# Thanks to Wolfgang Breyha for his help fixing a few rules
+
+#RESCORE - Lowering for FPs
+score HTML_IMAGE_ONLY_08 1.0
+score SUSPICIOUS_RECIPS 2.0
+score FSL_HAS_TINYURL 0.5
+score SCC_BODY_URI_ONLY 1.5
+score SHOPIFY_IMG_NOT_RCVD_SFY 1.0
+score ENA_SUBJ_ONLY_FWD 1.5
+score URI_DOTEDU 0.5
+score ADVANCE_FEE_3_NEW 1.5
+score URI_DOTEDU_ENTITY 0.25
+score TVD_APPROVED 2.5
+score WIKI_IMG 2.25
+
# COURTESY OF Marcin Miros
body __KAM_MM_FOREX_1 /program.{0,10}ktory\ssam\sgra\sna\sgieldzie|program\sdo\sgry\sna\sgieldzie|Potega\stego\sprogramu\stkwi|program.{0,10}handluje.{0,10}zarabia.{0,10}gieldzie.{0,10}udzialu.{0,10}czlowieka|zarabiaj.{0,10}program.{0,10}nie.{0,10}jest.{0,10}zabroniony|Program.{0,10}zrobi.{0,10}wszystko.{0,10}sam|handluj.{0,10}na.{0,10}gieldzie.{0,10}programowi|100.{0,10}%.{0,10}pewnych.{0,10}transakcji|program.{0,10}100.{0,10}%.{0,10}zysk|handel.{0,10}bedzie.{0,10}zabroniony|program.{0,10}odmieni.{0,10}twoje.{0,10}zycie|system.{0,10}finansow.{0,10}przed.{0,10}upadkiem|grupa.{0,10}niemieckich.{0,10}matematykow.{0,10}inteligentny.{0,10}program|zostan\sobrzydliwie\sbogaty|technologia.{0,10}100%.{0,10}pewne.{0,10}decyzje|zarabianie.{0,10}w.{0,10}sieci|swoja.{0,10}szanse.{0,10}zarabianie|internet.{0,10}doprowadzil.{0,10}pieniedzy|zarabia.{0,10}(w|przez).{0,10}internet|karaluch.{0,10}dom.{0,10}brzeg.{0,10}morza|odmieni.{0,10}zycie|pieniadz|pieniedz|zarabia|zarobi/i
body __KAM_REFI2 /(Free Evaluation (?:online|on your (?:current )?home loan)|No hidden costs|no strings attached|good credit or not|personalized consultation|in need of loan|consolidation loan|loan processing|apply by sending|loan of any amount|clean up any inacccuracies|lock in saving|save on monthly mortgage|absolutely no cost|underwater)|Reverse.?Mortgage|qualify for a VA loan|Refi now.? and Save|obama..?announces|rate.calculator|save.thousands|update: \d.\d\d..available|homeowner|over.your.head|rate.service|now.eligi?[bl]{2}e|a.second.mortgage|urgent.loan|loan.offer/is
-body __KAM_REFI3 /(restructure (?:proposal|program|opportunity|your loan)|switch from an adjustable rate to a fixed|new lending program|(low|reasonable) interest (loan|rate)|lowest monthly payment|\d% interest|unsecured personal|better credit terms|lower your mortgage|low-interest refinance|see your credit score|credit score.{1,15}updated|refi with HARP)|obama announce(s|d) (the )?harp program|obama'?s.refi|a.fortune.off|lower.home.rate|your.home|home.loan|gov.program|official.harp|currently.overpaying/is
+body __KAM_REFI3 /(restructure (?:proposal|program|opportunity|your loan)|switch from an adjustable rate to a fixed|new lending program|(low|reasonable) interest (loan|rate)|lowest monthly payment|\d% interest|unsecured personal|better credit terms|lower your mortgage|low\-interest refinance|see your credit score|credit score.{1,15}updated|refi with HARP)|obama announce(s|d) (the )?harp program|obama'?s.refi|a.fortune.off|lower.home.rate|your.home|home.loan|gov.program|official.harp|currently.overpaying/is
body __KAM_REFI4 /(\$\d{1,3},\d{1,3}|\d{2,3}k of funds|\d{4,6} USD|\d{4,6}\$ per month|\d{3,5}\/mo)|refinance at \d\.\d%|\$\d{3,}(\.\d\d)?.(a|per).year|extend.harp|spending.too.much|new.payment|better.rate/i
tflags __KAM_REFI4 nosubject
body __KAM_STOCKTIP137 /Dynamic Response Group|(\b|^)DRGZ(\b|$)/is
body __KAM_STOCKTIP138 /Cobra Oil (and|&) Gas|(\b|^)CGCA(\b|$)/is
body __KAM_STOCKTIP139 /Solanex Management|(\b|^)SLNX(\b|$)/is
-body __KAM_STOCKTIP140 /BIO-SOLUTIONS|(\b|^)BISU(\b|$)/is
+body __KAM_STOCKTIP140 /BIO\-SOLUTIONS|(\b|^)BISU(\b|$)/is
#FP IN French email on 3/2/2017
#body __KAM_STOCKTIP141 /(\b|^)FORC(\b|$)/is
body __KAM_STOCKTIP142 /Hawk Systems Inc|(\b|^)HWSYD(\b|$)/is
body __KAM_STOCKOTC /(OTC|OTC ?BB|OTC Pink Sheets|NASDAQ|NYSE|StockWatch):/is
body __KAM_STOCKSYM /S[ ]?[iy][ ]?m[ ]?[ßb8][ ]?[o0][ ]?[l1]|Siymbol/i
-body __KAM_STOCKSYM2 /(SYM[ ]?[-\:]|\bTicker|Pr+ice\s*\:|Volume\s*\:|Target\s*\:|Current(ly)? ?\??:|Projected:|Smybol:|Stcok\s*\:|Stock\s*\:|S\s*t\s*o\s*c\s*k\s*\:|Trad[ ]?e\:|short-?sell|book value|S\.umbol|Action:|Symb\s?[-:]|Price Today:|SYmN-|Lookup:|RADAR:|PK PAPER:|PINKSHEETS:|f[o0]rward ?l[0o]{2}king)/i
+body __KAM_STOCKSYM2 /(SYM[ ]?[-\:]|\bTicker|Pr+ice\s*\:|Volume\s*\:|Target\s*\:|Current(ly)? ?\??:|Projected:|Smybol:|Stcok\s*\:|Stock\s*\:|S\s*t\s*o\s*c\s*k\s*\:|Trad[ ]?e\:|short\-?sell|book value|S\.umbol|Action:|Symb\s?[-:]|Price Today:|SYmN\-|Lookup:|RADAR:|PK PAPER:|PINKSHEETS:|f[o0]rward ?l[0o]{2}king)/i
body __KAM_STOCKSHR /\b(Shares|Investments|invest|Stock|acquisitions?|broker|joint[ -]?venture|underperforming|(uncap|ventilated|public(ity)?) on friday|dividend opportunities|set your buy|financial safe haven|before the bell)\b/i
body __KAM_STOCKBULL /bull (run|market)|very.rich|high.return/is
body __KAM_STOCKSCTR /(energy sector|mineral rights|mineral wealth|natural resources|gold deposits)/is
-header __KAM_STOCKHEAD Subject =~ /{stk-sub}|on your radar|st0ck|best.stocktip|huge.winner|breaking.news/i
+header __KAM_STOCKHEAD Subject =~ /{stk\-sub}|on your radar|st0ck|best.stocktip|huge.winner|breaking.news/i
body __KAM_STOCKJUMP /(up|jumps) \d\d(\.\d)?\%/i
body __KAM_INSTOCK /in stock/i
header __KAM_TIME1 Subject =~ /(replica(\b|$)|designer[-_ ](watch|piece|collection)|(old|replica|style|luxury|trendy|elegant) watch|time[-_ ](keeper|piece)|wrist|chronometer|watches are in fashion|low budget|deliver your watch|(number|amount) of watches)|excellent.watch/i
#0.50 WEIGHTED TESTS
-body __KAM_TIME2 /(replica(\b|$)|diamond|designer[-_ ](piece|collections|watch)|time[-_ ]piece|wrist|time-keeper|\/\/atch)/is
+body __KAM_TIME2 /(replica(\b|$)|diamond|designer[-_ ](piece|collections|watch)|time[-_ ]piece|wrist|time\-keeper|\/\/atch)/is
header __KAM_TIME3 Subject =~ /(\b|^)(time|watch)(\b|$)/i
body __KAM_TIME4 /(\b|^)(time|watch)(\b|$)/i
body __KAM_TIME5 /(funny|low) price|treat.yourself/i
score GB_YOUTUBE_EMAIL 2.000
# Links to malware
- uri __GB_CUSTOM_HTM_URI0 m;^https?://.{10,128}(?:\.html?|\.php|\/)?(?:\#|\?&e=)%{GB_TO_ADDR};i
+ uri __GB_CUSTOM_HTM_URI0 m;^https?://.{10,128}(?:\.html?|\.php|\/)?(?:\??\#|\?&e=)%{GB_TO_ADDR};i
uri __GB_CUSTOM_HTM_URI1 m|^https?://.{10,64}\=https?://.{4,64}\#%{GB_TO_ADDR}|i
- uri __GB_CUSTOM_HTM_URI2 m;^https?://.{10,256}(?:\/\?)?(?:(?<!blocker)email=|audit\#|wapp\#)%{GB_TO_ADDR};i
+ uri __GB_CUSTOM_HTM_URI2 m;^https?://.{10,256}(?:\/\?)?(?:(?<!blocker)email=|audit\#|wapp\#|qrc=)%{GB_TO_ADDR};i
+ uri __GB_CUSTOM_LOGIN_URI m;^https?://login\..{4,64}/\#%{GB_TO_ADDR};i
uri __GB_ASWTRACK_URI m;^https?://.{10,20}\.awstrack\.me/L\d+/\=https?://.{4,64}\#%{GB_TO_ADDR};i
uri __GB_DRUPAL_URI m|^https?://.{10,64}/default/files/(?:\@)?\#%{GB_TO_ADDR}|i
- meta GB_CUSTOM_HTM_URI ( __GB_CUSTOM_HTM_URI0 || __GB_CUSTOM_HTM_URI1 || __GB_CUSTOM_HTM_URI2 || __GB_DRUPAL_URI || __GB_ASWTRACK_URI )
+ meta GB_CUSTOM_HTM_URI ( __GB_CUSTOM_HTM_URI0 || __GB_CUSTOM_HTM_URI1 || __GB_CUSTOM_HTM_URI2 || __GB_CUSTOM_LOGIN_URI || __GB_DRUPAL_URI || __GB_ASWTRACK_URI )
describe GB_CUSTOM_HTM_URI Custom html uri
score GB_CUSTOM_HTM_URI 1.500
#SEXUALLY EXPLICIT EMAILS - With updates courtesy of Mark Damrose
header __KAM_SEX_EXPLICIT1 Subject =~ /SEXUAL{2,3}Y[-_, ]{0,1}EXPL{1,2}I{1,2}CI{1,2}T/i
#EXPANDED TO INCLUDE HEADERS FOR SPAMS PREVALENT MAR 2007
-header __KAM_SEX_EXPLICIT2 Subject =~ /(?:fuck .*suck|suck .*fuck|pussy .*cock|cock .*pussy|horny amateur|couch sex|slut fuck|naked celebrity|pissing babes|ass[- ]fuck|animal cock|(^|\b)P[^a-zA-Z\d]O[^a-zA-Z\d]R[^a-zA-Z\d]N |exposes sexy ass|drunk babe nude|masturbate|looking.for.sex|breast.implants|pedophile|child predator|explore.being.bad|double.penetration|hardcore.slut|getting.laid|your.disco.stick|having.sex.*begging|f.ckbook|xxx gay|asian porn|blow ?job|anal xxx|huge tits tube|xxx tube|porn tube|porn video|sexy.clip|portal for xxx|3d porn|hard(er)?.erect)|dreaming of f.?cking|(^|\b)sex.in.the.car|horny.virgin|sex.acts|best.intercourse|sex request|dripping wet and need to get|S*?exy granny|shagmate|her squirt|elongation secret|small member|g-spot|XXX life|cart.?bloom.?jigsaw|clogged.?colon|Peppy.?Pet.?ball|derma.?correct|secret to squirting|monstrous cock|adult film star extension secret|inches to your manhood|lack of sex|harrys.?affiliate|numerologist|your prostate|stiffening tonic|need sex partner|manhood bigger/i
+header __KAM_SEX_EXPLICIT2 Subject =~ /(?:fuck .*suck|suck .*fuck|pussy .*cock|cock .*pussy|horny amateur|couch sex|slut fuck|naked celebrity|pissing babes|ass[- ]fuck|animal cock|(^|\b)P[^a-zA-Z\d]O[^a-zA-Z\d]R[^a-zA-Z\d]N |exposes sexy ass|drunk babe nude|masturbate|looking.for.sex|breast.implants|pedophile|child predator|explore.being.bad|double.penetration|hardcore.slut|getting.laid|your.disco.stick|having.sex.*begging|f.ckbook|xxx gay|asian porn|blow ?job|anal xxx|huge tits tube|xxx tube|porn tube|porn video|sexy.clip|portal for xxx|3d porn|hard(er)?.erect)|dreaming of f.?cking|(^|\b)sex.in.the.car|horny.virgin|sex.acts|best.intercourse|sex request|dripping wet and need to get|S*?exy granny|shagmate|her squirt|elongation secret|small member|g\-spot|XXX life|cart.?bloom.?jigsaw|clogged.?colon|Peppy.?Pet.?ball|derma.?correct|secret to squirting|monstrous cock|adult film star extension secret|inches to your manhood|lack of sex|harrys.?affiliate|numerologist|your prostate|stiffening tonic|need sex partner|manhood bigger|TPE sex.?doll/i
#TRYING TO GET RID OF FPs WITH LAST NAMES
header __KAM_SEX_EXPLICIT3 From =~ /(?:better sex|sextrick|ashleymadison|booty.call|breast.(aug|surg|redu)|throbing.member|f[\*u]?ckbook|Local MILFs|fuck(s|ing)?(\b|^)|Dating Granny|school.?of.?squirt)|hookup.?alert|bedroom.?partner|hookup.?online|lovely.?asian|squirting.?school|sex.?portal|sex.?club|liberator.?x2|instahard|eat me with your dick|(live|naughty).?.?sex/i
#MODIFIED TO FIX FP THANKS TO DOC SCHNEIDER AND MARK MARTINEC - REMOVED castrate|sexual.encounter|casual.sex|discreet.encounter 5/19/15
-body __KAM_SEX_EXPLICIT4 /(?:fucked hardcore|dildoes her tight ass|kinky watersports|schoolgirls? slut|teens? porn|first anal(\b|$)|pussy lips|kinky lesbian|sucks? cock|rub puss|spreads? cunt|fetish babe|kinky pee|muffdived \& fuck|deepthroat on knees|hello.naughty.boy|certain.type.of.guy|girlfriend.trick|sexual.stamina|sex...toy|porn.link|cunt.fuck|c-o-c-k|non.stop.sex|porn.industry|stronger.erection|make.her.moan|extreme.pro.abortion|erection.problem|your.erection|get.an.erection|hardest.erection|get.erect|xxx gay|asian porn|blow ?job (comm?unity|porn)|anal xxx|huge tits tube|xxx tube|porn tube|fuckbook|portal for xxx|3d porn|DrPEnterprise|girlfriends.porn|\bsex.galler|pussy.eaten|shemale|(\b|^)anal.adventure|black.girls.video|gay.porn|pussy.wet|make.her.horny|crave sex|women.fuck|women.horny|wanting.to.bang|getting.laid.is.simple|woman.on.her.knees|b r e a s t|generic.ed.product|best.sex|f[^a-z]cking.you|f[^a-z]ckbuddy|F\#ckFriends|Milf Selfies|need.a.horny.man|cute.sex.lover|horny.as.f.ck|fun.in.the.bedroom|my.tits.are|be.horny|horny.girl|horny.i.am|horny.latina|huge.dildo|made.me.climax|sex in my office|a.good.f\@ck|married.horny.woman|sucked.your.d\@ck|(naughty|horny).milf|suck.you.off|horny.stories|all.my.h[o0]les|cum.heavily|sucking.your.c[o0]ck|to.get.f[^a-z]cked)|h00kup|s\*xy|\bh0rny|ch0ked|pu\$\$y|f\*cked|F\*ck_|find milfs|girls (from|in) your city|rock.?hard boner|reclaiming your manhood|sexy and horny|bad girls from your city|awesome in bed|turbo\-charge your bed|shocking erection|stiffening tonic|anal fun|fingering videos|willing to pay for sex/i
+body __KAM_SEX_EXPLICIT4 /(?:fucked hardcore|dildoes her tight ass|kinky watersports|schoolgirls? slut|teens? porn|first anal(\b|$)|pussy lips|kinky lesbian|sucks? cock|rub puss|spreads? cunt|fetish babe|kinky pee|muffdived \& fuck|deepthroat on knees|hello.naughty.boy|certain.type.of.guy|girlfriend.trick|sexual.stamina|sex...toy|porn.link|cunt.fuck|c\-o\-c\-k|non.stop.sex|porn.industry|stronger.erection|make.her.moan|extreme.pro.abortion|erection.problem|your.erection|get.an.erection|hardest.erection|get.erect|xxx gay|asian porn|blow ?job (comm?unity|porn)|anal xxx|huge tits tube|xxx tube|porn tube|fuckbook|portal for xxx|3d porn|DrPEnterprise|girlfriends.porn|\bsex.galler|pussy.eaten|shemale|(\b|^)anal.adventure|black.girls.video|gay.porn|pussy.wet|make.her.horny|crave sex|women.fuck|women.horny|wanting.to.bang|getting.laid.is.simple|woman.on.her.knees|b r e a s t|generic.ed.product|best.sex|f[^a-z]cking.you|f[^a-z]ckbuddy|F\#ckFriends|Milf Selfies|need.a.horny.man|cute.sex.lover|horny.as.f.ck|fun.in.the.bedroom|my.tits.are|be.horny|horny.girl|horny.i.am|horny.latina|huge.dildo|made.me.climax|sex in my office|a.good.f\@ck|married.horny.woman|sucked.your.d\@ck|(naughty|horny).milf|suck.you.off|horny.stories|all.my.h[o0]les|cum.heavily|sucking.your.c[o0]ck|to.get.f[^a-z]cked)|h00kup|s\*xy|\bh0rny|ch0ked|pu\$\$y|f\*cked|F\*ck_|find milfs|girls (from|in) your city|rock.?hard boner|reclaiming your manhood|sexy and horny|bad girls from your city|awesome in bed|turbo\-charge your bed|shocking erection|stiffening tonic|anal fun|fingering videos|willing to pay for sex/i
#remove f\#ck for FPs
tflags __KAM_SEX_EXPLICIT4 nosubject
score KAM_TELEWORK 3.0
#SOME TLD ARE BAD
-header __KAM_SOMETLD_ARE_BAD_TLD_FROM From:addr =~ /\.(bar|beauty|buzz|cam|casa|cfd|club|date|guru|link|live|monster|online|press|pw|quest|rest|sbs|shop|stream|top|trade|wiki|workxyz)$/i
+header __KAM_SOMETLD_ARE_BAD_TLD_FROM From:addr =~ /\.(bar|beauty|buzz|cam|casa|cfd|club|date|guru|link|live|monster|online|press|pw|quest|rest|sbs|shop|stream|top|trade|wiki|work|xyz)$/i
uri __KAM_SOMETLD_ARE_BAD_TLD_URI /:\/{2}([a-z0-9-\.]+)\.(bar|beauty|buzz|cam|casa|cfd|club|date|guru|link|live|monster|online|press|pw|quest|rest|sbs|shop|stream|top|trade|wiki|work|xyz)($|\/|\:)/i
#FPs
-uri __KAM_SOMETLD_ARE_BAD_TLD_URI_NEGATIVE /(^|\b)(input|td|lev)\.date|de[b|l]\.date|div\.top($|\/)|\/smart\.link|\.emailprotection\.link\/|\.goat\.com\/|\/square\.link\//i
+uri __KAM_SOMETLD_ARE_BAD_TLD_URI_NEGATIVE /(^|\b)(input|td|lev)\.date|de[b|l]\.date|div\.top($|\/)|enable\.work|\/smart\.link|\.emailprotection\.link\/|\.goat\.com\/|\/square\.link\//i
body __KAM_SOMETLD_ARE_BAD_TLD_PROGRAM_REF /\.date ?\{/i
meta KAM_SOMETLD_ARE_BAD_TLD (__KAM_SOMETLD_ARE_BAD_TLD_FROM) || (__KAM_SOMETLD_ARE_BAD_TLD_URI && !(__KAM_SOMETLD_ARE_BAD_TLD_PROGRAM_REF + __KAM_SOMETLD_ARE_BAD_TLD_URI_NEGATIVE >= 1))
score KAM_RPTR_MISSING 6.0 #Lowered to 6.0 temporarily
#DWDTECHSPAM /ETC
- header KAM_RPTR_BADHOST X-Raptor-Reverse =~ /dwdtechllc.com|inculloop.net|donapex.net|wriltay.com|raptornode.com|voicitr.us|premiumjobhunt.com|newsocialdeals.com|dailysummercoupons.com|nm-priorityhosting.com|hypernia.com|queryfoundry.net|colocrossing.com|pawlitenews.com|hosted-by-i3d.net/i
+ header KAM_RPTR_BADHOST X-Raptor-Reverse =~ /dwdtechllc.com|inculloop.net|donapex.net|wriltay.com|raptornode.com|voicitr.us|premiumjobhunt.com|newsocialdeals.com|dailysummercoupons.com|nm\-priorityhosting.com|hypernia.com|queryfoundry.net|colocrossing.com|pawlitenews.com|hosted\-by\-i3d.net/i
describe KAM_RPTR_BADHOST Very Spammy Hosting Company Identified
score KAM_RPTR_BADHOST 9.0
score FREEMAIL_REPLYTO 1.0
score KHOP_BIG_TO_CC 1.5
score URIBL_DBL_SPAM 5.0
- score AC_HTML_NONSENSE_TAGS 4.0
+ score AC_HTML_NONSENSE_TAGS 3.25
#ENABLING DNSWL - BUG 6668
score KAM_COMBOJDR 5.0
#LOTTO CRUD
-body __KAM_LOTTO1 /((you |e-?mail )(?:address,? )?(has |have )?(emerged as one of (the|our) winning|emerged as a category "A" Winner|came out as the winning coupon|emerged a winner|has won|(?:was |is )?attached( to)?\s+(winning number|serial|ticket|reference)|was one of the ten winners|has been selected as one of the lucky)|random selection in our computerized email selection system|procuring your prize|email id identified with coupon|e-mail addresses are picked randomly|send your winning identification|final recipients? of a cash|selected as the one of the beneficiaries|receiving your donation|facebook name was selected)/is
+body __KAM_LOTTO1 /((you |e\-?mail )(?:address,? )?(has |have )?(emerged as one of (the|our) winning|emerged as a category "A" Winner|came out as the winning coupon|emerged a winner|has won|(?:was |is )?attached( to)?\s+(winning number|serial|ticket|reference)|was one of the ten winners|has been selected as one of the lucky)|random selection in our computerized email selection system|procuring your prize|email id identified with coupon|e\-mail addresses are picked randomly|send your winning identification|final recipients? of a cash|selected as the one of the beneficiaries|receiving your donation|facebook name was selected)/is
body __KAM_LOTTO2 /((ticket|serial|lucky) number|secret pin ?code|pin number|batch number|reference number|promotion date|lottery|sweepstake|\d+ lucky recipients|for claim and inquiring)|Micros(oft)? ID/is
body __KAM_LOTTO4 /(claims (office|agent|manager|requirement)|lottery coordinator|(certificate|fiduciary) (officer|agent|claims)|accredited agent|payment agency board|promotion manager|promotions? department|Name of +Agent:|executive secretary|claims & Management|lottery approved courier|promo.team)/is
-body __KAM_LOTTO5 /(POWERBALL-?LOTTO|freelotto group|(microsoft|Royal Heritage) (promotion|Lottery)|(British|UK) National( Online)? Lottery|U\.?K\.? Grand Promotions|Lottery Department UK|Euromillion Loteria|Luckyday International Lottery|International Lottery|Euro - Afro Asian Sweepstake|urawinner|Free Lotto Sweepstakes|PROMOTION DEPARTMENT|PROMOTION\/PRIZE AWARD|Nederlandse Internationale Loterij|EURO MILLIONS|APPLE LOTTERY ONLINE|MSW MEGA JACKPOT|MICROSOFT EMAIL PROMO|MSNlottery|ECOWAS|Nigeria|National Lottery|claim.{1,10}your.gbp|won.you.{1,10}gbp)|cola lotto online|on-?line promotion/is
+body __KAM_LOTTO5 /(POWERBALL\-?LOTTO|freelotto group|(microsoft|Royal Heritage) (promotion|Lottery)|(British|UK) National( Online)? Lottery|U\.?K\.? Grand Promotions|Lottery Department UK|Euromillion Loteria|Luckyday International Lottery|International Lottery|Euro \- Afro Asian Sweepstake|urawinner|Free Lotto Sweepstakes|PROMOTION DEPARTMENT|PROMOTION\/PRIZE AWARD|Nederlandse Internationale Loterij|EURO MILLIONS|APPLE LOTTERY ONLINE|MSW MEGA JACKPOT|MICROSOFT EMAIL PROMO|MSNlottery|ECOWAS|Nigeria|National Lottery|claim.{1,10}your.gbp|won.you.{1,10}gbp)|cola lotto online|on\-?line promotion/is
-body __KAM_LOTTO6 /(Dear (Award|Consultation Prize|Lucky) Winner|Winning Notification|Attention:Winner|Dear:? Winner|Amount won:|Sincere Congratulations|Lucky Numbers:|you are a winner|prize attached|prize notification|claims requirement|winning number|winning sum|payout of|qualification number)|attached.file|numbers.on.email|active email address|dear e-?mail/is
+body __KAM_LOTTO6 /(Dear (Award|Consultation Prize|Lucky) Winner|Winning Notification|Attention:Winner|Dear:? Winner|Amount won:|Sincere Congratulations|Lucky Numbers:|you are a winner|prize attached|prize notification|claims requirement|winning number|winning sum|payout of|qualification number)|attached.file|numbers.on.email|active email address|dear e\-?mail/is
header __KAM_LOTTO7 Subject =~ /(Your Lucky Day|Final Notice|CONGRATULATION|(Attention:|ONLINE) WINNER|Winning Notification|Claim Fund|YOU HAVE WON|Online Notification|Your Winning Amount|PROMOTIONS MANAGER|Winnin?g Alert|NOTICE FOR YOUR CLAIM|WINNER|Reference Number|payment of (prize|claim))/i
describe KAM_ADVERT2 This is probably an unwanted commercial email...
score KAM_ADVERT2 0.75
+body KAM_ADVERT4 /This is an ad/i
+describe KAM_ADVERT4 This is probably an unwanted commercial email...
+score KAM_ADVERT4 0.75
+
#ONE LINE ADVERTISEMENTS
body __KAM_1LINE1 /(free score and report|Did you overpay\?)/is
header __KAM_1LINE2 Subject =~ /(free online score & report|I need tax savings? tip)/i
score KAM_1LINE 2.5
#CAN SPAM
-body KAM_CANSPAM /(full compliance with the U.S. Federal-?Can-?Spam-Act|provides CAN-SPAM compliant email|consistent with the provisions of the CAN-SPAM Act|compliance with the CanSpam Act|no deceptive subject lines|compliant with all legal provisions of the CAN-SPAM Act)/is
+body KAM_CANSPAM /(full compliance with the U.S. Federal\-?Can\-?Spam\-Act|provides CAN\-SPAM compliant email|consistent with the provisions of the CAN\-SPAM Act|compliance with the CanSpam Act|no deceptive subject lines|compliant with all legal provisions of the CAN\-SPAM Act)/is
describe KAM_CANSPAM SPAM = Lack of Consent (not a Legal Definition)
score KAM_CANSPAM 1.0
#GIFTS / GIFT CARDS
-body __KAM_GIFT1 /(Claim your free \$500 Target Gift Card|complimentary gift-?card|received a Victoria's Secret Giftcard|\$500 airline gift card|\$1000 gift card for you to shop|\$\d+.{0,50}gift card|Secret gift card)|costco.coupon|facebook.gift|claim.my.credit/is
+body __KAM_GIFT1 /(Claim your free \$500 Target Gift Card|complimentary gift\-?card|received a Victoria's Secret Giftcard|\$500 airline gift card|\$1000 gift card for you to shop|\$\d+.{0,50}gift card|Secret gift card)|costco.coupon|facebook.gift|claim.my.credit/is
body __KAM_GIFT2 /(unsubscribe from this advertiseme(tn|nt)|exit future communications|to unsubscribe from this|to stop any offers from us)/is
body __KAM_GIFT3 /every girl loves to buy|do you need a new|offer pass you by|shopping.online|best.price|activate.my|valued.{0,20}user|extra.deals|sign.up.today/i
body __KAM_GIFT4 /card will be yours free|card on us|buy you the dyson animal|amazon.gift.?card|superstore|starbucks.card|card.egift|redeem.before|offering.you.this|enter.promo.code/i
score KAM_FAST 1.8
#BIZ CARDS FREE!
-body __KAM_BIZ1 /You always need new cards|free full color business cards|get 250 more ?- ?free|business card offer|500 business cards/is
+body __KAM_BIZ1 /You always need new cards|free full color business cards|get 250 more ?\- ?free|business card offer|500 business cards/is
header __KAM_BIZ2 Subject =~ /(do not pay for|Stop paying for|free) business cards|get( your)? 250 Free|BOGO|500 cards for|all for \$1\.99/i
header __KAM_BIZ3 From =~ /Free Business Cards|Custom Printing|Premium Cards/i
#WEIGHT LOSS
body __KAM_WEIGHT1 /(overweight|extra weight|glutting|shed fat|burns fat|burn calories|appetite suppressant|stimulate your metabolism|unwanted weight|duet of the year|healthy energy boost|Suppresses Appetite|internal cleansing|detoxify|cellulite|unsightly bulges|fat burn|Diet of the year|acai|cuts cholesterol|cleanse excess waste|free sample|unwanted weight|Acai suppl[ie]ments|Diet\/Detox|\#1 Weight Loss|lose body fat|(lose|drop) (about )?\d+\s*[li]b|calorie burning machine|before eating carbs)|flush.fat.away|slimming.down|\d+.pounds.gone|lose.\dx|highest.rated.episode|unwanted..?gain|too.goo?d.to.be.true|get.slim|tv.segment|weird.solution/is
-body __KAM_WEIGHT2 /(\d pounds|lose[_ ]weight|suppress appetite|appetite out of control|Oprah|for cancer patients|colon cure|colon cleanse|colonmate|avai berry|acai burn|ultraslim|feel energized|excess[_ ]weight|no diet changes|no exercise|hollywood'?s hottest -?diet|acai berry edge|Acai Diet|top secret diet|Power HCG|Sensa|shocking method|Jennifer Aniston|before eating carbs|all natural weight.?loss|green fruit|top celeb's diet)|one.secret|enjoying.food|f-a-t|melt.fat|squeeze into them|crazy.workout|celebs.everywhere|zero.effort|nothing.to.lose/is
-header __KAM_WEIGHT3 Subject =~ /(leaner|slimmer|stop gaining weight|fat loss|weight management|now available without a script|wuYi tea|(drop|lost|shed|knocked) \d+.?(pounds|[li]bs?)|FRS Healthy Energy|instant diet|colonmate|trimmer you|body cleanse|acai berry|acai burn|Fatburner|cholesterol reduction|cholestapro|Ephedra|W[EA]IGHT[- ]LOSS PRODUCT OF THE YEAR|t-r-i-a-l|try our trial|cleanse your system|no exc?ercise|Acai Advanced|toxic sludge|cleanse your body|Acai Diet|Acai Elite|Acai Super|losing weight fast|weight loss|detox product|Power HCG|Weight Loss System|shocking (?:weight|weihgt) loss)|before eating carbs|all natural weight.?loss|eat this fruit|Jennifer An+iston's secret|drop.\d.dress.sizes|fat.burning|burn..?fat|get.slim|drop.the.weight|(drop|shed).[li]bs?|move.\.*.?the scale|step.by.step|drop..?pounds|perfect.body|lose.the.weight|half.my.size|special.nutrition|workout|skinny|simple.way|to.get.slim|workout.for.the..?lazy|start.losing.weight|melt.fat|celebs.boycott|celebs.did|overeating|without.any.effort|doctors.tv|oprah|results.are.in|as.seen.on|slim.?spray|zero.effort/i
+body __KAM_WEIGHT2 /(\d pounds|lose[_ ]weight|suppress appetite|appetite out of control|Oprah|for cancer patients|colon cure|colon cleanse|colonmate|avai berry|acai burn|ultraslim|feel energized|excess[_ ]weight|no diet changes|no exercise|hollywood'?s hottest \-?diet|acai berry edge|Acai Diet|top secret diet|Power HCG|Sensa|shocking method|Jennifer Aniston|before eating carbs|all natural weight.?loss|green fruit|top celeb's diet)|one.secret|enjoying.food|f\-a\-t|melt.fat|squeeze into them|crazy.workout|celebs.everywhere|zero.effort|nothing.to.lose/is
+header __KAM_WEIGHT3 Subject =~ /(leaner|slimmer|stop gaining weight|fat loss|weight management|now available without a script|wuYi tea|(drop|lost|shed|knocked) \d+.?(pounds|[li]bs?)|FRS Healthy Energy|instant diet|colonmate|trimmer you|body cleanse|acai berry|acai burn|Fatburner|cholesterol reduction|cholestapro|Ephedra|W[EA]IGHT[- ]LOSS PRODUCT OF THE YEAR|t\-r\-i\-a\-l|try our trial|cleanse your system|no exc?ercise|Acai Advanced|toxic sludge|cleanse your body|Acai Diet|Acai Elite|Acai Super|losing weight fast|weight loss|detox product|Power HCG|Weight Loss System|shocking (?:weight|weihgt) loss)|before eating carbs|all natural weight.?loss|eat this fruit|Jennifer An+iston's secret|drop.\d.dress.sizes|fat.burning|burn..?fat|get.slim|drop.the.weight|(drop|shed).[li]bs?|move.\.*.?the scale|step.by.step|drop..?pounds|perfect.body|lose.the.weight|half.my.size|special.nutrition|workout|skinny|simple.way|to.get.slim|workout.for.the..?lazy|start.losing.weight|melt.fat|celebs.boycott|celebs.did|overeating|without.any.effort|doctors.tv|oprah|results.are.in|as.seen.on|slim.?spray|zero.effort/i
#rawbody __KAM_WEIGHT4 /shocking method|Jennifer Aniston|nationally known|never.seen.anything.like.this|unusual.(new.)?tip|your.metabolism|need.a.boost|this.is.not.a."?(joke|hoax|fad|trend)|no working out|no starving|a trimmer you|celebrity.doctor|seen.on.(cnn|abc|cbs)|\d+%.?off|oprah.and.celeb|beer.belly|thunder.thigh|flush.fat.fast|get.skinny|Women's Health|dress.size|feel.good|physical.activity|starving|hit.a.plateau|flat.belly|brakes on your appetite/i
-header __KAM_WEIGHT5 From =~ /celeb.weightloss|no.work.workout|(drop|shed).pounds|(drop|shed).\d+[il]bs?|inches off|your.waist|nutrisystem|fat.burn|magic.slim|slim.pack|get.?slim|overweight|becomingslim|slimmer|skinny.tee|flush.fat|slimming.down|hot.trend|curves.?\dweek|stubborn.fat|\d+.pounds|look.great|lazy.workout|bikini|fit.community|slim.?spray|shave.off.(the.)?(pound|lb)|f-a-t|fit.in.\d+.day|days.to.slim|oprah|belly|biggestloser/i
+header __KAM_WEIGHT5 From =~ /celeb.weightloss|no.work.workout|(drop|shed).pounds|(drop|shed).\d+[il]bs?|inches off|your.waist|nutrisystem|fat.burn|magic.slim|slim.pack|get.?slim|overweight|becomingslim|slimmer|skinny.tee|flush.fat|slimming.down|hot.trend|curves.?\dweek|stubborn.fat|\d+.pounds|look.great|lazy.workout|bikini|fit.community|slim.?spray|shave.off.(the.)?(pound|lb)|f\-a\-t|fit.in.\d+.day|days.to.slim|oprah|belly|biggestloser/i
#ANATRIM / GREEN TEA / CORTITHERM / ETC
-body __KAM_ANA1 /(anatrim|Green ?Tea|cortitherm|PHENTERTHIN|Phentremine|Acai Ultra|Civ-xR|WuYi Tea|Wu-?Yi Source|FRS Healthy Energy|Acai Berry|Chinese secret|Ephedra|Cholestapro|ColonMedic|Pure Cleanse|AcaiBurn|Acai Elite|Garcinia|Chlorogenic Acid|green coffee)/i
+body __KAM_ANA1 /(anatrim|Green ?Tea|cortitherm|PHENTERTHIN|Phentremine|Acai Ultra|Civ\-xR|WuYi Tea|Wu\-?Yi Source|FRS Healthy Energy|Acai Berry|Chinese secret|Ephedra|Cholestapro|ColonMedic|Pure Cleanse|AcaiBurn|Acai Elite|Garcinia|Chlorogenic Acid|green coffee)/i
header __KAM_ANA2 From =~ /green ?tea|Ultra ?Energy|weight ?loss|colon? ?clean|colon ?aid|acai|As seen on|Garcinia|sensa/i
meta KAM_ANA (__KAM_ANA1 + __KAM_ANA2 + (__KAM_OZ1 || __KAM_OZ2 || __KAM_OZ3) + __KAM_WEIGHT1 + __KAM_WEIGHT2 + __KAM_WEIGHT3 + __KAM_WEIGHT5 + KAM_FDA + (__KAM_HTML1 || KAM_INFOUSMEBIZ) >= 3)
score KAM_REPLACE 2.0
#EVEN MORE NIGERIAN SCAMS AND VARIANTS
-body __KAM_NIGERIAN1 /(?:payment officer|personal treasurer|experienced marketers|Chairman of the Finance Committee|contact my secretary|field of Financial Services|Head of Human Resources|Public Relation Officer|field of Business Services|payment agent|representing partner|vacancy in my company|representative\/book ?keeper|executor|search and selection of both experienced|retired chief economist|foreign partner|diplomatic courier|senior auditor|online book-?keeper)|in.your.country|united.state[^s]|states?.citizen|retired.ceo|nigeria|origin.finland|serious.illness|brain.(tumor|cancer)|former.minister|investment.partner|got.mugged|losing.my.(wife|only.son)/is
+body __KAM_NIGERIAN1 /(?:payment officer|personal treasurer|experienced marketers|Chairman of the Finance Committee|contact my secretary|field of Financial Services|Head of Human Resources|Public Relation Officer|field of Business Services|payment agent|representing partner|vacancy in my company|representative\/book ?keeper|executor|search and selection of both experienced|retired chief economist|foreign partner|diplomatic courier|senior auditor|online book\-?keeper)|in.your.country|united.state[^s]|states?.citizen|retired.ceo|nigeria|origin.finland|serious.illness|brain.(tumor|cancer)|former.minister|investment.partner|got.mugged|losing.my.(wife|only.son)/is
body __KAM_NIGERIAN2 /(?:looking for dynamic representative|seek your partnership|new online business model|seek to transfer this money|completely legal activity|never ask you to pay or invest|in search of trustworthy representatives|establishing a new liaison network|rec[ei]{2}ving payment on our behalf|assist me in transferring those funds|make money at home|requiring rep to work on a part time|part time job\/full time|organization for the good work of the lord|job search directory|investor willing to invest in lebanon|invest in Real Estate|Your kind assistance|next of kin|gold.exportation|calgary.lotto)|oil.producing|import.firm|oil.and.gas|petroleum|asset.available|urgent.reply|(cash|credit.cards?|cell(.phone)?).(were|was).stolen/is
-body __KAM_NIGERIAN3 /(?:\d{1,2}\% (?:commission on each transaction|of the total will be set|will be mapped out|is made available to you|of the total sum for your partner|of the money for your effort|for\s+sales)|pay for performance|floating deficit|for your compensation|financial independence|their financial dreams|work from home part\s*-?\s*time|employing your services|get extra income|deduct your weekly salary \d\d%|transfer of the funds|make successful career at us|you will get \d{1,2}% on each|funds can be directed to your account as a grant|reasonable parentage|dormant domiciliary account|share would be \d+\%|pay you \d+%)|invest|have.a.sum|make.a.donation|immense.benefits|transact.a?.?business|company.sponsor|loan me \$/is
+body __KAM_NIGERIAN3 /(?:\d{1,2}\% (?:commission on each transaction|of the total will be set|will be mapped out|is made available to you|of the total sum for your partner|of the money for your effort|for\s+sales)|pay for performance|floating deficit|for your compensation|financial independence|their financial dreams|work from home part\s*\-?\s*time|employing your services|get extra income|deduct your weekly salary \d\d%|transfer of the funds|make successful career at us|you will get \d{1,2}% on each|funds can be directed to your account as a grant|reasonable parentage|dormant domiciliary account|share would be \d+\%|pay you \d+%)|invest|have.a.sum|make.a.donation|immense.benefits|transact.a?.?business|company.sponsor|loan me \$/is
body __KAM_NIGERIAN4 /(?:American oil merchant|independent contractor|removallink|claim the funds|international corporation|bank draft|becoming our contract staff|contractual employment|customers\s*in Europe,\s*America|new partner from UK|great investment site|money orders|cashiers check|access to the funds|piloting the business|moving the funds|next of kin|syrian.refugees|reply.for.detail)|security.reason|(his|her).account|new.investor|directly.beneficial|business.discussion|promise.to|need.to.spend/is
body __KAM_NIGERIAN5 /Western Union Money Transfer|Money Gram|form of Money Orders|to apply for this job, please send the following|process our payments|not traceable|risk free transation|transfer to a designated bank account|inheritance return|my.inheritance|my.wealth|donation.to.you|out.of.country|charitable.trust/i
#SEXUALLY EXPLICIT RULES ROUND TWO - Fixed some FPs from Scunthorpe thanks to Stefan Morrell
body __KAM_SEX1 /(?:double[ -]?headed|pornstar|huge weenie|male power|\d\dper\. of men|male enhancement product|enlarge patch|boost up your virility|clinically tested|improve manhood|Bigger Pen..is|Big Penis|incredible gains to your manhood|muscular manhood|nights unsatisfied|climaxes|sensual enhancer|love instrument|bigger member|excitement with girls|fucker|animal sex)|adds \d inches to your manhood|pussy licked|hard.erection/i
-body __KAM_SEX2 /(?:(\b|^)cunt(\b|$)|busty|interracial|hardcore|peni(s|le) enlarge|generic quality|enlarge your manhood|stone-hard manhood|XXL Dick|intense pleasure|spend a night with you|efficient medicine|turn on your wife|with your boner|dick dangl)|\d.(extra.)?inches.of.girth|best.sex/i
-header __KAM_SEX3 Subject =~ /(double dildo|bunsfuck|dominatrix|huge tits|anti-ED|most confident man|for men over 30|peni(s|le) enlargement|interracial gobble|bitch sucking dong|product actually does work|update your penis|mans mall|endurerx|more excitement|love package|add more fire|her best male|average guys|monster cocks|first anal|anal fucking|love with monsters|horse sex|be the stud)|have an affair/i
+body __KAM_SEX2 /(?:(\b|^)cunt(\b|$)|busty|interracial|hardcore|peni(s|le) enlarge|generic quality|enlarge your manhood|stone\-hard manhood|XXL Dick|intense pleasure|spend a night with you|efficient medicine|turn on your wife|with your boner|dick dangl)|\d.(extra.)?inches.of.girth|best.sex/i
+header __KAM_SEX3 Subject =~ /(double dildo|bunsfuck|dominatrix|huge tits|anti\-ED|most confident man|for men over 30|peni(s|le) enlargement|interracial gobble|bitch sucking dong|product actually does work|update your penis|mans mall|endurerx|more excitement|love package|add more fire|her best male|average guys|monster cocks|first anal|anal fucking|love with monsters|horse sex|be the stud)|have an affair/i
body __KAM_SEX4 /(?:bring your girlfriend back|satisfied with their size|penis so huge and heavy|more semen|volume of your loads|wondercum|ejaculate|bargain offers on medic|improve xxx|improve your lovemaking|youngest teen|teen pics|monster in his pants|(female|multiple) orgasms|extreme penetration)/i
describe KAM_SEX Sexually Explicit SPAM / Penis Enlargement Scam
body __KAM_LIST1 /((Hospital|MD) directory|Nursing Home (List|directory)|doctor lists|marketing lists|Licensed Physicians|practicing MDs|practicing Medical doctors|Physicians in America|emails for every state|(vip|laywers|planners|Business Email|HR Directors Email|Sales & Marketing Directors|Managing Director Email) database)/is
body __KAM_LIST2 /(?:hospital|dentist|chiropractor|physician|medical doctors|nursing directors|medical marketing|\d sortable fields|records all with emails|business director(y|ies)|direct marketing data)|nursing assistant/is
body __KAM_LIST3 /price\:|prices for our director/is
-body __KAM_LIST4 /(?:database|list|[\d,]+ (total records|e-?mails))/is
+body __KAM_LIST4 /(?:database|list|[\d,]{1,32} (total records|e\-?mails))/is
body __KAM_LIST5 /(reply with "stop" as a subject|Send an email with "rem" in the subject to discontinue|put "cease" in the subject of an email|for termination of this e?mail|reply with .{1,8} in the subject)|you will have your email taken off|for the datacard|send.a.reply/is
header __KAM_LIST6 Subject =~ /Database of (neurological|surgeons|doctors|nurses|mds)|MD Database|looking for list|email database|we have that list|marketing database|list.of.\d/i
meta KAM_LIST (__KAM_LIST1 + __KAM_LIST2 + __KAM_LIST3 + __KAM_LIST4 + __KAM_LIST5 + __KAM_LIST6 >= 4)
#YET MORE DRUG SCAMS
-body __KAM_DRUG1 /Quality and cheap|premier quality|supor-collosal mixture|Discount-?Pharmacy|hi.quality.drug/is
+body __KAM_DRUG1 /Quality and cheap|premier quality|supor\-collosal mixture|Discount\-?Pharmacy|hi.quality.drug/is
body __KAM_DRUG2 /cheaper|redeem in bulk and save|bigger quantities and Save|drugstore accredi[dt]ations|economical (?:value|amount)|drug.online.supplies/is
-rawbody __KAM_DRUG3 /local drugstore|(hush-hush|secret) with no waiting rooms|confidential package|distributed securely|shape is our main concern/is
+rawbody __KAM_DRUG3 /local drugstore|(hush\-hush|secret) with no waiting rooms|confidential package|distributed securely|shape is our main concern/is
body __KAM_DRUG4 /click to buy|no previous doctors direction|No prescript[oi]{2}n needed|no script necessary|medicine assistance supplier|mail[- ]?order medicine/is
describe KAM_DRUG More Viagra, Medicine, et al Scams
#RECENT RASH OF VIRII/TROJAN PAYLOADS USING GREETING CARD NOTICES - IPHTTP IDEA BY STEPHEN FORD
-body __KAM_CARD1 /(worshipper|friend|Neighbou?r|partner|mate|colleague|member|worshipper|cousin|pal|brother|somebody|father|mother|uncle|aunt|daughter|son|nephew)(\(.{0,35}\))?(?: has)? (?:sen[dt] you|created) (?:an|a)?\s*(?:funny|love|post|greeting|birthday|animated|musical|holiday|love|hallmark|thank you|e)\s*(e|post)?-?card/i
-body __KAM_CARD2 /(laughing kitty|crazy cat) card|enjoy your awesome card|Click on your .{0,15}card('s)? (link|direct www address) below|To see your custom .{0,15}card, simply click on the (link below|following)|(as you can see on the ecard)|^your .{1,15}card link:$|I bet your wife won\'?t do this for you|Your temporary Login Info|temp\.? password id|pics I took of my Ex-Wife|card will be aviailable|our.new.collection/i
+body __KAM_CARD1 /(worshipper|friend|Neighbou?r|partner|mate|colleague|member|worshipper|cousin|pal|brother|somebody|father|mother|uncle|aunt|daughter|son|nephew)(\(.{0,35}\))?(?: has)? (?:sen[dt] you|created) (?:an|a)?\s*(?:funny|love|post|greeting|birthday|animated|musical|holiday|love|hallmark|thank you|e)\s*(e|post)?\-?card/i
+body __KAM_CARD2 /(laughing kitty|crazy cat) card|enjoy your awesome card|Click on your .{0,15}card('s)? (link|direct www address) below|To see your custom .{0,15}card, simply click on the (link below|following)|(as you can see on the ecard)|^your .{1,15}card link:$|I bet your wife won\'?t do this for you|Your temporary Login Info|temp\.? password id|pics I took of my Ex\-Wife|card will be aviailable|our.new.collection/i
body __KAM_CARD3 /I['`]m in hurry, but i still love you...|has (issued you a greeting|made you an Ecard)|^(Follow this link:|click (here to enter our secure server:))?\s*?http:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|eCard, open attached/i
-header __KAM_CARD4 Subject =~ /Here is some pics to say thanks|do you like em?|here is my picture|bra is too tight|look what I like to do|hot news|(\s|^)e-?cards?(\s|$)|greeting.e?card/i
+header __KAM_CARD4 Subject =~ /Here is some pics to say thanks|do you like em?|here is my picture|bra is too tight|look what I like to do|hot news|(\s|^)e\-?cards?(\s|$)|greeting.e?card/i
rawbody __KAM_CARD5 /postcard(\.gif)?\.exe|card.zip|groups.google.com|blaqseal/i
describe KAM_CARD Trojan or Virus Payload from fake ecard notice
#INSURANCE / CAR / LIFE / HEALTH SCAMS - fixed $ bug thanks to Mark Chaney
header __KAM_INSURE1 Subject =~ /get (low )?affordable health (coverage|insurance)|reduce health costs|without health coverage|\d+K(?:.in)?.(term.)?life|overypay for auto insurance|Policy.Payment|GAs Prices|Auto Insurance|get your 20\d\d quote|\$\d00,000 coverage|no exam|Insurance.Payment|child's financial future|\d+K in coverage|health insurance (?:plans|coverage)|(Omaba|obama).?care|Secure \d+k coverage|\$\d\d\d,\d\d\d of term life|life insurance coverage|save up to \d+% on .{0,10}insurance|Protect.your.family|homeowners insurance|home.?.?protection|read.asap|auto.policy|protect your|\$\d+K..?term|auto.?insurance|\d+k.available|simplified.protection|policy.update|view.policy|med(ical)?.exam|term.life|protection|\d+k.available|policy.review|business.insurance|your.health|care.policy|life.cover|life.secure|life.insured/i
body __KAM_INSURE2 /find better Health Insurance Rates Today|get information about health coverage|protect your family|overpay for auto insurance|been recently,? lowered|gas prices are going up|Auto Insurnace go with it|no examination|get (?:a )?free quote|have been.{0,2}reduced|AutoWarranty|plans as low as|plans starting at|complete your health profile|Secure \d+k coverage|growing.family|milestone|special.enroll|updated.rate|lifeinsurance|no.medical.exam|accuquote|no.tobacco.rate|denied.coverage|business.policy|reduced.rate|coverage.starts.immediately|obama|respect.your.privacy/i
-header __KAM_INSURE3 From =~ /Cheaper Auto|Insurance|health.quote.direct|fidelity|gerber|lifeplan|notice|warranty.expir|auto-repairs.{0,30}no longer covered|affordable.?health|Health.?care|AIG|accuquote|life.?rate|eCoverage|humana|ahs.warranty|policy|farmer|qualify|term.life|milestone|payout|secure|out.of.pocket|\d+k|take.comfort/i
+header __KAM_INSURE3 From =~ /Cheaper Auto|Insurance|health.quote.direct|fidelity|gerber|lifeplan|notice|warranty.expir|auto\-repairs.{0,30}no longer covered|affordable.?health|Health.?care|AIG|accuquote|life.?rate|eCoverage|humana|ahs.warranty|policy|farmer|qualify|term.life|milestone|payout|secure|out.of.pocket|\d+k|take.comfort/i
body __KAM_INSURE4 /why pay more for.{0,30}coverage|save up to \d+%|accuquote|Life Insurance Coverage|protect.your.family.{1,20}insurance|Protect home and belonging|Affordable Care Act|new health insurance plan for you|home.?.?protection|\d+k.life.insurance|eligible for auto.coverage|set to expire|\$\d+\/mo|new.rate|your.auto.?insurance.policy|term.life|update.policy|legacy|estate|your.package|your.own.life|prepared.for.anything|paying.(far.)?too/i
describe KAM_INSURE Life, Health, Auto, etc. Insurance SPAMs
#REAL ESTATE INVESTMENT SCAMS
body __KAM_REAL2_1 /(?:Property available|on the water|costa rica|mountain.top)/i
-body __KAM_REAL2_2 /(?:pre-development prices|finish building|torn down to build|exclusive place|ready.for.construction)/i
+body __KAM_REAL2_2 /(?:pre\-development prices|finish building|torn down to build|exclusive place|ready.for.construction)/i
body __KAM_REAL2_3 /(?:unbelievable deals|buyer with CA[s\$]h|pennies.on.the.dollar)/i
body __KAM_REAL2_4 /(?:home sites|raw land|vacation home|wooded.property)/i
body __KAM_REAL2_5 /(?:developers|estates|buyer flying in|retirement plans|liquidation)/i
describe KAM_BADPDF Prevalent Junk PDF SPAMs - BAD SUBJECT
score KAM_BADPDF 2.5
- header KAM_BADPDF Subject =~ /(?:^.{0,15}(document|confirmation|marketwatch|pinksheets|wire info|pinksheets|investor_report|proposal|invest_today|alert|invoice|investor_letter|check)-\d{5,12}$|^basic[- _]chart-|^Active[- _](stocks|trader)|^Analyst[- _]Coverage|^Income[- _](report|details|statement)|^Market[- _](advice|watch)|^Investor[- _]news|^real-?time[- _]quotes)/i
+ header KAM_BADPDF Subject =~ /(?:^.{0,15}(document|confirmation|marketwatch|pinksheets|wire info|pinksheets|investor_report|proposal|invest_today|alert|invoice|investor_letter|check)\-\d{5,12}$|^basic[- _]chart\-|^Active[- _](stocks|trader)|^Analyst[- _]Coverage|^Income[- _](report|details|statement)|^Market[- _](advice|watch)|^Investor[- _]news|^real\-?time[- _]quotes)/i
describe KAM_BADPDF1 Prevalent Junk PDF SPAMs - EMPTY BODY & ENCRYPTED
score KAM_BADPDF1 2.5
#BAD PURCHASE ORDER
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
- mimeheader __KAM_BADPO1 Content-Type =~ /Purchase.Order|New.Invoice|waiver/i
- mimeheader __KAM_BADPO2 Content-type =~ /PDF\.s?html?\"?$/i
+ mimeheader __KAM_BADPO1 Content-Type =~ /Purchase.Order|New.Invoice|waiver|reconciliation/i
+ mimeheader __KAM_BADPO2 Content-type =~ /PDF.{0,3}\.(rtf|s?html?)\"?$/i
endif
header __KAM_BADPO3 Subject =~ /New Order|PO(\b|$)|PO\d\d\d|Purchase Order|Invoice/i
ifplugin Mail::SpamAssassin::Plugin::RaptorOnly
meta KAM_BADPO (KAM_RAPTOR_ALTERED + __KAM_BADPO3 >= 2)
- describe KAM_BADPO Bad Purchase Orders
+ describe KAM_BADPO Bad Purchase Orders or Financial Docs
score KAM_BADPO 5.0
endif
meta KAM_OPRAH (__KAM_OPRAH1 + __KAM_OPRAH2 + __KAM_OPRAH3 + __KAM_OPRAH4 >= 4)
#EBAY TIPS
-body __KAM_EBAY1 /Succeed on ebay|thousands with ebay|ebay success|money-making secret/i
+body __KAM_EBAY1 /Succeed on ebay|thousands with ebay|ebay success|money\-making secret/i
body __KAM_EBAY2 /Auction success kit|Great Money Maker|documented program|Chuck Mullaney|more bills than money/i
header __KAM_EBAY3 Subject =~ /ebay .*for dummies|ebay expert|work online|ebay business|secrets to ebay|Chuck Mullaney|living on ebay|build a business|huge cash flows/i
describe KAM_BODY Odd Erectile Dysfunction Messages with Poor Formatting
#FREE TV, SATELLITE, CABLE INTERNET, ETC
-body __KAM_TV1 /watch unlimited television|DTV4PC|Online TV Code|Free DVD-CD Burner|100% legal|Rabbit TV|reliable.cable.service|existing.smart.tv/i
+body __KAM_TV1 /watch unlimited television|DTV4PC|Online TV Code|Free DVD\-CD Burner|100% legal|Rabbit TV|reliable.cable.service|existing.smart.tv/i
body __KAM_TV2 /without a monthly fee|pay a cable or satellite bill|no monthly fee|watch uncensored|movies online|no censorship|favorite.channels|online.television|\d{3}.channels|high.speed|sysview/i
header __KAM_TV3 Subject =~ /watch uncensored tv|digital TV|internet TV|Free TV|tv online for free|(shows|movies).with.cable|less.than.dish|stream.*channels|\$\d{2}.mo|smart.tv/i
header __KAM_TV4 From =~ /Unlock Internet TV|Movie Download|product alert|cable.tv|tv.stream|high.speed/i
#Right vs Left
header __KAM_POLITICS1 From =~ /Right vs Left|Minuteman|Senator|Pennsylvania Transportation Partners|Americans for Limited Government|special election|conservative|liberal|congress|judge|usa.?net|senate|fedup|sen\. |tea.party|the.right.to/i
-body __KAM_POLITICS2 /Minuteman Civil Defense Corps|National Campaign Fund|Right vs Left|Restore America PAC|penntransportation.com|getliberty.org|Americans for Limited Government|radical|true.conservative|true.liberal|job.killing|wasteful.spending|senate.takeover|liberal.agenda|smear.campaign|america.s future|liberty|obama|governor|election.day|v-o-t-e|sign.the.petition|paid.for.by|dear.conservative|dear.liberal|winning.the.senate|election.cycle|return.power|failed.policy|(left|right).is.claiming|bigwigs|favorable.voters/i
+body __KAM_POLITICS2 /Minuteman Civil Defense Corps|National Campaign Fund|Right vs Left|Restore America PAC|penntransportation.com|getliberty.org|Americans for Limited Government|radical|true.conservative|true.liberal|job.killing|wasteful.spending|senate.takeover|liberal.agenda|smear.campaign|america.s future|liberty|obama|governor|election.day|v\-o\-t\-e|sign.the.petition|paid.for.by|dear.conservative|dear.liberal|winning.the.senate|election.cycle|return.power|failed.policy|(left|right).is.claiming|bigwigs|favorable.voters/i
header __KAM_POLITICS3 Received =~ /\.politicalsystems\.net|republican\.com|democrat\.com|inboxfirst\.com/i
header __KAM_POLITICS4 Subject =~ /alert:?.?election|(republican|democratic).party|and.vote|impeach|insanity|election.ad|liberals|conservatives|back.?room.deal|urgent.obama|social.security.mistake|big.social|absentee.info/i
if (version >= 3.003000)
#HOSTS THAT BEHAVE LIKE TLDS, SUCH AS BLOGSPOT.COM AND OTHER FREE HOSTING - NOTE BLOGSPOT is in 20_aux_tlds.cf ALREADY
+ util_rb_2tld 42web.io
util_rb_2tld a2hosted.com
util_rb_2tld amplifyapp.com
util_rb_2tld app.link
util_rb_2tld campaign-view.com
util_rb_2tld caspio.com
util_rb_2tld cfolks.pl
+ util_rb_2tld cn.com
util_rb_2tld codeanyapp.com
util_rb_2tld codesandbox.io
util_rb_2tld co.in
util_rb_2tld doesphotography.com
util_rb_2tld dreamhost.com
util_rb_2tld dreamhosters.com
+ util_rb_2tld fanlink.tv
util_rb_2tld east-kazakhstan.su
util_rb_2tld exnet.su
util_rb_2tld fameup.net
util_rb_2tld fere.top
util_rb_2tld firebaseapp.com
+ util_rb_2tld fly.dev
util_rb_2tld free.hr
util_rb_2tld georgia.su
util_rb_2tld glitch.me
util_rb_2tld herokuapp.com
util_rb_2tld hubspot-inbox.com
util_rb_2tld in.net
+ util_rb_2tld infinityfreeapp.com
util_rb_2tld isteaching.com
util_rb_2tld jimdo.com
util_rb_2tld kalmykia.su
util_rb_2tld myclickfunnels.com
util_rb_2tld mygbiz.com
util_rb_2tld myshopify.com
+ util_rb_2tld netart.com
util_rb_2tld netdna-cdn.com
util_rb_2tld netlify.app
util_rb_2tld ning.com
util_rb_2tld onmicrosoft.com
util_rb_2tld outrch.com
util_rb_2tld pages.dev
+ util_rb_2tld psee.io
util_rb_2tld plan-net.technology
util_rb_2tld qualtrics.com
+ util_rb_2tld r2.dev
util_rb_2tld radio.am
+ util_rb_2tld replit.dev
util_rb_2tld ru.com
util_rb_2tld sa.com
util_rb_2tld sendpul.se
util_rb_2tld sentieo.com
+ util_rb_2tld sharepoint.com
util_rb_2tld tashkent.su
util_rb_2tld tempurl.host
+ util_rb_2tld thrivecart.com
util_rb_2tld trykalendarai.com
util_rb_2tld tumblr.com
util_rb_2tld usekalendarai.com
util_rb_3tld mkt.dynamics.co
util_rb_3tld on.fleek.co
util_rb_3tld qiye.163.com
+ util_rb_3tld trk.elasticemail.com
util_rb_3tld us-east-1.linodeobjects.com
util_rb_3tld us-iad-1.linodeobjects.com
endif
endif
endif
-#FREEMAIL SPAMMY ADDRESSES IN UNWANTED LANGUAGES
ifplugin Mail::SpamAssassin::Plugin::FreeMail
header __GB_FREEMAIL_NUM0 From:addr =~ /[a-z]\.?\d{4}\@(gmail|hotmail|icloud|yahoo)\.com/i
header __GB_FREEMAIL_NUMN0 From:addr =~ /[a-z]\.?(?:19|20)\d{2}\@(gmail|hotmail|icloud|yahoo)\.com/i
header __GB_FREEMAIL_NUM1 From:addr =~ /[a-z]\.?(?:\d{3}|\d{5,10})\@(gmail|hotmail|icloud|yahoo)\.com/i
+ header __GB_FREEMAIL_NUMN1 From:addr =~ /[a-z]\.?(?:123|321|456)\@(gmail|hotmail|icloud|yahoo)\.com/i
header __GB_FREEMAIL_NUM2 From:addr =~ /[a-z]\.?(?:\d+)(?:[a-z])+(?:\d+)?\@(gmail|hotmail|icloud|yahoo)\.com/i
- meta GB_FREEMAIL_NUM ( ( __GB_FREEMAIL_NUM0 && ! __GB_FREEMAIL_NUMN0 ) || __GB_FREEMAIL_NUM1 || __GB_FREEMAIL_NUM2 )
+ meta GB_FREEMAIL_NUM ( ( __GB_FREEMAIL_NUM0 && ! __GB_FREEMAIL_NUMN0 ) || ( __GB_FREEMAIL_NUM1 && ! __GB_FREEMAIL_NUMN1 ) || __GB_FREEMAIL_NUM2 )
describe GB_FREEMAIL_NUM Freemail spammy address
score GB_FREEMAIL_NUM 1.0
score GB_FREEMAIL_TEXTCOLOR 1.5
endif
-
+#FREEMAIL SPAMMY ADDRESSES IN UNWANTED LANGUAGES
ifplugin Mail::SpamAssassin::Plugin::RaptorOnly
meta GB_UNWANTED_FREE_NUM ( GB_FREEMAIL_NUM && UNWANTED_LANGUAGE_BODY )
describe GB_UNWANTED_FREE_NUM Freemail spammy address and unwanted language
score GB_UNWANTED_FREE_NUM 3.0
+
+ meta GB_UNWANTED_GM_UNDIS ( __TO_UNDISCLOSED && __GB_FREEMAIL_GMAIL && UNWANTED_LANGUAGE_BODY )
+ describe GB_UNWANTED_GM_UNDIS Gmail email to undisclosed recipients in an unwanted language
+ score GB_UNWANTED_GM_UNDIS 1.0
endif
#FAKERBL MX RELATED RULES
header __KAM_MX1 Reply-To =~ /\@mx\d+\./i
header __KAM_MX2 Return-Path =~ /\@mx\d+\./i
-header __KAM_MX3 Received =~ /(\(|\b)(pet|ptr|tech|host|mta|mx|vps|vsp|colo|sox|m)\d+\./i
+header __KAM_MX3 Received =~ /(\(|\b)(pet|ptr|tech|host|mta|mx|vps|vsp|colo|sox)\d+\./i
header __KAM_MX4 Received =~ /(\(|\b)[0-9A-F]{8}\.ptr\./i
# Thanks to Markus Clardy for feedback!
header __KAM_MX5 Received =~ /(\(|\b)[a-z]{2,4}[0-9]{1,3}\.[^\s]{1,20}\.info\b/i
header __KAM_NIGERIAN2_1 Subject =~ /high court|contact fedex courier|WIRE TRANSFER/i
body __KAM_NIGERIAN2_2 /barrister|director of central bank|bank director|former.minister|gold.dealer/i
body __KAM_NIGERIAN2_3 /high court|central bank|payment center|customs?.officer/i
-body __KAM_NIGERIAN2_4 /e-?mail id is found among those that have been scammed|paid the fee for your cheque draft|contact the bank director/i
+body __KAM_NIGERIAN2_4 /e\-?mail id is found among those that have been scammed|paid the fee for your cheque draft|contact the bank director/i
body __KAM_NIGERIAN2_5 /fund code|cheque|bank draft|oil.and.gas/i
body __KAM_NIGERIAN2_6 /full contact information requested|need your contacts informations|your bank account information|out.of.the.country/i
body __KAM_NIGERIAN2_7 /bank|smuggle/i
#MEDICAL
body __KAM_MEDICAL1 /million who suffer from|suffered from organ failure|Medical Billing and Coding|medical doctor/i
-body __KAM_MEDICAL2 /Safe - Natural - Effective/i
+body __KAM_MEDICAL2 /Safe \- Natural \- Effective/i
header __KAM_MEDICAL3 From =~ /Medical/i
header __KAM_MEDICAL4 Subject =~ /Medical Billing/i
describe KAM_GOOGLE Google Pyramid Scams
#SECURITY / ALARM
-header __KAM_ALARM1 Subject =~ /Free Alarm Quotes|home security|protect your.(house|home)|protect.what.matters.most|adt monitor|keep.watch|monitor.the.home|home.alarm|feel safe|burglar|high.crime|free.security|with.this.offer|crime.can|watching.your.home|adt.is.here|ADT-monitoring/i
+header __KAM_ALARM1 Subject =~ /Free Alarm Quotes|home security|protect your.(house|home)|protect.what.matters.most|adt monitor|keep.watch|monitor.the.home|home.alarm|feel safe|burglar|high.crime|free.security|with.this.offer|crime.can|watching.your.home|adt.is.here|ADT\-monitoring/i
body __KAM_ALARM2 /free Quote|burglaries|wireless.security.camera|(Guard|protect) Your Family|ADT is Number One|monitored security system|install from ADT|with ADT security|keep(ing)?.your.home.safe|home.is.your.castle|sleep.with.security|home.security.system|remote.access|video.security/i
rawbody __KAM_ALARM3 /Great rates on Home Security|(1|one) in Alarm System Monitoring|protect your loved ones|protect your business|your source for home security|event on home security|keep.the.home.safe|night.vision|online.monitoring|surveill?ance.camera|ADT.monitor|top.notch.security|exclusive.to.you|home security system/i
header __KAM_ALARM4 From =~ /adt|security.?cam|home.security|wireless.security|security.?camera|author.zed|home.?alarm/i
#URONLINE
body __KAM_URONLINE1 /(chat|chat with me|hook ?up) on Y ?A ?H ?O ?O (tonight|or MSN)|add me with yahoo or msn|view now|press this web link|send me your? photo|can u turn me on|kissing you|begin.a.chat/i
body __KAM_URONLINE2 /wanna talk|ur info|found your mail|found ur profile|mutual friend|katya from russia|you came to russia|my gentle sun|see this page I made|match making heaven|meet that special|comee see it over here|hexten.net|looking for a man|waiting for ur mail|found ur account|waiting for your message|casual.hookup/i
-body __KAM_URONLINE3 /get (naked|naughty)|horny|naughty toys|I will do anything|TOTALLY msg me on MSN|tell me your mobile|I remember you|let's talk|ran across someone like u|sexywebdating|chatting with someone|saw you by BJs|private e-?mail|dating portal|looking.for.fun/i
-header __KAM_URONLINE4 Subject =~ /i'?m so ho?rny|ur really cute|flirt with u|get the party|lets hookup|MSN messanger|\d\d y.o.|russian soul-?mate|my handsome|want you now|russian girl|costs you nothing|can you feel this|came to russia|I remember you|sexual Russia|take a look|attractive girl writes|found u by accident|tell u something special|hookups.waiting/i
+body __KAM_URONLINE3 /get (naked|naughty)|horny|naughty toys|I will do anything|TOTALLY msg me on MSN|tell me your mobile|I remember you|let's talk|ran across someone like u|sexywebdating|chatting with someone|saw you by BJs|private e\-?mail|dating portal|looking.for.fun/i
+header __KAM_URONLINE4 Subject =~ /i'?m so ho?rny|ur really cute|flirt with u|get the party|lets hookup|MSN messanger|\d\d y.o.|russian soul\-?mate|my handsome|want you now|russian girl|costs you nothing|can you feel this|came to russia|I remember you|sexual Russia|take a look|attractive girl writes|found u by accident|tell u something special|hookups.waiting/i
meta KAM_URONLINE (__KAM_URONLINE1 + __KAM_URONLINE2 + __KAM_URONLINE3 + __KAM_URONLINE4 >= 3)
score KAM_URONLINE 4.5
#SEX SCAMS
#MEDICINE REFERENCES
-body __KAM_SEX04_1 /(curative|medicinal|salutary|wholesome|beneficial|satisfaction) effect|(first-rated|splendid) drugs|(yellow|blue|famos) (tablet|pill)|good medical supplies|(commendable|valuable) medicines|canadian pharmacy|GNC|nugenix/is
+body __KAM_SEX04_1 /(curative|medicinal|salutary|wholesome|beneficial|satisfaction) effect|(first\-rated|splendid) drugs|(yellow|blue|famos) (tablet|pill)|good medical supplies|(commendable|valuable) medicines|canadian pharmacy|GNC|nugenix/is
#BED REFERENCES
body __KAM_SEX04_2 /fun in bed|(bed|night) adventures|aid your bed|(lift|heave|ascent|hoist|raise|boost|aid) your (belove|love|darling|sex|sweet)|sexuality with assistance|ascent your sweet|bed experience|love sexuality/is
#SUBJECT REFERENCES
#DISH NETWORK SPAMS AND OTHER TV SPAM
header __KAM_DISH1 From =~ /Dish Network|TVUpgrade|Satellite|Satellite|Dish.*Promo|dish.author|Wireless.Internet|cable.tv|tv.\&|tv.cable|tv.internet|liveteam/i
-header __KAM_DISH2 Subject =~ /Free Next Day Install|Free HD Receiver|Free HBO|free w\/Dish|Holiday Special|Redzone is back|Web-Only Offer|Free HD|with DISH|dish gives you|dish.offers|Wireless Internet provider|sports.package|dish.vs.cable|switch.to.satellite|dish.just|watch.everything|satellite.dish|cable.bill|satellite.bill|paying.too.much|try.satellite|stream.live.tv/i
+header __KAM_DISH2 Subject =~ /Free Next Day Install|Free HD Receiver|Free HBO|free w\/Dish|Holiday Special|Redzone is back|Web\-Only Offer|Free HD|with DISH|dish gives you|dish.offers|Wireless Internet provider|sports.package|dish.vs.cable|switch.to.satellite|dish.just|watch.everything|satellite.dish|cable.bill|satellite.bill|paying.too.much|try.satellite|stream.live.tv/i
rawbody __KAM_DISH3 /(American Satellite|Wireless Internet) Provider|gethdsat|free dvr|Satellite Deals|Dish Network|dish.gives.you.more|packages under \$\d+|compare plans|internet service provider|premium.channel|best.cable.deals|fit.your.budget|deals.near.you|online.television|quality.tv/i
meta KAM_DISH (__KAM_DISH1 + __KAM_DISH2 + __KAM_DISH3 >=3)
body __KAM_DRUG2_4 /grab hold|at[_ ~]your[_ ~]finger[_ ~]?tip|placing your order|questions about drugs|prescription is not|don't care about prescription|without a doctor|no need for a doctor|affor[df]able.prices|best daily rx|Fav.Prescript|unmatched.prices|rx.med|millions.are.praising/i
-body __KAM_DRUG2_5 /0nline|hassle[~-]free|favored rx|branded solutions|branded remedies|v[1i]cod[!i]n|Penhtremine|prxpills|ultimaterxhere|insanerx|speedymed4u|mightymeds1|coolestrxhere|hotrxmedspot|topshoprx|mightyrxhere|qualityrxmedz|legitrxlife|dealsformeds|simplyrxdeals|bestrxlight|ezprescriptz|reliablerxsource1|freetrusted-rx|hotmedsourcehere|CabinetOfMeds|mytrusted-rx|RxwarehouseHere|WarehouseofRxMeds|GreatrxMedsRus|rxmedsrus|(come by|Come to|Check Out) our web site|browse [0o]ur (website|selection)|Visit_0ur Web|Order_Now|available_this week|(buy|order) (n[0o]w|today|right.now|instantly|at [0o]nce|immediately)|check it out today|ord3r|0rder|0rd3r|browseour|rx ?unit/i
+body __KAM_DRUG2_5 /0nline|hassle[~-]free|favored rx|branded solutions|branded remedies|v[1i]cod[!i]n|Penhtremine|prxpills|ultimaterxhere|insanerx|speedymed4u|mightymeds1|coolestrxhere|hotrxmedspot|topshoprx|mightyrxhere|qualityrxmedz|legitrxlife|dealsformeds|simplyrxdeals|bestrxlight|ezprescriptz|reliablerxsource1|freetrusted\-rx|hotmedsourcehere|CabinetOfMeds|mytrusted\-rx|RxwarehouseHere|WarehouseofRxMeds|GreatrxMedsRus|rxmedsrus|(come by|Come to|Check Out) our web site|browse [0o]ur (website|selection)|Visit_0ur Web|Order_Now|available_this week|(buy|order) (n[0o]w|today|right.now|instantly|at [0o]nce|immediately)|check it out today|ord3r|0rder|0rd3r|browseour|rx ?unit/i
body __KAM_DRUG2_6 /\b(Express|Prompt|Day|Trusty|Trustworthy|Reliable|fast|true|discreet|confidential|rapid)[_ ~\.]?Shippin|anonymous packing|shipped.right.away|adderrx|clinically.proven|support.formula/i
#DIRECT BUY
header __KAM_DIRECT1 From =~ /Direct ?Buy|Wholesale/i
header __KAM_DIRECT2 Subject=~ /complimentary|visitor|settle for retail|top .rands at wholesale|guest pass and catalog|direct.?buy/i
-body __KAM_DIRECT3 /(Complimentary|Visitor|attend our open house|30-day member|VIP Pass|Wholesale Direct Pricing|guest pass and catalog)/i
+body __KAM_DIRECT3 /(Complimentary|Visitor|attend our open house|30\-day member|VIP Pass|Wholesale Direct Pricing|guest pass and catalog)/i
body __KAM_DIRECT4 /Direct.?Buy/i
meta KAM_DIRECT (__KAM_DIRECT1 + __KAM_DIRECT2 + __KAM_DIRECT3 + __KAM_DIRECT4 >= 3)
describe KAM_WTA Ridiculous campaign by unapologetic spammers purposefully using throwaway domains
#SMOKELESS
-body __KAM_SMOKE1 /smoke.anywhere|electronic cig|smoking alternative|prado|e.?-?cig|wanting to quit/i
-header __KAM_SMOKE2 Subject =~ /smoke|e-cig|perfect.?.gift|no cancer|electronic cig|never smoke|e.?-?cig/i
-header __KAM_SMOKE3 From =~ /smoke|smoking|e.?-?cig|electronic cig|vapex|vapor|starter.kit/i
+body __KAM_SMOKE1 /smoke.anywhere|electronic cig|smoking alternative|prado|e.?\-?cig|wanting to quit/i
+header __KAM_SMOKE2 Subject =~ /smoke|e\-cig|perfect.?.gift|no cancer|electronic cig|never smoke|e.?\-?cig/i
+header __KAM_SMOKE3 From =~ /smoke|smoking|e.?\-?cig|electronic cig|vapex|vapor|starter.kit/i
body __KAM_SMOKE4 /No carbon monoxide|Smokeless Direct|No Tobacco|no tar|no cancer|quit smoking|electronic cig|sinless.vapor/i
body __KAM_SMOKE5 /you have qualified/i
describe KAM_HIP Hip Replacement Recall Spam
#WORK AT HOME
-body __KAM_WORKHOME1 /online jobs|Full-time (and|&) Part-time|at home employment/i
+body __KAM_WORKHOME1 /online jobs|Full\-time (and|&) Part\-time|at home employment/i
body __KAM_WORKHOME2 /\#1 site|view here|information here/i
header __KAM_WORKHOME3 Subject =~ /work at home|work \@ home|home positions/i
#HSR UPDATES
body __KAM_HSR1 /hsrupdates.com|progressiverailroading.com/i
-header __KAM_HSR2 Subject =~ /hi-speed rail|HSR Funds|U.?S.? DOT|railroads/i
+header __KAM_HSR2 Subject =~ /hi\-speed rail|HSR Funds|U.?S.? DOT|railroads/i
header __KAM_HSR3 From =~ /HSRUpdates.com|progressive ?railroading/i
meta KAM_HSR (__KAM_HSR1 + __KAM_HSR2 + __KAM_HSR3 >= 3)
#SELLPHONE
body __KAM_SELLPHONE1 /Turn iphones into cash/i
-body __KAM_SELLPHONE2 /used or broken|pre-paid envelope/i
+body __KAM_SELLPHONE2 /used or broken|pre\-paid envelope/i
header __KAM_SELLPHONE3 Subject =~ /sell your old iphone/i
meta KAM_SELLPHONE (__KAM_SELLPHONE1 + __KAM_SELLPHONE2 + __KAM_SELLPHONE3 >= 3)
replace_rules __KAM_MAILBOX1 __KAM_MAILBOX2 __KAM_MAILBOX3
#ISSUE
- body __KAM_MAILBOX1 /mailbox .{0,12}exceeded|(storage|e-?mail|mailbox|bandwidth).(limit|quota|size|capacity)|(box|quota) is (a<L1>most )?(exhausted|fu<L1><L1>)|have been rejected|new version|(prevented|pending) (the )?(delivery|messages)|quota is low|annual upgrade|(held|important) message|messages pending|messages (are|placed) on.?hold|upgrade to our service|recent attack|(request(ed)? to|account) de-?activat|de-?activat(ed|e|ing) (from using|all mailbox)|close down.{0,10}account|(sync|communication) failure|de<A1>ctiv<A1>ted if no <A1>ction|invalid users|request .{0,13}shutdown|migrating all email|del<I1>v<E1>ry <O1>f \d|messages.{0,6}returned|\d.{0,2}(unreceived|failed|undelivered|incoming|valid) (undelivered|incoming|message|e?mail)|synchronize \d email|messages.{1,10}suspend|report your account|(validation|configuration|service|mail) error|updating stage|blacklisted|(server|quota|quarantine|suspension|mail|upgrade) (alert|noti)|mailbox agreement|(system|security|server) (reasons|update|upgrade|alert)|system malfunction|due for an update|mailbox managment|automatically renew|.\d. pending|due for (upgrade|update|reconfirmation)|has been outdated|(due|about) to expire|not confirmed the email|(failed|couldn't be|refused to) deliver|temporarily suspend|failure to proceed|data plan limit|blocked from (sending|receiving|your inbox)|sending unsolicited|\d\% full|confirm your request|security turned off|blocked or suspended|update warning|account .{1,9}?(restricted|closed)|old versions|mail malfunction|messages now queue|password expir|virus|expire on \d+\/|DNS Upgrad|encountered error|will be (locked|shut ?down)|unauthorized (person|access)|prevent (further reject|loss of account)|ensure safety|problem occurred|wrong password|suspicious sign.?in|\d quarantined? (e?mail|message|incoming)|deactivated tempor|low disk space|shutdown robot|suspended email|webmail security|account hijacked|(has been|will be) (hacked|suspended)|will.{0,2}expire.{0,2}(today|soon)|IP below was used|password.{1,5}expires? today|server is totally full|account is almost full|(irregular|suspicious) activit|locked out of your account|login (interruption|problem)|automatic shut.?down|lose your contact|not receive (more|new) e?mail|deactivation of the email|Expired today|exceeded the limit|disruption of your email|message might be pre<V1>ented|mail delivery blocked|email gets locked|shut down on your account|refusal in updating your email|avoid (lose access|shut.?down|being barred)|losing (of )?your account|undelivered e?-?mail|SSL Port server error|refusal of email security|blocked access to your inbox|web-?mail support|change your password|pending (some|e-?mail|mail) message|terminated in \d+ hour|messages were rejected|server error|platform is outdated|need to validate.{2,40}owned by you|password notification|expires today|Reconfirm(?: your) password|out of storage|mail quota full|email password will expire|mailbox termination|failed to sync|permanent deletion|password has been disabled|mailbox \".{5,35}\" has expired|deleted after \d+ hour|expires in less than \d+h|risk of being locked out|e\-?mail service deletion request|password for .{10,60} expire|password is set to expire/i
+ body __KAM_MAILBOX1 /mailbox .{0,12}exceeded|(storage|e\-?mail|mailbox|bandwidth).(limit|quota|size|capacity)|(box|quota) is (a<L1>most )?(exhausted|fu<L1><L1>)|have been rejected|new version|(prevented|pending) (the )?(delivery|messages)|quota is low|annual upgrade|(held|important) message|messages pending|messages (are|placed) on.?hold|upgrade to our service|recent attack|(request(ed)? to|account) de\-?activat|de\-?activat(ed|e|ing) (from using|all mailbox)|close down.{0,10}account|(sync|communication) failure|de<A1>ctiv<A1>ted if no <A1>ction|invalid users|request .{0,13}shutdown|migrating all email|del<I1>v<E1>ry <O1>f \d|messages.{0,6}returned|\d.{0,2}(unreceived|failed|undelivered|incoming|valid) (undelivered|incoming|message|e?mail)|synchronize \d email|messages.{1,10}suspend|report your account|(validation|configuration|service|mail) error|updating stage|blacklisted|(server|quota|quarantine|suspension|mail|upgrade) (alert|noti)|mailbox agreement|(system|security|server) (reasons|update|upgrade|alert)|system malfunction|due for an update|mailbox managment|automatically renew|.\d. pending|due for (upgrade|update|reconfirmation)|has been outdated|(due|about|set) to expire|not confirmed the email|(failed|couldn't be|refused to) deliver|temporarily suspend|failure to proceed|data plan limit|blocked from (sending|receiving|your inbox)|sending unsolicited|\d\% full|confirm your request|security turned off|blocked or suspended|update warning|account .{1,9}?(restricted|closed)|old versions|mail malfunction|messages now queue|password expir|virus|expire on \d+\/|DNS Upgrad|encountered error|will be (locked|shut ?down)|unauthorized (person|access)|prevent (further reject|loss of account)|ensure safety|problem occurred|wrong password|suspicious sign.?in|\d quarantined? (e?mail|message|incoming)|deactivated tempor|low disk space|shutdown robot|suspended email|webmail security|account hijacked|(has been|will be) (hacked|suspended)|will.{0,2}expire.{0,2}(today|soon)|IP below was used|password.{1,5}expires? today|server is totally full|account is almost full|(irregular|suspicious) activit|locked out of your account|login (interruption|problem)|automatic shut.?down|lose your contact|not receive (more|new) e?mail|deactivation of the email|Expired today|exceeded the limit|disruption of your email|message might be pre<V1>ented|mail delivery blocked|email gets locked|shut down on your account|refusal in updating your email|avoid (lose access|shut.?down|being barred)|losing (of )?your account|undelivered e?\-?mail|SSL Port server error|refusal of email security|blocked access to your inbox|web\-?mail support|change your password|pending (some|e\-?mail|mail) message|terminated in \d+ hour|messages were rejected|server error|platform is outdated|need to validate.{2,40}owned by you|password notification|expires today|Reconfirm(?: your) password|out of storage|mail quota full|email password will expire|mailbox termination|failed to sync|permanent deletion|password has been disabled|mailbox \".{5,35}\" has expired|deleted after \d+ hour|expires in less than \d+h|risk of being locked out|e\-?mail service deletion request|password for .{10,60} expire|password is set to expire|discontinue support on your account|generate a new password|word for .{1,30} is set expire|confirm your own|upgraded our security|p<A1><SPACE1>*ssword<SPACE1>*is<SPACE1>*s<E1><SPACE1>*t to <E1><SPACE1>*xpir<E1>/i
tflags __KAM_MAILBOX1 nosubject
#ACTION
- body __KAM_MAILBOX2 /(verify|update|upgrade|increase|validate|confirm|disable)"? (their|your)? {0,5}(address|password|<A1>ccount|(web-?)?mail|info|email|web ?mail|ownership|mailbox)|(increase|upgrade) (my|your?) (inbox |email )?quota|quota (configuration|upgrade)|(increase disk|create some additional|update|add|increase) storage|(setup|upgrade) (your )?mailbox|mail malfunction|update account|validated within \d\d|deleted (automatically|in our server)|release .{0,40}(sent e.?mail|message|pending mess)|account to be close|remain active|termination of your account|choose what happens|blacklisting inactive|continue (using|the usage)|untrusted activity|(retrieve|review|view) (message|e?mail)|(verify|validate) (it )?(here|now)|reset below|verification (check|process)|email disk usage|auto extend your disk|confirm your (email|details)|mandetory file|retrieve here|expected to reactivate|keep your webmail|data will be lost|(block|release|review) (them|below)|view undelivered sent|reconfirm .{0,40}password|will be deactivat|avoid suspension|start the process|fake payment|(will be|automatically) cancel|mail verification|turn on (security|authentication)|Office 365-?Secure|an usual location|(avoid|automatically) delet|(retrieve|review|reload) (your )?(undelivered|pending)|view, release or delete|reload below|unblock (your )?incoming|rectify below|fix now|Company.Assigned Outlook|fix delivery|restore your roundcube|re-?authenticate (now|below)|manage your quarantine|manually fi|manually fix|review and take action|view (your )?(pending|withheld|recent) (incoming|message|e?mail)|use the button|reduce your mai<L1>|deliver recent mail|(use|using|keep) (current|same|my) password|change password|stop (this action|account removal)|fix (the problem here|your email)|(maintain|keep).{0,6}current.{0,2}(signing|password)|verify login|apply update|deliver pending message|archive emails|initiate the upgrad|(approve|continue with) the (current|same) password|free up space|quick re-?validation|cancel the request|prevent lock of account|back under the limit|update no<W1>|re<A1>ctiv<A1>te <A1>ccess|consider keeping your password|account will work effectively|portal to prompt delivery|open the attachment|Reload Email message|secure your account|authenticate.{1,35} account|keep (the )?same password|(keep|use) (the|your) current password|proper verification|restoration of your account|systematically updated|synchronization errors|activate Improved security|(restore|recover) messages (here|below)|recover your delayed messages|validate your (?:mailbox|e\-mail)|conveyed to each sender|Please security access key|account password is due to expire|avoid missing important e?-?mail|pending e?-?mail message|clear cache quick|avoid loss of e?mail|upgrade inbox|enable your password|retrieve your file|view and accept messages|keep my access|re-?active current pass|call support helpline|attend to our notice|clear up space setting/i
+ body __KAM_MAILBOX2 /(verify|update|upgrade|increase|validate|confirm|disable)"? (their|your)? {0,5}(address|password|<A1>ccount|(web\-?)?mail|info|email|web ?mail|ownership|mailbox)|(increase|upgrade) (my|your?) (inbox |email )?quota|quota (configuration|upgrade)|(increase disk|create some additional|update|add|increase) storage|(setup|upgrade) (your )?mailbox|mail malfunction|update account|validated within \d\d|deleted (automatically|in our server)|release .{0,40}(sent e.?mail|message|pending mess)|account to be close|remain active|termination of your account|choose what happens|blacklisting inactive|continue (using|the usage)|untrusted activity|(retrieve|review) (message|e?mail)|(verify|validate) (it )?(here|now)|reset below|verification (check|process)|email disk usage|auto extend your disk|confirm your (email|details)|mandetory file|retrieve here|expected to reactivate|keep your webmail|data will be lost|(block|release|review) (them|below)|view undelivered sent|reconfirm .{0,40}password|will be deactivat|avoid suspension|start the process|fake payment|(will be|automatically) cancel|mail verification|turn on (security|authentication)|Office 365\-?Secure|an usual location|(avoid|automatically) delet|(retrieve|review|reload) (your )?(undelivered|pending)|view, release or delete|reload below|unblock (your )?incoming|rectify below|fix now|Company.Assigned Outlook|fix delivery|restore your roundcube|re\-?authenticate (now|below)|manage your quarantine|manually fi|manually fix|review and take action|view (your )?(pending|withheld|recent) (incoming|message|e?mail)|use the button|reduce your mai<L1>|deliver recent mail|(use|using|keep) (current|same|my) password|change password|stop (this action|account removal)|fix (the problem here|your email)|(maintain|keep).{0,6}current.{0,2}(signing|password)|verify login|apply update|deliver pending message|archive emails|initiate the upgrad|(approve|continue with) the (current|same) password|free up space|quick re\-?validation|cancel the request|prevent lock of account|back under the limit|update no<W1>|re<A1>ctiv<A1>te <A1>ccess|consider keeping your password|account will work effectively|portal to prompt delivery|open the attachment|Reload Email message|secure your account|authenticate.{1,35} account|keep (the )?same password|(keep|use) (the|your) current password|proper verification|restoration of your account|systematically updated|synchronization errors|activate Improved security|(restore|recover) messages (here|below)|recover your delayed messages|validate your (?:mailbox|e\-mail)|conveyed to each sender|Please security access key|account password is due to expire|avoid missing important e?\-?mail|pending e?\-?mail message|clear cache quick|avoid loss of e?mail|upgrade inbox|enable your password|retrieve your file|view and accept messages|keep my access|re\-?active current pass|call support helpline|attend to our notice|clear up space setting|retain your existing password|avoid mailbox disconnection|confirm active account|keep using the existing pass|maintain current credential/i
tflags __KAM_MAILBOX2 nosubject
#SUBJECT
- header __KAM_MAILBOX3 Subject =~ /(mail|exceeded|insufficient) (storage|quota|upgrade)|(@.*?is|Inbox) almost full|(urgent|important|admin|last|suspension|server|account|administrator|system|disk ?usage|max size) (alert|rectification|attention|warning|noti)|needs to be upgraded|(incoming|pending|unreceived) +((e-?)?mail|document|message)|(del<I1>v<E1>ry|synchronization|processing) (problem|is blocked|failure|err<O1>r)|(mailbox|storage) (is )?full|(disc|disk|inbox) full|(unread|upgrade|delayed) (messages|e?mail)|release your message|pending (new )?((e-?)?mail|message)|365 .{0,10} Update|new privacy policy|mandatory up|(sign in|Final|account|password|emails?) (closing|removal|update|upgrade|alert|notification|review)|quarantine|rejected|undelivered|(mailbox|limit|quota) .{0,10}exceeded|(action|confirmation|\..{2,6} update).?required|(mail|mailbox|account|password) (error|shutdown|verification|Veirification|Verfication|account)|(blocked|held) message|technology services|(server|mail|account).{1,8}err<O1>r|messages.{1,10}(suspend|hinder)|account (is )?(blocked|limited)|please verify.{1,10}account|mail.{1,6}Notice|email account.{1,11}full|final warning|help\-?desk|mail ownership|point files|(d|r)e-?activation|delayed for \d+ (hour|day)|undeliverable|closure of.{1,15}(\@|account)|(password|mail) (has|will) expire|did you make|password.(due|recovery|expir)|recovery option|(confirm|email) activity|Immediate action|action required|avoid block|review recent e?mail|final +alert|storage (error|limit)|ver<I1>f<I1>cat<I1>on|\@.{1,25}notification|notification \d+\/\d+\/|notification for .{1,25}\@|New Sign-in|deliver.{1,4}(cancel|issue|error|fail)|Unsuccessful Email|Mail DNS|ICT Maintenance|sync err|mailer un.?delivery|unauthorized (person|access)|configuration setting|reminder +for|re-?authenticate|change in your ip|shutdown request|Failure.{0,2}Report|(mail delivery|\d emails?) suspended|error sync|(e-?mails?|messages) (are )?pending|\d \(?new\)? notice|new IP address|expir(y|ation) notif|reached their disk quota|webmail support|notification for|change.{0,30}account password now|(mail|mail-?box) termination|office? ?365 access|(Attention|urgent):? update (required|needed)|(full|out of) storage|quota (limit|reached)|access.{1,4}expire|renew your e?-?mail pass|mail protection update|e-?mail .{0,30}still pending|unauthorized (login|logging) attempt|^suspended$|message failed|security upgrade|password.*expires today|password activity|mail (access blocked|delayed)|account has been hacked|prevent account malfunction|password change notification|Critical(?:\-|\s)Status on|(storage|upgrade) notice|mail not sent|mailbox.{0,4}update settings|\-notification\:\w|access has been suspended|Activities account|Alert\!\!|do not ignore this notification|trying to contact you|validation notic|pass(word|wrod) expire|email configuration|e\-?mail service deletion|cpanel notification|password for .{10,60} expire/i
+ header __KAM_MAILBOX3 Subject =~ /(mail|exceeded|insufficient) (storage|quota|upgrade)|(@.*?is|Inbox) almost full|(urgent|important|admin|last|suspension|server|account|administrator|system|disk ?usage|max size) (alert|rectification|attention|warning|noti)|needs to be upgraded|(incoming|pending|unreceived) +((e\-?)?mail|document|message)|(del<I1>v<E1>ry|synchronization|processing) (problem|is blocked|failure|err<O1>r)|(mailbox|storage) (is )?full|(disc|disk|inbox) full|(unread|upgrade|delayed) (messages|e?mail)|release your message|pending (new )?((e\-?)?mail|message)|365 .{0,10} Update|new privacy policy|mandatory up|(sign in|Final|account|password|emails?) (closing|removal|update|upgrade|alert|notification|review)|quarantine|rejected|undelivered|(mailbox|limit|quota) .{0,10}exceeded|(action|confirmation|\..{2,6} update).?required|(mail|mailbox|account|password) (error|shutdown|verification|Veirification|Verfication|account)|(blocked|held) message|technology services|(server|mail|account).{1,8}err<O1>r|messages.{1,10}(suspend|hinder)|account (is )?(blocked|limited|closing)|please verify.{1,10}account|mail.{1,6}Notice|email account.{1,11}full|final warning|help\-?desk|mail ownership|point files|(d|r)e\-?activation|delayed for \d+ (hour|day)|undeliverable|closure of.{1,15}(\@|account)|(password|mail) (has|will) expire|did you make|password.(due|recovery|expir)|recovery option|(confirm|email) activity|Immediate action|action required|avoid block|review recent e?mail|final +alert|storage (error|limit)|ver<I1>f<I1>cat<I1>on|\@.{1,25}notification|notification \d+\/\d+\/|notification for .{1,25}\@|New Sign\-in|deliver.{1,4}(cancel|issue|error|fail)|Unsuccessful Email|Mail DNS|ICT Maintenance|sync err|mailer un.?delivery|unauthorized (person|access)|configuration setting|reminder +for|re\-?authenticate|change in your ip|shutdown request|Failure.{0,2}Report|(mail delivery|\d emails?) suspended|error sync|(e\-?mails?|messages) (are )?pending|\d \(?new\)? notice|new IP address|expir(y|ation) notif|reached their disk quota|webmail support|notification for|change.{0,30}account password now|(mail|mail\-?box) termination|office? ?365 access|(Attention|urgent):? update (required|needed)|(full|out of) storage|quota (limit|reached)|access.{1,4}expire|renew your e?\-?mail pass|mail protection update|e\-?mail .{0,30}still pending|unauthorized (login|logging) attempt|^suspended$|message failed|security upgrade|password.*expires? today|password activity|mail (access blocked|delayed)|account has been hacked|prevent account malfunction|password change notification|Critical(?:\-|\s)Status on|(storage|upgrade) notice|mail not sent|mailbox.{0,4}update settings|\-notification\:\w|access has been suspended|Activities account|Alert\!\!|do not ignore this notification|trying to contact you|validation notic|pass(word|wrod) expire|email configuration|e\-?mail service deletion|cpanel notification|password for .{10,60} expire|message expiry error|message failure delivery notice|e-?mail account validat|^Your .{1,30} notification$|Final Notice\!/i
#NON OBFUSCATED VARIANT NOT A SPAM INDICATOR
header __KAM_MAILBOX3FP Subject =~ /verification/i
#COMPROMISED SYSTEMS
- uri __KAM_WPADMIN /\/wp-admin\//i
+ uri __KAM_WPADMIN /\/wp\-admin\//i
meta KAM_MAILBOX (__KAM_MAILBOX1 + __KAM_MAILBOX2 + (__KAM_MAILBOX3 && !__KAM_MAILBOX3FP) >=2) && (T_FREEMAIL_DOC_PDF + (KAM_SENDGRID + KAM_SENDGRID2 >= 1) + HTML_MIME_NO_HTML_TAG + T_HTML_ATTACH + __KAM_WPADMIN) >= 2
score KAM_MAILBOX 8.75
header __KAM_GALLERY3 Subject =~ /(Fantastic|Insane|Mega|Extreme|Extreme|New|Many|Fresh|Your|Check) P.?o.?r.?n|cele.?brities elite|(Insane|P.?o.?r.?n|More|Awesome|All|Mega) Model|(Your|Mega|Asian|Bad|Cool|Fresh|Real|Awesome|More) Girl|(Sweet|Incredible|Insane|The|Grand) chick|(Many|New|Infinite|Cool|All) Cele.?b|The N.?u.?des|(Infinite|Awesome|Many|Sweet|Bad|Get|Fresh|Hot|More|Black) Babe|Amat.?e.?urs|(All|Fresh|Fantastic|The|Mega) Adu.?lt|(Extraordinary) Chicks/i
body __KAM_GALLERY4 /(Fantastic|Insane|Mega|Extreme|Extreme|New|Many|Fresh|Your|Check) P.?o.?r.?n|cele.?brities elite|(Insane|P.?o.?r.?n|More|Awesome|All|Mega) Model|(Your|Mega|Asian|Bad|Cool|Fresh|Real|Awesome|More) Girl|(Sweet|Incredible|Insane|The|Grand) chick|(Many|New|Infinite|Cool|All) Cele.?b|The N.?u.?des|(Infinite|Awesome|Many|Sweet|Bad|Get|Fresh|Hot|More|Black) Babe|Amat.?e.?urs|(All|Fresh|Fantastic|The|Mega) Adu.?lt|(Extraordinary) Chicks/i
-rawbody __KAM_GALLERY5 /wp-content|_vti_cnf|cache|wp-admin|wordpress/i
+rawbody __KAM_GALLERY5 /wp\-content|_vti_cnf|cache|wp\-admin|wordpress/i
meta KAM_GALLERY (__KAM_GALLERY1 + __KAM_GALLERY2 + __KAM_GALLERY3 + __KAM_GALLERY4 + __KAM_GALLERY5 >=4)
describe KAM_GALLERY Exploited Gallery with Porn
replace_tag V1 (?:v|\xf0\x9d\x96\xb5|\xce\xbd)
replace_tag W1 (?:w|\xf0\x9d\x98\x84|\xf0\x9d\x9a\xa0|\xd1\xa1)
replace_tag Y1 (?:y|\xf0\x9d\x9a\xa2)
-replace_tag SPACE1 (?: |\xc2\xa0)
+replace_tag SPACE1 (?: |\xc2\xa0|\xef\xbb\xbf)
#OBFU ONLY
replace_tag A2 (?:[\xf0\x9d\x97][\xae]|[\xc3][\xa3]|[\xf0\x9d\x9a][\x8a]|[\xd0][\xb0]|[\xc9][\x91]|α|\@)
#ADVANCE
header __KAM_ADVANCE1 Subject =~ /Advance for \d.\d\d\d/i
body __KAM_ADVANCE2 /Advance Details/i
-body __KAM_ADVANCE3 /Pre-Approved/i
+body __KAM_ADVANCE3 /Pre\-Approved/i
header __KAM_ADVANCE4 From =~ /Advance|Approv|Financ/i
meta KAM_ADVANCE (__KAM_ADVANCE1 + __KAM_ADVANCE2 + __KAM_ADVANCE3 + __KAM_ADVANCE4 >= 3)
score KAM_COMPROMISED 8.25
#GROUPS THAT ARE BAD - RENAMED TO AVOID COLLISSION - THANKS TO DAVID FUNK
-header __KAM_LIST2A List-ID =~ /^<?(wareeed\d*|ArabBusinessmen-and-DecisionMakers-Network|MediaJO\d*|arabjo\d*|prime\-?media\d*|mediajoshoot\d*|bareedw\d*|mghadeh\d*|tawzeef-online|jordanianadd\d*|ssjo\d*|jaracast|ads-shooter-j\d*|jomarketing\d*|jomedia\d*|jobird\d*info|uhrda-\d*|mohanndahad\d*|caragcom\d*|marwahr\d*|sonjobonjo\d*|golrozz\d*|golbanoo\d*)\.googlegroups.com>?$/i
+header __KAM_LIST2A List-ID =~ /^<?(wareeed\d*|ArabBusinessmen\-and\-DecisionMakers\-Network|MediaJO\d*|arabjo\d*|prime\-?media\d*|mediajoshoot\d*|bareedw\d*|mghadeh\d*|tawzeef\-online|jordanianadd\d*|ssjo\d*|jaracast|ads\-shooter\-j\d*|jomarketing\d*|jomedia\d*|jobird\d*info|uhrda\-\d*|mohanndahad\d*|caragcom\d*|marwahr\d*|sonjobonjo\d*|golrozz\d*|golbanoo\d*|reka\-ppe)\.googlegroups.com>?$/i
header __KAM_LIST2B Sender =~ /(mediajo\d*|aloulaonline\d*|jomedia\d*|golbanoo\d*)\@googlegroups\.com/i
meta KAM_LIST2 (__KAM_LIST2A + __KAM_LIST2B >= 1)
body __KAM_BACK1 /backgrounds in seconds|Instant..?Checkmate|federal.record|background.report|reputation/i
body __KAM_BACK2 /(Property & Personal history|Asset & Background) (Investigation|Search)|check anyone|know.anything|registered.offense|their.name|publicly.available/is
body __KAM_BACK3 /(background check|detective|investigator|investigate backgrounds|arrest.record|public.record)|remain.anonymous|anonymous.report|says.about.you|instant.database|the.truth|reveal.the.information|screening.services/is
-header __KAM_BACK4 Subject =~ /background..?check|date-smart|detective|finding people|instant checkmate|pedophile|who.lives.next.?door|reports.are.now.posted|screening.results|police.record|confirm.identity|records.enclosed|local.report|criminal|public.record|complete.record|arrest|posted.online|information.posted|info.updated|who.they.are|uncover.any|private.eye|investigate.background/i
+header __KAM_BACK4 Subject =~ /background..?check|date\-smart|detective|finding people|instant checkmate|pedophile|who.lives.next.?door|reports.are.now.posted|screening.results|police.record|confirm.identity|records.enclosed|local.report|criminal|public.record|complete.record|arrest|posted.online|information.posted|info.updated|who.they.are|uncover.any|private.eye|investigate.background/i
header __KAM_BACK5 From =~ /Background.?check|instant.?check|arrest.record|pedophile|trust|criminal|urgent.info|find.out|who.is.s?he|trouble|shady|public.record|private.?eye/i
describe KAM_BACK Background Check SPAM
score KAM_TK 5.0
#THIRD PARTY / SENT BY XXXX
-body __KAM_THIRD /advertisement.{0,12}sent by a third-?party|sent.by.tb.systems|is.an.advert[il]se?ment/i
+body __KAM_THIRD /advertisement.{0,12}sent by a third\-?party|sent.by.tb.systems|is.an.advert[il]se?ment/i
#LASIK
header __KAM_LASIK1 From =~ /Lasik/i
score KAM_LASIK 4.5
#FAKE NOTIFIES
-header __KAM_NOTIFY1 From =~ /Support|Notifier|Reminder|Assistance|Administrator|RuneScape|Wells ?Fargo|Scotia|Diablo|MAILER-DAEMON|Notifications/i
+header __KAM_NOTIFY1 From =~ /Support|Notifier|Reminder|Assistance|Administrator|RuneScape|Wells ?Fargo|Scotia|Diablo|MAILER\-DAEMON|Notifications/i
body __KAM_NOTIFY2 /[2-9] friend request( |\b)|sell your personal|mandatory validation|verify your Account|unread messages/i
header __KAM_NOTIFY3 From =~ /\.br>/i
score KAM_LANG 4.5
#FAKE TRACK
-header __KAM_TRACK1 From =~ /Worldwide Express|Priority Mail|First-Class Mail|Express Mail/i
+header __KAM_TRACK1 From =~ /Worldwide Express|Priority Mail|First\-Class Mail|Express Mail/i
meta KAM_TRACK (__KAM_PHISH2_3 + __KAM_TRACK1 >= 2)
describe KAM_TRACK Fake Tracking Emails
#MEDICARE
header __KAM_MEDICARE1 From =~ /(Medicare|health.?options|enrollment)/i
-header __KAM_MEDICARE2 Subject =~ /medicare|message for senior|baby-boomer|save up to|compare.quotes|enrollment.plan/i
+header __KAM_MEDICARE2 Subject =~ /medicare|message for senior|baby\-boomer|save up to|compare.quotes|enrollment.plan/i
body __KAM_MEDICARE3 /medicare.(plan|recipient|annual election)/i
tflags __KAM_MEDICARE3 nosubject
body __KAM_MEDICARE4 /over.(65|sixty.?five)|most.affordable|lower.your.premium|medicare basics guide/i
header __KAM_BLOOD2 Subject =~ /Blood Pressure|the.(nurse|doctor).said|do.this.or.die|bp.med/i
body __KAM_BLOOD3 /Secret Big Pharma|conspiracy|Breaking.Health.Stories/i
body __KAM_BLOOD4 /Marine Essentials|this mineral|drug.companies.hate/i
-body __KAM_BLOOD5 /Anti-Aging Expert|worst.food/i
+body __KAM_BLOOD5 /Anti\-Aging Expert|worst.food/i
body __KAM_BLOOD6 /Blood pressure/i
meta KAM_BLOOD ( __KAM_BLOOD1 + __KAM_BLOOD2 + __KAM_BLOOD3 + __KAM_BLOOD4 + __KAM_BLOOD5 + __KAM_BLOOD6 + KAM_INFOUSMEBIZ >= 4)
#BBB Phish
header __KAM_BBB1 From =~ /bbb.org/i
body __KAM_BBB2 /consumer's *(?:worry|uneasiness|anxiety|disturbance|concern|trouble)/i
- body __KAM_BBB3 /has been registered the above|(?:visiting|review at) a link below|above-referenced complaint/i
+ body __KAM_BBB3 /has been registered the above|(?:visiting|review at) a link below|above\-referenced complaint/i
body __KAM_BBB4 /about your *(?:glance|belief|judgment)/i
header __KAM_BBB5 Subject =~ /(?:client|customer).{0,5}preten|(?:Appeal|Claim|Case|No\.|Complaint).{0,3}[A-Z\d]{5}/i
header __KAM_FAKE_DELIVER12 From !~ /dpd.com|dpd.co.uk/i
#ODD DELIVERY
-uri __KAM_FAKE_DELIVER13 /(cdn\.discordapp\.com|wp-conten|wp\d+\.server|onedrive\.live\.com)/i
+uri __KAM_FAKE_DELIVER13 /(cdn\.discordapp\.com|wp\-conten|wp\d+\.server|onedrive\.live\.com)/i
body __KAM_FAKE_DELIVER13A /open the enclosed receipt|print the receipt/i
meta KAM_FAKE_DELIVER (__KAM_FAKE_DELIVER1 + __KAM_FAKE_DELIVER2 + ((__KAM_FAKE_DELIVER3 + __KAM_FAKE_DELIVER4 + __KAM_FAKE_DELIVER4A >= 2) + (__KAM_FAKE_DELIVER5 + __KAM_FAKE_DELIVER6 >= 2) + (__KAM_FAKE_DELIVER7 + __KAM_FAKE_DELIVER8 >= 2) + (__KAM_FAKE_DELIVER11 + __KAM_FAKE_DELIVER12 >= 2) + (__KAM_FAKE_DELIVER9 + __KAM_FAKE_DELIVER10 >= 2) >= 1) + (HEADER_FROM_DIFFERENT_DOMAINS + SPF_SOFTFAIL + KAM_RAPTOR_ALTERED + __KAM_FAKE_DELIVER13 + __KAM_FAKE_DELIVER13A >= 1) >= 3)
#TIP
header __KAM_TIP1 From =~ /Beauty Tips/i
-header __KAM_TIP2 Subject =~ /Dark-Circles|undereye bags/i
+header __KAM_TIP2 Subject =~ /Dark\-Circles|undereye bags/i
body __KAM_TIP3 /undereye bags/i
body __KAM_TIP4 /Find Out This Quick New Trick/i
#MAID
header __KAM_MAID1 Subject =~ /Maid Services|housekeeping.service/i
header __KAM_MAID2 From =~ /Maid|Housekeeper/i
-body __KAM_MAID3 /Pre-Screened Housekeepers|local.maid/i
+body __KAM_MAID3 /Pre\-Screened Housekeepers|local.maid/i
meta KAM_MAID (__KAM_MAID1 + __KAM_MAID2 + __KAM_MAID3 >= 3)
describe KAM_MAID Maid Service Spams
#TESTOSTERONE
header __KAM_TESTOSTERONE1 Subject =~ /Boost your testosterone|Testoril|turning you into a woman|men into women|low.testosterone/i
-header __KAM_TESTOSTERONE2 From =~ /Testoril|mens health|low-T|for.men/i
+header __KAM_TESTOSTERONE2 From =~ /Testoril|mens health|low\-T|for.men/i
body __KAM_TESTOSTERONE3 /Boost your testosterone|get your body back|low.testosterone/i
body __KAM_TESTOSTERONE4 /Testoril|sexual confidence|androgel|axiron+androderm/i
score KAM_TIRES 3.0
#SLICEOMATIC
-header __KAM_SLICEOMATIC1 Subject =~ /Slice-O-Matic|Precision Cutting Blade/i
-header __KAM_SLICEOMATIC2 From =~ /Slice-o-matic/i
-body __KAM_SLICEOMATIC3 /Slice-o-matic/i
+header __KAM_SLICEOMATIC1 Subject =~ /Slice\-O\-Matic|Precision Cutting Blade/i
+header __KAM_SLICEOMATIC2 From =~ /Slice\-o\-matic/i
+body __KAM_SLICEOMATIC3 /Slice\-o\-matic/i
meta KAM_SLICEOMATIC (__KAM_SLICEOMATIC1 + __KAM_SLICEOMATIC2 + __KAM_SLICEOMATIC3 >= 3)
describe KAM_SLICEOMATIC Spam for Kitchen Tools
header __KAM_GENERICHEALTH2 Subject =~ /PSA|\[video\]|doctor|\d+.day|(zero|any).effort|oprah|(Dr|Doc).{0,2}[o0]z|[o0]z.([a-z]+.)?(daily|tip|show|weight|quick)|ellen|most.viewed|metabolism|danger|hormone|must.read|life.changing|healthy|perfect|younger|beautiful|hollywood|secret|aging|youth|flawless|as.seen.on|simple.way|workout|nutrition|shocking|detox|exercise|cleanse|diet|\d+(\+?).?(pounds|[li1]bs?)|images?.leaked|wow,|the.pics|don.t.tell|makeup|f-a-t|of.skin|on.(cnn|abc|cbs)|for.(summer|fall|autumn|winter|spring)|unwanted.fat|oz: |backfire|and.oz|and.racha?el|racha?el.talk|your.legs|slim.and.tone|fit.wom[ea]n|tummy|dress.size|wrinkle.reduc|younger.skin|solid.meds|belly.fat|your.calories|champion|is.it.possible|worse.than.smok|meds.online|jump-start.your.weightloss|cure.your.diabetes|weight.loss..?cure|magic.weight.loss|youth.and.vitality|get.thin.with|mental.decline|by.exercising|kidney.beans|drinking.this|treats?.the.(root.)?cause|reverse.\d+.years/i
-body __KAM_GENERICHEALTH3 /aging|clinical|dermatologist|aging|younger|wrinkle|omg|reduction|prevention|(body|your).fat|extra.pounds|perfect.skin|healthy|diet|gossip|\d+.years|facelift|(Dr|Doc).{0,2}[o0]z|weight|calories|metabolism|appetite|detox|unsightly|cholesterol|free.sample|\d+\s*[li]b|slimming|episode|tv.segment|oprah|colon|hollywood|shocking|workout|trend|starving|\d+%.?off|dress.size|flat.belly|silky|younger|free.trial|\d+.years|easy.trick|selfies|medical|\d+.?(lb|pounds)|exercise|the.mirror|fda.approved|slimmer|oz.blog|the.bulge|plant.based|online.store|respected.doctor|cure.your.diabete|with.forskolin|belly.fat|miracle.pill|burn.fat.fast|the.root.cause|drink(ing)?.this.shake/i
+body __KAM_GENERICHEALTH3 /aging|clinical|dermatologist|aging|younger|wrinkle|omg|reduction|prevention|(body|your).fat|extra.pounds|perfect.skin|healthy|diet|gossip|\d{1,32}.years|facelift|(Dr|Doc).{0,2}[o0]z|weight|calories|metabolism|appetite|detox|unsightly|cholesterol|free.sample|\d{1,32}\s*[li]b|slimming|episode|tv.segment|oprah|colon|hollywood|shocking|workout|trend|starving|\d{1,32}%.?off|dress.size|flat.belly|silky|younger|free.trial|\d{1,32}.years|easy.trick|selfies|medical|\d{1,32}.?(lb|pounds)|exercise|the.mirror|fda.approved|slimmer|oz.blog|the.bulge|plant.based|online.store|respected.doctor|cure.your.diabete|with.forskolin|belly.fat|miracle.pill|burn.fat.fast|the.root.cause|drink(ing)?.this.shake/i
meta KAM_GENERICHEALTH (__KAM_GENERICHEALTH1 + __KAM_GENERICHEALTH2 + __KAM_GENERICHEALTH3 + (KAM_EU || KAM_OTHER_BAD_TLD) >= 3)
score KAM_GENERICHEALTH 1.75
header __KAM_SALE1 From =~ /ipad|hdtv|\$\d+|auction|laptop|easyviewing/i
header __KAM_SALE2 Subject =~ /blowout|became.perfect|great.products|your.ipad.forever|weird.device|change.how.you.use|transform.your.piad|laptop.replacement/i
-body __KAM_SALE3 /\d+%.off|just.shipped|touch.?fire|just.became.perfect|transform.your.ipad/i
+body __KAM_SALE3 /\d{1,32}%.off|just.shipped|touch.?fire|just.became.perfect|transform.your.ipad/i
header __KAM_SALEA_1 From =~ /touch.?fire/i
header __KAM_SALEA_2 Received =~ /touchfire|tfire/i
describe KAM_PACKAGE Sexual Enhancement Scam
#NUM
-header __KAM_NUMSUBJECT Subject =~ /\d+$/
+header __KAM_NUMSUBJECT Subject =~ /(?<!day)\s\d+$/i
header __KAM_SUBJECTYEAR Subject =~ /20[1-2][0-9]$/
meta KAM_NUMSUBJECT (__KAM_NUMSUBJECT >=1 && __KAM_SUBJECTYEAR <= 0)
replace_rules __KAM_CRIM1 __KAM_CRIM2 __KAM_CRIM3 __KAM_CRIM4 __KAM_CRIM5 __KAM_CRIM6 __KAM_CRIM7
- body __KAM_CRIM1 /(group|team) of (hackers|web criminals)|(erase|eliminate|destroy|delete) (the|this) (compromising|promising)? ?(videotape|evidence|evidence)|(visit|complain to|call to) (the )?(cops|police)|m<A1>lw<A1>r<E1> <O1>n th<E1> w<E1>b|footage of you|you do not know who I am|mercenary|hack phones|(monitored|infected) your device|double.screen video|keylogger|ruin your life|collection officer|turned on your c<A1>mera|cameras? and a mic|I am a hacker|brows(er|ing) history|trojan virus|automatically infect|inject some code|google translator|<P1>l<A1><C1><E1>d (a )?m<A1>lw<A1>r<E1>|<S1><P1><Y1><W1><A1><R1><E1>|hacked y<O1>ur (website|OS|operating)|got hacked|hidden app|managed to hack|thr(u|ough) (ur|your) web.?cam|broke\s+into\s+your\s+system|infected your system|data security hack|hide (yo)?ur web.?camera|device was infected|i recorded you/i
+ body __KAM_CRIM1 /(group|team) of (hackers|web criminals)|(erase|eliminate|destroy|delete) (the|this) (compromising|promising)? ?(videotape|evidence|evidence)|(visit|complain to|call to) (the )?(cops|police)|m<A1>lw<A1>r<E1> <O1>n th<E1> w<E1>b|footage of you|you do not know who I am|mercenary|hack phones|(monitored|infected) your device|double.screen video|keylogger|ruin your life|collection officer|turned on your c<A1>mera|cameras? and a mic|I am a hacker|brows(er|ing) history|trojan virus|automatically infect|inject some code|google translator|<P1>l<A1><C1><E1>d (a )?m<A1>lw<A1>r<E1>|<S1><P1><Y1><W1><A1><R1><E1>|hacked y<O1>ur (website|OS|operating)|got hacked|hidden app|managed to hack|thr(u|ough) (ur|your) web.?cam|broke\s+into\s+your\s+system|infected your system|data security hack|hide (yo)?ur web.?camera|device was infected|i recorded you|gained access to your device/i
#Bitcoin / Etc.
body __KAM_CRIM2 /(<B1><I1><T1>\-?<C1><O1><I1><N1>|(\b|^)(BTC|DSH|LTC)(\b|$)|cryptocurrency|\b(?<!=)([13][a-km-zA-HJ-NP-Z1-9]{25,34}|bc1[acdefghjklmnpqrstuvwxyz234567890]{30,62})\b)|(remove|manually) all spaces|contains spaces|Litecoin|shoprite|instant money/i
body __KAM_CRIM4 /erotica|<P1><O1><R1><N1>|p(ro|or)nographic movie|promising evidence|<M1><A1><S1><T1><U1><R1><B1><A1><T1>|playing with yourself|wanking|l<I1>f<E1> <C1><A1>n b<E1> ru<I1>n<E1>d|explosi|lead azide|hexogen|banana|perversion|secured \d+ video|passion for jerk|creepy addiction|wank off|site for adult|spy on you over your cam|pleasuring yourself/i
#TIME
- body __KAM_CRIM5 /(twenty.?four|24).?h<O1>urs|(72|24|32|30|12) ?h\. (since|from) (now|this moment)|one day after opening|tracking pixel|(24|32|30|12) ?h(<O1>urs)? <A1>ft<E1>r y<O1><U> <O1>p<E1>n|hours for payment|days?\)? to (send|perform|make|transfer) the (amount|payment|dash|fund)|short-term support|48h plz|deadline|hours *(only )?to send the (pay|fund)|address immediately|tr<A1>nsfer the (amount|funds)|get back to me now|\d\s+working\s+days|make payment within \d+ day|indicated da(y|te)|\d hours from this moment|\d hours (yo)?ur contacts|not more than \d+ days?|\d hours to make a pay/i
+ body __KAM_CRIM5 /(twenty.?four|24).?h<O1>urs|(72|24|32|30|12) ?h\. (since|from) (now|this moment)|one day after opening|tracking pixel|(24|32|30|12) ?h(<O1>urs)? <A1>ft<E1>r y<O1><U> <O1>p<E1>n|hours for payment|days?\)? to (send|perform|make|transfer) the (amount|payment|dash|fund)|short-term support|48h plz|deadline|hours *(only )?to send the (pay|fund)|address immediately|tr<A1>nsfer the (amount|funds)|get back to me now|\d\s+working\s+days|make payment within \d+ day|indicated da(y|te)|\d hours from this moment|\d hours (yo)?ur contacts|not more than \d+ days?|\d hours to make a pay|you have \d+ hour/i
#Subject
- header __KAM_CRIM6 Subject =~ /remember.the.lesson|reputation.is.at.stake|we can be silent|very interesting content|compromising video|hide your camera|Y<O1><U> <A1>r<E1> my v<I1><C1>t<I1>m|visit the police|hi. vi<C1>tim|bomb|rescue|your building|<M1>asturbat|hi perv|(site|account) has been (compromised|hacked)|(final|last) warning|dirty little secret|bad news|central intelligence|pervert|hackers|access to your account|your hobby|video of you|<P1>orn|(share|forward|leak) (your|the) video|Read me now|want to read this|i have you|exfiltrated|everybody will know|check the information/i
+ header __KAM_CRIM6 Subject =~ /remember.the.lesson|reputation.is.at.stake|we can be silent|very interesting content|compromising video|hide your camera|Y<O1><U> <A1>r<E1> my v<I1><C1>t<I1>m|visit the police|hi. vi<C1>tim|bomb|rescue|your building|<M1>asturbat|hi perv|(site|account) has been (compromised|hacked)|(final|last) warning|dirty little secret|bad news|central intelligence|pervert|hackers|access to your account|your hobby|video of you|<P1>orn|(share|forward|leak) (your|the) video|Read me now|want to read this|i have you|exfiltrated|everybody will know|check the information|Regarding you /i
header __KAM_NOT_CRIM6 Subject =~ /Bomb.?cyclone/i
describe KAM_CRIM2 Extortion Email
score KAM_CRIM2 7.5
-#ZWNJ
+#ZWNJ - Zero Width Null Joiner
#ZWNJ 200C 157 https://en.wikipedia.org/wiki/Windows-1256
# Also want to look at Unicode U+200C.
# Also 'zero-width joiner' which is Windows-1256 0x9E and Unicode U+200D. $a
tflags __KAM_ZWNJ2 multiple maxhits=16
body __KAM_ZWNJ3 /\&\#x200B;/i
-describe KAM_ZWNJ Use of null characters indicates a goal to elude scanners
+describe KAM_ZWNJ Use of zero width null characters indicates a goal to elude scanners
meta KAM_ZWNJ (__KAM_ZWNJ1 + (__KAM_ZWNJ2 >= 16) >= 2)
describe KAM_ZWNJ Use of null characters indicates a goal to elude scanners
-score KAM_ZWNJ 6.0
+score KAM_ZWNJ 5.25
describe KAM_ZWNJBAD Attempted & failed Use of zero-width characters indicates a goal to elude scanners
meta KAM_ZWNJBAD (__KAM_ZWNJ3 >=1)
score KAM_ZWNJBAD 2.0
+#ZWNS - Zero Width Non-Breaking Space
+body __KAM_ZWNS1 /\xef\xbb\xbf/
+tflags __KAM_ZWNS1 multiple maxhits=16
+
+meta KAM_ZWNS ( __KAM_ZWNS1 >= 16 )
+describe KAM_ZWNS Use of zero width space characters indicates a goal to elude scanners
+score KAM_ZWNS 2.5
+
#GIRLS
body __KAM_GIRLS1 /Lack of sex/i
uri __KAM_FUN3A /imgstore.host/i
#Subject
-header __KAM_FUN4 Subject =~ /Gutter|Assisted Living|Refinance|rate|livewave|mortgage|E\.D\.|Single|Superfood|tax|protection|debt|mastercard|safety charge|supplement|pillow|Inogenone|learn a language|Roadside safety|carry a gun|minute survey|roofing Deals|fungus|insurance|pain|gold|hair|knife|warranty|reflexology|accufeet|keto|sound|heartburn|skincare|terminix|zippy|sneeze|healthcare|yoga|heal|jesus|virus|neuropathy|BP med|perfect vision|parasites|wine|willie nelson|InstaFresh|InstaSavings|carriers|CPAP|melt your belly|heart attack|power of plants|immunity|smart.?watch|fever|hearing aids|diabetes|gum problem|bad breath|fish oil|ultra ?boost|boost your internet|christmas list|(energy|cooling) (bill|cost)|time ?share|interstate move|vanishes pain|wine order|chat rooms|\d+ ?lbs|dementia|nutrisystem|personal plan|Printer Ink|america strong|perfect gifts|Someone Special|Insta ?heater|asian girls|audiobooks|memories into art|losing weight|CBD Gum/i
+header __KAM_FUN4 Subject =~ /Gutter|Assisted Living|Refinance|rate|livewave|mortgage|E\.D\.|Single|Superfood|tax|debt|mastercard|safety charge|supplement|pillow|Inogenone|learn a language|Roadside safety|carry a gun|minute survey|roofing Deals|fungus|insurance|pain|gold|hair|knife|warranty|reflexology|accufeet|keto|sound|heartburn|skincare|terminix|zippy|sneeze|healthcare|yoga|heal|jesus|virus|neuropathy|BP med|perfect vision|parasites|wine|willie nelson|InstaFresh|InstaSavings|carriers|CPAP|melt your belly|heart attack|power of plants|immunity|smart.?watch|fever|hearing aids|diabetes|gum problem|bad breath|fish oil|ultra ?boost|boost your internet|christmas list|(energy|cooling) (bill|cost)|time ?share|interstate move|vanishes pain|wine order|chat rooms|\d+ ?lbs|dementia|nutrisystem|personal plan|Printer Ink|america strong|perfect gifts|Someone Special|Insta ?heater|asian girls|audiobooks|memories into art|losing weight|CBD Gum/i
#How many/How Soon
-body __KAM_FUN5 /\d million americans|less than \d+ (weeks|days|hours)|temporary feeling|\d+ ?lbs|[\d+,]+ Asian babes/i
+body __KAM_FUN5 /\d million americans|less than \d{1,32} (weeks|days|hours)|temporary feeling|\d{1,32} ?lbs|[\d+,]{1,32} Asian babes/i
#miracle!
body __KAM_FUN6 /finds the secret|new discovery|natural medicine|health channel|medicinal plants|simple tweak|doctors are shocked|mysterious liquid|massive mistake|scientifically shown|chronic pain/i
#what
ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
# Allow googleapis.com to be blocklisted due to spam runs in June 2019 exploiting it
clear_uridnsbl_skip_domain googleapis.com
+ # Allow t.co to be blocklisted due to spam seem in April 2024 exploiting it
+ clear_uridnsbl_skip_domain t.co
endif
# Need a favor phishing
#trusted_networks 38.124.232.0/24
# CONTACTS / LISTS
-header __KAM_LIST3_1 Subject =~ /(accou?nt|Contacts?|buyers?|registrants?|attendees?|B2B|B2C|mailing|industries).(data|list|information)|reach qualified buyers|potential prospects|(potential|reach your) client|(list|lead) prospecting|build customer|(bitdefender|Acronis) Users|reach clients|Clients records|users accounts|Attendees info|marketing opp|(expo|Summit) Leads|Free Samples|email database|sales prospect|(construction|business) +(executives|professionals)|prospects|decision.?makers|(email|lead) list|increase your TAM|Booth.?\#\d+|data that you need|(audience|geography)\?|contact details|professional industry clients/i
+header __KAM_LIST3_1 Subject =~ /(accou?nt|Contacts?|buyers?|registrants?|attendees?|B2B|B2C|mailing|industries).(data|list|information)|reach qualified buyers|potential prospects|(potential|reach your) client|(list|lead) prospecting|build customer|(bitdefender|Acronis) Users|reach clients|Clients records|users accounts|Attendees info|marketing opp|(expo|Summit) Leads|Free Samples|email database|sales prospect|(construction|business) +(executives|professionals)|prospects|decision.?makers|(email|lead) list|increase your TAM|Booth.?\#\d+|data that you need|(audience|geography)\?|contact details|professional industry clients|easy contacts of/i
#title
body __KAM_LIST3_2 /list (consultant|services)|email campaign|global marketing|(event|campaign|success|purchasing) mana?ger|(tradeshow|marketing) (coordinator|campaign|manager|exec|project|team)|(lead|demand) gen|(business|Data|event|research|marketing) (analyst|coordinator)|(potential|professionals?|qualified) lead|(business development|marketing|lead|attendees?|data|prospect|intelligence|event).(executive|consultant|specialist)|(marketing|Business) Co-?ordinator|marketing (\&|and) comm|inside sales|pre-?sales|global leads|data dep(t|artment)|marketing exec|(right|appropriate) person|info solutions|Sales executive|database coordinator|list provider|(leads|business development|BD|Biz.?Dev) manager|cd services|data intelligence specialist/i
tflags __KAM_LIST3_2 nosubject
#db for sale
-body __KAM_LIST3_3 /(information|data|list\'s) (count|field)|verified e?-?mail|with email address|counts and pric|decision maker|specific parameters|job titles|Specific lists|each record|post show attendee|(List|contacts|fields) (consists?|Contains?|includes?)|visitors and price|pricing, counts|information about the list|sample (file|record)|direct email|100\% populated|installed users|(compiled|selling) (a )?list|pricing and further|(validated|buy a) dataset|counts, pricing|procure the list|samples for (your )?review|attendees who might|decision.makers|samples and pricing|pricing details|demographics|few (examples|samples)|database (organization|provider)|(cost|expense) (\&|and) count|(samples|counts?) and cost|multichannel marketing|count of email|users of the following|your marketing campaign|\d\d% on emails|acquiring (email|the) list|list of retailers|decision maker mailing list|B2B( data)? list|acquiring email|interested (in )?acquiring|quality lists|potential (client|customer)|database and list management|pricing and count|audience you would like to reach|data cleansing|job titles you wish to contact|leverage competitive intelligence|business contacts? list|verified direct contact numbers/i
+body __KAM_LIST3_3 /(information|data|list\'s) (count|field)|verified e?-?mail|with email address|counts and pric|decision maker|specific parameters|job titles|Specific lists|each record|post show attendee|(List|contacts|fields) (consists?|Contains?|includes?)|visitors and price|pricing, counts|information about the list|sample (file|record)|direct email|100\% populated|installed users|(compiled|selling) (a )?list|pricing and further|(validated|buy a) dataset|counts, pricing|procure the list|samples for (your )?review|attendees who might|decision.makers|samples and pricing|pricing details|demographics|few (examples|samples)|database (organization|provider)|(cost|expense) (\&|and) count|(samples|counts?) and cost|multichannel marketing|count of email|users of the following|your marketing campaign|\d\d% on emails|acquiring (email|the) list|list of retailers|decision maker mailing list|B2B( data)? list|acquiring email|interested (in )?acquiring|quality lists|potential (client|customer)|database and list management|pricing and count|audience you would like to reach|data cleansing|job titles you wish to contact|leverage competitive intelligence|business contacts? list|verified direct contact numbers|our list comes with/i
tflags __KAM_LIST3_3 nosubject
#db what
#NO SUBJ MATCH
meta KAM_LIST3_1 (KAM_LIST3 < 1) && (__KAM_LIST3_1 + __KAM_LIST3_2 + __KAM_LIST3_3 + __KAM_LIST3_4 >= 3)
describe KAM_LIST3_1 Likely Mailing List Purveyor Spam
-score KAM_LIST3_1 6.75
+score KAM_LIST3_1 3.75
#MONCLER
header __KAM_MONCLER1 Subject =~ /moncler/i
score KAM_GREYEAGLE 10.0
#Google Storage APIs
-uri KAM_STORAGE_GOOGLE /storage.googleapis.com|\.web.app\//i
+uri __KAM_STORAGE_GOOGLE /storage\.googleapis\.com|\.web\.app\//i
+meta KAM_STORAGE_GOOGLE ( __KAM_STORAGE_GOOGLE && !__URI_GOOG_STO_IMG )
describe KAM_STORAGE_GOOGLE Google Storage API being abused by spammers
score KAM_STORAGE_GOOGLE 1.70
#where
body __KAM_BENEFICIARY4 /(Ghana|South Africa|China|Greece|Estonia|United kingdom|foreign|(your|my) country|Benin|africa|Foreign Op|international Airport|portugal|business trip|Ivory Coast|Royal Bank|Syria|Libyan|Ministry of |Buffett Foundation|audit unit)|postmaster general|your country/i
#how much
-body __KAM_BENEFICIARY5 /\d+ ?(kilo|kg)|donat|assignment|last wishes|charity org|million dollars|secret account|overdue winnings|handsomely compensate|large amount|share of fund|one digit interest|beneficial business|anticipated cooperation|\d% (with|for) you|fiscal cash|huge amount|(half|99 percent) of (his|their|her) fortune|by proxy|\d million|investment in your country/i
+body __KAM_BENEFICIARY5 /\d{1,32} ?(kilo|kg)|donat|assignment|last wishes|charity org|million dollars|secret account|overdue winnings|handsomely compensate|large amount|share of fund|one digit interest|beneficial business|anticipated cooperation|\d% (with|for) you|fiscal cash|huge amount|(half|99 percent) of (his|their|her) fortune|by proxy|\d million|investment in your country/i
#sob
body __KAM_BENEFICIARY6 /(deceased|late) (customer|husband|client|father)|death of my husband|cancer|power of attorney|customer who died|orphan|no beneficiary|terminal|family treasure|not criminal|send (you )?more (information|details)|wife ran away|inability to release|terrorist attack|sterile|foreigner who died|corrupt officials|could not complete|Diplomat from|seized all my/i
#WEB
#subject
-header __KAM_WEB2_1 Subject =~ /follow|next step|web(site)? (analysis|builder|design|work)|crazy offer|cRM solution|CMS|worrdpress|inquiry web.?site|prices|developing mobile innovation|new web/i
+header __KAM_WEB2_1 Subject =~ /follow|next step|web(site)? (analysis|builder|design|work)|crazy offer|cRM solution|CMS|worrdpress|inquiry web.?site|prices|developing mobile innovation|new web|develoment/i
#price or person - purposefully looks at subject too
-body __KAM_WEB2_2 /(inexpensive|affordable) (quot|price)|cheap website|less than half|free of cost|low package price|indian web.?design|\(India\)|i am a professional|team of experts/i
+body __KAM_WEB2_2 /(inexpensive|affordable) (quot|price)|cheap website|less than half|free of cost|low package price|indian web.?design|\(India\)|i am a professional|team of experts|i am from india/i
#product
-body __KAM_WEB2_3 /web(site)? (design|develop)|(better|new|refreshed) website|website audit|fresh look|redesign your website|mobile application devel|redesign your existing web/i
+body __KAM_WEB2_3 /web(site)? (design|develop)|(better|new|refreshed) website|website audit|fresh look|redesign your website|mobile application devel|redesign your existing web|apps solution/i
tflags __KAM_WEB2_3 nosubject
#sample/offer
score KAM_WEB2 7.5
#BANK
-header __KAM_BANK_1 Subject =~ /Welcome to (Central )?(Money ?Gram|Bank)|Funding|Banker|congratulations/i
-body __KAM_BANK_2 /beneficiary|agent|investment group|deceased/i
-body __KAM_BANK_3 /re\-?verification|clearance tax|possible funding|same last name|nominated bank account/i
+header __KAM_BANK_1 Subject =~ /Welcome to (Central )?(Money ?Gram|Bank)|Funding|Banker|congratulations|d\x{C3}\x{A9}p\x{C3}\x{B4}t direct/i
+body __KAM_BANK_2 /beneficiary|agent|investment group|deceased|\x{C3}\x{A9}viter tout inconv\x{C3}\x{A9}nient/i
+body __KAM_BANK_3 /re\-?verification|clearance tax|possible funding|same last name|nominated bank account|mes informations bancaires/i
meta KAM_BANK (FREEMAIL_FROM + LOTS_OF_MONEY + __KAM_BANK_1 + __KAM_BANK_2 + __KAM_BANK_3 >= 5)
describe KAM_BANK Bank scams
score KAM_BANK 7.5
+meta KAM_BANK2 (LOTS_OF_MONEY + __KAM_BANK_1 + __KAM_BANK_2 + __KAM_BANK_3 >= 3)
+describe KAM_BANK2 Bank scams
+score KAM_BANK2 3.0
+
#FAKE CERTIFICATES
header __KAM_CERT1 Subject =~ /Medical Certificate/i
body __KAM_CERT2 /review this certificate/i
describe KAM_CELEB Celebrity Health Scams
score KAM_CELEB 4.5
-#additional Freemail domains
-freemail_domains my.com mediacombb.net tutanota.com mega.nz ntlworld.com windstream.net list.ru docomo.ne.jp terra.com.br interia.pl currently.com
-
#BEAL AND SIMILAR IMPERSONATOR
ifplugin Mail::SpamAssassin::Plugin::RaptorOnly
- replace_tag KAM_BEAL_NAMES (?:(Robert|Bob).{1,4}Beal|Geoff White|(James|Jim).{1,4}Hoffman|Kevin (A\. )?Mc ?Grail|Frederic Beuter|Chris(topher)? (K\.? )?Surprise|(mike|michael) Charvat|Sheryl( Brissett)? Chapman|Sheryl Brissett|Janet Smith|Jeff Gardner|Geoff(rey)? White|Jason Davis|Al Nance|Laura (C\.? )?Leach|Guy Neitz|Michael Rowland|Brenda MacDonald|Daram Van Oers|Pat(rick)? (A\. )?Campfield|Toni Kerns|Tina L. Berger|Robert T. Lalka|Karen Holmes|Richard Manship|WILLIAM HYATT|Alex DiJohnson|Mike Rinaldi|Patrick Augustine|Randy Livingston|Michael Schoor|Amy Millar|Gino Renne|Edward Kroman|Bill Stynes|Ralph Belk|gino renne|scott allen|Paula Sherman|Peter Turcik|Chip Anastasi|erik howard|Dyana Forester|Ryan Gardner|Yvan (cote|C\x{C3}\x{B4}t\x{C3}\x{A9})|morris adler|Gary (A. )?Smith|Peggy White|Sunny Kim|Jayran Farzanega|Kristin Kirkpatrick|Michael Davison|John Meis|Mitchell Forbes|Kate Syson|Bryan Plumlee|Janet Smith|Christian Gardner|Calvin Johnson|rick cole)
+ replace_tag KAM_BEAL_NAMES (?:(Robert|Bob).{1,4}Beal|Geoff White|(James|Jim).{1,4}Hoffman|Kevin (A\. )?Mc ?Grail|Frederic Beuter|Chris(topher)? (K\.? )?Surprise|(mike|michael) Charvat|Sheryl( Brissett)? Chapman|Sheryl Brissett|Janet Smith|Jeff Gardner|Geoff(rey)? White|Jason Davis|Al Nance|Laura (C\.? )?Leach|Guy Neitz|Michael Rowland|Brenda MacDonald|Daram Van Oers|Pat(rick)? (A\. )?Campfield|Toni Kerns|Tina L. Berger|Robert T. Lalka|Karen Holmes|Richard Manship|WILLIAM HYATT|Alex DiJohnson|Mike Rinaldi|Patrick Augustine|Randy Livingston|Michael Schoor|Amy Millar|Gino Renne|Edward Kroman|Bill Stynes|Ralph Belk|gino renne|scott allen|Paula Sherman|Peter Turcik|Chip Anastasi|erik howard|Dyana Forester|Ryan Gardner|Yvan (cote|C\x{C3}\x{B4}t\x{C3}\x{A9}|C\x{C3}\x{83}\x{C2}\x{B4}t\x{C3}\x{83}\x{C2}\x{A9})|morris adler|Gary (A. )?Smith|Peggy White|Sunny Kim|Jayran Farzanega|Kristin Kirkpatrick|Michael Davison|John Meis|Mitchell Forbes|Kate Syson|Bryan Plumlee|Janet Smith|Christian Gardner|Calvin Johnson|rick cole|(James A.|Andy) Sheppard)
replace_rules __KAM_BEAL1 __KAM_BEAL3 __KAM_NOT_BEAL3
header __KAM_BEAL2 From:addr =~ /\@.+\.rr\.com|\@mail\.ru|\@.*\.cz|\@cox\.net/i
#Name
body __KAM_BEAL3 /<KAM_BEAL_NAMES>/i
- body __KAM_NOT_BEAL3 /((From|Cc|To)\:\s+)<KAM_BEAL_NAMES>/i
+ body __KAM_NOT_BEAL3 /((From|Cc|To)\:\s+).*<KAM_BEAL_NAMES>/i
# Task
- body __KAM_BEAL4 /(reply with|forward|send me|let me have|give me|drop) +your (Cell|Mobile|text)|task (real quick|quickly)|(urgent|quick|fast) (reply|errand|response|task|request)|(handle|make) (some|a) purchase|reimburse you|do something for me fast|spare time right now|confirm if you are free|physical or electronic gift card|(done for me|send out|task done) ASAP|available at the moment|(desk|moment) right now|get some .{0,10}gift card|(run a|important) task for me|certain task to be carried|purchase on my behalf|(urgent|Immediate) (Task|Assignment)|quickly on my behalf|variety of gift card|something important for me|carry out (urgently|swiftly)|codes electronically|make a payment|gifts for their hard|assist me with a task|quick favor|gift cards? for staff|process a payment via Zelle|request I need|purchase done on my behalf|take care of something|handle (some )?task quickly|(have|got) a moment|run an errand|are you in\?|purchase urgently|assignment for (me|you)|change my direct deposit|personal (email|text phone|cell|number)|(leave|have|drop) your (phone )?number|(reply me with|confirm|drop|need|attach) your (mobil|cell)|send me your text|get all the gifts purchase|direct deposit authorization form|list of all unpaid|can you get (?:this\s)?paid|help me with something|if (you are|you're) available|(send|drop) me your (direct|personal) (cell|phone)|free time for you|you available today|bancaires actuelles|ask you for a favor|get physical gift card|(include|confirm) your mobile|Task\!|CONFERENCE MEETING|cartes\-cadeaux|talk a little via email|surprise gift|account balances|in the office today|just respond to my email|send a cell number|aging report|complete an outstanding request/i
+ body __KAM_BEAL4 /(reply with|forward|send me|let me have|give me|drop) +your (Cell|Mobile|text)|task (real quick|quickly)|(urgent|quick|fast) (reply|errand|response|task|request)|(handle|make) (some|a) purchase|reimburse you|do something for me fast|spare time right now|confirm if you are free|physical or electronic gift card|(done for me|send out|task done) ASAP|available at the moment|(desk|moment) right now|get some .{0,10}gift card|(run a|important) task for me|certain task to be carried|purchase on my behalf|(urgent|Immediate) (Task|Assignment)|quickly on my behalf|variety of gift card|something important for me|carry out (urgently|swiftly)|codes electronically|make a payment|gifts for their hard|assist me with a task|quick favor|gift cards? for staff|process a payment via Zelle|request I need|purchase done on my behalf|take care of something|handle (some )?task quickly|(have|got) a moment|run an errand|are you in\?|purchase urgently|assignment for (me|you)|change my direct deposit|personal (email|text phone|cell|number)|(leave|have|drop) your (phone )?number|(reply me with|confirm|drop|need|attach|email)( (me|with))? your (mobil|cell)|send me your text|get all the gifts purchase|direct deposit authorization form|list of all unpaid|can you get (?:this\s)?paid|help me with something|if (you are|you're) available|(send|drop) me your (direct|personal) (cell|phone)|free time for you|you available today|bancaires actuelles|ask you for a favor|get physical gift card|(include|confirm) your mobile|Task\!|CONFERENCE MEETING|cartes\-cadeaux|talk a little via email|surprise gift|account balances|in the office today|just respond to my email|send a cell number|aging report|complete an outstanding request|Visa, Apple or Amazon card|purchas(e|ing) these gifts on my behalf|souhaite modifier (?:le|mon\s+)?compte|(set up ACH for|take care of) the attached invoice/i
# question / privacy
- body __KAM_BEAL5 /can't talk on the phone|receivable aging report|summary of all w\-?2|look forward to my text|are you (accessible|in the office|busy)|between you and I|closed-?door meeting|get something done|you\'re unoccupied|accurately|I can brief|in a (conference|meeting)|reimburse if personal|what details do you need|(do|handle) discreetly|confidentiality|keep this private|get to a nearby store|(let me know|confirm) if you (are available|can get it done)|no calls just reply|write me back|look out for my text|concise you about it|so much on your plate|let me know if you are free|trust you on this|worry about your reimburse|after the surprise|limited cell service|can you assist|convey a message|entrust you|not want to disclose this|planning a surprise event|confidential assignment|respond back via email|going into a meeting|no calls|reach you at|lookout to my message|dans la confidence|wait for my text|immediate assistance|swift discussion|an emergency|prompt reply|laryngitis|(let me know when|as soon as) you are available|limited access to phone|kindly send me emails|plan to surprise|reach you urgent|need a work done|give me a number|comme une surprise|no call, just write|ruin this surprise|currently in session|assistance with an assignment|where we stand with cash|help is needed with an assignment|secretly handle|calls are off.?limit|number I can contact you|it\'s now overdue|can you handle|(send|give) me your personal (cell|num)|email back regarding|executive meeting currently|engaged in a virtual meeting/i
+ body __KAM_BEAL5 /can't talk on the phone|receivable aging report|summary of all w\-?2|look forward to my text|are you (accessible|in the office|busy)|between you and I|closed-?door meeting|get something done|you\'re unoccupied|accurately|I can brief|in a (conference|meeting)|reimburse if personal|what details do you need|(do|handle) discreetly|confidentiality|keep this private|get to a nearby store|(let me know|confirm) if you (are available|can get it done)|no calls just reply|write me back|look out for my text|concise you about it|so much on your plate|let me know if you are free|trust you on this|worry about your reimburse|after the surprise|limited cell service|can you assist|convey a message|entrust you|not want to disclose this|planning a surprise event|confidential assignment|respond back via email|going into a meeting|no calls|reach you at|lookout to my message|dans la confidence|wait for my text|immediate assistance|swift discussion|an emergency|prompt (response|reply)|laryngitis|(let me know when|as soon as) you are available|limited access to phone|kindly send me emails|plan to surprise|reach you urgent|need a work done|give me a number|comme une surprise|no call, just write|ruin this surprise|currently in session|assistance with an assignment|where we stand with cash|help is needed with an assignment|secretly handle|calls are off.?limit|number I can contact you|it\'s now overdue|can you handle|(send|give) me your personal (cell|num)|email back regarding|executive meeting currently|engaged in a virtual meeting|limited to call|Puis(?:\-|\s)je envoyer .{8,32} maintenant|handle the payment today/i
# oddlang
- body __KAM_BEAL6 /sent from my ?mail|depuis mon smartphone|\- Forwarded Message \-/i
+ body __KAM_BEAL6 /sent from my ?mail|depuis mon smartphone|\- Forwarded Message \-|I\'ll need you run/i
meta KAM_BEAL (__KAM_BEAL1 + (__KAM_BEAL3 && ! __KAM_NOT_BEAL3) >= 1) && ((SPF_SOFTFAIL + FREEMAIL_FROM + FREEMAIL_FORGED_REPLYTO + __KAM_BEAL2 + KAM_RAPTOR_EXTERNAL >= 1) + __KAM_BEAL4 + __KAM_BEAL5 + __KAM_BEAL6 >= 3) && !EXTRACTTEXT
describe KAM_BEAL IMPOSTER! Will the real Slim Shady, please stand up?
header __GB_RETPATH_GOOG_TRIX Return-Path =~ /\@trix\.bounces\.google\.com/
-meta GB_RETPATH_GOOG_TRIX __GB_RETPATH_GOOG_TRIX
+meta GB_RETPATH_GOOG_TRIX ( __GB_RETPATH_GOOG_TRIX && !ENVFROM_GOOG_TRIX )
describe GB_RETPATH_GOOG_TRIX Email from Google subdomain being abused by spammers
-score GB_RETPATH_GOOG_TRIX 2.00
+score GB_RETPATH_GOOG_TRIX 1.00
#BENEFICIARY FAKE FORM
body __KAM_DISCLOSE1 /enable me disclose|indicate your? interest|something important/i
describe KAM_BAD_LINK Potentially dangerous link in email
score KAM_BAD_LINK 10.0
+#.WELL KNOWN
+uri __KAM_WELL_KNOWN1 /\.well\-known\//i
+
+meta KAM_WELL_KNOWN ( __KAM_WELL_KNOWN1 >= 1 )
+describe KAM_WELL_KNOWN Link to .well-known directory found in email
+score KAM_WELL_KNOWN 2.5
+
#BAD CITIZENS
header __KAM_FAKE_CITIZEN1 Subject =~ /Citizens Bank Ealert/i
body __KAM_FAKE_CITIZEN2 /Important (message|Notice) From Citizens/i
-uri __KAM_FAKE_CITIZEN3 /phpmailer|wp-admin|.well-known/i
+uri __KAM_FAKE_CITIZEN3 /phpmailer|wp-admin/i
header __KAM_FAKE_CITIZEN4 From:name =~ /Citizens ?Bank/i
header __KAM_FAKE_CITIZEN5 From:addr !~ /citizen/i
-meta KAM_FAKE_CITIZEN (__KAM_FAKE_CITIZEN1 + __KAM_FAKE_CITIZEN2 + (KAM_SHORT + __KAM_FAKE_CITIZEN3 >= 1) + __KAM_FAKE_CITIZEN4 + (__KAM_FAKE_CITIZEN5 + SPF_FAIL >= 1) >= 5)
+meta KAM_FAKE_CITIZEN (__KAM_FAKE_CITIZEN1 + __KAM_FAKE_CITIZEN2 + (KAM_SHORT + __KAM_FAKE_CITIZEN3 + KAM_WELL_KNOWN >= 1) + __KAM_FAKE_CITIZEN4 + (__KAM_FAKE_CITIZEN5 + SPF_FAIL >= 1) >= 5)
describe KAM_FAKE_CITIZEN Fake Bank Alert Scam
score KAM_FAKE_CITIZEN 7.5
header __KAM_FAKE_NORTON1A To =~ /norton|billing\@geeksquad/i
header __KAM_FAKE_NORTON1B From =~ /norton|confirmation|no.?reply|service.?updates|billing|devices.?support|service.?dep|order|device.?alert|biliing|receipt|account.?team/i
#Fuzzy Prod
-body __KAM_FAKE_NORTON2 /N<O1>RT<O1>N(\(?tm\)?|\#)|360 (anti.?virus|Security|protection)|N<O1>rt<O1>N.?Life|norton (\- )?(360|security|deluxe|protection|firewall|plus family)|(nort-.|norton|Mcafee) (Web Pro|Web|Plus(\+| Pro)|pro (net|plus|protection)|all.?round) ((Secure|Family) )?Protection|norton (plan|pro life lock)|(service (name)?|item|Product):?\s+(Norton|Nort.?Pro|geek.?squad)|norton secure plus|nort-(Advance|Pro)|nort-?one 360|life-?lock pro|mal-?ware bites|geeksquad-solutions|Geek(squad)? 360|renewal through geeksquad|Geek Secure Premium|Shield Protection Renewal|G<E1><E1><K1>.?squad security|(symantec|mcafee|norton|geek).{0,3}total (secure|protection)|geek.?squad.?corp|norton billing team|firewall defender|geek.? advanced network|pro geek PC protection|SQUAD anti-?virus|Norton,? Inc|G<E1><E1>k\s+squ<A1>d|Windows Defender Advanced|Netwrk Shield Protection|(pc|network) (security|protection) (service|shield)|previous annual subscription|windows defender security|norton Tech pc support|\(defender\)|premium protection|norton membership|ant<I1>v<I1>rus \(?ultimate|Subscription Plan|geek standard upfront|Select Powerful Protection|<M1>cA\&fnof\;ee|<M1><C1><A1>Fee Subscription|PC Guard Protection/mi
+body __KAM_FAKE_NORTON2 /N<O1>RT<O1>N(\(?tm\)?|\#)|360 (anti.?virus|Security|protection)|N<O1>rt<O1>N.?Life|norton (\- )?(360|security|deluxe|protection|firewall|plus family)|(nort-.|norton|Mcafee) (Web Pro|Web|Plus(\+| Pro)|pro (net|plus|protection)|all.?round) ((Secure|Family) )?Protection|norton (plan|pro life lock)|(service (name)?|item|Product):?\s+(Norton|Nort.?Pro|geek.?squad)|norton secure plus|nort-(Advance|Pro)|nort-?one 360|life-?lock pro|mal-?ware bites|geeksquad-solutions|Geek(squad)? 360|renewal through geeksquad|Geek Secure Premium|Shield Protection Renewal|G<E1><E1><K1>.?squad security|(symantec|mcafee|norton|geek).{0,3}total (secure|protection)|geek.?squad.?corp|norton billing team|firewall defender|geek.? advanced network|pro geek PC protection|SQUAD anti-?virus|Norton,? Inc|G<E1><E1>k\s+squ<A1>d|Windows Defender Advanced|Netwrk Shield Protection|(pc|network) (security|protection) (service|shield)|previous annual subscription|windows defender security|norton Tech pc support|\(defender\)|premium protection|norton membership|ant<I1>v<I1>rus \(?ultimate|Subscription Plan|geek standard upfront|Select Powerful Protection|<M1>cA\&fnof\;ee|<M1><C1><A1>Fee Subscription|PC Guard Protection|mcafee as your security software/mi
#Oddlang
-body __KAM_FAKE_NORTON3 /Esteem your assessment|enhance our administration|recharged your club|looking for patron|delight and happiness|touch our group|confirmatory e?mail|customer service board|connect with expert|for transaction|confirmation range|did not place this order|cancel (your|this|the) (membership|service|subscription)|team norton|(claim a|instant) refund|cancel (or continue )?the plan|for more query|void (this|the) charge|account is debited|kindly activate the license|A\/C statement|you can trust them|drop you an email|don't want this plan|deactivate this plan|queries or doubt|issues? with (your order|the transaction)|feel free to contact|hesitate to call|appritiate your decesion|Warm (regards|respects)|(wish|want) (to )?cancel|order +worth +\$|plan has been enacted|change something|salutations|any query related|norton billing team|same has been processed|an confirmation|don\'t want to renew|remove auto-debit|auto renewal request|thanks\/norton|invalidate your subscription|precept copy|payment method.{1,10}on-?line|drop the membership|generously go ahead|want a refund|renewal tenure|believe an unauthorized|contact microsoft for a full refund|\*\-\* (8\-8\-8|8\-5\-0) \*\-\*|really want further explanation|disc<O1>unt benevolently|upgrade or postpone|get the full refund|valued member of us|find the attachment of your invoice|drop the charges|norton.{0,2}helpdesk|cancel service|not placed the order|within the next two hour|payment network regulation|open a dispute/i
+body __KAM_FAKE_NORTON3 /Esteem your assessment|enhance our administration|recharged your club|looking for patron|delight and happiness|touch our group|confirmatory e?mail|customer service board|connect with expert|for transaction|confirmation range|did not place this order|cancel (your|this|the) (membership|service|subscription)|team norton|(claim a|instant) refund|cancel (or continue )?the plan|for more query|void (this|the) charge|account is debited|kindly activate the license|A\/C statement|you can trust them|drop you an email|don't want this plan|deactivate this plan|queries or doubt|issues? with (your order|the transaction)|feel free to contact|hesitate to call|appritiate your decesion|Warm (regards|respects)|(wish|want) (to )?cancel|order +worth +\$|plan has been enacted|change something|salutations|any query related|norton billing team|same has been processed|an confirmation|don\'t want to renew|remove auto-debit|auto renewal request|thanks\/norton|invalidate your subscription|precept copy|payment method.{1,10}on-?line|drop the membership|generously go ahead|want a refund|renewal tenure|believe an unauthorized|contact microsoft for a full refund|\*\-\* (8\-8\-8|8\-5\-0) \*\-\*|really want further explanation|disc<O1>unt benevolently|upgrade or postpone|get the full refund|valued member of us|find the attachment of your invoice|drop the charges|norton.{0,2}helpdesk|cancel service|not placed the order|within the next two hour|payment network regulation|open a dispute|cancellation, call us/i
tflags __KAM_FAKE_NORTON3 nosubject
#Order
body __KAM_FAKE_NORTON4 /(bank|Auto(matic)?)-?.?-?(debit|renew)|Updated to premium|order is p<L1>aced|0rder|renewal|successfully (placed|renewed)|(repetitive|annual) charge|have been modified|In_voice id|details pertain|auto pay|online\/card|joined our security program|payment_for_services|yearly payment|\$[\d\.]+ will appear|renewed your product/i
describe KAM_FAKE_NORTON Fake Norton / McAfee / Geek Squad / Symantec / etc. Renewal Notices
score KAM_FAKE_NORTON 8.0
-meta KAM_FAKE_NORTONLOW (__KAM_FAKE_NORTON1 + (__KAM_FAKE_NORTON1A + __KAM_FAKE_NORTON1B + FREEMAIL_FROM >= 1) + __KAM_FAKE_NORTON2 + __KAM_FAKE_NORTON3 + __KAM_FAKE_NORTON4 + FREEMAIL_FROM >= 3) && !KAM_FAKE_NORTON && __KAM_FAKE_NORTON2
+meta KAM_FAKE_NORTONLOW (__KAM_FAKE_NORTON1 + (__KAM_FAKE_NORTON1A + __KAM_FAKE_NORTON1B + FREEMAIL_FROM >= 1) + __KAM_FAKE_NORTON2 + __KAM_FAKE_NORTON3 + __KAM_FAKE_NORTON4 >= 3) && !KAM_FAKE_NORTON && __KAM_FAKE_NORTON2
describe KAM_FAKE_NORTONLOW Fake Norton / McAfee / Geek Squad / Symantec / etc. Renewal Notices (Lower Confidence)
score KAM_FAKE_NORTONLOW 6.5
header __KAM_FROM_SPAM_JAN24 From =~ /Nail.?Fungus|water.?filtration|safe.?drinking.?water|Portable.?Heater|scrub.?daddy|stop.?ear.?ring|kohl.?s.?surprise|Solar.?Generator|vault.?scanner|b2b.?worlds|chimp\'s.?custom.?graphics|cold.?sore.*nuker|neuropathy.?cure|BackPain|\@.*\.(cannoschoolnighqua|usanoschoolnighqua)\d+\.org|Apple_Mystery|N\.e\.t\.f\.l\.i\.x|Nano.?Security.?scan|Temu Pallet|QBKS.?renew|american.?airlines.?winner|food.?shortage|Airwheel|benign.?vertigo|ozempic.?scandal|Harbor.?Freight.?Dep/i
-header __KAM_FROM_SPAM_FEB24 From =~ /MTS.?Transitional.?Life|\@avogtal\-|carshield.?auto.?protection|harbor.?freight.?thanks|anti.?aging.?cream|my.?senior.?perks|siriusxm.?loyalty.?program|0nlyfans|gutter.?guard.?affiliate|Federal.?Tax.?Debt.?Help|Activate.?your.?superbrain/i
+header __KAM_FROM_SPAM_FEB24 From =~ /MTS.?Transitional.?Life|\@avogtal\-|carshield.?auto.?protection|harbor.?freight.?thanks|anti.?aging.?cream|my.?senior.?perks|siriusxm.?loyalty.?program|0nlyfans|gutter.?guard.?affiliate|Federal.?Tax.?Debt.?Help|Activate.?your.?superbrain|Eye.?Nutrient.?Risk/i
+
+header __KAM_FROM_SPAM_MAR24 From =~ /Portable.?Wifi|Easter.?letters|\@\w*?\.socialteers\-|Zymme.?Pillow|Crystal.?clear.?vision|stubborn.?belly.?fat|Smart.?time.?share.?owner/i
+
+header __KAM_FROM_SPAM_APR24 From =~ /ugly.?plant|Mysterious.?Liquid|empiretaxprofessionals|\@\w*\.petra\-.*\.com|XBINANCEX/i
+
+header __KAM_FROM_SPAM_MAY24 From =~ /Michael Page Recruitment|Page Group Recruiting|MFA\-Enrollments\-Desk|Nina.?video.?(display|etindge)/i
+
+header __KAM_FROM_SPAM_JUN24 From =~ /Purave.?Water.?filter/i
-meta KAM_FROM_SPAM ( __KAM_FROM_SPAM_NOV21 + __KAM_FROM_SPAM_DEC21 + __KAM_FROM_SPAM_JAN22 + __KAM_FROM_SPAM_FEB22 + __KAM_FROM_SPAM_MAR22 + __KAM_FROM_SPAM_APR22 + __KAM_FROM_SPAM_MAY22 + __KAM_FROM_SPAM_JUN22 + __KAM_FROM_SPAM_JUL22 + __KAM_FROM_SPAM_AUG22 + __KAM_FROM_SPAM_SEP22 + __KAM_FROM_SPAM_OCT22 + __KAM_FROM_SPAM_NOV22 + __KAM_FROM_SPAM_DEC22 + __KAM_FROM_SPAM_JAN23 + __KAM_FROM_SPAM_FEB23 + __KAM_FROM_SPAM_MAR23 + __KAM_FROM_SPAM_APR23 + __KAM_FROM_SPAM_MAY23 + __KAM_FROM_SPAM_JUN23 + __KAM_FROM_SPAM_JUL23 + __KAM_FROM_SPAM_AUG23 + __KAM_FROM_SPAM_SEP23 + __KAM_FROM_SPAM_OCT23 + __KAM_FROM_SPAM_NOV23 + __KAM_FROM_SPAM_DEC23 + __KAM_FROM_SPAM_JAN24 + __KAM_FROM_SPAM_FEB24 >= 1)
+meta KAM_FROM_SPAM ( __KAM_FROM_SPAM_NOV21 + __KAM_FROM_SPAM_DEC21 + __KAM_FROM_SPAM_JAN22 + __KAM_FROM_SPAM_FEB22 + __KAM_FROM_SPAM_MAR22 + __KAM_FROM_SPAM_APR22 + __KAM_FROM_SPAM_MAY22 + __KAM_FROM_SPAM_JUN22 + __KAM_FROM_SPAM_JUL22 + __KAM_FROM_SPAM_AUG22 + __KAM_FROM_SPAM_SEP22 + __KAM_FROM_SPAM_OCT22 + __KAM_FROM_SPAM_NOV22 + __KAM_FROM_SPAM_DEC22 + __KAM_FROM_SPAM_JAN23 + __KAM_FROM_SPAM_FEB23 + __KAM_FROM_SPAM_MAR23 + __KAM_FROM_SPAM_APR23 + __KAM_FROM_SPAM_MAY23 + __KAM_FROM_SPAM_JUN23 + __KAM_FROM_SPAM_JUL23 + __KAM_FROM_SPAM_AUG23 + __KAM_FROM_SPAM_SEP23 + __KAM_FROM_SPAM_OCT23 + __KAM_FROM_SPAM_NOV23 + __KAM_FROM_SPAM_DEC23 + __KAM_FROM_SPAM_JAN24 + __KAM_FROM_SPAM_FEB24 + __KAM_FROM_SPAM_MAR24 + __KAM_FROM_SPAM_APR24 + __KAM_FROM_SPAM_MAY24 + __KAM_FROM_SPAM_JUN24 >= 1)
describe KAM_FROM_SPAM From Indicates a Product Spam
score KAM_FROM_SPAM 9.0
meta KAM_GB_INVALID_FROM (__KAM_GB_INVALID_FROM_NO_DOTS + __KAM_GB_INVALID_FROM_NO_AT >= 1) && ! ( ALL_TRUSTED || NO_RELAYS || __BOUNCE_CTYPE )
describe KAM_GB_INVALID_FROM From Address is invalid
-score KAM_GB_INVALID_FROM 3.0
+score KAM_GB_INVALID_FROM 5.0
meta GB_INVALID_FROM_NOTLS ( KAM_GB_INVALID_FROM && KAM_NOTLS )
describe GB_INVALID_FROM_NOTLS From Address is invalid without TLS connection
#FAKE PAYROLL UPDATE
#subj
-header __KAM_FAKE_PAY_UPDATE1 Subject =~ /Payroll (details?|information) (rectification|adjust|update)|account information|pay(check|roll) ((re\-)?update|review)|update (DD|info)|direct deposit|new bank|UPDATE (BANK|PAYCHECK)|BANK (STATUS|CHANGE)|modification request|update salary|quick update|(^|\b)D(\.|-)?D ?(stub|pay|information|update|request)|change (in|of) (DD|direct.?deposit|account)|Demand Change|^\s$|DD[\- ]*(Authorization|Modify)|help needed|new account|account (change|replace|update)|pay.?roll (update|adjustment)|request? for (change|update)|have a request|RENSEIGNEMENTS\s+.{1,16}\s+BANCAIRES|URGENT(\b|$)|adjustment of bank|ASSIST\!|correction of ACH|paycheck|pay D\-D|payroll \(?info|modifications? to (electronic fund transfer|ACH|EFT)|replac(e|ing) bank info|have a moment|update my account|^Changes$|emolument/i
+header __KAM_FAKE_PAY_UPDATE1 Subject =~ /Payroll (details?|information) (rectification|adjust|update)|account information|pay(check|roll) ((re\-)?update|review)|(change|update) (DD|info)|direct deposit|new bank|UPDATE (BANK|PAYCHECK)|BANK (STATUS|CHANGE)|modification request|update salary|quick update|(^|\b)D(\.|-)?D ?(stub|pay|information|update|request)|(modification|change) (in|of) (DD|direct.?deposit|account)|Demand Change|^\s$|DD[\- ]*(Authorization|Modify)|help needed|new account|account (change|replace|update)|pay.?roll (update|adjustment)|request? for (change|update)|have a request|RENSEIGNEMENTS\s+.{1,16}\s+BANCAIRES|URGENT(\b|$)|adjustment of bank|ASSIST\!|correction of ACH|paycheck|pay D\-D|payroll \(?info|modifications? to (electronic fund transfer|ACH|EFT)|replac(e|ing) bank info|have a moment|update (of|my) (bank )?account|^Changes$|emolument|D D Pay.?Stub|changement de compte|new deposit|DD SWITCH|Immediate Details Change/i
#urg
-body __KAM_FAKE_PAY_UPDATE2 /(for|before|against) (my|the) (subsequent|current|next|upcoming) pay|for next payroll|kindly review (payroll|your) statement|when the next payday|prochaine date de paiement|current pay cycle|next pay (run|date)|Inactive in a few day|right away|on-?time for any ongoing|what data is required|urgent help|next salary|(upcoming|forthcoming) payroll|effective (for this|this|on) pay.?da|effect for next pay|made right now|closed in (a )?few day|for the current pay|next pay period|prompt attention|subsequent payroll|finish the update|can ?not afford any more delay|before the pay.?(roll|date)|straight away|against the upcoming pay|before payroll is run|timely payment|for my current pay|prochain ch.que de paie|quick assistance|account will not be difficult|next pay cycle|immediate effect|before next pay|for the next (check|pay)|this coming payroll/i
+body __KAM_FAKE_PAY_UPDATE2 /(for|before|against) (my|the) (subsequent|current|next|upcoming) pay|for next payroll|kindly review (payroll|your) statement|when the next payday|prochaine date de paiement|current pay cycle|next pay (run|date)|Inactive in a few day|on-?time for any ongoing|what data is required|urgent help|next salary|(upcoming|forthcoming) payroll|effective (for this|this|on) pay.?da|effect for next pay|made right now|closed in (a )?few day|for the current pay|next pay period|prompt attention|subsequent payroll|finish the update|can ?not afford any more delay|before the pay.?(roll|date)|straight away|against the upcoming pay|before payroll is run|timely payment|for my current pay|prochain ch.que de paie|quick assistance|account will not be difficult|next pay cycle|immediate effect|before next pay|for the next (check|pay)|(the|this) coming payroll|before the current check|issues with the bank/i
tflags __KAM_FAKE_PAY_UPDATE2 nosubject
#task
-body __KAM_FAKE_PAY_UPDATE3 /(change|updat(e|ing)) (of my|my) (ACH|bank(ing)?|DD|paycheck|payment|pay) (direct.?deposit|info|account)|new bank(ing)? (details|info)|change the account on my pay|direct.?deposit\s+information|(move|change) (in )?(my|the) (bank|payroll)|account information be change|update my (Pay|bank|account)|account needs to be updated|change in my ACH|I switched bank|paychecks? needs to be update|updat(e|ing) my (payroll.?)?direct.?deposit|designate it as my payee|bank information.{0,35} on file has changed|about my direct deposit|change (on )?my (old account|direct deposit)|updating for my salary|just changed banks|changed my financial institut|DD details changed|new account for my direct deposit|new bank account|informations bancaires|replace my bank(ing)? info|updat(e|ing) my deposit|update my information on pay|passer\s+.\s+un nouveau compte|replace my (previous|current) (bank|direct deposit)|direct.?deposit update|move my paycheck/i
+body __KAM_FAKE_PAY_UPDATE3 /(change|updat(e|ing)) (of my|my) (ACH|bank(ing)?|DD|paycheck|payment|pay|new pay) (direct.?deposit|info|account)|new bank(ing)? (details|info)|change the account on my pay|direct.?deposit\s+information|(move|change) (in )?(my|the) (bank|payroll)|account information be change|update my (Pay|bank|account)|account needs to be updated|change in my ACH|I switched bank|paychecks? needs to be update|updat(e|ing) my (payroll.?)?direct.?deposit|designate it as my payee|bank information.{0,35} on file has changed|about my direct deposit|change (on )?my (old account|direct deposit)|updating for my salary|just changed banks|changed my financial institut|DD details changed|new account for my direct deposit|new bank account|informations bancaires|replace my bank(ing)? info|updat(e|ing) my deposit|update my information on pay|passer\s+.\s+un nouveau compte|replace my (previous|current) (bank|direct deposit)|direct.?deposit update|move my paycheck|(change|amend) the direct deposit|Confirmez .{1,16}quand le changement|direct deposit details? has change|new information on file for direct deposit|amending the text about my pay/i
tflags __KAM_FAKE_PAY_UPDATE3 nosubject
#sigonly/freemail
-meta KAM_FAKE_PAY_UPDATE ( FREEMAIL_FROM + __KAM_FAKE_PAY_UPDATE1 + __KAM_FAKE_PAY_UPDATE2 + __KAM_FAKE_PAY_UPDATE3 >= 4)
+meta KAM_FAKE_PAY_UPDATE ( ( KAM_RAPTOR_EXTERNAL + FREEMAIL_FROM >= 1 ) + __KAM_FAKE_PAY_UPDATE1 + __KAM_FAKE_PAY_UPDATE2 + __KAM_FAKE_PAY_UPDATE3 >= 4)
describe KAM_FAKE_PAY_UPDATE Likely a fake ACH/Payroll Scam
score KAM_FAKE_PAY_UPDATE 9.0
-meta KAM_FAKE_PAY_UPDATE_LOW FREEMAIL_FROM && ( __KAM_FAKE_PAY_UPDATE1 + __KAM_FAKE_PAY_UPDATE2 + __KAM_FAKE_PAY_UPDATE3 >= 2) && ! KAM_FAKE_PAY_UPDATE
+meta KAM_FAKE_PAY_UPDATE_LOW ( KAM_RAPTOR_EXTERNAL + FREEMAIL_FROM >= 1 ) && ( __KAM_FAKE_PAY_UPDATE1 + __KAM_FAKE_PAY_UPDATE2 + __KAM_FAKE_PAY_UPDATE3 >= 2) && ! KAM_FAKE_PAY_UPDATE
describe KAM_FAKE_PAY_UPDATE_LOW Likely a fake ACH/Payroll Scam (Lower Confidence)
score KAM_FAKE_PAY_UPDATE_LOW 7.5
#VOUCHER/COUPON
header __KAM_FAKE_LOWES1 Subject =~ /(costco|ace.?hardware|cvs|cvs.?pharmacy|t-mobile|target|burgerking).*(christmas|e-?coupon|gift.?voucher|bonus|(e.?)?voucher|gift.?card|give.?away|credit)|ace-hard?ware|massive thank you|give?.?away winner|(\d+|dols|bucks) (for you )?from (Starbuck|Sam|Costco)|gas reward|acehardware|samsclub|free samples|gas drop|\d+\.\d+ vouch from costco|CVS\s+expires|sams_club|(fuel|gas) shopping spree|giveaway from (bud.?light|fox)|glft.?card|thank you from (\(?Home.?Depot\)?|cvs)|cvs e-?rewards|nike sends \d+|Verizon (August|September) Gift|points rwrds|verizonrewards|thanks (from|to) .?(sam\'s club|ace.?hardware)|survey reward|\d+ gift.?card pending|(cvs|verizon) (gift.?cert|coupon|has something special|has \d\.0)|\d+ (bucks|dols)|\d+\.0 for you|your \d+ at Verizon|(home.?depot|t-mobile) bonus|Evouch from Sams Club|_ace.?hardware_|use your\s+from Verizon|glft.?certificate|points rwrds|home.?depot_shopper|\$\d+ at Sam\'?s.?club|gift for you|costco gift.?cert|walgreens bonus points/i
#FUZZ
-body __KAM_FAKE_LOWES2 /C<O1>stc<O1> (giveaway|new gift|credit|local reward)|(erewards?|epoints?|evouch|thank you|\d\.\d) from (starbucks|ace.?hardware)|ace[-_]?hardware|sams[-_]?club|complimentary-(fuel\/gas|gas\/Fuel) card|(monday|tuesday|wednesday|thursday|friday|saturday|sunday) (gift-?cert|bonus)|costco-wholesale|\d from your CVS St<O1>re|cvs-pharmacy.?gift.?voucher|giveaway from (bud.?light|fox)|glft.?card|\d from cvs pharm|one hundred from C.?V.?S|nike sends \d+|Sam\'sClub|amount of \d+\.0(\b|$)|\d+ from Verizon|points rwrds|verizonrewards|UNINQUE GIVEAWAY|em<O1>ney|_Ace.?Hardware_|C Ostco|Sam\'s...Club|\$\-Prize|G[1l]ft.?cert|coupon from C<O1>stc<O1>|(target|T\-mobile) e.?(voucher|coupon)|\(home.?depot\)|homedepot bonus|\brwrds\b|_shopper|gift-voucher|has a prize|home depot\-|home\-depot|kohls(\s|\b|$)|BK Card/i
+body __KAM_FAKE_LOWES2 /C<O1>stc<O1> (giveaway|new gift|credit|local reward)|(erewards?|epoints?|evouch|thank you|\d\.\d) from (starbucks|ace.?hardware)|ace[-_]?hardware|sams[-_]?club|complimentary-(fuel\/gas|gas\/Fuel) card|(monday|tuesday|wednesday|thursday|friday|saturday|sunday) (gift-?cert|bonus)|costco-wholesale|\d from your CVS St<O1>re|cvs-pharmacy.?gift.?voucher|giveaway from (bud.?light|fox)|glft.?card|\d from cvs pharm|one hundred from C.?V.?S|nike sends \d+|Sam\'sClub|amount of \d+\.0(\b|$)|\d+ from Verizon|points rwrds|verizonrewards|UNINQUE GIVEAWAY|_Ace.?Hardware_|C Ostco|Sam\'s...Club|\$\-Prize|G[1l]ft.?cert|coupon from C<O1>stc<O1>|(target|T\-mobile) e.?(voucher|coupon)|\(home.?depot\)|homedepot bonus|\brwrds\b|_shopper|gift-voucher|has a prize|home depot\-|home\-depot|kohls(\s|\b|$)|BK Card/i
tflags __KAM_FAKE_LOWES2 nosubject
#ODDLANG
-body __KAM_FAKE_LOWES3 /\d buck|your \d+\.0|\d+ dols|sent with joy|chosen as winer|spend you \$|(huge|massive) (thank you|thanks)|tough times|humble gift|evouch|\bepoint|em<O1>ney|ereward|we are loved|sending some love|(difficult|turbulent) times|nearest-pharm|weekend is on us|wish you a happy (August)|starbucks wishes you|spend bonus|inspire your dreams|unsuscribe here|want to give back|Enjoy_your_weekend|all the-best|e-?vouch|weekly gift.?card|big thanks for (Ace|costco|cvs)|\d+ sent to you by (Ace|costco|cvs)|rewards balance = \d+ USD|this make it better|Ace.?hardware style|awaiting to be spend|dols-voucher|you have been chosen|scary.?reward|tuff times|super.?(monday|tuesday|wednesday|thursday|friday|saturday|sunday).?mega|send a postcard|day-vouch|\d+ bucks coupon|inside = \$\d+|\d+ coupon|\%Subscriber|as an important customer|glft|here is a thanks|202\d has been difficult|how we celebrate|available for download|points-can be used/i
+body __KAM_FAKE_LOWES3 /\d buck|your \d+\.0|\d+ dols|sent with joy|chosen as winer|spend you \$|(huge|massive) (thank you|thanks)|tough times|humble gift|evouch|\bepoint|ereward|we are loved|sending some love|(difficult|turbulent) times|nearest-pharm|weekend is on us|wish you a happy (August)|starbucks wishes you|spend bonus|inspire your dreams|unsuscribe here|want to give back|Enjoy_your_weekend|all the-best|e-?vouch|weekly gift.?card|big thanks for (Ace|costco|cvs)|\d+ sent to you by (Ace|costco|cvs)|rewards balance = \d+ USD|this make it better|Ace.?hardware style|awaiting to be spend|dols-voucher|you have been chosen|scary.?reward|tuff times|super.?(monday|tuesday|wednesday|thursday|friday|saturday|sunday).?mega|send a postcard|day-vouch|\d+ bucks coupon|inside = \$\d+|\d+ coupon|\%Subscriber|as an important customer|glft|here is a thanks|202\d has been difficult|how we celebrate|available for download|points-can be used/i
#URGENT
body __KAM_FAKE_LOWES4 /will be expiring|expires|(finishes|change by) (mon|tue|wed|thu|fri|sat|sun)|pending to activate|(use by|until) (Jan|Feb|mar|apr|may|jun|Jul|aug|sep|oct|nov|dec|mon|tue|wed|thu|fri|sat|sun)|pending (to|your) activat|(valid until|(redeem|use|spend) (before|by)) (mid.?night|mon|tue|wed|thu|fri|sat|sun|aug|sep|oct|nov|dec|jan|feb|mar|apr|may|jun|jul)|ending tomorrow|before midnight|received before \d|activat(e|ion) (today|by|before)|end of month giveaway|ends (today|tomorrow)|valid for (today|the weekend|\d+ hours)|August Help|pending to use|by next (Mon|tue|Wed|Thu|Fri|Sat|sun)|(received?|used?) as soon as possible|ends the \d+(nd|th)|yet to be used|this.? (Mon|Tue|Wed|Thu|Fri|Sat|Sun)|use before|used? \d+\.\d+ by (Sun|Mon|Tue|Wed|Thu|Fri|Sat)|last day to activate|ends (Oct(ober)?|Nov(ember)?|Dec(ember)?) \d|\d+ hours to change|grab your \d+|\d hours left|use now|end of today|used today|this week|\d is available since|before christmas|act fast|will go quickly/i
#BIDDING/ESTIMATING
#NAMES
-body __KAM_BIDEST1A /CSI Estimati(ng|on)|crossland estimating|Williams Estimating|Global Estimation|bolt estimating|prestige estimation|bidding estimating|define estimating|dreamland estimation|swift estimating LLC|define estimating,? LLC|perfect estimation.? llc|estimating solutions.? LLC|rockford estimation.? LLC|define estimating LLC|Rise Estimating LLC|american estimating|maple professionals|international estimating, llc|international estimates, llc|Estemanians, LLC|Dream Estimations|universal estimating llc/i
+body __KAM_BIDEST1A /CSI Estimati(ng|on)|crossland estimating|Williams Estimating|Global Estimation|bolt estimating|prestige estimation|bidding estimating|define estimating|dreamland estimation|swift estimating LLC|define estimating,? LLC|perfect estimation.? llc|estimating solutions.? LLC|rockford estimation.? LLC|define estimating LLC|Rise Estimating LLC|american estimating|maple professionals|international estimating, llc|international estimates, llc|Estemanians, LLC|Dream Estimations|universal estimating llc|unity estimating|Cannon Estimation, LLC/i
header __KAM_BIDEST1B From =~ /bidding|estimat|globalbid/i
-header __KAM_BIDEST1C Subject =~ /bidding|estimati(on|ng)|take.?off|(quote|quotation) (to|for) (bid|project|take.?off)|budget planning|CSI(\b|$)|constructions? project/i
+header __KAM_BIDEST1C Subject =~ /bidding|estimati(on|ng)|take.?off|(quote|quotation) (to|for) (bid|project|take.?off)|budget planning|CSI(\b|$)|constructions? project|project bid proposal/i
#MORE INFO
-body __KAM_BIDEST2 /need assistance with a project|like more information|bidding and estimating service|estimate your projects|project for estimat|need of cost estimation|low cost detailed cost estimates|providing estimation|you really want take-offs|outsourced cost estimation|need any take.?off service|looking for accurate estimat|Take.?off services for any project|need a detailed estimate|offering budget cost estimates|cost estimating services|show you some sample|estimating.?take-offs? service|forward us the bid|quote on your project|(fair|sample) (take.?off|estimate)|complimentary detail from|send (me|us) the drawing|quick introductory call|send us the project's construction plans|quotes for your project|see attached sample|our example work|need any samples|detailed quote|provide detailed quantity take.?off|professional services in Quantity take.?off|provide material take.?off|estimates \& take.?off|20\% discount on your first estimate|cost estimating|architectural projects for us|need of expert construction estimating|handle your construction (take.?offs|estimat)|any job for us regarding estimat|benefit from our estimat|construction estimation service|estimation services are tailored|offer the most precise estimat|detailed commercial estimate/i
+body __KAM_BIDEST2 /need assistance with a project|like more information|bidding and estimating service|estimate your projects|project for estimat|need of cost estimation|low cost detailed cost estimates|providing estimation|you really want take-offs|outsourced cost estimation|need any take.?off service|looking for accurate estimat|Take.?off services for any project|need a detailed estimate|offering budget cost estimates|cost estimating services|show you some sample|estimating.?take-offs? service|forward us the bid|quote on your project|(fair|sample) (take.?off|estimate)|complimentary detail from|send (me|us) the drawing|quick introductory call|send us the project's construction plans|quotes for your project|see attached sample|our example work|need any samples|detailed quote|provide detailed quantity take.?off|professional services in Quantity take.?off|provide material take.?off|estimates \& take.?off|20\% discount on your first estimate|cost estimating|architectural projects for us|need of expert construction estimating|handle your construction (take.?offs|estimat)|any job for us regarding estimat|benefit from our estimat|construction estimation service|estimation services are tailored|offer the most precise estimat|detailed commercial estimate|costing \& take\-?off|too much time on construction take-?off|send us plans for proposal/i
#TITLE
-body __KAM_BIDEST3 /Business Development Manager|(senior|certified) estimator|certified software|(office|marketing) manager|estimation (department|dept|company)|head of business devel|estimating service|estimator|project +manager|Civil, MEP, Architectural|manager of business dev|Sales team/i
+body __KAM_BIDEST3 /Business Development Manager|(senior|certified) estimator|certified software|(office|marketing) manager|estimation (department|dept|company)|head of business devel|estimating service|estimator|project +manager|Civil, MEP, Architectural|manager of business dev|Sales team|estimation department/i
#OBFU
body __KAM_BIDEST4 /\(dot\)/i
#FAKE DOCUSIGN
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __KAM_FAKE_DOCUSIGN1 Content-Type =~ /docusign\.png/i
+ header __KAM_FAKE_DOCUSIGN2 Subject =~ /D0cuSign\: Signature Required/i
- meta KAM_FAKE_DOCUSIGN (__KAM_FAKE_DOCUSIGN1 + T_HTML_ATTACH >= 2)
+ meta KAM_FAKE_DOCUSIGN (__KAM_FAKE_DOCUSIGN1 + T_HTML_ATTACH >= 2) || (__KAM_FAKE_DOCUSIGN2)
describe KAM_FAKE_DOCUSIGN Fake Docusign Document
score KAM_FAKE_DOCUSIGN 3.0
endif
describe KAM_FREEMAIL_ORDER Questionable message about an order but using freemail
score KAM_FREEMAIL_ORDER 3.0
-#RESCORE
-score URI_DOTEDU 0.5
-score ADVANCE_FEE_3_NEW 1.5
-
#PROBLEMATIC 2TLD PROVIDERS
uri KAM_2TLD_PROBLEMS /(\.sa\.com|\.ru\.com|\.plesk\.page)/i
describe KAM_2TLD_PROBLEMS Problematic 2TLD handlers being abused
describe KAM_CALLING Spamming Phone and Answering Solutions
score KAM_CALLING 6.0
-#SA and ZA ABUSE
+#SA and ZA ABUSE + CO.IN
replace_tag ABUSE_DOMAINS (?:\.(sa\.com|za\.com|co\.in))(\b|\/|$|\@)
meta KAM_SA_ZA_ABUSE (__KAM_SA_ZA_ABUSE1 + __KAM_SA_ZA_ABUSE2 >= 1)
describe KAM_SA_ZA_ABUSE 2TLD Providers prevalent in spam abuse
-score KAM_SA_ZA_ABUSE 4.5
+score KAM_SA_ZA_ABUSE 3.0
#FAKE COINBASE
body __KAM_FAKE_COINBASE1 /C\.O\.I\.N\.B\.A\.S\.E/
score KAM_DESZY 6.0
#HEROKU ETC APP EXPLOITS WITH FREEMAIL
+ #VALID URIS
uri __KAM_APPS1 /\.herokuapp\.com|app\.connect365\.io|\.appspot\.com|salesforce\.com\/servlet/i
+ #URIS TO SKIP
+uri __KAM_APPS1A /salesforce\.com\/servlet\/servlet\.ImageServer/i
header __KAM_APPS2A Subject =~ /onedrive/i
header __KAM_APPS2B From:name =~ /onedrive/i
header __KAM_APPS3 From:addr =~ /\.awsapps.com>?$/i
-meta KAM_APPS ( FREEMAIL_FROM + __KAM_APPS1 >= 2 )
+meta KAM_APPS ( FREEMAIL_FROM + (__KAM_APPS1 - __KAM_APPS1A) >= 2 )
describe KAM_APPS Apps being exploited by Spammers
score KAM_APPS 4.0
-meta KAM_APPS2 (__KAM_APPS1 + (__KAM_APPS2A + __KAM_APPS2B >= 1) >= 2)
+meta KAM_APPS2 ((__KAM_APPS1 - __KAM_APPS1A) + (__KAM_APPS2A + __KAM_APPS2B >= 1) >= 2)
describe KAM_APPS2 Fake OneDrive Notification
score KAM_APPS2 4.0
#ACTION
body __KAM_PASSEXP2 /(continue with|Keep my) same password/i
#URI
-uri __KAM_PASSEXP3 /s3\.amazonaws\.com\/.{1,10}\.html/i
+uri __KAM_PASSEXP3 /s3\.amazonaws\.com\/.{1,10}\.html?/i
meta KAM_PASSEXP ( __KAM_PASSEXP1 + __KAM_PASSEXP2 + ( KAM_IPFS + __KAM_PASSEXP3 >= 1 ) >= 3 )
describe KAM_PASSEXP Credential Scam
score KAM_PASSEXP 4.5
#IPFS
-uri KAM_IPFS /(\.|\b|\/)ipfs\.io\/|\/ipfs\/|https?\:\/\/ipfs\.|https?\:\/\/.*\.ipfs\./i
+uri __KAM_IPFS /(\.|\b|\/)ipfs\.io\/|\/ipfs\/|https?\:\/\/ipfs\.|https?\:\/\/.*\.ipfs\./i
+uri __KAM_FALSE_IPFS /(\@|\/|^)ipfs\.com/i
+meta KAM_IPFS ( __KAM_IPFS && !__KAM_FALSE_IPFS)
describe KAM_IPFS Abused Protocol for Distributed Content
score KAM_IPFS 12.0
score KAM_COPOUT 4.5
#DOMAIN/URI TEST CONCEPT
-replace_tag BADCALENDLYURIS (?:jpcalendly|michael\-2900|avolinq|otto\-demosho|jprecruiting|stella\-ridge|nivaai|guammi\-marketing|sethg\-erc|marc\-alderson|randy\-wimmer|video\-animation|julius\-frago|growthtitan|byte\-bridge\-team|flipcausedemo|techerp|leadoverload\-team|twiz|vissia\-ac|eventgives|sephacquisition|mattia\-100|doug\-376|byron\-lewis|selo\-ai|elevatemkt|business-gps-tetsch|nandreaatos|stephanie\-alic)
+replace_tag BADCALENDLYURIS (?:jpcalendly|michael\-2900|avolinq|otto\-demosho|jprecruiting|stella\-ridge|nivaai|guammi\-marketing|sethg\-erc|marc\-alderson|randy\-wimmer|video\-animation|julius\-frago|growthtitan|byte\-bridge\-team|flipcausedemo|techerp|leadoverload\-team|twiz|vissia\-ac|eventgives|sephacquisition|mattia\-100|doug\-376|byron\-lewis|selo\-ai|elevatemkt|business-gps-tetsch|nandreaatos|stephanie\-alic|.*praxis\-business\-brokers\-introduction|tony\-tarkowski|jvrtechllc|fractionl\/sonia-rosa|\-spv|2jm\-9wc\-m84|adrianaidid|bilal\-saeed\-)
replace_rules __KAM_BADCALENDLY
-uri __KAM_BADCALENDLY /https?\:\/\/(www\.)?calendly\.com\/<BADCALENDLYURIS>(?:\/|\?|\b|$)/i
+uri __KAM_BADCALENDLY /https?\:\/\/(www\.)?calendly\.com\/(d\/)?<BADCALENDLYURIS>(?:\/|\?|\b|$)/i
replace_tag BADIGURIS (?:vakninliorcom)
replace_rules __KAM_BADIG
uri __KAM_BADIG /https?\:\/\/(www\.)?instagram\.com\/<BADIGURIS>(?:\/|\?|\b|$)/i
-replace_tag BADYTURIS (?:\@muvisaku|mzVih1bMPVE|PXcdLbnO9I4)
+replace_tag BADYTURIS (?:\@muvisaku|mzVih1bMPVE|PXcdLbnO9I4|\-lkrTRz5Ei8)
replace_rules __KAM_BADYT
-uri __KAM_BADYT /https?\:\/\/(www\.)?(youtube\.com|youtu\.be)\/<BADYTURIS>(?:\/|\?|\b|$)/i
+uri __KAM_BADYT /https?\:\/\/(www\.)?(youtube\.com|youtu\.be)\/(watch\?v\=)?<BADYTURIS>(?:\/|\?|\b|$)/i
replace_tag BADVIMEOURIS (?:446834731|399916650|256117879|268399852|602066576|179069936|540337372|391568499|clumcreative)
replace_rules __KAM_BADVIMEO
replace_rules __KAM_BADTELEGRAMURIS
uri __KAM_BADTELEGRAMURIS /t.me\/<BADTELEGRAMURIS>(?:\/|\?|\b|$)/i
-replace_tag BADSKYPEURIS (?:32a8cfbcf097b10d|2bc4ed65aa40fb3b)
+replace_tag BADSKYPEURIS (?:32a8cfbcf097b10d|2bc4ed65aa40fb3b|feedbackform2019)
replace_rules __KAM_BADSKYPEURIS
-body __KAM_BADSKYPEURIS /live\:\.cid\.<BADSKYPEURIS>(?:\/|\?|\b|$)/i
+body __KAM_BADSKYPEURIS /live\:(\.cid\.)?<BADSKYPEURIS>(?:\/|\?|\b|$)/i
replace_tag BADWHATSAPPURIS (?:40753537389)
replace_rules __KAM_BADWHATSAPPURIS
uri __KAM_BADWHATSAPPURIS /https?\:\/\/wa.me\/<BADWHATSAPPURIS>(?:\/|\?|\b|$)/i
-replace_tag BADFLOWCODEURIS (?:signalsdefense)
+replace_tag BADFLOWCODEURIS (?:signalsdefense|rAcrHS8hy)
replace_rules __KAM_BADFLOWCODEURIS
-uri __KAM_BADFLOWCODEURIS /https?\:\/\/flow\.page\/<BADFLOWCODEURIS>(?:\/|\?|\b|$)/i
+uri __KAM_BADFLOWCODEURIS /https?\:\/\/(flow\.page|flowcode\.com\/p)\/<BADFLOWCODEURIS>(?:\/|\?|\b|$)/i
+
+replace_tag BADBOXURIS (?:x6ddn2vwirubrnh5|3nrerkb3hstmpqx9|x6ddn2vwirubrnh5|q3629y3ewqvpmzb3|ic47i4xh8ms6pdd2|wr55diqj4rs785v3|bk5bdzzqbg2f9r7r)
+replace_rules __KAM_BADBOXURIS
+uri __KAM_BADBOXURIS /https?\:\/\/docsend\.com\/view\/<BADBOXURIS>(?:\/|\?|\b|\#|$)/i
+
+replace_tag BADHUBSPOTURIS (?:timote\-chanut|keaton\-flanigan)
+replace_rules __KAM_BADHUBSPOTURIS
+uri __KAM_BADHUBSPOTURIS /https?\:\/\/meetings\.hubspot\.com\/<BADHUBSPOTURIS>(?:\/|\?|\b|$)/i
-meta KAM_BADDOMAINURI (__KAM_BADCALENDLY + __KAM_BADIG + __KAM_BADYT + __KAM_BADVIMEO + __KAM_BADMEDIUM + __KAM_BADFIVERR + __KAM_BADGSITES + __KAM_BADDYNAMICS + __KAM_BADTELEGRAMURIS + __KAM_BADSKYPEURIS + __KAM_BADWHATSAPPURIS + __KAM_BADFLOWCODEURIS >= 1)
+meta KAM_BADDOMAINURI (__KAM_BADCALENDLY + __KAM_BADIG + __KAM_BADYT + __KAM_BADVIMEO + __KAM_BADMEDIUM + __KAM_BADFIVERR + __KAM_BADGSITES + __KAM_BADDYNAMICS + __KAM_BADTELEGRAMURIS + __KAM_BADSKYPEURIS + __KAM_BADWHATSAPPURIS + __KAM_BADFLOWCODEURIS + __KAM_BADBOXURIS + __KAM_BADHUBSPOTURIS >= 1)
describe KAM_BADDOMAINURI Blocked domain/uri combo
score KAM_BADDOMAINURI 9.0
score KAM_TRACKING_REDIR 4.5
#FAKE SAFE SENDERS LIST
-body __KAM_FAKE_SAFESENDER1 /This sender has been verified from the.*safe senders? list/
+body __KAM_FAKE_SAFESENDER1 /This sender has been verified from the.{1,32}safe senders? list/
meta KAM_FAKE_SAFESENDER ( __KAM_FAKE_SAFESENDER1 >= 1 )
describe KAM_FAKE_SAFESENDER Email shows up with a safe sender notice
score KAM_FAKE_SAFESENDER 1.0
#CHECKFILE
-body __KAM_CHECKFILE1 /(File|Document)\: https?\:\/\/.*\/.{2,5}\/\?/i
+body __KAM_CHECKFILE1 /(File|Document)\: https?\:\/\/.{8,128}\/.{2,5}\/\?/i
meta KAM_CHECKFILE ( __KAM_CHECKFILE1 >= 1)
describe KAM_CHECKFILE Likely File link abuse
score KAM_FAKE_GOOGLEGROUP 9.0
#LEAD FORENSICS
-body __KAM_LEAD_FORENSICS1 /leadforensics.*com|Lead Forensics/i
+body __KAM_LEAD_FORENSICS1 /leadforensics.{1,32}com|Lead Forensics/i
meta KAM_LEAD_FORENSICS ( __KAM_LEAD_FORENSICS1 >= 1 )
describe KAM_LEAD_FORENSICS Domain hopping spamming engine
#FAKE_NETFLIX
#domain mismatch
-header __KAM_FAKE_NETFLIX1A From:name =~ /Netflix/i
+header __KAM_FAKE_NETFLIX1A From:name =~ /(watch|Net)flix/i
header __KAM_FAKE_NETFLIX1B From:addr !~ /netflix\.com/i
#fuzz
header __KAM_FAKE_NETFLIX2A From:addr =~ /NetfIix/i
describe GB_EMPTY_CALENDAR Empty message with a calendar attachment
score GB_EMPTY_CALENDAR -2.0
+#EMPTY MESSAGE FP FOR IMAGES
+meta GB_EMPTY_IMAGES ( EMPTY_MESSAGE && __ANY_IMAGE_ATTACH )
+describe GB_EMPTY_IMAGES Empty message with an attached image
+score GB_EMPTY_IMAGES -2.0
+
#FAKE LOWES
#domain
header __KAM_FAKE_LOWES_1A From:name =~ /lowes.?home.?improvement|Lowes.?(shopper|Store)|LowesHome/i
score GB_BIZZABO_REDIR 1.5
# Windows redirector
-uri GB_WINDOWS_REDIR m|^https?://\w+.blob.core.windows.net/\w+/\w+.html\#\w{2}/\d{5}_md/\d+/|i
+uri GB_WINDOWS_REDIR m|^https?://\w+.blob.core.windows.net/\w+/\w+.html?\#\w{2}/\d{5}_md/\d+/|i
describe GB_WINDOWS_REDIR Windows redirector
score GB_WINDOWS_REDIR 4.5
score GB_ONECLICK_REDIR 1.5
# Powerobjects redirector
-uri GB_POWEROBJECTS_REDIR m;^https?://go\.onelink\.me/\d+\?pid=InProduct.{16,128}&af_web_dp=https?://;i
+uri GB_POWEROBJECTS_REDIR m;^https?://pocloudcentral\.crm\.powerobjects\.net/PowerEmailWebsite/GetUrl\d+\.aspx\?.{16,128}\&pval=https?://;i
describe GB_POWEROBJECTS_REDIR Powerobjects redirector
score GB_POWEROBJECTS_REDIR 1.5
+# Kmail-lists redirector
+uri GB_KMAIL_LISTS_REDIR m;^https?://manage\.kmail\-lists\.com/subscriptions/subscribe/update\?.{16,128}&r=https?;i
+describe GB_KMAIL_LISTS_REDIR Kmail-lists redirector
+score GB_KMAIL_LISTS_REDIR 1.5
+
+# Emlnk redirector
+uri GB_EMLNK_REDIR m;^https?://\w+\.\w+\.emlnk\.com/Prod/link\-tracker\?.{4,64}&redirectUrl=;i
+describe GB_EMLNK_REDIR Emlnk redirector
+score GB_EMLNK_REDIR 1.5
+
+# Benchurl redirector
+uri GB_BENCH_REDIR m;^https?://clt\d{4,16}\.benchurl\.com/c/l\?.{8,64}&email\=;i
+describe GB_BENCH_REDIR Benchurl redirector
+score GB_BENCH_REDIR 1.5
+
+# Originsmarket redirector
+uri GB_ORIGINSMARKET_REDIR m;https?://sp\-track\.originsmarket\.com\.au/api/v1/track/click/\d+/\d+/.{32,64}\?redirecturl=https?://;i
+describe GB_ORIGINSMARKET_REDIR Originsmarket redirector
+score GB_ORIGINSMARKET_REDIR 1.5
+
+# Contactmonkey redirector
+uri GB_CONTACTMONKEY_REDIR m;^https?://contactmonkey\.com/api/v1/tracker.{32,256}\&cm_destination=https?://;i
+describe GB_CONTACTMONKEY_REDIR Contactmonkey redirector
+score GB_CONTACTMONKEY_REDIR 1.5
+
+# Turkmenportal redirector
+uri GB_TURKMEN_REDIR m;^https?://turkmenportal\.com/\w{2}/banner/\w/leave\?url=(?:https?:)?//;i
+describe GB_TURKMEN_REDIR Turkmenportal redirector
+score GB_TURKMEN_REDIR 1.5
+
+# Zafos redirector
+uri GB_ZAFOS_REDIR m;^https?://zafos\.com/app/newsletter/tracklink\?.{8,32}\&tid=https?://;i
+describe GB_ZAFOS_REDIR Zafos redirector
+score GB_ZAFOS_REDIR 1.5
+
# Generic Php redirector
uri GB_PHP_REDIR /\.php\?url=https?\:\/\//
describe GB_PHP_REDIR Php redirector
score GB_PHP_REDIR 1.0
+# href.li abused redirector
+uri GB_HREF_LI_REDIR m;https?://href\.li/\??https?://;i
+describe GB_HREF_LI_REDIR Href.li abused redirector
+score GB_HREF_LI_REDIR 2.5
+
+if (version >= 4.000000)
+ if can(Mail::SpamAssassin::Conf::feature_capture_rules)
+ ifplugin Mail::SpamAssassin::Plugin::AskDNS
+ uri __GAD_REDIR_URL m;(?:adclick\.\w\.doubleclick\.net/pcs/click|(?:www)?\.googleadservices\.com/pagead/aclk)\?.{64,1024}\&adurl=https?//(?<GAD_REDIR_URL>.*)/;
+ askdns GB_GAD_REDIR _GAD_REDIR_URL_.wild.pccc.com A 127.0.0.4
+ describe GB_GAD_REDIR Abused Google Ads redirector
+ score GB_GAD_REDIR 9.0
+
+ uri __G_REDIR_URL m;https?://(?:www\.)?google\.\w+/amp/s/(?<G_REDIR_URL>.*)/?;
+ askdns GB_G_REDIR _G_REDIR_URL_.wild.pccc.com A 127.0.0.4
+ describe GB_G_REDIR Abused Google search redirector
+ score GB_G_REDIR 9.0
+ endif
+ endif
+endif
+
#TLDSCHINA
body __KAM_TLDSCHINA1 /t ?l ?d ?s ?c ?h ?i ?n ?a\[\.\]com|0086\-21\-619\-18\-696/i
meta KAM_FAKE_QUOTE ( __KAM_FAKE_QUOTE1 + FREEMAIL_FROM >= 2 )
describe KAM_FAKE_QUOTE Fake Quotes Signup Notice
-score KAM_FAKE_QUOTE 3.0
+score KAM_FAKE_QUOTE 6.0
#FAKE HOTEL ROOM
replace_rules __GB_FAKE_HOTEL
#PENPAL
#subject
-header __KAM_PENPAL1 Subject =~ /^(GREETINGS|HI)$/i
+header __KAM_PENPAL1 Subject =~ /^(GREETINGS|HI)$|GET WRITING/i
#intro
body __KAM_PENPAL2 /my name is|I\'m from Sweden/i
#penpal
body __KAM_PENPAL3 /pen.?pal/i
#topic
-body __KAM_PENPAL4 /talk *anything|talk about (everything|anything)|look forward to hear/i
+body __KAM_PENPAL4 /talk *anything|talk about (everything|anything)|look forward to hear|contact details online/i
meta KAM_PENPAL ( __KAM_PENPAL1 + __KAM_PENPAL2 + __KAM_PENPAL3 + __KAM_PENPAL4 >= 4 )
describe KAM_PENPAL Pen Pal Scams
#from:name
header __KAM_FAKE_DRIVE1 From:name =~ /(Ch<A1>s<E1>|W<E1>(1|l|I)(1|l|I)s.?F<A1>rg<O1>).?(B<A1>nk|S<E1>c|R<E1>g<A1>|R<E1>v<I1>|H<E1>lp)/i
#from:addr
-header __KAM_FAKE_DRIVE2 From:addr =~ /drive-shares-dm-noreply\@google\.com/i
+header __KAM_FAKE_DRIVE2 From:addr =~ /drive\-shares\-dm\-noreply\@google\.com/i
#subj
header __KAM_FAKE_DRIVE3 Subject =~ /Scam Sign.?in Detected|Bank ID Locked|Account Frozen|Fraud Sign.?in/i
# Fake invoice links to Google Cloud
ifplugin Mail::SpamAssassin::Plugin::URIDetail
- uri_detail GB_GOOGLE_INVOICE cleaned =~ /\d+\.\d+\.\d+\.\d+\.bc\.googleusercontent\.com/ text =~ /invoice|fattura/i
- describe GB_GOOGLE_INVOICE Fake Invoice stored on Google cloud
+ uri_detail __GB_GOOGLE_INVOICE0 cleaned =~ /(?:\d+\.\d+\.\d+\.\d+\.bc\.googleusercontent\.com|(?:adclick|googleads)\.\w\.doubleclick\.net\/(?:aclk|pcs\/click))/ text =~ /document|invoice|fattura/i
+ uri __GB_GOOGLE_INVOICE1 /(?:\d+\.\d+\.\d+\.\d+\.bc\.googleusercontent\.com|adclick\.\w\.doubleclick\.net\/pcs\/click).{1,8}Payment.Invoice/i
+ meta GB_GOOGLE_INVOICE ( __GB_GOOGLE_INVOICE0 + __GB_GOOGLE_INVOICE1 >= 1 )
+ describe GB_GOOGLE_INVOICE Fake Invoice stored on Google cloud/ads
score GB_GOOGLE_INVOICE 4.0
endif
#COST
body __KAM_PIANO3 /free|gifting|offering|give away/i
#SUBJ
-header __KAM_PIANO4 Subject =~ /want this|beautiful piano|instrument/i
+header __KAM_PIANO4 Subject =~ /want this|beautiful piano|instrument|piano donation|baby grand|['`] +piano|yamaha piano/i
meta KAM_PIANO ( __KAM_PIANO1 + __KAM_PIANO2 + __KAM_PIANO3 + __KAM_PIANO4 + (__KAM_EDU_FROM + FREEMAIL_FROM >= 1) >= 5 )
-describe KAM_PIANO Likely Piano Scam (yes, Piano Scams are a real thing apparently)
+describe KAM_PIANO Likely Piano Scam (yes, Piano Scams are a real thing apparently. "Sing us a song, you're the piano scam...")
score KAM_PIANO 7.5
ifplugin Mail::SpamAssassin::Plugin::RaptorOnly
#FIT LLC
replace_rules __KAM_FIT1
-body __KAM_FIT1 /Email sent by F<I1>T, LLC|newsletter on behalf of (prestige publishing|Event Horizon) LLC/im
+body __KAM_FIT1 /Email (was |is )?sent by:? (Event Horizon LLC|F<I1>T, LLC)|(email was sent|newsletter).{0,35} (operator of|on behalf of) (prestige publishing|Event Horizon) LLC|Polaris Advertising is the operator and proprietor/im
meta KAM_FIT ( __KAM_FIT1 >= 1 )
describe KAM_FIT Spamming spammers who spam
-score KAM_FIT 5.0
-
-#Lowering for FPs
-score HTML_IMAGE_ONLY_08 1.0
-score SUSPICIOUS_RECIPS 2.0
+score KAM_FIT 6.0
#FAKE FIDELITY
body __KAM_FAKE_FIDELITY1 /we are brokers/i
describe KAM_FAKE_FIDELITY Likely Fake Brokerage Emails
score KAM_FAKE_FIDELITY 4.5
+#FAKE AIRDROP
+body __KAM_FAKE_AIRDROP1 /claim airdrop/i
+uri __KAM_FAKE_AIRDROP2 /\.sendgrid.net\//i
+header __KAM_FAKE_AIRDROP3 From:name =~ /cointracker/i
+header __KAM_FAKE_AIRDROP4 From:addr !~ /cointracker\.io/i
+header __KAM_FAKE_AIRDROP5 Subject =~ /Arbitrum Airdrop/i
+
+meta KAM_FAKE_AIRDROP ( __KAM_FAKE_AIRDROP1 + __KAM_FAKE_AIRDROP2 + __KAM_FAKE_AIRDROP3 + __KAM_FAKE_AIRDROP4 + __KAM_FAKE_AIRDROP5 >= 5 )
+describe KAM_FAKE_AIRDROP Fake Air Drop / Coin Email
+score KAM_FAKE_AIRDROP 6.0
+
+#PAGE GROUp
+ #Title
+body __KAM_PAGE_GROUP1 /Talent Acquisition Specialist/i
+ #Name
+body __KAM_PAGE_GROUP2 /Michael Page Recruitment/i
+
+meta KAM_PAGE_GROUP ( __KAM_PAGE_GROUP1 + __KAM_PAGE_GROUP2 >= 2)
+describe KAM_PAGE_GROUP Page Recruiting Scam
+score KAM_PAGE_GROUP 5.0
+
+#GOOGLE SCRIPTS
+uri __KAM_GOOGLE_SCRIPT /script\.google\.com/i
+
+#FAKE AMAZON
+header __KAM_FAKE_AMAZON_NOTICE1 Subject =~ /Amazon Membership Update/i
+
+meta KAM_FAKE_AMAZON_NOTICE ( __KAM_FAKE_AMAZON_NOTICE1 + __KAM_GOOGLE_SCRIPT >= 2 )
+describe KAM_FAKE_AMAZON_NOTICE Fake Amazon Notice
+score KAM_FAKE_AMAZON_NOTICE 6.0
+
+#PATHOS PR
+body __KAM_PATHOS1 /PR firm|spots left for an article/i
+body __KAM_PATHOS2 /(Pathos|Pay on Results) (PR|Media)/i
+body __KAM_PATHOS3 /(\b|^)((managing|marketing) (director|partner)|team lead|Partner)(\b|$)/i
+body __KAM_PATHOS4 /opt-?out|opt-?ing out/i
+
+meta KAM_PATHOS ( __KAM_PATHOS1 + __KAM_PATHOS2 + __KAM_PATHOS3 + __KAM_PATHOS4 >= 4 )
+describe KAM_PATHOS Pathos Payonresults Spam
+score KAM_PATHOS 8.0
+
+#FAKE DOCUSIGN
+header __KAM_FAKE_DOCUSIGN2_1 Subject =~ /signature required/i
+uri __KAM_FAKE_DOCUSIGN2_2 /mimecastprotect.com.*urldefense.proofpoint.co/i
+body __KAM_FAKE_DOCUSIGN2_3 /docusign/i
+
+meta KAM_FAKE_DOCUSIGN2 ( __KAM_FAKE_DOCUSIGN2_1 + __KAM_FAKE_DOCUSIGN2_2 + __KAM_FAKE_DOCUSIGN2_3 >= 3 )
+describe KAM_FAKE_DOCUSIGN2 Likely Fake DocuSign Email
+score KAM_FAKE_DOCUSIGN2 4.5
+
+#VIRTUAL BOOKKEEPER
+ #SUBJ
+header __KAM_BOOKKEEP1 Subject =~ /(Accounting|Bookkeeping) ?(\/|\&) ?(Bookkeeping|Accounting)|Help with bookkeeping|bookkeeping for|bookkeeping a hassle|outsourced Bookkeeping|ease your bookkeeping|(accounting|bookkeeping)\/tax prep service|virtual (accounting|bookkeeping|bookkeeper|accountant)|affordable (accounting|bookkeeping) solution|be your in.?house (accounting|bookkeeping)/i
+ #FOLLOW/COLD
+body __KAM_BOOKKEEP2 /sent you a message|my name is|reply with an optimal number for me to reach|helped a business in your state|reply with a good time\/number to reach|respond a time for us to talk|helping businesses outsource all their bookkeeping|give you a quick call|assisted a company (organize|manage) two years of books|follow back on my message|reply back with a good line|give you a brief line|convenient time to connect|brief minute to discuss|follow up on my last email|received my note from a couple of days|what time works best|set up a time to chat|reached out a couple of days ago|schedule a time to connect/i
+tflags __KAM_BOOKKEEP2 nosubject
+ #SALE
+body __KAM_BOOKKEEP3 /(explore|see|check) if (we\'?re|we are) a (match|fit)|paying huge amounts of money for bookkeeping|open to a quick call|streamline bookkeeping needs|fed up with keeping your own books|transform your bookkeeping|accounting for (tons|thousands) of companies just like|no\-stress bookkeeping solution|wasting a lot of time doing bookkeeping|benefit from help keeping books|manag(e|ing) bookkeeping \& accounting requirements for lots of (companies|customers)|interested to hire a dedicated remote (tax|accountant|bookkeeper)|assist businesses handle their books|extra hand with bookkeeping|client in your state|we saved \d+ hours a month/im
+tflags __KAM_BOOKKEEP3 nosubject
+
+meta KAM_BOOKKEEP ( __KAM_BOOKKEEP1 + __KAM_BOOKKEEP2 + __KAM_BOOKKEEP3 + FREEMAIL_FROM >= 4 )
+describe KAM_BOOKKEEP Bookkeeping and Accounting Spams
+score KAM_BOOKKEEP 6.0
+
+#LATEST APP DEV SPAMS
+ #subj
+header __KAM_APPDEV1 Subject =~ /App Prices|healthcare app|app offer|new app|follow up|mobile app(lication|s)? company|Mobile App$|improve your app/i
+ #location or type of app
+body __KAM_APPDEV2 /(companies|based) in India|Indian.?Based|Rani$|(handyman|fitness|Entertainment|Shopping|hospital|real.?estate|Taxi|custom business|store|booking) App/i
+tflags __KAM_APPDEV2 nosubject
+ #COLD
+body __KAM_APPDEV3 /My name is|chance to review my email|I work with \d+\+ experienced IT|if you are interested|chance to peruse through it/i
+tflags __KAM_APPDEV3 nosubject
+ #AppDev
+body __KAM_APPDEV4 /app developer|app for your domain|best mobile app devel|app development manager|app development service/i
+tflags __KAM_APPDEV4 nosubject
+ #PRICE
+body __KAM_APPDEV5 /mobile app price list|cost efficient|price list \& sample|catalog price|meeting to discuss details}|share ballpark estimat/i
+tflags __KAM_APPDEV5 nosubject
+
+meta KAM_APPDEV ( __KAM_APPDEV1 + __KAM_APPDEV2 + __KAM_APPDEV3 + __KAM_APPDEV4 + __KAM_APPDEV5 + FREEMAIL_FROM >= 6)
+describe KAM_APPDEV Application Developer Spams
+score KAM_APPDEV 9.0
+
+#FAKE METAMASK
+ #FROM
+header __KAM_FAKE_METAMASK1 From:name =~ /metamask/i
+ #CRYPTO
+header __KAM_FAKE_METAMASK2 Subject =~ /wallet has been (suspended|limited)/i
+ #NOT META
+header __KAM_FAKE_METAMASK3 From:addr !~ /\@metamask\.com/i
+ #TASK
+body __KAM_FAKE_METAMASK4 /Up(grade|date) (here|Now)|activate and verify/i
+
+meta KAM_FAKE_METAMASK ( __KAM_FAKE_METAMASK1 + __KAM_FAKE_METAMASK2 + __KAM_FAKE_METAMASK3 + __KAM_FAKE_METAMASK4 >= 4 )
+describe KAM_FAKE_METAMASK Fake MetaMask Crypto Notification
+score KAM_FAKE_METAMASK 6.0
+
#EOF
--- /dev/null
+
+# NOTE: freemail_domains in KAM.cf also needs to be updated for FREEMAIL_FROM
+# update freemail domain list by running:
+# make freemail
+
+if (version >= 3.004003)
+ ifplugin Mail::SpamAssassin::Plugin::FreeMail
+ freemail_domains 020.co.uk
+ freemail_domains 111mail.com
+ freemail_domains 123.com
+ freemail_domains 123box.net
+ freemail_domains 123india.com
+ freemail_domains 123iran.com
+ freemail_domains 123mail.cl
+ freemail_domains 123mail.org
+ freemail_domains 123qwe.co.uk
+ freemail_domains 126.com
+ freemail_domains 138mail.com
+ freemail_domains 139.com
+ freemail_domains 141.ro
+ freemail_domains 150mail.com
+ freemail_domains 150ml.com
+ freemail_domains 163.com
+ freemail_domains 16mail.com
+ freemail_domains 188.com
+ freemail_domains 189.cn
+ freemail_domains 1963chevrolet.com
+ freemail_domains 1963pontiac.com
+ freemail_domains 1netdrive.com
+ freemail_domains 1st-website.com
+ freemail_domains 1stpd.net
+ freemail_domains 2-mail.com
+ freemail_domains 20after4.com
+ freemail_domains 21cn.com
+ freemail_domains 24h.co.jp
+ freemail_domains 24horas.com
+ freemail_domains 263.net
+ freemail_domains 271soundview.com
+ freemail_domains 2die4.com
+ freemail_domains 2mydns.com
+ freemail_domains 2net.us
+ freemail_domains 3000.it
+ freemail_domains 37.com
+ freemail_domains 3ammagazine.com
+ freemail_domains 3email.com
+ freemail_domains 3xl.net
+ freemail_domains 4-music-today.com
+ freemail_domains 420email.com
+ freemail_domains 444.net
+ freemail_domains 4degreez.com
+ freemail_domains 4email.com
+ freemail_domains 4email.net
+ freemail_domains 4newyork.com
+ freemail_domains 4xn.de
+ freemail_domains 5005.lv
+ freemail_domains 50mail.com
+ freemail_domains 55mail.cc
+ freemail_domains 5fm.za.com
+ freemail_domains 5x2.de
+ freemail_domains 5x2.me
+ freemail_domains 6210.hu
+ freemail_domains 6sens.com
+ freemail_domains 702mail.co.za
+ freemail_domains 7110.hu
+ freemail_domains 8848.net
+ freemail_domains 8m.com
+ freemail_domains 8m.net
+ freemail_domains 8u8.com
+ freemail_domains 8u8.hk
+ freemail_domains 8u8.tw
+ freemail_domains 8x.com.br
+ freemail_domains 9.cn
+ freemail_domains a-teens.net
+ freemail_domains a-topmail.at
+ freemail_domains a.org.ua
+ freemail_domains abha.cc
+ freemail_domains about.com
+ freemail_domains abv.bg
+ freemail_domains acatperson.com
+ freemail_domains acceso.or.cr
+ freemail_domains access4less.net
+ freemail_domains accessgcc.com
+ freemail_domains accountant.com
+ freemail_domains acdcfan.com
+ freemail_domains acmemail.net
+ freemail_domains actingbiz.com
+ freemail_domains activist.com
+ freemail_domains adexec.com
+ freemail_domains adiga.com
+ freemail_domains adinet.com.uy
+ freemail_domains adogperson.com
+ freemail_domains adres.nl
+ freemail_domains advalvas.be
+ freemail_domains aeiou.pt
+ freemail_domains aeneasmail.com
+ freemail_domains africamail.com
+ freemail_domains afrik.com
+ freemail_domains afropoets.com
+ freemail_domains agadir.cc
+ freemail_domains aggies.com
+ freemail_domains ahaa.dk
+ freemail_domains ahsa.ws
+ freemail_domains aichi.com
+ freemail_domains aim.com
+ freemail_domains aircraftmail.com
+ freemail_domains airpost.net
+ freemail_domains aiutamici.com
+ freemail_domains ajman.cc
+ freemail_domains ajman.us
+ freemail_domains ajman.ws
+ freemail_domains aklan.com
+ freemail_domains aknet.kg
+ freemail_domains alabama.usa.com
+ freemail_domains alaska.usa.com
+ freemail_domains alavatotal.com
+ freemail_domains albafind.com
+ freemail_domains albaha.cc
+ freemail_domains albawaba.com
+ freemail_domains alburaq.net
+ freemail_domains aldeax.com
+ freemail_domains aldeax.com.ar
+ freemail_domains alex4all.com
+ freemail_domains alexandria.cc
+ freemail_domains algeria.com
+ freemail_domains algerie.cc
+ freemail_domains alice.it
+ freemail_domains alinto.com
+ freemail_domains aliyun.com
+ freemail_domains all4theskins.com
+ freemail_domains allergist.com
+ freemail_domains allhiphop.com
+ freemail_domains allmail.net
+ freemail_domains allsportsrock.com
+ freemail_domains alriyadh.cc
+ freemail_domains alskens.dk
+ freemail_domains altavista.se
+ freemail_domains altbox.org
+ freemail_domains alternativagratis.com
+ freemail_domains alum.com
+ freemail_domains alumni.com
+ freemail_domains alumnidirector.com
+ freemail_domains alunos.unipar.br
+ freemail_domains alvilag.hu
+ freemail_domains alwaysgrilling.com
+ freemail_domains alwaysinthekitchen.com
+ freemail_domains alwayswatchingmovies.com
+ freemail_domains alwayswatchingtv.com
+ freemail_domains amenworld.com
+ freemail_domains america.hm
+ freemail_domains americamail.com
+ freemail_domains amman.cc
+ freemail_domains amnetsal.com
+ freemail_domains amorous.com
+ freemail_domains ananzi.co.za
+ freemail_domains anatomicrock.com
+ freemail_domains anet.ne.jp
+ freemail_domains anfmail.com
+ freemail_domains angelfire.com
+ freemail_domains angelic.com
+ freemail_domains animail.net
+ freemail_domains animeone.com
+ freemail_domains aniverse.com
+ freemail_domains anjungcafe.com
+ freemail_domains another.com
+ freemail_domains antedoonsub.com
+ freemail_domains antwerpen.com
+ freemail_domains anunciador.net
+ freemail_domains anytimenow.com
+ freemail_domains aol.co.uk
+ freemail_domains aol.com
+ freemail_domains aon.at
+ freemail_domains apexmail.com
+ freemail_domains apollo.lv
+ freemail_domains appraiser.net
+ freemail_domains approvers.net
+ freemail_domains aprava.com
+ freemail_domains apropo.ro
+ freemail_domains aqaba.cc
+ freemail_domains arab.ir
+ freemail_domains arar.ws
+ freemail_domains archaeologist.com
+ freemail_domains arcor.de
+ freemail_domains arcticmail.com
+ freemail_domains argentina.com
+ freemail_domains arizona.usa.com
+ freemail_domains arkansas.usa.com
+ freemail_domains armmail.com
+ freemail_domains army.com
+ freemail_domains arnet.com.ar
+ freemail_domains aroma.com
+ freemail_domains arrl.net
+ freemail_domains artlover.com
+ freemail_domains aruba.it
+ freemail_domains asheville.com
+ freemail_domains asia-links.com
+ freemail_domains asia-mail.com
+ freemail_domains asia.com
+ freemail_domains asiamail.com
+ freemail_domains asiancutes.com
+ freemail_domains assala.com
+ freemail_domains assamesemail.com
+ freemail_domains asurfer.com
+ freemail_domains aswan.cc
+ freemail_domains asylum.com
+ freemail_domains atheist.com
+ freemail_domains atl.lv
+ freemail_domains atlas.cz
+ freemail_domains atlas.sk
+ freemail_domains atozasia.com
+ freemail_domains atreillou.com
+ freemail_domains att.ne.jp
+ freemail_domains att.net
+ freemail_domains au.ru
+ freemail_domains aubenin.com
+ freemail_domains auctioneer.net
+ freemail_domains auf-steroide.de
+ freemail_domains aufdrogen.de
+ freemail_domains aus-city.com
+ freemail_domains ausi.com
+ freemail_domains aussiemail.com.au
+ freemail_domains australiamail.com
+ freemail_domains autoindia.com
+ freemail_domains autopm.com
+ freemail_domains avasmail.com.mv
+ freemail_domains axarnet.com
+ freemail_domains ayna.com
+ freemail_domains azet.sk
+ freemail_domains b-boy.com
+ freemail_domains baalbeck.cc
+ freemail_domains babbalu.com
+ freemail_domains badgers.com
+ freemail_domains bahraini.cc
+ freemail_domains bakpaka.com
+ freemail_domains bakpaka.net
+ freemail_domains balochistan.org
+ freemail_domains baluch.com
+ freemail_domains bama-fan.com
+ freemail_domains bancora.net
+ freemail_domains banha.cc
+ freemail_domains bankersmail.com
+ freemail_domains barlick.net
+ freemail_domains barriolife.com
+ freemail_domains bartender.net
+ freemail_domains basketball-email.com
+ freemail_domains beabookworm.com
+ freemail_domains beagolfer.com
+ freemail_domains beahealthnut.com
+ freemail_domains beautifulboy.com
+ freemail_domains beeebank.com
+ freemail_domains beehive.org
+ freemail_domains been-there.com
+ freemail_domains beirut.com
+ freemail_domains believeinliberty.com
+ freemail_domains belizehome.com
+ freemail_domains belizemail.net
+ freemail_domains belizeweb.com
+ freemail_domains bellair.net
+ freemail_domains bellsouth.net
+ freemail_domains berlin.com
+ freemail_domains berlin.de
+ freemail_domains besser-als-du.de
+ freemail_domains bestcoolcars.com
+ freemail_domains bestjobcandidate.com
+ freemail_domains bestmail.us
+ freemail_domains besure2vote.com
+ freemail_domains bflomail.com
+ freemail_domains bgay.com
+ freemail_domains bgnmail.com
+ freemail_domains bharatmail.com
+ freemail_domains bicycledata.com
+ freemail_domains bicycling.com
+ freemail_domains big-orange.com
+ freemail_domains bigboss.cz
+ freemail_domains bigfoot.com
+ freemail_domains bigger.com
+ freemail_domains bigheavyworld.com
+ freemail_domains bigmailbox.com
+ freemail_domains bigmailbox.net
+ freemail_domains bigmir.net
+ freemail_domains bigpond.com
+ freemail_domains bigstring.com
+ freemail_domains bigtimecatperson.com
+ freemail_domains bigtimedogperson.com
+ freemail_domains bigtimereader.com
+ freemail_domains bigtimesportsfan.com
+ freemail_domains bikerheaven.net
+ freemail_domains bikerider.com
+ freemail_domains bikermail.com
+ freemail_domains billssite.com
+ freemail_domains bip.net
+ freemail_domains birdlover.com
+ freemail_domains bitwiser.com
+ freemail_domains biz.by
+ freemail_domains bizerte.cc
+ freemail_domains bizhosting.com
+ freemail_domains black-sea.ro
+ freemail_domains blackandchristian.com
+ freemail_domains blackburnmail.com
+ freemail_domains blackcity.net
+ freemail_domains blackglobalnetwork.net
+ freemail_domains blackvault.com
+ freemail_domains blackvoices.com
+ freemail_domains blader.com
+ freemail_domains blida.info
+ freemail_domains blink182.net
+ freemail_domains blue.devils.com
+ freemail_domains bluebottle.com
+ freemail_domains bluemail.ch
+ freemail_domains blumail.org
+ freemail_domains blvds.com
+ freemail_domains bmx.lv
+ freemail_domains bmxtrix.com
+ freemail_domains boardermail.com
+ freemail_domains boarderzone.com
+ freemail_domains boatnerd.com
+ freemail_domains bol.com.br
+ freemail_domains bolando.com
+ freemail_domains bolbox.com
+ freemail_domains bollywood2000.com
+ freemail_domains bollywoodz.com
+ freemail_domains bombka.dyn.pl
+ freemail_domains bonbon.net
+ freemail_domains bongmail.com
+ freemail_domains boom.com
+ freemail_domains bootmail.com
+ freemail_domains bostonoffice.com
+ freemail_domains bowl.com
+ freemail_domains box.az
+ freemail_domains boxbg.com
+ freemail_domains boxemail.com
+ freemail_domains brain.com.pk
+ freemail_domains brainsurfer.de
+ freemail_domains brasilia.net
+ freemail_domains bravanese.com
+ freemail_domains brazilmail.com
+ freemail_domains brazilmail.com.br
+ freemail_domains breathe.com
+ freemail_domains brestonline.com
+ freemail_domains brew-master.com
+ freemail_domains brew-meister.com
+ freemail_domains brfree.com.br
+ freemail_domains brujula.net
+ freemail_domains bsdmail.com
+ freemail_domains btcc.org
+ freemail_domains buffaloes.com
+ freemail_domains bulgaria.com
+ freemail_domains bulldogs.com
+ freemail_domains bumerang.ro
+ freemail_domains buraydah.cc
+ freemail_domains burntmail.com
+ freemail_domains butch-femme.net
+ freemail_domains butch-femme.org
+ freemail_domains buzy.com
+ freemail_domains buzzjakkerz.com
+ freemail_domains byke.com
+ freemail_domains c-box.cz
+ freemail_domains c3.hu
+ freemail_domains c4.com
+ freemail_domains cadinfo.net
+ freemail_domains calcfacil.com.br
+ freemail_domains calcware.org
+ freemail_domains california.usa.com
+ freemail_domains californiamail.com
+ freemail_domains calle22.com
+ freemail_domains callnetuk.com
+ freemail_domains camaroclubsweden.com
+ freemail_domains cameroon.cc
+ freemail_domains canada-11.com
+ freemail_domains canada.com
+ freemail_domains canal21.com
+ freemail_domains cannabismail.com
+ freemail_domains canoemail.com
+ freemail_domains capsfanatic.com
+ freemail_domains capshockeyfan.com
+ freemail_domains capsred.com
+ freemail_domains car-nut.net
+ freemail_domains caramail.com
+ freemail_domains cardblvd.com
+ freemail_domains care-mail.com
+ freemail_domains care2.com
+ freemail_domains caress.com
+ freemail_domains carioca.net
+ freemail_domains cash4u.com
+ freemail_domains cashette.com
+ freemail_domains casino.com
+ freemail_domains casinomail.com
+ freemail_domains cat-person.com
+ freemail_domains cataloniamail.com
+ freemail_domains catalunyamail.com
+ freemail_domains cataz.com
+ freemail_domains catcha.com
+ freemail_domains catholic.org
+ freemail_domains caths.co.uk
+ freemail_domains catlover.com
+ freemail_domains catlovers.com
+ freemail_domains catpeoplerule.com
+ freemail_domains caxess.net
+ freemail_domains cbrmail.com
+ freemail_domains cc.lv
+ freemail_domains cemelli.com
+ freemail_domains centoper.it
+ freemail_domains centralpets.com
+ freemail_domains centrum.cz
+ freemail_domains centrum.sk
+ freemail_domains centurylink.net
+ freemail_domains cercaziende.it
+ freemail_domains certifiedbitches.com
+ freemail_domains cgac.es
+ freemail_domains chaiyo.com
+ freemail_domains chaiyomail.com
+ freemail_domains championboxing.com
+ freemail_domains chance2mail.com
+ freemail_domains channelonetv.com
+ freemail_domains charter.net
+ freemail_domains chat-with-me.com
+ freemail_domains chattown.com
+ freemail_domains chatway.com
+ freemail_domains cheatasrule.com
+ freemail_domains checkitmail.at
+ freemail_domains cheerful.com
+ freemail_domains chef.net
+ freemail_domains chelny.com
+ freemail_domains chemist.com
+ freemail_domains cheshiremail.com
+ freemail_domains chewiemail.com
+ freemail_domains chil-e.com
+ freemail_domains chillaxer.de
+ freemail_domains chillimail.com
+ freemail_domains chillymail.com
+ freemail_domains china.com
+ freemail_domains chinamail.com
+ freemail_domains christianmail.org
+ freemail_domains ciaoweb.it
+ freemail_domains cine.com
+ freemail_domains ciphercom.net
+ freemail_domains circlemail.com
+ freemail_domains cititrustbank1.cjb.net
+ freemail_domains citromail.hu
+ freemail_domains citynetusa.com
+ freemail_domains ciudad.com.ar
+ freemail_domains claramail.com
+ freemail_domains classicmail.co.za
+ freemail_domains classprod.com
+ freemail_domains classycouples.com
+ freemail_domains clerk.com
+ freemail_domains cliffhanger.com
+ freemail_domains clix.pt
+ freemail_domains close2you.net
+ freemail_domains clovermail.net
+ freemail_domains clubmember.org
+ freemail_domains cluemail.com
+ freemail_domains clujnapoca.ro
+ freemail_domains collector.org
+ freemail_domains collegeclub.com
+ freemail_domains colombia.com
+ freemail_domains colorado.usa.com
+ freemail_domains columnist.com
+ freemail_domains comcast.net
+ freemail_domains comfortable.com
+ freemail_domains comic.com
+ freemail_domains company.org.ua
+ freemail_domains compaqnet.fr
+ freemail_domains compuserve.com
+ freemail_domains computer.net
+ freemail_domains computer4u.com
+ freemail_domains computermail.net
+ freemail_domains computhouse.com
+ freemail_domains conevyt.org.mx
+ freemail_domains congiu.net
+ freemail_domains connect4free.net
+ freemail_domains connecticut.usa.com
+ freemail_domains consultant.com
+ freemail_domains contractor.net
+ freemail_domains coolgoose.com
+ freemail_domains coolkiwi.com
+ freemail_domains coollist.com
+ freemail_domains coolmail.com
+ freemail_domains coolmail.net
+ freemail_domains coolmail.ru
+ freemail_domains coolsend.com
+ freemail_domains coolshit.com
+ freemail_domains coolsite.net
+ freemail_domains cooltoad.com
+ freemail_domains cooperation.net
+ freemail_domains copacabana.com
+ freemail_domains copticmail.com
+ freemail_domains corporateattorneys.com
+ freemail_domains corporation.net
+ freemail_domains corpusmail.com
+ freemail_domains correios.net.br
+ freemail_domains correomagico.com
+ freemail_domains cosmo.com
+ freemail_domains cosmosurf.net
+ freemail_domains cougars.com
+ freemail_domains counsellor.com
+ freemail_domains count.com
+ freemail_domains countrybass.com
+ freemail_domains couple.com
+ freemail_domains coxinet.net
+ freemail_domains crazy4baseball.com
+ freemail_domains crazy4homeimprovement.com
+ freemail_domains crazy4mail.com
+ freemail_domains crazyaboutfilms.net
+ freemail_domains crazycarfan.com
+ freemail_domains crazyforemail.com
+ freemail_domains crazymoviefan.com
+ freemail_domains criticalpath.net
+ freemail_domains critterpost.com
+ freemail_domains crosspaths.net
+ freemail_domains crosswinds.net
+ freemail_domains cryingmail.com
+ freemail_domains cs.com
+ freemail_domains csucsposta.hu
+ freemail_domains cumbriamail.com
+ freemail_domains curio-city.com
+ freemail_domains currently.com
+ freemail_domains custmail.com
+ freemail_domains cutey.com
+ freemail_domains cwazy.co.uk
+ freemail_domains cwazy.net
+ freemail_domains cww.de
+ freemail_domains cyber-wizard.com
+ freemail_domains cyberaccess.com.pk
+ freemail_domains cyberdude.com
+ freemail_domains cybergal.com
+ freemail_domains cybergirls.dk
+ freemail_domains cyberguys.dk
+ freemail_domains cyberkriminell.de
+ freemail_domains cybernet.it
+ freemail_domains cyberservices.com
+ freemail_domains cyberunlimited.org
+ freemail_domains cycledata.com
+ freemail_domains cymail.net
+ freemail_domains dabsol.net
+ freemail_domains dada.net
+ freemail_domains dadanet.it
+ freemail_domains dailypioneer.com
+ freemail_domains dallasmail.com
+ freemail_domains damuc.org.br
+ freemail_domains danneben.so
+ freemail_domains dansegulvet.com
+ freemail_domains darkfear.com
+ freemail_domains darkforces.com
+ freemail_domains darkhorsefan.net
+ freemail_domains data54.com
+ freemail_domains daum.net
+ freemail_domains davegracey.com
+ freemail_domains dayzers.com
+ freemail_domains dbmail.com
+ freemail_domains dbzmail.com
+ freemail_domains dcemail.com
+ freemail_domains dcsi.net
+ freemail_domains deacons.com
+ freemail_domains deadlymob.org
+ freemail_domains deal-maker.com
+ freemail_domains dearriba.com
+ freemail_domains degoo.com
+ freemail_domains delajaonline.org
+ freemail_domains delaware.usa.com
+ freemail_domains delfi.lv
+ freemail_domains delhimail.com
+ freemail_domains deliveryman.com
+ freemail_domains demon.deacons.com
+ freemail_domains denmark.ir
+ freemail_domains descriptivemail.com
+ freemail_domains desertonline.com
+ freemail_domains desidrivers.com
+ freemail_domains deskpilot.com
+ freemail_domains despammed.com
+ freemail_domains detik.com
+ freemail_domains devils.com
+ freemail_domains dexara.net
+ freemail_domains dhahran.cc
+ freemail_domains dhmail.net
+ freemail_domains dhofar.cc
+ freemail_domains di-ve.com
+ freemail_domains didamail.com
+ freemail_domains differentmail.com
+ freemail_domains digitaltrue.com
+ freemail_domains dino.lv
+ freemail_domains diplomats.com
+ freemail_domains direccion.com
+ freemail_domains director-general.com
+ freemail_domains diri.com
+ freemail_domains dirtythird.com
+ freemail_domains discardmail.com
+ freemail_domains disciples.com
+ freemail_domains discofan.com
+ freemail_domains discoverymail.net
+ freemail_domains disinfo.net
+ freemail_domains disposable.com
+ freemail_domains djibouti.cc
+ freemail_domains djmillenium.com
+ freemail_domains dmailman.com
+ freemail_domains dnsmadeeasy.com
+ freemail_domains do.net.ar
+ freemail_domains docomo.ne.jp
+ freemail_domains doctor.com
+ freemail_domains dodgeit.com
+ freemail_domains dog-person.com
+ freemail_domains doglover.com
+ freemail_domains dogmail.co.uk
+ freemail_domains dogpeoplerule.com
+ freemail_domains doityourself.com
+ freemail_domains domaindiscover.com
+ freemail_domains domainmanager.com
+ freemail_domains dominican.cc
+ freemail_domains doneasy.com
+ freemail_domains dontexist.org
+ freemail_domains dopefiends.com
+ freemail_domains doramail.com
+ freemail_domains dores.com
+ freemail_domains dostmail.com
+ freemail_domains dot5hosting.com
+ freemail_domains dotcom.fr
+ freemail_domains dotnow.com
+ freemail_domains dott.it
+ freemail_domains doubt.com
+ freemail_domains dplanet.ch
+ freemail_domains dr-dre.com
+ freemail_domains dr.com
+ freemail_domains draac.com
+ freemail_domains dragoncon.net
+ freemail_domains dragonfans.com
+ freemail_domains drakmail.net
+ freemail_domains dreamstop.com
+ freemail_domains dropzone.com
+ freemail_domains dserver.org
+ freemail_domains dubaiwebcity.com
+ freemail_domains dublin.com
+ freemail_domains dublin.ie
+ freemail_domains dustdevil.com
+ freemail_domains dutchmail.com
+ freemail_domains dynamitemail.com
+ freemail_domains dyndns.org
+ freemail_domains e-apollo.lv
+ freemail_domains e-hkma.com
+ freemail_domains e-mail.am
+ freemail_domains e-mail.cz
+ freemail_domains e-mail.ph
+ freemail_domains e-mailanywhere.com
+ freemail_domains e-milio.com
+ freemail_domains e-tapaal.com
+ freemail_domains e-webtec.com
+ freemail_domains earthalliance.com
+ freemail_domains earthling.net
+ freemail_domains eastmail.com
+ freemail_domains eastrolog.com
+ freemail_domains easy-pages.com
+ freemail_domains easy.com
+ freemail_domains easydoesit.com
+ freemail_domains easyinfomail.co.za
+ freemail_domains easypeasy.com
+ freemail_domains echina.com
+ freemail_domains eclub.lv
+ freemail_domains ecn.org
+ freemail_domains ecplaza.net
+ freemail_domains edsamail.com.ph
+ freemail_domains educacao.te.pt
+ freemail_domains edumail.co.za
+ freemail_domains eeism.com
+ freemail_domains ego.co.th
+ freemail_domains egypt.ir
+ freemail_domains egypt.net
+ freemail_domains eircom.net
+ freemail_domains ekolay.net
+ freemail_domains elforotv.com.ar
+ freemail_domains elitemail.org
+ freemail_domains elsitio.com
+ freemail_domains eltimon.com
+ freemail_domains elvis.com
+ freemail_domains elvisfan.com
+ freemail_domains email.bg
+ freemail_domains email.com
+ freemail_domains email.com.br
+ freemail_domains email.cz
+ freemail_domains email.it
+ freemail_domains email.lu
+ freemail_domains email.lviv.ua
+ freemail_domains email.nu
+ freemail_domains email.ro
+ freemail_domains email.si
+ freemail_domains email2me.com
+ freemail_domains emailacc.com
+ freemail_domains emailaccount.com
+ freemail_domains emailaddresses.com
+ freemail_domains emailchoice.com
+ freemail_domains emailcorner.net
+ freemail_domains emailengine.net
+ freemail_domains emailengine.org
+ freemail_domains emailfast.com
+ freemail_domains emailgaul.com
+ freemail_domains emailgroups.net
+ freemail_domains emailhut.net
+ freemail_domains emailn.de
+ freemail_domains emailpinoy.com
+ freemail_domains emailplanet.com
+ freemail_domains emailplus.org
+ freemail_domains emailuser.net
+ freemail_domains ematic.com
+ freemail_domains embarqmail.com
+ freemail_domains embroideryforums.com
+ freemail_domains eml.cc
+ freemail_domains emoka.ro
+ freemail_domains emptymail.com
+ freemail_domains enel.net
+ freemail_domains enelpunto.net
+ freemail_domains engineer.com
+ freemail_domains england.com
+ freemail_domains englandmail.com
+ freemail_domains enterate.com.ar
+ freemail_domains entryweb.it
+ freemail_domains entusiastisk.com
+ freemail_domains enusmail.com
+ freemail_domains envirocitizen.com
+ freemail_domains epatra.com
+ freemail_domains epix.net
+ freemail_domains epomail.com
+ freemail_domains epost.de
+ freemail_domains eprompter.com
+ freemail_domains eqqu.com
+ freemail_domains eramail.co.za
+ freemail_domains eresmas.com
+ freemail_domains eriga.lv
+ freemail_domains eritrea.cc
+ freemail_domains ertelecom.ru
+ freemail_domains escapeartist.com
+ freemail_domains esde-s.org
+ freemail_domains esfera.cl
+ freemail_domains estadao.com.br
+ freemail_domains etllao.com
+ freemail_domains euromail.net
+ freemail_domains europe.com
+ freemail_domains europemail.com
+ freemail_domains euroseek.com
+ freemail_domains euskalmail.com
+ freemail_domains evafan.com
+ freemail_domains everyday.com.kh
+ freemail_domains everymail.net
+ freemail_domains everyone.net
+ freemail_domains excite.co.uk
+ freemail_domains excite.com
+ freemail_domains execs.com
+ freemail_domains execs2k.com
+ freemail_domains executivemail.co.za
+ freemail_domains expertrenovator.com
+ freemail_domains expn.com
+ freemail_domains expressivemail.com
+ freemail_domains expressmail.dk
+ freemail_domains ezilon.com
+ freemail_domains ezrs.com
+ freemail_domains ezsweeps.com
+ freemail_domains f-m.fm
+ freemail_domains facilmail.com
+ freemail_domains fadrasha.net
+ freemail_domains fadrasha.org
+ freemail_domains faithhighway.com
+ freemail_domains faithmail.com
+ freemail_domains falasteen.cc
+ freemail_domains familymailbox.com
+ freemail_domains familyroll.com
+ freemail_domains familysafeweb.net
+ freemail_domains famous.as
+ freemail_domains fan.com
+ freemail_domains fan.net
+ freemail_domains fanaticos.com
+ freemail_domains fanofbooks.com
+ freemail_domains fanofcomputers.com
+ freemail_domains fanofcooking.com
+ freemail_domains fanoftheweb.com
+ freemail_domains faroweb.com
+ freemail_domains farts.com
+ freemail_domains fast-email.com
+ freemail_domains fast-mail.org
+ freemail_domains fastem.com
+ freemail_domains fastemail.us
+ freemail_domains fastemailer.com
+ freemail_domains fastermail.com
+ freemail_domains fastest.cc
+ freemail_domains fastimap.com
+ freemail_domains fastmail.co.uk
+ freemail_domains fastmail.com
+ freemail_domains fastmailbox.net
+ freemail_domains fastmessaging.com
+ freemail_domains fastservice.com
+ freemail_domains fastwebmail.it
+ freemail_domains fawz.net
+ freemail_domains fea.st
+ freemail_domains federalcontractors.com
+ freemail_domains fedxmail.com
+ freemail_domains feelingnaughty.com
+ freemail_domains feelings.com
+ freemail_domains female.ru
+ freemail_domains fepg.net
+ freemail_domains ffanet.com
+ freemail_domains fiberia.com
+ freemail_domains fieldmail.com
+ freemail_domains filipinolinks.com
+ freemail_domains financesource.com
+ freemail_domains financier.com
+ freemail_domains findmail.com
+ freemail_domains fireman.net
+ freemail_domains firemyst.com
+ freemail_domains fiscal.net
+ freemail_domains fit.lv
+ freemail_domains flashmail.com
+ freemail_domains fleetmail.com
+ freemail_domains flipcode.com
+ freemail_domains florida.usa.com
+ freemail_domains floridagators.com
+ freemail_domains fmail.co.uk
+ freemail_domains fmailbox.com
+ freemail_domains fmgirl.com
+ freemail_domains fmguy.com
+ freemail_domains fnmail.com
+ freemail_domains focusedonprofits.com
+ freemail_domains focusedonreturns.com
+ freemail_domains footballer.com
+ freemail_domains forfree.at
+ freemail_domains forsythmissouri.org
+ freemail_domains fortuncity.com
+ freemail_domains forum.dk
+ freemail_domains foxmail.com
+ freemail_domains free.com.pe
+ freemail_domains free.fr
+ freemail_domains free.net.nz
+ freemail_domains freeaccess.nl
+ freemail_domains freegates.be
+ freemail_domains freeghana.com
+ freemail_domains freehosting.nl
+ freemail_domains freei.co.th
+ freemail_domains freeler.nl
+ freemail_domains freemail.com
+ freemail_domains freemail.globalsite.com.br
+ freemail_domains freemailen.de
+ freemail_domains freemailn.de
+ freemail_domains freemuslim.net
+ freemail_domains freenet.de
+ freemail_domains freenet.kg
+ freemail_domains freeola.net
+ freemail_domains freeonline.com
+ freemail_domains freepgs.com
+ freemail_domains freesbee.fr
+ freemail_domains freeservers.com
+ freemail_domains freestart.hu
+ freemail_domains freesurf.ch
+ freemail_domains freesurf.fr
+ freemail_domains freesurf.nl
+ freemail_domains freeuk.com
+ freemail_domains freeuk.net
+ freemail_domains freeweb.it
+ freemail_domains freewebemail.com
+ freemail_domains freeyellow.com
+ freemail_domains frisurf.no
+ freemail_domains frontiernet.net
+ freemail_domains fsmail.net
+ freemail_domains fsnet.co.uk
+ freemail_domains ftml.net
+ freemail_domains fudge.com
+ freemail_domains fuelie.org
+ freemail_domains fujairah.cc
+ freemail_domains fujairah.us
+ freemail_domains fujairah.ws
+ freemail_domains fun-greetings-jokes.com
+ freemail_domains fun.21cn.com
+ freemail_domains funkytimes.com
+ freemail_domains fusemail.com
+ freemail_domains fut.es
+ freemail_domains futboladdict.com
+ freemail_domains gabes.cc
+ freemail_domains gafsa.cc
+ freemail_domains gala.net
+ freemail_domains galaxyhit.com
+ freemail_domains galmail.co.za
+ freemail_domains gamebox.net
+ freemail_domains gamecocks.com
+ freemail_domains gamerssolution.com
+ freemail_domains games.com
+ freemail_domains gardener.com
+ freemail_domains gawab.com
+ freemail_domains gay.com
+ freemail_domains gaymailbox.com
+ freemail_domains gaza.net
+ freemail_domains gazabo.net
+ freemail_domains gazeta.pl
+ freemail_domains gci.net
+ freemail_domains gdi.net
+ freemail_domains geeklife.com
+ freemail_domains gemari.or.id
+ freemail_domains genxemail.com
+ freemail_domains geologist.com
+ freemail_domains geopia.com
+ freemail_domains georgia.usa.com
+ freemail_domains germanymail.com
+ freemail_domains getintobooks.com
+ freemail_domains getmail.no
+ freemail_domains ggaweb.ch
+ freemail_domains giga4u.de
+ freemail_domains giza.cc
+ freemail_domains gjk.dk
+ freemail_domains glay.org
+ freemail_domains glendale.net
+ freemail_domains glittergrrrls.com
+ freemail_domains globalfree.it
+ freemail_domains globalpinoy.com
+ freemail_domains globalsite.com.br
+ freemail_domains globalum.com
+ freemail_domains globetrotter.net
+ freemail_domains globomail.com
+ freemail_domains gmail.com
+ freemail_domains gmx.com
+ freemail_domains go-bama.com
+ freemail_domains go-cavs.com
+ freemail_domains go-chargers.com
+ freemail_domains go-dawgs.com
+ freemail_domains go-gators.com
+ freemail_domains go-hogs.com
+ freemail_domains go-irish.com
+ freemail_domains go-spartans.com
+ freemail_domains go-tigers.com
+ freemail_domains go.aggies.com
+ freemail_domains go.air-force.com
+ freemail_domains go.badgers.com
+ freemail_domains go.big-orange.com
+ freemail_domains go.blue.devils.com
+ freemail_domains go.buffaloes.com
+ freemail_domains go.bulldogs.com
+ freemail_domains go.com
+ freemail_domains go.cougars.com
+ freemail_domains go.dores.com
+ freemail_domains go.gamecocks.com
+ freemail_domains go.huskies.com
+ freemail_domains go.longhorns.com
+ freemail_domains go.mustangs.com
+ freemail_domains go.rebels.com
+ freemail_domains go.ro
+ freemail_domains go.ru
+ freemail_domains go.terrapins.com
+ freemail_domains go.wildcats.com
+ freemail_domains go.wolverines.com
+ freemail_domains go.yellow-jackets.com
+ freemail_domains go2net.com
+ freemail_domains go4.it
+ freemail_domains goatrance.com
+ freemail_domains goddess.com
+ freemail_domains gofree.co.uk
+ freemail_domains gohip.com
+ freemail_domains golfemail.com
+ freemail_domains goliadtexas.com
+ freemail_domains gomail.com.ua
+ freemail_domains gonowmail.com
+ freemail_domains gonuts4free.com
+ freemail_domains googlemail.com
+ freemail_domains googlegroups.com
+ freemail_domains goplay.com
+ freemail_domains gorontalo.net
+ freemail_domains gospelcity.com
+ freemail_domains gothicgirl.com
+ freemail_domains gotmail.com
+ freemail_domains gotomy.com
+ freemail_domains govzone.com
+ freemail_domains grad.com
+ freemail_domains graduate.org
+ freemail_domains graffiti.net
+ freemail_domains grapemail.net
+ freemail_domains graphic-designer.com
+ freemail_domains gratisweb.com
+ freemail_domains greatautos.org
+ freemail_domains greenmail.net
+ freemail_domains groupmail.com
+ freemail_domains gtechnics.com
+ freemail_domains guate.net
+ freemail_domains guessmail.com
+ freemail_domains guinea.cc
+ freemail_domains guy.com
+ freemail_domains gwalla.com
+ freemail_domains h-mail.us
+ freemail_domains haberx.com
+ freemail_domains hacker.am
+ freemail_domains hackermail.com
+ freemail_domains hail2theskins.com
+ freemail_domains hailmail.net
+ freemail_domains hairdresser.net
+ freemail_domains haitisurf.com
+ freemail_domains halejob.com
+ freemail_domains hamptonroads.com
+ freemail_domains hamra.cc
+ freemail_domains handbag.com
+ freemail_domains hanmail.net
+ freemail_domains happemail.com
+ freemail_domains happycounsel.com
+ freemail_domains happyhippo.com
+ freemail_domains hasakah.com
+ freemail_domains hateinthebox.com
+ freemail_domains hawaii.com
+ freemail_domains hawaii.usa.com
+ freemail_domains hayahaya.tg
+ freemail_domains hebron.tv
+ freemail_domains hedgeai.com
+ freemail_domains heesun.net
+ freemail_domains heremail.com
+ freemail_domains hetnet.nl
+ freemail_domains highveldmail.co.za
+ freemail_domains hilarious.com
+ freemail_domains hildebrands.de
+ freemail_domains hingis.org
+ freemail_domains hiphopfan.com
+ freemail_domains hispavista.com
+ freemail_domains hitmanrecords.com
+ freemail_domains hitthepuck.com
+ freemail_domains hockeyghiaccio.com
+ freemail_domains hockeymail.com
+ freemail_domains holapuravida.com
+ freemail_domains home.no.net
+ freemail_domains home.ro
+ freemail_domains home.se
+ freemail_domains homelocator.com
+ freemail_domains homemail.co.za
+ freemail_domains homemail.com
+ freemail_domains homenetmail.com
+ freemail_domains homestead.com
+ freemail_domains homosexual.net
+ freemail_domains homs.cc
+ freemail_domains hong-kong-1.com
+ freemail_domains hongkong.com
+ freemail_domains hopthu.com
+ freemail_domains hosanna.net
+ freemail_domains hot-shot.com
+ freemail_domains hot.ee
+ freemail_domains hotbot.com
+ freemail_domains hotbox.ru
+ freemail_domains hotcoolmail.com
+ freemail_domains hotdak.com
+ freemail_domains hotfire.net
+ freemail_domains hotinbox.com
+ freemail_domains hotmail.co.uk
+ freemail_domains hotmail.com
+ freemail_domains hotpop.com
+ freemail_domains hotvoice.com
+ freemail_domains hour.com
+ freemail_domains housemail.com
+ freemail_domains houseofhorrors.com
+ freemail_domains howling.com
+ freemail_domains hugkiss.com
+ freemail_domains huhmail.com
+ freemail_domains hullnumber.com
+ freemail_domains human.lv
+ freemail_domains humanoid.net
+ freemail_domains humour.com
+ freemail_domains hurra.de
+ freemail_domains hush.ai
+ freemail_domains hush.com
+ freemail_domains hushmail.com
+ freemail_domains huskies.com
+ freemail_domains hutchcity.com
+ freemail_domains i-dig-movies.com
+ freemail_domains i-france.com
+ freemail_domains i-love-restaurants.com
+ freemail_domains i-p.com
+ freemail_domains i12.com
+ freemail_domains i2828.com
+ freemail_domains ibatam.com
+ freemail_domains ibest.com.br
+ freemail_domains ibizdns.com
+ freemail_domains ibra.cc
+ freemail_domains icafe.com
+ freemail_domains ice.is
+ freemail_domains icestorm.com
+ freemail_domains icloud.com
+ freemail_domains icq.com
+ freemail_domains icq.ir
+ freemail_domains icqmail.com
+ freemail_domains icrazy.com
+ freemail_domains id.ru
+ freemail_domains idaho.usa.com
+ freemail_domains idcloudhost.com
+ freemail_domains idigcomputers.com
+ freemail_domains idigelectronics.com
+ freemail_domains idigvideos.com
+ freemail_domains idirect.com
+ freemail_domains idncafe.com
+ freemail_domains idunno4recipes.com
+ freemail_domains ieg.com.br
+ freemail_domains iespalomeras.net
+ freemail_domains iespana.es
+ freemail_domains ifrance.com
+ freemail_domains ig.com.br
+ freemail_domains ignazio.it
+ freemail_domains ihatenetscape.com
+ freemail_domains ilike2helpothers.com
+ freemail_domains ilike2invest.com
+ freemail_domains ilike2workout.com
+ freemail_domains ilikeelectronics.com
+ freemail_domains ilikeworkingout.com
+ freemail_domains illinois.usa.com
+ freemail_domains ilovehomeprojects.com
+ freemail_domains iloveourteam.com
+ freemail_domains iloveworkingout.com
+ freemail_domains ilse.net
+ freemail_domains ilse.nl
+ freemail_domains imail.ru
+ freemail_domains imailbox.com
+ freemail_domains imap-mail.com
+ freemail_domains imap.cc
+ freemail_domains imapmail.org
+ freemail_domains imel.org
+ freemail_domains in-box.net
+ freemail_domains in.com
+ freemail_domains in2autos.net
+ freemail_domains iname.acom
+ freemail_domains iname.com
+ freemail_domains inbox.com
+ freemail_domains inbox.ge
+ freemail_domains inbox.lv
+ freemail_domains inbox.net
+ freemail_domains inbox.ru
+ freemail_domains incamail.com
+ freemail_domains indexa.fr
+ freemail_domains india.com
+ freemail_domains indiamail.com
+ freemail_domains indiana.usa.com
+ freemail_domains indiatimes.com
+ freemail_domains induquimica.org
+ freemail_domains inet.com.ua
+ freemail_domains infinito.it
+ freemail_domains infoapex.com
+ freemail_domains infohq.com
+ freemail_domains infomail.es
+ freemail_domains infomart.or.jp
+ freemail_domains infosat.net
+ freemail_domains infovia.com.ar
+ freemail_domains inicia.es
+ freemail_domains inmail.sk
+ freemail_domains inmail24.com
+ freemail_domains innocent.com
+ freemail_domains inorbit.com
+ freemail_domains inoutbox.com
+ freemail_domains instruction.com
+ freemail_domains instructor.net
+ freemail_domains insurer.com
+ freemail_domains intelnet.net.gt
+ freemail_domains intelnett.com
+ freemail_domains interblod.com
+ freemail_domains interestedinthejob.com
+ freemail_domains interfree.it
+ freemail_domains interia.pl
+ freemail_domains interlap.com.ar
+ freemail_domains intermail.hu
+ freemail_domains internet-e-mail.com
+ freemail_domains internet-mail.org
+ freemail_domains internet.lu
+ freemail_domains internetegypt.com
+ freemail_domains internetemails.net
+ freemail_domains internetmailing.net
+ freemail_domains intimatefire.com
+ freemail_domains intomotors.com
+ freemail_domains inwind.it
+ freemail_domains iobox.com
+ freemail_domains iobox.fi
+ freemail_domains iol.it
+ freemail_domains iol.pt
+ freemail_domains iowa.usa.com
+ freemail_domains ip3.com
+ freemail_domains ipermitmail.com
+ freemail_domains iphon.biz
+ freemail_domains iqemail.com
+ freemail_domains iquebec.com
+ freemail_domains ir.ae
+ freemail_domains iran.com
+ freemail_domains irangate.net
+ freemail_domains iraq.ir
+ freemail_domains irbid.ws
+ freemail_domains ire.ir
+ freemail_domains ireland.ir
+ freemail_domains irelandmail.com
+ freemail_domains irow.com
+ freemail_domains irr.ir
+ freemail_domains iscool.net
+ freemail_domains islandmama.com
+ freemail_domains ismailia.cc
+ freemail_domains ismart.net
+ freemail_domains isonews2.com
+ freemail_domains isonfire.com
+ freemail_domains isp9.net
+ freemail_domains ispey.com
+ freemail_domains israelmail.com
+ freemail_domains ist-der-mann.de
+ freemail_domains ist-der-wahnsinn.de
+ freemail_domains ist-echt.so
+ freemail_domains ist-genialer.de
+ freemail_domains ist-schlauer.de
+ freemail_domains ist-supersexy.de
+ freemail_domains istecht.so
+ freemail_domains italymail.com
+ freemail_domains itelgua.com
+ freemail_domains itloox.com
+ freemail_domains itmom.com
+ freemail_domains ivenus.com
+ freemail_domains iwan-fals.com
+ freemail_domains iwatchrealitytv.com
+ freemail_domains iwon.com
+ freemail_domains ixp.net
+ freemail_domains jadida.cc
+ freemail_domains jadida.org
+ freemail_domains japan.com
+ freemail_domains jaydemail.com
+ freemail_domains jazzemail.com
+ freemail_domains jedrzejow.pl
+ freemail_domains jerash.cc
+ freemail_domains jetemail.net
+ freemail_domains jingjo.net
+ freemail_domains jippii.fi
+ freemail_domains jizan.cc
+ freemail_domains jmail.co.za
+ freemail_domains job4u.com
+ freemail_domains jojomail.com
+ freemail_domains jouf.cc
+ freemail_domains journalist.com
+ freemail_domains jovem.te.pt
+ freemail_domains joymail.com
+ freemail_domains jpg.ir
+ freemail_domains juanitabynum.com
+ freemail_domains jubii.dk
+ freemail_domains jubiipost.dk
+ freemail_domains jumpy.it
+ freemail_domains juno.com
+ freemail_domains justemail.net
+ freemail_domains justmailz.com
+ freemail_domains k.ro
+ freemail_domains kaazoo.com
+ freemail_domains kabissa.org
+ freemail_domains kairouan.cc
+ freemail_domains kaixo.com
+ freemail_domains kalluritimes.com
+ freemail_domains kalpoint.com
+ freemail_domains kann.so
+ freemail_domains kanoodle.com
+ freemail_domains kansas.usa.com
+ freemail_domains karak.cc
+ freemail_domains katamail.com
+ freemail_domains kataweb.it
+ freemail_domains kayafmmail.co.za
+ freemail_domains keko.com.ar
+ freemail_domains kentucky.usa.com
+ freemail_domains keptprivate.com
+ freemail_domains keromail.com
+ freemail_domains khaimah.cc
+ freemail_domains khartoum.cc
+ freemail_domains khobar.cc
+ freemail_domains kickboxing.com
+ freemail_domains kidrock.com
+ freemail_domains kimo.com
+ freemail_domains kinkyemail.com
+ freemail_domains kissfans.com
+ freemail_domains kittymail.com
+ freemail_domains kiwitown.com
+ freemail_domains klik.it
+ freemail_domains klikni.cz
+ freemail_domains kmtn.ru
+ freemail_domains koko.com
+ freemail_domains kolozsvar.ro
+ freemail_domains kombud.com
+ freemail_domains kool-things.com
+ freemail_domains koreamail.com
+ freemail_domains koreanmail.com
+ freemail_domains kotaksuratku.info
+ freemail_domains krunis.com
+ freemail_domains ksa.ir
+ freemail_domains kukamail.com
+ freemail_domains kuronowish.com
+ freemail_domains kuwait.ir
+ freemail_domains kuwaiti.tv
+ freemail_domains kyokodate.com
+ freemail_domains kyokofukada.net
+ freemail_domains kyrgyzstan.cc
+ freemail_domains ladymail.cz
+ freemail_domains lagoon.nc
+ freemail_domains lahaonline.com
+ freemail_domains lamalla.net
+ freemail_domains lancsmail.com
+ freemail_domains land.ru
+ freemail_domains laposte.net
+ freemail_domains latakia.cc
+ freemail_domains latchess.com
+ freemail_domains latinabarbie.com
+ freemail_domains latinmail.com
+ freemail_domains latinogreeks.com
+ freemail_domains lawyer.com
+ freemail_domains lawyersmail.com
+ freemail_domains lawyerzone.com
+ freemail_domains lebanese.cc
+ freemail_domains lebanonatlas.com
+ freemail_domains leehom.net
+ freemail_domains leesville.com
+ freemail_domains legislator.com
+ freemail_domains lemondrop.com
+ freemail_domains leonardo.it
+ freemail_domains leonlai.net
+ freemail_domains letsjam.com
+ freemail_domains letterbox.org
+ freemail_domains letterboxes.org
+ freemail_domains levele.com
+ freemail_domains lexpress.net
+ freemail_domains libero.it
+ freemail_domains liberomail.com
+ freemail_domains libertysurf.net
+ freemail_domains libre.net
+ freemail_domains lightwines.org
+ freemail_domains linkmaster.com
+ freemail_domains linuxfreemail.com
+ freemail_domains linuxmail.org
+ freemail_domains lionsfan.com.au
+ freemail_domains list.ru
+ freemail_domains live.com
+ freemail_domains live.com.ar
+ freemail_domains livedoor.com
+ freemail_domains llandudno.com
+ freemail_domains llangollen.com
+ freemail_domains lmxmail.sk
+ freemail_domains lobbyist.com
+ freemail_domains loggain.net
+ freemail_domains loggain.nu
+ freemail_domains lolnetwork.net
+ freemail_domains london.com
+ freemail_domains london.ir
+ freemail_domains longhorns.com
+ freemail_domains look.com
+ freemail_domains looksmart.co.uk
+ freemail_domains looksmart.com
+ freemail_domains looksmart.com.au
+ freemail_domains loteria.net
+ freemail_domains lotonazo.com
+ freemail_domains louisiana.usa.com
+ freemail_domains louiskoo.com
+ freemail_domains love2exercise.com
+ freemail_domains love2workout.com
+ freemail_domains loveable.com
+ freemail_domains lovecat.com
+ freemail_domains loveemail.com
+ freemail_domains lovefantasysports.com
+ freemail_domains loveis.lv
+ freemail_domains lovemail.com
+ freemail_domains lovetoexercise.com
+ freemail_domains lovingjesus.com
+ freemail_domains lowrider.com
+ freemail_domains lpemail.com
+ freemail_domains lubnan.cc
+ freemail_domains lubnan.ws
+ freemail_domains lucky7lotto.net
+ freemail_domains luckymail.com
+ freemail_domains luso.pt
+ freemail_domains lusoweb.pt
+ freemail_domains luukku.com
+ freemail_domains luvfishing.com
+ freemail_domains luvgolfing.com
+ freemail_domains luvsoccer.com
+ freemail_domains lv-inter.net
+ freemail_domains lycos.co.uk
+ freemail_domains lycos.com
+ freemail_domains lycosmail.com
+ freemail_domains mac.com
+ freemail_domains machinecandy.com
+ freemail_domains macmail.com
+ freemail_domains mad.scientist.com
+ freemail_domains madcrazy.com
+ freemail_domains madeniggaz.net
+ freemail_domains madinah.cc
+ freemail_domains madonnafan.com
+ freemail_domains madonno.com
+ freemail_domains madrid.com
+ freemail_domains mag-spam.net
+ freemail_domains mag2.com
+ freemail_domains maghreb.cc
+ freemail_domains magicmail.co.za
+ freemail_domains magik-net.com
+ freemail_domains mail-atlas.net
+ freemail_domains mail-awu.de
+ freemail_domains mail-box.cz
+ freemail_domains mail-center.com
+ freemail_domains mail-central.com
+ freemail_domains mail-jp.org
+ freemail_domains mail-me.com
+ freemail_domains mail-on.us
+ freemail_domains mail-online.dk
+ freemail_domains mail-page.com
+ freemail_domains mail-x-change.com
+ freemail_domains mail.austria.com
+ freemail_domains mail.az
+ freemail_domains mail.be
+ freemail_domains mail.bg
+ freemail_domains mail.bulgaria.com
+ freemail_domains mail.by
+ freemail_domains mail.co.za
+ freemail_domains mail.com
+ freemail_domains mail.de
+ freemail_domains mail.dk
+ freemail_domains mail.ee
+ freemail_domains mail.goo.ne.jp
+ freemail_domains mail.gr
+ freemail_domains mail.lawguru.com
+ freemail_domains mail.md
+ freemail_domains mail.mn
+ freemail_domains mail.org
+ freemail_domains mail.pf
+ freemail_domains mail.pt
+ freemail_domains mail.ru
+ freemail_domains mail.yahoo.co.jp
+ freemail_domains mail15.com
+ freemail_domains mail3000.com
+ freemail_domains mail333.com
+ freemail_domains mail4me.com
+ freemail_domains mail8.com
+ freemail_domains mailandftp.com
+ freemail_domains mailandnews.com
+ freemail_domains mailas.com
+ freemail_domains mailasia.com
+ freemail_domains mailbg.com
+ freemail_domains mailblocks.com
+ freemail_domains mailbolt.com
+ freemail_domains mailbomb.com
+ freemail_domains mailbox.as
+ freemail_domains mailbox.co.za
+ freemail_domains mailbox.gr
+ freemail_domains mailbox.hu
+ freemail_domains mailbox.sk
+ freemail_domains mailc.net
+ freemail_domains mailcan.com
+ freemail_domains mailcircuit.com
+ freemail_domains mailclub.fr
+ freemail_domains mailclub.net
+ freemail_domains maildozy.com
+ freemail_domains mailfly.com
+ freemail_domains mailforce.net
+ freemail_domains mailftp.com
+ freemail_domains mailglobal.net
+ freemail_domains mailhaven.com
+ freemail_domains mailinator.com
+ freemail_domains mailingaddress.org
+ freemail_domains mailingweb.com
+ freemail_domains mailisent.com
+ freemail_domains mailite.com
+ freemail_domains mailme.dk
+ freemail_domains mailmight.com
+ freemail_domains mailmij.nl
+ freemail_domains mailnew.com
+ freemail_domains mailops.com
+ freemail_domains mailpanda.com
+ freemail_domains mailpersonal.com
+ freemail_domains mailroom.com
+ freemail_domains mailru.com
+ freemail_domains mails.de
+ freemail_domains mailsent.net
+ freemail_domains mailserver.dk
+ freemail_domains mailservice.ms
+ freemail_domains mailsnare.net
+ freemail_domains mailsurf.com
+ freemail_domains mailup.net
+ freemail_domains mailvault.com
+ freemail_domains mailworks.org
+ freemail_domains maine.usa.com
+ freemail_domains majorana.martina-franca.ta.it
+ freemail_domains majorgolfer.com
+ freemail_domains majorshopaholic.com
+ freemail_domains majortechie.com
+ freemail_domains maktoob.com
+ freemail_domains malayalamtelevision.net
+ freemail_domains malayalapathram.com
+ freemail_domains male.ru
+ freemail_domains manager.de
+ freemail_domains manama.cc
+ freemail_domains manlymail.net
+ freemail_domains mansoura.tv
+ freemail_domains mantrafreenet.com
+ freemail_domains mantramail.com
+ freemail_domains mantraonline.com
+ freemail_domains marchmail.com
+ freemail_domains marihuana.ro
+ freemail_domains marijuana.nl
+ freemail_domains marillion.net
+ freemail_domains marketweighton.com
+ freemail_domains marrakesh.cc
+ freemail_domains maryland.usa.com
+ freemail_domains mascara.ws
+ freemail_domains masrawy.com
+ freemail_domains massachusetts.usa.com
+ freemail_domains mauimail.com
+ freemail_domains mbox.com.au
+ freemail_domains mcom.com
+ freemail_domains mcrmail.com
+ freemail_domains me.by
+ freemail_domains me.com
+ freemail_domains mediacombb.net
+ freemail_domains medicinatv.com
+ freemail_domains meetingmall.com
+ freemail_domains mega.nz
+ freemail_domains mega-schlau.de
+ freemail_domains megamail.pt
+ freemail_domains megarave.com
+ freemail_domains meknes.cc
+ freemail_domains menara.ma
+ freemail_domains merseymail.com
+ freemail_domains mesra.net
+ freemail_domains messagez.com
+ freemail_domains metacrawler.com
+ freemail_domains metalfan.com
+ freemail_domains mexico.com
+ freemail_domains mexicomail.com
+ freemail_domains miaoweb.net
+ freemail_domains michigan.usa.com
+ freemail_domains micro2media.com
+ freemail_domains miesto.sk
+ freemail_domains mighty.co.za
+ freemail_domains milacamn.net
+ freemail_domains milmail.com
+ freemail_domains mindless.com
+ freemail_domains mindviz.com
+ freemail_domains minister.com
+ freemail_domains minnesota.usa.com
+ freemail_domains mississippi.usa.com
+ freemail_domains missouri.usa.com
+ freemail_domains mixmail.com
+ freemail_domains ml1.net
+ freemail_domains ml2clan.com
+ freemail_domains mlanime.com
+ freemail_domains mm.st
+ freemail_domains mmail.com
+ freemail_domains mobimail.mn
+ freemail_domains mobsters.com
+ freemail_domains mobstop.com
+ freemail_domains modemnet.net
+ freemail_domains modomail.com
+ freemail_domains mofa.com
+ freemail_domains moldova.com
+ freemail_domains moldovacc.com
+ freemail_domains monarchy.com
+ freemail_domains montana.usa.com
+ freemail_domains montevideo.com.uy
+ freemail_domains moomia.com
+ freemail_domains moose-mail.com
+ freemail_domains mosaicfx.com
+ freemail_domains moscowmail.com
+ freemail_domains motley.com
+ freemail_domains motor-nut.com
+ freemail_domains motormania.com
+ freemail_domains movemail.com
+ freemail_domains moviefan.com
+ freemail_domains mr.outblaze.com
+ freemail_domains mrspender.com
+ freemail_domains mscold.com
+ freemail_domains msn.co.uk
+ freemail_domains msn.com
+ freemail_domains msnzone.cn
+ freemail_domains mundo-r.com
+ freemail_domains munich.com
+ freemail_domains muscat.tv
+ freemail_domains muscat.ws
+ freemail_domains music.com
+ freemail_domains musician.net
+ freemail_domains musician.org
+ freemail_domains musicsites.com
+ freemail_domains muslim.com
+ freemail_domains muslimsonline.com
+ freemail_domains muss.so
+ freemail_domains mustangs.com
+ freemail_domains mxs.de
+ freemail_domains my.com
+ freemail_domains myblue.cc
+ freemail_domains mycabin.com
+ freemail_domains mycapitalsmail.com
+ freemail_domains mycatiscool.com
+ freemail_domains mycity.com
+ freemail_domains mycommail.com
+ freemail_domains mycool.com
+ freemail_domains mydomain.com
+ freemail_domains myeweb.com
+ freemail_domains myfantasyteamrules.com
+ freemail_domains myfastmail.com
+ freemail_domains myfunnymail.com
+ freemail_domains mygamingconsoles.com
+ freemail_domains mygrande.net
+ freemail_domains myiris.com
+ freemail_domains myjazzmail.com
+ freemail_domains mykolab.com
+ freemail_domains mymacmail.com
+ freemail_domains mymail.dk
+ freemail_domains mymail.ph.inter.net
+ freemail_domains mymail.ro
+ freemail_domains mynet.com
+ freemail_domains mynet.com.tr
+ freemail_domains myopera.com
+ freemail_domains myotw.net
+ freemail_domains myownemail.com
+ freemail_domains mypersonalemail.com
+ freemail_domains myplace.com
+ freemail_domains myrealbox.com
+ freemail_domains myself.com
+ freemail_domains myspace.com
+ freemail_domains myt.mu
+ freemail_domains myteamisbest.com
+ freemail_domains myyahoo.com
+ freemail_domains myway.com
+ freemail_domains mzgchaos.de
+ freemail_domains n2.com
+ freemail_domains n2business.com
+ freemail_domains n2mail.com
+ freemail_domains n2software.com
+ freemail_domains nabble.com
+ freemail_domains nabeul.cc
+ freemail_domains nabeul.info
+ freemail_domains nablus.cc
+ freemail_domains nador.cc
+ freemail_domains najaf.cc
+ freemail_domains name.com
+ freemail_domains nameplanet.com
+ freemail_domains nanamail.co.il
+ freemail_domains nanaseaikawa.com
+ freemail_domains nandomail.com
+ freemail_domains narod.ru
+ freemail_domains naseej.com
+ freemail_domains nastything.com
+ freemail_domains nate.com
+ freemail_domains national-champs.com
+ freemail_domains nativeweb.net
+ freemail_domains naveganas.com
+ freemail_domains naver.com
+ freemail_domains nebraska.usa.com
+ freemail_domains nemra1.com
+ freemail_domains nenter.com
+ freemail_domains nerd4life.de
+ freemail_domains nerdshack.com
+ freemail_domains nervhq.org
+ freemail_domains net-shopping.com
+ freemail_domains net-surf.com
+ freemail_domains net.hr
+ freemail_domains net4b.pt
+ freemail_domains net4jesus.com
+ freemail_domains net4you.at
+ freemail_domains netbounce.com
+ freemail_domains netbroadcaster.com
+ freemail_domains netbusiness.com
+ freemail_domains netcabo.pt
+ freemail_domains netcape.net
+ freemail_domains netcourrier.com
+ freemail_domains netexecutive.com
+ freemail_domains netfingers.com
+ freemail_domains netfirms.com
+ freemail_domains netkushi.com
+ freemail_domains netmongol.com
+ freemail_domains netpiper.com
+ freemail_domains netposta.net
+ freemail_domains netscape.com
+ freemail_domains netscape.net
+ freemail_domains netscapeonline.co.uk
+ freemail_domains netsquare.com
+ freemail_domains nettaxi.com
+ freemail_domains netti.fi
+ freemail_domains networld.com
+ freemail_domains netzero.com
+ freemail_domains netzero.net
+ freemail_domains neustreet.com
+ freemail_domains nevada.usa.com
+ freemail_domains newhampshire.usa.com
+ freemail_domains newjersey.usa.com
+ freemail_domains newmail.com
+ freemail_domains newmail.net
+ freemail_domains newmail.ok.com
+ freemail_domains newmail.ru
+ freemail_domains newmexico.usa.com
+ freemail_domains news-fanatic.com
+ freemail_domains newspaperemail.com
+ freemail_domains newspaperfan.com
+ freemail_domains newyork.com
+ freemail_domains newyork.usa.com
+ freemail_domains newyorkcity.com
+ freemail_domains nfmail.com
+ freemail_domains nicegal.com
+ freemail_domains nightimeuk.com
+ freemail_domains nightly.com
+ freemail_domains nightmail.com
+ freemail_domains nightmail.ru
+ freemail_domains ninfan.com
+ freemail_domains noavar.com
+ freemail_domains nocharge.com
+ freemail_domains noemail.com
+ freemail_domains nokiamail.com
+ freemail_domains nonomail.com
+ freemail_domains nonpartisan.com
+ freemail_domains noolhar.com
+ freemail_domains northcarolina.usa.com
+ freemail_domains northdakota.usa.com
+ freemail_domains nospammail.net
+ freemail_domains nowzer.com
+ freemail_domains ntlworld.com
+ freemail_domains null.net
+ freemail_domains ny.com
+ freemail_domains nyc.com
+ freemail_domains nycmail.com
+ freemail_domains nz11.com
+ freemail_domains nzoomail.com
+ freemail_domains o2.pl
+ freemail_domains oath.com
+ freemail_domains oceanfree.net
+ freemail_domains ocsnet.net
+ freemail_domains oddpost.com
+ freemail_domains odeon.pl
+ freemail_domains odmail.com
+ freemail_domains offcolormail.com
+ freemail_domains offshorewebmail.com
+ freemail_domains ofir.dk
+ freemail_domains ohio.usa.com
+ freemail_domains ohne-drogen-gehts.net
+ freemail_domains oicexchange.com
+ freemail_domains ok.ru
+ freemail_domains oklahoma.usa.com
+ freemail_domains ole.com
+ freemail_domains oleco.net
+ freemail_domains olympist.net
+ freemail_domains omani.ws
+ freemail_domains omaninfo.com
+ freemail_domains omdurman.cc
+ freemail_domains on-steroids.de
+ freemail_domains onatoo.com
+ freemail_domains ondikoi.com
+ freemail_domains onebox.com
+ freemail_domains onenet.com.ar
+ freemail_domains onet.pl
+ freemail_domains ongc.net
+ freemail_domains oninet.pt
+ freemail_domains onionmail.org
+ freemail_domains online.ie
+ freemail_domains online.ru
+ freemail_domains onlinevideosrock.com
+ freemail_domains onlinewiz.com
+ freemail_domains onobox.com
+ freemail_domains open.by
+ freemail_domains openbg.com
+ freemail_domains openforyou.com
+ freemail_domains openmail.cc
+ freemail_domains opentransfer.com
+ freemail_domains operamail.com
+ freemail_domains operationivy.com
+ freemail_domains oplusnet.com
+ freemail_domains optician.com
+ freemail_domains optimum.net
+ freemail_domains oran.cc
+ freemail_domains orange.es
+ freemail_domains orange.fr
+ freemail_domains orange.jo
+ freemail_domains orange.pl
+ freemail_domains orangehome.co.uk
+ freemail_domains orbitel.bg
+ freemail_domains orcon.net.nz
+ freemail_domains oregon.usa.com
+ freemail_domains oreka.com
+ freemail_domains organizer.net
+ freemail_domains orgio.net
+ freemail_domains orthodontist.net
+ freemail_domains orthodox.com
+ freemail_domains osite.com.br
+ freemail_domains oso.com
+ freemail_domains oued.info
+ freemail_domains oued.org
+ freemail_domains oujda.biz
+ freemail_domains oujda.cc
+ freemail_domains ourbrisbane.com
+ freemail_domains ournet.md
+ freemail_domains ourprofile.net
+ freemail_domains ourwest.com
+ freemail_domains outgun.com
+ freemail_domains outlook.com
+ freemail_domains ownmail.net
+ freemail_domains oxfoot.com
+ freemail_domains ozu.es
+ freemail_domains pacer.com
+ freemail_domains pacific-ocean.com
+ freemail_domains pacificwest.com
+ freemail_domains paginasamarillas.com
+ freemail_domains paidoffers.net
+ freemail_domains pakistani.ws
+ freemail_domains pakistanmail.com
+ freemail_domains palmyra.cc
+ freemail_domains palmyra.ws
+ freemail_domains paltalk.ir
+ freemail_domains pandawa.com
+ freemail_domains pando.com
+ freemail_domains pandora.be
+ freemail_domains paris.com
+ freemail_domains parsimail.com
+ freemail_domains parspage.com
+ freemail_domains patmail.com
+ freemail_domains pattayacitythailand.com
+ freemail_domains pc4me.us
+ freemail_domains pcbee.com
+ freemail_domains pcpostal.com
+ freemail_domains pediatrician.com
+ freemail_domains penguinmaster.com
+ freemail_domains pennsylvania.usa.com
+ freemail_domains peoplepc.com
+ freemail_domains peopleweb.com
+ freemail_domains persian.com
+ freemail_domains personal.ro
+ freemail_domains personales.com
+ freemail_domains peru.com
+ freemail_domains petlover.com
+ freemail_domains petml.com
+ freemail_domains petrofind.com
+ freemail_domains photographer.net
+ freemail_domains phreaker.net
+ freemail_domains phunkybitches.com
+ freemail_domains physicist.net
+ freemail_domains pigeonportal.com
+ freemail_domains pikaguam.com
+ freemail_domains pilu.com
+ freemail_domains pimagop.com
+ freemail_domains pinkcity.net
+ freemail_domains pinoymail.com
+ freemail_domains pipni.cz
+ freemail_domains pisem.net
+ freemail_domains pitbullmail.com
+ freemail_domains planet-school.de
+ freemail_domains planetaccess.com
+ freemail_domains planetmail.com
+ freemail_domains planetmail.net
+ freemail_domains planetout.com
+ freemail_domains planetsmeg.com
+ freemail_domains plasa.com
+ freemail_domains playersodds.com
+ freemail_domains playful.com
+ freemail_domains pluno.com
+ freemail_domains plusmail.com.br
+ freemail_domains pm.me
+ freemail_domains pmail.net
+ freemail_domains pnetmail.co.za
+ freemail_domains pobox.ru
+ freemail_domains pobox.sk
+ freemail_domains pochta.ru
+ freemail_domains pochtamt.ru
+ freemail_domains poczta.fm
+ freemail_domains poetic.com
+ freemail_domains pogowave.com
+ freemail_domains polandmail.com
+ freemail_domains polbox.com
+ freemail_domains politician.com
+ freemail_domains pookmail.com
+ freemail_domains poop.com
+ freemail_domains poormail.com
+ freemail_domains pop.co.th
+ freemail_domains pop3.ru
+ freemail_domains popmail.com
+ freemail_domains poppymail.com
+ freemail_domains popsmail.com
+ freemail_domains popstar.com
+ freemail_domains portafree.com
+ freemail_domains portaldosalunos.com
+ freemail_domains portsaid.cc
+ freemail_domains portugalmail.com
+ freemail_domains portugalmail.pt
+ freemail_domains post.com
+ freemail_domains post.cz
+ freemail_domains post.expart.ne.jp
+ freemail_domains post.pl
+ freemail_domains post.sk
+ freemail_domains posta.ge
+ freemail_domains postaccesslite.com
+ freemail_domains postiloota.net
+ freemail_domains postinbox.com
+ freemail_domains postino.ch
+ freemail_domains postino.it
+ freemail_domains postmaster.co.uk
+ freemail_domains postpro.net
+ freemail_domains potsmokersnet.com
+ freemail_domains powdermail.com
+ freemail_domains praize.com
+ freemail_domains presidency.com
+ freemail_domains press.co.jp
+ freemail_domains priest.com
+ freemail_domains primetap.com
+ freemail_domains primposta.com
+ freemail_domains printesamargareta.ro
+ freemail_domains private.21cn.com
+ freemail_domains probemail.com
+ freemail_domains profesional.com
+ freemail_domains profession.freemail.com.br
+ freemail_domains programmer.net
+ freemail_domains proinbox.com
+ freemail_domains project420.com
+ freemail_domains prolife.net
+ freemail_domains promessage.com
+ freemail_domains prontomail.com
+ freemail_domains protestant.com
+ freemail_domains protonmail.ch
+ freemail_domains protonmail.com
+ freemail_domains proton.me
+ freemail_domains provincial.net
+ freemail_domains publicaccounting.com
+ freemail_domains publicist.com
+ freemail_domains puertoricowow.com
+ freemail_domains punkass.com
+ freemail_domains puppetweb.com
+ freemail_domains puppy.com.my
+ freemail_domains q.com
+ freemail_domains qassem.cc
+ freemail_domains qatar.io
+ freemail_domains qlmail.com
+ freemail_domains qq.com
+ freemail_domains qrio.com
+ freemail_domains qsl.net
+ freemail_domains qualityservice.com
+ freemail_domains quds.cc
+ freemail_domains qudsmail.com
+ freemail_domains queerplaces.com
+ freemail_domains quepasa.com
+ freemail_domains quick.cz
+ freemail_domains quickwebmail.com
+ freemail_domains r-o-o-t.com
+ freemail_domains r320.hu
+ freemail_domains raakim.com
+ freemail_domains rabat.cc
+ freemail_domains racingseat.com
+ freemail_domains radicalz.com
+ freemail_domains radiojobbank.com
+ freemail_domains radiologist.net
+ freemail_domains rafah.cc
+ freemail_domains ragingbull.com
+ freemail_domains raisingadaughter.com
+ freemail_domains rallye-webmail.com
+ freemail_domains ramallah.cc
+ freemail_domains rambler.ru
+ freemail_domains ranmamail.com
+ freemail_domains rapstar.com
+ freemail_domains rapworld.com
+ freemail_domains rastamall.com
+ freemail_domains ratedx.net
+ freemail_domains ravearena.com
+ freemail_domains ravemail.co.za
+ freemail_domains ravemail.com
+ freemail_domains ravermail.com
+ freemail_domains razormail.com
+ freemail_domains rbcmail.ru
+ freemail_domains rbox.co
+ freemail_domains rbox.me
+ freemail_domains real.ro
+ freemail_domains realbookfan.com
+ freemail_domains realemail.net
+ freemail_domains realhealthnut.com
+ freemail_domains realitytvaddict.net
+ freemail_domains realitytvnut.com
+ freemail_domains reallyfast.biz
+ freemail_domains reallyfast.info
+ freemail_domains reallyintomusic.com
+ freemail_domains realtravelfan.com
+ freemail_domains realtyagent.com
+ freemail_domains rebels.com
+ freemail_domains reborn.com
+ freemail_domains recife.net
+ freemail_domains recme.net
+ freemail_domains rediffmail.com
+ freemail_domains rediffmailpro.com
+ freemail_domains redseven.de
+ freemail_domains redskinscheer.com
+ freemail_domains redskinsfamily.com
+ freemail_domains redskinsfancentral.com
+ freemail_domains redskinshog.com
+ freemail_domains redskinsrule.com
+ freemail_domains redskinsspecialteams.com
+ freemail_domains redskinsultimatefan.com
+ freemail_domains redwhitearmy.com
+ freemail_domains reggaefan.com
+ freemail_domains registerednurses.com
+ freemail_domains reincarnate.com
+ freemail_domains relapsecult.com
+ freemail_domains relia.com
+ freemail_domains religious.com
+ freemail_domains remixer.com
+ freemail_domains repairman.com
+ freemail_domains representative.com
+ freemail_domains rescueteam.com
+ freemail_domains revenue.com
+ freemail_domains rexian.com
+ freemail_domains rhodeisland.usa.com
+ freemail_domains ritmes.net
+ freemail_domains rn.com
+ freemail_domains roadrunner.com
+ freemail_domains roanokemail.com
+ freemail_domains rochester-mail.com
+ freemail_domains rock.com
+ freemail_domains rockeros.com
+ freemail_domains rocketmail.com
+ freemail_domains rocketship.com
+ freemail_domains rockfan.com
+ freemail_domains rockinghamgateway.com
+ freemail_domains rojname.com
+ freemail_domains rol.ro
+ freemail_domains rollin.com
+ freemail_domains romance106fm.com
+ freemail_domains rome.com
+ freemail_domains romymichele.com
+ freemail_domains royal.net
+ freemail_domains rpharmacist.com
+ freemail_domains rt.nl
+ freemail_domains ru.ru
+ freemail_domains runbox.com
+ freemail_domains rushpost.com
+ freemail_domains russiamail.com
+ freemail_domains rxpost.net
+ freemail_domains s-mail.com
+ freemail_domains saabnet.com
+ freemail_domains sacbeemail.com
+ freemail_domains sacmail.com
+ freemail_domains safat.biz
+ freemail_domains safat.info
+ freemail_domains safat.us
+ freemail_domains safat.ws
+ freemail_domains safe-mail.net
+ freemail_domains safe-mailbox.com
+ freemail_domains safrica.com
+ freemail_domains saigonnet.vn
+ freemail_domains saint-mike.org
+ freemail_domains saintly.com
+ freemail_domains salalah.cc
+ freemail_domains salesperson.net
+ freemail_domains salmiya.biz
+ freemail_domains samerica.com
+ freemail_domains samilan.net
+ freemail_domains sanaa.cc
+ freemail_domains sandiego.com
+ freemail_domains sanfranmail.com
+ freemail_domains sanook.com
+ freemail_domains sanriotown.com
+ freemail_domains sapibon.com
+ freemail_domains sapo.pt
+ freemail_domains saturnfans.com
+ freemail_domains sayhi.net
+ freemail_domains sbcglobal.com
+ freemail_domains scfn.net
+ freemail_domains scheint.so
+ freemail_domains schweiz.org
+ freemail_domains sci.fi
+ freemail_domains sciaga.pl
+ freemail_domains scientist.com
+ freemail_domains scotlandmail.com
+ freemail_domains scoutmail.com
+ freemail_domains scrapbookscrapbook.com
+ freemail_domains seapole.com
+ freemail_domains search417.com
+ freemail_domains seark.com
+ freemail_domains sebil.com
+ freemail_domains secretary.net
+ freemail_domains secretservices.net
+ freemail_domains secure-jlnet.com
+ freemail_domains seductive.com
+ freemail_domains seeb.cc
+ freemail_domains sendmail.ru
+ freemail_domains sendme.cz
+ freemail_domains sent.as
+ freemail_domains sent.at
+ freemail_domains sent.com
+ freemail_domains serga.com.ar
+ freemail_domains sermix.com
+ freemail_domains server4free.de
+ freemail_domains serverwench.com
+ freemail_domains sesmail.com
+ freemail_domains sexmagnet.com
+ freemail_domains sexriga.lv
+ freemail_domains seznam.cz
+ freemail_domains sfax.ws
+ freemail_domains shadango.com
+ freemail_domains sharm.cc
+ freemail_domains she.com
+ freemail_domains shuf.com
+ freemail_domains siamlocalhost.com
+ freemail_domains siamnow.net
+ freemail_domains sify.com
+ freemail_domains sina.cn
+ freemail_domains sina.com
+ freemail_domains sinai.cc
+ freemail_domains sinamail.com
+ freemail_domains sinanail.com
+ freemail_domains singalongcenter.com
+ freemail_domains singapore.com
+ freemail_domains singmail.com
+ freemail_domains singnet.com.sg
+ freemail_domains siraj.org
+ freemail_domains siria.cc
+ freemail_domains sirindia.com
+ freemail_domains sirunet.com
+ freemail_domains sister.com
+ freemail_domains sistersbrothers.com
+ freemail_domains sizzling.com
+ freemail_domains sketchyfriends.com
+ freemail_domains skiff.com
+ freemail_domains skins4life.com
+ freemail_domains slamdunkfan.com
+ freemail_domains slayerized.com
+ freemail_domains slickriffs.co.uk
+ freemail_domains slingshot.com
+ freemail_domains slo.net
+ freemail_domains slomusic.net
+ freemail_domains smartemail.co.uk
+ freemail_domains smartstocks.com
+ freemail_domains smtp.ru
+ freemail_domains snail-mail.net
+ freemail_domains snakebite.com
+ freemail_domains sndt.net
+ freemail_domains sneakemail.com
+ freemail_domains snoopymail.com
+ freemail_domains snowboarding.com
+ freemail_domains so-simple.org
+ freemail_domains socamail.com
+ freemail_domains socialworker.net
+ freemail_domains sociologist.com
+ freemail_domains softhome.net
+ freemail_domains sohu.com
+ freemail_domains sol.dk
+ freemail_domains solidmail.com
+ freemail_domains solution4u.com
+ freemail_domains songwriter.net
+ freemail_domains soon.com
+ freemail_domains sos.lv
+ freemail_domains soulja-beatz.org
+ freemail_domains soundvillage.org
+ freemail_domains sousse.cc
+ freemail_domains southcarolina.usa.com
+ freemail_domains southdakota.usa.com
+ freemail_domains space.com
+ freemail_domains spacetowns.com
+ freemail_domains spain.ir
+ freemail_domains spainmail.com
+ freemail_domains spamex.com
+ freemail_domains spartapiet.com
+ freemail_domains specialoperations.com
+ freemail_domains speed-racer.com
+ freemail_domains speedpost.net
+ freemail_domains speedymail.net
+ freemail_domains speedymail.org
+ freemail_domains spells.com
+ freemail_domains spils.com
+ freemail_domains spinfinder.com
+ freemail_domains sportemail.com
+ freemail_domains spray.net
+ freemail_domains spray.no
+ freemail_domains spray.se
+ freemail_domains spymac.com
+ freemail_domains srbbs.com
+ freemail_domains srilankan.net
+ freemail_domains ssan.com
+ freemail_domains ssl-mail.com
+ freemail_domains staatsterrorist.de
+ freemail_domains stade.fr
+ freemail_domains stalag13.com
+ freemail_domains stampmail.com
+ freemail_domains starbuzz.com
+ freemail_domains stargate2.com
+ freemail_domains stargateatlantis.com
+ freemail_domains stargatefanclub.com
+ freemail_domains stargatesg1.com
+ freemail_domains stargateu.com
+ freemail_domains starline.ee
+ freemail_domains starmail.com
+ freemail_domains starmail.org
+ freemail_domains starmedia.com
+ freemail_domains starspath.com
+ freemail_domains start.com.au
+ freemail_domains start.no
+ freemail_domains streetracing.com
+ freemail_domains stribmail.com
+ freemail_domains strompost.com
+ freemail_domains student.com
+ freemail_domains student.ednet.ns.ca
+ freemail_domains studmail.com
+ freemail_domains subspacemail.com
+ freemail_domains sudanese.cc
+ freemail_domains sudanmail.net
+ freemail_domains suez.cc
+ freemail_domains sugarray.com
+ freemail_domains suisse.org
+ freemail_domains sunbella.net
+ freemail_domains sunmail1.com
+ freemail_domains sunpoint.net
+ freemail_domains sunrise.ch
+ freemail_domains sunumail.sn
+ freemail_domains sunuweb.net
+ freemail_domains suomi24.fi
+ freemail_domains super-gerissen.de
+ freemail_domains superbikeclub.com
+ freemail_domains superdada.it
+ freemail_domains supereva.com
+ freemail_domains supereva.it
+ freemail_domains superintendents.net
+ freemail_domains supermailbox.com
+ freemail_domains superposta.com
+ freemail_domains surf3.net
+ freemail_domains surfassistant.com
+ freemail_domains surfguiden.com
+ freemail_domains surfsupnet.net
+ freemail_domains surfy.net
+ freemail_domains surgical.net
+ freemail_domains surimail.com
+ freemail_domains surnet.cl
+ freemail_domains sverige.nu
+ freemail_domains svizzera.org
+ freemail_domains sweb.cz
+ freemail_domains sweden.ir
+ freemail_domains swedenmail.com
+ freemail_domains sweetwishes.com
+ freemail_domains swift-mail.com
+ freemail_domains swissinfo.org
+ freemail_domains swissmail.com
+ freemail_domains swissmail.net
+ freemail_domains switched.com
+ freemail_domains switzerland.org
+ freemail_domains syom.com
+ freemail_domains syriamail.com
+ freemail_domains t-mail.com
+ freemail_domains t-net.net.ve
+ freemail_domains t-online.de
+ freemail_domains t2mail.com
+ freemail_domains tabasheer.com
+ freemail_domains tabouk.cc
+ freemail_domains tajikistan.cc
+ freemail_domains talk21.com
+ freemail_domains talkcity.com
+ freemail_domains talktalk.net
+ freemail_domains tangiers.cc
+ freemail_domains tangmonkey.com
+ freemail_domains tanta.cc
+ freemail_domains tatanova.com
+ freemail_domains tattoodesign.com
+ freemail_domains taxcutadvice.com
+ freemail_domains tayef.cc
+ freemail_domains teachers.org
+ freemail_domains teamster.net
+ freemail_domains tech-center.com
+ freemail_domains techemail.com
+ freemail_domains techie.com
+ freemail_domains technisamail.co.za
+ freemail_domains technologist.com
+ freemail_domains teenchatnow.com
+ freemail_domains teenmail.co.uk
+ freemail_domains teenmail.co.za
+ freemail_domains tejary.com
+ freemail_domains telebot.com
+ freemail_domains telefonica.net
+ freemail_domains telegraf.by
+ freemail_domains teleline.es
+ freemail_domains telenet.be
+ freemail_domains telinco.net
+ freemail_domains telkom.net
+ freemail_domains telpage.net
+ freemail_domains telstra.com
+ freemail_domains telusplanet.net
+ freemail_domains tempting.com
+ freemail_domains tenchiclub.com
+ freemail_domains tennessee.usa.com
+ freemail_domains terra.com.br
+ freemail_domains terrapins.com
+ freemail_domains tetouan.cc
+ freemail_domains texas.usa.com
+ freemail_domains texascrossroads.com
+ freemail_domains tfz.net
+ freemail_domains thai.com
+ freemail_domains thaimail.com
+ freemail_domains thaimail.net
+ freemail_domains the-fastest.net
+ freemail_domains the-quickest.com
+ freemail_domains the5thquarter.com
+ freemail_domains theblackmarket.com
+ freemail_domains thegame.com
+ freemail_domains thegamefanatic.com
+ freemail_domains theinternetemail.com
+ freemail_domains theoffice.net
+ freemail_domains theplate.com
+ freemail_domains thepostmaster.net
+ freemail_domains theracetrack.com
+ freemail_domains therapist.net
+ freemail_domains theserverbiz.com
+ freemail_domains thewatercooler.com
+ freemail_domains thewebpros.co.uk
+ freemail_domains thinkpost.net
+ freemail_domains thirdage.com
+ freemail_domains thundermail.com
+ freemail_domains tightmail.com
+ freemail_domains tim.it
+ freemail_domains timemail.com
+ freemail_domains timor.cc
+ freemail_domains tin.it
+ freemail_domains tinati.net
+ freemail_domains tiscali.co.uk
+ freemail_domains tiscali.com
+ freemail_domains tiscali.it
+ freemail_domains tiscalinet.it
+ freemail_domains tjohoo.se
+ freemail_domains tkcity.com
+ freemail_domains tlcfan.com
+ freemail_domains tlen.pl
+ freemail_domains tmicha.net
+ freemail_domains todito.com
+ freemail_domains todoperros.com
+ freemail_domains toke.com
+ freemail_domains tokyo.com
+ freemail_domains tokyo.ir
+ freemail_domains tombstone.ws
+ freemail_domains toothandmail.com
+ freemail_domains toothfairy.com
+ freemail_domains topchat.com
+ freemail_domains topmail.co.ie
+ freemail_domains topmail.co.in
+ freemail_domains topmail.co.nz
+ freemail_domains topmail.co.uk
+ freemail_domains topmail.co.za
+ freemail_domains topmail.com.ar
+ freemail_domains topmail.dk
+ freemail_domains topsurf.com
+ freemail_domains toquedequeda.com
+ freemail_domains torba.com
+ freemail_domains torchmail.com
+ freemail_domains torontomail.com
+ freemail_domains total-techie.com
+ freemail_domains totalfoodnut.com
+ freemail_domains totally-into-cooking.com
+ freemail_domains totallyintobaseball.com
+ freemail_domains totallyintobasketball.com
+ freemail_domains totallyintocooking.com
+ freemail_domains totallyintofootball.com
+ freemail_domains totallyintogolf.com
+ freemail_domains totallyintohockey.com
+ freemail_domains totallyintomusic.com
+ freemail_domains totallyintoreading.com
+ freemail_domains totallyintosports.com
+ freemail_domains totallyintotravel.com
+ freemail_domains totalmail.com
+ freemail_domains totalmoviefan.com
+ freemail_domains totalsurf.com
+ freemail_domains totonline.net
+ freemail_domains tough.com
+ freemail_domains toughguy.net
+ freemail_domains trav.se
+ freemail_domains travel2newplaces.com
+ freemail_domains trevas.net
+ freemail_domains tripod-mail.com
+ freemail_domains triton.net
+ freemail_domains trmailbox.com
+ freemail_domains troamail.org
+ freemail_domains tsamail.co.za
+ freemail_domains tunisian.cc
+ freemail_domains tunome.com
+ freemail_domains turbonett.com
+ freemail_domains turkey.com
+ freemail_domains tushmail.com
+ freemail_domains tutanota.com
+ freemail_domains tvchannelsurfer.com
+ freemail_domains tvnet.lv
+ freemail_domains tvstar.com
+ freemail_domains twc.com
+ freemail_domains typemail.com
+ freemail_domains u2club.com
+ freemail_domains u2tours.com
+ freemail_domains uae.ac
+ freemail_domains ubbi.com
+ freemail_domains ubbi.com.br
+ freemail_domains uboot.com
+ freemail_domains ugeek.com
+ freemail_domains uk2.net
+ freemail_domains uk2net.com
+ freemail_domains ukr.net
+ freemail_domains ukrpost.net
+ freemail_domains ukrpost.ua
+ freemail_domains uku.co.uk
+ freemail_domains ulimit.com
+ freemail_domains ultimateredskinsfan.com
+ freemail_domains ummah.org
+ freemail_domains umpire.com
+ freemail_domains unbounded.com
+ freemail_domains unendlich-schlau.de
+ freemail_domains unican.es
+ freemail_domains unicum.de
+ freemail_domains unimail.mn
+ freemail_domains unitedemailsystems.com
+ freemail_domains universal.pt
+ freemail_domains universia.cl
+ freemail_domains universia.edu.ve
+ freemail_domains universia.es
+ freemail_domains universia.net.co
+ freemail_domains universia.net.mx
+ freemail_domains universia.pr
+ freemail_domains universia.pt
+ freemail_domains universiabrasil.net
+ freemail_domains unofree.it
+ freemail_domains uol.com.ar
+ freemail_domains uol.com.br
+ freemail_domains uole.com
+ freemail_domains uolmail.com
+ freemail_domains uomail.com
+ freemail_domains uraniomail.com
+ freemail_domains urbi.com.br
+ freemail_domains urdun.cc
+ freemail_domains ureach.com
+ freemail_domains usa.com
+ freemail_domains usanetmail.com
+ freemail_domains userbeam.com
+ freemail_domains utah.usa.com
+ freemail_domains uymail.com
+ freemail_domains uyuyuy.com
+ freemail_domains v-sexi.com
+ freemail_domains v3mail.com
+ freemail_domains vegetarisme.be
+ freemail_domains velnet.com
+ freemail_domains velocall.com
+ freemail_domains vercorreo.com
+ freemail_domains verizonmail.com
+ freemail_domains vermont.usa.com
+ freemail_domains verticalheaven.com
+ freemail_domains veryfast.biz
+ freemail_domains veryspeedy.net
+ freemail_domains vfemail.net
+ freemail_domains videogamesrock.com
+ freemail_domains vietmedia.com
+ freemail_domains vip-client.de
+ freemail_domains vip.126.com
+ freemail_domains vip.163.com
+ freemail_domains vip.188.com
+ freemail_domains vip.gr
+ freemail_domains vip.qq.com
+ freemail_domains vip.sina.com
+ freemail_domains vip.sohu.com
+ freemail_domains vip.sohu.net
+ freemail_domains vip.tom.com
+ freemail_domains vipsohu.net
+ freemail_domains virgilio.it
+ freemail_domains virgin.net
+ freemail_domains virginia.usa.com
+ freemail_domains virginmedia.com
+ freemail_domains virtual-mail.com
+ freemail_domains visitmail.com
+ freemail_domains visto.com
+ freemail_domains vitalogy.org
+ freemail_domains vivelared.com
+ freemail_domains vjtimail.com
+ freemail_domains vnn.vn
+ freemail_domains vodafone.com
+ freemail_domains vodafone.it
+ freemail_domains vodamail.co.za
+ freemail_domains voila.fr
+ freemail_domains volkermord.com
+ freemail_domains volunteeringisawesome.com
+ freemail_domains vosforums.com
+ freemail_domains vsnl.com
+ freemail_domains vsnl.net
+ freemail_domains w.cn
+ freemail_domains walla.co.il
+ freemail_domains walla.com
+ freemail_domains wallet.com
+ freemail_domains wam.co.za
+ freemail_domains wanex.ge
+ freemail_domains wap.hu
+ freemail_domains wapda.com
+ freemail_domains wapicode.com
+ freemail_domains wappi.com
+ freemail_domains warpmail.net
+ freemail_domains washington.usa.com
+ freemail_domains wassup.com
+ freemail_domains waterloo.com
+ freemail_domains waumail.com
+ freemail_domains wayintocomputers.com
+ freemail_domains wazmail.com
+ freemail_domains wearab.net
+ freemail_domains web-mail.com.ar
+ freemail_domains web.de
+ freemail_domains web.nl
+ freemail_domains web2mail.com
+ freemail_domains webaddressbook.com
+ freemail_domains webbworks.com
+ freemail_domains webcity.ca
+ freemail_domains webdream.com
+ freemail_domains webemaillist.com
+ freemail_domains webindia123.com
+ freemail_domains webinfo.fi
+ freemail_domains webjump.com
+ freemail_domains webl-3.br.inter.net
+ freemail_domains webmail.co.yu
+ freemail_domains webmail.co.za
+ freemail_domains webmails.com
+ freemail_domains webmailv.com
+ freemail_domains webname.com
+ freemail_domains webpim.cc
+ freemail_domains webspawner.com
+ freemail_domains webstation.com
+ freemail_domains websurfer.co.za
+ freemail_domains webtopmail.com
+ freemail_domains webtribe.net
+ freemail_domains webtv.net
+ freemail_domains weedmail.com
+ freemail_domains weekonline.com
+ freemail_domains weirdness.com
+ freemail_domains westvirginia.usa.com
+ freemail_domains whale-mail.com
+ freemail_domains whatisthis.com
+ freemail_domains whatmail.com
+ freemail_domains when.com
+ freemail_domains whipmail.com
+ freemail_domains who.net
+ freemail_domains whoever.com
+ freemail_domains wild4music.com
+ freemail_domains wildaboutelectronics.com
+ freemail_domains wildcats.com
+ freemail_domains wildmail.com
+ freemail_domains will-keinen-spam.de
+ freemail_domains williams.net.ar
+ freemail_domains windstream.net
+ freemail_domains winning.com
+ freemail_domains winningteam.com
+ freemail_domains winwinhosting.com
+ freemail_domains wisconsin.usa.com
+ freemail_domains witelcom.com
+ freemail_domains witty.com
+ freemail_domains wolverines.com
+ freemail_domains wooow.it
+ freemail_domains worker.com
+ freemail_domains workingaroundthehouse.com
+ freemail_domains workingonthehouse.com
+ freemail_domains workmail.co.za
+ freemail_domains workmail.com
+ freemail_domains worldcrossing.com
+ freemail_domains worldemail.com
+ freemail_domains worldmedic.com
+ freemail_domains worldonline.de
+ freemail_domains wowmail.com
+ freemail_domains wp.pl
+ freemail_domains wprost.pl
+ freemail_domains wrestlezone.com
+ freemail_domains writeme.com
+ freemail_domains writesoon.com
+ freemail_domains wrongmail.com
+ freemail_domains wtonetwork.com
+ freemail_domains wurtele.net
+ freemail_domains www.com
+ freemail_domains www.consulcredit.it
+ freemail_domains wyoming.usa.com
+ freemail_domains x-mail.net
+ freemail_domains xasa.com
+ freemail_domains xemail.com
+ freemail_domains xfreehosting.com
+ freemail_domains xmail.net
+ freemail_domains xmasmail.com
+ freemail_domains xmsg.com
+ freemail_domains xnmsn.cn
+ freemail_domains xoom.com
+ freemail_domains xpectmore.com
+ freemail_domains xrea.com
+ freemail_domains xsmail.com
+ freemail_domains xtra.co.nz
+ freemail_domains xuite.net
+ freemail_domains xzapmail.com
+ freemail_domains y7mail.com
+ freemail_domains ya.com
+ freemail_domains ya.ru
+ freemail_domains yahala.co.il
+ freemail_domains yaho.com
+ freemail_domains yahoo.co.uk
+ freemail_domains yahoo.com
+ freemail_domains yahoomail.com
+ freemail_domains yalla.com.lb
+ freemail_domains yam.com
+ freemail_domains yamal.info
+ freemail_domains yanbo.cc
+ freemail_domains yandex.ru
+ freemail_domains yapost.com
+ freemail_domains yawmail.com
+ freemail_domains yeah.net
+ freemail_domains yebox.com
+ freemail_domains yehey.com
+ freemail_domains yellow-jackets.com
+ freemail_domains yellowstone.net
+ freemail_domains yemeni.cc
+ freemail_domains yenimail.com
+ freemail_domains yepmail.net
+ freemail_domains yifan.net
+ freemail_domains ymail.com
+ freemail_domains yopmail.com
+ freemail_domains your-mail.com
+ freemail_domains yours.com
+ freemail_domains yourwap.com
+ freemail_domains yunus.cc
+ freemail_domains yyhmail.com
+ freemail_domains z11.com
+ freemail_domains z6.com
+ freemail_domains zagazig.cc
+ freemail_domains zambia.cc
+ freemail_domains zednet.co.uk
+ freemail_domains zeeman.nl
+ freemail_domains ziplip.com
+ freemail_domains zipmail.com.br
+ freemail_domains zipmax.com
+ freemail_domains zmail.pt
+ freemail_domains zmail.ru
+ freemail_domains zoho.com
+ freemail_domains zohomail.com
+ freemail_domains zona-andina.net
+ freemail_domains zonai.com
+ freemail_domains zoneview.net
+ freemail_domains zonnet.nl
+ freemail_domains zoomshare.com
+ freemail_domains zoznam.sk
+ freemail_domains zu-geil.de
+ freemail_domains zubee.com
+ freemail_domains zuvio.com
+ freemail_domains zwallet.com
+ freemail_domains zworg.com
+ freemail_domains zybermail.com
+ freemail_domains zzn.com
+ endif
+endif
projects / proxmox-spamassassin.git / commitdiff