.?vision|Norton.?Lifelock|instant.?translator/i header __KAM_FROM_SPAM_APR22 From =~ /snoring.?fix|automix|circa.?knee|zoomshot.?pro|Instant.?translator|prostate.?health|stay.?dry.?202|battery.?vault|goodbye.?diabetes|bad eyes|createxdigital|\@.{0,8}advids\.|\@deszy|\@devacc\./i header __KAM_FROM_SPAM_MAY22 From =~ /butter.?on.?toast|exobone|sharp.?ear|news.?reward.?exclusive|AirBuds|earbuds|Massage.?gun|directaxis|sanlamfinance|grants.?for.?homeowner|manchester.?collection|Power.?drill.?(confirmation|surprise)|gift.?card.?shipment|fast.?keto.?diet|(energy|bill).?cruncher|fun.?drops.?cbd|easy.?warm.?floor|home.?loan.?analyst.?offer/i header __KAM_FROM_SPAM_JUN22 From =~ /Finance.?the.?big.?lie|cbd.?gumm|vet.?savings|Keto.?maxx|unbreakable.?brain|brain.?blueprint|just.?gi[zs]mo|ice.?house.?portable|portable.?ac|single.?flirt|painful.?knees|russian?.?(babe|bride)|eyesight.?max|blood.?sugar.?formula|brain.?fix|FOLIFORT|PROCompression.?special|por?table.?oxygen|Special.?Oil|Syno.?gut|blissy.?offer|WarHawk.?Binoculars|keto.?diet|match.?seniors|no.?more.?pin.?pricks|Doctors?.?shock|20.?20.?Vision|Windows.?Defender.?Order|fat.?burner/i header __KAM_FROM_SPAM_JUL22 From =~ /Horrific.?Back|fat.?reducer|smart.?watch|chill.?well|blurred.?vision|Family.?savings|Revifol\.com|Fluxactive|eye.?herb|eco.?chip|Lumbar.?Correct|Air.?Flops|Getinstahard\.com|neurodrine|air.?cooly|Bladder.?relief|Doctor.?Inflammation|Shrink.?your.?prostate|RetailMarketingPro|back.?to.?life/i header __KAM_FROM_SPAM_AUG22 From =~ /a1c.?fix|LeafProtect\.com|ServicePlus\.Home|Golden.?fx|Arcti.?FREEZE|RensaClub\.com|\@advids?\-|nail.?infection|pain.?relief.?sock|leaf.?filter|toxic.?foot|nails.?fungus|cat.?spraying|big.?pharma|vision.?enhancing|battery.?recondition|injecting.?fat|mosquito.?light|black.?surge|tinnitus.?911|sugar.?balance|cardio.?clear|compression.?sock|balanced.?blood|Sqribble|ukraine.?(beauty|bride)|instahard|shop.?icehouse|vital.?flow|Discount.?is.?ready|cinch.?home.?protection|home.?protection.?plan|zander.?term|easy.?canvas.?(deals|prints)|home.?warranty.?offer|toxic.?water|keto.?202\d|wifi.?booster|restore.?gummies|-advids\.|lost.?superfoods|vantis.?life|roofing.?quote|maasalong|flux.?active|hot.?russian|serious.?daters|anderson.?affiliate|instant.?translator|clipper.?pro|scientific.?nail|6.?secrets|singles.?offer|lower.?my.?bill|SplashWines\.com|leafprotect\.com|columbian.?girl|wifi.?ultraboost|\@clum-?(video|creat)|deadly.?sex|Vita.?Firm/i header __KAM_FROM_SPAM_SEP22 From =~ /Select.?Quote.?(offer|affiliate|insurance)|light.?bulb.?camera|pitney.?bowes.?presort|carshield.?quote|neckcool|zinc7|term.?life.?insurance|detox.?shower|protection.?from.?pests|Pest.?defense|Life.?Omic|pipelinersales|\.kalendar/i header __KAM_FROM_SPAM_OCT22 From =~ /Barx.?Busy.?Ball|Nationwide.?Home.?protection|Social Diger|Splash Wine|Holiday.?Wallet.?Guru|no.?more.?joint.?pain|poop.?out.?fat/i header __KAM_FROM_SPAM_NOV22 From =~ /liveto.?accelerator|tupi.?tea|lT Service Desk|free.?spins?.?Canada|eye.?bag.?cream|amylase.?benefit|bladder.?leak|\@.{0,8}saasee\.|\@saasee|japanese.?delicacy|insure.?my.?car|businesspronews|CFOtrends|COOupdate|\@whizzbridge|phototrakk|CIOProNews/i header __KAM_FROM_SPAM_DEC22 From =~ /\@avogtal\.|Belly.?Slim|stealth.?attraction|renewalbyandersen|\@devacc\.|bloodbalance|\@.*\.kalenda/i header __KAM_FROM_SPAM_JAN23 From =~ /cat\d[ae]?_cable|\@.*\.kalndr|Alpha.?Beast|Auto.?Renewal.?Notice|Blue.?Hat.?Giveaway|Sleep.?Guard.?Plus|balance.?trick|black.?coffee.?hack|openeye.?cbd|fatty.?liver|bizjournals\.com|washingtonbusinessjournal\.com|Acetaminophen.?Lawsuit|\@whizzbridge|Photo.?Trakk|cosmic.?globe|SelectHomeWarranty/i header __KAM_FROM_SPAM_FEB23 From =~ /SEO Rose|Diabacore|Cholibrium|Brain.?Savior|Ukranian.?Single|business.?concierge.?team/i header __KAM_FROM_SPAM_MAR23 From =~ /Ukranian.?girls|feel.?good.?knee|fiber.?warning|septi.?fix|elongation.?secret|liver.?warning|Health.?Teamz|Blisterol/i header __KAM_FROM_SPAM_APR23 From =~ /Fat.?loss.?trick|paid.?clinical.?stud|reduce.?wrist.?pain|Compression.?Sock|mystery.?shopper|carshield|prostate.?911|sonovive|\@avogtal\.|homedepotpromotions|ukranian.?girls|liver.?health/i header __KAM_FROM_SPAM_MAY23 From =~ /Get.?prostate|mr.?.?lean.?belly|pain.?trigger|homedepotpromo|lume.?deodorant|hemp.?gummies|ninja.?offers|obamacare.?rate|brain.?news|joint.?support|lepticell/i header __KAM_FROM_SPAM_JUN23 From =~ /ukrainian.?(wom[ae]n|single)|brain.?fortify|attorney.?for.?cancer|enence.?translator|tac.?right.?mini.?saw|walk.?in.?bath|care.?soles|hip.?flexor|prodentim/i header __KAM_FROM_SPAM_JUL23 From =~ /Memory.?foam.?pillow|flow.?it.?hardware|payroll.?advance|elon.?Power.?bank|dementia.?trigger/i header __KAM_FROM_SPAM_AUG23 From =~ /menopause.?pooch|icloud.?online.?shopper|(airlines?|UPS).?shopper.?gift|surge.?card|1st.?premier.?lending|fast.?lean.?pro|Dementia.?Trigger|(epson|delta|stanley|Lowes).?(rewards|giveaway)|\@\d\.socialteers\-|\@\d\..*-carmine\.com/i header __KAM_FROM_SPAM_SEP23 From =~ /\@\d\.petra\-.*\.com|ups.?evaluation.?center|kohls.?perspective.?team|gift.?opportunities.?by.?oreilly|netflixmember|home.?depot.?(store|reward|express)|hexclad.?(kitchen|cook)ware|costco.?store.?card|\@dealclosers-.*\.com|Walgreens(points)|powerknot|unitedmiieage/i header __KAM_FROM_SPAM_OCT23 From =~ /bye.?herpes|compass.?coffee|Kobalt.?giveaway|pain.?relief.?protein|\@(tr\.)?\d\.digiteers\-.*\.com|stanleyToolSet/i #removed tiktok shop as a FP 2025-02-06 header __KAM_FROM_SPAM_NOV23 From =~ /Amblebrook.?at.?Gettysburg|mcafee.?warning|\@reloadl?ux\.|metamask.?airdrop|legostar.?nft/i header __KAM_FROM_SPAM_DEC23 From =~ /SBAlley|home.?foreclosures?.?list|Ad0be.?Acr0bat|real.?social.?mart|nail.?fungus|cardiologists.?shocked/i header __KAM_FROM_SPAM_JAN24 From =~ /Nail.?Fungus|water.?filtration|safe.?drinking.?water|Portable.?Heater|scrub.?daddy|stop.?ear.?ring|kohl.?s.?surprise|Solar.?Generator|vault.?scanner|b2b.?worlds|chimp\'s.?custom.?graphics|cold.?sore.*nuker|neuropathy.?cure|BackPain|\@.*\.(cannoschoolnighqua|usanoschoolnighqua)\d+\.org|Apple_Mystery|N\.e\.t\.f\.l\.i\.x|Nano.?Security.?scan|Temu Pallet|QBKS.?renew|american.?airlines.?winner|food.?shortage|Airwheel|benign.?vertigo|ozempic.?scandal|Harbor.?Freight.?Dep/i header __KAM_FROM_SPAM_FEB24 From =~ /MTS.?Transitional.?Life|\@avogtal\-|carshield.?auto.?protection|harbor.?freight.?thanks|anti.?aging.?cream|my.?senior.?perks|siriusxm.?loyalty.?program|0nlyfans|gutter.?guard.?affiliate|Federal.?Tax.?Debt.?Help|Activate.?your.?superbrain|Eye.?Nutrient.?Risk/i header __KAM_FROM_SPAM_MAR24 From =~ /Portable.?Wifi|Easter.?letters|\@\w*?\.socialteers\-|Zymme.?Pillow|Crystal.?clear.?vision|stubborn.?belly.?fat|Smart.?time.?share.?owner/i header __KAM_FROM_SPAM_APR24 From =~ /ugly.?plant|Mysterious.?Liquid|empiretaxprofessionals|\@\w*\.petra\-.*\.com|XBINANCEX/i header __KAM_FROM_SPAM_MAY24 From =~ /Michael Page Recruitment|Page Group Recruiting|MFA\-Enrollments\-Desk|Nina.?video.?(display|etindge)/i header __KAM_FROM_SPAM_JUN24 From =~ /Purave.?Water.?filter|vagabondtemple\.com|\@qwiklabs.*\.firebaseapp\.com/i header __KAM_FROM_SPAM_JUL24 From =~ /Diabetes.?(defender|solution.?kit)|Black.?Tea.?vs\..?Green.?Tea|Lume.?Deoderant|Chocolate\?vs.?Butter|Fue[il].?Re[il]ief.?Program|loca[il].?food.?he[il]p|Your.?Local.?McDona[il]ds|Trump.?Hat|Power.?Saver.?Pro/i header __KAM_FROM_SPAM_AUG24 From =~ /10\-seconds|diabetes.?supplement|healthy.?nails|alerts?yourpackage\@|MarriottComfortSquad|cloudphonealert|Unlimited.?TV|destroy.?fat|Anti.?Snoring.?Solution|Hero.?Blanket|repair.?nerves|Senior.?savings|Knee.?pain|10\-seconds|ageless.?dog|Your.?Teeth|Neck.?Cool.?Pro|Ergonomic.?Chairs|Stanley.?Tool.?Set.?Winner|Wrist.?Pain.?Relief|Cordless.?Drill.?driver.?kit.?reward|Ninja.?Air.?Fryer.?Department|Eye.?Nutrient.?Risk|Tool.?Set.?Rewards|Antibacterial.?Sheets|tractor.?supply.?winner|CostcoExclusiveDeals|Enence.?translat|Portable.?wifi|Walmart.?tech.?team|Harbor.?freight.?surprise/i header __KAM_FROM_SPAM_SEP24 From =~ /imanuel.?bible.?app|pancake.?swap|Klaudena.?Ergonomic.?Design|CVS.?Shopper.?Gift|Tactic.?Air.?Drone|Zoominfo.?Accounting.?Dept|ninja.?doublestack|keto.?gumm|omaha.?steaks.?exclusive|yeti.?hopper.?flip|SpyRec.?Pro|Prime.?CBD|penis.?(growth|enlargement)|Home.?Depot.?Opinion.?Requested|[\@=]losbuzos\.com|SouthwestAirlines(Online)?Survey/i header __KAM_FROM_SPAM_OCT24 From =~ /Huusk\@|Ace.?Unlocked|Skincare.?by.?Marilee|Patriot.?Solar.?Generator|HuluMembership|FreeTrumpShirt|Tractor.?Supply.?Surprise|WalmartDailyFinds\@|radon.?eraser|DunkinDonutsRewardsBoxDepartment|sniperrifle|TheUltimatePrepStore|NewKneesAndHips|Dr\. Merritt\'s Health Insights|EnenceTranslator|Collagen.?Booster|Virtual.?Shield.?Alerts|hollywood.?skin.?boost|Overnight.?Pain.?Relief/i header __KAM_FROM_SPAM_NOV24 From =~ /exclusive.?offers.?tesco|electric.?ear.?vacuum|Excelsior.?Trading.?Plus.?LLC|Enence.?Translator|Klaudena.?Ergonomic.?Design|Sidewinder.?sling|Night.?Vision.?4.?driving|Enence.?translat|Hardware.?store.?Reward|Tractor.?Supply.?Surprise|predator.?generator|official.?santa.?package|peeting.?at.?night|lowering.?blood.?pressure|ebay.?shopper.?feedback/i header __KAM_FROM_SPAM_DEC24 From =~ /\(label\)|medicinal.?garden.?kit|eZScrubpro|FreeTaxUSA.?(Customer|Tool)|Personalized.?Santa.?Letters|Vision.?Boosting.?Secret|Winter.?Secret.?Pro|Ryoko.?WiFi|Painful.?Surgery|ukranian girls|DriveBright.?offer/i header __KAM_FROM_SPAM_JAN25 From =~ /Free.?Trump.?Merch|southwest.?airlines.?shopper|Prostate.?Wellness|[a-z]*\.biddingestimatings?\@gmail.com|drop.?lbs.?with.?this|Stuck.?poop.?fast|[a-z]*\.smartleadlist\@gmail\.com|heated.?scarf|restore.?prostate|\@accufin\.|Joint.?pain.?remedy|Anti.?glucose.?mineral|vanishes.?wrinkles|activate.?brain.?power|fast.?constipation.?relief/i header __KAM_FROM_SPAM_FEB25 From =~ /perfect.?A1C|pooping.?secret|Neuropathy.?Warning|Total\-T|Urgent.?Wealth.?Warning|hearing.?loss|Statefarm.?safety|Trump.?Collector|Trump.?Gold.?Coin|Sudanese.?sugar.?trick|ancient.?secret.?unveiled|no.?more.?metformin|numb.?hands.?and.?feet|do.?this.?in.?bed|bone.?on.?bone/i header __KAM_FROM_SPAM_MAR25 From =~ /(kalendarai|reply|datascience)\@(link|join|network|chat)\-\d+/i header __KAM_FROM_SPAM_APR25 From =~ /cold.?sore.?drink|belly.?fat.?killer|Herpes.?Warning/i header __KAM_FROM_SPAM_MAY25 From =~ /clear.?fungus.?fast|neuropathy.?relief|Metabolism.?mute|muffled.?hearing|costco.?offer.?alert/i header __KAM_FROM_SPAM_JUN25 From =~ /you.?have.?been.?hacked.*\@/i header __KAM_FROM_SPAM_AUG25 From =~ /AAA.?(preparedness|protection|rescue|Roadside|ready|emergency|Help|shipping.?car|response).?Kit/ia header __KAM_FROM_SPAM_SEP25 From =~ /RoadsideServicesfromAAA/i meta KAM_FROM_SPAM ( __KAM_FROM_SPAM_NOV21 + __KAM_FROM_SPAM_DEC21 + __KAM_FROM_SPAM_JAN22 + __KAM_FROM_SPAM_FEB22 + __KAM_FROM_SPAM_MAR22 + __KAM_FROM_SPAM_APR22 + __KAM_FROM_SPAM_MAY22 + __KAM_FROM_SPAM_JUN22 + __KAM_FROM_SPAM_JUL22 + __KAM_FROM_SPAM_AUG22 + __KAM_FROM_SPAM_SEP22 + __KAM_FROM_SPAM_OCT22 + __KAM_FROM_SPAM_NOV22 + __KAM_FROM_SPAM_DEC22 + __KAM_FROM_SPAM_JAN23 + __KAM_FROM_SPAM_FEB23 + __KAM_FROM_SPAM_MAR23 + __KAM_FROM_SPAM_APR23 + __KAM_FROM_SPAM_MAY23 + __KAM_FROM_SPAM_JUN23 + __KAM_FROM_SPAM_JUL23 + __KAM_FROM_SPAM_AUG23 + __KAM_FROM_SPAM_SEP23 + __KAM_FROM_SPAM_OCT23 + __KAM_FROM_SPAM_NOV23 + __KAM_FROM_SPAM_DEC23 + __KAM_FROM_SPAM_JAN24 + __KAM_FROM_SPAM_FEB24 + __KAM_FROM_SPAM_MAR24 + __KAM_FROM_SPAM_APR24 + __KAM_FROM_SPAM_MAY24 + __KAM_FROM_SPAM_JUN24 + __KAM_FROM_SPAM_JUL24 + __KAM_FROM_SPAM_AUG24 + __KAM_FROM_SPAM_SEP24 + __KAM_FROM_SPAM_OCT24 + __KAM_FROM_SPAM_NOV24 + __KAM_FROM_SPAM_DEC24 + __KAM_FROM_SPAM_JAN25 + __KAM_FROM_SPAM_FEB25 + __KAM_FROM_SPAM_MAR25 + __KAM_FROM_SPAM_APR25 + __KAM_FROM_SPAM_MAY25 + __KAM_FROM_SPAM_JUN25 + __KAM_FROM_SPAM_AUG25 + __KAM_FROM_SPAM_SEP25 >= 1) describe KAM_FROM_SPAM From Indicates a Product Spam score KAM_FROM_SPAM 9.0 meta KAM_FROM_SPAM_TLD ( __KAM_FROM_SPAM_FEB22_TLD + KAM_SOMETLD_ARE_BAD_TLD >= 2) describe KAM_FROM_SPAM_TLD From and TLD Indicates a Product Spam score KAM_FROM_SPAM_TLD 7.75 #EVIL NUMBERS #1.?\(?213\)?[-\. ]+?260[-\. ]+?3712 body __KAM_EVIL_NUMBERS1 /(1.?\(?833\)?[-\. ]?900[-\. ]?0864|1.?\(?818\)?[-\. ]?275[-\. ]?7971|1.?\(?855\)?[-\. ]?357[-\. ]?8754|1.?\(?888\)?[-\. ]?683[-\. ]?2877|1.?\(?800\)?[-\. ]?363[-\. ]?9576|1.?\(?888\)?[-\. ]?501[-\. ]?3532|1.?\(?770\)?[-\. ]?406[-\. ]?6871|1.?\(?213\)?[-\. ]?260[-\. ]?3712|1.?\(?844\)?[-\. ]?984[-\. ]?0636|1.?\(?877\)?[-\. ]?483[-\. ]?0915|1.?\(?845\)?[-\. ]?393[-\. ]?0745|1.?\(?888\)?[-\. ]?505[-\. ]?1735|1.?\(?888\)?[-\. ]+?987[-\. ]+?6497|1.?\(?855\)?[-\. ]+?459[-\. ]+?2056|1.?\(?804\)?[-\. ]+?889[-\. ]+?0912|1.?\(?888\)?[-\. ]+?246[-\. ]+?8525|1.?\(?888\)?[-\. ]+?366[-\. ]+?2749|1.?\(?816\)?[-\. ]+?376[-\. ]+?8830|1.?\(?877\)?[-\. ]+?509[-\. ]+?8177|1.?\(?888\)?[-\. ]+?385[-\. ]+?8394|1.?\(?805\)?[-\. ]+?429[-\. ]+?2880|1.?\(?888\)?[-\. ]+?260[-\. ]+?7583|1.?\(?808\)?[-\. ]+?444[-\. ]+?7474|1.?\(?888\)?[-\. ]+?225[-\. ]+?0087|1.?\(?818\)?[-\. ]+?447[-\. ]+?4686|1.?\(?845\)?[-\. ]+?481[-\. ]+?2002|1.?\(?888\)?[-\. ]+?337[-\. ]+?3512|1.?\(?888\)?[-\. ]+?865[-\. ]+?0443|1.?\(?801\)?[-\. ]+?326[-\. ]+?4945|1.?\(?888\)?[-\. ]+?457[-\. ]+?7953|1.?\(?888\)?[-\. ]+?712[-\. ]+?0714|1.?\(?805\)?[-\. ]+?220[-\. ]+?9060|1.?\(?888\)?[-\. ]+?216[-\. ]+?7674|1.?\(?888\)?[-\. ]+?219[-\. ]+?8757|1.?\(?888\)?[-\. ]+?376[-\. ]+?0079|1.?\(?888\)?[-\. ]+?806[-\. ]+?2548|1.?\(?808\)?[-\. ]+?736[-\. ]+?6567|1.?\(?805\)?[-\. ]+?250[-\. ]+?1682|1.?\(?808\)?[-\. ]+?649[-\. ]+?5251|1.?\(?888\)?[-\. ]+?884[-\. ]+?3596|1.?\(?888\)?[-\. ]+?850[-\. ]+?1879|1.?\(?888\)?[-\. ]+?672[-\. ]+?7156|1.?\(?801\)?[-\. ]+?833[-\. ]+?0315|1.?\(?808\)?[-\. ]+?755[-\. ]+?6084|1.?\(?859\)?[-\. ]+?888[-\. ]+?2341|1.?\(?833\)?[-\. ]+?685[-\. ]+?4054|1.?\(?888\)?[-\. ]+?394[-\. ]+?0278|1.?\(?888\)?[-\. ]+?992[-\. ]+?1779|1.?\(?888\)?[-\. ]+?399[-\. ]+?0394|1.?\(?888\)?[-\. ]+?982[-\. ]+?7639|1.?\(?877\)?[-\. ]+?208[-\. ]+?4319|1.?\(?877\)?[-\. ]+?232[-\. ]+?6467|1.?\(?877\)?[-\. ]+?208[-\. ]+?4319|1.?\(?855\)?[-\. ]+?630[-\. ]+?3663|1.?\(?808\)?[-\. ]+?470[-\. ]+?7449|1.?\(?888\)?[-\. ]+?803[-\. ]+?6039|1.?\(?920\)?[-\. ]+?354[-\. ]+?6236|1.?\(?888\)?[-\. ]+?803[-\. ]+?3130|1.?\(?888\)?[-\. ]+?436[-\. ]+?-0785|1.?\(?855\)?[-\. ]+?948[-\. ]+?3820|1.?\(?888\)?[-\. ]+?662[-\. ]+?7908|1.?\(?888\)?[-\. ]+?350[-\. ]+?3529|1.?\(?808\)?[-\. ]+?501[-\. ]+?0625|1.?\(?833\)?[-\. ]+?216[-\. ]+?0511|1.?\(?833\)?[-\. ]+?552[-\. ]+?7144|1.?\(?800\)?[-\. ]+?526[-\. ]+?5742|1.?\(?806\)?[-\. ]+?839[-\. ]+?6096|1.?\(?727\)?[-\. ]+?498[-\. ]+?4899|1.?\(?808\)?[-\. ]+?318[-\. ]+?2838|1.?\(?877\)?[-\. ]+?409[-\. ]+?1087)(\b|$)/i #WEIRD FORMAT body __KAM_EVIL_NUMBERS2 /\(845\)-458-6\.4\.9\.1|850 3285 455|229 5154 934|585 3660 399/i #WEIRD CHARS body __KAM_EVIL_NUMBERS3 /(888\s5\s?3\s?1\s?4\s?0\s?3\s?0|855\s5\s?4\s?5\s?6\s?2\s?0\s?1)/i #WEIRD FORMAT body __KAM_EVIL_NUMBERS4A /[\({]\d\d\d[\)}][_~\*,]\d\d\d[_~\*,]{1,3}\d\d\d\d/ body __KAM_EVIL_NUMBERS4B /\(\d\d\d\)-\(\d\d\d\)-\(\d\d\d\d\)/ meta KAM_EVIL_NUMBERS (__KAM_EVIL_NUMBERS1 + __KAM_EVIL_NUMBERS2 + __KAM_EVIL_NUMBERS3 >= 1) describe KAM_EVIL_NUMBERS Phone Numbers used by scammers score KAM_EVIL_NUMBERS 7.0 #Thanks to Greg Troxel for the error fix here meta KAM_EVIL_NUMBERS4 ( __KAM_EVIL_NUMBERS4A + __KAM_EVIL_NUMBERS4B >= 1 ) describe KAM_EVIL_NUMBERS4 Phone Numbers used by scammers score KAM_EVIL_NUMBERS4 1.0 #LAUNCH PCCC WILD RBL if (version >= 4.000000) ifplugin Mail::SpamAssassin::Plugin::HashBL if can(Mail::SpamAssassin::Plugin::HashBL::has_hashbl_bodyre_num) # extract phone numbers from text # the phone number might be of the form: # +1 (123) 123-4567 # 441 (123) 123-4567 (44 is the hex of the + char, tesseract(1) could convert the '+' sign this way # spaces, + sign, parenthesis and spaces are optional ifplugin Mail::SpamAssassin::Plugin::RaptorOnly if can(Mail::SpamAssassin::Plugin::HashBL::has_hashbl_bodyre_replace) if can(Mail::SpamAssassin::Plugin::RaptorOnly::has_hashbl_bodyre_phone) replace_rules GB_PHONE_RBL body GB_PHONE_RBL eval:check_hashbl_bodyre_phone('wild.pccc.com', 'raw/max=10/shuffle/num/case/replace', '(?<![1-9])((?:(?:\+)?(?:<N0>|<N1>|<N2>|<N3>|<N4>|<N5>|<N6>|<N7>|<N8>|<N9>){1,3}[^a-zA-Z0-9]{0,2})?(?:<N0>|<N1>|<N2>|<N3>|<N4>|<N5>|<N6>|<N7>|<N8>|<N9>){2,3}[^a-zA-Z0-9]*(?:<N0>|<N1>|<N2>|<N3>|<N4>|<N5>|<N6>|<N7>|<N8>|<N9>){3,4}[^a-zA-Z0-9]*(?:<N0>|<N1>|<N2>|<N3>|<N4>|<N5>|<N6>|<N7>|<N8>|<N9>){4,6})(?!\d)', '127.0.1.16') priority GB_PHONE_RBL -100 tflags GB_PHONE_RBL net describe GB_PHONE_RBL Message contains phone number found on blocklist (https://raptor.pccc.com/RBL) score GB_PHONE_RBL 6.0 endif replace_rules GB_PHONE_RBL_RAW rawbody GB_PHONE_RBL_RAW eval:check_hashbl_bodyre('wild.pccc.com', 'raw/max=10/shuffle/num/case/replace', 'tel:(?:\+)?((?:<N0>|<N1>|<N2>|<N3>|<N4>|<N5>|<N6>|<N7>|<N8>|<N9>){10,13})', '127.0.1.16') priority GB_PHONE_RBL_RAW -100 tflags GB_PHONE_RBL_RAW net describe GB_PHONE_RBL_RAW Message contains phone number found on blocklist (https://raptor.pccc.com/RBL) score GB_PHONE_RBL_RAW 6.0 endif else body GB_PHONE_RBL eval:check_hashbl_bodyre('wild.pccc.com', 'raw/max=10/shuffle/num/', '(?<![1-9])((?:(?:\d){1,3}[^a-zA-Z0-9]{0,2})?(?:\d){2,3}[^a-zA-Z0-9]*(?:\d){3,4}[^a-zA-Z0-9]*(?:\d){4,6})(?!\d)', '127.0.1.16') # slow regexp # body GB_PHONE_RBL eval:check_hashbl_bodyre('wild.pccc.com', 'raw/max=10/shuffle/num', '(?:\*+|\b)(?:\+|4{2})?(?:[\s\*]+)?(?:[0-9]{1,2})?((?:[\s,\^\*]+)?[(|{|\*+]?[0-9]{3}[)|}|\*+]?(?:[-\s\.\*_~,:\*]+)?[0-9]{3}(?:[-\s\.\*_~,"]+)?[0-9]{4,6})(?:\*+|\b)', '127.0.1.16') priority GB_PHONE_RBL -100 tflags GB_PHONE_RBL net describe GB_PHONE_RBL Message contains phone number found on blocklist (https://raptor.pccc.com/RBL) score GB_PHONE_RBL 6.0 rawbody GB_PHONE_RBL_RAW eval:check_hashbl_bodyre('wild.pccc.com', 'raw/max=10/shuffle/num', 'tel:(?:\+)?([0-9]{10,13})', '127.0.1.16') priority GB_PHONE_RBL_RAW -100 tflags GB_PHONE_RBL_RAW net describe GB_PHONE_RBL_RAW Message contains phone number found on blocklist (https://raptor.pccc.com/RBL) score GB_PHONE_RBL_RAW 6.0 endif endif endif endif #FAKE PRODUCTS USING SHAREPOINT body __KAM_FAKE_SHAREPOINT_PRODUCTS1 /bitdefender security cloud/i body __KAM_FAKE_SHAREPOINT_PRODUCTS2 /renewed/i meta KAM_FAKE_SHAREPOINT_PRODUCTS (KAM_FAKE_SHAREPOINT + __KAM_FAKE_SHAREPOINT_PRODUCTS1 + __KAM_FAKE_SHAREPOINT_PRODUCTS2 >= 3) describe KAM_FAKE_SHAREPOINT_PRODUCTS Spams abusing Sharepoint score KAM_FAKE_SHAREPOINT_PRODUCTS 3.0 #ODDNAME ENGINE #SIG body __KAM_ODDNAME_1 /(Respond|Message back|reply).{0,4}(OPT.?OUT|NOT INTERESTED)/i #HAWK body __KAM_ODDNAME_2 /we offer|how about a quote|connect for a quote|good time in mind|number to quickly connect|best time to contact|direct line to connect/i #SUBJ header __KAM_ODDNAME_3 Subject =~ /best line to reach|payroll|leads|call answering|quick minute|talk tomorrow|available today/i #WHAT body __KAM_ODDNAME_4 /high.?speed internet|payroll solution|x more visit|inbound call|marketing (division|arm)|reduce its phone/i meta KAM_ODDNAME ( __KAM_ODDNAME_1 + __KAM_ODDNAME_2 + __KAM_ODDNAME_3 + __KAM_ODDNAME_4 + FREEMAIL_FROM >= 5 ) describe KAM_ODDNAME Engine Hawking Products with Odd rotating business names score KAM_ODDNAME 7.5 #FAKE HOLD #from header __KAM_FAKE_HOLD1 From:name =~ /TD.?Ameritrade/i #subj header __KAM_FAKE_HOLD2 Subject =~ /account is on hold/i #prob body __KAM_FAKE_HOLD3 /account has been put on hold/i #action body __KAM_FAKE_HOLD4 /verify your identity/i meta KAM_FAKE_HOLD ( __KAM_FAKE_HOLD1 + __KAM_FAKE_HOLD2 + __KAM_FAKE_HOLD3 + __KAM_FAKE_HOLD4 + KAM_SHORT >= 5) describe KAM_FAKE_HOLD Fake Account Hold Scams score KAM_FAKE_HOLD 7.5 #PAYROLL SCANNER header __KAM_PAYROLL_SCANNER1 From =~ /account/i header __KAM_PAYROLL_SCANNER2 Subject =~ /payroll/i body __KAM_PAYROLL_SCANNER3 /e-?mail was sent from \"/i meta KAM_PAYROLL_SCANNER ( __KAM_PAYROLL_SCANNER1 + __KAM_PAYROLL_SCANNER2 + __KAM_PAYROLL_SCANNER3 + (T_HTML_ATTACH + __KAM_SHTML_ATTACH >= 1) + KAM_IFRAME >= 5) describe KAM_PAYROLL_SCANNER Payroll Scam Emails score KAM_PAYROLL_SCANNER 7.5 #KAM_REFRESH # LIKELY NEED MORE EFFICIENT RAPTOR TAG rawbody KAM_HTTP_REFRESH /http-equiv=("|')?refresh("|')?/i describe KAM_HTTP_REFRESH Contains an http refresh score KAM_HTTP_REFRESH 0.5 #BAD HTML MESSAGES meta KAM_BAD_HTML (KAM_SHORT + (T_HTML_ATTACH + __KAM_SHTML_ATTACH >= 1) + KAM_HTTP_REFRESH + UNWANTED_LANGUAGE_BODY >= 3) describe KAM_BAD_HTML Email With a likely bad or dangerous html attachment score KAM_BAD_HTML 6.5 #BAD CONTENT-TYPE ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader KAM_BAD_CONTENT Content-Type =~ /image\/png.*\.s?html?"?$/i describe KAM_BAD_CONTENT Content likely using evasion techniques score KAM_BAD_CONTENT 6.0 endif #FAKE MT BANK header __KAM_FAKE_MT1 Subject =~ /Important Notice from M&T/i body __KAM_FAKE_MT2 /Important (message|Notice) From /i tflags __KAM_FAKE_MT2 nosubject #3 removed - looking at X-PHP-Originating-Script: or something similar - header __X_PHP_EXISTS ALL =~ /^X-PHP-/m header __KAM_FAKE_MT4 From:name =~ /M&T Bank/i header __KAM_FAKE_MT5 From:addr !~ /mtb\.com/i meta KAM_FAKE_MT (__KAM_FAKE_MT1 + __KAM_FAKE_MT2 + KAM_SHORT + __HAS_PHP_ORIG_SCRIPT + __KAM_FAKE_MT4 + (__KAM_FAKE_MT5 + SPF_FAIL >= 1) >= 5) describe KAM_FAKE_MT Fake Bank Alert Scam score KAM_FAKE_MT 7.5 #FAKE SHARED DOCUMENT header __KAM_FAKE_SHARE1 Subject =~ /document shared with you/i body __KAM_FAKE_SHARE2 /sent you the following/i meta KAM_FAKE_SHARE ( __KAM_FAKE_SHARE1 + __KAM_FAKE_SHARE2 + __GB_ANY_REDIR >= 3) describe KAM_FAKE_SHARE Fake sharing email scam score KAM_FAKE_SHARE 4.5 #BTC SCAM header __KAM_BTC1 Subject =~ /btc|bitcoin/i body __KAM_BTC2 /passive income|\d+\s?btc to your wallet/i tflags __KAM_BTC2 nosubject meta KAM_BTC ( __KAM_BTC1 + __KAM_BTC2 + ( __GB_ANY_REDIR || __TO_UNDISCLOSED ) >= 3) describe KAM_BTC BTC Investment Scam score KAM_BTC 8.5 #PHOTO PHISH body __KAM_PHOTOPHISH1 /here are the(se)? (pics|pictures|images|photo)|(here is|forwarded|sent) (this|that) (photo|pic)|have a look|send these pics before|photos from last week/i body __KAM_PHOTOPHISH2 /(guess|not sure if|hope|presume) (it\'s|they\'re|they are) still (appropriate|related|needed|relevant)|still the right time for them|send them to you way sooner|just occurred to me/i body __KAM_PHOTOPHISH3 /remember the (m[ae]n|wom[ea]n|girls) (in|on) (the|this) (pic|image|photo)|recall the (guys|girls) on the last \d+\s+pictures|assume you know most of these (guys|girls)/i meta KAM_PHOTOPHISH (( __KAM_PHOTOPHISH1 + __KAM_PHOTOPHISH2 >= 2) + (__HAS_ANY_URI >= 1) >= 2 ) describe KAM_PHOTOPHISH Photograph phishing scam score KAM_PHOTOPHISH 7.0 meta KAM_PHOTOPHISHLOW __KAM_PHOTOPHISH3 + __HAS_ANY_URI >= 2 describe KAM_PHOTOPHISHLOW Photograph phishing scam [lower confidence] score KAM_PHOTOPHISHLOW 5.0 #DIRECT DEPOSIT body __KAM_DIRECTDEPOSIT1 /payroll|pay account/i body __KAM_DIRECTDEPOSIT2 /(update|Change) my (pay account|Direct deposit)/i tflags __KAM_DIRECTDEPOSIT2 nosubject header __KAM_DIRECTDEPOSIT3 Subject =~/direct deposit change/i meta KAM_DIRECTDEPOSIT ( __KAM_DIRECTDEPOSIT1 + __KAM_DIRECTDEPOSIT2 + __KAM_DIRECTDEPOSIT3 + ( KAM_RAPTOR_EXTERNAL + FREEMAIL_FROM >= 1) >= 3) describe KAM_DIRECTDEPOSIT Direct Deposit Phish ifplugin Mail::SpamAssassin::Plugin::RaptorOnly if can(Mail::SpamAssassin::Conf::feature_subjprefix) subjprefix KAM_DIRECTDEPOSIT [Phish] endif endif score KAM_DIRECTDEPOSIT 4.5 ifplugin Mail::SpamAssassin::Plugin::OLEVBMacro #MAL INVOICE header __KAM_MALINVOICE1 Subject =~ /Tax Invoice/i body __KAM_MALINVOICE2 /tax invoice/i tflags __KAM_MALINVOICE2 nosubject mimeheader __KAM_MALINVOICE3 Content-type =~ /Name=\"?Form.*\.xls\"?$/i meta KAM_MALINVOICE ( KAM_OLEMACRO_RENAME + __KAM_MALINVOICE1 + __KAM_MALINVOICE2 + __KAM_MALINVOICE3 >= 4) describe KAM_MALINVOICE Malicious Invoice with Dangerous Attachment ifplugin Mail::SpamAssassin::Plugin::RaptorOnly if can(Mail::SpamAssassin::Conf::feature_subjprefix) subjprefix KAM_MALINVOICE [Malware] endif endif score KAM_MALINVOICE 10.0 endif #LEAD SUPPLY body KAM_LEAD_SUPPLY /The Lead Supply via marketing services from The Email Bureau|The Email Bureau Limited/i describe KAM_LEAD_SUPPLY Spam from Lead Supply score KAM_LEAD_SUPPLY 10.0 #FAKE LINKEDIN header __KAM_FAKE_LINKEDIN1 From:name =~ /Linkedin/i header __KAM_FAKE_LINKEDIN2 From:addr !~ /linkedin\.com$/i header __KAM_FAKE_LINKEDIN2A From:addr =~ /googleusercontent/i header __KAM_FAKE_LINKEDIN3 Subject =~ /\d+ searches this week|looking at your profile|found by people|matches this job|have (?:a|\d+) new message|searching for you/i meta KAM_FAKE_LINKEDIN (__KAM_FAKE_LINKEDIN1 + __KAM_FAKE_LINKEDIN2 + __KAM_FAKE_LINKEDIN2A + __KAM_FAKE_LINKEDIN3 >= 3) describe KAM_FAKE_LINKEDIN Fake LinkedIn messages score KAM_FAKE_LINKEDIN 4.5 ifplugin Mail::SpamAssassin::Plugin::HeaderEval if can(Mail::SpamAssassin::Plugin::HeaderEval::has_check_invalid_from) header __KAM_GB_INVALID_FROM eval:check_invalid_from() meta KAM_GB_INVALID_FROM (__KAM_GB_INVALID_FROM && ! ( ALL_TRUSTED || NO_RELAYS || __BOUNCE_CTYPE ) ) describe KAM_GB_INVALID_FROM From Address is invalid score KAM_GB_INVALID_FROM 5.0 else #INVALID FROM RULE header __KAM_GB_INVALID_FROM_NO_DOTS From:addr !~ /\./ header __KAM_GB_INVALID_FROM_NO_AT From:addr !~ /\@/ header __KAM_TWODOTS From:addr =~ /\@.*\.\./i meta KAM_GB_INVALID_FROM (__KAM_GB_INVALID_FROM_NO_DOTS + __KAM_GB_INVALID_FROM_NO_AT + __KAM_TWODOTS >= 1) && ! ( ALL_TRUSTED || NO_RELAYS || __BOUNCE_CTYPE ) describe KAM_GB_INVALID_FROM From Address is invalid score KAM_GB_INVALID_FROM 5.0 endif else #INVALID FROM RULE header __KAM_GB_INVALID_FROM_NO_DOTS From:addr !~ /\./ header __KAM_GB_INVALID_FROM_NO_AT From:addr !~ /\@/ header __KAM_TWODOTS From:addr =~ /\@.*\.\./i meta KAM_GB_INVALID_FROM (__KAM_GB_INVALID_FROM_NO_DOTS + __KAM_GB_INVALID_FROM_NO_AT + __KAM_TWODOTS >= 1) && ! ( ALL_TRUSTED || NO_RELAYS || __BOUNCE_CTYPE ) describe KAM_GB_INVALID_FROM From Address is invalid score KAM_GB_INVALID_FROM 5.0 endif #INVALID FROM HEADER header __KAM_INVFROM1 From =~ /<[^>]*$/ header __KAM_INVFROM2 From =~ /^[^<]*>/ meta KAM_INVFROM (__KAM_INVFROM1 + __KAM_INVFROM2 >= 1) score KAM_INVFROM 2.0 describe KAM_INVFROM Invalid From Header containing mismatched <>'s meta GB_INVALID_FROM_NOTLS ( KAM_GB_INVALID_FROM && KAM_NOTLS ) describe GB_INVALID_FROM_NOTLS From Address is invalid without TLS connection score GB_INVALID_FROM_NOTLS 1.5 #FAKE PAYROLL header __KAM_FAKE_PAYROLL1 Subject =~ /payroll verification/i #change body __KAM_FAKE_PAYROLL2 /new payroll directory/i #oddlang body __KAM_FAKE_PAYROLL3 /required directive/i #oddlink uri __KAM_FAKE_PAYROLL4 /\.boxmode\.io/i meta KAM_FAKE_PAYROLL ( __KAM_FAKE_PAYROLL1 + __KAM_FAKE_PAYROLL2 + __KAM_FAKE_PAYROLL3 + __KAM_FAKE_PAYROLL4 >= 4) describe KAM_FAKE_PAYROLL Payroll Scam score KAM_FAKE_PAYROLL 6.0 #DATING ADD THAT IS EXPLICIT body __KAM_DATING1 /women seeking happiness/i body __KAM_DATING2 /18\+ platform/i mimeheader __KAM_DATING3 Content-type =~ /\.(png|jpe?g)\"?$/i meta KAM_DATING ( __KAM_DATING1 + __KAM_DATING2 + __KAM_DATING3 + (FREEMAIL_FORGED_REPLYTO + FREEMAIL_FROM >= 1) >= 4) describe KAM_DATING Explicit Content Dating Advert score KAM_DATING 4.5 #FAKE EFAX header __KAM_FAKE_EFAX1 From:addr !~ /efax.com/i header __KAM_FAKE_EFAX2 Subject =~ /new fax document/i body __KAM_FAKE_EFAX3 /efax/i uri __KAM_FAKE_EFAX4 /\.html?/i meta KAM_FAKE_EFAX ( __KAM_FAKE_EFAX1 + __KAM_FAKE_EFAX2 + __KAM_FAKE_EFAX3 + __KAM_FAKE_EFAX4 >=4) describe KAM_FAKE_EFAX Fake Zix Email score KAM_FAKE_EFAX 7.0 #PIPEDRIVE HTML uri KAM_PIPEDRIVE_HTML /\.pipedrive\.email\/.*\.s?html?/i describe KAM_PIPEDRIVE_HTML Suspicious HTML Link in an email score KAM_PIPEDRIVE_HTML 4.0 #GEEKSERVICES uri __KAM_GEEKSERVICES1 /geeks?-?(squad)?(hub|services)\d+\.co|gsquad-services\d+\.co/i header __KAM_GEEKSERVICES1A From:addr =~ /geeks?-?(squad)?(hub|services)\d+\.co|gsquad-services\d+\.co/i header __KAM_GEEKSERVICES2 Subject =~ /receipt|renewal|renewing|subscription/i body __KAM_GEEKSERVICES2A /bitcoin|coinbase/i meta KAM_GEEKSERVICES ( (__KAM_GEEKSERVICES1 + __KAM_GEEKSERVICES1A >= 1) + (__KAM_GEEKSERVICES2 + __KAM_GEEKSERVICES2A >= 1) >= 2) describe KAM_GEEKSERVICES Fake Geek Squad Services score KAM_GEEKSERVICES 9.0 #FAKE SECURITY ALERT body __KAM_FAKE_SECURITY1 /Security Alert/i header __KAM_FAKE_SECURITY2 Subject =~ /(Failed login|Account must be updated)/i meta KAM_FAKE_SECURITY (__KAM_FAKE_SECURITY1 + __KAM_FAKE_SECURITY2 + __GB_ANY_REDIR >= 3) describe KAM_FAKE_SECURITY Likely a fake security alert score KAM_FAKE_SECURITY 5.5 #FAKE GEEKSQUAD header KAM_FAKE_GEEKSQUAD From:addr =~ /\@geek-?(squad)?\-?services\d+\.|productshipping-?hub\d+\./i describe KAM_FAKE_GEEKSQUAD Fake Geek Squad Notice score KAM_FAKE_GEEKSQUAD 7.0 #FAKE GEEKSQUAD VARIANT 2 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __KAM_FAKE_GEEKSQUAD2_1 Content-Type =~ /geeksquad.*\.jpe?g/i header __KAM_FAKE_GEEKSQUAD2_2 Subject =~ /antivirus receipt/i meta KAM_FAKE_GEEKSQUAD2 ( __KAM_FAKE_GEEKSQUAD2_1 + __KAM_FAKE_GEEKSQUAD2_2 + FREEMAIL_FROM >= 3) describe KAM_FAKE_GEEKSQUAD2 Fake Geek Squad Notice score KAM_FAKE_GEEKSQUAD2 4.5 endif #FAKE PAYROLL UPDATE #subj header __KAM_FAKE_PAY_UPDATE1 Subject =~ /Payroll (details?|information) (rectification|adjust|update)|account information|pay(check|roll) ((re\-)?update|review)|(change|update) (DD|info|request)|direct deposit|new bank|UPDATE (BANK|PAYCHECK)|BANK (STATUS|CHANGE)|modification request|update salary|quick update|(^|\b)D(\.|-)?D ?(stub|pay|information|update|request)|(modification|change) (in|of) (DD|direct.?deposit|account)|Demand Change|^\s$|DD[\- ]*(Authorization|Modify)|help needed|new account|account (change|replace|update)|pay.?roll (update|adjustment)|request? for (change|update)|have a request|RENSEIGNEMENTS\s+.{1,16}\s+BANCAIRES|URGENT(\b|$)|adjustment of bank|ASSIST\!|correction of ACH|paycheck|pay D\-D|payroll \(?info|modifications? to (electronic fund transfer|ACH|EFT)|replac(e|ing) bank info|have a moment|update (of|my) (bank )?account|^Changes$|emolument|D D Pay.?Stub|changement de compte|new deposit|DD SWITCH|Immediate Details Change|banking info update|Employee Pay|payroll modification|claim for change|pay request|request for Payroll|updat(e|ing) bank(ing)? info|change in payroll|update pay info|Paystub.?dd|Update on Account|DD Auth|Change of Pay account/i #urg body __KAM_FAKE_PAY_UPDATE2 /(for|before|against) (my|the) (subsequent|current|next|upcoming) pay|for next payroll|kindly review (payroll|your) statement|when the next payday|prochaine date de paiement|current pay cycle|next pay (run|date)|Inactive in a few day|on-?time for any ongoing|what data is required|urgent help|next salary|(upcoming|forthcoming) payroll|effective (for this|this|on) pay.?(day|period)|effect for next pay|made right now|closed in (a )?few day|for the current pay|next pay period|prompt attention|subsequent payroll|finish the update|can ?not afford any more delay|before the pay.?(roll|date)|straight away|against the upcoming pay|before payroll is run|timely payment|for my current pay|prochain ch.que de paie|quick assistance|account will not be difficult|next pay cycle|immediate effect|before next pay|for the next (check|pay)|(the|this) coming payroll|before the current check|issues with the bank|submit the new banking details to you|before processing the next pay|prochaine paie|let me know how to proceed|recently changed (account|bank)|ahead of payroll|before.{5,10}the next pay|before the pay cycle/i tflags __KAM_FAKE_PAY_UPDATE2 nosubject #task body __KAM_FAKE_PAY_UPDATE3 /(change|updat(e|ing)) (of my|my) (ACH|bank(ing)?|DD|paycheck|Payroll|payment|pay|new pay) (direct.?deposit|deposit account|info|account)|new bank(ing)? (details|info)|change the account on my pay|direct.?deposit\s+information|(move|change) (in )?(my|the) (bank|payroll)|account information be change|update my (Pay|bank|account|new checking)|account needs to be updated|change in my ACH|I switched bank|paychecks? needs to be update|updat(e|ing) my (payroll.?)?direct.?deposit|designate it as my payee|bank information.{0,35} on file has changed|about my direct deposit|change (on )?my (old account|direct deposit)|updating for my salary|just changed banks|changed my financial institut|DD details changed|new account for my direct deposit|new bank account|(?:coordonn\x{C3}\x{A9}es|informations) bancaires|replace my bank(ing)? info|updat(e|ing) my deposit|update my information on pay|passer\s+.\s+un nouveau compte|replace my (previous|current) (bank|direct deposit)|direct.?deposit update|d\x{C3}\x{A9}p\x{C3}\x{B4}ts direct|move my paycheck|(change|amend) the direct deposit|Confirmez .{1,16}quand le changement|direct deposit details? has change|new information on file for direct deposit|amending the text about my pay|change my personal paycheck|issue with the DD|replace my pay.?roll info|payroll records are updated|make the modification/i tflags __KAM_FAKE_PAY_UPDATE3 nosubject #sigonly/freemail meta KAM_FAKE_PAY_UPDATE ( ( KAM_RAPTOR_EXTERNAL + FREEMAIL_FROM >= 1 ) + __KAM_FAKE_PAY_UPDATE1 + __KAM_FAKE_PAY_UPDATE2 + __KAM_FAKE_PAY_UPDATE3 >= 4) describe KAM_FAKE_PAY_UPDATE Likely a fake ACH/Payroll Scam score KAM_FAKE_PAY_UPDATE 9.0 meta KAM_FAKE_PAY_UPDATE_LOW ( KAM_RAPTOR_EXTERNAL + FREEMAIL_FROM >= 1 ) && ( __KAM_FAKE_PAY_UPDATE1 + __KAM_FAKE_PAY_UPDATE2 + __KAM_FAKE_PAY_UPDATE3 >= 2) && ! KAM_FAKE_PAY_UPDATE && !EXTRACTTEXT describe KAM_FAKE_PAY_UPDATE_LOW Likely a fake ACH/Payroll Scam (Lower Confidence) score KAM_FAKE_PAY_UPDATE_LOW 7.5 #ENCRYPTED PAYLOAD uri __KAM_ENCRYPTED_LIVE1 /onedrive\.live\.com/i body __KAM_ENCRYPTED_LIVE2 /password:/i meta KAM_ENCRYPTED_LIVE ( __KAM_ENCRYPTED_LIVE1 + __KAM_ENCRYPTED_LIVE2 >= 2) describe KAM_ENCRYPTED_LIVE Likely malware payload score KAM_ENCRYPTED_LIVE 7.0 #HOMEDEPOT SURVEY header __KAM_HOMEDEPOTE1 From:addr =~ /\@homedepote\.com/i meta KAM_HOMEDEPOTE ( __KAM_HOMEDEPOTE1 >= 1) describe KAM_HOMEDEPOTE Fake Home Depot Messages score KAM_HOMEDEPOTE 10.0 #SIGNATURE ONLY VERSION 2.0 if (version >= 4.000000) if can(Mail::SpamAssassin::Plugin::BodyEval::has_plaintext_body_sig_ratio) body __GB_BODY_ONLY_SPACE eval:check_blank_line_ratio('100', '100') body __KAM_SIGONLY_BODY_NONE eval:plaintext_body_length('0','0') body __KAM_SIGONLY_SIG_100 eval:plaintext_sig_length('100') meta KAM_SIGONLY ( __KAM_SIGONLY_BODY_NONE || __GB_BODY_ONLY_SPACE ) && __KAM_SIGONLY_SIG_100 && !__GB_CALENDAR_ATTACH && !__MIME_ATTACHMENT && !__ANY_IMAGE_ATTACH && !__PDF_ATTACH score KAM_SIGONLY 3.5 else meta KAM_SIGONLY 0 endif endif #GAMBLING SPAM meta KAM_GAMBLING (KAM_MANYTO + KAM_SHORT + FORGED_GMAIL_RCVD + __FREEMAIL_DOC_PDF >= 4) describe KAM_GAMBLING Emails hawking gambling and similar spams score KAM_GAMBLING 2.0 #JUNK_INVOICE ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __KAM_JUNK_INVOICE1 Content-Type =~ /invoice\.jpe?g/i body __KAM_JUNK_INVOICE2 /\[image\:\s+invoice/i header __KAM_JUNK_INVOICE3 Subject =~ /Invoice/i meta KAM_JUNK_INVOICE (FREEMAIL_FROM + __KAM_JUNK_INVOICE1 + __KAM_JUNK_INVOICE2 + __KAM_JUNK_INVOICE3 >= 4) score KAM_JUNK_INVOICE 6.0 endif #ONMICROSOFT header __KAM_ONMICROSOFT1 From =~ /[-\.]onmicrosoft\.com/i header __KAM_ONMICROSOFT2 Reply-To =~ /[-\.]onmicrosoft\.com/i header __KAM_ONMICROSOFT3 Resent-from =~ /[-\.]onmicrosoft\.com/i meta KAM_ONMICROSOFT (( __KAM_ONMICROSOFT1 + __KAM_ONMICROSOFT2 >= 1) && !__AUTOREPLY_ASU ) describe KAM_ONMICROSOFT Mail From or Reply-to an unprovisioned domain on Microsoft 365 score KAM_ONMICROSOFT 6.0 meta KAM_ONMICROSOFT_RF ( __KAM_ONMICROSOFT3 && !__AUTOREPLY_ASU ) describe KAM_ONMICROSOFT_RF Mail Resent-from an unprovisioned domain on Microsoft 365 score KAM_ONMICROSOFT_RF 0.001 #TEMPORARY.LINK header __KAM_TEMPORARYLINK1 From =~ /\w\.temporary\.link/i header __KAM_TEMPORARYLINK2 Reply-To =~ /\w\.temporary\.link/i header __KAM_TEMPORARYLINK3 Resent-from =~ /\w\.temporary\.link/i meta KAM_TEMPORARYLINK (( __KAM_TEMPORARYLINK1 + __KAM_TEMPORARYLINK2 >= 1) && !__AUTOREPLY_ASU ) describe KAM_TEMPORARYLINK Mail From or Reply-to an unprovisioned domain on InMotion Hosting score KAM_TEMPORARYLINK 6.0 meta KAM_TEMPORARYLINK_RF ( __KAM_TEMPORARYLINK3 && !__AUTOREPLY_ASU ) describe KAM_TEMPORARYLINK_RF Mail Resent-from an unprovisioned domain on Microsoft 365 score KAM_TEMPORARYLINK_RF 0.001 #FAKE INVOICE header __KAM_FAKE_INVOICEMS1 Subject =~ /invoice/i body __KAM_FAKE_INVOICEMS2 /process ACH/i meta KAM_FAKE_INVOICEMS KAM_ONMICROSOFT + ( __KAM_FAKE_INVOICEMS1 + __KAM_FAKE_INVOICEMS2 >= 2) >=2 describe KAM_FAKE_INVOICEMS Fake Invoice Scam score KAM_FAKE_INVOICEMS 4.5 #FAKE ACE/LOWES/ETC ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_rules __KAM_FAKE_LOWES2 #FUZZ body __KAM_FAKE_LOWES2 /C<O1>stc<O1> (giveaway|new gift|credit|local reward)|(erewards?|epoints?|evouch|thank you|\d\.\d) from (starbucks|ace.?hardware)|ace[-_]?hardware|sams[-_]?club|complimentary-(fuel\/gas|gas\/Fuel) card|(monday|tuesday|wednesday|thursday|friday|saturday|sunday) (gift-?cert|bonus)|costco-wholesale|\d from your CVS St<O1>re|cvs-pharmacy.?gift.?voucher|giveaway from (bud.?light|fox)|glft.?card|\d from cvs pharm|one hundred from C.?V.?S|nike sends \d+|Sam\'sClub|amount of \d+\.0(\b|$)|\d+ from Verizon|points rwrds|verizonrewards|UNINQUE GIVEAWAY|_Ace.?Hardware_|C Ostco|Sam\'s...Club|\$\-Prize|G[1l]ft.?cert|coupon from C<O1>stc<O1>|(target|T\-mobile) e.?(voucher|coupon)|\(home.?depot\)|homedepot bonus|\brwrds\b|_shopper|gift-voucher|has a prize|home depot\-|home\-depot|kohls(\s|\b|$)|BK Card/i tflags __KAM_FAKE_LOWES2 nosubject endif #VOUCHER/COUPON header __KAM_FAKE_LOWES1 Subject =~ /(costco|ace.?hardware|cvs|cvs.?pharmacy|t-mobile|target|burgerking).*(christmas|e-?coupon|gift.?voucher|bonus|(e.?)?voucher|gift.?card|give.?away|credit)|ace-hard?ware|massive thank you|give?.?away winner|(\d+|dols|bucks) (for you )?from (Starbuck|Sam|Costco)|gas reward|acehardware|samsclub|free samples|gas drop|\d+\.\d+ vouch from costco|CVS\s+expires|sams_club|(fuel|gas) shopping spree|giveaway from (bud.?light|fox)|glft.?card|thank you from (\(?Home.?Depot\)?|cvs)|cvs e-?rewards|nike sends \d+|Verizon (August|September) Gift|points rwrds|verizonrewards|thanks (from|to) .?(sam\'s club|ace.?hardware)|survey reward|\d+ gift.?card pending|(cvs|verizon) (gift.?cert|coupon|has something special|has \d\.0)|\d+ (bucks|dols)|\d+\.0 for you|your \d+ at Verizon|(home.?depot|t-mobile) bonus|Evouch from Sams Club|_ace.?hardware_|use your\s+from Verizon|glft.?certificate|points rwrds|home.?depot_shopper|\$\d+ at Sam\'?s.?club|gift for you|costco gift.?cert|walgreens bonus points/i #ODDLANG body __KAM_FAKE_LOWES3 /\d buck|your \d+\.0|\d+ dols|sent with joy|chosen as winer|spend you \$|(huge|massive) (thank you|thanks)|tough times|humble gift|evouch|\bepoint|ereward|we are loved|sending some love|(difficult|turbulent) times|nearest-pharm|weekend is on us|wish you a happy (August)|starbucks wishes you|spend bonus|inspire your dreams|unsuscribe here|want to give back|Enjoy_your_weekend|all the-best|e-?vouch|weekly gift.?card|big thanks for (Ace|costco|cvs)|\d+ sent to you by (Ace|costco|cvs)|rewards balance = \d+ USD|this make it better|Ace.?hardware style|awaiting to be spend|dols-voucher|you have been chosen|scary.?reward|tuff times|super.?(monday|tuesday|wednesday|thursday|friday|saturday|sunday).?mega|send a postcard|day-vouch|\d+ bucks coupon|inside = \$\d+|\d+ coupon|\%Subscriber|as an important customer|glft|here is a thanks|202\d has been difficult|how we celebrate|available for download|points\-can be used/i #URGENT body __KAM_FAKE_LOWES4 /will be expiring|expires|(finishes|change by) (mon|tue|wed|thu|fri|sat|sun)|pending to activate|(use by|until) (Jan|Feb|mar|apr|may|jun|Jul|aug|sep|oct|nov|dec|mon|tue|wed|thu|fri|sat|sun)|pending (to|your) activat|(valid until|(redeem|use|spend) (before|by)) (mid.?night|mon|tue|wed|thu|fri|sat|sun|aug|sep|oct|nov|dec|jan|feb|mar|apr|may|jun|jul)|ending tomorrow|before midnight|received before \d|activat(e|ion) (today|by|before)|end of month giveaway|ends (today|tomorrow)|valid for (today|the weekend|\d+ hours)|August Help|pending to use|by next (Mon|tue|Wed|Thu|Fri|Sat|sun)|(received?|used?) as soon as possible|ends the \d+(nd|th)|yet to be used|this.? (Mon|Tue|Wed|Thu|Fri|Sat|Sun)|use before|used? \d+\.\d+ by (Sun|Mon|Tue|Wed|Thu|Fri|Sat)|last day to activate|ends (Oct(ober)?|Nov(ember)?|Dec(ember)?) \d|\d+ hours to change|grab your \d+|\d hours left|use now|end of today|used today|this week|\d is available since|before christmas|act fast|will go quickly/i meta KAM_FAKE_LOWES ( __KAM_FAKE_LOWES1 + __KAM_FAKE_LOWES2 + __KAM_FAKE_LOWES3 + __KAM_FAKE_LOWES4 >= 4) describe KAM_FAKE_LOWES Fake Costco/Ace Hardware/etc. coupons score KAM_FAKE_LOWES 6.0 meta KAM_FAKE_LOWES_LOW !KAM_FAKE_LOWES && ( __KAM_FAKE_LOWES1 + __KAM_FAKE_LOWES2 + __KAM_FAKE_LOWES3 + __KAM_FAKE_LOWES4 >= 3) describe KAM_FAKE_LOWES_LOW Fake Costco/Ace Hardware/etc. coupons (Lower Confidence) score KAM_FAKE_LOWES_LOW 4.5 #FAKE ACE header __KAM_FAKE_ACE1 From:addr =~ /\@.*ace.*/i header __KAM_FAKE_ACE2 From:addr !~ /acehardware\.com/i meta KAM_FAKE_ACE ( (__KAM_FAKE_ACE1 + __KAM_FAKE_ACE2 >=2 ) + (__KAM_FAKE_LOWES1 + __KAM_FAKE_LOWES2 >= 1) >= 2) describe KAM_FAKE_ACE Possible Ace Hardware Forgery score KAM_FAKE_ACE 2.0 #BAD SCAN ifplugin Mail::SpamAssassin::Plugin::MIMEHeader body __KAM_BAD_SCAN1 /scanned from MFP|\(\d+\) scanned/i header __KAM_BAD_SCAN2 Subject =~ /scan(ned)? image from MFP/i meta KAM_BAD_SCAN ( __KAM_BAD_SCAN1 + __KAM_BAD_SCAN2 + (T_HTML_ATTACH + __KAM_VM5 >= 1) >= 3) describe KAM_BAD_SCAN Likely a fake scan score KAM_BAD_SCAN 6.5 endif #TRADERBOT #BOT / DEPOSIT header __KAM_TRADEBOT1 Subject =~ /(auto|crypto|new|unique|trader?).?bot|(minimum|initial) deposit|without invest|automatic machine/i #EARN header __KAM_TRADEBOT2 Subject =~ /(raise|earn) from \d+ (\$+|USD|Eur|dollar|a (month|day))|earnings on crypto|\d+ (\$+|euro?|USD|dollars?) (every|per) (month|day)/i #BOT BODY body __KAM_TRADEBOT3 /(auto|crypto|new|trader?|unique).?bot|automatic machine|pro tariff|free monthly tariff|fully automatic/i tflags __KAM_TRADEBOT3 nosubject #TRADING BODY body __KAM_TRADEBOT4 /initial deposit|crytpocurrency trading|(field|world) of (trading|crypto)|make money on trading|solution for the trader|without investing|no investment|(find|news) for trader|traders can relax|lazy trader|currency trading/i tflags __KAM_TRADEBOT4 nosubject #EARN BODY body __KAM_TRADEBOT5 /(make|earn) from \d+ (\$+|USD|Eur|dollar)|(earn|make) \d+ (\$+|USD|Eur|dollar)|(over|more than) [\d,]+ (dollar|USD|Eur)/i tflags __KAM_TRADEBOT5 nosubject #LINK / ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __KAM_TRADEBOT6A Content-Type =~ /(earn.?from.?\d+.?(USD|Eur|dollar)|novice.?trader|(auto|crypto|trader?).?bot).*\.pdf"?$/i endif body __KAM_TRADEBOT6B /(personal|private|your) (secure )?link|link (below )?from PDF/i meta KAM_TRADEBOT ( __KAM_TRADEBOT1 + __KAM_TRADEBOT2 + __KAM_TRADEBOT3 + __KAM_TRADEBOT4 + __KAM_TRADEBOT5 + (__KAM_TRADEBOT6A + __KAM_TRADEBOT6B >= 1) + FREEMAIL_FROM >= 6 ) describe KAM_TRADEBOT Crypto Currency Trading Spams score KAM_TRADEBOT 9.0 #BIDDING/ESTIMATING #NAMES body __KAM_BIDEST1A /CSI Estimati(ng|on)|crossland estimating|Williams Estimating|Global Estimation|bolt estimating|prestige estimation|bidding estimating|define estimating|dreamland estimation|swift estimating LLC|define estimating,? LLC|perfect estimation.? llc|estimating solutions.? LLC|rockford estimation.? LLC|define estimating LLC|Rise Estimating LLC|american estimating|maple professionals|international estimating, llc|international estimates, llc|Estemanians, LLC|Dream Estimations|universal estimating llc|unity estimating|Cannon Estimation, LLC|Estimen LLC|The Global Estimation LLC|USA ESTIMATION LLC|Estimate Builders LLC|Quantify Bids, LLC|Grace Arch & Estimating, LLC|Unity Estimating|MultiTrade Estimating, LLC|buildify estimating|Needes Estimating/i header __KAM_BIDEST1B From =~ /bidding|estimat|globalbid|define the scope of work/i header __KAM_BIDEST1C Subject =~ /bidding|estimati(on|ng)|take.?off|(quote|quotation) (to|for) (bid|project|take.?off)|budget planning|CSI(\b|$)|constructions? project|project bid proposal|bid more/i #MORE INFO (removed detailed quote for FP) body __KAM_BIDEST2 /need assistance with a project|like more information|bidding and estimating service|estimate your projects|project for estimat|need of cost estimation|low cost detailed cost estimates|providing estimation|you really want take-offs|outsourced cost estimation|need any take.?off service|looking for accurate estimat|Take.?off services for any project|need a detailed estimate|offering budget cost estimates|cost estimating services|show you some sample|estimating.?take-offs? service|forward us the bid|quote on your project|(fair|sample) (take.?off|estimate)|complimentary detail from|send (me|us) the drawing|quick introductory call|send us the project's construction plans|quotes for your project|see attached sample|our example work|need any samples|provide detailed quantity take.?off|professional services in Quantity take.?off|provide material take.?off|estimates \& take.?off|20\% discount on your first estimate|cost estimating|architectural projects for us|need of expert construction estimating|handle your construction (take.?offs|estimat)|any job for us regarding estimat|benefit from our estimat|construction estimation service|estimation services are tailored|offer the most precise estimat|detailed commercial estimate|costing \& take\-?off|too much time on construction take-?off|send us plans for proposal|construction estimates and takeoffs|share your project drawings|require samples or a quotation|services like quantity takeoff|provide accurate estimates|remind you of our construction estimating|pending projects for architecture or estimation|looking for top\-notch estimation service|send plans \& scope|need estimating support|send over the set of plans|specialize in providing accurate (take.?off|estimate)|streamlined takeoff|professionally serve estimating|how our estimation services can benefit/i #TITLE body __KAM_BIDEST3 /Business Development Manager|(senior|certified) estimator|certified software|(office|marketing) manager|estimation (department|dept|company)|head of business devel|estimating (manager|service)|project +manager|Civil, MEP, Architectural|manager of business dev|Sales team|estimation department|bidding estimating|BD Manager/i #OBFU / COLD body __KAM_BIDEST4 /\(dot\)|thank you for considering our service|reaching out to introduce/i #SOFTWARE body __KAM_BIDEST5 /Accu-bid|McCormick|Blue\-Beam|Plan\-Swift|On\-Screen/i meta KAM_BIDEST ( (__KAM_BIDEST1A + __KAM_BIDEST1B + __KAM_BIDEST1C >= 1) + __KAM_BIDEST2 + (__KAM_BIDEST3 + __KAM_BIDEST5 >= 1) + (__KAM_BIDEST4 + FREEMAIL_FROM + KAM_FROM_URIBL_PCCC >= 1 ) >= 3 ) describe KAM_BIDEST Bidding and Estimating Spam score KAM_BIDEST 7.5 #FAKE BILL header __KAM_FAKE_BILL1 From:name =~ /alert/i header __KAM_FAKE_BILL2 Subject =~ /e\-bill copy/i body __KAM_FAKE_BILL3 /Payment mode: Paypal pro\-credits|paypal billing team/i body __KAM_FAKE_BILL4 /issues with the transaction/i meta KAM_FAKE_BILL ( __KAM_FAKE_BILL1 + __KAM_FAKE_BILL2 + __KAM_FAKE_BILL3 + __KAM_FAKE_BILL4 + FREEMAIL_FROM >= 5 ) describe KAM_FAKE_BILL Fake Invoice Scams score KAM_FAKE_BILL 6.0 #FAKE PO body __KAM_FAKE_PO1 /status on our purchase order/i header __KAM_FAKE_PO2 Subject =~ /PO \d+/i body __KAM_FAKE_PO3 /attached/i meta KAM_FAKE_PO (__KAM_FAKE_PO1 + __KAM_FAKE_PO2 + __KAM_FAKE_PO3 + T_HTML_ATTACH >= 4) describe KAM_FAKE_PO Fake Purchase Orders score KAM_FAKE_PO 6.0 #FAKE AGING REPORT header __KAM_FAKE_AGING1 Subject =~ /Aging Report/i body __KAM_FAKE_AGING2 /current aging report/i tflags __KAM_FAKE_AGING2 nosubject body __KAM_FAKE_AGING3 /treat it as urgent/i body __KAM_FAKE_AGING4 /email addresses in an excel/i meta KAM_FAKE_AGING ( __KAM_FAKE_AGING1 + __KAM_FAKE_AGING2 + __KAM_FAKE_AGING3 + __KAM_FAKE_AGING4 + KAM_RAPTOR_EXTERNAL >= 5) describe KAM_FAKE_AGING Phishes for Financial Information score KAM_FAKE_AGING 7.5 #PAYPAL FREEMAIL header __KAM_PAYPAL_FREEMAIL1 From:name =~ /paypal/i #body __KAM_PAYPAL_FREEMAIL2 /crypto.?currency/i meta KAM_PAYPAL_FREEMAIL ( FREEMAIL_FROM + __KAM_PAYPAL_FREEMAIL1 >= 2) describe KAM_PAYPAL_FREEMAIL PayPal spoofs from Freemail Addresses score KAM_PAYPAL_FREEMAIL 4.5 #FAKE DOCUSIGN ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __KAM_FAKE_DOCUSIGN1 Content-Type =~ /docusign\.png/i header __KAM_FAKE_DOCUSIGN2 Subject =~ /D0cuSign\: Signature Required/i meta KAM_FAKE_DOCUSIGN (__KAM_FAKE_DOCUSIGN1 + T_HTML_ATTACH >= 2) || (__KAM_FAKE_DOCUSIGN2) describe KAM_FAKE_DOCUSIGN Fake Docusign Document score KAM_FAKE_DOCUSIGN 3.0 endif #FAKE REIMB header __KAM_FAKE_REIMB1 Subject =~ /assistance/i #HOW body __KAM_FAKE_REIMB2 /mobile transfer/i #MONEY body __KAM_FAKE_REIMB3 /\$[\d,]+/i #ODDLANG & REIMBURSEMENT REQUEST body __KAM_FAKE_REIMB4 /reimbursement cheque/i #TRANSFER body __KAM_FAKE_REIMB5 /details for the transfer/i meta KAM_FAKE_REIMB ( __KAM_FAKE_REIMB1 + __KAM_FAKE_REIMB2 + __KAM_FAKE_REIMB3 + __KAM_FAKE_REIMB4 + __KAM_FAKE_REIMB5 + FREEMAIL_FROM >= 6) describe KAM_FAKE_REIMB Fake Reimbursement Request score KAM_FAKE_REIMB 9.0 #FAKE_AMAZON #2 header __KAM_FAKE_AMAZON2_1 From:name =~ /\#A.?m.?a.?z.?o.?n/i header __KAM_FAKE_AMAZON2_2 Subject =~ /A\-M\-A\-Z\-O\-N|payment confirmation|amazon.?e.?billing/i #body __KAM_FAKE_AMAZON2_3 /(888\s5\s?3\s?1\s?4\s?0\s?3\s?0|855\s5\s?4\s?5\s?6\s?2\s?0\s?1)/ body __KAM_FAKE_AMAZON2_3 /Receipt Id|Bill no/i uri __KAM_FAKE_AMAZON2_4 /googleusercontent\.com/i meta KAM_FAKE_AMAZON ( __KAM_FAKE_AMAZON2_1 + __KAM_FAKE_AMAZON2_2 + __KAM_FAKE_AMAZON2_3 + __KAM_FAKE_AMAZON2_4 + FREEMAIL_FROM >= 5 ) describe KAM_FAKE_AMAZON Fake Amazon Order score KAM_FAKE_AMAZON 7.5 #FAKE_APPLE header __KAM_FAKE_APPLE1 From:name =~ /\#.?A.?p.?p.?l.?e|statement/i header __KAM_FAKE_APPLE2 Subject =~ /i\.t\.u\.n\.e|membership confirmation|invoice|billing/i body __KAM_FAKE_APPLE3 /a\.p\.p\.l\.e|i\.c\.l\.o\.u\.d|app store team/i tflags __KAM_FAKE_APPLE3 nosubject uri __KAM_FAKE_APPLE4 /googleusercontent\.com/i meta KAM_FAKE_APPLE ( __KAM_FAKE_APPLE1 + __KAM_FAKE_APPLE2 + __KAM_FAKE_APPLE3 + __KAM_FAKE_APPLE4 + FREEMAIL_FROM >= 5 ) describe KAM_FAKE_APPLE Fake Apple Order score KAM_FAKE_APPLE 7.5 #FREEMAIL_ORD header __KAM_FREEMAIL_ORDER1 Subject =~ /thank you for your order/i meta KAM_FREEMAIL_ORDER ( __KAM_FREEMAIL_ORDER1 + FREEMAIL_FROM >= 2 ) describe KAM_FREEMAIL_ORDER Questionable message about an order but using freemail score KAM_FREEMAIL_ORDER 3.0 #PROBLEMATIC 2TLD PROVIDERS uri KAM_2TLD_PROBLEMS /(\.sa\.com|\.ru\.com|\.plesk\.page)/i describe KAM_2TLD_PROBLEMS Problematic 2TLD handlers being abused score KAM_2TLD_PROBLEMS 3.5 #CALLING ASSOCIATE #SUBJ header __KAM_CALLING_1 Subject =~ /answering solution/i #NAME body __KAM_CALLING_2 /Itotogit/i #TITLE body __KAM_CALLING_3 /answering associate/i tflags __KAM_CALLING_3 nosubject meta KAM_CALLING ( __KAM_CALLING_1 + __KAM_CALLING_2 + __KAM_CALLING_3 + FREEMAIL_FROM >= 4) describe KAM_CALLING Spamming Phone and Answering Solutions score KAM_CALLING 6.0 #SA and ZA ABUSE + CO.IN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_tag ABUSE_DOMAINS (?:\.(sa\.com|za\.com|co\.in))(\b|\/|$|\@) replace_rules __KAM_SA_ZA_ABUSE1 __KAM_SA_ZA_ABUSE2 uri __KAM_SA_ZA_ABUSE1 /<ABUSE_DOMAINS>/i header __KAM_SA_ZA_ABUSE2 From:addr =~ /<ABUSE_DOMAINS>/i meta KAM_SA_ZA_ABUSE (__KAM_SA_ZA_ABUSE1 + __KAM_SA_ZA_ABUSE2 >= 1) describe KAM_SA_ZA_ABUSE 2TLD Providers prevalent in spam abuse score KAM_SA_ZA_ABUSE 3.0 endif #FAKE COINBASE body __KAM_OBFU_COINBASE1 /C[\. ]O[\. ]I[\. ]N[\. ]B[\. ]A[\. ]S[\. ]E/i header __KAM_OBFU_COINBASE2 From:name =~ /C[\. ]O[\. ]I[\. ]N[\. ]B[\. ]A[\. ]S[\. ]E/i meta KAM_OBFU_COINBASE ( __KAM_OBFU_COINBASE1 + __KAM_OBFU_COINBASE2 >= 1 ) describe KAM_OBFU_COINBASE Likely Fake Coinbase Email using Obfuscation score KAM_OBFU_COINBASE 3.0 #FAKE COINBASE VARIANT header __KAM_FAKE_COINBASE2_1 Subject =~ /billing/i body __KAM_FAKE_COINBASE2_2 /sent a payment/i body __KAM_FAKE_COINBASE2_3 /BTC|paypal/i meta KAM_FAKE_COINBASE2 (__KAM_FAKE_COINBASE2_1 + __KAM_FAKE_COINBASE2_2 + __KAM_FAKE_COINBASE2_3 + FREEMAIL_FROM + __KAM_FAKE_AMAZON2_3 >= 5) describe KAM_FAKE_COINBASE2 Fake Coinbase Email score KAM_FAKE_COINBASE2 7.5 #FAKE COINBASE VARIANT 2 #FP fixed on 4/11 with the From:addr rule thanks to RunBox ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_rules __KAM_FAKE_COINBASE3_1 header __KAM_FAKE_COINBASE3_1 From:name =~ /c<O1><I1>nbase/i header __KAM_FAKE_COINBASE3_2 From:addr !~ /\@(.*?\.)?coinbase\.com/i meta KAM_FAKE_COINBASE3 (__KAM_FAKE_COINBASE3_1 + __KAM_FAKE_COINBASE3_2 >= 2) describe KAM_FAKE_COINBASE3 Fake Coinbase Notice score KAM_FAKE_COINBASE3 8.5 endif #FAKE COINBASE VARIANT 3 body __KAM_FAKE_COINBASE4_1 /Coinbase at risk/i body __KAM_FAKE_COINBASE4_2 /Coinbase\.com\/verify/i meta KAM_FAKE_COINBASE4 ( KAM_FAKE_COINBASE3 + __KAM_FAKE_COINBASE4_1 + __KAM_FAKE_COINBASE4_2 + KAM_SHORT >= 4) describe KAM_FAKE_COINBASE4 Fake Coinbase Email score KAM_FAKE_COINBASE4 4.5 #FAKE SURVEY header __KAM_FAKE_SURVEY1 From:addr =~ /Shopper.?Gift.?Card|survey/i body __KAM_FAKE_SURVEY2 /gift card (opp|promo)/i tflags __KAM_FAKE_SURVEY2 nosubject body __KAM_FAKE_SURVEY3 /\d second survey/i tflags __KAM_FAKE_SURVEY3 nosubject header __KAM_FAKE_SURVEY4 Subject =~ /gift card/i meta KAM_FAKE_SURVEY ( __KAM_FAKE_SURVEY1 + __KAM_FAKE_SURVEY2 + __KAM_FAKE_SURVEY3 + __KAM_FAKE_SURVEY4 + KAM_SA_ZA_ABUSE >= 5) describe KAM_FAKE_SURVEY Fake gift card surveys score KAM_FAKE_SURVEY 7.5 #REWARDS header __KAM_FAKE_REWARDS1 Subject =~ /(dollar general|t-mobile|ace hardware) (gift|reward)/i meta KAM_FAKE_REWARDS ( KAM_STORAGE_GOOGLE + __KAM_FAKE_REWARDS1 >= 2) describe KAM_FAKE_REWARDS Fake Reward emails score KAM_FAKE_REWARDS 3.0 #FAKE_AHS header __KAM_FAKE_AHS1 From =~ /AHS Warranty/i meta KAM_FAKE_AHS ( __KAM_FAKE_AHS1 + KAM_SOMETLD_ARE_BAD_TLD >= 2) describe KAM_FAKE_AHS Home Warranty Spam score KAM_FAKE_AHS 3.0 #FAKE_FICO #FUZZ body __KAM_FAKE_FICO1 /F[1l]co/i #ODD LANG body __KAM_FAKE_FICO1A /complimentary\-review/i #SUBJ header __KAM_FAKE_FICO2 Subject =~ /(cred[1il]t.?(points|score)|score heal?th|202\d score|3 bureaus|Equifax score)/i meta KAM_FAKE_FICO ((__KAM_FAKE_FICO1 + __KAM_FAKE_FICO1A >= 1) + __KAM_FAKE_FICO2 >= 2 ) describe KAM_FAKE_FICO Credit Score Spam score KAM_FAKE_FICO 6.0 #CAM DOMAIN ISSUES header __KAM_CAM_DOMAIN From:addr =~ /\.cam$/i meta KAM_CAM_DOMAIN ( KAM_SEMFRESH + __KAM_CAM_DOMAIN >= 2 ) describe KAM_CAM_DOMAIN Abusive TLD with a new domain score KAM_CAM_DOMAIN 3.0 #UNREAD MESSAGES header __KAM_UNREAD1 Subject =~ /unread message/i body __KAM_UNREAD2 /relationship status/i body __KAM_UNREAD3 /(see more of me here|photo album)/i meta KAM_UNREAD ( __KAM_UNREAD1 + __KAM_UNREAD2 + __KAM_UNREAD3 >= 3) describe KAM_UNREAD Singles Message Scams score KAM_UNREAD 4.5 #NOT INTERESTED body KAM_NOT_INTERESTED /reply \"Not Interested\"/i describe KAM_NOT_INTERESTED Contains Opt-Out Language score KAM_NOT_INTERESTED 1.5 #OCTET STREAM ISSUE - Updated 2022-11-26 thanks to Judah for the FP mimeheader __KAM_OCTET_PHISH1 Content-Type =~ /application\/octet-stream.*\.s?html?\.?\"?$/i meta KAM_OCTET_PHISH ( __KAM_OCTET_PHISH1 >= 1 ) describe KAM_OCTET_PHISH HTML File attached with the wrong MIME Type score KAM_OCTET_PHISH 3.0 #FAKE WALMART header __KAM_FAKE_WALMART1 Subject =~ /transaction code/i body __KAM_FAKE_WALMART2 /Your order/i tflags __KAM_FAKE_WALMART2 nosubject body __KAM_FAKE_WALMART3 /WALMART INC/i tflags __KAM_FAKE_WALMART3 nosubject meta KAM_FAKE_WALMART ( __KAM_FAKE_NORTON3 + FREEMAIL_FROM + __KAM_FAKE_WALMART1 + __KAM_FAKE_WALMART2 + __KAM_FAKE_WALMART3 >= 5) describe KAM_FAKE_WALMART Fake Walmart Scam score KAM_FAKE_WALMART 7.5 #ANALYTICO header __KAM_ANALYTICO1 Subject =~ /online course|promotion/i body __KAM_ANALYTICO2 /Training Manager/i body __KAM_ANALYTICO3 /Analytico Academy/i meta KAM_ANALYTICO ( __KAM_ANALYTICO1 + __KAM_ANALYTICO2 + __KAM_ANALYTICO3 >= 3) describe KAM_ANALYTICO Domain Hopping Spammers score KAM_ANALYTICO 4.5 #DESZY header __KAM_DESZY1 From =~ /deszy/i body __KAM_DESZY2 /Deszy/i uri __KAM_DESZY3 /search\?q=Deszy/i header __KAM_DESZY4 Subject =~ /content creation/i meta KAM_DESZY ( __KAM_DESZY1 + __KAM_DESZY2 + __KAM_DESZY3 + __KAM_DESZY4 >= 4) describe KAM_DESZY Domain Hopping Spammers score KAM_DESZY 6.0 #HEROKU ETC APP EXPLOITS WITH FREEMAIL #VALID URIS uri __KAM_APPS1 /\.herokuapp\.com|app\.connect365\.io|\.appspot\.com|salesforce\.com\/servlet/i #URIS TO SKIP uri __KAM_APPS1A /salesforce\.com\/servlet\/servlet\.ImageServer/i header __KAM_APPS2A Subject =~ /onedrive/i header __KAM_APPS2B From:name =~ /onedrive/i header __KAM_APPS3 From:addr =~ /\.awsapps.com>?$/i meta KAM_APPS ( FREEMAIL_FROM + (__KAM_APPS1 - __KAM_APPS1A) >= 2 ) describe KAM_APPS Apps being exploited by Spammers score KAM_APPS 4.0 meta KAM_APPS2 ((__KAM_APPS1 - __KAM_APPS1A) + (__KAM_APPS2A + __KAM_APPS2B >= 1) >= 2) describe KAM_APPS2 Fake OneDrive Notification score KAM_APPS2 4.0 meta KAM_APPS3 (__KAM_APPS3) describe KAM_APPS3 AWS Apps Emailing Directly score KAM_APPS3 9.0 #PHONE body __KAM_PHONE1 /reduce your company phone expense/i body __KAM_PHONE2 /changes? that takes? less than \d+ min/i meta KAM_PHONE ( __KAM_PHONE1 + __KAM_PHONE2 + FREEMAIL_FROM >= 3 ) describe KAM_PHONE Phone Service Spam score KAM_PHONE 4.5 #PASSWORD EXPIRATIOn #URG body __KAM_PASSEXP1 /expires today|about to expire/i #ACTION body __KAM_PASSEXP2 /(continue with|Keep my) same password/i #URI uri __KAM_PASSEXP3 /s3\.amazonaws\.com\/.{1,10}\.html?/i meta KAM_PASSEXP ( __KAM_PASSEXP1 + __KAM_PASSEXP2 + ( KAM_IPFS + __KAM_PASSEXP3 >= 1 ) >= 3 ) describe KAM_PASSEXP Credential Scam score KAM_PASSEXP 4.5 #IPFS uri __KAM_IPFS /(\.|\b|\/)ipfs\.io\/|\/ipfs\/|https?\:\/\/ipfs\.|https?\:\/\/.*\.ipfs\./i uri __KAM_FALSE_IPFS /(\@|\/|^)(.{1,32}\.)?ipfs\.com/i meta KAM_IPFS ( __KAM_IPFS && !__KAM_FALSE_IPFS) describe KAM_IPFS Abused Protocol for Distributed Content score KAM_IPFS 18.0 #PHONESYSTEM #DEAL body __KAM_PHONESYS1 /(reduced|lower your) rate|\d+% lower|lower (your|its) telecom/i #TITLE body __KAM_PHONESYS2 /Business Dev|tech associate|tele.?specialist|growth dev/i #PHONE body __KAM_PHONESYS3 /Top-regarded carriers|(T1|Cloud) (lines|phone)|cloud.?based phone|voip service/i #MEETING REQ/OPT body __KAM_PHONESYS4 /(worth|Have) \d+ minute|reply with rule.?out|open to this/i #INFO REQ body __KAM_PHONESYS5 /best number to quickly get in touch|quick number to reach you|may i send some info|best direct line to reach/i meta KAM_PHONESYS ( __KAM_PHONESYS1 + __KAM_PHONESYS2 + __KAM_PHONESYS3 + __KAM_PHONESYS4 + __KAM_PHONESYS5 + FREEMAIL_FROM >= 6 ) describe KAM_PHONESYS New Phone System Spam score KAM_PHONESYS 9.0 #CONTRACT HTML ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __KAM_CONTRACT2_1 Content-Type =~ /(statement\d+|contract\#?\d+|final.?hud.?\d+|Kyc\d+|check)\.htm/i meta KAM_CONTRACT2 ( __KAM_CONTRACT2_1 >= 1) describe KAM_CONTRACT2 Suspect HTML file score KAM_CONTRACT2 7.0 endif #FAKE ALLSCRIPTS header __KAM_ALLSCRIPTS1 From:addr !~ /\@allscripts.com/i header __KAM_ALLSCRIPTS2 From:name =~ /allscripts/i header __KAM_ALLSCRIPTS3 Subject =~ /invoice|receipt/i body __KAM_ALLSCRIPTS4 /membership|recurring monthly/i meta KAM_ALLSCRIPTS ( __KAM_ALLSCRIPTS1 + __KAM_ALLSCRIPTS2 + __KAM_ALLSCRIPTS3 + __KAM_ALLSCRIPTS4 >= 4 ) describe KAM_ALLSCRIPTS Fake Invoice Scam score KAM_ALLSCRIPTS 6.0 #EXPLOIT SCAM body __KAM_EXPLOIT1 /wallet:/i body __KAM_EXPLOIT2 /you have three days/i body __KAM_EXPLOIT3 /countdown will begin/i body __KAM_EXPLOIT4 /\$\d00/i meta KAM_EXPLOIT (__KAM_EXPLOIT1 + __KAM_EXPLOIT2 + __KAM_EXPLOIT3 + __KAM_EXPLOIT4 + KAM_SENDGRID >= 5) describe KAM_EXPLOIT Exploitation Scam score KAM_EXPLOIT 7.5 #GEEK SQUAD FAKE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_rules KAM_OBFU_GEEK body KAM_OBFU_GEEK /G<E2><E2>k Sq/i describe KAM_OBFU_GEEK Likley Geek Squad impersonation score KAM_OBFU_GEEK 6.0 endif #NO SPACE SUBJECT header GB_SUBJ25 Subject =~ /^[^\s+.]{25,}$/ describe GB_SUBJ25 Subject with no Spaces score GB_SUBJ25 0.25 #Score adjustment for unwanted languages ifplugin Mail::SpamAssassin::Plugin::RaptorOnly score UNWANTED_LANGUAGE_BODY 3.3 meta UNWANTED_LB_EXTRACT_CO ( UNWANTED_LANGUAGE_BODY && EXTRACTTEXT ) describe UNWANTED_LB_EXTRACT_CO Compensate unwanted language rule score when data are extracted from images score UNWANTED_LB_EXTRACT_CO -0.75 tflags UNWANTED_LB_EXTRACT_CO nice endif #ADVIDS header __KAM_ADVIDS1 From:addr =~ /\@advid|\@.*advids?\.|\@advi\-/i body __KAM_ADVIDS2 /video (production|examples|ads|design|ideas|content)|design explainer|design capabilit|(business|demo) video/i uri __KAM_ADVIDS3 /search\?q\=Advids|youtube|video samples/i body __KAM_ADVIDS4 /(video|content) (director|producer|marketer|creation)/i meta KAM_ADVIDS ( __KAM_ADVIDS1 + __KAM_ADVIDS2 + (__KAM_ADVIDS3 + __KAM_ADVIDS4 >= 1) >= 3) describe KAM_ADVIDS Video Production Spam score KAM_ADVIDS 10.0 #CRYPTO FAKE #ISSUE body __KAM_CRYPTOFAKE1A /wallet will be suspended/i body __KAM_CRYPTOFAKE1B /assets (require action|will be frozen|failed to merge)|merge your assets|action required for your assets|upgrade failure|submit your claim/i #FROM header __KAM_CRYPTOFAKE2A From =~ /Trust.?wallet|trezor|Ripple/i body __KAM_CRYPTOFAKE2B /ethereum merge|Community Token Allocation Program|redistributed XRP/i #SOURCE uri __KAM_CRYPTOFAKE3A /blogspot\.com|sendgrid\.net/i body __KAM_CRYPTOFAKE3B /(trezor.io|exodus\.com)\/merge|blogpost instructions/i meta KAM_CRYPTOFAKE ( (__KAM_CRYPTOFAKE1A + __KAM_CRYPTOFAKE1B >= 1) + (__KAM_CRYPTOFAKE2A + __KAM_CRYPTOFAKE2B >= 1) + (__KAM_CRYPTOFAKE3A + __KAM_CRYPTOFAKE3B >= 1) >= 3 ) describe KAM_CRYPTOFAKE Fake Crypto Notice score KAM_CRYPTOFAKE 6.5 #EMOJISEX body __KAM_SEXEMOJI1 /ready 4fun|lets fun|private cam|exciting experiences|very hot|taste me|freaky fantas|hookup|tight pus|tight boob|divorced mom|mature wom[ae]n|bj mom|div0rced|f\*?u\*?c\*?k|sexy on your bed|good fuck/i #EMOJI body __KAM_SEXEMOJI2 /\x{F0}\x{9F}\x{8D}\x{91}|\x{F0}\x{9F}\x{92}\x{8B}/i #URL uri __KAM_SEXEMOJI3 /\.(ga|cf|ml)\//i meta KAM_SEXEMOJI (FREEMAIL_FROM >= 1) && (__KAM_SEXEMOJI1 + __KAM_SEXEMOJI2 + __KAM_SEXEMOJI3 >= 3) describe KAM_SEXEMOJI Sexually Explicit Email Using Emojis score KAM_SEXEMOJI 9.5 #MARKETING COPOUT body __KAM_COPOUT1 /MARKETING COMMUNICATION/i body __KAM_COPOUT2 /sources believed reliable/i body __KAM_COPOUT3 /We have not verified/i meta KAM_COPOUT ( __KAM_COPOUT1 + __KAM_COPOUT2 + __KAM_COPOUT3 >= 3 ) describe KAM_COPOUT Marketing Emails that copout on the verification score KAM_COPOUT 4.5 #DOMAIN/URI TEST CONCEPT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_tag BADCALENDLYURIS (?:jpcalendly|michael\-2900|avolinq|otto\-demosho|jprecruiting|stella\-ridge|nivaai|guammi\-marketing|sethg\-erc|marc\-alderson|randy\-wimmer|video\-animation|julius\-frago|growthtitan|byte\-bridge\-team|flipcausedemo|techerp|leadoverload\-team|twiz|vissia\-ac|eventgives|sephacquisition|mattia\-100|doug\-376|byron\-lewis|selo\-ai|elevatemkt|business-gps-tetsch|nandreaatos|stephanie\-alic|.*praxis\-business\-brokers\-introduction|tony\-tarkowski|jvrtechllc|fractionl\/sonia-rosa|\-spv|2jm\-9wc\-m84|adrianaidid|bilal\-saeed\-|adobosolutions\-calendar\-4tof|verticalsols12|cyrusrsandoval77|fbfb|ikefontaine|ryan\-gonyo|gunaatita|mhoan867|paulam\-leadsignite|mktg\-sales\-leads|marketingteam\-cbox|leadstouchmarketingcal|appventurez\-mobi\-tech|darlyn\-tindoy\-powerhouse\-unlimited|appventurezmobi|crownglobe|revhero\-demo\-group|rolling\-adz|insyncmedia|dnathan\-3|kevin\-wright) replace_rules __KAM_BADCALENDLY uri __KAM_BADCALENDLY /https?\:\/\/(www\.)?calendly\.com\/(d\/)?<BADCALENDLYURIS>(?:\/|\?|\b|$)/i replace_tag BADIGURIS (?:vakninliorcom|wehackhealth) replace_rules __KAM_BADIG uri __KAM_BADIG /https?\:\/\/(www\.)?instagram\.com\/<BADIGURIS>(?:\/|\?|\b|$)/i replace_tag BADYTURIS (?:\@muvisaku|mzVih1bMPVE|PXcdLbnO9I4|\-lkrTRz5Ei8|j87M2BS4Ii8|LnQC_6XdH\-I|nT8luUsO4SU) replace_rules __KAM_BADYT uri __KAM_BADYT /https?\:\/\/(www\.)?(youtube\.com|youtu\.be)\/(watch\?v\=)?<BADYTURIS>(?:\/|\?|\b|$)/i replace_tag BADVIMEOURIS (?:446834731|399916650|256117879|268399852|602066576|179069936|540337372|391568499|clumcreative) replace_rules __KAM_BADVIMEO uri __KAM_BADVIMEO /https?\:\/\/(www\.)?vimeo\.com\/<BADVIMEOURIS>(?:\/|\?|\b|$)/i replace_tag BADMEDIUMURIS (?:\@webmoneyrevolution) replace_rules __KAM_BADMEDIUM uri __KAM_BADMEDIUM /https?\:\/\/(www\.)?medium\.com\/<BADMEDIUMURIS>(?:\/|\?|\b|$)/i replace_tag BADFIVERRURIS (?:jamshednarayana) replace_rules __KAM_BADFIVERR uri __KAM_BADFIVERR /https?\:\/\/(www\.)?fiverr\.com\/<BADFIVERRURIS>(?:\/|\?|\b|$)/i replace_tag BADGSITESURIS (?:33344455666|rfdzxgffg) replace_rules __KAM_BADGSITES uri __KAM_BADGSITES /https?\:\/\/sites\.google\.com\/view\/<BADGSITESURIS>(?:\/|\?|\b|$)/i replace_tag BADDYNAMICSURIS (?:9F7f0SFS2Z|Koi3RYh33D) replace_rules __KAM_BADDYNAMICS uri __KAM_BADDYNAMICS /https?\:\/\/ncv\.microsoft\.com\/<BADDYNAMICSURIS>(?:\/|\?|\b|$)/i replace_tag BADTELEGRAMURIS (?:leadgenmarket1) replace_rules __KAM_BADTELEGRAMURIS uri __KAM_BADTELEGRAMURIS /t.me\/<BADTELEGRAMURIS>(?:\/|\?|\b|$)/i replace_tag BADSKYPEURIS (?:32a8cfbcf097b10d|2bc4ed65aa40fb3b|feedbackform2019) replace_rules __KAM_BADSKYPEURIS body __KAM_BADSKYPEURIS /live\:(\.cid\.)?<BADSKYPEURIS>(?:\/|\?|\b|$)/i replace_tag BADWHATSAPPURIS (?:40753537389|48794973356|48794972985|48794972595|8801310463899|13653420669|48576377485|48576387220|48504723628|48576386112|48504723542|48660929489|48504723648|48861548807|48504723571|48507951873|48732676269|17539221591) replace_rules __KAM_BADWHATSAPPURIS uri __KAM_BADWHATSAPPURIS /https?\:\/\/wa.me\/<BADWHATSAPPURIS>(?:\/|\?|\b|$)/i replace_tag BADFLOWCODEURIS (?:signalsdefense|rAcrHS8hy) replace_rules __KAM_BADFLOWCODEURIS uri __KAM_BADFLOWCODEURIS /https?\:\/\/(flow\.page|flowcode\.com\/p)\/<BADFLOWCODEURIS>(?:\/|\?|\b|$)/i replace_tag BADBOXURIS (?:x6ddn2vwirubrnh5|3nrerkb3hstmpqx9|x6ddn2vwirubrnh5|q3629y3ewqvpmzb3|ic47i4xh8ms6pdd2|wr55diqj4rs785v3|bk5bdzzqbg2f9r7r|i8zkd3af27jznkzm|8hcqbxug96jcdkju|ukv7ra8ka6hi6tqb|qyt7i36zncx5map7|zpiyp9cfitd6nk83|2m9mvvxhu6nfk963|dncjppepqdfa8nr2|h4cpywq5kijxrqva|cuf3i39bw5mqabv5|nmyr45teezgtdmxi|25wrxidxxj8irkdi|fgpahmmaf4urc82i|fjxzaaqkaz5jk8uf|a2k3hsj3tyv4pg2h|28uyg6xaw2i25axb|r2puxzzs28kyd35t|jibpaq7bj2j7xc84|xfjmwqv6q5hzqaez) replace_rules __KAM_BADBOXURIS uri __KAM_BADBOXURIS /https?\:\/\/docsend\.com\/view\/<BADBOXURIS>(?:\/|\?|\b|\#|$)/i replace_tag BADHUBSPOTURIS (?:timote\-chanut|keaton\-flanigan) replace_rules __KAM_BADHUBSPOTURIS uri __KAM_BADHUBSPOTURIS /https?\:\/\/meetings\.hubspot\.com\/<BADHUBSPOTURIS>(?:\/|\?|\b|$)/i replace_tag BADLOOKERURIS (?:s74PQVx32qg|vcqPQCIEiwo) replace_rules __KAM_BADLOOKERURIS uri __KAM_BADLOOKERURIS /https?\:\/\/lookerstudio\.google\.com\/s\/<BADLOOKERURIS>(?:\/|\?|\b|$)/i replace_tag BADYESWAREURIS (?:siniyahs) replace_rules __KAM_BADYESWAREURIS uri __KAM_BADYESWAREURIS /https?\:\/\/meet\.yesware\.com\/me\/<BADYESWAREURIS>(?:\/|\?|\b|$)/i replace_tag BADXURIS (?:omarmohdomain|I4NZO7DEGe|329FQ5xXLY|wywBeF5oSy|WVg3MrDcuT|jeJ6QmURIo|nlBSAQ8vYx|9eyWNqeGvr|vqw4wHc7JF|Oer3A39I6x|jeeva_ai) replace_rules __KAM_BADXURIS uri __KAM_BADXURIS /https?\:\/\/((twitter|x)\.com|t\.co)\/<BADXURIS>(?:\/|\?|\b|$)/i replace_tag BADLINKEDINURIS (?:thomaspropen) replace_rules __KAM_BADLINKEDINURIS uri __KAM_BADLINKEDINURIS /https?\:\/\/(www.)?linkedin\.com\/in\/<BADLINKEDINURIS>(?:\/|\?|\b|$)/i meta KAM_BADDOMAINURI (__KAM_BADCALENDLY + __KAM_BADIG + __KAM_BADYT + __KAM_BADVIMEO + __KAM_BADMEDIUM + __KAM_BADFIVERR + __KAM_BADGSITES + __KAM_BADDYNAMICS + __KAM_BADTELEGRAMURIS + __KAM_BADSKYPEURIS + __KAM_BADWHATSAPPURIS + __KAM_BADFLOWCODEURIS + __KAM_BADBOXURIS + __KAM_BADHUBSPOTURIS + __KAM_BADLOOKERURIS + __KAM_BADYESWAREURIS + __KAM_BADXURIS + __KAM_BADLINKEDINURIS >= 1) describe KAM_BADDOMAINURI Blocked domain/uri combo score KAM_BADDOMAINURI 9.0 endif #FAKE FEDEX header __KAM_FEDEX1 From:name =~ /Fedex/i header __KAM_FEDEX2 From:addr !~ /fedex/i meta KAM_FEDEX (__KAM_FEDEX1 + __KAM_FEDEX2 + T_HTML_ATTACH >= 3) describe KAM_FEDEX Fake FedEx notice score KAM_FEDEX 4.5 #BLUEHORNET ESM SPAM header __KAM_BLUEHORNET1A EnvelopeFrom =~ /\.bluehornet\.com/i header __KAM_BLUEHORNET1B Return-Path =~ /\.bluehornet\.com/i header __KAM_BLUEHORNET2 Received =~ /returnpath\.bluehornet\.com/i meta KAM_BLUEHORNET ((HEADER_FROM_DIFFERENT_DOMAINS || SPF_HELO_NONE) + ((__KAM_BLUEHORNET1A + __KAM_BLUEHORNET1B >= 1) + __KAM_BLUEHORNET2 >= 1) >= 2) describe KAM_BLUEHORNET BlueHornet being exploited by scammers score KAM_BLUEHORNET 4.50 #Rescoring for FPs score PHP_SCRIPT 2.25 #APPLINK EMAILS uri __KAM_APPLINK1 /\.app\.link/i meta KAM_APPLINK ( __KAM_APPLINK1 + FREEMAIL_FROM + __KAM_BODY_LENGTH_LT_512 >= 3) describe KAM_APPLINK App Link Spams score KAM_APPLINK 4.5 #SEX EXPLICIT GROUPS header __KAM_SEX_GROUPS1 From:addr =~ /(Anya|sexy|\-x)\-.*\@googlegroups\.com/i uri __KAM_SEX_GROUPS2 /sites\.google\.com/i body __KAM_SEX_GROUPS3 /(escort (company|job|section)|sexual needs|sexy lady|sexual?ly fit|fucked hard|local hotties|secret community|hq escorts|good fuck|naughty date|male escort)/i meta KAM_SEX_GROUPS ( __KAM_SEX_GROUPS1 + __KAM_SEX_GROUPS2 + __KAM_SEX_GROUPS3 >= 3) describe KAM_SEX_GROUPS Sexually Explicit Spam score KAM_SEX_GROUPS 15.0 #SUSAN HAMILTON BLOCK ifplugin Mail::SpamAssassin::Plugin::RaptorOnly header __KAM_SUSAN1 To =~ /\@triplectrailersales.com/i header __KAM_SUSAN2 From:name =~ /Susanne Hamilton/i meta KAM_SUSAN ( __KAM_SUSAN1 + __KAM_SUSAN2 >= 2 ) describe KAM_SUSAN Susanne Hamilton Block score KAM_SUSAN 10.0 endif #FAKE MCAFEE VARIANT header __KAM_FAKE_NORTON3_1 From:name =~ /Mcafee/i header __KAM_FAKE_NORTON3_2 Subject =~ /payment/i body __KAM_FAKE_NORTON3_3 /auto(matic)?.?renew/i uri __KAM_FAKE_NORTON3_4 /(docs|drive)\.google\.com\/(document|file)\//i meta KAM_FAKE_NORTON3 (__KAM_FAKE_NORTON3_1 + __KAM_FAKE_NORTON3_2 + __KAM_FAKE_NORTON3_3 + __KAM_FAKE_NORTON3_4 + FREEMAIL_FROM >= 4) describe KAM_FAKE_NORTON3 Fake Norton / McAfee / Geek Squad / Symantec / etc. Renewal Notices score KAM_FAKE_NORTON3 8.0 #TRACKING REDIR uri __KAM_TRACKING_REDIR1 /\/tracking\/clicks\?redirect\=/i uri __KAM_TRACKING_REDIR2 /https?:\/\/adclick\.\w\.doubleclick\.net\/\/?pcs\/click\?.{10,64}\&?\&adurl\=(?:https?\:)?\/\//i uri __KAM_TRACKING_REDIR3 /https?:\/\/ad\.doubleclick\.net\/clk;.{8,64}\?(?:https?:)?\/\//i meta KAM_TRACKING_REDIR ( __KAM_TRACKING_REDIR1 + __KAM_TRACKING_REDIR2 + __KAM_TRACKING_REDIR3 >= 1 ) describe KAM_TRACKING_REDIR Tracking URI with a redirect that is a security risk score KAM_TRACKING_REDIR 4.5 #FAKE SAFE SENDERS LIST body __KAM_FAKE_SAFESENDER1 /This sender has been verified from the.{1,32}safe senders? list/ meta KAM_FAKE_SAFESENDER ( __KAM_FAKE_SAFESENDER1 >= 1 ) describe KAM_FAKE_SAFESENDER Email shows up with a safe sender notice score KAM_FAKE_SAFESENDER 1.0 #CHECKFILE body __KAM_CHECKFILE1 /(File|Document)\: https?\:\/\/.{8,128}\/.{2,5}\/\?/i meta KAM_CHECKFILE ( __KAM_CHECKFILE1 >= 1) describe KAM_CHECKFILE Likely File link abuse score KAM_CHECKFILE 8.5 body __KAM_CHECKFILE2_1 /(See|View|check|check) attach(ment|ed) (document|file)/i meta KAM_CHECKFILE2 ( T_OBFU_PDF_ATTACH + __KAM_CHECKFILE2_1 >= 2) score KAM_CHECKFILE2 4.0 #lowered from 8.5 on 2025-02-11 describe KAM_CHECKFILE2 Likely File Attachment scam #BAD MAILBOX RELEASE / FINANCIAL REQUEST uri __KAM_CONSTANTCONTACT1 /https?\:\/\/\w\d{1,3}\.rs6\.net/i header __KAM_BAD_RELEASE1 Subject =~ /held messages|financial statement.? has been shared/i meta KAM_BAD_RELEASE ( __KAM_EDU_FROM + __KAM_CONSTANTCONTACT1 + __KAM_BAD_RELEASE1 >= 3) describe KAM_BAD_RELEASE Likely bad link abuse score KAM_BAD_RELEASE 4.5 #FAKE TREZOR header __KAM_FAKE_TREZOR1 from:addr !~ /\@trezor\.io/i header __KAM_FAKE_TREZOR2 from:name =~ /trezor/i #problem body __KAM_FAKE_TREZOR3 /Ethereum merge|new device paired/i tflags __KAM_FAKE_TREZOR3 nosubject #urg body __KAM_FAKE_TREZOR4 /as soon as possible|lost forever/i #Trezor body __KAM_FAKE_TREZOR5 /trezor|satoshi.?labs.?group/i tflags __KAM_FAKE_TREZOR5 nosubject #sub header __KAM_FAKE_TREZOR6 Subject =~ /missing.?funds/i meta KAM_FAKE_TREZOR (__KAM_FAKE_TREZOR1 + __KAM_FAKE_TREZOR2 + __KAM_FAKE_TREZOR3 + __KAM_FAKE_TREZOR4 + __KAM_FAKE_TREZOR5 + (__KAM_FAKE_TREZOR8 + __KAM_FAKE_TREZOR6 >= 1) + __KAM_SHORT >= 7) describe KAM_FAKE_TREZOR Fake Trezor Message score KAM_FAKE_TREZOR 10.5 #confirm body __KAM_FAKE_TREZOR7 /confirm it was you/i #problem body __KAM_FAKE_TREZOR8 /new (paired )?application|new device paired/i #Trezor header __KAM_FAKE_TREZOR9 Subject =~ /Trezor|Linked\!/i meta KAM_FAKE_TREZOR2 (__KAM_FAKE_TREZOR1 + __KAM_FAKE_TREZOR7 + __KAM_FAKE_TREZOR8 + __KAM_FAKE_TREZOR9 + KAM_SHORT >= 5) describe KAM_FAKE_TREZOR2 Fake Trezor Message score KAM_FAKE_TREZOR2 7.5 #CRYPTODRIVE header __KAM_CRYPTODRIVE1 Subject =~ /\d hours to withdraw|quickly withdraw|balance has been replenished|withdraw your \+\d|cancell?ed in \d+ hour/i body __KAM_CRYPTODRIVE2 /bitcoin (earn|min)|automatic bitcoin/i meta KAM_CRYPTODRIVE ( __KAM_CRYPTODRIVE1 + __KAM_CRYPTODRIVE2 + FREEMAIL_FROM + __URI_GOOGLE_DRV >= 4 ) describe KAM_CRYPTODRIVE Likely CryptoCurrency Scam score KAM_CRYPTODRIVE 6.0 #SA_POSTAL header __KAM_FAKE_SA_POST1 From:addr !~ /\@postoffice\.co\.za/i header __KAM_FAKE_SA_POST2 From:name =~ /South African Post Office/i meta KAM_FAKE_SA_POST ( __KAM_FAKE_SA_POST1 + __KAM_FAKE_SA_POST2 >= 2 ) describe KAM_FAKE_SA_POST Fake Postal Notice score KAM_FAKE_SA_POST 4.0 #FAKE BENEFITS body __KAM_FAKE_BENEFIT1 /attached/i body __KAM_FAKE_BENEFIT2 /benefits? enrollment/i meta KAM_FAKE_BENEFIT ( __KAM_FAKE_BENEFIT1 + __KAM_FAKE_BENEFIT2 + T_HTML_ATTACH >= 3 ) describe KAM_FAKE_BENEFIT Likely fake benefit email score KAM_FAKE_BENEFIT 4.5 #CNOBFU body __KAM_URI_OBFU1 /w ?w ?w\[?.\]?asiane ?twork\[?.\]?org\[?.\]?cn/i body __KAM_URI_OBFU2 /w ?w ?w\[?.\]?netchin ?a\[?.\]?org/i meta KAM_URI_OBFU ( __KAM_URI_OBFU1 + __KAM_URI_OBFU2 >= 1 ) describe KAM_URI_OBFU Obfuscation of URLs score KAM_URI_OBFU 10.0 #FAKE_GOOGLEGROUP ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_rules __KAM_FAKE_GOOGLEGROUP2 header __KAM_FAKE_GOOGLEGROUP1 From:addr =~ /\@googlegroups\.com/i header __KAM_FAKE_GOOGLEGROUP2 From:name =~ /Support Team|(Mcafee|Best.?Buy) (support|Team)|Help Desk|client support|customer care team|Geek Squad (help.?(line|desk)|Call Center|support|customer support)|Team (McAfee|Best.?buy)|chase bank (protect|zero)|paypal (team|support)|(support|Service|Billing|team) PayPal|Helping (group|Hand|community)|help each other|W<E1>llsf<A1>rgo B<A1>nk r<e>gain|Bank of America Business/i meta KAM_FAKE_GOOGLEGROUP ( __KAM_FAKE_GOOGLEGROUP1 + __KAM_FAKE_GOOGLEGROUP2 >= 2 ) describe KAM_FAKE_GOOGLEGROUP Google Group posing as a legitimate firm score KAM_FAKE_GOOGLEGROUP 9.0 replace_rules __GB_OBFU_BANK header __GB_FROM_GOOGLEDRIVE1 X-Original-Sender =~ /drive\-shares\-noreply\@google\.com/ header __GB_OBFU_BANK X-Original-From =~ /<B1><A1><N1><K1>\s?<O1><F>\s?<A1><M1><E1><R1><I1><C1><A1>/i meta GB_OBFU_BANK_GDRIVE ( __GB_FROM_GOOGLEDRIVE1 && __GB_OBFU_BANK ) describe GB_OBFU_BANK_GDRIVE Google drive link from obfuscated Bank address score GB_OBFU_BANK_GDRIVE 2.0 endif #LEAD FORENSICS body __KAM_LEAD_FORENSICS1 /leadforensics.{1,32}com|Lead Forensics/i meta KAM_LEAD_FORENSICS ( __KAM_LEAD_FORENSICS1 >= 1 ) describe KAM_LEAD_FORENSICS Domain hopping spamming engine score KAM_LEAD_FORENSICS 10.0 #FAKE_INTUIT header __GB_INTUIT_NAME From:name =~ /intuit\.com/ header __GB_INTUIT_ADDR From:addr =~ /(?:\@|\.)intuit\.com/ meta GB_FAKE_INTUIT ( __GB_INTUIT_NAME && ! __GB_INTUIT_ADDR && SPF_FAIL ) describe GB_FAKE_INTUIT Fake Intuit message score GB_FAKE_INTUIT 4.0 tflags GB_FAKE_INTUIT net #FAKE_NETFLIX #domain mismatch header __KAM_FAKE_NETFLIX1A From:name =~ /(watch|Net)flix/i header __KAM_FAKE_NETFLIX1B From:addr !~ /netflix\.com/i #fuzz header __KAM_FAKE_NETFLIX2A From:addr =~ /NetfIix/i header __KAM_FAKE_NETFLIX2B Subject =~ /NetfIix/i meta KAM_FAKE_NETFLIX ( __KAM_FAKE_NETFLIX1A + __KAM_FAKE_NETFLIX1B >= 2 ) || ( __KAM_FAKE_NETFLIX2A + __KAM_FAKE_NETFLIX2B >= 1 ) describe KAM_FAKE_NETFLIX Fake Netflix message score KAM_FAKE_NETFLIX 7.0 #FAKE_STARBUCKS #domain header __KAM_FAKE_STARBUCKS1A From:name =~ /starbucks/i header __KAM_FAKE_STARBUCKS1B From:addr !~ /starbucks\.com|order\.online/i meta KAM_FAKE_STARBUCKS ( __KAM_FAKE_STARBUCKS1A + __KAM_FAKE_STARBUCKS1B >= 2 ) describe KAM_FAKE_STARBUCKS Fake Starbucks message score KAM_FAKE_STARBUCKS 4.0 #FAKE_SAMSCLUB #domain mismatch header __KAM_FAKE_SAMSCLUB1A From:name =~ /Sam'?s?.?c(1|l|I)ub/i header __KAM_FAKE_SAMSCLUB1B From:addr !~ /samsclub\.com|synchrony\.com/i #fuzz header __KAM_FAKE_SAMSCLUB2A From:addr =~ /Sam'?s?.?CIub/i header __KAM_FAKE_SAMSCLUB2B Subject =~ /Sam'?s.?CIub/i meta KAM_FAKE_SAMSCLUB ( __KAM_FAKE_SAMSCLUB1A + __KAM_FAKE_SAMSCLUB1B >= 2 ) || ( __KAM_FAKE_SAMSCLUB2A + __KAM_FAKE_SAMSCLUB2B >= 1 ) describe KAM_FAKE_SAMSCLUB Fake Sam's Club message score KAM_FAKE_SAMSCLUB 4.0 #FAKE_WALGREENS #domain header __KAM_FAKE_WALGREENS1A From:name =~ /wa(l|1|i)greens/i header __KAM_FAKE_WALGREENS1B From:addr !~ /wa(l|1|i)greens\.com/i #fuzz header __KAM_FAKE_WALGREENS2A From:addr =~ /wa(1|i)greens/i header __KAM_FAKE_WALGREENS2B Subject =~ /wa(1|i)greens/i meta KAM_FAKE_WALGREENS ( __KAM_FAKE_WALGREENS1A + __KAM_FAKE_WALGREENS1B >= 2 ) || ( __KAM_FAKE_WALGREENS2A + __KAM_FAKE_WALGREENS2B >= 1 ) describe KAM_FAKE_WALGREENS Fake Walgreens message score KAM_FAKE_WALGREENS 4.0 # Disabled 2025-06-02 for FPs with Ace Hardware Franchises ##FAKE_ACEHARDWARE2 # #domain #header __KAM_FAKE_ACEHARDWARE2_1A From:name =~ /Ace.?(reward|Hardware)|AceOctoberReward/i #header __KAM_FAKE_ACEHARDWARE2_1B From:addr !~ /acehardware\.com/i ##header __KAM_FAKE_ACEHARDWARE2_1C Subject =~ /Ace.?hardware.?rewards/i # #meta KAM_FAKE_ACEHARDWARE2 ( __KAM_FAKE_ACEHARDWARE2_1A + __KAM_FAKE_ACEHARDWARE2_1B >= 2 ) #describe KAM_FAKE_ACEHARDWARE2 Fake Ace Hardware message #score KAM_FAKE_ACEHARDWARE2 8.0 #FAKE_CVS #domain - Fixed FP on 2023-10-06 from Joel Risberg header __KAM_FAKE_CVS_1A From:name =~ /CVS(care|extra|octoberreward|reward|bonus|stores|savr|save)|CVS(\b|\$)|CVS.*dea[1|i|l]s/i header __KAM_FAKE_CVS_1B From:addr !~ /cvs(health)?\.com|caremark\.com/i meta KAM_FAKE_CVS ( __KAM_FAKE_CVS_1A + __KAM_FAKE_CVS_1B >= 2 ) describe KAM_FAKE_CVS Fake CVS message score KAM_FAKE_CVS 6.0 #MEDALLIA header __KAM_MEDALLIA From:addr =~ /medallia\.com/i meta KAM_MEDALLIA (KAM_FAKE_CVS + KAM_FAKE_SAMSCLUB >= 1) && __KAM_MEDALLIA describe KAM_MEDALLIA False Positive Handling for Medallia Surveys score KAM_MEDALLIA -6.0 #FAKE HOME DEPOT #domain header __KAM_FAKE_HOMEDEPOT_1A From:name =~ /home.?depot/i header __KAM_FAKE_HOMEDEPOT_1B From:addr !~ /(\@|\.)(homedepot\.com|squaretrade\.com)/i meta KAM_FAKE_HOMEDEPOT ( __KAM_FAKE_HOMEDEPOT_1A + __KAM_FAKE_HOMEDEPOT_1B >= 2 ) describe KAM_FAKE_HOMEDEPOT Fake Home Depot message score KAM_FAKE_HOMEDEPOT 5.0 #FAKE COSTCO #domain header __KAM_FAKE_COSTCO_1A From:name =~ /costco/i header __KAM_FAKE_COSTCO_1B From:addr !~ /costco\.(com|ca|uk)|costcotravel\.com/i meta KAM_FAKE_COSTCO2 ( __KAM_FAKE_COSTCO_1A + __KAM_FAKE_COSTCO_1B >= 2 ) describe KAM_FAKE_COSTCO2 Fake Costco message score KAM_FAKE_COSTCO2 7.0 #EMPTY MESSAGE FP FOR CALENDARS mimeheader __GB_CALENDAR_ATTACH Content-Type =~ /\b(text\/calendar)\b/i meta GB_EMPTY_CALENDAR ( ( EMPTY_MESSAGE || BODY_URI_ONLY ) && __GB_CALENDAR_ATTACH ) describe GB_EMPTY_CALENDAR Empty message with a calendar attachment score GB_EMPTY_CALENDAR -2.0 #EMPTY MESSAGE FP FOR IMAGES meta GB_EMPTY_IMAGES ( EMPTY_MESSAGE && __ANY_IMAGE_ATTACH ) describe GB_EMPTY_IMAGES Empty message with an attached image score GB_EMPTY_IMAGES -2.0 #FAKE LOWES #domain header __KAM_FAKE_LOWES2_1A From:name =~ /lowes.?home.?improvement|Lowes.?(shopper|Store)|LowesHome|Lowes.?customer.?support|Lowe's.?Shopper/i header __KAM_FAKE_LOWES2_1B From:addr !~ /lowes\.com/i meta KAM_FAKE_LOWES2 ( __KAM_FAKE_LOWES2_1A + __KAM_FAKE_LOWES2_1B >= 2 ) describe KAM_FAKE_LOWES2 Fake Lowes message score KAM_FAKE_LOWES2 4.0 #UNSOLICITED body __KAM_UNSOLICITED1 /Sorry for the unsolicited email/i meta KAM_UNSOLICITED ( __KAM_UNSOLICITED1 >= 1 ) describe KAM_UNSOLICITED Email that is unsolicited score KAM_UNSOLICITED 5.0 #FAKE PRIME/AMAZON #domain header __KAM_FAKE_PRIME_1A From:name =~ /Prime.*Member|PrimeAccount(a(1|i|l)ert|Service)|Prime.?Dea(1|i)|prime.?day.?saving/i header __KAM_FAKE_PRIME_1B From:addr !~ /amazon\.com/i header __KAM_FAKE_PRIME_2 Subject =~ /Amaz0n prime|prime membership (is renewing|statement was ended)/i meta KAM_FAKE_PRIME ( ( __KAM_FAKE_PRIME_1A + __KAM_FAKE_PRIME_2 >= 1 ) + __KAM_FAKE_PRIME_1B >= 2 ) describe KAM_FAKE_PRIME Fake Amazon Prime message score KAM_FAKE_PRIME 7.0 #FAKE MILWAUKEE #fuzz header __KAM_FAKE_MILWAUKEE2A From:addr =~ /mi(1|i)waukeetoo(i|1)s/i header __KAM_FAKE_MILWAUKEE2B Subject =~ /Milwaukee (Drill|tool)/i meta KAM_FAKE_MILWAUKEE ( __KAM_FAKE_MILWAUKEE2A + __KAM_FAKE_MILWAUKEE2B >= 1 ) describe KAM_FAKE_MILWAUKEE Fake Lowes / Milwaukee Tools message score KAM_FAKE_MILWAUKEE 4.0 #FAKE HULU #fuzz header __KAM_FAKE_HULU2A From:addr =~ /hu(1|i)u.?(acct|account|member)/i header __KAM_FAKE_HULU2B Subject =~ /hu(1|i)u.?member/i meta KAM_FAKE_HULU ( __KAM_FAKE_HULU2A + __KAM_FAKE_HULU2B >= 1 ) describe KAM_FAKE_HULU Fake Hulu message score KAM_FAKE_HULU 6.0 #FAKE WEBROOT header __KAM_FAKE_WEBROOT1 Subject =~ /got your order|Payment receipt|Order Confirm|your e.?statement|renewal confirm|itemized invoice|renewal success/i body __KAM_FAKE_WEBROOT2 /Webroot/i body __KAM_FAKE_WEBROOT3 /Total Securities|Webroot (security|premium)/i body __KAM_FAKE_WEBROOT4 /not authorized|should there be any concern|terminate your service|discontinuing this transaction/i meta KAM_FAKE_WEBROOT ( __KAM_FAKE_WEBROOT1 + __KAM_FAKE_WEBROOT2 + __KAM_FAKE_WEBROOT3 + __KAM_FAKE_WEBROOT4 + FREEMAIL_FROM >= 5) describe KAM_FAKE_WEBROOT Fake Webroot Scam score KAM_FAKE_WEBROOT 7.5 ifplugin Mail::SpamAssassin::Plugin::RaptorOnly # Received document body __GB_DID_RECEIVE /did you receive .{1,10} document/i meta GB_DID_RECEIVE ( __GB_DID_RECEIVE && KAM_RAPTOR_EXTERNAL ) describe GB_DID_RECEIVE Document received scam score GB_DID_RECEIVE 1.5 endif # ExtractText Rules ifplugin Mail::SpamAssassin::Plugin::RaptorOnly ifplugin Mail::SpamAssassin::Plugin::ExtractText header GB_QR_CODE X-ExtractText-Flags =~ /\bQR\-Code\b/ describe GB_QR_CODE QR-Code in attached image score GB_QR_CODE 2.0 header __GB_OCR_URI_BAD_TLD X-ExtractText-URIs =~ /https?:\/\/.*\.ru\//i meta GB_QR_CODE_BAD_TLD ( __GB_OCR_URI_BAD_TLD && GB_QR_CODE ) describe GB_QR_CODE_BAD_TLD Qr code uri with a bad tld domain score GB_QR_CODE_BAD_TLD 4.5 endif endif #TLDSCHINA body __KAM_TLDSCHINA1 /t ?l ?d ?s ?c ?h ?i ?n ?a\[\.\]com|0086\-21\-619\-18\-696/i meta KAM_TLDSCHINA ( __KAM_TLDSCHINA1 >= 1 ) describe KAM_TLDSCHINA Chinese Domain Scams score KAM_TLDSCHINA 5.0 # .html link stored on S3 uri __GB_S3_HTM1 /^https?:\/\/.{3,64}\.s3\..{3,16}\.amazonaws\.com\/.{3,128}\.s?html?(?![^\/]*?(?:%24|\$|\?X\-Amz\-))/i uri __GB_S3_HTM2 /^https?:\/\/(?:\w+\.)?s3\.amazonaws\.com\/(?:.{3,16}\/.{3,16}\/)?.{3,128}\.s?html?(?![^\/]*?(?:%24|\$|\?X\-Amz\-))/i uri __GB_S3_HTM3 /^https?:\/\/s3\.(?:[a-z0-9-]+)\.amazonaws\.com\/(?:[a-z0-9-\.]+)\/.{1,64}\.s?html?(?![^\/]*?(?:%24|\$|\?X\-Amz\-))/i uri __GB_S3_HTMCUB /^https?:\/\/s3\.cubbit\.eu\/(?:[a-z0-9-\.]+)\/.{1,64}\.s?html?/i meta GB_S3_HTM ( __GB_S3_HTM1 + __GB_S3_HTM2 + __GB_S3_HTM3 + __GB_S3_HTMCUB >= 1 ) describe GB_S3_HTM .html link stored on AWS S3 score GB_S3_HTM 5.75 meta GB_S3_HTM_MANY ( GB_S3_HTM && KAM_MANYTO ) describe GB_S3_HTM_MANY .html link stored on AWS S3 sent to many people score GB_S3_HTM_MANY 1.0 # AWS Apprunner abuse if (version >= 4.000000) if can(Mail::SpamAssassin::Conf::feature_capture_rules) uri GB_AWSAPPRUNNER_MAIL /^https?:\/\/(?:\w+\.)(?:[a-z0-9-]+)\.awsapprunner\.com\/.{1,64}=%{GB_TO_ADDR}/i describe GB_AWSAPPRUNNER_MAIL AWS Apprunner link with destination mail address score GB_AWSAPPRUNNER_MAIL 2.0 endif endif #FAKE STIMULUS header __KAM_FAKE_STIM1 From =~ /state.?reiief|stim.?state.?check|stim.?check.?reiief|reiief2023|statestimcheck|statebenefits/i header __KAM_FAKE_STIM2 Subject =~ /stimu[1i]us/i body __KAM_FAKE_STIM3 /stimu[1i]us|stimulus (benefit|fund|check)/i tflags __KAM_FAKE_STIM3 nosubject meta KAM_FAKE_STIM ( __KAM_FAKE_STIM1 + __KAM_FAKE_STIM2 + __KAM_FAKE_STIM3 >= 3) describe KAM_FAKE_STIM Fake Stimulus Scam score KAM_FAKE_STIM 6.0 #FAKE QUOTES header __KAM_FAKE_QUOTE1 Subject =~ /signing up for Quotes\.daily/i meta KAM_FAKE_QUOTE ( __KAM_FAKE_QUOTE1 + FREEMAIL_FROM >= 2 ) describe KAM_FAKE_QUOTE Fake Quotes Signup Notice score KAM_FAKE_QUOTE 6.0 #FAKE HOTEL ROOM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_rules __GB_FAKE_HOTEL body __GB_FAKE_HOTEL /(?:book(?:ing)? a|(?:need|reserving) a|standard|cost of a)(?:\s)?(?:single|double|twin)?(?:\sstandard)? room|check into your hotel|book a hotel room|have such a room|left it in (?:a|my|the) room|mak(?:e|ing) a reservation|reservar una habitaci<O>n|room availability/i header __GB_FAKE_HOTEL_S Subject =~ /To the Hotel|Booking confirmation/i meta GB_FAKE_HOTEL ( FREEMAIL_FROM && ( KAM_BLANKSUBJECT || __GB_FAKE_HOTEL_S ) && __GB_FAKE_HOTEL ) describe GB_FAKE_HOTEL Fake hotel room reservation score GB_FAKE_HOTEL 4.0 body __GB_FAKE_BOOKING /Book,{0,4}ing\.com|Booking app\b|following this link|New Message from Guest|important questions/i body __GB_BOOKING_DEAR /Dear Hotel (?:Manage(?:ment|r)|Team)|Dear Partner/i uri __GB_BOOKING_URI /booking\.com/ header __GB_BOOKING_FROM From:addr =~ /\@booking\.com/ header __GB_BOOKING_REPLY Reply-To =~ /noreply\@booking\.com/ meta __GB_FAKE_BOOKING0 ( __GB_FAKE_BOOKING && __GB_BOOKING_DEAR && !__GB_BOOKING_URI ) meta __GB_FAKE_BOOKING1 ( __GB_FAKE_BOOKING && __GB_BOOKING_REPLY && !__GB_BOOKING_FROM ) meta GB_FAKE_BOOKING ( __GB_FAKE_BOOKING0 || __GB_FAKE_BOOKING1 ) describe GB_FAKE_BOOKING Booking.com scam score GB_FAKE_BOOKING 0.001 endif #FAKE SPOTIFY #domain header __KAM_FAKE_SPOTIFY_1A From:name =~ /spotify premium|Spotify(?:\s|_)Inc\./i header __KAM_FAKE_SPOTIFY_1B From:addr !~ /spotify\.com/i meta KAM_FAKE_SPOTIFY ( __KAM_FAKE_SPOTIFY_1A + __KAM_FAKE_SPOTIFY_1B >= 2 ) describe KAM_FAKE_SPOTIFY Fake Spotify message score KAM_FAKE_SPOTIFY 7.0 #FAKE TRUST WALLET #domain header __KAM_FAKE_TRUSTWALLET_1A From:name =~ /trust.?wallet/i header __KAM_FAKE_TRUSTWALLET_1B From:addr !~ /trustwallet\.com/i meta KAM_FAKE_TRUSTWALLET ( __KAM_FAKE_TRUSTWALLET_1A + __KAM_FAKE_TRUSTWALLET_1B >= 2 ) describe KAM_FAKE_TRUSTWALLET Fake Trust Wallet message score KAM_FAKE_TRUSTWALLET 7.0 #APP SPAM #subject header __KAM_APP1 Subject =~ /App Idea/i #who body __KAM_APP2 /IT Based company/i #what body __KAM_APP3 /App devel/i #pricing body __KAM_APP4 /pocket.?friendly/i #LMK body __KAM_APP5 /requirements in detail/i meta KAM_APP ( __KAM_APP1 + __KAM_APP2 + __KAM_APP3 + __KAM_APP4 + __KAM_APP5 + FREEMAIL_FROM >= 6 ) describe KAM_APP Spammers hawking App Development score KAM_APP 9.0 #PENPAL #subject header __KAM_PENPAL1 Subject =~ /^(GREETINGS|HI)\.?$|GET WRITING|pen.?pal|GOOD MORNING|GOOD DAY|MORNING|reaching out From Sweden|Friendship Request|request letter|^HELLO$/i #intro body __KAM_PENPAL2 /my name is| from Sweden/i #penpal body __KAM_PENPAL3 /pen.?pal|virtual friendship|learn about life in your country|exploring a friendship|becoming friends with me/i tflags __KAM_PENPAL3 nosubject #topic body __KAM_PENPAL4 /talk *anything|talk about (everything|anything)|look forward to hear|contact details online|begin a worthwhile relationship|share anything|establishing a meaningful connection|potentially a relationship|relationship with someone/i meta KAM_PENPAL ( __KAM_PENPAL1 + __KAM_PENPAL2 + __KAM_PENPAL3 + __KAM_PENPAL4 + FREEMAIL_FROM >= 5 ) describe KAM_PENPAL Pen Pal Scams score KAM_PENPAL 8.0 #FAKE GOOGLE DRIVE NOTICE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_rules __KAM_FAKE_DRIVE1 #from:name header __KAM_FAKE_DRIVE1 From:name =~ /(Ch<A1>s<E1>|W<E1>(1|l|I)(1|l|I)s.?F<A1>rg<O1>).?(B<A1>nk|S<E1>c|R<E1>g<A1>|R<E1>v<I1>|H<E1>lp)/i #from:addr header __KAM_FAKE_DRIVE2 From:addr =~ /drive\-shares\-dm\-noreply\@google\.com/i #subj header __KAM_FAKE_DRIVE3 Subject =~ /Scam Sign.?in Detected|Bank ID Locked|Account Frozen|Fraud Sign.?in/i meta KAM_FAKE_DRIVE ( __KAM_FAKE_DRIVE1 + __KAM_FAKE_DRIVE2 >= 2 ) || ( __KAM_FAKE_DRIVE2 + __KAM_FAKE_DRIVE3 >= 2 ) describe KAM_FAKE_DRIVE Fake Google Drive Notice score KAM_FAKE_DRIVE 12.0 endif #FAKE SCORE NOTES #subj header __KAM_FAKE_SCORE1 Subject =~ /Score released\:.*\+\$\d+/i #Form header __KAM_FAKE_SCORE2 X-GoogleForms-IsConsumerForm =~ /true/i #Result body __KAM_FAKE_SCORE3 /account deactivation|balance will be (reset|cleared|zeroed)|block inactive account/i #Action body __KAM_FAKE_SCORE4 /(sign in.?to|log.?in.?to|enter|access) your account/i meta KAM_FAKE_SCORE ( __KAM_FAKE_SCORE1 + __KAM_FAKE_SCORE2 + __KAM_FAKE_SCORE3 + __KAM_FAKE_SCORE4 + FREEMAIL_FROM >= 5 ) describe KAM_FAKE_SCORE Fake Score Emails score KAM_FAKE_SCORE 7.5 #blob uri __KAM_BLOBHTML1 /.*\.blob\.core\.windows\.net\/.*html?/i meta KAM_BLOBHTML ( __KAM_BLOBHTML1 + FREEMAIL_FROM >= 2 ) describe KAM_BLOBHTML Windows Blob Likely Spam score KAM_BLOBHTML 9.0 meta KAM_BLOBHTMLLOW ( __KAM_BLOBHTML1 >= 1 ) && !KAM_BLOBHTML describe KAM_BLOBHTMLLOW Windows Blob Lower Confidence of Spam score KAM_BLOBHTMLLOW 3.25 # Cloudflare r2.dev public cloud uri __GB_R2DEVHTML1 /https?:\/\/pub\-\w+\.r2\.dev\/.{1,32}\.html?/ meta GB_R2DEVHTML ( __GB_R2DEVHTML1 + FREEMAIL_FROM >= 2 ) describe GB_R2DEVHTML Cloudflare r2.dev Likely Spam score GB_R2DEVHTML 5.0 meta GB_R2DEVHTMLLOW ( __GB_R2DEVHTML1 >= 1 ) describe GB_R2DEVHTMLLOW Cloudflare r2.dev Lower Confidence of Spam score GB_R2DEVHTMLLOW 2.0 if (version >= 4.000000) if can(Mail::SpamAssassin::Conf::feature_capture_rules) uri __GB_CUSTOM_SURGESH /https?:\/\/(?:[a-z0-9_\-]+)\.surge\.sh\/.{0,16}\#%{GB_TO_ADDR}/i meta GB_CUSTOM_SURGESH __GB_CUSTOM_SURGESH describe GB_CUSTOM_SURGESH Surge.sh abuse score GB_CUSTOM_SURGESH 2.0 meta GB_CUSTOM_FREESURGESH ( GB_CUSTOM_SURGESH && FREEMAIL_FROM ) describe GB_CUSTOM_FREESURGESH Surge.sh abuse from freemail address score GB_CUSTOM_FREESURGESH 3.0 endif endif # Fake invoice links to Google Cloud ifplugin Mail::SpamAssassin::Plugin::URIDetail uri_detail __GB_GOOGLE_INVOICE0 cleaned =~ /(?:\d+\.\d+\.\d+\.\d+\.bc\.googleusercontent\.com|(?:adclick|googleads)\.\w\.doubleclick\.net\/(?:aclk|pcs\/click)|googleadservices\.com\/pagead)/ text =~ /document|invoice|fattura/i uri __GB_GOOGLE_INVOICE1 /(?:\d+\.\d+\.\d+\.\d+\.bc\.googleusercontent\.com|adclick\.\w\.doubleclick\.net\/pcs\/click).{1,8}Payment.Invoice/i meta GB_GOOGLE_INVOICE ( __GB_GOOGLE_INVOICE0 + __GB_GOOGLE_INVOICE1 >= 1 ) describe GB_GOOGLE_INVOICE Fake Invoice stored on Google cloud/ads score GB_GOOGLE_INVOICE 4.0 endif # Dispatch targeted postcompromise spam body __KAM_DISPATCH1 /dis+patch(ed)? a (material|file)|Document\:/i uri __KAM_DISPATCH2 /https?\:\/\/.*?\/\w*\/\?\d+/i meta KAM_DISPATCH ( __KAM_DISPATCH1 + __KAM_DISPATCH2 >= 2) describe KAM_DISPATCH Phishing File Scam Email score KAM_DISPATCH 4.0 # DEAD PIANO #DAYED body __KAM_PIANO1 /(dead|late) (spouse|husband)/i #PIANO body __KAM_PIANO2 /(Yamaha|grand) piano|baby grand/i #COST body __KAM_PIANO3 /free|gifting|offering|give away|go to someone/i #SUBJ header __KAM_PIANO4 Subject =~ /want this|(beautiful|grand) piano|instrument|piano donation|baby grand|['`] +piano|yamaha piano/i meta KAM_PIANO ( __KAM_PIANO1 + __KAM_PIANO2 + __KAM_PIANO3 + __KAM_PIANO4 + (__KAM_EDU_FROM + FREEMAIL_FROM >= 1) >= 5 ) describe KAM_PIANO Likely Piano Scam (yes, Piano Scams are a real thing apparently. "Sing us a song, you're the piano scam...") score KAM_PIANO 7.5 ifplugin Mail::SpamAssassin::Plugin::RaptorOnly # AP/AR SCAM body __KAM_APARSCAM /email me our most recent AP and AR Aging report|what is the bank cut off line for WIRE TRANSFER/i meta KAM_APARSCAM ( __KAM_APARSCAM + __KAM_BEAL1 + KAM_RAPTOR_EXTERNAL >= 3 ) describe KAM_APARSCAM Accounting Phishing Scams score KAM_APARSCAM 6.0 endif #FAKE WELLS FARGO ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_rules __KAM_FAKE_WELLSFARGO_1A #domain header __KAM_FAKE_WELLSFARGO_1A From:name =~ /W<E1>lls.?f<A1>rgo 0nline/i header __KAM_FAKE_WELLSFARGO_1B From:addr !~ /wellsfargo\.com/i meta KAM_FAKE_WELLSFARGO ( __KAM_FAKE_WELLSFARGO_1A + __KAM_FAKE_WELLSFARGO_1B >= 2 ) describe KAM_FAKE_WELLSFARGO Fake Wells Fargo message score KAM_FAKE_WELLSFARGO 7.0 #FIT LLC replace_rules __KAM_FIT1 body __KAM_FIT1 /Email (was |is )?sent by:? (Event Horizon LLC|F<I1>T, LLC)|(email was sent|newsletter).{0,35} (operator of|on behalf of) (prestige publishing|Event Horizon) LLC|Polaris Advertising is the operator and proprietor|brought to you by Event Horizon LLC|(valued member of the|possessed by) Stark Media LLC/im meta KAM_FIT ( __KAM_FIT1 >= 1 ) describe KAM_FIT Spamming spammers who spam score KAM_FIT 6.0 endif #FAKE FIDELITY body __KAM_FAKE_FIDELITY1 /we are brokers/i header __KAM_FAKE_FIDELITY2 Subject =~ /Fidelity Investments/i meta KAM_FAKE_FIDELITY ( __KAM_FAKE_FIDELITY1 + __KAM_FAKE_FIDELITY2 + FREEMAIL_FROM >= 3 ) describe KAM_FAKE_FIDELITY Likely Fake Brokerage Emails score KAM_FAKE_FIDELITY 4.5 #FAKE AIRDROP body __KAM_FAKE_AIRDROP1 /claim airdrop/i uri __KAM_FAKE_AIRDROP2 /\.sendgrid.net\//i header __KAM_FAKE_AIRDROP3 From:name =~ /cointracker/i header __KAM_FAKE_AIRDROP4 From:addr !~ /cointracker\.io/i header __KAM_FAKE_AIRDROP5 Subject =~ /Arbitrum Airdrop/i meta KAM_FAKE_AIRDROP ( __KAM_FAKE_AIRDROP1 + __KAM_FAKE_AIRDROP2 + __KAM_FAKE_AIRDROP3 + __KAM_FAKE_AIRDROP4 + __KAM_FAKE_AIRDROP5 >= 5 ) describe KAM_FAKE_AIRDROP Fake Air Drop / Coin Email score KAM_FAKE_AIRDROP 6.0 #PAGE GROUp #Title body __KAM_PAGE_GROUP1 /Talent Acquisition Specialist/i #Name body __KAM_PAGE_GROUP2 /Michael Page Recruitment/i meta KAM_PAGE_GROUP ( __KAM_PAGE_GROUP1 + __KAM_PAGE_GROUP2 >= 2) describe KAM_PAGE_GROUP Page Recruiting Scam score KAM_PAGE_GROUP 5.0 #GOOGLE SCRIPTS uri __KAM_GOOGLE_SCRIPT /script\.google\.com/i #FAKE AMAZON header __KAM_FAKE_AMAZON_NOTICE1 Subject =~ /Amazon Membership Update/i meta KAM_FAKE_AMAZON_NOTICE ( __KAM_FAKE_AMAZON_NOTICE1 + __KAM_GOOGLE_SCRIPT >= 2 ) describe KAM_FAKE_AMAZON_NOTICE Fake Amazon Notice score KAM_FAKE_AMAZON_NOTICE 6.0 #PATHOS PR body __KAM_PATHOS1 /PR firm|spots left for an article/i body __KAM_PATHOS2 /(Pathos|Pay on Results) (PR|Media)/i body __KAM_PATHOS3 /(\b|^)((managing|marketing) (director|partner)|team lead|Partner)(\b|$)/i body __KAM_PATHOS4 /opt-?out|opt-?ing out/i meta KAM_PATHOS ( __KAM_PATHOS1 + __KAM_PATHOS2 + __KAM_PATHOS3 + __KAM_PATHOS4 >= 4 ) describe KAM_PATHOS Pathos Payonresults Spam score KAM_PATHOS 8.0 #FAKE DOCUSIGN header __KAM_FAKE_DOCUSIGN2_1 Subject =~ /signature required/i uri __KAM_FAKE_DOCUSIGN2_2 /mimecastprotect.com.*urldefense.proofpoint.co/i body __KAM_FAKE_DOCUSIGN2_3 /docusign/i meta KAM_FAKE_DOCUSIGN2 ( __KAM_FAKE_DOCUSIGN2_1 + __KAM_FAKE_DOCUSIGN2_2 + __KAM_FAKE_DOCUSIGN2_3 >= 3 ) describe KAM_FAKE_DOCUSIGN2 Likely Fake DocuSign Email score KAM_FAKE_DOCUSIGN2 4.5 #VIRTUAL BOOKKEEPER #SUBJ header __KAM_BOOKKEEP1 Subject =~ /(Accounting|Bookkeeping) ?(\/|\&) ?(Bookkeeping|Accounting)|Help with bookkeeping|bookkeeping for|bookkeeping a hassle|outsourced Bookkeeping|ease your bookkeeping|(accounting|bookkeeping)\/tax prep service|virtual (accounting|bookkeeping|bookkeeper|accountant)|affordable (accounting|bookkeeping) solution|be your in.?house (accounting|bookkeeping)|senior bookkeep|master your finance/i #FOLLOW/COLD body __KAM_BOOKKEEP2 /sent you a message|my name is|reply with an optimal number for me to reach|helped a business in your state|reply with a good time\/number to reach|respond a time for us to talk|helping businesses outsource all their bookkeeping|give you a quick call|assisted a company (organize|manage) two years of books|follow back on my message|reply back with a good line|give you a brief line|convenient time to connect|brief minute to discuss|follow up on my last email|received my note from a couple of days|what time works best|set up a time to chat|reached out a couple of days ago|schedule a time to connect|interested in seeing our work/i tflags __KAM_BOOKKEEP2 nosubject #SALE body __KAM_BOOKKEEP3 /(explore|see|check) if (we\'?re|we are) a (match|fit)|paying huge amounts of money for bookkeeping|open to a quick call|streamline bookkeeping needs|fed up with keeping your own books|transform your bookkeeping|accounting for (tons|thousands) of companies just like|no\-stress bookkeeping solution|wasting a lot of time doing bookkeeping|benefit from help keeping books|manag(e|ing) bookkeeping \& accounting requirements for lots of (companies|customers)|interested to hire a dedicated remote (tax|accountant|bookkeeper)|assist businesses handle their books|extra hand with bookkeeping|client in your state|we saved \d+ hours a month|already serving \d+ plus business|we specialize in:? bookkeeping/im tflags __KAM_BOOKKEEP3 nosubject meta KAM_BOOKKEEP ( __KAM_BOOKKEEP1 + __KAM_BOOKKEEP2 + __KAM_BOOKKEEP3 + FREEMAIL_FROM >= 4 ) describe KAM_BOOKKEEP Bookkeeping and Accounting Spams score KAM_BOOKKEEP 6.0 #LATEST APP DEV SPAMS #subj header __KAM_APPDEV1 Subject =~ /App Prices|healthcare app|app offer|new app|follow up|mobile app(lication|s)? company|Mobile App$|improve your app|Any app|creating an app|\@gmail\.com|Price|perfect app|your requirement|apps? development|app platform|developer|Electric Bike Apps|applications? for your business|Ios Apps|Web apps|app proposal|Custom app|create an app/i #location or type of app body __KAM_APPDEV2 /(companies|company|based) in India|Indian.?Based|Rani$|(handyman|fitness|Entertainment|Shopping|hospital|real.?estate|Taxi|custom business|store|booking|lifestyle|ecommerce|ios|game|gaming|Web) App|App and Website Devel|are you looking for responsive mobile app/i tflags __KAM_APPDEV2 nosubject #COLD body __KAM_APPDEV3 /My name is|chance to review my (previous )?email|I work with \d+\+ experienced IT|if you are interested|chance to peruse through it|interested in developing a mobile app|are you trying to find apps|wondering if you wanted an app|connect you with the right person|company with over \d+ years of experience|We specialize in high\-quality android|looking for creating an app/i tflags __KAM_APPDEV3 nosubject #AppDev body __KAM_APPDEV4 /app develop(ment|er)|app for your domain|best mobile app devel|app development manager|app development service|develop your web project|apps for your company|experts in app.?dev|build a mobile? app|apps we have successfully developed|mobile apps and game devel|apps development manager/i tflags __KAM_APPDEV4 nosubject #PRICE / REQS body __KAM_APPDEV5 /mobile app price list|cost efficient|price list \& sample|catalog price|meeting to discuss details|share ballpark estimat|share your requirement|discuss the further steps|see our portfolio|portfolio and pricing|send you our price|price list|requirement, please do share|(let me know|discuss) your requirements|send you more details on (sample|package|portfolio)|offer a detailed pric|hear more about project req|forward you our price \& latest work|app prices? list|we can discuss pricing/i tflags __KAM_APPDEV5 nosubject meta KAM_APPDEV ( __KAM_APPDEV1 + __KAM_APPDEV2 + __KAM_APPDEV3 + __KAM_APPDEV4 + __KAM_APPDEV5 + FREEMAIL_FROM >= 6) describe KAM_APPDEV Application Developer Spams score KAM_APPDEV 9.0 #FAKE METAMASK #FROM header __KAM_FAKE_METAMASK1 From:name =~ /metamask/i #CRYPTO header __KAM_FAKE_METAMASK2 Subject =~ /wallet has been (suspended|limited|locked|disabled)/i #NOT META header __KAM_FAKE_METAMASK3 From:addr !~ /\@metamask\.com/i #TASK body __KAM_FAKE_METAMASK4 /Up(grade|date) (here|Now)|activate and verify|complete the migration/i meta KAM_FAKE_METAMASK ( __KAM_FAKE_METAMASK1 + __KAM_FAKE_METAMASK2 + __KAM_FAKE_METAMASK3 + __KAM_FAKE_METAMASK4 >= 4 ) describe KAM_FAKE_METAMASK Fake MetaMask Crypto Notification score KAM_FAKE_METAMASK 6.0 #FAKE SAISON WALLET body __KAM_FAKE_SAISON1 /Saison Gold Premium|saison card/i uri __KAM_FAKE_SAISON2 /\.cn(\/|$|\b)/i meta KAM_FAKE_SAISON ( __KAM_FAKE_SAISON1 + __KAM_FAKE_SAISON2 + RDNS_NONE + SPF_SOFTFAIL >= 4) describe KAM_FAKE_SAISON Fake Saison Notices score KAM_FAKE_SAISON 6.0 #Google APPSHEET ABUSE header __KAM_APPSHEET1 From:addr =~ /noreply\@appsheet\.com/i meta KAM_APPSHEET ( __KAM_APPSHEET1 >= 1 ) describe KAM_APPSHEET Google AppSheet being abused by spammers score KAM_APPSHEET 4.0 #Google Cloud Run Functions abuse uri GB_CLOUDFUNCTIONS /https?:\/\/[a-z0-9\-]+\.cloudfunctions\.net\/app\/tracker\/.{8,128}\?redirect.{1,128}\.html?\?/i describe GB_CLOUDFUNCTIONS Google Cloud Run Functions abused by spammers score GB_CLOUDFUNCTIONS 2.0 #FAKE_META #from header __KAM_FAKE_META1 From:name =~ /Meta for Business/i #subj header __KAM_FAKE_META2 Subject =~ /(account|page) will be restricted/i #messenger uri __KAM_FAKE_META3 /messenger.com\/t\/\d+/i meta KAM_FAKE_META ( __KAM_FAKE_META1 + __KAM_FAKE_META2 + __KAM_FAKE_META3 + FREEMAIL_FROM >= 4) describe KAM_FAKE_META Fake Message from Meta for Business score KAM_FAKE_META 6.0 #GITHUB uri __KAM_GITHUB_USER_ATTACHMENT /github\.com\/user\-attachments\/assets\//i meta KAM_GITHUB_USER_ATTACHMENT ( __KAM_GITHUB_USER_ATTACHMENT >= 1 ) describe KAM_GITHUB_USER_ATTACHMENT Email contains a github user attachment score KAM_GITHUB_USER_ATTACHMENT 1.5 ifplugin Mail::SpamAssassin::Plugin::URIDetail uri_detail GB_GITEXE_SOCIAL cleaned =~ /(?:bitbucket|github|gitlab)\.com\/.{8,128}\.exe$/i text =~ /Social Security/i describe GB_GITEXE_SOCIAL "Social Security" link to a .exe file stored on a git public link score GB_GITEXE_SOCIAL 3.0 endif #SENDGRID uri __KAM_SENDGRID_LINK /sendgrid\.net\/ls\/click/i #FAKE CRYPTO #CRYPTO body __KAM_FAKE_CRYPTO1 /join our platform and start stak|tokens are waiting|Steth rewards|stake now/i #SUBJ header __KAM_FAKE_CRYPTO2 Subject =~ /claim your tokens|announcing OP \#\d|steth earnings/i #FROM header __KAM_FAKE_CRYPTO3 From =~ /lido finance|optimism newsletter/i meta KAM_FAKE_CRYPTO ( __KAM_FAKE_CRYPTO1 + __KAM_FAKE_CRYPTO2 + __KAM_FAKE_CRYPTO3 + ( __KAM_SENDGRID_LINK + __KAM_GITHUB_USER_ATTACHMENT >= 1 ) >= 4) describe KAM_FAKE_CRYPTO Fake Crypto Scam Email score KAM_FAKE_CRYPTO 6.0 #KALENDAR - NOTE WE HAVE KALENDARAI as well as TALKINGHEADS rules as well body __KAM_KALENDAR1 /introduce KalendarAI|(development|sales) at .?talkingheads|Veritex Exploration, Inc.|Flexcode software|Bywater street/i body __KAM_KALENDAR2 /(director|VP|head) of (strategic|growth|sales|AI|regional AI)/i body __KAM_KALENDAR3 /(reply \'stop\'|opt\-out of our campaigns)/i meta KAM_KALENDAR ( __KAM_KALENDAR1 + __KAM_KALENDAR2 + __KAM_KALENDAR3 >= 3 ) describe KAM_KALENDAR Spams from KalendarAI / Talking Heads / Veritex Exploration / Flexcode Software score KAM_KALENDAR 8.5 #AI AGENTS body __KAM_AI_SOCIAL_AGENTS1 /Written by AI Social Agents/i meta KAM_AI_SOCIAL_AGENTS ( __KAM_AI_SOCIAL_AGENTS1 >= 1 ) describe KAM_AI_SOCIAL_AGENTS AI Driven Spam Campaigns score KAM_AI_SOCIAL_AGENTS 10.0 #PAYPAL FRAUD header __KAM_PAYPAL_FRAUD1 From:addr =~ /\@paypal\.com/i body __KAM_PAYPAL_FRAUD2 /Note from Seller.?.?Didn\'t make this order? Call|Note from.{5,110}Didn\'t make this order\? Call|don\'t recognize the seller\? quickly/i header __KAM_PAYPAL_FRAUD3 Subject =~ /money request|invoice from/i meta KAM_PAYPAL_FRAUD ( __KAM_PAYPAL_FRAUD1 + __KAM_PAYPAL_FRAUD2 + __KAM_PAYPAL_FRAUD3 >= 3) describe KAM_PAYPAL_FRAUD Fraudulent Payment Scam score KAM_PAYPAL_FRAUD 6.0 #E-BIKE body __GB_EBIKE /\b(?:electric (?:bicycle|bike)s?|e\-bike|Elektromopeds)\b/i meta GB_EBIKE ( ( NEW_PRODUCTS || CBJ_GiveMeABreak || YOUR_DELIVERY_ADDRESS || __DOS_DIRECT_TO_MX_UNTRUSTED || RDNS_NONE ) && __TAG_EXISTS_HEAD && __GB_EBIKE ) describe GB_EBIKE E-Bike spam score GB_EBIKE 3.5 meta GB_EBIKE_ADDR ( GB_EBIKE && YOUR_DELIVERY_ADDRESS ) describe GB_EBIKE_ADDR E-Bike shipping spam score GB_EBIKE_ADDR 1.0 #URI WITH ASTERISK uri __GB_URI_ASTERISK1 /^https?:\/\/(?:\w+\.)?[\-\w]+\.(\w+|\w+\.\w{2})\/(?:\w{2,5}\/)?\*$/i meta GB_URI_ASTERISK ( __GB_URI_ASTERISK1 >= 1 ) describe GB_URI_ASTERISK Short uris with an asterisk score GB_URI_ASTERISK 6.75 #TALKINGHEADS body __KAM_TALKINGHEADS1 /WebsiteTalkingHeads/i body __KAM_TALKINGHEADS2 /AI Sales/i meta KAM_TALKINGHEADS ( __KAM_TALKINGHEADS1 + __KAM_TALKINGHEADS2 >= 2 ) describe KAM_TALKINGHEADS TalkingHeads Spam score KAM_TALKINGHEADS 3.0 #KALENDARAI body __KAM_KALENDARAI1 /Sent from Kalendar.?AI/i header __KAM_KALENDARAI2 List-Unsubscribe =~ /\/kriya\.ai\// meta KAM_KALENDARAI ( __KAM_KALENDARAI1 + __KAM_KALENDARAI2 >= 1 ) describe KAM_KALENDARAI Sent from a known spammy source of KalendarAI score KAM_KALENDARAI 7.0 #GOLD #GOLD body __KAM_GOLD1 /gold merchant/i #HELPING SOMEONE body __KAM_GOLD2 /sick (mother|father|uncle)/i #ASK body __KAM_GOLD3 /Assistance in transferring|investing the(se)? fund/i #PLACE body __KAM_GOLD4 /departure from ghana|fleeing Ukraine/i meta KAM_GOLD ( __KAM_GOLD1 + __KAM_GOLD2 + __KAM_GOLD3 + __KAM_GOLD4 >= 4) describe KAM_GOLD Funds to release treasure scam du jour score KAM_GOLD 6.0 #SURLLIDATE uri __KAM_SURLLI1 /https?:\/\/surl\.li\//i #RELATIONSHIP body __KAM_SURLLI2 /local relationship|looking for a man|dating platform|short distance relationship/i meta KAM_SURLLI ( __KAM_SURLLI1 + __KAM_SURLLI2 + FREEMAIL_FROM >= 2 ) describe KAM_SURLLI Surli Dating Spam score KAM_SURLLI 4.5 #FP_URI_TRY_3LD #uri KAM_FP_URI_TRY_3LD /\/join\.slack\.com\//i #describe KAM_FP_URI_TRY_3LD Offsetting a FP with Slack Join Links #score KAM_FP_URI_TRY_3LD -2.0 #SOME 2TLD SERVICES ARE BAD uri __KAM_SOME_2TLD_ARE_BAD1 /https?:\/\/.{3,32}\.(za|ru)\.com/i meta KAM_SOME_2TLD_ARE_BAD ( __KAM_SOME_2TLD_ARE_BAD1 >= 1 ) describe KAM_SOME_2TLD_ARE_BAD Some 2TLD and hosting sites are bad score KAM_SOME_2TLD_ARE_BAD 3.0 #google integration abuse header __KAM_GOOGLEAPPINTEGRATION1 From:addr =~ /noreply\-application\-integration\@google.com/i meta KAM_GOOGLEAPPINTEGRATION ( __KAM_GOOGLEAPPINTEGRATION1 >= 1 ) describe KAM_GOOGLEAPPINTEGRATION Abused Google Application Integration Address score KAM_GOOGLEAPPINTEGRATION 3.0 header __KAM_APPINTEGRATIONFRAUD1 Subject =~ /American Airlines|cookware set|exclusive reward|cvs package/i meta KAM_APPINTEGRATIONFRAUD ( __KAM_APPINTEGRATIONFRAUD1 + KAM_GOOGLEAPPINTEGRATION >= 2 ) describe KAM_APPINTEGRATIONFRAUD Google Application Integration Address being used for Fraud score KAM_APPINTEGRATIONFRAUD 3.0 # Google Lookerstudio abuse body __GB_SECURE_DOCUSIGN /Secure link to DocuSign/i uri __GB_LOOKERSTUDIO /https?:\/\/lookerstudio\.google\.com/i meta GB_LOOKERSTUDIO ( __GB_SECURE_DOCUSIGN && __GB_LOOKERSTUDIO && __GB_ANY_REDIR ) describe GB_LOOKERSTUDIO Google Lookerstudio abuse score GB_LOOKERSTUDIO 2.5 # FAKE INVOICE #Brand (Real or Fake) header __KAM_PHISH_INVOICE1 From:name =~ /Microsoft (Global.?Payment|Billing|Payments|subscriptions)/i #Brand/Product (Fakes) body __KAM_PHISH_INVOICE2 /Microsoft.?Office.?(365 )?(team|Billing)|Microsoft office plus|Microsoft llc|security\@PayPal, Inc\.\.com|The PayPal, Llc\. Team|GeekFullProtection|microsoft+ premium|Microsoft Business Protection|Family WorkCloud|Microsoft.?office.?black|Norton PC Support, Inc|ArmorScan.?Pro|ThreatLock.?(Ult|Pro)|Total.?AV.?Defender|InvisiGuard.?Secure|Mc Afee, Inc|virusguard.?elite, Geeksquad, llc\.|Geeksquad life.?lock|Security Counsel Solutions subscription|Virusguard.?supreme|Mcafee PC Protection|Team Mcafee Repair|Geek Squad Security Plus Plan|Pay palLLC, Inc|PayPal,LLC Team|TotalShield Premium|Antivirus Shield Pro|(Product|Plan)\: (DefendGuardian|Secure lifeguards|Comprehensive Care Shield)|True.?cyber.?safe.?Security|Internet breach (gaurd|guard)|Mcafee (Genie|Antitrack)|Northon Team/i header __KAM_PHISH_INVOICE3 Subject =~ /Microsoft.?.? Protection Plan/i meta KAM_PHISH_INVOICE ( (__KAM_PHISH_INVOICE1 + __KAM_PHISH_INVOICE2 + __KAM_PHISH_INVOICE3 >= 1) + FREEMAIL_FROM >= 2 ) describe KAM_PHISH_INVOICE Brand Impersonation Phishing Invoice score KAM_PHISH_INVOICE 8.5 # HELLOSIGN BAD header __KAM_HELLOSIGN1 From:addr =~ /\@(mail\.)hellosign\.com/i body __KAM_HELLOSIGN2 /Dropbox Sign team/i meta KAM_HELLOSIGN ( __KAM_HELLOSIGN1 + __KAM_HELLOSIGN2 >= 2 ) describe KAM_HELLOSIGN Spammers abusing hellosign to send spam/phish score KAM_HELLOSIGN 4.5 # 2IN1 body __KAM_2IN1_1 /DS18\-1215U|DS18\-N100|Alldocube|Ki1306/i header __KAM_2IN1_2 Subject =~ /2\-in\-1|Ki1306 Laptop/i meta KAM_2IN1 ( __KAM_2IN1_1 + __KAM_2IN1_2 >= 2 ) describe KAM_2IN1 2-IN-1 Computer Spam score KAM_2IN1 8.0 # APP ABUSE uri __KAM_APP_ABUSE_1 /\w\.(vercel\.app|netlify\.app|replit\.app|glitch\.me|page\.link|cloudfunctions\.net)\//i meta KAM_APP_ABUSE ( __KAM_APP_ABUSE_1 >= 1 ) describe KAM_APP_ABUSE Rampant abuse of legitimate app builders in phishing scams. This is why we can't have nice things. score KAM_APP_ABUSE 5.0 #EOF
