portalzine / mosparo rule package example

{ "lastUpdatedAt": "2025-11-11T12:00:00Z", "refreshInterval": 3600, "rules": [ { "uuid": "550e8400-e29b-41d4-a716-446655440000", "name": "Common Spam Words", "description": "Detects common spam keywords and phrases", "type": "word", "spamRatingFactor": 1.2, "items": [ { "uuid": "550e8400-e29b-41d4-a716-446655440001", "type": "text", "value": "viagra", "rating": 0.9 }, { "uuid": "550e8400-e29b-41d4-a716-446655440002", "type": "text", "value": "cialis", "rating": 0.9 }, { "uuid": "550e8400-e29b-41d4-a716-446655440003", "type": "text", "value": "free money", "rating": 0.8 }, { "uuid": "550e8400-e29b-41d4-a716-446655440004", "type": "text", "value": "win now", "rating": 0.7 }, { "uuid": "550e8400-e29b-41d4-a716-446655440005", "type": "text", "value": "click here", "rating": 0.6 } ] }, { "uuid": "550e8400-e29b-41d4-a716-446655440010", "name": "Suspicious Email Patterns", "description": "Regex patterns to detect suspicious email formats and content", "type": "regex", "spamRatingFactor": 1.0, "items": [ { "uuid": "550e8400-e29b-41d4-a716-446655440011", "type": "regex", "value": "\\b[A-Z]{2,}\\s+[A-Z]{2,}\\s+[A-Z]{2,}\\b", "rating": 0.7 }, { "uuid": "550e8400-e29b-41d4-a716-446655440012", "type": "regex", "value": "\\$\\d+[,.]?\\d*\\s*(million|billion|thousand)", "rating": 0.8 }, { "uuid": "550e8400-e29b-41d4-a716-446655440013", "type": "regex", "value": "(?i)\\b(urgent|immediate|act\\s+now|limited\\s+time)\\b", "rating": 0.6 }, { "uuid": "550e8400-e29b-41d4-a716-446655440014", "type": "regex", "value": "\\b\\d{1,2}%\\s+(?:off|discount|savings)\\b", "rating": 0.5 } ] }, { "uuid": "550e8400-e29b-41d4-a716-446655440020", "name": "Malicious User Agents", "description": "Known malicious or suspicious user agent strings", "type": "user-agent", "spamRatingFactor": 1.5, "items": [ { "uuid": "550e8400-e29b-41d4-a716-446655440021", "type": "text", "value": "curl/", "rating": 0.8 }, { "uuid": "550e8400-e29b-41d4-a716-446655440022", "type": "text", "value": "wget/", "rating": 0.8 }, { "uuid": "550e8400-e29b-41d4-a716-446655440023", "type": "text", "value": "Python-urllib/", "rating": 0.7 }, { "uuid": "550e8400-e29b-41d4-a716-446655440024", "type": "regex", "value": "bot|crawler|spider", "rating": 0.6 } ] }, { "uuid": "550e8400-e29b-41d4-a716-446655440030", "name": "URL Spam Patterns", "description": "Detects suspicious URLs and link patterns", "type": "url", "spamRatingFactor": 1.1, "items": [ { "uuid": "550e8400-e29b-41d4-a716-446655440031", "type": "regex", "value": "https?://bit\\.ly/[a-zA-Z0-9]+", "rating": 0.5 }, { "uuid": "550e8400-e29b-41d4-a716-446655440032", "type": "regex", "value": "https?://tinyurl\\.com/[a-zA-Z0-9]+", "rating": 0.5 }, { "uuid": "550e8400-e29b-41d4-a716-446655440033", "type": "text", "value": ".tk", "rating": 0.7 }, { "uuid": "550e8400-e29b-41d4-a716-446655440034", "type": "text", "value": ".ml", "rating": 0.7 } ] }, { "uuid": "550e8400-e29b-41d4-a716-446655440040", "name": "Phishing Keywords", "description": "Common phishing and social engineering terms", "type": "word", "spamRatingFactor": 1.3, "items": [ { "uuid": "550e8400-e29b-41d4-a716-446655440041", "type": "text", "value": "verify your account", "rating": 0.8 }, { "uuid": "550e8400-e29b-41d4-a716-446655440042", "type": "text", "value": "suspended account", "rating": 0.8 }, { "uuid": "550e8400-e29b-41d4-a716-446655440043", "type": "text", "value": "update payment", "rating": 0.7 }, { "uuid": "550e8400-e29b-41d4-a716-446655440044", "type": "text", "value": "click to confirm", "rating": 0.6 }, { "uuid": "550e8400-e29b-41d4-a716-446655440045", "type": "text", "value": "security alert", "rating": 0.7 } ] }, { "uuid": "550e8400-e29b-41d4-a716-446655440050", "name": "Cryptocurrency Spam", "description": "Detects cryptocurrency-related spam and scam content", "type": "word", "spamRatingFactor": 1.4, "items": [ { "uuid": "550e8400-e29b-41d4-a716-446655440051", "type": "text", "value": "bitcoin investment", "rating": 0.8 }, { "uuid": "550e8400-e29b-41d4-a716-446655440052", "type": "text", "value": "crypto trading bot", "rating": 0.7 }, { "uuid": "550e8400-e29b-41d4-a716-446655440053", "type": "text", "value": "guaranteed profits", "rating": 0.9 }, { "uuid": "550e8400-e29b-41d4-a716-446655440054", "type": "text", "value": "mining software", "rating": 0.6 }, { "uuid": "550e8400-e29b-41d4-a716-446655440055", "type": "text", "value": "wallet recovery", "rating": 0.8 } ] }, { "uuid": "550e8400-e29b-41d4-a716-446655440060", "name": "Code Injection Patterns", "description": "Detects common code injection attempts", "type": "regex", "spamRatingFactor": 2.0, "items": [ { "uuid": "550e8400-e29b-41d4-a716-446655440061", "type": "regex", "value": "<script[^>]*>.*?</script>", "rating": 1.0 }, { "uuid": "550e8400-e29b-41d4-a716-446655440062", "type": "regex", "value": "javascript:", "rating": 0.9 }, { "uuid": "550e8400-e29b-41d4-a716-446655440063", "type": "regex", "value": "(?i)\\b(SELECT|UNION|DROP|INSERT)\\b.*\\b(FROM|TABLE)\\b", "rating": 1.0 }, { "uuid": "550e8400-e29b-41d4-a716-446655440064", "type": "regex", "value": "\\bon\\w+\\s*=", "rating": 0.8 }, { "uuid": "550e8400-e29b-41d4-a716-446655440065", "type": "regex", "value": "document\\.cookie", "rating": 0.9 } ] }, { "uuid": "550e8400-e29b-41d4-a716-446655440070", "name": "SEO Spam Keywords", "description": "Common SEO and marketing spam terms", "type": "word", "spamRatingFactor": 0.8, "items": [ { "uuid": "550e8400-e29b-41d4-a716-446655440071", "type": "text", "value": "SEO services", "rating": 0.6 }, { "uuid": "550e8400-e29b-41d4-a716-446655440072", "type": "text", "value": "rank higher", "rating": 0.5 }, { "uuid": "550e8400-e29b-41d4-a716-446655440073", "type": "text", "value": "backlinks", "rating": 0.6 }, { "uuid": "550e8400-e29b-41d4-a716-446655440074", "type": "text", "value": "increase traffic", "rating": 0.5 }, { "uuid": "550e8400-e29b-41d4-a716-446655440075", "type": "text", "value": "link building", "rating": 0.6 } ] }, { "uuid": "550e8400-e29b-41d4-a716-446655440080", "name": "Adult Content Keywords", "description": "Detects adult content and inappropriate material", "type": "word", "spamRatingFactor": 1.5, "items": [ { "uuid": "550e8400-e29b-41d4-a716-446655440081", "type": "text", "value": "adult dating", "rating": 0.8 }, { "uuid": "550e8400-e29b-41d4-a716-446655440082", "type": "text", "value": "cam girls", "rating": 0.9 }, { "uuid": "550e8400-e29b-41d4-a716-446655440083", "type": "text", "value": "hookup tonight", "rating": 0.8 }, { "uuid": "550e8400-e29b-41d4-a716-446655440084", "type": "text", "value": "singles near you", "rating": 0.7 }, { "uuid": "550e8400-e29b-41d4-a716-446655440085", "type": "text", "value": "meet locals", "rating": 0.6 } ] }, { "uuid": "550e8400-e29b-41d4-a716-446655440090", "name": "Pharmaceutical Spam", "description": "Illegal pharmacy and drug-related spam", "type": "word", "spamRatingFactor": 1.6, "items": [ { "uuid": "550e8400-e29b-41d4-a716-446655440091", "type": "text", "value": "pharmacy online", "rating": 0.8 }, { "uuid": "550e8400-e29b-41d4-a716-446655440092", "type": "text", "value": "no prescription", "rating": 0.9 }, { "uuid": "550e8400-e29b-41d4-a716-446655440093", "type": "text", "value": "weight loss pills", "rating": 0.7 }, { "uuid": "550e8400-e29b-41d4-a716-446655440094", "type": "text", "value": "enhancement pills", "rating": 0.8 }, { "uuid": "550e8400-e29b-41d4-a716-446655440095", "type": "text", "value": "discount pharmacy", "rating": 0.7 } ] }, { "uuid": "550e8400-e29b-41d4-a716-446655440100", "name": "Suspicious Email Patterns", "description": "Detects suspicious email address patterns", "type": "regex", "spamRatingFactor": 1.2, "items": [ { "uuid": "550e8400-e29b-41d4-a716-446655440101", "type": "regex", "value": "\\b[a-z]{1,3}\\d{3,}@[a-z]+\\.[a-z]{2,}\\b", "rating": 0.7 }, { "uuid": "550e8400-e29b-41d4-a716-446655440102", "type": "regex", "value": "\\bnoreply\\d+@[a-z]+\\.[a-z]{2,}\\b", "rating": 0.6 }, { "uuid": "550e8400-e29b-41d4-a716-446655440103", "type": "regex", "value": "\\btest\\d*@[a-z]+\\.[a-z]{2,}\\b", "rating": 0.5 }, { "uuid": "550e8400-e29b-41d4-a716-446655440104", "type": "regex", "value": "\\b\\w+\\.\\w+\\.\\w+@[a-z]+\\.[a-z]{2,}\\b", "rating": 0.6 } ] }, { "uuid": "550e8400-e29b-41d4-a716-446655440110", "name": "International Spam Terms", "description": "Spam terms in multiple languages", "type": "word", "spamRatingFactor": 1.0, "items": [ { "uuid": "550e8400-e29b-41d4-a716-446655440111", "type": "text", "value": "kostenlos", "rating": 0.6 }, { "uuid": "550e8400-e29b-41d4-a716-446655440112", "type": "text", "value": "gratis", "rating": 0.6 }, { "uuid": "550e8400-e29b-41d4-a716-446655440113", "type": "text", "value": "casino", "rating": 0.7 }, { "uuid": "550e8400-e29b-41d4-a716-446655440114", "type": "text", "value": "lottery winner", "rating": 0.8 }, { "uuid": "550e8400-e29b-41d4-a716-446655440115", "type": "text", "value": "inheritance claim", "rating": 0.9 } ] }, { "uuid": "550e8400-e29b-41d4-a716-446655440120", "name": "Suspicious Text Patterns", "description": "Various suspicious formatting and text patterns", "type": "regex", "spamRatingFactor": 1.1, "items": [ { "uuid": "550e8400-e29b-41d4-a716-446655440121", "type": "regex", "value": "\\b[A-Z]{4,}\\s+[A-Z]{4,}\\s+[A-Z]{4,}", "rating": 0.7 }, { "uuid": "550e8400-e29b-41d4-a716-446655440122", "type": "regex", "value": "\\b\\w*(.)\\1{4,}\\w*\\b", "rating": 0.6 }, { "uuid": "550e8400-e29b-41d4-a716-446655440123", "type": "regex", "value": "[!@#$%^&*]{4,}", "rating": 0.5 }, { "uuid": "550e8400-e29b-41d4-a716-446655440124", "type": "regex", "value": "\\d+\\.\\d+\\.\\d+\\.\\d+", "rating": 0.8 }, { "uuid": "550e8400-e29b-41d4-a716-446655440125", "type": "regex", "value": "\\b(URGENT|IMPORTANT|IMMEDIATE).*\\b(ACTION|RESPONSE)\\b", "rating": 0.8 } ] } ] }

07be17de35d734cdd01481f3339ac1baafae897d958a5a863edc53a90e43d83b rulepackage.json