You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jm...@apache.org on 2004/05/07 07:16:18 UTC
svn commit: rev 10553 - in incubator/spamassassin/trunk: . rules
Author: jm
Date: Thu May 6 22:16:17 2004
New Revision: 10553
Modified:
incubator/spamassassin/trunk/CREDITS
incubator/spamassassin/trunk/rules/20_drugs.cf
incubator/spamassassin/trunk/rules/70_testing.cf
Log:
bug 3009: Matt Kettler's antidrug.cf ruleset taken out of testing and added to core ruleset
Modified: incubator/spamassassin/trunk/CREDITS
==============================================================================
--- incubator/spamassassin/trunk/CREDITS (original)
+++ incubator/spamassassin/trunk/CREDITS Thu May 6 22:16:17 2004
@@ -48,6 +48,9 @@
- Ryan Finnie, <ryan(at)finnie.org>: message encapsulation as
message/rfc822 attachment.
+ - Matt Kettler, <mkettler_sa(at)comcast.net>: most of the anti-drug rules in
+ rules/20_drugs.cf; bug fix for list of reserved IP addresses; others.
+
- Brad "anomie" Jorsch, <anomie(at)users.sourceforge.net>: fix
to avoid losing mail from spamc; BSMTP and -e support; tracking of
number of spamd processes; several other mods.
@@ -167,9 +170,6 @@
- Steve Keay, <steve-spamassassin-bugzilla(at)keay.com>: spamd -A network
ranges support.
-
- - Matt Kettler, <mkettler_sa(at)comcast.net>: bug fix for list of reserved IP
- addresses; other misc fixes.
- Vivek Khera, <khera(at)kcilink.com>: contributed to Razor2 patch.
Modified: incubator/spamassassin/trunk/rules/20_drugs.cf
==============================================================================
--- incubator/spamassassin/trunk/rules/20_drugs.cf (original)
+++ incubator/spamassassin/trunk/rules/20_drugs.cf Thu May 6 22:16:17 2004
@@ -1,12 +1,16 @@
# SpamAssassin rules file: drug tests
#
-# Please don't modify this file as your changes will be overwritten with
-# the next update. Use @@LOCAL_RULES_DIR@@/local.cf instead.
-# See 'perldoc Mail::SpamAssassin::Conf' for details.
-#
-# Note: body tests are run with long lines, so be sure to limit the
-# size of searches; use /.{0,30}/ instead of /.*/ to avoid huge
-# search times.
+# This ruleset is intended to detect common "pill spam" however, it is not
+# appropriate for all environments. It may not be appropriate for a medical or
+# pharmaceutical environment. If in doubt, adjust the scores of all the rules
+# to 0.01 and see if they fire off on your daily nonspam.
+#
+# Please don't modify this file as your changes will be overwritten with the
+# next update. Use @@LOCAL_RULES_DIR@@/local.cf instead. See 'perldoc
+# Mail::SpamAssassin::Conf' for details.
+#
+# Note: body tests are run with long lines, so be sure to limit the size of
+# searches; use /.{0,30}/ instead of /.*/ to avoid huge search times.
#
# <@LICENSE>
# Copyright 2004 Apache Software Foundation
@@ -86,4 +90,221 @@
# too easy
body VIA_GAP_GRA /\bvia.gra\b/i
describe VIA_GAP_GRA Attempts to disguise the word 'viagra'
+
+########################################################################
+# male sexual dysfunction drugs
+#
+# This section is undergoing improvements and I'm trying to track down a
+# FP case that seems to mostly affect technical emails.
+# However, all of the test cases so far fail to match when retested.
+# note: The regex /v.i.a.g.r.a/ was intentionally not used
+# due to potential false positive cases with PGP signatures
+# and other base-64ish stuff.
+# instead other patterns are used catch non alphanumeric gapping patterns
+# note: \W = "non word character"
+
+# Note: many of the drugs named in here are brand-names and are trademarked.
+# All trademarks are property of the respective owners.
+#current best char substitutions
+# i - [i1!|l\xEC-\xEF]
+# a - [a4\xE0-\xE6@]
+# e - [e3\xE8-\xEB]
+# o - [o0\xF2-\xF6]
+# u - [u\xB5\xF9-\xFC]
+
+# v - (?:\\\/|V)
+# l - [l!|1]
+#plain Viagra and Cialis (used in obfu detection)
+body __DRUGS_ERECTILE_V /\bViagra\b/i
+body __DRUGS_ERECTILE_C /\bCialis\b/i
+body __DRUGS_ERECTILE_L /\bLevitra\b/i
+# obfu/plain and mis-spelled Viagra variants
+body __DRUGS_ERECTILE1 /(?:\b|\s)[_\W]{0,3}(?:\\\/|V)[_\W]{0,3}[ij1!|l\xEC\xED\xEE\xEF][_\W]{0,3}[a40\xE0-\xE6@][_\W]{0,3}[xyz]?[gj][_\W]{0,3}r[_\W]{0,3}[a40\xE0-\xE6@][_\W]{0,3}x?[_\W]{0,3}(?:\b|\s)/i
+body __DRUGS_ERECTILE2 /\bV(?:agira|igara|iaggra|iaegra)\b/i
+# cialis variants (spelling correct now)
+# note: the rather strange pre-amble is to avoid FPs on french words containing high-ascii chars surrounding
+# "cialis".
+body __DRUGS_ERECTILE3 /(?:\A|[\s\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f])[_\W]{0,3}C[_\W]{0,3}[ij1!|l\xEC\xED\xEE\xEF][_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}l?[l!|1][_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}s[_\W]{0,3}(?:\b|\s)/i
+body __DRUGS_ERECTILE4 /\bC(?:alis|ilias|ilais)\b/i
+# generic names
+#sildenafil citrate
+body __DRUGS_ERECTILE5 /\b_{0,3}s[_\W]?[i1!|l\xEC-\xEF][_\W]?l[_\W]?d[_\W]?[e3\xE8-\xEB][_\W]?n[_\W]?[a4\xE0-\xE6@][_\W]?f[_\W]?[i1!|l\xEC-\xEF][_\W]?l c[_\W]?[i1!|l\xEC-\xEF][_\W]?t[_\W]?r[_\W]?[a4\xE0-\xE6@][_\W]?t[_\W]?[e3\xE8-\xEB]_{0,3}(?:\b|\s)/i
+#Levitra
+body __DRUGS_ERECTILE6 /\b_{0,3}L[_\W]?[e3\xE8-\xEB][_\W]?(?:\\\/|V)[_\W]?[i1!|l\xEC-\xEF][_\W]?t[_\W]?r[_\W]?[a4\xE0-\xE6@][_\W]?(?:\b|\s)/i
+#tadalafil
+body __DRUGS_ERECTILE8 /\b_{0,3}T[_\W]?[a4\xE0-\xE6@][_\W]?d[_\W]?[a4\xE0-\xE6@][_\W]?l[_\W]?[a4\xE0-\xE6@][_\W]?f[_\W]?[i1!|l\xEC-\xEF][_\W]?l_{0,3}\b/i
+# gapped/obfu viagra variants using funky html-style character codes
+rawbody __DRUGS_ERECTILE10 /\b_{0,3}V[_\W]?(?:i|\ï\;)[_\W]?(?:a|\à|\å)\;?[_\W]?g[_\W]?r[_\W]?(?:a|\à|\å)\b/i
+#apcalis - a generic of cialis
+body __DRUGS_ERECTILE11 /(?:\b|\s)_{0,3}[a4\xE0-\xE6@][_\W]{0,3}p[_\W]{0,3}c[_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}[l!|1][_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}s_{0,3}\b/i
+meta DRUGS_ERECTILE (__DRUGS_ERECTILE1 || __DRUGS_ERECTILE2 || __DRUGS_ERECTILE3 || __DRUGS_ERECTILE4 ||__DRUGS_ERECTILE5 ||__DRUGS_ERECTILE6 ||__DRUGS_ERECTILE7 ||__DRUGS_ERECTILE8 || __DRUGS_ERECTILE10 ||__DRUGS_ERECTILE11 )
+describe DRUGS_ERECTILE Refers to an erectile drug
+meta DRUGS_ERECTILE_OBFU ( (__DRUGS_ERECTILE1 &&!__DRUGS_ERECTILE_V) || (__DRUGS_ERECTILE3 && !__DRUGS_ERECTILE_C) ||__DRUGS_ERECTILE2 || (__DRUGS_ERECTILE10 &&!__DRUGS_ERECTILE_V) || (__DRUGS_ERECTILE6 &&!__DRUGS_ERECTILE_L))
+describe DRUGS_ERECTILE_OBFU Obfuscated reference to an erectile drug
+
+
+
+#diet
+body __DRUGS_DIET_PHEN /\bphentermine\b/i
+#phentermine
+body __DRUGS_DIET1 /(?:\b|\s)[_\W]{0,3}p[_\W]{0,3}h[_\W]{0,3}[e3\xE8-\xEB][_\W]{0,3}n[_\W]{0,3}t[_\W]{0,3}[e3\xE8-\xEB][_\W]{0,3}r[_\W]{0,3}m[_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}n[_\W]{0,3}[e3\xE8-\xEB][_\W]{0,3}(?:\b|\s)/i
+#ionamin
+body __DRUGS_DIET2 /(?:\b|\s)_{0,3}[i1!|l\xEC-\xEF][_\W]?o[_\W]?n[_\W]?[a4\xE0-\xE6@][_\W]?m[_\W]?[i1!|l\xEC-\xEF][_\W]?n_{0,3}\b/i
+#bontril
+body __DRUGS_DIET3 /\bbontril\b/i
+#phendimetrazine
+body __DRUGS_DIET4 /\bphendimetrazine\b/i
+#diethylpropion, generic of Tenuate, uncommon in spam
+body __DRUGS_DIET5 /\bdiethylpropion\b/i
+#Meridia
+body __DRUGS_DIET6 /(?:\b|\s)[_\W]{0,3}M[_\W]{0,3}[e3\xE8-\xEB][_\W]{0,3}r[_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}d[_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}(?:\b|\s)/i
+#tenuate
+body __DRUGS_DIET7 /\b_{0,3}t[_\W]?[e3\xE8-\xEB][_\W]?n[_\W]?u[_\W]?a[_\W]?t[_\W]?[e3\xE8-\xEB]_{0,3}(?:\b|\s)/i
+#didrex
+body __DRUGS_DIET8 /\b_{0,3}d[_\W]?[i1!|l\xEC-\xEF][_\W]?d[_\W]?r[_\W][e3\xE8-\xEB[_\W]?xx?_{0,3}\b/i
+#adipex
+body __DRUGS_DIET9 /\b_{0,3}a[_\W]?d[_\W]?[i1!|l\xEC-\xEF][_\W]?p[_\W]?[e3\xE8-\xEB][_\W]?x_{0,3}\b/i
+#xenical
+body __DRUGS_DIET10 /\b_{0,3}x?x[_\W]?[e3\xE8-\xEB][_\W]?n[_\W]?[i1!|l\xEC-\xEF][_\W]?c[_\W]?[a4\xE0-\xE6@][_\W]?l_{0,3}\b/i
+meta DRUGS_DIET (__DRUGS_DIET1 || __DRUGS_DIET2 || __DRUGS_DIET3 || __DRUGS_DIET4 ||__DRUGS_DIET5 ||__DRUGS_DIET6 ||__DRUGS_DIET7 ||__DRUGS_DIET8 || __DRUGS_DIET9 || __DRUGS_DIET10 )
+describe DRUGS_DIET Refers to a diet drug
+meta DRUGS_DIET_OBFU (__DRUGS_DIET1 && !__DRUGS_DIET_PHEN)
+describe DRUGS_DIET_OBFU Obfuscated reference to a diet drug
+
+# pain relief drugs
+body __DRUGS_PAIN_VICO /vicodin/i
+body __DRUGS_PAIN_VIOXX /vioxx/i
+body __DRUGS_PAIN_FIO /fioricet/i
+body __DRUGS_PAIN1 /\b_{0,3}h[_\W]?y[_\W]?d[_\W]?r[_\W]?[o0\xF2-\xF6][_\W]?c[_\W]?[o0\xF2-\xF6][_\W]?d[_\W]?[o0\xF2-\xF6][_\W]?n[_\W]?e_{0,3}\b/i
+body __DRUGS_PAIN2 /\b_{0,3}c[o0\xF2-\xF6]deine_{0,3}\b/i
+#ultram
+body __DRUGS_PAIN3 /(?:\b|\s)[_\W]{0,3}[u\xB5\xF9-\xFC][_\W]{0,3}l[_\W]{0,3}t[_\W]{0,3}r[_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}m_{0,3}\b/i
+#vicodin
+body __DRUGS_PAIN4 /(?:\b|\s)[_\W]{0,3}(?:\\\/|V)[_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}c[_\W]{0,3}[o0\xF2-\xF6][_\W]{0,3}d[_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}ns?[_\W]{0,3}(?:\b|\s)/i
+#tramadol
+body __DRUGS_PAIN5 /\b_{0,3}t[_\W]?r[_\W]?[a4\xE0-\xE6@][_\W]?m[_\W]?[a4\xE0-\xE6@][_\W]?d[_\W]?[o0\xF2-\xF6][_\W]?[l!|1]_{0,3}\b/i
+# ultracet, uncommon in spam.
+body __DRUGS_PAIN6 /\b_{0,3}u[_\W]?l[_\W]?t[_\W]?r[_\W]?a[_\W]?c[_\W]?e[_\W]?t_{0,3}\b/i
+#fioricet
+body __DRUGS_PAIN7 /\b_{0,3}f[_\W]?[i1!|l\xEC-\xEF][_\W]?[o0\xF2-\xF6][_\W]?r[_\W]?[i1!|l\xEC-\xEF][_\W]?c[_\W]?[e3\xE8-\xEB][_\W]?[t7]_{0,3}\b/i
+#celebrex
+body __DRUGS_PAIN8 /\b_{0,3}c[_\W]?[e3\xE8-\xEB][_\W]?l[_\W]?[e3\xE8-\xEB][_\W]?b[_\W]?r[_\W]?[e3\xE8-\xEB][_\W]?x_{0,3}\b/i
+#imitrex
+body __DRUGS_PAIN9 /(?:\b|\s)_{0,3}[i1!|l\xEC-\xEF]m[i1!|l\xEC-\xEF]tr[e3\xE8-\xEB]x_{0,3}\b/i
+#vioxx
+body __DRUGS_PAIN10 /(?:\b|\s)[_\W]{0,3}(?:\\\/|V)[_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}[o0\xF2-\xF6][_\W]{0,3}x[_\W]{0,3}xx?_{0,3}\b/i
+#zebutal, uncommon in spam.
+body __DRUGS_PAIN11 /\bzebutal\b/i
+#esgic plus, uncommon in spam.
+body __DRUGS_PAIN12 /\besgic plus\b/i
+#Darvon - a prescription narcotic
+body __DRUGS_PAIN13 /\bD[_\W]?[a4\xE0-\xE6@][_\W]?r[_\W]?v[_\W]?[o0\xF2-\xF6][_\W]?n\b/i
+body __DRUGS_PAIN14 /N[o0\xF2-\xF6]rc[o0\xF2-\xF6]/i
+meta DRUGS_PAIN (__DRUGS_PAIN1 || __DRUGS_PAIN2 || __DRUGS_PAIN3 || __DRUGS_PAIN4 ||__DRUGS_PAIN5 ||__DRUGS_PAIN6 ||__DRUGS_PAIN7 ||__DRUGS_PAIN8 || __DRUGS_PAIN9 || __DRUGS_PAIN10|| __DRUGS_PAIN11 || __DRUGS_PAIN12 || __DRUGS_PAIN13 ||__DRUGS_PAIN14)
+describe DRUGS_PAIN Refers to a pain relief drug
+meta DRUGS_PAIN_OBFU (( __DRUGS_PAIN4 &&! __DRUGS_PAIN_VICO) || ( __DRUGS_PAIN10 &&!__DRUGS_PAIN_VIOXX) || ( __DRUGS_PAIN7 &&!__DRUGS_PAIN_FIO))
+describe DRUGS_PAIN_OBFU Obfuscated reference to a pain relief drug
+#sleep aids
+#ativan and lorazepam already under anxiety
+#Ambien, brand of zolpidem tartrate
+body __DRUGS_SLEEP1 /(?:\b|\s)[_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}m[_\W]{0,3}b[_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}[e3\xE8-\xEB][_\W]{0,3}n[_\W]{0,3}(?:\b|\s)/i
+#sonata, brand of zaleplon
+body __DRUGS_SLEEP2 /(?:\b|\s)[_\W]{0,3}S[_\W]{0,3}[o0\xF2-\xF6][_\W]{0,3}n[_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}t[_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}(?:\b|\s)/i
+#Restoril, brand of temazepam, uncommon in spam
+body __DRUGS_SLEEP3 /\b_{0,3}R[_\W]?[e3\xE8-\xEB][_\W]?s[_\W]?t[_\W]?[o0\xF2-\xF6][_\W]?r[_\W]?i[_\W]?l_{0,3}\b/i
+#Halcion, brand of triazolam
+body __DRUGS_SLEEP4 /\b_{0,3}H[_\W]?[a4\xE0-\xE6@][_\W]?l[_\W]?c[_\W]?i[_\W]?[o0\xF2-\xF6][_\W]?n_{0,3}\b/i
+
+meta DRUGS_SLEEP (__DRUGS_SLEEP1 || __DRUGS_SLEEP2 || __DRUGS_SLEEP3 ||__DRUGS_SLEEP4)
+describe DRUGS_SLEEP Refers to a sleep aid drug
+
+#muscle relaxants
+#soma
+body __DRUGS_MUSCLE1 /(?:\b|\s)[_\W]{0,3}s[_\W]{0,3}[o0\xF2-\xF6][_\W]{0,3}m[_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}(?:\b|\s)/i
+#cyclobenzaprine
+body __DRUGS_MUSCLE2 /\b_{0,3}cycl[o0\xF2-\xF6]b[e3\xE8-\xEB]nz[a4\xE0-\xE6@]pr[i1!|l\xEC-\xEF]n[e3\xE8-\xEB]_{0,3}(?:\b|\s)/i
+#flexeril
+body __DRUGS_MUSCLE3 /\b_{0,3}f[_\W]?l[_\W]?[e3\xE8-\xEB][_\W]?x[_\W]?[e3\xE8-\xEB][_\W]?r[_\W]?[i1!|l\xEC-\xEF]_{0,3}[_\W]?l_{0,3}\b/i
+#zanaflex
+body __DRUGS_MUSCLE4 /\b_{0,3}z[_\W]?a[_\W]?n[_\W]?a[_\W]?f[_\W]?l[_\W]?e[_\W]?x_{0,3}\b/i
+#skelaxin
+body __DRUGS_MUSCLE5 /\bskelaxin\b/i
+meta DRUGS_MUSCLE (__DRUGS_MUSCLE1 || __DRUGS_MUSCLE2 || __DRUGS_MUSCLE3 || __DRUGS_MUSCLE4 ||__DRUGS_MUSCLE5 )
+describe DRUGS_MUSCLE Refers to a muscle relaxant
+#anti-anxiety
+#these two rules are used to differentiate between obfu and non-obfu spellings
+body __DRUGS_ANXIETY_XAN /xan[ae]x/i
+body __DRUGS_ANXIETY_VAL /valium/i
+#xanax - note: second a sometimes done as e.
+body __DRUGS_ANXIETY1 /(?:\b|\s)[_\W]{0,3}x?x[_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}n[_\W]{0,3}[ea4\xE1\xE2\xE3@][_\W]{0,3}xx?_{0,3}\b/i
+#alprazolam
+body __DRUGS_ANXIETY2 /\bAlprazolam\b/i
+#valium
+body __DRUGS_ANXIETY3 /(?:\b|\s)[_\W]{0,3}(?:\\\/|V)[_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}[l|][_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}[u\xB5\xF9-\xFC][_\W]{0,3}m\b/i
+#diazepam, generic of valium
+body __DRUGS_ANXIETY4 /\b_{0,3}D[_\W]?[i1!|l\xEC-\xEF][_\W]?[a4\xE0-\xE6@][_\W]?z[_\W]?[ea3\xE9\xEA\xEB][_\W]?p[_\W]?[a4\xE0-\xE6@][_\W]?m_{0,3}\b/i
+#ativan
+body __DRUGS_ANXIETY5 /(?:\b|\s)[a4\xE0-\xE6@][_\W]?t[_\W]?[i1!|l\xEC-\xEF][_\W]?v[_\W]?[a4\xE0-\xE6@][_\W]?n_{0,3}\b/i
+#lorazepam - generic of ativan, uncommon in spam
+body __DRUGS_ANXIETY6 /\b_{0,3}l[_\W]?[o0\xF2-\xF6][_\W]?r[_\W]?[a4\xE0-\xE6@][_\W]?z[_\W]?[e3\xE8-\xEB][_\W]?p[_\W]?[a4\xE0-\xE6@][_\W]?m_{0,3}\b/i
+#clonazepam, generic.
+body __DRUGS_ANXIETY7 /\b_{0,3}c[_\W]?l[_\W]?[o0\xF2-\xF6][_\W]?n[_\W]?[a4\xE0-\xE6@][_\W]?z[_\W]?e[_\W]?p[_\W]?[a4\xE0-\xE6@][_\W]?m\b/i
+#klonopin, brand of clonazepam, uncommon in spam
+body __DRUGS_ANXIETY8 /\bklonopin\b/i
+#rivotril, brand of clonazepam, uncommon in spam
+body __DRUGS_ANXIETY9 /\brivotril\b/i
+meta DRUGS_ANXIETY (__DRUGS_ANXIETY1 || __DRUGS_ANXIETY2 || __DRUGS_ANXIETY3 || __DRUGS_ANXIETY4 ||__DRUGS_ANXIETY5 ||__DRUGS_ANXIETY6 ||__DRUGS_ANXIETY7 ||__DRUGS_ANXIETY8 || __DRUGS_ANXIETY9 )
+describe DRUGS_ANXIETY Refers to an anxiety control drug
+meta DRUGS_ANXIETY_OBFU ( (__DRUGS_ANXIETY1 &&! __DRUGS_ANXIETY_XAN) || (__DRUGS_ANXIETY3 && !__DRUGS_ANXIETY_VAL))
+describe DRUGS_ANXIETY_OBFU Obfuscated reference to an anxiety control drug
+#antidepressant
+#prozac
+body __DRUGS_DEPRESSION1 /\b_{0,3}p[_\W]?r[_\W]?[o0\xF2-\xF6][_\W]?z[_\W]?[a4\xE0-\xE6@][_\W]?c_{0,3}\b/i
+#fluoxetine
+body __DRUGS_DEPRESSION2 /\bfluoxetine\b/i
+#buspar
+body __DRUGS_DEPRESSION3 /\bbuspar\b/i
+#paxil
+body __DRUGS_DEPRESSION4 /\b_{0,3}p[_\W]?[a4\xE0-\xE6@][_\W]?x[_\W]?[i1!|l\xEC-\xEF][_\W]?[l!|1]_{0,3}(?:\b|\s)/i
+#wellbutrin
+body __DRUGS_DEPRESSION5 /\bwellbutrin\b/i
+#lexapro
+body __DRUGS_DEPRESSION6 /\blexapro\b/i
+#zoloft
+body __DRUGS_DEPRESSION7 /\b_{0,3}z[_\W]?[o0\xF2-\xF6][_\W]?l[_\W]?[o0\xF2-\xF6][_\W]?f[_\W]?t_{0,3}\b/i
+#elavil
+body __DRUGS_DEPRESSION8 /\belavil\b/i
+#sarafem
+body __DRUGS_DEPRESSION9 /\bsarafem\b/i
+#remeron
+body __DRUGS_DEPRESSION10 /\bremeron\b/i
+meta DRUGS_DEPRESSION (__DRUGS_DEPRESSION1 || __DRUGS_DEPRESSION2 || __DRUGS_DEPRESSION3 || __DRUGS_DEPRESSION4 ||__DRUGS_DEPRESSION5 ||__DRUGS_DEPRESSION6 ||__DRUGS_DEPRESSION7 ||__DRUGS_DEPRESSION8 || __DRUGS_DEPRESSION9 || __DRUGS_DEPRESSION10)
+describe DRUGS_DEPRESSION Refers to an antidepressant
+
+body DRUGS_SMEAR1 /(?:Viagra|Valium|Xanax|Soma|Cialis){2}/i
+describe DRUGS_SMEAR1 Two or more drugs crammed together into one word
+
+#search for "weird" combinations that are unlikely to
+#be prescribed together for a single event, thus unlikely to be
+#mentioned in the same email, except an online pharmacy ad.
+meta DRUGS_DIET_EREC (DRUGS_ERECTILE && DRUGS_DIET)
+describe DRUGS_DIET_EREC Refers to both an erectile and a diet drug
+meta DRUGS_PAIN_EREC (DRUGS_ERECTILE && DRUGS_PAIN)
+describe DRUGS_PAIN_EREC Refers to both an erectile and a painkiller
+meta DRUGS_DEPR_EREC (DRUGS_ERECTILE && DRUGS_DEPRESSION)
+describe DRUGS_DEPR_EREC Refers to both an erectile and an antidepressant
+meta DRUGS_ANXIETY_EREC (DRUGS_ERECTILE && DRUGS_ANXIETY)
+describe DRUGS_ANXIETY_EREC Refers to both an erectile and an anxiety drug
+meta DRUGS_DIET_PAIN (DRUGS_DIET && DRUGS_PAIN)
+describe DRUGS_DIET_PAIN Refers to both a diet drug and a pain drug
+meta DRUGS_SLEEP_EREC (DRUGS_ERECTILE && DRUGS_SLEEP)
+describe DRUGS_SLEEP_EREC Refers to both an erectile and a sleep aid drug
+
+# note: some 3 item combos are "normal" ie: a patient might legitimately
+# be prescribed depression, anxiety and sleep aid drugs all at once.
+# however, I know of no "normal" 4-item combinations.
+meta DRUGS_MANYKINDS (DRUGS_ERECTILE + DRUGS_DIET + DRUGS_PAIN + DRUGS_SLEEP + DRUGS_MUSCLE + DRUGS_ANXIETY + DRUGS_DEPRESSION >3)
+describe DRUGS_MANYKINDS Refers to at least four kinds of drugs
+
+########################################################################
Modified: incubator/spamassassin/trunk/rules/70_testing.cf
==============================================================================
--- incubator/spamassassin/trunk/rules/70_testing.cf (original)
+++ incubator/spamassassin/trunk/rules/70_testing.cf Thu May 6 22:16:17 2004
@@ -52,251 +52,6 @@
describe T_RCVD_IN_IADB_LIST_T Sender is listed in ISIPP IADB
tflags T_RCVD_IN_IADB_LIST_T net nice
-###########################################################################
-# Matt Kettler's antidrug.cf ruleset. bug 3009
-# should probably move good ones from here directly into 20_drugs.cf?
-# or a new rules file, 20_antidrug.cf?
-#
-#The anti-drug ruleset
-# authored by Matt Kettler for SpamAssassin
-#
-# This ruleset is intended to detect common "pill spam"
-# however, it is not appropriate for all environments.
-# It may not be appropriate for a medical or pharmaceutical
-# environment. If in doubt, adjust the scores of all the rules
-# to 0.01 and see if they fire off on your daily nonspam.
-#
-#
-# rev 0.65 04/28/2004
-#
-# the current home of this ruleset is
-# http://mywebpages.comcast.net/mkettler/sa/antidrug.cf
-#
-# Contact address mkettler_sa@comcast.net
-#
-#male sexual dysfunction drugs
-#
-# This section is undergoing improvements and I'm trying to track down a
-# FP case that seems to mostly affect technical emails.
-# However, all of the test cases so far fail to match when retested.
-# note: The regex /v.i.a.g.r.a/ was intentionally not used
-# due to potential false positive cases with PGP signatures
-# and other base-64ish stuff.
-# instead other patterns are used catch non alphanumeric gapping patterns
-# note: \W = "non word character"
-
-# Note: many of the drugs named in here are brand-names and are trademarked.
-# All trademarks are property of the respective owners.
-#current best char substitutions
-# i - [i1!|l\xEC-\xEF]
-# a - [a4\xE0-\xE6@]
-# e - [e3\xE8-\xEB]
-# o - [o0\xF2-\xF6]
-# u - [u\xB5\xF9-\xFC]
-
-# v - (?:\\\/|V)
-# l - [l!|1]
-#plain Viagra and Cialis (used in obfu detection)
-body __DRUGS_ERECTILE_V /\bViagra\b/i
-body __DRUGS_ERECTILE_C /\bCialis\b/i
-body __DRUGS_ERECTILE_L /\bLevitra\b/i
-# obfu/plain and mis-spelled Viagra variants
-body __DRUGS_ERECTILE1 /(?:\b|\s)[_\W]{0,3}(?:\\\/|V)[_\W]{0,3}[ij1!|l\xEC\xED\xEE\xEF][_\W]{0,3}[a40\xE0-\xE6@][_\W]{0,3}[xyz]?[gj][_\W]{0,3}r[_\W]{0,3}[a40\xE0-\xE6@][_\W]{0,3}x?[_\W]{0,3}(?:\b|\s)/i
-body __DRUGS_ERECTILE2 /\bV(?:agira|igara|iaggra|iaegra)\b/i
-# cialis variants (spelling correct now)
-# note: the rather strange pre-amble is to avoid FPs on french words containing high-ascii chars surrounding
-# "cialis".
-body __DRUGS_ERECTILE3 /(?:\A|[\s\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f])[_\W]{0,3}C[_\W]{0,3}[ij1!|l\xEC\xED\xEE\xEF][_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}l?[l!|1][_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}s[_\W]{0,3}(?:\b|\s)/i
-body __DRUGS_ERECTILE4 /\bC(?:alis|ilias|ilais)\b/i
-# generic names
-#sildenafil citrate
-body __DRUGS_ERECTILE5 /\b_{0,3}s[_\W]?[i1!|l\xEC-\xEF][_\W]?l[_\W]?d[_\W]?[e3\xE8-\xEB][_\W]?n[_\W]?[a4\xE0-\xE6@][_\W]?f[_\W]?[i1!|l\xEC-\xEF][_\W]?l c[_\W]?[i1!|l\xEC-\xEF][_\W]?t[_\W]?r[_\W]?[a4\xE0-\xE6@][_\W]?t[_\W]?[e3\xE8-\xEB]_{0,3}(?:\b|\s)/i
-#Levitra
-body __DRUGS_ERECTILE6 /\b_{0,3}L[_\W]?[e3\xE8-\xEB][_\W]?(?:\\\/|V)[_\W]?[i1!|l\xEC-\xEF][_\W]?t[_\W]?r[_\W]?[a4\xE0-\xE6@][_\W]?(?:\b|\s)/i
-#tadalafil
-body __DRUGS_ERECTILE8 /\b_{0,3}T[_\W]?[a4\xE0-\xE6@][_\W]?d[_\W]?[a4\xE0-\xE6@][_\W]?l[_\W]?[a4\xE0-\xE6@][_\W]?f[_\W]?[i1!|l\xEC-\xEF][_\W]?l_{0,3}\b/i
-# gapped/obfu viagra variants using funky html-style character codes
-rawbody __DRUGS_ERECTILE10 /\b_{0,3}V[_\W]?(?:i|\ï\;)[_\W]?(?:a|\à|\å)\;?[_\W]?g[_\W]?r[_\W]?(?:a|\à|\å)\b/i
-#apcalis - a generic of cialis
-body __DRUGS_ERECTILE11 /(?:\b|\s)_{0,3}[a4\xE0-\xE6@][_\W]{0,3}p[_\W]{0,3}c[_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}[l!|1][_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}s_{0,3}\b/i
-meta T_DRUGS_ERECTILE (__DRUGS_ERECTILE1 || __DRUGS_ERECTILE2 || __DRUGS_ERECTILE3 || __DRUGS_ERECTILE4 ||__DRUGS_ERECTILE5 ||__DRUGS_ERECTILE6 ||__DRUGS_ERECTILE7 ||__DRUGS_ERECTILE8 || __DRUGS_ERECTILE10 ||__DRUGS_ERECTILE11 )
-describe T_DRUGS_ERECTILE Refers to an erectile drug
-meta T_DRUGS_ERECTILE_OBFU ( (__DRUGS_ERECTILE1 &&!__DRUGS_ERECTILE_V) || (__DRUGS_ERECTILE3 && !__DRUGS_ERECTILE_C) ||__DRUGS_ERECTILE2 || (__DRUGS_ERECTILE10 &&!__DRUGS_ERECTILE_V) || (__DRUGS_ERECTILE6 &&!__DRUGS_ERECTILE_L))
-describe T_DRUGS_ERECTILE_OBFU Obfuscated reference to an erectile drug
-
-
-
-#diet
-body __DRUGS_DIET_PHEN /\bphentermine\b/i
-#phentermine
-body __DRUGS_DIET1 /(?:\b|\s)[_\W]{0,3}p[_\W]{0,3}h[_\W]{0,3}[e3\xE8-\xEB][_\W]{0,3}n[_\W]{0,3}t[_\W]{0,3}[e3\xE8-\xEB][_\W]{0,3}r[_\W]{0,3}m[_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}n[_\W]{0,3}[e3\xE8-\xEB][_\W]{0,3}(?:\b|\s)/i
-#ionamin
-body __DRUGS_DIET2 /(?:\b|\s)_{0,3}[i1!|l\xEC-\xEF][_\W]?o[_\W]?n[_\W]?[a4\xE0-\xE6@][_\W]?m[_\W]?[i1!|l\xEC-\xEF][_\W]?n_{0,3}\b/i
-#bontril
-body __DRUGS_DIET3 /\bbontril\b/i
-#phendimetrazine
-body __DRUGS_DIET4 /\bphendimetrazine\b/i
-#diethylpropion, generic of Tenuate, uncommon in spam
-body __DRUGS_DIET5 /\bdiethylpropion\b/i
-#Meridia
-body __DRUGS_DIET6 /(?:\b|\s)[_\W]{0,3}M[_\W]{0,3}[e3\xE8-\xEB][_\W]{0,3}r[_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}d[_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}(?:\b|\s)/i
-#tenuate
-body __DRUGS_DIET7 /\b_{0,3}t[_\W]?[e3\xE8-\xEB][_\W]?n[_\W]?u[_\W]?a[_\W]?t[_\W]?[e3\xE8-\xEB]_{0,3}(?:\b|\s)/i
-#didrex
-body __DRUGS_DIET8 /\b_{0,3}d[_\W]?[i1!|l\xEC-\xEF][_\W]?d[_\W]?r[_\W][e3\xE8-\xEB[_\W]?xx?_{0,3}\b/i
-#adipex
-body __DRUGS_DIET9 /\b_{0,3}a[_\W]?d[_\W]?[i1!|l\xEC-\xEF][_\W]?p[_\W]?[e3\xE8-\xEB][_\W]?x_{0,3}\b/i
-#xenical
-body __DRUGS_DIET10 /\b_{0,3}x?x[_\W]?[e3\xE8-\xEB][_\W]?n[_\W]?[i1!|l\xEC-\xEF][_\W]?c[_\W]?[a4\xE0-\xE6@][_\W]?l_{0,3}\b/i
-meta T_DRUGS_DIET (__DRUGS_DIET1 || __DRUGS_DIET2 || __DRUGS_DIET3 || __DRUGS_DIET4 ||__DRUGS_DIET5 ||__DRUGS_DIET6 ||__DRUGS_DIET7 ||__DRUGS_DIET8 || __DRUGS_DIET9 || __DRUGS_DIET10 )
-describe T_DRUGS_DIET Refers to a diet drug
-meta T_DRUGS_DIET_OBFU (__DRUGS_DIET1 && !__DRUGS_DIET_PHEN)
-describe T_DRUGS_DIET_OBFU Obfuscated reference to a diet drug
-
-# pain relief drugs
-body __DRUGS_PAIN_VICO /vicodin/i
-body __DRUGS_PAIN_VIOXX /vioxx/i
-body __DRUGS_PAIN_FIO /fioricet/i
-body __DRUGS_PAIN1 /\b_{0,3}h[_\W]?y[_\W]?d[_\W]?r[_\W]?[o0\xF2-\xF6][_\W]?c[_\W]?[o0\xF2-\xF6][_\W]?d[_\W]?[o0\xF2-\xF6][_\W]?n[_\W]?e_{0,3}\b/i
-body __DRUGS_PAIN2 /\b_{0,3}c[o0\xF2-\xF6]deine_{0,3}\b/i
-#ultram
-body __DRUGS_PAIN3 /(?:\b|\s)[_\W]{0,3}[u\xB5\xF9-\xFC][_\W]{0,3}l[_\W]{0,3}t[_\W]{0,3}r[_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}m_{0,3}\b/i
-#vicodin
-body __DRUGS_PAIN4 /(?:\b|\s)[_\W]{0,3}(?:\\\/|V)[_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}c[_\W]{0,3}[o0\xF2-\xF6][_\W]{0,3}d[_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}ns?[_\W]{0,3}(?:\b|\s)/i
-#tramadol
-body __DRUGS_PAIN5 /\b_{0,3}t[_\W]?r[_\W]?[a4\xE0-\xE6@][_\W]?m[_\W]?[a4\xE0-\xE6@][_\W]?d[_\W]?[o0\xF2-\xF6][_\W]?[l!|1]_{0,3}\b/i
-# ultracet, uncommon in spam.
-body __DRUGS_PAIN6 /\b_{0,3}u[_\W]?l[_\W]?t[_\W]?r[_\W]?a[_\W]?c[_\W]?e[_\W]?t_{0,3}\b/i
-#fioricet
-body __DRUGS_PAIN7 /\b_{0,3}f[_\W]?[i1!|l\xEC-\xEF][_\W]?[o0\xF2-\xF6][_\W]?r[_\W]?[i1!|l\xEC-\xEF][_\W]?c[_\W]?[e3\xE8-\xEB][_\W]?[t7]_{0,3}\b/i
-#celebrex
-body __DRUGS_PAIN8 /\b_{0,3}c[_\W]?[e3\xE8-\xEB][_\W]?l[_\W]?[e3\xE8-\xEB][_\W]?b[_\W]?r[_\W]?[e3\xE8-\xEB][_\W]?x_{0,3}\b/i
-#imitrex
-body __DRUGS_PAIN9 /(?:\b|\s)_{0,3}[i1!|l\xEC-\xEF]m[i1!|l\xEC-\xEF]tr[e3\xE8-\xEB]x_{0,3}\b/i
-#vioxx
-body __DRUGS_PAIN10 /(?:\b|\s)[_\W]{0,3}(?:\\\/|V)[_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}[o0\xF2-\xF6][_\W]{0,3}x[_\W]{0,3}xx?_{0,3}\b/i
-#zebutal, uncommon in spam.
-body __DRUGS_PAIN11 /\bzebutal\b/i
-#esgic plus, uncommon in spam.
-body __DRUGS_PAIN12 /\besgic plus\b/i
-#Darvon - a prescription narcotic
-body __DRUGS_PAIN13 /\bD[_\W]?[a4\xE0-\xE6@][_\W]?r[_\W]?v[_\W]?[o0\xF2-\xF6][_\W]?n\b/i
-body __DRUGS_PAIN14 /N[o0\xF2-\xF6]rc[o0\xF2-\xF6]/i
-meta T_DRUGS_PAIN (__DRUGS_PAIN1 || __DRUGS_PAIN2 || __DRUGS_PAIN3 || __DRUGS_PAIN4 ||__DRUGS_PAIN5 ||__DRUGS_PAIN6 ||__DRUGS_PAIN7 ||__DRUGS_PAIN8 || __DRUGS_PAIN9 || __DRUGS_PAIN10|| __DRUGS_PAIN11 || __DRUGS_PAIN12 || __DRUGS_PAIN13 ||__DRUGS_PAIN14)
-describe T_DRUGS_PAIN Refers to a pain relief drug
-meta T_DRUGS_PAIN_OBFU (( __DRUGS_PAIN4 &&! __DRUGS_PAIN_VICO) || ( __DRUGS_PAIN10 &&!__DRUGS_PAIN_VIOXX) || ( __DRUGS_PAIN7 &&!__DRUGS_PAIN_FIO))
-describe T_DRUGS_PAIN_OBFU Obfuscated reference to a pain relief drug
-#sleep aids
-#ativan and lorazepam already under anxiety
-#Ambien, brand of zolpidem tartrate
-body __DRUGS_SLEEP1 /(?:\b|\s)[_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}m[_\W]{0,3}b[_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}[e3\xE8-\xEB][_\W]{0,3}n[_\W]{0,3}(?:\b|\s)/i
-#sonata, brand of zaleplon
-body __DRUGS_SLEEP2 /(?:\b|\s)[_\W]{0,3}S[_\W]{0,3}[o0\xF2-\xF6][_\W]{0,3}n[_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}t[_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}(?:\b|\s)/i
-#Restoril, brand of temazepam, uncommon in spam
-body __DRUGS_SLEEP3 /\b_{0,3}R[_\W]?[e3\xE8-\xEB][_\W]?s[_\W]?t[_\W]?[o0\xF2-\xF6][_\W]?r[_\W]?i[_\W]?l_{0,3}\b/i
-#Halcion, brand of triazolam
-body __DRUGS_SLEEP4 /\b_{0,3}H[_\W]?[a4\xE0-\xE6@][_\W]?l[_\W]?c[_\W]?i[_\W]?[o0\xF2-\xF6][_\W]?n_{0,3}\b/i
-
-meta T_DRUGS_SLEEP (__DRUGS_SLEEP1 || __DRUGS_SLEEP2 || __DRUGS_SLEEP3 ||__DRUGS_SLEEP4)
-describe T_DRUGS_SLEEP Refers to a sleep aid drug
-
-#muscle relaxants
-#soma
-body __DRUGS_MUSCLE1 /(?:\b|\s)[_\W]{0,3}s[_\W]{0,3}[o0\xF2-\xF6][_\W]{0,3}m[_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}(?:\b|\s)/i
-#cyclobenzaprine
-body __DRUGS_MUSCLE2 /\b_{0,3}cycl[o0\xF2-\xF6]b[e3\xE8-\xEB]nz[a4\xE0-\xE6@]pr[i1!|l\xEC-\xEF]n[e3\xE8-\xEB]_{0,3}(?:\b|\s)/i
-#flexeril
-body __DRUGS_MUSCLE3 /\b_{0,3}f[_\W]?l[_\W]?[e3\xE8-\xEB][_\W]?x[_\W]?[e3\xE8-\xEB][_\W]?r[_\W]?[i1!|l\xEC-\xEF]_{0,3}[_\W]?l_{0,3}\b/i
-#zanaflex
-body __DRUGS_MUSCLE4 /\b_{0,3}z[_\W]?a[_\W]?n[_\W]?a[_\W]?f[_\W]?l[_\W]?e[_\W]?x_{0,3}\b/i
-#skelaxin
-body __DRUGS_MUSCLE5 /\bskelaxin\b/i
-meta T_DRUGS_MUSCLE (__DRUGS_MUSCLE1 || __DRUGS_MUSCLE2 || __DRUGS_MUSCLE3 || __DRUGS_MUSCLE4 ||__DRUGS_MUSCLE5 )
-describe T_DRUGS_MUSCLE Refers to a muscle relaxant
-#anti-anxiety
-#these two rules are used to differentiate between obfu and non-obfu spellings
-body __DRUGS_ANXIETY_XAN /xan[ae]x/i
-body __DRUGS_ANXIETY_VAL /valium/i
-#xanax - note: second a sometimes done as e.
-body __DRUGS_ANXIETY1 /(?:\b|\s)[_\W]{0,3}x?x[_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}n[_\W]{0,3}[ea4\xE1\xE2\xE3@][_\W]{0,3}xx?_{0,3}\b/i
-#alprazolam
-body __DRUGS_ANXIETY2 /\bAlprazolam\b/i
-#valium
-body __DRUGS_ANXIETY3 /(?:\b|\s)[_\W]{0,3}(?:\\\/|V)[_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}[l|][_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}[u\xB5\xF9-\xFC][_\W]{0,3}m\b/i
-#diazepam, generic of valium
-body __DRUGS_ANXIETY4 /\b_{0,3}D[_\W]?[i1!|l\xEC-\xEF][_\W]?[a4\xE0-\xE6@][_\W]?z[_\W]?[ea3\xE9\xEA\xEB][_\W]?p[_\W]?[a4\xE0-\xE6@][_\W]?m_{0,3}\b/i
-#ativan
-body __DRUGS_ANXIETY5 /(?:\b|\s)[a4\xE0-\xE6@][_\W]?t[_\W]?[i1!|l\xEC-\xEF][_\W]?v[_\W]?[a4\xE0-\xE6@][_\W]?n_{0,3}\b/i
-#lorazepam - generic of ativan, uncommon in spam
-body __DRUGS_ANXIETY6 /\b_{0,3}l[_\W]?[o0\xF2-\xF6][_\W]?r[_\W]?[a4\xE0-\xE6@][_\W]?z[_\W]?[e3\xE8-\xEB][_\W]?p[_\W]?[a4\xE0-\xE6@][_\W]?m_{0,3}\b/i
-#clonazepam, generic.
-body __DRUGS_ANXIETY7 /\b_{0,3}c[_\W]?l[_\W]?[o0\xF2-\xF6][_\W]?n[_\W]?[a4\xE0-\xE6@][_\W]?z[_\W]?e[_\W]?p[_\W]?[a4\xE0-\xE6@][_\W]?m\b/i
-#klonopin, brand of clonazepam, uncommon in spam
-body __DRUGS_ANXIETY8 /\bklonopin\b/i
-#rivotril, brand of clonazepam, uncommon in spam
-body __DRUGS_ANXIETY9 /\brivotril\b/i
-meta T_DRUGS_ANXIETY (__DRUGS_ANXIETY1 || __DRUGS_ANXIETY2 || __DRUGS_ANXIETY3 || __DRUGS_ANXIETY4 ||__DRUGS_ANXIETY5 ||__DRUGS_ANXIETY6 ||__DRUGS_ANXIETY7 ||__DRUGS_ANXIETY8 || __DRUGS_ANXIETY9 )
-describe T_DRUGS_ANXIETY Refers to an anxiety control drug
-meta T_DRUGS_ANXIETY_OBFU ( (__DRUGS_ANXIETY1 &&! __DRUGS_ANXIETY_XAN) || (__DRUGS_ANXIETY3 && !__DRUGS_ANXIETY_VAL))
-describe T_DRUGS_ANXIETY_OBFU Obfuscated reference to an anxiety control drug
-#antidepressant
-#prozac
-body __DRUGS_DEPRESSION1 /\b_{0,3}p[_\W]?r[_\W]?[o0\xF2-\xF6][_\W]?z[_\W]?[a4\xE0-\xE6@][_\W]?c_{0,3}\b/i
-#fluoxetine
-body __DRUGS_DEPRESSION2 /\bfluoxetine\b/i
-#buspar
-body __DRUGS_DEPRESSION3 /\bbuspar\b/i
-#paxil
-body __DRUGS_DEPRESSION4 /\b_{0,3}p[_\W]?[a4\xE0-\xE6@][_\W]?x[_\W]?[i1!|l\xEC-\xEF][_\W]?[l!|1]_{0,3}(?:\b|\s)/i
-#wellbutrin
-body __DRUGS_DEPRESSION5 /\bwellbutrin\b/i
-#lexapro
-body __DRUGS_DEPRESSION6 /\blexapro\b/i
-#zoloft
-body __DRUGS_DEPRESSION7 /\b_{0,3}z[_\W]?[o0\xF2-\xF6][_\W]?l[_\W]?[o0\xF2-\xF6][_\W]?f[_\W]?t_{0,3}\b/i
-#elavil
-body __DRUGS_DEPRESSION8 /\belavil\b/i
-#sarafem
-body __DRUGS_DEPRESSION9 /\bsarafem\b/i
-#remeron
-body __DRUGS_DEPRESSION10 /\bremeron\b/i
-meta T_DRUGS_DEPRESSION (__DRUGS_DEPRESSION1 || __DRUGS_DEPRESSION2 || __DRUGS_DEPRESSION3 || __DRUGS_DEPRESSION4 ||__DRUGS_DEPRESSION5 ||__DRUGS_DEPRESSION6 ||__DRUGS_DEPRESSION7 ||__DRUGS_DEPRESSION8 || __DRUGS_DEPRESSION9 || __DRUGS_DEPRESSION10)
-describe T_DRUGS_DEPRESSION Refers to an antidepressant
-
-body T_DRUGS_SMEAR1 /(?:Viagra|Valium|Xanax|Soma|Cialis){2}/i
-describe T_DRUGS_SMEAR1 Two or more drugs crammed together into one word
-
-#search for "weird" combinations that are unlikely to
-#be prescribed together for a single event, thus unlikely to be
-#mentioned in the same email, except an online pharmacy ad.
-meta T_DRUGS_DIET_EREC (T_DRUGS_ERECTILE && T_DRUGS_DIET)
-describe T_DRUGS_DIET_EREC Refers to both an erectile and a diet drug
-meta T_DRUGS_PAIN_EREC (T_DRUGS_ERECTILE && T_DRUGS_PAIN)
-describe T_DRUGS_PAIN_EREC Refers to both an erectile and a painkiller
-meta T_DRUGS_DEPR_EREC (T_DRUGS_ERECTILE && T_DRUGS_DEPRESSION)
-describe T_DRUGS_DEPR_EREC Refers to both an erectile and an antidepressant
-meta T_DRUGS_ANXIETY_EREC (T_DRUGS_ERECTILE && T_DRUGS_ANXIETY)
-describe T_DRUGS_ANXIETY_EREC Refers to both an erectile and an anxiety drug
-meta T_DRUGS_DIET_PAIN (T_DRUGS_DIET && T_DRUGS_PAIN)
-describe T_DRUGS_DIET_PAIN Refers to both a diet drug and a pain drug
-meta T_DRUGS_SLEEP_EREC (T_DRUGS_ERECTILE && T_DRUGS_SLEEP)
-describe T_DRUGS_SLEEP_EREC Refers to both an erectile and a sleep aid drug
-
-# jm: not sure about this, TBH. note that Matt does state:
-# "don't use this rule with a sum-total that fires off for 3 or less"
-meta T_DRUGS_TWO (T_DRUGS_ERECTILE + T_DRUGS_DIET + T_DRUGS_PAIN + T_DRUGS_SLEEP + T_DRUGS_MUSCLE + T_DRUGS_ANXIETY + T_DRUGS_DEPRESSION == 2)
-describe T_DRUGS_TWO Refers to two different kinds of drugs
-meta T_DRUGS_THREE (T_DRUGS_ERECTILE + T_DRUGS_DIET + T_DRUGS_PAIN + T_DRUGS_SLEEP + T_DRUGS_MUSCLE + T_DRUGS_ANXIETY + T_DRUGS_DEPRESSION == 3)
-describe T_DRUGS_THREE Refers to three different kinds of drugs
-
-# note: some 3 item combos are "normal" ie: a patient might legitimately
-# be prescribed depression, anxiety and sleep aid drugs all at once.
-# however, I know of no "normal" 4-item combinations.
-meta T_DRUGS_MANYKINDS (T_DRUGS_ERECTILE + T_DRUGS_DIET + T_DRUGS_PAIN + T_DRUGS_SLEEP + T_DRUGS_MUSCLE + T_DRUGS_ANXIETY + T_DRUGS_DEPRESSION >3)
-describe T_DRUGS_MANYKINDS Refers to at least four kinds of drugs
-
-########################################################################
-
# high daily volume for organization
# high monthly volume for IP address
header T_S2_83_S41_42 eval:check_rbl_sub('senderbase', 'S2 > 8.3 && S41 > 4.2')