home *** CD-ROM | disk | FTP | other *** search
/ Enter 2005 December / enter-cd-12-2005.iso / Internet / SpamAware 4.0 / SpamAware-Setup.exe / {app} / rules / jam.cf < prev    next >
Encoding:
Text File  |  2005-07-14  |  26.1 KB  |  464 lines
  1. # tests around medications
  2.  
  3. header          JAM_VIAGRA              ALL =~ /[v].?[i1|l!].?[a@].?[g].?[r].?[a@]/i
  4. describe        JAM_VIAGRA              Subject line contains medicine Viagra
  5. score           JAM_VIAGRA              1.5
  6.  
  7. body            JAM_VIAGRA_BD           /[v].?[i1|l!].?[a@].?[g].?[r].?[a@]/i
  8. describe        JAM_VIAGRA_BD           Subject line contains typical medical product like Viagra or Valium
  9. score           JAM_VIAGRA_BD           0.5
  10.  
  11. header          JAM_HYDROCODONE         ALL =~ /H.?y.?d.?r.?[o0].?c.?[o0].?d/i
  12. describe        JAM_HYDROCODONE         Subject line contains medicine Hydrocodone
  13. score           JAM_HYDROCODONE         1.0
  14.  
  15. body            JAM_HYDROCODONE_BD       /H.?y.?d.?r.?[o0].?c.?[o0].?d/i
  16. describe        JAM_HYDROCODONE_BD       Subject line contains medicine Hydrocodone
  17. score           JAM_HYDROCODONE_BD       0.3
  18.  
  19. header          JAM_VICODIN             ALL =~ /V.?[i1|l!].?c.?[o0].?d.?[i1|l!].?n/i
  20. describe        JAM_VICODIN             Subject line contains medicine Vicodin
  21. score           JAM_VICODIN             1.0
  22.  
  23. body            JAM_VICODIN_BD          /V.?[i1|l!].?c.?[o0].?d.?[i1|l!].?n/i
  24. describe        JAM_VICODIN_BD          Subject line contains medicine Vicodin
  25. score           JAM_VICODIN_BD          0.5
  26.  
  27. header          JAM_LIPITOR             ALL =~ /\sL.?[i1|l!].?p.?[i1|l!].?t.?[o0].?r/i
  28. describe        JAM_LIPITOR             Subject line contains medicine Vicodin
  29. score           JAM_LIPITOR             1.0
  30.  
  31. body            JAM_LIPITOR_BD          /L.?[i1|l!].?p.?[i1|l!].?t.?[o0].?r/i
  32. describe        JAM_LIPITOR_BD          Body contains medicine Vicodin
  33. score           JAM_LIPITOR_BD          0.5
  34.  
  35. header          JAM_XANAX               ALL =~ /X.?[a@].?n.?[a@].?x/i
  36. describe        JAM_XANAX               Subject line contains medicine Xanax
  37. score           JAM_XANAX               1.5
  38.  
  39. body            JAM_XANAX_BD            /X.?[a@].?n.?[a@].?x/i
  40. describe        JAM_XANAX_BD            Subject line contains medicine Xanax
  41. score           JAM_XANAX_BD            0.5
  42.  
  43. header          JAM_VIOXX               ALL =~ /V.?[i1|l!].?o.?x/i
  44. describe        JAM_VIOXX               Subject line contains medicine Vioxx
  45. score           JAM_VIOXX               1.5
  46.  
  47. body            JAM_VIOXX_BD            /V.?[i1|l!].?o.?x/i
  48. describe        JAM_VIOXX_BD            Subject line contains medicine Viox
  49. score           JAM_VIOXX_BD            0.5
  50.  
  51. header          JAM_VALIUM              Subject =~ /V.?[a@].?[l1|].?[i1|l!].?u.?m/i
  52. describe        JAM_VALIUM              Subject line contains medicine Valium
  53. score           JAM_VALIUM              1.0
  54.  
  55. body            JAM_VALIUM_BD           /V.?[a\@o].?[l1|].?[i1|l!].?u.?m/i
  56. describe        JAM_VALIUM_BD           Subject line contains medicine Valium
  57. score           JAM_VALIUM_BD           0.3
  58.  
  59. header          JAM_PHENTERMINE         ALL =~ /P.?h.?e.?n.?t.?e.?r.?m.?i.?n.?e/i
  60. describe        JAM_PHENTERMINE         Subject line contains medicine Phentermine
  61. score           JAM_PHENTERMINE         1.5
  62.  
  63. body            JAM_PHENTERMINE_BD      /P.?h.?e.?n.?t.?e.?r.?m.?i.?n.?e/i
  64. describe        JAM_PHENTERMINE_BD      Subject line contains medicine Phentermine
  65. score           JAM_PHENTERMINE_BD      0.3
  66.  
  67. header          JAM_XENICAL             ALL =~ /xenical/i
  68. describe        JAM_XENICAL             Subject line contains medicine Xenical
  69. score           JAM_XENICAL             1.5
  70.  
  71. body            JAM_XENICAL_BD          /xenical/i
  72. describe        JAM_XENICAL_BD          Subject line contains medicine Xenical
  73. score           JAM_XENICAL_BD          0.3
  74.  
  75. header          JAM_BOTOX               Subject =~ /B.?[o0].?t.?[o0].?x/i
  76. describe        JAM_BOTOX               Subject line contains Botox
  77. score           JAM_BOTOX               1.5
  78.  
  79. body            JAM_BOTOX_BD            /B.?[o0].?t.?[o0].?x/i
  80. describe        JAM_BOTOX_BD            Body contains Botox
  81. score           JAM_BOTOX_BD            0.5
  82.  
  83. header          JAM_CIALIS              ALL =~ /[C].?[i1|.]?[a\@]?[l1].?[i1|l!].?s/i
  84. describe        JAM_CIALIS              Subject line contains medicine Cialis
  85. score           JAM_CIALIS              1.8
  86.  
  87. body            JAM_CIALIS_BD           /\sC.?[i1|.]?[a@].?[l1].?[i1|l!].?s/i
  88. describe        JAM_CIALIS_BD           Subject line contains medicine Cialis
  89. score           JAM_CIALIS_BD           0.6
  90.  
  91. header          JAM_LEVITRA             Subject =~ /L.?e.?v.?[i1|l!].?t.?r.?[a\@]/i
  92. describe        JAM_LEVITRA             Subject line contains medicine Levitra
  93. score           JAM_LEVITRA             1.0
  94.  
  95. body            JAM_LEVITRA_BD          /L.?e.?v.?[i1|l!].?t.?r.?[a@]/i
  96. describe        JAM_LEVITRA_BD          Subject line contains medicine Levitra
  97. score           JAM_LEVITRA_BD          0.5
  98.  
  99. header          JAM_NORCO               Subject =~ /\s.?N.?[o0].?r.?c.?[o0].?\s/i
  100. describe        JAM_NORCO               Subject line contains medicine Norco
  101. score           JAM_NORCO               1.0
  102.  
  103. body            JAM_NORCO_BD            /\s.?N.?[o0].?r.?c.?[o0].?\s/i
  104. describe        JAM_NORCO_BD            Body contains medicine Norco
  105. score           JAM_NORCO_BD            0.5
  106.  
  107. header          JAM_PROZAC              Subject =~ /P.?r.?o.?z.?a.?c/i
  108. describe        JAM_PROZAC              Subject line contains medicine Prozac
  109. score           JAM_PROZAC              1.0
  110.  
  111. body            JAM_PROZAC_BD           /P.?r.?o.?z.?a.?c/i
  112. describe        JAM_PROZAC_BD           Body contains medicine Prozac
  113. score           JAM_PROZAC_BD           0.5
  114.  
  115. header          JAM_CIALAPREN           Subject =~ /C.?i.?a.?l.?a.?p.?r.?e.?n/i
  116. describe        JAM_CIALAPREN           Subject line contains Cialapren
  117. score           JAM_CIALAPREN           3.5
  118.  
  119. body            JAM_CIALAPREN_BD        /C.?i.?a.?l.?a.?p.?r.?e.?n/i
  120. describe        JAM_CIALAPREN_BD        Body contains Cialapren
  121. score           JAM_CIALAPREN_BD        1.5
  122.  
  123. header          JAM_GROWTH_HORMONE      Subject =~ /G.?r.?o.?w.?t.?h.?.?.?H.?o.?r.?m.?o.?n.?e/i
  124. describe        JAM_GROWTH_HORMONE      Subject Line contains "Growth Hormone"
  125. score           JAM_GROWTH_HORMONE      2.5
  126.  
  127. body            JAM_GROWTH_HORMONE_BD   /G.?r.?o.?w.?t.?h.?.?.?H.?o.?r.?m.?o.?n.?e/i
  128. describe        JAM_GROWTH_HORMONE_BD   Body contains "Growth Hormone"
  129. score           JAM_GROWTH_HORMONE_BD   1.0
  130.  
  131. header          JAM_PHARMACY            Subject =~ /(?:m.?e.?d.?i.?c.?a.?t.?i.?o.?n|p.?h.?a.?r.?m.?[a\@e].?c|\Wmeds\W|p.?r.?e.?s.?c.?r.?i.?p.?t.?i.?o.?n|p[i1|l][l1]l[sz\b]|health)/i
  132. describe        JAM_PHARMACY            Subject line contains pharmacy, medication etc
  133. score           JAM_PHARMACY            0.5
  134.  
  135. body            JAM_PHARMACY_BD          /(?:m.?e.?d.?i.?c.?a.?t.?i.?o.?n|p.?h.?a.?r.?m.?a.?c|\Wmeds\W|p.?r.?e.?s.?c.?r.?i.?p.?t.?i.?o.?n|p[i1|l][l1]l[sz\b])/i
  136. describe        JAM_PHARMACY_BD          Body contains pharmacy, medication etc
  137. score           JAM_PHARMACY_BD          0.1
  138.  
  139. meta            JAM_PHARMACY_PRODUCTS   ((JAM_VIAGRA + JAM_HYDROCODONE + JAM_VICODIN + JAM_XANAX + JAM_VALIUM + JAM_PHENTERMINE + JAM_XENICAL + JAM_BOTOX + JAM_CIALIS + JAM_LEVITRA + JAM_NORCO + JAM_LIPITOR + JAM_VIOXX)>2)
  140. describe        JAM_PHARMACY_PRODUCTS   Subject line contains multiple typical medicines like Viagra or Xanax
  141. score           JAM_PHARMACY_PRODUCTS   3.0
  142.  
  143. meta            JAM_PHARMACY_PRODUCTS_BD  ((JAM_VIAGRA_BD + JAM_HYDROCODONE_BD + JAM_VICODIN_BD + JAM_XANAX_BD + JAM_VALIUM_BD + JAM_PHENTERMINE_BD + JAM_XENICAL_BD + JAM_BOTOX_BD + JAM_LEVITRA_BD + JAM_CIALIS_BD + JAM_NORCO_BD + JAM_LIPITOR_BD + JAM_VIOXX_BD + JAM_PHARMACY_BD)>2)
  144. describe        JAM_PHARMACY_PRODUCTS_BD  Body contains multiple typical medicines like Viagra or Xanax
  145. score           JAM_PHARMACY_PRODUCTS_BD  3.0
  146.  
  147.  
  148. # Meta tests
  149. meta            JAM_PHARMACY_MANY_BD    ((JAM_PHARMACY_PRODUCTS_BD + JAM_SHIPPING_BD) > 1)
  150. describe        JAM_PHARMACY_MANY_BD    Body contains medical products and shipping information
  151. score           JAM_PHARMACY_MANY_BD    1.5
  152.  
  153. meta            JAM_PHARMACY_MANY2_BD   ((JAM_PHARMACY_BD + JAM_SHIPPING_BD) > 1)
  154. describe        JAM_PHARMACY_MANY2_BD   Body contains medical products and shipping information
  155. score           JAM_PHARMACY_MANY2_BD   2.0
  156.  
  157. meta            JAM_PHARMACY_IMAGE_ONLY ((JAM_PHARMACY || JAM_PHARMACY_PRODUCTS || JAM_PHARMACY_PRODUCTS_BD || JAM_PHARMACY_BD) && (HTML_IMAGE_RATIO_08 || HTML_IMAGE_RATIO_02 || HTML_IMAGE_RATIO_04 || HTML_IMAGE_RATIO_06 || HTML_IMAGE_ONLY_02))
  158. describe        JAM_PHARMACY_IMAGE_ONLY Subject contains medical products and shipping information
  159. score           JAM_PHARMACY_IMAGE_ONLY 2.5
  160.  
  161. header          __JAM_SHIPPING1         Subject =~ /\s(?:e.?x.?p.?r.?e.?s.?s|o.?n.?l.?i.?n.?e|o.?v.?e.?r.?n.?i.?g.?h.?t|w.?o.?r.?l.?d.?w.?i.?d.?e).{0,10}(?:s.?h.?i.?p.?p.?i.?n.?g|s.?h.?i.?p.?m.?e.?n.?t)/i
  162. header          __JAM_SHIPPING2         Subject =~ /\s(?:s.?h.?i.?p.?p.?i.?n.?g|s.?h.?i.?p.?p.?e.?d|s.?h.?i.?p.?m.?e.?n.?t|ship\b).{0,10}(?:e.?x.?p.?r.?e.?s.?s|o.?n.?l.?i.?n.?e|o.?v.?e.?r.?n.?i.?g.?h.?t|w.?o.?r.?l.?d.?w.?i.?d.?e|next day)/i
  163.  
  164. meta            JAM_SHIPPING            (__JAM_SHIPPING1 || __JAM_SHIPPING2)
  165. describe        JAM_SHIPPING            Subject line contains shipping information
  166. score           JAM_SHIPPING            0.5
  167.  
  168. body            __JAM_SHIPPING1_BD      /\s(?:express|online|overnight|w.?o.?r.?l.?d.?w.?i.?d.?e).{0,10}(?:s.?h.?i.?p.?p.?i.?n.?g|s.?h.?i.?p.?m.?e.?n.?t)/i
  169. body            __JAM_SHIPPING2_BD      /\s(?:s.?h.?i.?p.?p.?i.?n.?g|s.?h.?i.?p.?m.?e.?n.?t|ship\b).{0,10}(?:e.?x.?p.?r.?e.?s.?s|o.?n.?l.?i.?n.?e|o.?v.?e.?r.?n.?i.?g.?h.?t|w.?o.?r.?l.?d.?w.?i.?d.?e)/i
  170.  
  171. meta            JAM_SHIPPING_BD         (__JAM_SHIPPING1_BD || __JAM_SHIPPING2_BD)
  172. describe        JAM_SHIPPING_BD         Body contains shipping information
  173. score           JAM_SHIPPING_BD         0.2
  174.  
  175. meta            __JAM_SHIPPING_ALL      (JAM_SHIPPING || JAM_SHIPPING_BD)
  176. describe        __JAM_SHIPPING_ALL      Subject or Body contains shipping information 
  177.  
  178. meta            JAM_PHARMACY_MANY       ((JAM_PHARMACY_PRODUCTS + JAM_SHIPPING) > 1)
  179. describe        JAM_PHARMACY_MANY       Subject contains medical products and shipping information
  180. score           JAM_PHARMACY_MANY       3.5
  181.  
  182. meta            JAM_PHARMACY_MANY2      ((JAM_PHARMACY + JAM_SHIPPING) > 1)
  183. describe        JAM_PHARMACY_MANY2      Body contains medical products and shipping information
  184. score           JAM_PHARMACY_MANY2      2.5
  185.  
  186. # Other keywords
  187. header          JAM_MORTGAGE            Subject =~ /(?:m.?[o0].?r.?t.?g.?[a@].?g.?e|\bd.?e.?b.?t\b^|r.?e.?f.?i.?n.?a.?n.?c.?e)/i
  188. describe        JAM_MORTGAGE            Subject contains mortgage, debt or similar
  189. score           JAM_MORTGAGE            2.0
  190.  
  191. body            JAM_MORTGAGE_BD         /(?:m.?[0o].?r.?t.?g.?[a@].?g.?e|\bd.?e.?b.?t\b)/i
  192. describe        JAM_MORTGAGE_BD         Body contains mortgage, debt or similar
  193. score           JAM_MORTGAGE_BD         1.6
  194.  
  195. header          JAM_LOAN                Subject =~ /\s.?l.?o.?[a@].?n.?\s/i
  196. describe        JAM_LOAN                Subject contains "loan"
  197. score           JAM_LOAN                1.0
  198.  
  199. body            JAM_LOAN_BD             /\s.?l.?o.?[a@].?n.?\s/i
  200. describe        JAM_LOAN_BD             Subject contains "loan"
  201. score           JAM_LOAN_BD             0.5
  202.  
  203. body            JAM_LOW_RATES           /\blow.{0,20}rate/i
  204. describe        JAM_LOW_RATES           Mail contains "low rate(s)"
  205. score           JAM_LOW_RATES           0.3
  206.  
  207. header          JAM_LOW_PRICES          Subject =~ /\bl[o0]w.{0,20}pr[i1|l!]ce/i
  208. describe        JAM_LOW_PRICES          Header contains hint about low prices
  209. score           JAM_LOW_PRICES          0.4
  210.  
  211. body            JAM_LOW_PRICES_BD       /\blow.{0,20}price/i
  212. describe        JAM_LOW_PRICES_BD       Mail contains hint about low prices
  213. score           JAM_LOW_PRICES_BD       0.2
  214.  
  215. body            JAM_BAD_CREDIT          /(?:b.?a.?d.{0,6}c.?r.?e.?d.?i.?t|F.?i.?n.?a.?n.?c.?i.?a.?l.? .?p.?r.?o.?b.?l.?e.?m)/i
  216. describe        JAM_BAD_CREDIT          Mail contains "bad credit"
  217. score           JAM_BAD_CREDIT          0.3
  218.  
  219. body            JAM_RANDOMWORD          /(?:RNDDOMAINWORD|RND_SYB|RND_WORD)/
  220. describe        JAM_RANDOMWORD          Body contains bulk mailer fault %RNDDOMAINWORD or similar
  221. score           JAM_RANDOMWORD          4.0
  222.  
  223. header          JAM_CHEAP_SOFTWARE      Subject =~ /(?:not expensive|c.?h.?e.?a.?p).{0,20}s.?o.?f.?t.?w.?a.?r.?e/i
  224. describe        JAM_CHEAP_SOFTWARE      Subject line contains "cheap software"
  225. score           JAM_CHEAP_SOFTWARE      0.4
  226.  
  227. body            JAM_CHEAP_SOFTWARE_BD   /(?:not expensive|c.?h.?e.?a.?p).{0,20}s.?o.?f.?t.?w.?a.?r.?e/i
  228. describe        JAM_CHEAP_SOFTWARE_BD   Body contains "cheap software"
  229. score           JAM_CHEAP_SOFTWARE_BD   0.2
  230.  
  231. body            __SOFTWARE_PRODUCT_XP   /W[i1|l]nd[o0]ws?.?(?:X.?P|2000|Server|2003)/i
  232. body            __SOFTWARE_PRODUCT_MSO  /[O0]ff[i1|l]ce.?(?:X.?P|2000|2003)/i
  233. body            __SOFTWARE_PRODUCT_PS   /Ph[o0]t[o0]sh[o0]p/i
  234. body            __SOFTWARE_PRODUCT_PM   /P[a@][gq]em[a@]ker/i
  235. body            __SOFTWARE_PRODUCT_ACR  /[A@]cr[0o]b[a@]t/i
  236. body            __SOFTWARE_PRODUCT_COREL /Core[il1|] Draw/i
  237. body            __SOFTWARE_PRODUCT_NERO /Ahead Nero/i
  238. body            __SOFTWARE_PRODUCT_NAV   /N[0o]rt[o0]n/i
  239.  
  240. meta            SOFTWARE_PRODUCTS_MANY  ((__SOFTWARE_PRODUCT_XP + __SOFTWARE_PRODUCT_MSO + __SOFTWARE_PRODUCT_PS + __SOFTWARE_PRODUCT_ACR + __SOFTWARE_PRODUCT_COREL + __SOFTWARE_PRODUCT_ACR + __SOFTWARE_PRODUCT_NERO + __SOFTWARE_PRODUCT_NAV) >2)
  241. describe        SOFTWARE_PRODUCTS_MANY  Body contains many different software products
  242. score           SOFTWARE_PRODUCTS_MANY  1.2
  243.  
  244. meta            SOFTWARE_MANY_CHEAP     (SOFTWARE_PRODUCTS_MANY && (JAM_CHEAP_SOFTWARE || JAM_CHEAP_SOFTWARE_BD || JAM_LOW_PRICES || JAM_LOW_PRICES_BD))
  245. describe        SOFTWARE_MANY_CHEAP     Body contains many different software products at low prices
  246. score           SOFTWARE_MANY_CHEAP     3.5
  247.  
  248. meta            JAM_SHIPPING_SOFTWARE   ((JAM_CHEAP_SOFTWARE || JAM_CHEAP_SOFTWARE_BD || SOFTWARE_PRODUCTS_MANY) && __JAM_SHIPPING_ALL)
  249. describe        JAM_SHIPPING_SOFTWARE   Mail contains software offers and shipping information
  250. score           JAM_SHIPPING_SOFTWARE   0.8
  251.  
  252. header          JAM_CABLE_DISCRAMBLER   Subject =~ /c.?[a@].?b.?l.?e.{0,12}(?:d.?i.?s.?c.?r.?[a@].?m.?b.?l|f.?[i1|l!].?[l1].?t.?e.?r)/i
  253. describe        JAM_CABLE_DISCRAMBLER   Subject mentions Cable discrambler
  254. score           JAM_CABLE_DISCRAMBLER   2.0
  255.  
  256. body            JAM_CABLE_DISCRAMBLER_BD /c.?[a@].?b.?l.?e.{0,12}(?:d.?i.?s.?c.?r.?[a@].?m.?b.?l|f.?[i1|l!].?[l1].?t.?e.?r)/i
  257. describe        JAM_CABLE_DISCRAMBLER_BD Body mentions Cable discrambler
  258. score           JAM_CABLE_DISCRAMBLER_BD 1.0
  259.  
  260. header          JAM_XXX_MOVIES          Subject =~ /(?:XXX|porn).{0,12}(?:movie|pics|picture)/i
  261. describe        JAM_XXX_MOVIES          Subject mentions XXX movies etc.
  262. score           JAM_XXX_MOVIES          3.0
  263.  
  264. body            JAM_XXX_MOVIES_BD       /(?:XXX|porn).{0,8}(?:movie|pics|picture)/i
  265. describe        JAM_XXX_MOVIES_BD       Body mentions XXX movies etc.
  266. score           JAM_XXX_MOVIES_BD       1.5
  267.  
  268. header          JAM_SAVINGS             Subject =~ /(?:Savings|discount|l[o0]w.{0,12}price)/i
  269. describe        JAM_SAVINGS             Subject line contains word savings
  270. score           JAM_SAVINGS             0.5
  271.  
  272. body            JAM_PAGE_IS_LOADING     /(?:(?:Page|Picture|Image).{0,8}loading|Loading.{0,8}(?:Page|Picture|Image))/i
  273. describe        JAM_PAGE_IS_LOADING     Body indicates that a page from the web is loaded, which is often done by HTML spam mails
  274. score           JAM_PAGE_IS_LOADING     0.5
  275.  
  276. header          JAM_LONG_SUBJECT        Subject =~ /.{120,10000}/
  277. describe        JAM_LONG_SUBJECT        Very long subject, possibly filled up with random words by bulk mailer
  278. score           JAM_LONG_SUBJECT        1.0
  279.  
  280. body            JAM_LONG_DOMAIN_LINK    /http:\/\/[\w.]{35,600}\//
  281. describe        JAM_LONG_DOMAIN_LINK    Very long domain name in link, possibly filled up with random words by bulk mailer
  282. score           JAM_LONG_DOMAIN_LINK    1.0
  283.  
  284. body            JAM_LONG_LINK           /http:[^> \n<"]{100,1000}\s/
  285. describe        JAM_LONG_LINK           Very long link in mail, possibly filled up with random words by bulk mailer
  286. score           JAM_LONG_LINK           0.2
  287.  
  288. header          JAM_PENIS               Subject =~ /(?:p.?e.?n.?[i1|l!].?s|\s.?d.?i.?c.?k.?\s|\s.?c.?o.?c.?k.?\s)/i
  289. describe        JAM_PENIS               Subject contains "penis"
  290. score           JAM_PENIS               2.5
  291.  
  292. body            JAM_PENIS_BD            /(?:\s.?p.?e.?n.?[i1|l!].?s.?\s|\s.?d.?i.?c.?k.?\s|\s.?c.?o.?c.?k.?\s)/i
  293. describe        JAM_PENIS_BD            Body contains "penis"
  294. score           JAM_PENIS_BD            0.8
  295.  
  296. header          __ENLARGEMENT           Subject =~ /(?:e.?n.?l.?a.?r.?g.?e.?m.?e.?n.?t|g.?r.?o.?w.?t.?h|e.?n.?h.?a.?n.?c.?e.?m.?e.?n.?t)/i
  297.  
  298. meta            JAM_PENIS_ENLARGEMENT   (JAM_PENIS && __ENLARGEMENT)
  299. describe        JAM_PENIS_ENLARGEMENT   Subject contains "penis" and "enlargement"
  300. score           JAM_PENIS_ENLARGEMENT   2.5
  301.  
  302. body            JAM_PENIS_ENLARGE_BD    /(?:p.?e.?n.?[i1|l!].?s|e.?n.?l.?a.?r.?g.?e).{0,16}(?:p.?e.?n.?[i1|l!].?s|e.?n.?l.?a.?r.?g.?e.?m.?e.?n.?t|g.?r.?o.?w.?t.?h)/i
  303. describe        JAM_PENIS_ENLARGE_BD    Body contains "penis" and "enlargement"
  304. score           JAM_PENIS_ENLARGE_BD    2.0
  305.  
  306. header          JAM_ERECTION            Subject =~ /e.?r.?e.?c.?t.?[i1|l!].?[o0].?n/i
  307. describe        JAM_ERECTION            Subject contains "erection"
  308. score           JAM_ERECTION            2.0
  309.  
  310. body            JAM_ERECTION_BD         /e.?r.?e.?c.?t.?[i1|l!].?[o0].?n/i
  311. describe        JAM_ERECTION_BD         Body contains "erection"
  312. score           JAM_ERECTION_BD         1.5
  313.  
  314. header          JAM_EJACULATION         Subject =~ /(?:e.?j.?[a@].?c.?u.?[l1].?[a@].?t|[o0].?r.?g.?[a@].?s.?m)/i
  315. describe        JAM_EJACULATION         Subject contains "ejaculation"
  316. score           JAM_EJACULATION         2.0
  317.  
  318. body            JAM_EJACULATION_BD      /(?:e.?j.?[a@].?c.?u.?[l1].?[a@].?t|[o0].?r.?g.?[a@].?s.?m)/i
  319. describe        JAM_EJACULATION_BD      Body contains "ejaculation"
  320. score           JAM_EJACULATION_BD      1.5
  321.  
  322. rawbody         JAM_SMALL_FONT_SIZE     /font[- ]size[^\d]{1,4}(?:[0-1][^\d]|[0-2][^\d]?(?:px|;))/i
  323. describe        JAM_SMALL_FONT_SIZE     Body of mail contains parts with very small font
  324. score           JAM_SMALL_FONT_SIZE     0.5
  325.  
  326. rawbody         JAM_LARGE_FONT_SIZE     /font[- ]size[^\d]{1,4}[3-9][0-9][^\d]/i
  327. describe        JAM_LARGE_FONT_SIZE     Body of mail contains parts with very large font
  328. score           JAM_LARGE_FONT_SIZE     0.5
  329.  
  330. body            JAM_DO_STH_HERE         /(?:O.?r.?d.?e.?r|C.?[l1].?[i1|l!].?c.?k|P.?r.?e.?s.?s|A.?p.?p.?[l1].?[yi]|V.?i.?s.?i.?t|B.?u.?y|C.?h.?e.?c.?k|I.?n.?f.?o).{0,9}\bh.?e.?r.?e/i
  331. describe        JAM_DO_STH_HERE         Body contains Click/Order/Press... Here
  332. score           JAM_DO_STH_HERE         0.3
  333.  
  334. header          JAM_DOLLARS             Subject =~ /(?:d.?o.?l.?l.?a.?r.?|USD|\$)/i
  335. describe        JAM_DOLLARS             Subjects mentions dollar(s)
  336. score           JAM_DOLLARS             0.8
  337.  
  338. header          JAM_EMPTY_SUBJECT       Subject =~ /^.?$/
  339. describe        JAM_EMPTY_SUBJECT       Mail has an empty subject
  340. score           JAM_EMPTY_SUBJECT       0.4
  341.  
  342. rawbody         HTML_EMPTY_LINES        /(\s?<br>\s?){15,999}/i
  343. describe        HTML_EMPTY_LINES        HTML Mail with many empty lines
  344. score           HTML_EMPTY_LINES        1.2
  345.  
  346. header          JAM_INVERZ_ETC          Subject =~ /(?:\bInverz\b|RufIdent\b)/i
  347. describe        JAM_INVERZ_ETC          Spam for offering reverse search for telephone numbers
  348. score           JAM_INVERZ_ETC          1.5
  349.  
  350. body            JAM_INVERZ_ETC_BD       /(?:\bInverz\b|RufIdent\b)/i
  351. describe        JAM_INVERZ_ETC_BD       Spam for offering reverse search for telephone numbers
  352. score           JAM_INVERZ_ETC_BD       0.5
  353.  
  354. header          JAM_UNIVESITY_DEGREE    Subject =~ /U.?n.?i.?v.?e.?r.?s.?i.?t.?y.{1,15}(?:D.?i.?p.?l.?o.?m.?a|d.?e.?g.?r.?e.?e)/i
  355. describe        JAM_UNIVESITY_DEGREE    Mail offers university degress in subject
  356. score           JAM_UNIVESITY_DEGREE    1.5
  357.  
  358. body            JAM_UNIVESITY_DEGREE_BD /U.?n.?i.?v.?e.?r.?s.?i.?t.?y.{1,15}(?:D.?i.?p.?l.?o.?m.?a|d.?e.?g.?r.?e.?e)/i
  359. describe        JAM_UNIVESITY_DEGREE_BD Mail offers university degress in body
  360. score           JAM_UNIVESITY_DEGREE_BD 0.4
  361.  
  362. header          __JAM_BACHELOR          Subject =~ /B.?a.?c.?h.?e.?l.?o.?r/i
  363. header          __JAM_MASTER            Subject =~ /M.?a.?s.?t.?e.?r/i
  364. header          __JAM_MBA               Subject =~ /M.?B.?A/i
  365. header          __JAM_PHD               Subject =~ /P.?H.?D/i
  366. header          __JAM_DIPLOMA           Subject =~ /D.?i.?p.?l.?o.?m.?a/i
  367. header          __JAM_DOCTORATE         Subject =~ /D.?o.?c.?t.?o.?r/i
  368.  
  369. body            __JAM_BACHELOR_BD       /B.?a.?c.?h.?e.?l.?o.?r/i
  370. body            __JAM_MASTER_BD         /M.?a.?s.?t.?e.?r/i
  371. body            __JAM_MBA_BD            /M.?B.?A/i
  372. body            __JAM_PHD_BD            /P.?H.?D/i
  373. body            __JAM_DIPLOMA_BD        /D.?i.?p.?l.?o.?m.?a/i
  374. body            __JAM_DOCTORATE_BD      /D.?o.?c.?t.?o.?r/i
  375.  
  376. meta            JAM_DEGREES_MANY        ((__JAM_BACHELOR + __JAM_MASTER + __JAM_MBA + __JAM_PHD + __JAM_DIPLOMA + __JAM_DOCTORATE) >2)
  377. describe        JAM_DEGREES_MANY        Header contains many different university degrees
  378. score           JAM_DEGREES_MANY        3.0
  379.  
  380. meta            JAM_DEGREES_MANY_BD     ((__JAM_BACHELOR_BD + __JAM_MASTER_BD + __JAM_MBA_BD + __JAM_PHD_BD + __JAM_DIPLOMA_BD + __JAM_DOCTORATE_BD) >3)
  381. describe        JAM_DEGREES_MANY_BD     Body contains many different university degrees
  382. score           JAM_DEGREES_MANY_BD     3.0
  383.  
  384. header        JAM_REPEATED_VOCALS_A       Subject =~ /a{4,15}/i
  385. describe    JAM_REPEATED_VOCALS_A       Header of mail contains repeats the vocal a
  386. score           JAM_REPEATED_VOCALS_A       0.5
  387.  
  388. header        JAM_REPEATED_VOCALS_E       Subject =~ /e{4,15}/i
  389. describe    JAM_REPEATED_VOCALS_E       Header of mail contains repeats the vocal e
  390. score           JAM_REPEATED_VOCALS_E       0.5
  391.  
  392. header        JAM_REPEATED_VOCALS_I       Subject =~ /i{4,15}/i
  393. describe    JAM_REPEATED_VOCALS_I       Header of mail contains repeats the vocal i
  394. score           JAM_REPEATED_VOCALS_I       0.5
  395.  
  396. header        JAM_REPEATED_VOCALS_O       Subject =~ /o{4,15}/i
  397. describe    JAM_REPEATED_VOCALS_O       Header of mail contains repeats the vocal o
  398. score           JAM_REPEATED_VOCALS_O       0.5
  399.  
  400. header        JAM_REPEATED_VOCALS_U       Subject =~ /u{4,15}/i
  401. describe    JAM_REPEATED_VOCALS_U       Header of mail contains repeats the vocal u
  402. score           JAM_REPEATED_VOCALS_U       0.5
  403.  
  404. body         JAM_REPEATED_VOCALS_A_BD    /a{4,15}/i
  405. describe    JAM_REPEATED_VOCALS_A_BD    Body of mail contains repeats the vocal a
  406. score           JAM_REPEATED_VOCALS_A_BD    0.3
  407.  
  408. body         JAM_REPEATED_VOCALS_E_BD    /e{4,15}/i
  409. describe    JAM_REPEATED_VOCALS_E_BD    Body of mail contains repeats the vocal e
  410. score           JAM_REPEATED_VOCALS_E_BD    0.3
  411.  
  412. body         JAM_REPEATED_VOCALS_I_BD    /i{4,15}/i
  413. describe    JAM_REPEATED_VOCALS_I_BD    Body of mail contains repeats the vocal i
  414. score           JAM_REPEATED_VOCALS_I_BD    0.3
  415.  
  416. body         JAM_REPEATED_VOCALS_O_BD    /o{4,15}/i
  417. describe    JAM_REPEATED_VOCALS_O_BD    Body of mail contains repeats the vocal o
  418. score           JAM_REPEATED_VOCALS_O_BD    0.3
  419.  
  420. body         JAM_REPEATED_VOCALS_U_BD    /u{4,15}/i
  421. describe    JAM_REPEATED_VOCALS_U_BD    Body of mail contains repeats the vocal u
  422. score           JAM_REPEATED_VOCALS_U_BD    0.3
  423.  
  424. meta            JAM_REPEATED_VOCALS_MANY_BD ((JAM_REPEATED_VOCALS_A_BD + JAM_REPEATED_VOCALS_E_BD + JAM_REPEATED_VOCALS_I_BD + JAM_REPEATED_VOCALS_O_BD + JAM_REPEATED_VOCALS_U_BD) > 3)
  425. describe        JAM_REPEATED_VOCALS_MANY_BD Body of mail contains many repeated vocals
  426. score           JAM_REPEATED_VOCALS_MANY_BD 1.5
  427.  
  428. header          JAM_REPLACED_O              Subject =~ /\s(?:[a-z]{2,15}0[a-z1.,!?]{2,15}|[a-z]0[a-z1.,!?]{2,15}|[a-z]{3,15}0[a-z1.,!?])\s/i
  429. describe        JAM_REPLACED_O              Header contains the words in which the letter O has beeen replaced by another sign like a zero
  430. score           JAM_REPLACED_O              0.8
  431.  
  432. body            JAM_REPLACED_O_BD           /\s(?:[a-z]{2,15}0[a-z1.,!?]{2,15}|[a-z]0[a-z1.,!?]{3,15}|[a-z]{3,15}0[a-z1.,!?])\s/i
  433. describe        JAM_REPLACED_O_BD           Header contains the words in which the letter O has beeen replaced by another sign like a zero
  434. score           JAM_REPLACED_O_BD           0.3
  435.  
  436. header          JAM_REPLACED_I              Subject =~ /\s(?:[a-z]{2,15}[1|!][a-z0.,!?]{2,15}|[a-z][1|!][a-z0.,!?]{2,15}|[a-z]{3,15}[1|!][a-z0.,!?])\s/i
  437. describe        JAM_REPLACED_I              Header contains the words in which the letter O has beeen replaced by another sign like a zero
  438. score           JAM_REPLACED_I              0.8
  439.  
  440. body            JAM_REPLACED_I_BD           /\s(?:[a-z]{2,15}[1|!][a-z]{2,15}|[a-z][1|!][a-z]{3,15}|[a-z]{3,15}[1|!][a-z])\s/i
  441. describe        JAM_REPLACED_I_BD           Header contains the words in which the letter I has beeen replaced by another sign like a one or exclamation mark
  442. score           JAM_REPLACED_I_BD           0.3
  443.  
  444. meta            JAM_REPLACED_SIGNS_MANY     ((JAM_REPLACED_O + JAM_REPLACED_O_BD + JAM_REPLACED_I + JAM_REPLACED_I_BD ) >= 2)
  445. describe        JAM_REPLACED_SIGNS_MANY     Several signs in the mail have been replaced by numbers
  446. score           JAM_REPLACED_SIGNS_MANY     1.0
  447.  
  448. rawbody         JAM_ENCRYPTED_HTML_STYLE    /style.{0,9}=.{0,9}&\#/i
  449. describe        JAM_ENCRYPTED_HTML_STYLE    HTML mail contains style attribute that is encrypted using HTML entities like p
  450. score           JAM_ENCRYPTED_HTML_STYLE    2.0 
  451.  
  452. rawbody        JAM_HTML_HIDDEN_ELEMS       /(style.{1,5}display.{1,4}none.*?){2}/i
  453. describe        JAM_HTML_HIDDEN_ELEMS       HTML mail contains hidden elements
  454. score           JAM_HTML_HIDDEN_ELEMS       1.0
  455.  
  456. header        JAM_TYPICAL_SPAM_SUBJECT    Subject =~ /(?:MONEY WITH STOCKS|hot stocks|cheap pharmacy)/i
  457. describe    JAM_TYPICAL_SPAM_SUBJECT    Header of mail contains repeats the vocal a
  458. score           JAM_TYPICAL_SPAM_SUBJECT    2.2
  459.  
  460.  
  461. #Re-score some rules
  462. #score        HTML_IMAGE_ONLY_02          3.5
  463. #score        FORGED_IMS_TAG              2.5
  464.