# SARE file
# (03/16/04)
# For notes, updates, licensing, and info see:
# www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm

###############################
#To/Cc rules                  #
###############################
header   	L_T_COMBINED			ToCc =~ /(?:Undisclosed|recipient|Medical |Insurance)/i
describe 	L_T_COMBINED			Addressed to "Undisclosed Recipients" or equivalent
score    	L_T_COMBINED			1.391

header  	RM_tl_ToNone			To =~ /^UNSET$/ [if-unset: UNSET]
describe	RM_tl_ToNone			To header not found
score   	RM_tl_ToNone			.713  # 1415s/58h of 87289 corpus (70035s/17254h)

header  	L_t_NOTO    			To =~ /<>/
describe	L_t_NOTO    			To address is set to empty (RM)
score   	L_t_NOTO    			0.744

###############################
#Reply-To/Retrun-Path rules   #
###############################
header		SALES_REPLIES			Reply-To =~ /(?:advertis|amateur|bargain|cash|credit|deal|direct|discount|funny|inkjet|interacia|interacial|offer|profit|reward|sale|saving|special)/i
describe	SALES_REPLIES			FVGT - reply-to sounds like sales, deals, etc
score		SALES_REPLIES			.617

header 		FVGT_h_REPLY_ASTERISK		Reply-To =~ /<\@>/
describe	FVGT_h_REPLY_ASTERISK		FVGT - reply-to is not valid
score		FVGT_h_REPLY_ASTERISK		3.0

header   	L_hR_NOREPLY    		Return-path =~ /<>/
describe 	L_hR_NOREPLY    		Return path is set to empty (common for bounces) (RM)
score    	L_hR_NOREPLY    		0.002

###############################
#From rules                   #
###############################
header 		COMBINED_FROM  			From =~ /(?:Credit(?:Hunter|worthy|now)|Dating Tips|Email-Gallery|Free Credit Report|FreeOffers|FreebieFix|Long Distance|Shape Solutions|TMobile Authorized Dealer|TheGolfWarehouse|Typing Teacher|Value Center|^Refi(?:_n\ )|^\$|amateur|anything|auto|bargain|bounce|cash|daily|dating|deal|direct|discount|doctor|dr\.|entrepreneur|free|freePriority Shipping|freesample|funpage|guaranteed|health|high.?speed|info|inkjet|interacial|koldny|lottery|mortgage|moshe|new.?car|offer|opportunity|platinum|printer|prize|promo|promotion|propecia|refinance|reply|reward|romance|sale|saving|single|special|suite|sweep|thedailyfreesamples|training|wealth)/is
describe 	COMBINED_FROM  			Evil froms
score 		COMBINED_FROM			0.318

header  	RM_fl_ConsWord6s        	From =~ /\b[bcghjklmnpqrtvwxz]{6,20}\b/
describe	RM_fl_ConsWord6s        	To   contains word consisting of consecutive consonants
score   	RM_fl_ConsWord6s        	1.666  # 460s/1h of 97268 corpus (79437s/17831h) 01/24/04

header  	RM_fl_ConsWord9         	From =~ /\b[bcghjklmnpqrstvwxz]{9,20}\b/
describe	RM_fl_ConsWord9         	From contains word consisting of consecutive consonants
score   	RM_fl_ConsWord9         	1.666  # type=spamp - 137s/0h of 97268 corpus (79437s/17831h) 01/24/04

header 		FVGT_h_FROM_ASTERISK		From =~ /<\*\@.{1,50}\..{1,3}/
describe	FVGT_h_FROM_ASTERISK		FVGT - asterisk for an e-mail address?
score		FVGT_h_FROM_ASTERISK		.716

header		FVGT_h_FROM_NONAME		From =~ /\"\"\ \</
describe	FVGT_h_FROM_NONAME		FVGT - from has no name on purpose
score		FVGT_h_FROM_NONAME		1.666

header    	RM_fw_LeadingPrep       	From =~ /^(?:A|About|All|An|And|Any|As|At(?:tn:?)|Be|Best|Bulk|Cash|Earn|Easy|Fast|Find|For|From|Get|Hi|Home|In|Instant|Is|It|Its|Limited|Lose|Love|Make|Need|New|No|Save|Sex|She|Special|Stock|Stop|Take|Test|There|This|To|Try|Want|We|What|Where|Why|You|Your)[_ ]/i
describe  	RM_fw_LeadingPrep       	From begins with preposition or similar word, a, all, any, free, get
score     	RM_fw_LeadingPrep       	1.630

header  	RM_fw_FromIsPhrase  		From =~ /\w+_\w+_\w+_\w+_/i
describe	RM_fw_FromIsPhrase  		Sender name appears to be phrase rather than name
score   	RM_fw_FromIsPhrase  		0.627

header  	RM_fw_FromIsPhras2  		From =~ /\w+\ +\w+\ +\w+\ +\w+\ /
describe	RM_fw_FromIsPhras2  		Sender name appears to be phrase rather than name
score   	RM_fw_FromIsPhras2  		0.077 

header  	L_f_Noname      		From =~ /""\ \</i
describe	L_f_Noname      		Sender has blanked out name (RM)
score   	L_f_Noname      		1.666

header 		SUPPORT_AT_MICROSOFT     	ALL=~ /From:\ssupport\@microsoft.com/
describe 	SUPPORT_AT_MICROSOFT   		(LOCAL RULE) Mail claims to be an update,probably is SoBig worm.
score 		SUPPORT_AT_MICROSOFT      	2.5

###############################
#Received rules               #
###############################

header   	RM_hr_HeloSender                Received =~ /helo=sender/i
describe 	RM_hr_HeloSender                A received header claims to be from a sender system
score    	RM_hr_HeloSender                0.661

header		WORKSTATION_NAME 		Received =~ /^from \w+ \(\[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\]\)/
describe	WORKSTATION_NAME 		Header includes a server with no FQDN.
score		WORKSTATION_NAME 		0.027

header		WORKSTATION_NAME2		Received =~ /^from \[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\]\n/
describe	WORKSTATION_NAME2		Received is missing a FQDN, IP only.
score		WORKSTATION_NAME2		0.027

header		WORKSTATION_NAME3		Received =~ /^from \(.?\[.?\].?\)\b/
describe	WORKSTATION_NAME3		Contains an empty Recieved IP.
score		WORKSTATION_NAME3		0.027

header		WORKSTATION_NAME4		Received =~ /^from unknown \(\w+ \w+\)\b/
describe	WORKSTATION_NAME4		Received contains an unknown FQDN with possible HELO.
score		WORKSTATION_NAME4		0.027

header		WORKSTATION_NAME5		Received =~ /^from \(HELO \w+\) \[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\] by /
describe	WORKSTATION_NAME5		RCVD has no FQDN and a HELO.
score		WORKSTATION_NAME5		0.027

header		WORKSTATION_NAME6		Received =~ /^from \w+ \((\w+\.)?\w+\.\w+\.\w+ \[\d{1,3}\./
describe	WORKSTATION_NAME6		RCVD has FQDN inside IP parens after a workstation name.
score		WORKSTATION_NAME6		0.027

header		WORKSTATION_NAME7		Received =~ /^from \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} \((\w+\.)?\w+\.\w+\.\w+ \[\d{1,3}\./
describe	WORKSTATION_NAME7		RCVD has IP, then IP inside parens, then IP inside Brackets.
score		WORKSTATION_NAME7		0.027

header 		LC_ESMTP_RCVD      		Received =~ /^from \(?:unknown|\d+\.\d+\.\d+\.\d+\) \(\s+\) by \s+ with esmtp; /
describe 	LC_ESMTP_RCVD    		(LOCAL RULE) Received header contains forged lowercase 'esmtp' relay
score 		LC_ESMTP_RCVD       		0.22

header 		MY_BAD_DOT 			Received =~ /\.(ru|de|be)\b/i
describe 	MY_BAD_DOT 			Country codes that we don't get a lot of Ham from.
score 		MY_BAD_DOT 			.857

header   	L_hr_clkheremail    		Received =~ /clkheremail\.com/
describe 	L_hr_clkheremail    		Spam passed through clkheremail.com relay (RM)
score    	L_hr_clkheremail    		3.1

###############################
#X-Header rules               #
###############################
header 		BAD_X_HEADERS         		ALL =~ /X-(?:[Cc][Ii][Dd]|Camp...|ClientHost|cross|E|E[Mm]ail|Encoding-Version|ENVID|Find|[Ii][Dd]?|Indiv|INFO_.Z|JLH|L-C|Mailid|MailingID|Misc_ID|mailer|mlcipher|mlmsgid|mpm|ms|ntc|PMG-.+|RMD-Text|Rec|SP-Track-ID|srk|TID|Trans|UnityUser:\sUnregistered\sUser|Vig|WCMailID|XaM3-API-Version|yd):/
describe 	BAD_X_HEADERS         		Evil X-Headers
score 		BAD_X_HEADERS         		0.207

header   	RM_hxl_ForgedIndy  		X-Library=~ /Indy 10.00.14-B/
describe 	RM_hxl_ForgedIndy  		Uses version of Indy library which has only been seen in spam
score    	RM_hxl_ForgedIndy  		1.027

header 		BCS_XMAILERBOGUS  		X-Mailer =~ /^[a-z][^A-Z0-9.]*$/
describe 	BCS_XMAILERBOGUS  		X-Mailer has NO uppercase letters, numbers, dots
score 		BCS_XMAILERBOGUS  		1.666

header   	L_hx_PSSBulk    		X-Mailer =~ /PSS\ Bulk\ Mailer/
describe 	L_hx_PSSBulk    		Uses PSS Bulk Mailer (RM)
score    	L_hx_PSSBulk    		0.277


###############################
#Other Headers rules          #
###############################
header 		MY_HEADER_TAG3 			OptinId =~ /./i
describe 	MY_HEADER_TAG3 			Spam header tag found, OptinId:
score 		MY_HEADER_TAG3 			1.0

header 		MY_HEADER_TAG4 			RefId =~ /./i
describe 	MY_HEADER_TAG4 			Spam header tag found, RefId:
score 		MY_HEADER_TAG4 			0.01

header		FVGT_h_ABUSE2			exists:Abuse2-Tracking
describe	FVGT_h_ABUSE2			FVGT - Message hides e-mail using Abuse2-Tracking header
score		FVGT_h_ABUSE2			0.2

###############################
#Content-Type rules           #
###############################
header 		MY_BOUNDARY2			Content-Type =~ /boundary\=('|\")?\~{10,}/
describe 	MY_BOUNDARY2			Too many ~'s in the boundary.
score 		MY_BOUNDARY2			2.5

header 		MY_BOUNDARY4			Content-Type =~ /06986E0E1E1963/
describe 	MY_BOUNDARY4			Known spammer Boundary found
score 		MY_BOUNDARY4			1.038

header 		L_MIME_BOUND_SIMPLE 		Content-Type =~ /boundary==?\".{0,}XXXX-/
describe 	L_MIME_BOUND_SIMPLE 		Spam tool pattern in MIME boundary
score 		L_MIME_BOUND_SIMPLE 		0.44


#Nice rule, but should be somewhere else.
header  	FVGT_s_SINGLE_LETTER 		Subject =~ /\s[dfghjlmnpqstvwzDFGHJLMNPQSTVWZ]{1}\s/
describe 	FVGT_s_SINGLE_LETTER 		FVGT - Single non-vowel seperated by spaces
score  		FVGT_s_SINGLE_LETTER 		0.6