# HTML-PATTERNS.RC
#
#  Patterns in HTML common to spam.
LT2=no

# JavaScript in message body
#
#  Even when JavaScript is not blocked outright as dangerous content,
#  it's normally a reliable sign of bulk marketing email.  Bulk marketing
#  email that you did not request is spam, and if you did request it,
#  you should whitelist it in your LEGITLISTS file.
#
:0 B
* LEANTAG ?? no
* -1000^0
*   600^1 ()<SCRIPT language=
*   600^1 ()</SCRIPT>
*   500^0 ()<object
*   300^0 codebase
*   300^0 data
*   300^0 (file:/)?.*[a-z]?:/
*   100^0 classid
*   100^0 clsid:[-0-9a-f]+
{
 LT3=yes
 LT2=yes

 SBLOG="C3R-Pattern Match (${TESTNAME}) (Embedded Script)"
 INCLUDERC=${SBDIR}/functions/loglevel.rc
}


# Unnecessary Base64 encoding
#
#  Email in Text/Plain or Text/HTML Content-Type:, with a charset
#  that isn't Unicode or a character-based language (like Chinese,
#  Japanese, or Korean) has no reason whatsoever to be BASE64-encoded
#  except spammer obfuscation.  This recipe catches that email.
#
LT4=no

:0
* LT2 ?? no
* BASE64BLOCK ?? yes
* ! ^Content-Type: text/(plain|html); charset=.?(big5|chinesebig5|euc.(jp|kr)|gb-?(1988|2312|18030)|iso-10646|iso-2022-(cn|jp|kr)|jis.C622[06]|jis.x02(01|08|12)|shift.jis|ks.c.5601-198[79]|utf.?[78]|windows.31j).?$
* ! ^X-MIME-Autoconverted: from 8bit to base64
* ! ^X-SBRule: (Chinese|Japanese|Korean)
* ^Content-Type: text/(plain|html)
* ^Content-Transfer-Encoding: base64$
{ LT4=yes }

:0
* LT2 ?? no
* BASE64BLOCK ?? yes
* LT4 ?? no
* LEANTAG ?? no
* ! ^X-SBRule: (Chinese|Japanese|Korean)
{
 :0 B
 * ! ^(- )?--[-_0-9a-z.=+/$()]+$Content-Type: text/(plain|html);[^-_0-9a-z]*charset( )?=( )?.?(big5|chinesebig5|euc.(jp|kr)|gb(-)?(1988|2312|18030)|iso-10646|iso-2022-(cn|jp|kr)|jis.C622[06]|jis.x02(01|08|12)|shift.jis|ks.c.5601-198[79]|utf.?[78]|windows.31j).?$
 * ! ^(- )?--[-_0-9a-z.=+/$()]+$Content-Type: text/(plain|html);?$[^-_0-9a-z]*charset( )?=( )?.?(big5|chinesebig5|euc.(jp|kr)|gb(-)?(1988|2312|18030)|iso-10646|iso-2022-(cn|jp|kr)|jis.C622[06]|jis.x02(01|08|12)|shift.jis|ks.c.5601-198[79]|utf.?[78]|windows.31j).?$
 * -1000^0
 *  1100^0   ^(- )?--[^ ]+$Content-Type: text/(plain|html);?$?[^0-9a-z]*charset( )?=( )?(\")?[-0-9a-z]+(\")?$Content-Transfer-Encoding: base64$
 *  1100^0   ^(- )?--[^ ]+$Content-Type: text/(plain|html).*$(.+$)*Content-Transfer-Encoding: base64$
 { LT4=yes }
}

:0
* LT4 ?? yes
{
 LT3=yes
 LT2=yes

 SBLOG="C3R-Pattern Match (${TESTNAME}) (Unnecessary Base64 encoding)"
 INCLUDERC=${SBDIR}/functions/loglevel.rc
}


# CID:GIF or CID:JPG in Russian Language Email
#
:0
* LT2 ?? no
* LEANTAG ?? no
* ! CYRILLIC ?? yes
* ! RUSSIAN ?? yes
* ^Content-Type: multipart/(alternative|mixed|related)
{
 :0 B
 * ! --.*forwarded message --
 * ! ^forwarded message:
 * -1000^0
 *   300^0   ^Content-Type: text/(plain|html)(.*$)+[^0-9a-z]*charset( )?=( )?.?(iso-ir-111|koi8-[ru]|windows-1251).?$
 *   300^0   ^Content-Type: text/(plain|html).*;[^0-9a-z]*charset( )?=( )?.?(iso-ir-111|koi8-[ru]|windows-1251).?$
 *   300^0   (^|[^0-9a-z])src.?$?.?=.?$?.?(3d)?\"cid:
 *   500^0   ^(- )?--[-_0-9a-z.=+/$()]+$Content-Type: image/(gif|p?jpe?g)(; |[^0-9a-z]*$[^0-9a-z]*)name=(\")?[0-9a-z][-_0-9a-z]+(\.|=2e)(gif|p?jpe?g)(\")?$(.*$)?\
              Content-Transfer-Encoding: base64$(.*$)?\
              Content-ID: <[^ ]+>$
 *   500^0   ^(- )?--[-_0-9a-z.=+/$()]+$Content-Type: image/(gif|p?jpe?g)(; |[^0-9a-z]*$[^0-9a-z]*)name=(\")?[0-9a-z][-_0-9a-z]+(\.|=2e)(gif|p?jpe?g)(\")?$(.*$)?\
              Content-ID: <[^ ]+>$(.*$)?\
              Content-Transfer-Encoding: base64$
 {
  LT3=yes
  LT2=yes

  SBLOG="C3R-Pattern Match (${TESTNAME}) (Russian language email with CID:GIF or CID:JPG attachment)"
  INCLUDERC=${SBDIR}/functions/loglevel.rc
 }
}


# Typical Freemail drop-box address in Russian Language Email
#
LT4=no

:0
* LT2 ?? no
* LEANTAG ?? no
* ! CYRILLIC ?? yes
* ! RUSSIAN ?? yes
* ^Content-Type: multipart/(alternative|mixed|related)
{
 :0 B
 * ! --.*forwarded message --
 * ! ^forwarded message:
 * -1000^0
 *   300^0   ^Content-Type: text/(plain|html)(.*$)+[^0-9a-z]*charset( )?=( )?.?(iso-ir-111|koi8-[ru]|windows-1251).?$
 *   300^0   ^Content-Type: text/(plain|html).*;[^0-9a-z]*charset( )?=( )?.?(iso-ir-111|koi8-[ru]|windows-1251).?$
 *   1100^0   (\")mailto:[0-9a-z][-_0-9a-z]+(@|=40|%40)netscape(я|\.|=2E|%2E)net(\")
 { LT4=yes }
}

:0
* LT2 ?? no
* LT4 ?? no
* LEANTAG ?? no
* ^Content-Type: text/(plain|html); charset( )?=( )?(\")?(iso-ir-111|koi8-[ru]|windows-1251)
{
 :0 B
 *  (\")mailto:[0-9a-z][-_0-9a-z]+(@|=40|%40)(bonbon(я|\.|[=%]2E)net|\
                                              gmail(я|\.|[=%]2E)ru|\
                                              km(я|\.|[=%]2E)ru|\
                                              netscape(я|\.|[=%]2E)net|\
                                              rambler(я|\.|[=%]2E)ru|\
                                              yandex(я|\.|[=%]2E)ru)(\")
 { LT4=yes }
}

:0
* LT4 ?? yes
{
 LT3=yes
 LT2=yes

 SBLOG="C3R-Pattern Match (${TESTNAME}) (Russian language email with characteristic Freemail drop-box)"
 INCLUDERC=${SBDIR}/functions/loglevel.rc
}

# Russian Language Email with Obfuscated Phone Number
#
:0
* LT2 ?? no
* LEANTAG ?? no
* ! CYRILLIC ?? yes
* ! RUSSIAN ?? yes
* ^Content-Type: (multipart/(alternative|mixed|related)|\
                  text/(plain|html); charset( )?=( )?(\")?(iso-ir-111|koi8-[ru]|windows-1251)(\")?)
{
 :0
 * ! --.*forwarded message --
 * ! ^forwarded message:
 * -1000^0
 * H ??   300^0   ^Content-Type: text/(plain|html)(.*$)+[^0-9a-z]*charset( )?=( )?.?(iso-ir-111|koi8-[ru]|windows-1251).?$
 * B ??   300^0   ^Content-Type: text/(plain|html)(.*$)+[^0-9a-z]*charset( )?=( )?.?(iso-ir-111|koi8-[ru]|windows-1251).?$
 * B ??   300^0   ^Content-Type: text/(plain|html);[^0-9a-z]*charset( )?=( )?.?(iso-ir-111|koi8-[ru]|windows-1251).?$
 * B ??   800^0   ()<FONT size=5>+[7-8]( )*\(0?95\)( )*[^ ][^ ][^ ][^0-9a-z][^ ][^ ][^0-9a-z][^ ][^ ]</FONT>
 * B ??   800^0   ()\(0?(44|67|95)\)(</?[0-9a-z]+>|( )*)?[^0-9][^ ][^ ][^0-9a-z]+[^ ][^ ][^0-9a-z][^ ][^ ]([^0-9]|$)
 * B ??   800^0   ()\(0?(44|67|95)\)(</?[0-9a-z]+>|( )*)?[^ ][^0-9][^ ][^0-9a-z]+[^ ][^ ][^0-9a-z][^ ][^ ]([^0-9]|$)
 * B ??   800^0   ()\(0?(44|67|95)\)(</?[0-9a-z]+>|( )*)?[^ ][^ ][^0-9][^0-9a-z]+[^ ][^ ][^0-9a-z][^ ][^ ]([^0-9]|$)
 * B ??   800^0   ()\(0?(44|67|95)\)(</?[0-9a-z]+>|( )*)?[^ ][^ ][^ ][^0-9a-z]+[^0-9][^ ][^0-9a-z][^ ][^ ]([^0-9]|$)
 * B ??   800^0   ()\(0?(44|67|95)\)(</?[0-9a-z]+>|( )*)?[^ ][^ ][^ ][^0-9a-z]+[^ ][^0-9][^0-9a-z][^ ][^ ]([^0-9]|$)
 * B ??   800^0   ()\(0?(44|67|95)\)(</?[0-9a-z]+>|( )*)?[^ ][^ ][^ ][^0-9a-z]+[^ ][^ ][^0-9a-z][^0-9][^ ]([^0-9]|$)
 * B ??   800^0   ()\(0?(44|67|95)\)(</?[0-9a-z]+>|( )*)?[^ ][^ ][^ ][^0-9a-z]+[^ ][^ ][^0-9a-z][^ ][^0-9]([^0-9]|$)
 * B ??   800^0   ( )[0-9][0-9][0-9]( )[§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=][§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=][§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=]\+[§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=][§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=]\+[§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=][§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=]([^§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=]|$)
 * B ??   800^0   ( )[§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=][0-9][0-9]( )[§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=][§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=][§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=]\+[§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=][§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=]\+[§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=][§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=]([^§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=]|$)
 * B ??   800^0   ( )[0-9][§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=][0-9]( )[§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=][§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=][§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=]\+[§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=][§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=]\+[§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=][§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=]([^§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=]|$)
 * B ??   800^0   ( )[0-9][0-9][§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=]( )[§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=][§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=][§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=]\+[§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=][§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=]\+[§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=][§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=]([^§абвгдежзийклмнопрстуфхцшщъыьэюяЧa-z0-9=]|$)
 * B ??   800^0   ()\(( )[^ ]?( )4( )4( )\)
 * B ??   800^0   ()\(( )[^ ]?( )6( )7( )\)
 * B ??   800^0   ()\(( )[^ ]?( )9( )5( )\)
 * B ??   800^0   ()\((044|067|095)\)[^0-9]*$
 * B ??   800^0   (^|[^-_0-9a-z]|[=%]20)\+[78] \([^ )][^ )][^ )]?\)--[^ )][^ )][^ )]--[^ )][^ )]--[^ )][^ )]([^a-z0-9.]|\. |\.$|$)
 * B ??   800^0   (^|[^0-9])[0-1]*(95[^0-9a-z]*)?[0-9][0-9][0-9][^0-9a-z]*(&nbsp;)+[^0-9a-z]*[0-9][0-9][^0-9a-z]*(&nbsp;)*[^0-9a-z]*[0-9][0-9]([^0-9]|$)
 * B ??   800^0   (^|[^0-9])[0-1]*(95[^0-9a-z]*)?[0-9][0-9][0-9][^0-9a-z]*(&nbsp;)*[^0-9a-z]*[0-9][0-9][^0-9a-z]*(&nbsp;)+[^0-9a-z]*[0-9][0-9]([^0-9]|$)
 * B ??   800^0   (^|[^0-9])(ПДЙО|РСФШ|ЫЕУФШ|ЧПУЕНШ)-(ПДЙО|РСФШ|ЫЕУФШ|ЧПУЕНШ)-(ПДЙО|РСФШ|ЫЕУФШ|ЧПУЕНШ)(-(ПДЙО|РСФШ|ЫЕУФШ|ЧПУЕНШ))?([^0-9]|$)
 {
  LT3=yes
  LT2=no

  SBLOG="C3R-Pattern Match (${TESTNAME}) (Russian language email with Obfuscated Phone Number)"
  INCLUDERC=${SBDIR}/functions/loglevel.rc
 }
}

# Message consisting of attached image(s), but no URL
# or email address.
#
:0
* LT2 ?? no
* LEANTAG ?? no
* ^Content-Type: multipart/(alternative|mixed|related)
{
 :0 B
 * !  (^|[^-_0-9a-z]|[=%]20)h(=$)?t(=$)?t(=$)?p(=$)?s?(=$|$)?:(=$)?/(=$)?/
 * !  (^|[^-_0-9a-z]|[=%]20)f(=$)?t(=$)?p(=$)?:(=$)?/(=$)?/
 * !  (^|[^-_0-9a-z]|[=%]20)m(=$)?a(=$)?i(=$)?l(=$)?t(=$)?o(=$)?:
 * -1000^0
 *   500^0   ()<IMG[^>]*SRC( )*=(3D)?( )*\"cid:
 *   300^0   ^Content-Type: image/(gif|jpe?g|png)
 *   300^0   ^[^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ]\
              [^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ]\
              [^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ]\
              [^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ]\
              [^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ]\
              [^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ]+$\
              [^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ]\
              [^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ]\
              [^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ]\
              [^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ]\
              [^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ]\
              [^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ]+$\
              [^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ]\
              [^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ]\
              [^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ]\
              [^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ]\
              [^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ]\
              [^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ][^ ]+
 {
  LT3=yes
  LT2=yes

  SBLOG="C3R-Pattern Match (${TESTNAME}) (HTML message with attached image(s), no URL or email address)"
  INCLUDERC=${SBDIR}/functions/loglevel.rc
 }
}

# Message contains MIME section for JPG attachment, not a JPG file.
#
:0
* LT2 ?? no
* LEANTAG ?? no
* ^Content-Type: multipart/(alternative|mixed|related)
{
 :0 B
 * ! --.*forwarded message --
 * ! ^forwarded message:
 * -1000^0
 * -1100^0   ^(- )?--[^ ]+$\
              ([^0-9a-z]*[a-z][-_0-9a-z]+[:=].*$)*\
              Content-Type: image/p?jpe?g;$\
              ([^0-9a-z]*[a-z][-_0-9a-z]+[:=].*$)*$\
              /9j/[^ ]+$[^ ]+$
 *  1100^0   ^(- )?--[^ ]+$\
              ([^0-9a-z]*[a-z][-_0-9a-z]+[:=].*$)*\
              Content-Type: image/p?jpe?g;$\
              ([^0-9a-z]*[a-z][-_0-9a-z]+[:=].*$)*$\
              [^ ]+$[^ ]+$
 {
  LT3=yes
  LT2=yes

  SBLOG="C3R-Pattern Match (${TESTNAME}) (JPG-format MIME attachment, not a JPG file)"
  INCLUDERC=${SBDIR}/functions/loglevel.rc
 }
}