1 # -*- mode: spamassassin -*-
3 # various drugs match these rules
5 # blarson, 2004-05-10 -> lists --pasc 04/05/11
6 body DRUGSPAM /(\b|_|\d)(c.?(i|\?|\=ed|\xed).?a.?l.?[ig].?s|v.?(i|1|=ed|\xed|l).?(?:a|\@|\/\\).?g.?r.?(?:a|\@|\/\\)|v.?i.?c.?o.?d.?i.?n|h.?y.?d.?r.?o.?c.?o.?d.?o.?n.?e|[xz].?a.?n.?a.\?x|p.?r.?o.?z.?a.?c|hgh)(\b|_\d)/i
7 describe DRUGSPAM drug spam
10 # blarson, 2004-05-10 -> lists --pasc 04/05/11
11 header DRUGSPAM2 subject =~ /(\b|_|\d)(c.?(i|\?|\=ed|\xed).?a.?l.?[ig].?s|v\.?(i|1|=ed).?(?:a|\@|\/\\).?g.?r.?(?:a|\/\\)|v.?i.?c.?o.?d.?i.?n|h.?y.?d.?r.?o.?c.?o.?d.?o.?n.?e|\[xz].?a.?n.?a.?x|p.?r.?o.?z.?a.?c|hgh)(\d|\b|_)/i
12 describe DRUGSPAM2 more drug spam
15 # More drugs! --pasc 2003-05-13 blarson 2007-09-12
16 body DRUGSPAM3 /\b(v.?i.?o.?x|x.?a.?n.?(a|@).?x|p.?h.?e.?n.?t.?r.?e.?m.?i.?n.?e|v.?i.?a.?g.?r.?a)/i
17 describe DRUGSPAM3 yet more drugs
21 full MURPHY_DRUGS1 /\bv.?i.?a+.?[gdk]+.?r+.?a+\b/i
22 describe MURPHY_DRUGS1 Viagra
23 score MURPHY_DRUGS1 1.5
25 body MURPHY_DRUGS2 /v.?i.?o.?x/i
26 describe MURPHY_DRUGS2 Viox
27 score MURPHY_DRUGS2 0.5
29 body MURPHY_DRUGS3 /F.?i.?o.?r.?i.?c.?e.?e.?t/i
30 describe MURPHY_DRUGS3 Fioriceet
31 score MURPHY_DRUGS3 0.5
33 body MURPHY_DRUGS4 /P.?h.?e.?n.?t.?(r.?e|e.?r).?m.?i.?n.?e/i
34 describe MURPHY_DRUGS4 Phentremine
35 score MURPHY_DRUGS4 0.5
37 body MURPHY_DRUGS5 /v.?a.?l.?i.?u.?m/i
38 describe MURPHY_DRUGS5 Valium
39 score MURPHY_DRUGS5 0.5
41 body MURPHY_DRUGS6 /x.?(a|@).?n.?a.?x/i
42 describe MURPHY_DRUGS6 Xanax
43 score MURPHY_DRUGS6 0.5
45 body MURPHY_DRUGS7 /v.?i.?c.?o.?d.?i.?n/i
46 describe MURPHY_DRUGS7 Vicodin
47 score MURPHY_DRUGS7 0.5
49 body MURPHY_DRUGS8 /h.?y.?d.?r.?o.?c.?o.?d.?o.?n.?e/i
50 describe MURPHY_DRUGS8 Hydrocodone
51 score MURPHY_DRUGS8 0.5
53 body MURPHY_DRUGS_REL1 /medication/i
54 score MURPHY_DRUGS_REL1 0.5
56 body MURPHY_DRUGS_REL2 /P.?r.?e.?s.?c.?r.?i.?p.?t.?i.?o.?n/i
57 score MURPHY_DRUGS_REL2 0.5
59 body MURPHY_DRUGS_REL3 /health product/i
60 score MURPHY_DRUGS_REL3 0.5
62 body MURPHY_DRUGS_REL4 /drug.*expensive/i
63 score MURPHY_DRUGS_REL4 0.5
65 body MURPHY_DRUGS_REL5 /p.?h.?a.?r.?m.?a.?c.?e.?u.?t.?i.?c.?a.?l/i
66 score MURPHY_DRUGS_REL5 0.5
68 body MURPHY_DRUGS_REL6 /formula/i
69 score MURPHY_DRUGS_REL6 0.2
71 body MURPHY_DRUGS_REL7 /dosing/i
72 score MURPHY_DRUGS_REL7 0.2
74 body MURPHY_DRUGS_REL8 /patch/i
75 score MURPHY_DRUGS_REL8 0.02
77 body MURPHY_DRUGS_REL9 /\bpills?\b/i
78 score MURPHY_DRUGS_REL9 1
80 body MURPHY_DRUGS_REL10 /bacteria/i
81 score MURPHY_DRUGS_REL10 0.1
83 body MURPHY_DRUGS_REL11 /antidote/i
84 score MURPHY_DRUGS_REL11 0.1
86 meta MURPHY_DRUGS_META1 (MURPHY_DRUGS1 + MURPHY_DRUGS2 + MURPHY_DRUGS3 + MURPHY_DRUGS4 + MURPHY_DRUGS5 + MURPHY_DRUGS6 + MURPHY_DRUGS7 + MURPHY_DRUGS8 + MURPHY_DRUGS_REL1 + MURPHY_DRUGS_REL2 + MURPHY_DRUGS_REL3 + MURPHY_DRUGS_REL4 + MURPHY_DRUGS_REL5 + MURPHY_DRUGS_REL9 + MURPHY_DRUGS_REL10 + MURPHY_DRUGS_REL11) > 1
87 score MURPHY_DRUGS_META1 3.0
89 meta MURPHY_DRUGS_META2 (MURPHY_DRUGS1 + MURPHY_DRUGS2 + MURPHY_DRUGS3 + MURPHY_DRUGS4 + MURPHY_DRUGS5 + MURPHY_DRUGS6 + MURPHY_DRUGS7 + MURPHY_DRUGS8 + MURPHY_DRUGS_REL1 + MURPHY_DRUGS_REL2 + MURPHY_DRUGS_REL3 + MURPHY_DRUGS_REL4 + MURPHY_DRUGS_REL5 + MURPHY_DRUGS_REL11 + MURPHY_DRUGS_REL10 + MURPHY_DRUGS_REL9) > 2
90 score MURPHY_DRUGS_META2 4.0
93 meta MURPHY_DRUGS_META3 (MURPHY_DRUGS_REL6 + MURPHY_DRUGS_REL7 + MURPHY_DRUGS_REL8 + MURPHY_DRUGS_REL9) > 1
94 score MURPHY_DRUGS_META3 2.0
96 meta DRUGS_STOCK_MIMEOLE (__MIMEOLE_1106 && __MAILER_OL_5510)
97 header __MIMEOLE_1106 X-MimeOLE =~ /^Produced By Microsoft MimeOLE V6.00.2800.1106$/
98 header __MAILER_OL_5510 X-Mailer =~ /^Microsoft Office Outlook, Build 11.0.5510$/
99 describe DRUGS_STOCK_MIMEOLE Stock-spam forged headers found (5510)
100 score DRUGS_STOCK_MIMEOLE 3
102 # More penis enlargement --pasc 061012
103 body M_BIGGER1 /gain \d inches/i
106 # cjwatson, 2003/02/26
107 body AMAZINGHEALTHGROUP /www\.amazinghealthgroup\.com/
108 describe AMAZINGHEALTHGROUP Amazing Spam Group
109 score AMAZINGHEALTHGROUP 4.0
112 body PHARMACYSPAM1 /http:\/\/www.pharmacy[^\.]+.biz/i
113 describe PHARMACYSPAM1 pharmacy spam 1
114 score PHARMACYSPAM1 4
116 header PHARMACYSPAM2 Subject =~ /Best Discount Online Drugs/i
117 describe PHARMACYSPAM2 pharmacy spam 2
118 score PHARMACYSPAM2 4
121 body PRESCRIPTION /prescription/i
122 describe PRESCRIPTION pharmacy spam
125 body PHARMACY /pharmacy/i
126 describe PHARMACY pharmacy spam
129 body FDAAPPROVEDB /(USA?|FDA)( official)?[ -]approved/
130 describe FDAAPPROVEDB US FDA approved pharmacy spam
133 header FDAAPPROVEDS Subject =~ /(USA?|FDA)( official)?[ -]approved/
134 describe FDAAPPROVEDS US FDA approved pharmacy spam
137 # cjwatson, 2004-01-16
138 body MYPILLSOURCE /mypillsource\.com/
139 describe MYPILLSOURCE mypillsource.com spam
142 # cjwatson, 2004-02-18
143 body HGH_PROVEN /HGH is proven to help/
144 describe HGH_PROVEN Yeah, sure
147 # cjwatson, 2004-02-22
148 header CIALGS Subject =~ /sug?per viagrga/
149 describe CIALGS Viagra derivative spam
152 # cjwatson, 2004-03-01, 2004-03-05
153 body LAY_THE_PIPE /the next (chick|girl) you (screw|bang)/
154 describe LAY_THE_PIPE Viagra spam
158 body SPERM /\bsperm/i
159 describe SPERM fertility spam
163 header MED subject =~ /\b(?:doctor|health|medic(?:al|ine))$/
164 describe MED medical spam
167 # blarson 2006-09-25 2007-09-18
168 body HOODIA /\bh.?oo+dia/i
169 describe HOODIA weight loss scam
173 header PHARRMACY subject =~ /Can+adian\s+Fami+ly\s+Phar+macy/i
174 describe PHARRMACY pharrmacy can't spell
178 body MALEENHANCE /male\s+enhan[c\(]e/i
179 describe MALEENHANCE Enhanced males
183 body SIZEMAT /\b(?:Does Size|size does) Matter\b/i
184 describe SIZEMAT size matters spam
188 body SIZEMAT /\bsizematters\.cn\b/i
189 describe SIZEMAT size matters
193 body ENLARGEPL /\benlargeplus\b/
194 describe ENLARGEPL more penis spam
198 body PHYSCONS /^After this we will require a physician consultation/
199 describe PHYSCONS more php spam
204 body GETABIG /\bwww\.getabiggercock\.net\b/i
205 describe GETABIG cock spam
209 body PHYLET /\bphysician (?:letter|questions?)\b/i
210 describe PHYLET physician letter
214 body PEN1S /\bpen1s\b/i
219 body PILLS /\bx\s+\d+\s+pills\b/
220 describe PILLS pills spam
224 body PFIZER /\bP\W?f\W?i\W?z\W?e\W?r\b/i
225 describe PFIZER Pfizer
229 body WONDERCUM /\bwondercum\b/i
230 describe WONDERCUM more drug spam
234 body DRUGSTORE /\bdrug store\b/i
235 describe DRUGSTORE drug store
239 header LETACCOUNT subject =~ /LET\:account,password,shop/i
240 describe LETACCOUNT Random Let:account spam
244 body HGH /\bh(?:uman)?g(?:rowth)?h(?:ormone)?\b/i
249 body BRACKVIAG /\b\[V(?:\]\w\[)?I(?:\]\w\[)?A(?:\]\w\[)?G(?:\]\w\[)?R(?:]\w\[)?A\]\b/i
250 describe BRACKVIAG [viagra]
254 header PHARMORD subject =~ /\bPharmacy\b.*\border\b/i
255 describe PHARMORD Pharmacy order
259 body XTRASIZE /\bXtra\s*Size\b/i
260 describe XTRASIZE more penis spam
264 header BIGORGAN subject =~ /\b(?:macro|sizeable|bouffant|colossal|elephantin|largish|gargantuan|vast|ample|broad|huge|size|significant|oversized?|monolithic|hulky|voluminous|whopping|enormous|titanic|large|extended|bulky|humongous|outsize|puffy|prodigious|extended|sized|monstrous|wide|thumping|stupendous|gigantic|big|important|mountainous|immense|extended|plumping|tremendous|extensive|massive|sizable|conspicuous|prodigious|jumbo|monster|greatest|scale|immence|spacious|ranging|giant|biggish|outsized|whacking|fat|capacious|grand|intense|monumental|rangy|prominent|cosmic|bigger|muscular|obvious|overlarge|enlarged|super|larger|increase|stronger|sized?|your|great|longest|true|harder|tiny|small|gaining|ultimate|amazing|long|huge)\s+(?:body part|member|phallus|fuckstick|sc?hlong|d[il]c?\W?k|shaft|p\W?e\W?n[i!l]s|erectile|organ|c[o0]ck[s5]?|rods?|ejaculation|erections?|in\sgirth|one-eyed|penile|w[i1][l1]+y|magic wand|masculinity|PE|pleasure machine|herbal|stick|male|d\Wi\Wc\Wk|boner|pecker)\b/i
265 describe BIGORGAN big body part
269 header BKWORD subject =~ /\b\{word\}\b/
270 describe BKWORD {word}
274 header MEDS subject =~ /\bmed(?:ication)?s?\b/i
279 header STEROIDS subject =~ /\bsteroids?\b/i
280 describe STEROIDS steroids
284 header HEALTH subject =~ /\bhealth\b/i
285 describe HEALTH health
289 body MEDS2 /\bmed\W?s?\b/
299 full TRIBULUS /\b(?:Tribulus terrestris|Albizzia lebbeck|Argyrerin speciosa|Valeriana wallichii|Soya protein)\b/i
300 describe TRIBULUS Tribulus terrestris|Albizzia lebbeck
304 body VITAMINE /\bVitamin E\b/
305 describe VITAMINE Vitamin E
309 full PENISSIZE /\b(?:penis|dick|cock)\s+(?:size|enlargement|width|girth)\b/i
310 describe PENISSIZE penis size
314 full INVOICE /\bPharmacy Invoice\b/i
315 describe INVOICE Pharmacy Invoice
319 header S_E_X subject =~ /\bs\W?e\W?(?:x|[>)]\W?[<(])(?:\b|u)/i
324 header EDSET subject =~ /\bEDSET\b/
329 full CANADIAN /\bCanadian.*pharmacy\b/i
330 describe CANADIAN Canadian pharmacy
334 header INVOICE subject =~ /\b(?:Invoice|order)\s+.?\s*\d+/i
335 describe INVOICE invoice number
339 header PHARMA subject =~ /\bpharm/i
340 describe PHARMA pharma
344 full UITRAM /\bUItram\b/i
345 describe UITRAM UItram
349 full ANTIED /\banti(?:-|\s*)EDs?\b/i
350 describe ANTIED anti-ED
354 full BUYDRUGS /\bbuydrugs\b/i
355 describe BUYDRUGS buydrugs
359 body POPTHIS /\bpop\s+this\b/i
360 describe POPTHIS pop this
364 full BLUEPILL /\bblue?.?(?:pil+|med)/i
365 describe BLUEPILL blue pill
369 full NAKEDWOM /\bNaked\s*Wom[ae]n/i
370 describe NAKEDWOM Naked Woman
374 full HERBALSUP /\bherbal supplement/i
375 describe HERBALSUP herbal supplement
380 describe VIA4 viagra in the middle of a word
384 full LEGALWEED /\bLegal WEED\b/
385 describe LEGALWEED Legal WEED
389 header PUSSY subject =~ /\b\_?(?:pussy|cum|naked|g(?:-|\s*)?spot|nipple|manhood|one(?:-|\s+)eyed\s+monster|orgasm|breast|vibrator|p[e3]n[il]s|porno|Tittie|flaccid|shagging|stripping|hottie|orgasmic|capsule|climax|lace|horny|Pink|wet|foreplay|Playboy|playmate|bares|blowing|sucking|Embrace|courtship|love|bosom|exposed|freaky|motel|credit card|pleasure|Ejaculation|herba[l1]|dosage|\d+\s+mg|escort|Penetration|orgie|pecker|crotch|Pocket Rocket|Sports Illustrated|RAMBO|bees|Corpora Cavernosa|rod|luv|see-through|College|jetsetting|Shaven|1\d and|inches|lovemaking|bedroom|Purchase|kung fu|saucy|Buy|laid|Obama|dementia|No weight|pill|Pacify|screening|regret|brad pitt|undressed|freebie|Discount|wonderdrug|Rock|diet|racy|boob|ramming|Loving|bang|coming|tablet|customer|highs|limited edition|Shock attack|topless|CS\s*3|babe|kinky|clothes|bed(?:ding)?|fame|hurt her|LOTTERY|year old|hot action|Ladies man|\d+ inche?|creamy|Click Here|wicked|Shy|touch herself|Shopping|timepiece|Shop|Dealer|watches|luxury|flaunting|dressed|brand|Popular|bling|luxuries|order processing|hobbies|wealth|lucky|draw|thi\b|flesh|Bacheelor|Doctoraate|Exquisite|bottle|money|millionaire|price|famous|branded|Affordable|bucks|Grape Seed|Antioxidant|fashion|Antiox|Free Radical|wonder power|Paris Hilton|wrist|Pamper|Red hot|Nicolas Cage|sale|blood|scientist|sin|Steve Jobs|hot girl|Lordly|dosage|Prada|shoes|pilz|che+ap|babymaker|pornstar|chixx|shed|pound|Investment|E-gold|swagger|LNH|weener|shipping|billing|oem|PhD|university|accredited|degree|hi|from me|monster\.com|discreet|hey|Maxim|Erection|Webmaster|sell|Career|xxx\w*|medicine|medication|health|buying|Rx|pharm|medicinal|Perscription|debt|Cam|Medical|foto|Narcotic|meddiscount|crazy|japanese|Chat|babe|winner|sure cure|European|agency|vocanc(?:ie|y)|CareerBuilder|pilule|CorelDRAW|shag|cumming|Employer|jobseeker|NoPrescripiton|remedy|cheaper|SpaB|fedex|luksus)s?\_?\b/i
390 describe PUSSY various spammy words in subject
394 header FDA subject =~ /\bFDA\b/
399 body CANADIANRX /\bCanadian(?:\s|_)+(?:Rx|med)/i
400 describe CANADIANRX Canadian RxMedz
404 # don da30 is a subtype of m68k; don't match it.
405 body MEDS35 /\b(?:meds?|shop|pill|gen|ca|via|cu|ko|me|ba|bu|ku|ma)\d\d\b/
406 describe MEDS35 meds35