#The anti-drug ruleset
# authored by Matt Kettler for SpamAssassin
#
# This ruleset is intended to detect common "pill spam"
# however, it is not appropriate for all environments.
# It may not be appropriate for a medical or pharmecutical
# environment. If in doubt, adjust the scores of all the rules
# to 0.01 and see if they fire off on your daily nonspam.
#
#
# rev 0.52 02/18/2004
#
# the current home of this ruleset is
# http://mywebpages.comcast.net/mkettler/sa/antidrug.cf
#
# Contact address mkettler_sa@comcast.net
#

#male sexual dysfunction drugs
#
# This section is undergoing improvements and I'm trying to track down a 
# FP case that seems to mostly affect technical emails.
# However, all of the test cases so far fail to match when retested.

# note: The regex /v.i.a.g.r.a/ was intentionaly not used
# due to potential false positive cases with PGP signatures
# and other base-64ish stuff.
# instead other patterns are used catch non alphanumeric gapping patterns
# note: \W = "non word charachter"


# Note: many of the drugs named in here are brand-names and are trademarked.
# All trademarks are property of the respective owners.

#plain Viagra and Cialis (used in obfu detection)
body __DRUGS_MALEDYSFUNCTION_V	/Vi+agra+\b/i
body __DRUGS_MALEDYSFUNCTION_C	/\bCialis\b/i

#  obfu/plain and mis-spelled Viagra variants
body __DRUGS_MALEDYSFUNCTION1	/(?:\b|\s)[_\W]{0,3}(?:\\\/|V)[_\W]{0,3}[i1|lïî¡ì][_\W]{0,3}[a4@áâ][_\W]{0,3}g[_\W]{0,3}r[_\W]{0,3}[a4@áâ][_\W]{0,3}x?[_\W]{0,3}(?:\b|\s)/i
body __DRUGS_MALEDYSFUNCTION2	/\bV(?:ag.ra|igara|iag.ra|iagr.a|iaegra|1\@gra)\b/i
#  cialis variants (spelling correct now)
body __DRUGS_MALEDYSFUNCTION3 /(?:\b|\s)[_\W]{0,3}[C©][_\W]{0,3}[i1|lìïî¡][_\W]{0,3}[a4@áâ][_\W]{0,3}[|l][_\W]{0,3}[i1|lïî¡ì][_\W]{0,3}s[_\W]{0,3}(?:\b|\s)/i
body __DRUGS_MALEDYSFUNCTION4	/\bC(?:alis|ili.s)\b/i

# generic names
body __DRUGS_MALEDYSFUNCTION5	/\bsildenafil citrate\b/i
#Levitra
body __DRUGS_MALEDYSFUNCTION6	/\bL\W?[e3]\W?(?:\\\/|V)\W?[i1|l]\W?t\W?r\W?[a4@]\W?(?:\b|\s)/i
#tadalfil
body __DRUGS_MALEDYSFUNCTION8 /\bT\W?[a4@]\W?d\W?[a4@]\W?l\W?[a4@]\W?f\W?[i1|l]\W?l\b/i

# gapped/obfu viagra variants using funky html-style charachter codes

rawbody __DRUGS_MALEDYSFUNCTION10   /\bV(?:i|\&iuml\;)(?:a|\&agrave\;\&aring\;|)gr(?:a|\&agrave|\&aring)\b/i

meta DRUGS_MALEDYSFUNCTION (__DRUGS_MALEDYSFUNCTION1 || __DRUGS_MALEDYSFUNCTION2 || __DRUGS_MALEDYSFUNCTION3 || __DRUGS_MALEDYSFUNCTION4 ||__DRUGS_MALEDYSFUNCTION5 ||__DRUGS_MALEDYSFUNCTION6 ||__DRUGS_MALEDYSFUNCTION7 ||__DRUGS_MALEDYSFUNCTION8 || __DRUGS_MALEDYSFUNCTION10  )
meta DRUGS_MALEDYSFUNCTION_OBFU ( (__DRUGS_MALEDYSFUNCTION1 &&!__DRUGS_MALEDYSFUNCTION_V) || (__DRUGS_MALEDYSFUNCTION3 && !__DRUGS_MALEDYSFUNCTION_C) ||__DRUGS_MALEDYSFUNCTION2 || (__DRUGS_MALEDYSFUNCTION10 &&!__DRUGS_MALEDYSFUNCTION_V))
 


#diet
#phentermine
body __DRUGS_DIET1	/\bp\W?h\W?[e3]\W?n\W?t\W?[e3]\W?r\W?m\W?[i1|l]\W?n\W?[e3]\b/i
#ionamin
body __DRUGS_DIET2	/\bionamin\b/i
#bontril
body __DRUGS_DIET3	/\bbontril\b/i
#phendimetrazine
body __DRUGS_DIET4	/\bphendimetrazine\b/i
#diethylpropion
body __DRUGS_DIET5	/\bdiethylpropion\b/i
#Meridia
body __DRUGS_DIET6	/\bM\W?e\W?r\W?i\W?d\W?i\W?a\b/i
#tenuate
body __DRUGS_DIET7	/\btenuate\b/i
#didrex
body __DRUGS_DIET8	/\bdidrex\b/i
#adipex
body __DRUGS_DIET9	/\ba\W?d\W?[i1|l]\W?p\W?[e3]\W?x\b/i
#xenical
body __DRUGS_DIET10	/\bx\W?[e3]\W?n\W?[i1|l]\W?c\W?[a4@]\W?l\b/i

meta DRUGS_DIET (__DRUGS_DIET1 || __DRUGS_DIET2 || __DRUGS_DIET3 || __DRUGS_DIET4 ||__DRUGS_DIET5 ||__DRUGS_DIET6 ||__DRUGS_DIET7 ||__DRUGS_DIET8 || __DRUGS_DIET9 || __DRUGS_DIET10 )


# pain relief drugs
body __DRUGS_PAIN1	/\bhydrocodone\b/i
body __DRUGS_PAIN2	/\bc[o0]deine\b/i
#ultram
body __DRUGS_PAIN3	/\bu[\Wl1]\W?t\W?r\W?[a4]\W?m\b/i
#vicodin
body __DRUGS_PAIN4	/\bv\W?[i1|l]+\W?c\W?[o0]\W?d\W?[i1|l]\W?n\b/i
body __DRUGS_PAIN5	/\btramadol\b/i
body __DRUGS_PAIN6	/\bultracet\b/i
body __DRUGS_PAIN7	/\bfioricet\b/i
#celebrex
body __DRUGS_PAIN8	/\bc\W?[e3]\W?l\W?[e3]\W?b\W?r\W?[e3]\W?x\b/i
#imitrex
body __DRUGS_PAIN9	/\bimitrex\b/i
#vioxx 
body __DRUGS_PAIN10	/\bv\W?[i1|l]\W?[o0]\W?x\W?x\b/i
#zebutal
body __DRUGS_PAIN11	/\bzebutal\b/i
#esgic plus
body __DRUGS_PAIN12	/\besgic plus\b/i
#Darvon - a prescription narcotic
body __DRUGS_PAIN13	/\bD\W?[a4@]\W?r\W?v\W?[o0]\W?n\b/i

meta DRUGS_PAIN (__DRUGS_PAIN1 || __DRUGS_PAIN2 || __DRUGS_PAIN3 || __DRUGS_PAIN4 ||__DRUGS_PAIN5 ||__DRUGS_PAIN6 ||__DRUGS_PAIN7 ||__DRUGS_PAIN8 || __DRUGS_PAIN9 || __DRUGS_PAIN10|| __DRUGS_PAIN11 || __DRUGS_PAIN12 || __DRUGS_PAIN13)


#sleep aids
#ativan
body __DRUGS_SLEEP1	/(?:\b|\s)[a4@]\W?t\W?[i1|l]\W?v\W?[a4@]\W?n\b/i
#lorazepam
body __DRUGS_SLEEP2	/\bL\W?o\W?r\W?[a4@]\W?z\W?[e3]\W?p\W?[a4@]\W?m\b/i
#ambien
body __DRUGS_SLEEP3	/(?:\b|\s)[a4@]\W?m\W?b\W?[i1|l]\W?[e3]\W?n\b/i
#sonata
body __DRUGS_SLEEP4	/\bS\W?o\W?n\W?[a4@]\W?t\W?a\b/i

meta DRUGS_SLEEP (__DRUGS_SLEEP1 || __DRUGS_SLEEP2 || __DRUGS_SLEEP3 || __DRUGS_SLEEP4 )


#muscle relaxants
#soma
body __DRUGS_MUSCLE1	/\bs\W?[o0]\W?m\W?[a4@]\W?(?:\b|\s)/i
#cyclobenzaprine
body __DRUGS_MUSCLE2	/\bcyclobenz[a4@]pr[i1|l]ne\b/i
#flexeril
body __DRUGS_MUSCLE3	/\bf\W?l\W?[e3]\W?x\W?[e3]\W?r\W?[i1|l]\W?l\b/i
#zanaflex
body __DRUGS_MUSCLE4	/\bzanaflex\b/i
#skelaxin
body __DRUGS_MUSCLE5	/\bskelaxin\b/i

meta DRUGS_MUSCLE (__DRUGS_MUSCLE1 || __DRUGS_MUSCLE2 || __DRUGS_MUSCLE3 || __DRUGS_MUSCLE4 ||__DRUGS_MUSCLE5 )


#anti-anxiety
#xanax
body __DRUGS_ANXIETY1	/\bx\W?[a4@]\W?n\W?[a4@]\W?x\b/i
#alprazolam
body __DRUGS_ANXIETY2	/\balprazolam\b/i
#valium
body __DRUGS_ANXIETY3	/(?:\s\\\/|\bV)\W?[a4@]\W?l\W?[i1|l]+\W?u\W?m\b/i
#diezapam
body __DRUGS_ANXIETY4	/\bd\W?[i1|l]\W?e\W?z\W?[a4@]\W?p\W?[a4@]\W?m\b/i
#ativan
body __DRUGS_ANXIETY5	/\ba\W?t\W?[i1|l]\W?v\W?[a4@]\W?n\b/i
#lorazepam
body __DRUGS_ANXIETY6	/\bl\W?[o0]\W?r\W?[a4@]\W?z\W?[e3]\W?p\W?[a4@]\W?m\b/i
#clonazepam
body __DRUGS_ANXIETY7	/\bc\W?l\W?[o0]\W?n\W?[a4@]\W?z\W?e\W?p\W?[a4@]\W?m\b/i
#klonopin
body __DRUGS_ANXIETY8	/\bklonopin\b/i
#rivotril
body __DRUGS_ANXIETY9	/\brivotril\b/i
meta DRUGS_ANXIETY (__DRUGS_ANXIETY1 || __DRUGS_ANXIETY2 || __DRUGS_ANXIETY3 || __DRUGS_ANXIETY4 ||__DRUGS_ANXIETY5 ||__DRUGS_ANXIETY6 ||__DRUGS_ANXIETY7 ||__DRUGS_ANXIETY8 || __DRUGS_ANXIETY9 )

#antidepresant
#prozac
body __DRUGS_DEPRESSION1	/\bp\W?r\W?[o0]\W?z\W?[a4@]\W?c\b/i
#fluoxetine 
body __DRUGS_DEPRESSION2	/\bfluoxetine\b/i
#buspar
body __DRUGS_DEPRESSION3	/\bbuspar\b/i
#paxil
body __DRUGS_DEPRESSION4	/\bp\W?[a4@]\W?x\W?[i1|l]\W?l\b/i
#wellbutrin
body __DRUGS_DEPRESSION5	/\bwellbutrin\b/i
#lexapro
body __DRUGS_DEPRESSION6	/\blexapro\b/i
#zoloft
body __DRUGS_DEPRESSION7	/\bz\W?[o0]\W?l\W?[o0]\W?f\W?t\b/i
#elavil
body __DRUGS_DEPRESSION8	/\belavil\b/i
#sarafem
body __DRUGS_DEPRESSION9	/\bsarafem\b/i
#remeron
body __DRUGS_DEPRESSION10	/\bremeron\b/i
meta DRUGS_DEPRESSION (__DRUGS_DEPRESSION1 || __DRUGS_DEPRESSION2 || __DRUGS_DEPRESSION3 || __DRUGS_DEPRESSION4 ||__DRUGS_DEPRESSION5 ||__DRUGS_DEPRESSION6 ||__DRUGS_DEPRESSION7 ||__DRUGS_DEPRESSION8 || __DRUGS_DEPRESSION9 || __DRUGS_DEPRESSION10)


#hair
#propecia
body __DRUGS_HAIR1		/\bpr[o0]p[e3]c[i1!|]a\b/i
#rogaine
body __DRUGS_HAIR2		/\brogaine\b/i
meta DRUGS_HAIR (__DRUGS_HAIR1 || __DRUGS_HAIR2)

# Catch descriptions in the message body
body __DRUGS_DESCRIPTION1	/\bgeneric\smeds\b/i
body __DRUGS_DESCRIPTION2	/\bgirlfriend\sloves\sthe\sresults\b/i
body __DRUGS_DESCRIPTION3	/\bmakes?\sit\slasts?\sall\b/i
body __DRUGS_DESCRIPTION4	/\bonline\s+drugstore\b/i
body __DRUGS_DESCRIPTION5	/\bof\s+(?:medications|prescriptions)\b/i
body __DRUGS_DESCRIPTION6       /\bpi[lÍ][lÌ]s\b/i
body __DRUGS_DESCRIPTION7       /\blôvëlîfe\b/i
meta DRUGS_DESCRIPTION (__DRUGS_DESCRIPTION1 || __DRUGS_DESCRIPTION2 || __DRUGS_DESCRIPTION3 || __DRUGS_DESCRIPTION4 || __DRUGS_DESCRIPTION5 || __DRUGS_DESCRIPTION6 || __DRUGS_DESCRIPTION7)

#search for "weird" combinations that are unlikely to 
#be prescribed together for a single event, thus unlikely to be
#mentioned in the same email, except an online pharmacy ad.

meta DRUGS_DIET_MALEDYS	(DRUGS_MALEDYSFUNCTION && DRUGS_DIET)
meta DRUGS_PAIN_MALEDYS	(DRUGS_MALEDYSFUNCTION && DRUGS_PAIN)
meta DRUGS_DEPRESSION_MALEDYS	(DRUGS_MALEDYSFUNCTION && DRUGS_DEPRESSION)
meta DRUGS_ANXIETY_MALEDYS (DRUGS_MALEDYSFUNCTION && DRUGS_ANXIETY)
meta DRUGS_DIET_PAIN	(DRUGS_DIET && DRUGS_PAIN)

# Breast enhancement drugs
body __BREAST_SUCCESS1     /\bBr[eé]ast\s+Succ[eé]ss\b/i
body __BREAST_SUCCESS2     /\bh[eé]rbal\s+br[eé]ast\s+[eé]nhancing\s+suppl[eé]ment\b/i
meta BREAST_SUCCESS (__BREAST_SUCCESS1 || __BREAST_SUCCESS2)

#this last rule is SA 2.5x and higher only

# note: some 3 item combos are "normal" ie: a patient might legitamately
# be prescribed depression, anxiety and sleep aid drugs all at once.
# however, I know of no "normal" 4-item combinations.
# don't use this rule with a sum-total that fires off for 3 or less

meta DRUGS_MANYKINDS	(DRUGS_MALEDYSFUNCTION + DRUGS_DIET + DRUGS_PAIN + DRUGS_SLEEP + DRUGS_MUSCLE + DRUGS_ANXIETY + DRUGS_DEPRESSION + DRUGS_HAIR >3)



score DRUGS_MALEDYSFUNCTION 6.0
score DRUGS_MALEDYSFUNCTION_OBFU 6.5
score DRUGS_DIET 6.01
score DRUGS_PAIN 6.01
score DRUGS_SLEEP 6.01
score DRUGS_MUSCLE 6.01
score DRUGS_ANXIETY 6.01
score DRUGS_DEPRESSION 6.01
score DRUGS_HAIR 6.0

score DRUGS_DIET_MALEDYS 6.0
score DRUGS_PAIN_MALEDYS 6.0
score DRUGS_DEPRESSION_MALEDYS 6.0
score DRUGS_ANXIETY_MALEDYS 6.0
score DRUGS_DIET_PAIN	6.5

score DRUGS_DESCRIPTION 6.0

score DRUGS_MANYKINDS 6.0
score BREAST_SUCCESS 10.0

describe DRUGS_MALEDYSFUNCTION 		For erectile disfunction pils
describe DRUGS_MALEDYSFUNCTION_OBFU	Obfuscated erectile disfunction pills
describe DRUGS_DIET			For diet pills
describe DRUGS_PAIN			For pain pills
describe DRUGS_SLEEP			For sleeping pills
describe DRUGS_MUSCLE			For muscle relaxant pills
describe DRUGS_ANXIETY			For anxiety pills
describe DRUGS_DEPRESSION		For depression pills
describe DRUGS_HAIR			For hair growth pills

describe DRUGS_DIET_MALEDYS		Both erectile disfunction and diet pills
describe DRUGS_PAIN_MALEDYS		Both erectile disfunction and pain medicine
describe DRUGS_DEPRESSION_MALEDYS	Both erectile disfunction and dpression pills
describe DRUGS_ANXIETY_MALEDYS		Both erectile disfunction and anxiety pills
describe DRUGS_DIET_PAIN		Both diet and pain pills

describe DRUGS_DESCRIPTION 		Body contains descriptions of hawking medicine

describe DRUGS_MANYKINDS		Body contains many different types of medication

describe BREAST_SUCCESS                 Breast enhancement pills