Block spam uses drug names in Subject with SpamAssassin

Clifton's test rules for drug spam that uses obfu drug names, and doesn't mention the real name

CODE:
  1. ## Idea from Clifton Royston
  2. ## Subpatterns for obscured subject content, based on observations of actual
  3. ## spam which was bypassing "drug" tests.
  4. # A = (a|A|\(a\)|4|@) V = (v|V|\\/) I = (i|I|1|\xef|\|) note: \xef = umlaut i
  5. # O = (o|O|0)  G = (g|G)  M = (m|M|rn)  R = (r|R)  X = (x|X|><)  N = (n|N)
  6. # S = (s|S|$|5)  L = (l|L|\|) U = (u|U|\(u\)) E = (e|E|3)  T=(t|T|7)
  7. # Y = (y|Y)  C=(c|C)
  8. # obscuring punctuation = [:^."%()*\[\\]
  9. header __TT_VIAGRA     Subject =~ /VIAGRA/i
  10. header __TT_OBSCURED_VIAGRA Subject =~ /(v|V|\\\/)(i|I|1|\xef|\|)(a|A|\(a\)|4|@)(g|G)(r|R)(a|A|\(a\)|4|@)/
  11. header __TT_BROKEN_VIAGRA  Subject =~ /V[:^."%()*\[\\]?I[:^."%()*\[\\]?A[:^."%()*\[\\]?G[:^."%()*\[\\]?R[:^."%()*\[\\]?A/i
  12. meta TT_OBSCURED_VIAGRA         ( __TT_BROKEN_VIAGRA || __TT_OBSCURED_VIAGRA ) && ! __TT_VIAGRA
  13. describe TT_OBSCURED_VIAGRA     Scora: obscured "VIAGRA" in subject
  14.  
  15. header __TT_XANAX       Subject =~ /XANAX/i
  16. header __TT_OBSCURED_XANAX  Subject =~ /(x|X|><)(a|A|\(a\)|4|@)(n|N)(a|A|\(a\)|4|@)(x|X|><)/
  17. header __TT_BROKEN_XANAX   Subject =~ /X[:^."%()*\[\\]?A[:^."%()*\[\\]?N[:^."%()*\[\\]?A[:^."%()*\[\\]?X/i
  18. meta TT_OBSCURED_XANAX          ( __TT_BROKEN_XANAX || __TT_OBSCURED_XANAX ) && ! __TT_XANAX
  19. describe TT_OBSCURED_XANAX      Scora: obscured "XANAX" in subject
  20.  
  21. header __TT_VALIUM     Subject =~ /VALIUM/i
  22. header __TT_OBSCURED_VALIUM  Subject =~ /(v|V|\\\/)(a|A|\(a\)|4|@)(l|L|\|)(i|I|1|\xef|\|)(u|U|\(u\))(m|M)/
  23. header __TT_BROKEN_VALIUM Subject =~ /V[:^."%()*\[\\]?A[:^."%()*\[\\]?L[:^."%()*\[\\]?I[:^."%()*\[\\]?U[:^."%()*\[\\]?M/i
  24. meta TT_OBSCURED_VALIUM         ( __TT_BROKEN_VALIUM || __TT_OBSCURED_VALIUM ) && ! __TT_VALIUM
  25. describe TT_OBSCURED_VALIUM     Scora: obscured "VALIUM" in subject


Leave a Reply

You must be logged in to post a comment.