# SPAMSW-PATTERNS.RC # # Recipes to catch known spam-only software. # # Last updated: 4/09/2006 # Bogus AOL Mailer :0 * ^X-Mailer:.*[^-_0-9a-z]AOL([^a-z0-9.]|\. |\.$|$) * ! ^Received: from .*[^-_0-9a-z]aol\.com([^a-z0-9.]|\. |\.$|$) { SBLOG="A1R-Spam Software (Bogus AOL X-Mailer)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 8^0 { SBSCORE=$= } } # Bogus AV Mailer # :0 D * ^X-Mailer: [a-z]+ [a-z]+ [a-z]+$ * ^Received: from [0-9][0-9][0-9]\.[0-9][0-9][0-9]\.[0-9][0-9][0-9]\.[0-9][0-9][0-9] \(\[[0-9][0-9][0-9]\.[0-9][0-9][0-9]\.[0-9][0-9][0-9]\.[0-9][0-9][0-9]\]\) * ^X-Declude-Sender: * ^X-Note: This E-mail was scanned by Declude JunkMail \(www\.declude\.com\) for spam\.$ { SBLOG="A1R-Spam Software (Bogus AV Mailer)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 10^0 { SBSCORE=$= } } # Book Words Mailer # :0 D * ^X-Mailer: ([a-z][a-z]+ )*$ * boundary=\"(--)?[0-9][0-9]+\" { SBLOG="A1R-Spam Software (Book Words Mailer)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 10^0 { SBSCORE=$= } } # Book Words Mailer (new) # # Testing a recipe for a morph of the Book Words Mailer. # :0 * LEANTAG ?? no * ^Content-Type: multipart/alternative * ^[^0-9a-z]*boundary=\"[0-9]+\"$ { :0 BD * !--.*forwarded message -- * !^forwarded message: * -1000^0 * 1100^0 ^--[0-9]+$\ Content-Type: text/plain;$\ () charset=\"windows-1252\"$\ Content-Transfer-Encoding: 7Bit$$\ (([A-Za-z][a-z]+ )+$)+$$\ --[0-9]+$\ Content-Type: text/html;$\ () charset=\"windows-1252\"$\ Content-Transfer-Encoding: 7Bit$$\ ()$\ ()
$\ ()(([A-Za-z][a-z]+ )+$)+$ { SBLOG="A1R-Spam Software (New Book Words Mailer)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 10^0 { SBSCORE=$= } } } # Dmailer :0 * ! ^X-Mailer:.*(BillettServiceMail|GRMessageQueue) * ^(To:.*[^0-9a-z]d.?mail(er)?[^0-9a-z]|\ X-Mailer: ([a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9][a-z0-9]?[a-z0-9]?[a-z0-9]?[a-z0-9]?[a-z0-9]?[a-z0-9]?[a-z0-9]?[a-z0-9]?[a-z0-9]?[a-z0-9]?[a-z0-9]?[a-z0-9]?[a-z0-9]?[a-z0-9]?[a-z0-9]?[a-z0-9]?[a-z0-9]?[a-z0-9]?[a-z0-9]?[a-z0-9]?$|\ D(yna)?Mailer)) { SBLOG="A1R-Spam Software (Dmailer)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 { DMAILER=yes } :0 * $ ${SBSCORE}^0 * 10^0 { SBSCORE=$= } } # Golden Launcher :0 * ^X-Mailer: Microsoft Outlook Express 5\.00\.2919\.6900 DM { SBLOG="A1R-Spam Software (Golden Launcher)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 10^0 { SBSCORE=$= } } # MIME-ALT Mailer :0 D * LOCALTAG ?? no * -1000^0 * 300^0 ^Received:.*[^0-9a-z.]mail\.pander\.com([^a-z0-9.]|\. |\.$|$) * 300^0 ^Received:.*[^0-9a-z.]mail\.poke\.com([^a-z0-9.]|\. |\.$|$) * 600^0 ^X-Mailer: mPOP Web-Mail 2\.19$ * 600^0 ^X-Mailer: miPOP WebMail 3\.29$ * 600^0 ^X-Originating-IP: \[[0-9a-z][-_0-9a-z]+\.[a-z][a-z][a-z]?[a-z]?IP\] * 600^0 boundary=\"--ALT-- * 600^0 ^Subject: (Fwd|Re): ([A-Z]+|%RND_UC_CHAR\[[0-9]-[0-9]\]),([0-9]+,)? [0-9a-z]+[^0-9a-zA-Z]* [0-9a-z]+[^0-9a-zA-Z]* [0-9a-z]+([^0-9a-zA-Z]*|\[[0-9]+\])$ { SBLOG="A1R-Spam Software (MIME-ALT Mailer)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 10^0 { SBSCORE=$= } } # mail.ru phony "legitimate" bulk mailing list :0 * LOCALTAG ?? no * -1000^0 * 1100^0 ^(Batched-Sender|From|Received|Reply-To|To):.*[^0-9a-z](mail\.ru|subscribe\.ru)([^a-z0-9.]|$) * 1100^0 ^(Batched-IP|Received|X-Original-IP):.*[^0-9a-z]194\.67\.45\.[0-9][0-9]?[0-9]?([^a-z0-9.]|$) * 1100^0 ^To:.*[^0-9a-z]subscribers@list\.ru([^a-z0-9.]|$) * 600^0 ^X-Mailer: miPOP WebMail 3\.29$ * 600^0 ^X-Originating-IP: \[[0-9a-z][-_0-9a-z]+\.[a-z][a-z][a-z]?[a-z]?IP\] * 600^0 boundary=\"--ALT-- * 600^0 ^Subject: (Fwd|Re): ([A-Z]+|%RND_UC_CHAR\[[0-9]-[0-9]\]),([0-9]+,)? [0-9a-z]+[^0-9a-zA-Z]* [0-9a-z]+[^0-9a-zA-Z]* [0-9a-z]+([^0-9a-zA-Z]*|\[[0-9]+\])$ { SBLOG="A1R-Spam Software (mail.ru phony "legitimate" bulk email list)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 10^0 { SBSCORE=$= } } # Message.html spam software # :0 * LEANTAG ?? no * ^Content-Type: multipart/(alternative|mixed|related) { :0 B * ! --.*forwarded message -- * ! ^forwarded message: * ^--[^ ]+$\ Content-Type: text/plain; charset=us-ascii$\ Content-Transfer-Encoding: 7bit$$\ See attachment message\.html$ { SBLOG="A1R-message.html spam software" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 10^0 { SBSCORE=$= } } } # Message.html spam software morph # :0 * LEANTAG ?? no * ^Content-Type: multipart/alternative; boundary= { :0 B * ! --.*forwarded message -- * ! ^forwarded message: * ^--[^ ]+$\ Content-Type: text/(plain|html); charset=\"[-_0-9a-z]+\"$\ Content-Transfer-Encoding: quoted-printable$$\ (^[^ ]+$)+$\ --[^ ]+$ { SBLOG="A1R-message.html spam software morph" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 10^0 { SBSCORE=$= } } } # Phony mPop Mailer # # (Morph of MIME-ALT mailer) # :0 D * LOCALTAG ?? no * -1000^0 * 600^0 ^X-Mailer: mPOP Web-Mail 2\.19$ * 600^0 ^X-Originating-IP: \[[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\] * 600^0 boundary=\"[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]+\" { SBLOG="A1R-Spam Software (Phony mPop Mailer)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 10^0 { SBSCORE=$= } } # myguestbook.exe :0 * !--.*forwarded message -- * !^forwarded message: * -1000^0 * -200^1 ^[:;#>] * 500^0 ^References:\s+[A-F0-9]{9,9}$ * 500^0 ^X-References:\s+[A-F0-9]{9,9}, [A-F0-9]{9,9}$ * 500^0 ^X-Other-References:\s+[A-F0-9]{9,9}$ * 500^0 ^X-In-Response-To:\s+[A-F0-9]{9,9}$ * 500^0 ^X-See-Also:\s+[A-F0-9]{9,9}$ * 500^0 ^X-Via:.+#$ * 500^0 ^X-Mailer:.+Internet Mail Service \[[0-9.]+\] * 500^0 ^MessageID: { SBLOG="A1R-Spam Software (myguestbook.exe)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 10^0 { SBSCORE=$= } } # Phony "The Bat" Email Client # :0 D * LOCALTAG ?? no * -1000^0 * 600^0 ^X-Mailer: The Bat! \([0-9a-z.]+\) CD5BF9353B3B7091$ { SBLOG="A1R-Spam Software (Phony The Bat Mailer)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 10^0 { SBSCORE=$= } } # Mailer with Random X-Mailer Header string :0 * ! DMAILER ?? yes * ! ^X-Mailer:.*GRMessageQueue * ^X-Mailer: [a-z0-9][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.][a-z0-9.] { SBLOG="A1R-Spam Software (Random X-Mailer string)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 8^0 { SBSCORE=$= } } # Other Spam Software X-Mailer: headers :0 * ^X-(Mailer|Server): .*(\{\%xmailer\%\}|\ [0-9]+KingInfo_Mailer|\ 4Admin\(tm\) Spam Filter|\ Accucast|\ AcquireWeb|\ AppMailer|\ ArGoSoft MX Mailer|\ Aristotle|\ AutoroMail|\ BallSacMailer|\ BulkMailer|\ carboxylic|\ cgiemail|\ CSM[ ]|\ Cybercreek Avalanche|\ DailyXMailer|\ DBM|\ dd <[0-9][0-9]>|\ diachronic|\ Diffondi|\ Direct Email|\ disjunctive|\ DM-SenderEX|\ Easy Mass Mailer|\ eBizmailer|\ eGroups Message Poster|\ EhooPost|\ E-Mail Connection|\ Email Panther|\ eMerge|\ Envex|\ FletMail|\ FoxMail|\ Gammadyne|\ GoldMine|\ GRMessageQueue|\ ikonmktg@|\ ikonmktg\.com|\ Jackpot|\ JBH Msender|\ jfmailer|\ JiXing|\ Kaufman Mail Warrior|\ KingInfo_Mailer|\ Klayperuda|\ knowspam\.net|\ Mach5|\ Mail Bomber|\ Mailchute|\ Mailer Signature|\ MailKing|\ MailWorkZ|\ MailXSender|\ MassE-Mail|\ massmail\.pl|\ Mega-Mailer|\ Millennium Mailer|\ Mindcast|\ Mircosoft|\ MMailer|\ Mozzila|\ MSOUTLOOK|\ Multimailer|\ mxMAILPro|\ Newsomemail|\ Nixonmail|\ Odulo BulkMail Master|\ Opt-In Lightning|\ PostCast|\ QuickSender|\ QuickSMTP|\ RIME|\ RLSP Mailer|\ Robot-Mail|\ RoryMAILER|\ Sir Mail-A-Lot|\ SmartMailer|\ SMTP COMPONENT|\ StormPost|\ Super Mailer 9|\ Telesale|\ The HARVESTER|\ TopMail|\ UFO Mailer|\ UFOMarketingPro|\ V3,1,6,1|\ VolleyMail|\ WC Mail __ty__|\ X-Mailer|\ YDH_optin_v[0-9].[0-9]|\ yougotit|\ YourWorldNews) { :0 { XMAILER=`${FORMAIL} -xX-Mailer:` } SBLOG="A1R-Spam Software (X-Mailer:${XMAILER})" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${SBSCORE}^0 * 10^0 { SBSCORE=$= } } # Spam Software -- Header Stigmata # :0 * (^Abuse2-Tracking:|\ (^|[^0-9a-z])boundary=\"MWZRelatedMessage\"|\ ^Content-Alias:|\ ^Content-Type: Commercial E-Mail|\ ^Content-type: .*boundary=.?\#MYBOUNDARY\#|\ ^Disposition-Notification-Options:|\ ^FCC:|\ ^From: [0-9a-z]+\|[0-9a-z]+ <[0-9a-z]+\|[0-9a-z]+@[0-9a-z]+\.[a-z][a-z]+>$|\ ^Mail-System-Version: Broadc@st HTML|\ ^Message-ID:--- Sent by UNREGISTERED VERSION of Atomic Mail Sender\.\
()
Please register to remove this message\.$\
()$
* 1100^0 ^This mailer was created with Campaigner\.$\
http://www\.gotmarketing\.com\?testdrive_0$
* 1100^0 (^|[^0-9a-z])A HREF( )*=( )*\"h(
)t(
)?t(
)?p(
)?\
:(
)?/(
)?
* 1100^0 (^|[^0-9a-z])A HREF( )*=( )*\"h(
)?t(
)t(
)?p(
)?\
:(
)?/(
)?
* 1100^0 (^|[^0-9a-z])A HREF( )*=( )*\"h(
)?t(
)?t(
)p(
)?\
:(
)?/(
)?
* 1100^0 (^|[^0-9a-z])A HREF( )*=( )*\"h(
)?t(
)?t(
)?p(
)\
:(
)?/(
)?
* 1100^0 (^|[^0-9a-z])A HREF( )*=( )*\"h(
)?t(
)?t(
)?p(
)?\
:(
)/(
)?
* 1100^0 (^|[^0-9a-z])A HREF( )*=( )*\"h(
)?t(
)?t(
)?p(
)?\
:(
)?/(
)
* 1100^0 :\\/[a-z]+\.net%2E[a-z]
{
SBLOG="A1R-Spam Software (Body Stigmata)"
INCLUDERC=${SBDIR}/functions/loglevel.rc
:0
* $ ${SBSCORE}^0
* 8^0
{ SBSCORE=$= }
}
# MIME encoded email with spamsign in Text/Plain section
#
# A lot of spamware uses a dual-part Text/HTML format, but puts
# nothing in the text section at all. Legitimate email software
# doesn't do this.
#
:0
* LEANTAG ?? no
* ^Content-Type: (multipart/(alternative|mixed|related)|\
text/html)
{
:0 B
* !--.*forwarded message --
* !^forwarded message:
* -1000^0
* 1100^0 ^(- )?--[-_0-9a-z.=+/$]+$Content-Type: text/plain;?$?[^-_0-9a-z]*charset=.?[-0-9a-z]+.?$Content-Transfer-Encoding: [-_0-9a-z\.]+$$Your mailer do not support HTML messages\.( )*Switch to a better mailer\.$
* 1100^0 ^(- )?--[-_0-9a-z.=+/$]+$Content-Type: text/plain;?$?[^-_0-9a-z]*charset=.?[-0-9a-z]+.?$Content-Transfer-Encoding: [-_0-9a-z\.]+$$No plain text content\. Please use a HTML enabled email reader(\.)?$$(- )?--[-_0-9a-z.=+/$]+$
* 1100^0 ^(- )?--[-_0-9a-z.=+/$]+$Content-Type: text/plain;?$?[^-_0-9a-z]*charset=.?[-0-9a-z]+.?$Content-Transfer-Encoding: [-_0-9a-z\.]+$$This is an HTML message\.$$(- )?--[-_0-9a-z.=+/$]+$
* 1100^0 ^(- )?--[-_0-9a-z.=+/$()]+$Content-Type: text/plain;?$Content-Transfer-Encoding: [-_0-9a-z\.]+$$(--------------------------------------------------------------------$)+\(This safeguard is not inserted when using the registered version\)$(--------------------------------------------------------------------$)+
* 1100^0 ^(- )?--[-_0-9a-z.=+/$()]+$Content-Type: text/plain;?$Content-Transfer-Encoding: [-_0-9a-z\.]+$$+\.\.\.\.\. This is an HTML Message \! \.\.\.\.\.$
* 1100^0 ^(- )?--[-_0-9a-z.=+/$()]+$Content-Type: text/plain;?$Content-Transfer-Encoding: [-_0-9a-z\.]+$$+Please use MIME\(HTML\) Email Client to read this mail$
* 1100^0 ^(- )?--[-_0-9a-z.=+/$()]+$Content-Type: text/plain;?$Content-Transfer-Encoding: [-_0-9a-z\.]+$$+ÕâÊÇÒ»¸öHTML¸ñʽµÄÓʼþ/This is a html format mail$
* 1100^0 ^(- )?--[-_0-9a-z.=+/$()]+$Content-Type: text/plain;?$Content-Transfer-Encoding: [-_0-9a-z\.]+$$+Please use MIME-capable reader\.$
* 1100^0 ^(- )?--[-_0-9a-z.=+/$()]+$Content-Type: text/plain;?$Content-Transfer-Encoding: [-_0-9a-z\.]+$$+If you are reading this message, your email browser does not support$
* 1100^0 ^(- )?--[-_0-9a-z.=+/$()]+$Content-Type: text/plain;?$Content-Transfer-Encoding: [-_0-9a-z\.]+$$+HTML formatting\. Please disregard the HTML code below this message\.$
* 1100^0 ^(- )?--[-_0-9a-z.=+/$()]+$Content-Type: text/plain;?$Content-Transfer-Encoding: [-_0-9a-z\.]+$$+Your Email Client does not support MIME encoding. Please upgrade to$
* 1100^0 ^(- )?--[-_0-9a-z.=+/$()]+$Content-Type: text/plain;?$Content-Transfer-Encoding: [-_0-9a-z\.]+$$+(.*$)+\(almost every modern Email Client is MIME-capable\)\.$
* 1100^0 ^(- )?--[-_0-9a-z.=+/$()]+$Content-Type: text/plain;?$Content-Transfer-Encoding: [-_0-9a-z\.]+$$+(.*$)+This message is in HTML format\. [0-9a-z\.]+$
* 1100^0 ^(- )?--[-_0-9a-z.=+/$()]+$Content-Type: text/plain;?$Content-Transfer-Encoding: [-_0-9a-z\.]+$$+(.*$)+No text version was provided[0-9a-z\.]+$
* 1100^0 ^(- )?--[-_0-9a-z.=+/$()]+$Content-Type: text/plain;?$Content-Transfer-Encoding: [-_0-9a-z\.]+$$+(.*$)+This mail was sent in html format\. Please open the attached file\.$
* 1100^0 ^(- )?--[-_0-9a-z.=+/$()]+$Content-Type: text/plain;?$Content-Transfer-Encoding: [-_0-9a-z\.]+$$+(.*$)+Ëÿ ëÿ ëÿ$
* 1100^0 ^This plain text message area is for recipients who have\
email programs that do not support html $
* 1100^0 ^Please view this message in HTML\. This is a Placeholder\.$
* 1100^0 ^Please view this message in HTML\.$
* 1100^0 ^Please use a HTML capable email client to view this message\.$
* 1100^0 ^Get a capable html e-mailer$
* 1100^0 ^