{
  "lastUpdatedAt": "2025-11-11T12:00:00Z",
  "refreshInterval": 3600,
  "rules": [
    {
      "uuid": "550e8400-e29b-41d4-a716-446655440000",
      "name": "Common Spam Words",
      "description": "Detects common spam keywords and phrases",
      "type": "word",
      "spamRatingFactor": 1.2,
      "items": [
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440001",
          "type": "text",
          "value": "viagra",
          "rating": 0.9
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440002",
          "type": "text",
          "value": "cialis",
          "rating": 0.9
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440003",
          "type": "text",
          "value": "free money",
          "rating": 0.8
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440004",
          "type": "text",
          "value": "win now",
          "rating": 0.7
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440005",
          "type": "text",
          "value": "click here",
          "rating": 0.6
        }
      ]
    },
    {
      "uuid": "550e8400-e29b-41d4-a716-446655440010",
      "name": "Suspicious Email Patterns",
      "description": "Regex patterns to detect suspicious email formats and content",
      "type": "regex",
      "spamRatingFactor": 1.0,
      "items": [
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440011",
          "type": "regex",
          "value": "\\b[A-Z]{2,}\\s+[A-Z]{2,}\\s+[A-Z]{2,}\\b",
          "rating": 0.7
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440012",
          "type": "regex",
          "value": "\\$\\d+[,.]?\\d*\\s*(million|billion|thousand)",
          "rating": 0.8
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440013",
          "type": "regex",
          "value": "(?i)\\b(urgent|immediate|act\\s+now|limited\\s+time)\\b",
          "rating": 0.6
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440014",
          "type": "regex",
          "value": "\\b\\d{1,2}%\\s+(?:off|discount|savings)\\b",
          "rating": 0.5
        }
      ]
    },
    {
      "uuid": "550e8400-e29b-41d4-a716-446655440020",
      "name": "Malicious User Agents",
      "description": "Known malicious or suspicious user agent strings",
      "type": "user-agent",
      "spamRatingFactor": 1.5,
      "items": [
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440021",
          "type": "text",
          "value": "curl/",
          "rating": 0.8
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440022",
          "type": "text",
          "value": "wget/",
          "rating": 0.8
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440023",
          "type": "text",
          "value": "Python-urllib/",
          "rating": 0.7
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440024",
          "type": "regex",
          "value": "bot|crawler|spider",
          "rating": 0.6
        }
      ]
    },
    {
      "uuid": "550e8400-e29b-41d4-a716-446655440030",
      "name": "URL Spam Patterns",
      "description": "Detects suspicious URLs and link patterns",
      "type": "url",
      "spamRatingFactor": 1.1,
      "items": [
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440031",
          "type": "regex",
          "value": "https?://bit\\.ly/[a-zA-Z0-9]+",
          "rating": 0.5
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440032",
          "type": "regex",
          "value": "https?://tinyurl\\.com/[a-zA-Z0-9]+",
          "rating": 0.5
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440033",
          "type": "text",
          "value": ".tk",
          "rating": 0.7
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440034",
          "type": "text",
          "value": ".ml",
          "rating": 0.7
        }
      ]
    },
    {
      "uuid": "550e8400-e29b-41d4-a716-446655440040",
      "name": "Phishing Keywords",
      "description": "Common phishing and social engineering terms",
      "type": "word",
      "spamRatingFactor": 1.3,
      "items": [
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440041",
          "type": "text",
          "value": "verify your account",
          "rating": 0.8
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440042",
          "type": "text",
          "value": "suspended account",
          "rating": 0.8
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440043",
          "type": "text",
          "value": "update payment",
          "rating": 0.7
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440044",
          "type": "text",
          "value": "click to confirm",
          "rating": 0.6
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440045",
          "type": "text",
          "value": "security alert",
          "rating": 0.7
        }
      ]
    },
    {
      "uuid": "550e8400-e29b-41d4-a716-446655440050",
      "name": "Cryptocurrency Spam",
      "description": "Detects cryptocurrency-related spam and scam content",
      "type": "word",
      "spamRatingFactor": 1.4,
      "items": [
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440051",
          "type": "text",
          "value": "bitcoin investment",
          "rating": 0.8
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440052",
          "type": "text",
          "value": "crypto trading bot",
          "rating": 0.7
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440053",
          "type": "text",
          "value": "guaranteed profits",
          "rating": 0.9
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440054",
          "type": "text",
          "value": "mining software",
          "rating": 0.6
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440055",
          "type": "text",
          "value": "wallet recovery",
          "rating": 0.8
        }
      ]
    },
    {
      "uuid": "550e8400-e29b-41d4-a716-446655440060",
      "name": "Code Injection Patterns",
      "description": "Detects common code injection attempts",
      "type": "regex",
      "spamRatingFactor": 2.0,
      "items": [
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440061",
          "type": "regex",
          "value": "<script[^>]*>.*?</script>",
          "rating": 1.0
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440062",
          "type": "regex",
          "value": "javascript:",
          "rating": 0.9
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440063",
          "type": "regex",
          "value": "(?i)\\b(SELECT|UNION|DROP|INSERT)\\b.*\\b(FROM|TABLE)\\b",
          "rating": 1.0
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440064",
          "type": "regex",
          "value": "\\bon\\w+\\s*=",
          "rating": 0.8
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440065",
          "type": "regex",
          "value": "document\\.cookie",
          "rating": 0.9
        }
      ]
    },
    {
      "uuid": "550e8400-e29b-41d4-a716-446655440070",
      "name": "SEO Spam Keywords",
      "description": "Common SEO and marketing spam terms",
      "type": "word",
      "spamRatingFactor": 0.8,
      "items": [
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440071",
          "type": "text",
          "value": "SEO services",
          "rating": 0.6
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440072",
          "type": "text",
          "value": "rank higher",
          "rating": 0.5
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440073",
          "type": "text",
          "value": "backlinks",
          "rating": 0.6
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440074",
          "type": "text",
          "value": "increase traffic",
          "rating": 0.5
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440075",
          "type": "text",
          "value": "link building",
          "rating": 0.6
        }
      ]
    },
    {
      "uuid": "550e8400-e29b-41d4-a716-446655440080",
      "name": "Adult Content Keywords",
      "description": "Detects adult content and inappropriate material",
      "type": "word",
      "spamRatingFactor": 1.5,
      "items": [
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440081",
          "type": "text",
          "value": "adult dating",
          "rating": 0.8
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440082",
          "type": "text",
          "value": "cam girls",
          "rating": 0.9
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440083",
          "type": "text",
          "value": "hookup tonight",
          "rating": 0.8
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440084",
          "type": "text",
          "value": "singles near you",
          "rating": 0.7
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440085",
          "type": "text",
          "value": "meet locals",
          "rating": 0.6
        }
      ]
    },
    {
      "uuid": "550e8400-e29b-41d4-a716-446655440090",
      "name": "Pharmaceutical Spam",
      "description": "Illegal pharmacy and drug-related spam",
      "type": "word",
      "spamRatingFactor": 1.6,
      "items": [
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440091",
          "type": "text",
          "value": "pharmacy online",
          "rating": 0.8
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440092",
          "type": "text",
          "value": "no prescription",
          "rating": 0.9
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440093",
          "type": "text",
          "value": "weight loss pills",
          "rating": 0.7
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440094",
          "type": "text",
          "value": "enhancement pills",
          "rating": 0.8
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440095",
          "type": "text",
          "value": "discount pharmacy",
          "rating": 0.7
        }
      ]
    },
    {
      "uuid": "550e8400-e29b-41d4-a716-446655440100",
      "name": "Suspicious Email Patterns",
      "description": "Detects suspicious email address patterns",
      "type": "regex",
      "spamRatingFactor": 1.2,
      "items": [
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440101",
          "type": "regex",
          "value": "\\b[a-z]{1,3}\\d{3,}@[a-z]+\\.[a-z]{2,}\\b",
          "rating": 0.7
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440102",
          "type": "regex",
          "value": "\\bnoreply\\d+@[a-z]+\\.[a-z]{2,}\\b",
          "rating": 0.6
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440103",
          "type": "regex",
          "value": "\\btest\\d*@[a-z]+\\.[a-z]{2,}\\b",
          "rating": 0.5
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440104",
          "type": "regex",
          "value": "\\b\\w+\\.\\w+\\.\\w+@[a-z]+\\.[a-z]{2,}\\b",
          "rating": 0.6
        }
      ]
    },
    {
      "uuid": "550e8400-e29b-41d4-a716-446655440110",
      "name": "International Spam Terms",
      "description": "Spam terms in multiple languages",
      "type": "word",
      "spamRatingFactor": 1.0,
      "items": [
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440111",
          "type": "text",
          "value": "kostenlos",
          "rating": 0.6
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440112",
          "type": "text",
          "value": "gratis",
          "rating": 0.6
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440113",
          "type": "text",
          "value": "casino",
          "rating": 0.7
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440114",
          "type": "text",
          "value": "lottery winner",
          "rating": 0.8
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440115",
          "type": "text",
          "value": "inheritance claim",
          "rating": 0.9
        }
      ]
    },
    {
      "uuid": "550e8400-e29b-41d4-a716-446655440120",
      "name": "Suspicious Text Patterns",
      "description": "Various suspicious formatting and text patterns",
      "type": "regex",
      "spamRatingFactor": 1.1,
      "items": [
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440121",
          "type": "regex",
          "value": "\\b[A-Z]{4,}\\s+[A-Z]{4,}\\s+[A-Z]{4,}",
          "rating": 0.7
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440122",
          "type": "regex",
          "value": "\\b\\w*(.)\\1{4,}\\w*\\b",
          "rating": 0.6
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440123",
          "type": "regex",
          "value": "[!@#$%^&*]{4,}",
          "rating": 0.5
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440124",
          "type": "regex",
          "value": "\\d+\\.\\d+\\.\\d+\\.\\d+",
          "rating": 0.8
        },
        {
          "uuid": "550e8400-e29b-41d4-a716-446655440125",
          "type": "regex",
          "value": "\\b(URGENT|IMPORTANT|IMMEDIATE).*\\b(ACTION|RESPONSE)\\b",
          "rating": 0.8
        }
      ]
    }
  ]
}