#The anti-drug ruleset
# authored by Matt Kettler for SpamAssassin
#
# This ruleset is intended to detect common "pill spam"
# however, it is not appropriate for all environments.
# It may not be appropriate for a medical or pharmecutical
# environment. If in doubt, adjust the scores of all the rules
# to 0.01 and see if they fire off on your daily nonspam.
#
#
# rev 0.52 02/18/2004
#
# the current home of this ruleset is
# http://mywebpages.comcast.net/mkettler/sa/antidrug.cf
#
# Contact address mkettler_sa@comcast.net
#

#male sexual dysfunction drugs
#
# This section is undergoing improvements and I'm trying to track down a 
# FP case that seems to mostly affect technical emails.
# However, all of the test cases so far fail to match when retested.

# note: The regex /v.i.a.g.r.a/ was intentionaly not used
# due to potential false positive cases with PGP signatures
# and other base-64ish stuff.
# instead other patterns are used catch non alphanumeric gapping patterns
# note: \W = "non word charachter"


# Note: many of the drugs named in here are brand-names and are trademarked.
# All trademarks are property of the respective owners.

#plain Viagra and Cialis (used in obfu detection)
body __DRUGS_MALEDYSFUNCTION_V	/\bViagra\b/i
body __DRUGS_MALEDYSFUNCTION_C	/\bCialis\b/i

#  obfu/plain and mis-spelled Viagra variants
body __DRUGS_MALEDYSFUNCTION1	/(?:\b|\s)[_\W]{0,3}(?:\\\/|V)[_\W]{0,3}[i1|l][_\W]{0,3}[a4@][_\W]{0,3}g[_\W]{0,3}r[_\W]{0,3}[a4@][_\W]{0,3}x?[_\W]{0,3}(?:\b|\s)/i
body __DRUGS_MALEDYSFUNCTION2	/\bV(?:agira|igara|iaggra|iaegra)\b/i
#  cialis variants (spelling correct now)
body __DRUGS_MALEDYSFUNCTION3 /(?:\b|\s)[_\W]{0,3}C[_\W]{0,3}[i1|l][_\W]{0,3}[a4@][_\W]{0,3}[|l][_\W]{0,3}[i1|l][_\W]{0,3}s[_\W]{0,3}(?:\b|\s)/i
body __DRUGS_MALEDYSFUNCTION4	/\bC(?:alis|ilias|ilais)\b/i

# generic names
body __DRUGS_MALEDYSFUNCTION5	/\bsildenafil citrate\b/i
#Levitra
body __DRUGS_MALEDYSFUNCTION6	/\bL\W?[e3]\W?(?:\\\/|V)\W?[i1|l]\W?t\W?r\W?[a4@]\W?(?:\b|\s)/i
#tadalfil
body __DRUGS_MALEDYSFUNCTION8 /\bT\W?[a4@]\W?d\W?[a4@]\W?l\W?[a4@]\W?f\W?[i1|l]\W?l\b/i

# gapped/obfu viagra variants using funky html-style charachter codes

rawbody __DRUGS_MALEDYSFUNCTION10   /\bV(?:i|\&iuml\;)(?:a|\&agrave\;\&aring\;|)gr(?:a|\&agrave|\&aring)\b/i

meta LOCAL_DRUGS_MALEDYSFUNCTION (__DRUGS_MALEDYSFUNCTION1 || __DRUGS_MALEDYSFUNCTION2 || __DRUGS_MALEDYSFUNCTION3 || __DRUGS_MALEDYSFUNCTION4 ||__DRUGS_MALEDYSFUNCTION5 ||__DRUGS_MALEDYSFUNCTION6 ||__DRUGS_MALEDYSFUNCTION7 ||__DRUGS_MALEDYSFUNCTION8 || __DRUGS_MALEDYSFUNCTION10  )
meta LOCAL_DRUGS_MALEDYSFUNCTION_OBFU ( (__DRUGS_MALEDYSFUNCTION1 &&!__DRUGS_MALEDYSFUNCTION_V) || (__DRUGS_MALEDYSFUNCTION3 && !__DRUGS_MALEDYSFUNCTION_C) ||__DRUGS_MALEDYSFUNCTION2 || (__DRUGS_MALEDYSFUNCTION10 &&!__DRUGS_MALEDYSFUNCTION_V))
 


#diet
#phentermine
body __DRUGS_DIET1	/\bp\W?h\W?[e3]\W?n\W?t\W?[e3]\W?r\W?m\W?[i1|l]\W?n\W?[e3]\b/i
#ionamin
body __DRUGS_DIET2	/\bionamin\b/i
#bontril
body __DRUGS_DIET3	/\bbontril\b/i
#phendimetrazine
body __DRUGS_DIET4	/\bphendimetrazine\b/i
#diethylpropion
body __DRUGS_DIET5	/\bdiethylpropion\b/i
#Meridia
body __DRUGS_DIET6	/\bM\W?e\W?r\W?i\W?d\W?i\W?a\b/i
#tenuate
body __DRUGS_DIET7	/\btenuate\b/i
#didrex
body __DRUGS_DIET8	/\bdidrex\b/i
#adipex
body __DRUGS_DIET9	/\ba\W?d\W?[i1|l]\W?p\W?[e3]\W?x\b/i
#xenical
body __DRUGS_DIET10	/\bx\W?[e3]\W?n\W?[i1|l]\W?c\W?[a4@]\W?l\b/i

meta LOCAL_DRUGS_DIET (__DRUGS_DIET1 || __DRUGS_DIET2 || __DRUGS_DIET3 || __DRUGS_DIET4 ||__DRUGS_DIET5 ||__DRUGS_DIET6 ||__DRUGS_DIET7 ||__DRUGS_DIET8 || __DRUGS_DIET9 || __DRUGS_DIET10 )


# pain relief drugs
body __DRUGS_PAIN1	/\bhydrocodone\b/i
body __DRUGS_PAIN2	/\bc[o0]deine\b/i
#ultram
body __DRUGS_PAIN3	/\bu\W?l\W?t\W?r\W?[a4@]\W?m\b/i
#vicodin
body __DRUGS_PAIN4	/\bv\W?[i1|l]\W?c\W?o\W?d\W?i\W?n\b/i
body __DRUGS_PAIN5	/\btramadol\b/i
body __DRUGS_PAIN6	/\bultracet\b/i
body __DRUGS_PAIN7	/\bfioricet\b/i
#celebrex
body __DRUGS_PAIN8	/\bc\W?[e3]\W?l\W?[e3]\W?b\W?r\W?[e3]\W?x\b/i
#imitrex
body __DRUGS_PAIN9	/\bimitrex\b/i
#vioxx 
body __DRUGS_PAIN10	/\bv\W?[i1|l]\W?[o0]\W?x\W?x\b/i
#zebutal
body __DRUGS_PAIN11	/\bzebutal\b/i
#esgic plus
body __DRUGS_PAIN12	/\besgic plus\b/i
#Darvon - a prescription narcotic
body __DRUGS_PAIN13	/\bD\W?[a4@]\W?r\W?v\W?[o0]\W?n\b/i

meta LOCAL_DRUGS_PAIN (__DRUGS_PAIN1 || __DRUGS_PAIN2 || __DRUGS_PAIN3 || __DRUGS_PAIN4 ||__DRUGS_PAIN5 ||__DRUGS_PAIN6 ||__DRUGS_PAIN7 ||__DRUGS_PAIN8 || __DRUGS_PAIN9 || __DRUGS_PAIN10|| __DRUGS_PAIN11 || __DRUGS_PAIN12 || __DRUGS_PAIN13)


#sleep aids
#ativan
body __DRUGS_SLEEP1	/(?:\b|\s)[a4@]\W?t\W?[i1|l]\W?v\W?[a4@]\W?n\b/i
#lorazepam
body __DRUGS_SLEEP2	/\bL\W?o\W?r\W?[a4@]\W?z\W?[e3]\W?p\W?[a4@]\W?m\b/i
#ambien
body __DRUGS_SLEEP3	/(?:\b|\s)[a4@]\W?m\W?b\W?[i1|l]\W?[e3]\W?n\b/i
#sonata
body __DRUGS_SLEEP4	/\bS\W?o\W?n\W?[a4@]\W?t\W?a\b/i

meta LOCAL_DRUGS_SLEEP (__DRUGS_SLEEP1 || __DRUGS_SLEEP2 || __DRUGS_SLEEP3 || __DRUGS_SLEEP4 )


#muscle relaxants
#soma
body __DRUGS_MUSCLE1	/\bs\W?[o0]\W?m\W?[a4@]\W?(?:\b|\s)/i
#cyclobenzaprine
body __DRUGS_MUSCLE2	/\bcyclobenz[a4@]pr[i1|l]ne\b/i
#flexeril
body __DRUGS_MUSCLE3	/\bf\W?l\W?[e3]\W?x\W?[e3]\W?r\W?[i1|l]\W?l\b/i
#zanaflex
body __DRUGS_MUSCLE4	/\bzanaflex\b/i
#skelaxin
body __DRUGS_MUSCLE5	/\bskelaxin\b/i

meta LOCAL_DRUGS_MUSCLE (__DRUGS_MUSCLE1 || __DRUGS_MUSCLE2 || __DRUGS_MUSCLE3 || __DRUGS_MUSCLE4 ||__DRUGS_MUSCLE5 )


#anti-anxiety
#xanax
body __DRUGS_ANXIETY1	/\bx\W?[a4@]\W?n\W?[a4@]\W?x\b/i
#alprazolam
body __DRUGS_ANXIETY2	/\balprazolam\b/i
#valium
body __DRUGS_ANXIETY3	/(?:\s\\\/|\bV)\W?[a4@]\W?l\W?[i1|l]\W?u\W?m\b/i
#diezapam
body __DRUGS_ANXIETY4	/\bd\W?[i1|l]\W?e\W?z\W?[a4@]\W?p\W?[a4@]\W?m\b/i
#ativan
body __DRUGS_ANXIETY5	/\ba\W?t\W?[i1|l]\W?v\W?[a4@]\W?n\b/i
#lorazepam
body __DRUGS_ANXIETY6	/\bl\W?[o0]\W?r\W?[a4@]\W?z\W?[e3]\W?p\W?[a4@]\W?m\b/i
#clonazepam
body __DRUGS_ANXIETY7	/\bc\W?l\W?[o0]\W?n\W?[a4@]\W?z\W?e\W?p\W?[a4@]\W?m\b/i
#klonopin
body __DRUGS_ANXIETY8	/\bklonopin\b/i
#rivotril
body __DRUGS_ANXIETY9	/\brivotril\b/i
meta LOCAL_DRUGS_ANXIETY (__DRUGS_ANXIETY1 || __DRUGS_ANXIETY2 || __DRUGS_ANXIETY3 || __DRUGS_ANXIETY4 ||__DRUGS_ANXIETY5 ||__DRUGS_ANXIETY6 ||__DRUGS_ANXIETY7 ||__DRUGS_ANXIETY8 || __DRUGS_ANXIETY9 )

#antidepresant
#prozac
body __DRUGS_DEPRESSION1	/\bp\W?r\W?[o0]\W?z\W?[a4@]\W?c\b/i
#fluoxetine 
body __DRUGS_DEPRESSION2	/\bfluoxetine\b/i
#buspar
body __DRUGS_DEPRESSION3	/\bbuspar\b/i
#paxil
body __DRUGS_DEPRESSION4	/\bp\W?[a4@]\W?x\W?[i1|l]\W?l\b/i
#wellbutrin
body __DRUGS_DEPRESSION5	/\bwellbutrin\b/i
#lexapro
body __DRUGS_DEPRESSION6	/\blexapro\b/i
#zoloft
body __DRUGS_DEPRESSION7	/\bz\W?[o0]\W?l\W?[o0]\W?f\W?t\b/i
#elavil
body __DRUGS_DEPRESSION8	/\belavil\b/i
#sarafem
body __DRUGS_DEPRESSION9	/\bsarafem\b/i
#remeron
body __DRUGS_DEPRESSION10	/\bremeron\b/i
meta LOCAL_DRUGS_DEPRESSION (__DRUGS_DEPRESSION1 || __DRUGS_DEPRESSION2 || __DRUGS_DEPRESSION3 || __DRUGS_DEPRESSION4 ||__DRUGS_DEPRESSION5 ||__DRUGS_DEPRESSION6 ||__DRUGS_DEPRESSION7 ||__DRUGS_DEPRESSION8 || __DRUGS_DEPRESSION9 || __DRUGS_DEPRESSION10)




#search for "weird" combinations that are unlikely to 
#be prescribed together for a single event, thus unlikely to be
#mentioned in the same email, except an online pharmacy ad.

meta LOCAL_DRUGS_DIET_MALEDYS	(LOCAL_DRUGS_MALEDYSFUNCTION && LOCAL_DRUGS_DIET)
meta LOCAL_DRUGS_PAIN_MALEDYS	(LOCAL_DRUGS_MALEDYSFUNCTION && LOCAL_DRUGS_PAIN)
meta LOCAL_DRUGS_DEPRESSION_MALEDYS	(LOCAL_DRUGS_MALEDYSFUNCTION && LOCAL_DRUGS_DEPRESSION)
meta LOCAL_DRUGS_ANXIETY_MALEDYS (LOCAL_DRUGS_MALEDYSFUNCTION && LOCAL_DRUGS_ANXIETY)
meta LOCAL_DRUGS_DIET_PAIN	(LOCAL_DRUGS_DIET && LOCAL_DRUGS_PAIN)


#this last rule is SA 2.5x and higher only

# note: some 3 item combos are "normal" ie: a patient might legitamately
# be prescribed depression, anxiety and sleep aid drugs all at once.
# however, I know of no "normal" 4-item combinations.
# don't use this rule with a sum-total that fires off for 3 or less

meta LOCAL_DRUGS_MANYKINDS	(LOCAL_DRUGS_MALEDYSFUNCTION + LOCAL_DRUGS_DIET + LOCAL_DRUGS_PAIN + LOCAL_DRUGS_SLEEP + LOCAL_DRUGS_MUSCLE + LOCAL_DRUGS_ANXIETY + LOCAL_DRUGS_DEPRESSION >3)



score LOCAL_DRUGS_MALEDYSFUNCTION 1.0
score LOCAL_DRUGS_MALEDYSFUNCTION_OBFU 0.5
score LOCAL_DRUGS_DIET 0.01
score LOCAL_DRUGS_PAIN 0.01
score LOCAL_DRUGS_SLEEP 0.01
score LOCAL_DRUGS_MUSCLE 0.01
score LOCAL_DRUGS_ANXIETY 0.01
score LOCAL_DRUGS_DEPRESSION 0.01

score LOCAL_DRUGS_DIET_MALEDYS 1.0
score LOCAL_DRUGS_PAIN_MALEDYS 1.0
score LOCAL_DRUGS_DEPRESSION_MALEDYS 1.0
score LOCAL_DRUGS_ANXIETY_MALEDYS 1.0
score LOCAL_DRUGS_DIET_PAIN	0.5

score LOCAL_DRUGS_MANYKINDS 1.0