Skip to content

Instantly share code, notes, and snippets.

@fmarier
Created December 19, 2023 05:36
Show Gist options
  • Save fmarier/5e67daffdc7f43c0ed402a3a326d42e4 to your computer and use it in GitHub Desktop.
Save fmarier/5e67daffdc7f43c0ed402a3a326d42e4 to your computer and use it in GitHub Desktop.
Custom SpamAssassin ruleset
body FM_BIKKEMBERGS /\bbikkembergs\b/i
describe FM_BIKKEMBERGS Shoe brand
score FM_BIKKEMBERGS 1.0
body FM_GUCCI /\bgucci\b/i
describe FM_GUCCI Shoe brand
score FM_GUCCI 1.0
body FM_VUITTON /\bvuitton\b/i
describe FM_VUITTON Shoe brand
score FM_VUITTON 1.0
body FM_ADIDAS /\badidas\b/i
describe FM_ADIDAS Shoe brand
score FM_ADIDAS 1.0
body FM_DIOR /\bdior\b/i
describe FM_DIOR Shoe brand
score FM_DIOR 1.0
body FM_CHANEL /\bchanel\b/i
describe FM_CHANEL Shoe brand
score FM_CHANEL 1.0
body FM_BALLY /\bbally\b/i
describe FM_BALLY Shoe brand
score FM_BALLY 1.0
body FM_HERMES /\bhermes\b/i
describe FM_HERMES Shoe brand
score FM_HERMES 1.0
body FM_ARMANI /\barmani\b/i
describe FM_ARMANI Shoe brand
score FM_ARMANI 1.0
body FM_PRADA /\bprada\b/i
describe FM_PRADA Shoe brand
score FM_PRADA 1.0
body FM_VERSACE /\bversace\b/i
describe FM_VERSACE Shoe brand
score FM_VERSACE 1.0
body FM_BURBERRY /\bburberry\b/i
describe FM_BURBERRY Shoe brand
score FM_BURBERRY 1.0
# Shoe brands, but common words as well
body __FM_BOSS /\bboss\b/i
body __FM_COACH /\bcoach\b/i
meta FM_SHOES (FM_BIKKEMBERGS + FM_GUCCI + FM_VUITTON + FM_ADIDAS + FM_DIOR + FM_CHANEL + __FM_BOSS + FM_BALLY + FM_HERMES + __FM_COACH + FM_PRADA + FM_ARMANI + FM_BURBERRY + FM_VERSACE) > 2
describe FM_SHOES Offer for contraband shoes
score FM_SHOES 3.0
body __FM_MINISTER /\bminister\b/i
body __FM_CHURCH /\bchurch\b/i
describe FM_ORDAIN Talks about becoming a minister
body FM_ORDAIN /\bordain\b/i
score FM_ORDAIN 0.6
describe FM_PRIEST Too much talking about church and ministers
meta FM_PRIEST ((__FM_MINISTER + FM_ORDAIN + __FM_CHURCH) > 1)
score FM_PRIEST 3.5
describe FM_EAD Spam acknowledgment
body FM_EAD /This email is a paid eAd sent to/i
score FM_EAD 3.0
describe FM_MEDS Talks about medications
body FM_MEDS /\bmedi?s?\b/i
score FM_MEDS 0.5
describe FM_SUB_SEXUAL Sex-related medecines in the subject
header FM_SUB_SEXUAL Subject =~ /sexual/i
score FM_SUB_SEXUAL 1
describe FM_SUB_SEX Sex promises in subject
header FM_SUB_SEX Subject =~ /\bsex\b/i
score FM_SUB_SEX 0.6
describe FM_SUB_ORGASM Sex promises in subject
header FM_SUB_ORGASM Subject =~ /\borgasm/i
score FM_SUB_ORGASM 2.0
describe FM_SUB_LOSEW There is no secret to losing weight
header FM_SUB_LOSEW Subject =~ /los(e|ing) weight/i
score FM_SUB_LOSEW 3.0
describe FM_SUB_TABLETS Tablets in subject
header FM_SUB_TABLETS Subject =~ /\btablets\b/i
score FM_SUB_TABLETS 0.6
describe FM_SUB_ERECT Erection-boosting drugs in subject
header FM_SUB_ERECT Subject =~ /er+ection/i
score FM_SUB_ERECT 4.0
describe FM_SUB_ACAI Talks about the magic berry
header FM_SUB_ACAI Subject =~ /acai/i
score FM_SUB_ACAI 4.0
describe FM_BOD_ACAI Talks about the magic berry
body FM_BOD_ACAI /\bacai\b/i
score FM_BOD_ACAI 0.5
describe FM_BOD_INTERIA Links to a subdomain of interia.pl
body FM_BOD_INTERIA /\bhttp:\/\/.*\.interia\.pl\b/
score FM_BOD_INTERIA 2.0
describe FM_ERECTION Obfuscated erection
body FM_ERECTION /\ber+ee+ction\b/i
score FM_ERECTION 2.0
describe FM_PHARMACY Talks about pharmacy
body FM_PHARMACY /\bpharmacy\b/i
score FM_PHARMACY 0.1
describe FM_PRESCRIPTION Talks about prescription drugs
body FM_PRESCRIPTION /\bprescriptions?\b/i
score FM_PRESCRIPTION 0.1
body __FM_ANXIETY /\banxiety\b/i
body __FM_CONSULTATION /\bconsultation\b/i
body __FM_DOCTOR /\bdoctor\b/i
body __FM_DISCOUNT /\bdiscount\b/i
body __FM_HEART /\bheart\b/i
body __FM_LOW /\blow\b/i
body __FM_PAIN /\bpain\b/i
body __FM_PRIVACY /\bprivacy\b/i
body __FM_RELIEF /\brelief\b/i
body __FM_SEXUAL /\bsexual\b/i
body __FM_SHIPPING /\bshipping\b/i
body __FM_OVERNIGHT /\bovernight\b/i
body __FM_ORDERING /\bordering\b/i
describe FM_DRUGS Drug peddlers
meta FM_DRUGS ((__FM_CONSULTATION + __FM_DOCTOR + FM_PRESCRIPTION + FM_PHARMACY) > 1) && ((__FM_SHIPPING + __FM_OVERNIGHT + __FM_DISCOUNT + __FM_LOW + __FM_PRIVACY + __FM_ORDERING) > 1) && (FM_MEDS || __FM_ANXIETY || __FM_HEART || __FM_PAIN || __FM_RELIEF || __FM_SEXUAL)
score FM_DRUGS 3.5
describe FM_MORTGAGE Talks about mortgage
body FM_MORTGAGE /\bmortgage\b/i
score FM_MORTGAGE 0.4
describe FM_LOAN Talks about loans
body FM_LOAN /\bloan\b/i
score FM_LOAN 0.5
describe FM_REFINANCE Talks about refinancing
body FM_REFINANCE /\bre[\-_]*financed?\b/i
score FM_REFINANCE 0.6
describe FM_BADCREDIT Obfuscated bad credit
body FM_BADCREDIT /\bbad[\-_]*credit\b/i
score FM_BADCREDIT 0.5
describe FM_BANKRUPTCY Talks about bankruptcy
body FM_BANKRUPTCY /\bbankruptcy\b/i
score FM_BANKRUPTCY 0.4
describe FM_DEBTFREE I don't have any debts
header FM_DEBTFREE Subject =~ /DebtFree\b/
score FM_DEBTFREE 4.0
describe FM_SUB_SWEEPST Fake sweepstakes
header FM_SUB_SWEEPST Subject =~ /\bsweepstakes\b/i
score FM_SUB_SWEEPST 2.0
describe FM_SUB_PROMO Promotions are advertisments
header FM_SUB_PROMO Subject =~ /\bpromo/i
score FM_SUB_PROMO 0.8
describe FM_CASINO Talks about casinos
body FM_CASINO /\bcasino\b/i
score FM_CASINO 0.8
describe FM_LOTTERY Lottery is a hidden tax
body FM_LOTTERY /\bloterry\b/i
score FM_LOTTERY 0.4
body __FM_AWARD /\baward\b/i
body __FM_AWARD /\bballot\b/i
body __FM_DEBT /\bdebt\b/i
body __FM_INTERNET /\binternet\b/i
body __FM_BONUS /\bbonus\b/i
body __FM_DEPOSIT /\bdeposit\b/i
body __FM_PAYMENTS /\bpayments\b/i
body __FM_PROMOTION /\bpromotion/i
body __FM_CONGRATS /\bcongratulations\b/i
body __FM_DRAW /\bdraw/i
body __FM_WINNER /\bwinner\b/i
body __FM_WINNING /\bwinning\b/i
body __FM_PENNY /\bpenny\b/i
body __FM_STOCK /\bstock\b/i
describe FM_PENNYSTOCK Horrible investment opportunities
meta FM_PENNYSTOCK __FM_PENNY && __FM_STOCK
score FM_PENNYSTOCK 1.7
describe FM_FINANCE Not having money sucks
meta FM_FINANCE ((FM_MORTGAGE + (BAD_CREDIT || FM_BADCREDIT) + FM_REFINANCE + __FM_DEBT + FM_BANKRUPTCY + __FM_PAYMENTS) > 2)
score FM_FINANCE 3.0
describe FM_ECASINO Advertises an Internet casino
meta FM_ECASINO (FM_CASINO && ((__FM_INTERNET + BAD_CREDIT + __FM_DEBT + __FM_DEPOSIT + __FM_BONUS) > 1))
score FM_ECASINO 3.0
describe FM_FAKE_WINNER Who isn't a lottery winner these days?
meta FM_FAKE_WINNER FM_LOTTERY && ((__FM_PROMOTION + __FM_CONGRATS + __FM_DRAW + __FM_WINNER + __FM_WINNING + __FM_AWARD + __FM_BALLOT) > 1)
score FM_FAKE_WINNER 3.0
describe FM_FAKE_WIN2 Too many winning words
meta FM_FAKE_WIN2 (__FM_PROMOTION + __FM_CONGRATS + __FM_DRAW + __FM_WINNER + __FM_WINNING + __FM_AWARD + __FM_BALLOT) > 2
score FM_FAKE_WIN2 1.0
describe FM_ROLEX Stolen or fake Rolex
body FM_ROLEX /\brolex\b/i
score FM_ROLEX 3.0
describe FM_SUB_MARINER Watch brand in subject
header FM_SUB_MARINER Subject =~ /\bsubmariner\b/i
score FM_SUB_MARINER 2.0
body __FM_BREGUET /\bbreguet\b/i
body __FM_CHRONOSWISS /\bchronoswiss\b/i
body __FM_EBERHARD /\beberhard\b/i
body __FM_BLANCPAIN /\bblancpain\b/i
body __FM_TUDOR /\btudor\b/i
meta FM_WATCHES (__FM_BREGUET + __FM_CHRONOSWISS + __FM_EBERHARD + __FM_TUDOR + __FM_BLANCPAIN + FM_ROLEX) > 1
describe FM_WATCHES Offer for stolen/fake watches
score FM_WATCHES 3.0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment