1 # various drugs match these rules
3 # blarson, 2004-05-10 -> lists --pasc 04/05/11
4 body DRUGSPAM /(\b|_)(c.?(i|\?|\=ed|\xed).?a.?l.?[ig].?s|v.?(i|1|=ed|\xed).?[\a@].?g.?r.?a|v.?i.?c.?o.?d.?i.?n|h.?y.?d.?r.?o.?c.?o.?d.?o.?n.?e|[xz].?a.?n.?a.\?x|p.?r.?o.?z.?a.?c|rx|hgh)(\b|_)/i
5 describe DRUGSPAM drug spam
8 # blarson, 2004-05-10 -> lists --pasc 04/05/11
9 header DRUGSPAM2 subject =~ /(\b|_)(c.?(i|\?|\=ed|\xed).?a.?l.?[ig].?s|v\.?(i|1|=ed).?[a@].?g.?r.?a|v.?i.?c.?o.?d.?i.?n|h.?y.?d.?r.?o.?c.?o.?d.?o.?n.?e|\[xz].?a.?n.?a.?x|p.?r.?o.?z.?a.?c|rx|hgh)(\b|_)/i
10 describe DRUGSPAM2 more drug spam
13 # More drugs! --pasc 2003-05-13
14 body DRUGSPAM3 /(v.?i.?o.?x|x.?a.?n.?(a|@).?x|p.?h.?e.?n.?t.?r.?e.?m.?i.?n.?e|v.?i.?a.?g.?r.?a)/i
15 describe DRUGSPAM3 yet more drugs
18 body MURPHY_DRUGS1 /v.?i.?a.?g.?r.?a/i
19 describe MURPHY_DRUGS1 Viagra
20 score MURPHY_DRUGS1 0.5
22 body MURPHY_DRUGS2 /v.?i.?o.?x/i
23 describe MURPHY_DRUGS2 Viox
24 score MURPHY_DRUGS2 0.5
26 body MURPHY_DRUGS3 /F.?i.?o.?r.?i.?c.?e.?e.?t/i
27 describe MURPHY_DRUGS3 Fioriceet
28 score MURPHY_DRUGS3 0.5
30 body MURPHY_DRUGS4 /P.?h.?e.?n.?t.?(r.?e|e.?r).?m.?i.?n.?e/i
31 describe MURPHY_DRUGS4 Phentremine
32 score MURPHY_DRUGS4 0.5
34 body MURPHY_DRUGS5 /v.?a.?l.?i.?u.?m/i
35 describe MURPHY_DRUGS5 Valium
36 score MURPHY_DRUGS5 0.5
38 body MURPHY_DRUGS6 /x.?(a|@).?n.?a.?x/i
39 describe MURPHY_DRUGS6 Xanax
40 score MURPHY_DRUGS6 0.5
42 body MURPHY_DRUGS7 /v.?i.?c.?o.?d.?i.?n/i
43 describe MURPHY_DRUGS7 Vicodin
44 score MURPHY_DRUGS7 0.5
46 body MURPHY_DRUGS8 /h.?y.?d.?r.?o.?c.?o.?d.?o.?n.?e/i
47 describe MURPHY_DRUGS8 Hydrocodone
48 score MURPHY_DRUGS8 0.5
50 body MURPHY_DRUGS_REL1 /medication/i
51 score MURPHY_DRUGS_REL1 0.5
53 body MURPHY_DRUGS_REL2 /P.?r.?e.?s.?c.?r.?i.?p.?t.?i.?o.?n/i
54 score MURPHY_DRUGS_REL2 0.5
56 body MURPHY_DRUGS_REL3 /health product/i
57 score MURPHY_DRUGS_REL3 0.5
59 body MURPHY_DRUGS_REL4 /drug.*expensive/i
60 score MURPHY_DRUGS_REL4 0.5
62 body MURPHY_DRUGS_REL5 /p.?h.?a.?r.?m.?a.?c.?e.?u.?t.?i.?c.?a.?l/i
63 score MURPHY_DRUGS_REL5 0.5
65 body MURPHY_DRUGS_REL6 /formula/i
66 score MURPHY_DRUGS_REL6 0.2
68 body MURPHY_DRUGS_REL7 /dosing/i
69 score MURPHY_DRUGS_REL7 0.2
71 body MURPHY_DRUGS_REL8 /patch/i
72 score MURPHY_DRUGS_REL8 0.02
74 body MURPHY_DRUGS_REL9 /pill/i
75 score MURPHY_DRUGS_REL9 0.2
77 body MURPHY_DRUGS_REL10 /bacteria/i
78 score MURPHY_DRUGS_REL10 0.1
80 body MURPHY_DRUGS_REL11 /antidote/i
81 score MURPHY_DRUGS_REL11 0.1
83 meta MURPHY_DRUGS_META1 (MURPHY_DRUGS1 + MURPHY_DRUGS2 + MURPHY_DRUGS3 + MURPHY_DRUGS4 + MURPHY_DRUGS5 + MURPHY_DRUGS6 + MURPHY_DRUGS7 + MURPHY_DRUGS8 + MURPHY_DRUGS_REL1 + MURPHY_DRUGS_REL2 + MURPHY_DRUGS_REL3 + MURPHY_DRUGS_REL4 + MURPHY_DRUGS_REL5 + MURPHY_DRUGS_REL9 + MURPHY_DRUGS_REL10 + MURPHY_DRUGS_REL11) > 1
84 score MURPHY_DRUGS_META1 3.0
86 meta MURPHY_DRUGS_META2 (MURPHY_DRUGS1 + MURPHY_DRUGS2 + MURPHY_DRUGS3 + MURPHY_DRUGS4 + MURPHY_DRUGS5 + MURPHY_DRUGS6 + MURPHY_DRUGS7 + MURPHY_DRUGS8 + MURPHY_DRUGS_REL1 + MURPHY_DRUGS_REL2 + MURPHY_DRUGS_REL3 + MURPHY_DRUGS_REL4 + MURPHY_DRUGS_REL5 + MURPHY_DRUGS_REL11 + MURPHY_DRUGS_REL10 + MURPHY_DRUGS_REL9) > 2
87 score MURPHY_DRUGS_META2 4.0
90 meta MURPHY_DRUGS_META3 (MURPHY_DRUGS_REL6 + MURPHY_DRUGS_REL7 + MURPHY_DRUGS_REL8 + MURPHY_DRUGS_REL9) > 1
91 score MURPHY_DRUGS_META3 2.0
93 meta DRUGS_STOCK_MIMEOLE (__MIMEOLE_1106 && __MAILER_OL_5510)
94 header __MIMEOLE_1106 X-MimeOLE =~ /^Produced By Microsoft MimeOLE V6.00.2800.1106$/
95 header __MAILER_OL_5510 X-Mailer =~ /^Microsoft Office Outlook, Build 11.0.5510$/
96 describe DRUGS_STOCK_MIMEOLE Stock-spam forged headers found (5510)
97 score DRUGS_STOCK_MIMEOLE 3
99 # More penis enlargement --pasc 061012
100 body M_BIGGER1 /gain \d inches/i
103 # cjwatson, 2003/02/26
104 body AMAZINGHEALTHGROUP /www\.amazinghealthgroup\.com/
105 describe AMAZINGHEALTHGROUP Amazing Spam Group
106 score AMAZINGHEALTHGROUP 4.0
109 body PHARMACYSPAM1 /http:\/\/www.pharmacy[^\.]+.biz/i
110 describe PHARMACYSPAM1 pharmacy spam 1
111 score PHARMACYSPAM1 4
113 header PHARMACYSPAM2 Subject =~ /Best Discount Online Drugs/i
114 describe PHARMACYSPAM2 pharmacy spam 2
115 score PHARMACYSPAM2 4
118 body PRESCRIPTION /prescription/i
119 describe PRESCRIPTION pharmacy spam
122 body PHARMACY /pharmacy/i
123 describe PHARMACY pharmacy spam
126 body FDAAPPROVEDB /(USA?|FDA)( official)?[ -]approved/
127 describe FDAAPPROVEDB US FDA approved pharmacy spam
130 header FDAAPPROVEDS Subject =~ /(USA?|FDA)( official)?[ -]approved/
131 describe FDAAPPROVEDS US FDA approved pharmacy spam
134 # cjwatson, 2004-01-16
135 body MYPILLSOURCE /mypillsource\.com/
136 describe MYPILLSOURCE mypillsource.com spam
139 # cjwatson, 2004-02-18
140 body HGH_PROVEN /HGH is proven to help/
141 describe HGH_PROVEN Yeah, sure
144 # cjwatson, 2004-02-22
145 header CIALGS Subject =~ /sug?per viagrga/
146 describe CIALGS Viagra derivative spam
149 # cjwatson, 2004-03-01, 2004-03-05
150 body LAY_THE_PIPE /the next (chick|girl) you (screw|bang)/
151 describe LAY_THE_PIPE Viagra spam
155 body SPERM /\bsperm/i
156 describe SPERM fertility spam
160 header MED subject =~ /\b(?:doctor|health|medic(?:al|ine))$/
161 describe MED medical spam
165 body HOODIA /\bh.?oodia/i
166 describe HOODIA weight loss scam
170 header PHARRMACY subject =~ /Can+adian\s+Fami+ly\s+Phar+macy/i
171 describe PHARRMACY pharrmacy can't spell
175 body MALEENHANCE /male\s+enhan[c\(]e/i
176 describe MALEENHANCE Enhanced males
180 body SIZEMAT /\b(?:Does Size|size does) Matter\b/i
181 describe SIZEMAT size matters spam
185 body SIZEMAT /\bsizematters\.cn\b/i
186 describe SIZEMAT size matters
190 body ENLARGEPL /\benlargeplus\b/
191 describe ENLARGEPL more penis spam
195 body PHYSCONS /^After this we will require a physician consultation/
196 describe PHYSCONS more php spam
201 body GETABIG /\bwww\.getabiggercock\.net\b/i
202 describe GETABIG cock spam