# Ruleset: GONE_PHISHING.cf - JR_PHISH.cf StandAlone Version
# License: GPL
# Version: 215159157
# Created: Mon Oct 26 07:25:58 AM EDT 2026
# Author: Jared Hall
# Contact: jared@jaredsec.com
# Generated By: jbuild

################### JR_PHISH ###################

# These are some simple rules which will filter out a lot of
# impersonation phishes/spam. Designed for use by Small and
# Medium-sized businesses, these rules provide additional proectections
# for scams from over 90 different entities. Enjoy!


################## PHISHING SPOOFS ###################
#
# GENERAL DETECTIONS #
######################
header	__JR_PHISH_REPLY		exists:Reply-To
meta    __JR_PHISH_SPF_RDIR		(SPF_FAIL || __GOOG_REDIR)
header  __JR_PHISH_BEENTHERE	exists:X-BeenThere

header  __JR_PHISH_PROD_OLK     ALL:raw =~ /Received:\sfrom\s(.*\.)prod\.outlook\.com\s/m
tflags	__JR_PHISH_PROD_OLK		multiple maxhits=4
meta    __JR_PHISH_MPROD_OLK	(__JR_PHISH_PROD_OLK >= 3)

mimeheader __JR_PHISH_ARCHIVE1  Content-Type =~ /.*(\.tgz|\.zip|\.xz|\.x\-rar|\.jar|\.r00|\.r09)(\"|\;)?/i
mimeheader __JR_PHISH_ARCHIVE2  Content-Disposition =~ /filename\=[\s"]?.*\.(tgz|zipx?|7z|xz|z|[jr]ar|r0[0-9]|arc|gz|bz2?|tar|b?cpio|sit|lzh|lha|cab)([";']?|$)/i
meta       JR_PHISH_ARCHIVE     (__JR_PHISH_ARCHIVE1 || __JR_PHISH_ARCHIVE2)
score      JR_PHISH_ARCHIVE     0.1

mimeheader JR_PHISH_DOC         Content-Type =~ /(\.doc|\.docx|\.rtf|\.odt|\.xls|\.xltx|wordprocessingml\.document|officedocument\.spreadsheetml\.sheet)/i
score      JR_PHISH_DOC         0.1

mimeheader __JR_PHISH_PDF1      Content-Type =~ /\.pdf/i
mimeheader __JR_PHISH_PDF2      Content-Disposition =~ /filename\=\"?.*([\._]pdf\.img|\.pdf)\"?/i
meta       JR_PHISH_PDF         (__JR_PHISH_PDF1 || __JR_PHISH_PDF2)
score      JR_PHISH_PDF         0.1

mimeheader JR_PHISH_ISO         Content-Type =~ /(\.iso|\.daa)/i
score      JR_PHISH_ISO         0.1

mimeheader __JR_PHISH_IMG1      Content-Disposition =~ /filename\=\"?.*(\.img)\"?/i
meta       JR_PHISH_IMG         (__JR_PHISH_IMG1)
score      JR_PHISH_IMG         0.1

mimeheader __GIF_ATTACH 		Content-Type =~ /^image\/gif\b/i
mimeheader __JPEG_ATTACH          Content-Type =~ /image\/jpeg/i
mimeheader   __ZIP_ATTACH_NOFN   Content-Type =~ m,\bapplication/zip[;\s]*$,i

header		__JR_SUBJ_PHONE1	Subject =~ /(^|\b|\s|\:)(\+1|1)?[\.\-),(\s\[\]`{}]*(?:[\d]{3})[\.\-),(\s\[\]`{}]*(?:[\d]{3})[\.\-),(\s\[\]`{}]*(?:[\d]{4})(\b|$)/
header		__JR_SUBJ_PHONE2A	Subject:raw =~ /\=\?UTF\-8\?B\?/i
header		__JR_SUBJ_PHONE2B	Subject =~ /[\xF0\x9D\x9F\x8E-\xF0\x9D\x9F\xBF]{3,}/
meta		T_JR_SUBJ_PHONE     (__JR_SUBJ_PHONE1 || (__JR_SUBJ_PHONE2A && __JR_SUBJ_PHONE2B))
header		__JR_FROM_PHONE1	From:name =~ /(^|\b|\s|\:)(\+1|1)?[\.\-),(\s\[\]`{}]*(?:[\d]{3})[\.\-),(\s\[\]`{}]*(?:[\d]{3})[\.\-),(\s\[\]`{}]*(?:[\d]{4})(\b|$)/
header		__JR_FROM_PHONE2A	From:raw =~ /\=\?UTF\-8\?B\?/i
header		__JR_FROM_PHONE2B	From:name =~ /[\xF0\x9D\x9F\x8E-\xF0\x9D\x9F\xBF]{3,}/
meta		T_JR_FROM_PHONE		(__JR_FROM_PHONE1 || (__JR_FROM_PHONE2A && __JR_FROM_PHONE2B))
header		__JR_REPLY_PHONE1	Reply-To:name =~ /(^|\b|\s|\:)(\+1|1)?[\.\-),(\s\[\]`{}]*(?:[\d]{3})[\.\-),(\s\[\]`{}]*(?:[\d]{3})[\.\-),(\s\[\]`{}]*(?:[\d]{4})(\b|$)/
header		__JR_REPLY_PHONE2A	From:raw =~ /\=\?UTF\-8\?B\?/i
header		__JR_REPLY_PHONE2B	Reply-To =~ /([\xF0\x9D\x9F\x8E-\xF0\x9D\x9F\xBF]|[\xf0\x9f\x84\x80-\xf0\x9f\x84\x8a]){3,}/
meta		T_JR_REPLY_PHONE	(__JR_REPLY_PHONE1 || (__JR_REPLY_PHONE2A && __JR_REPLY_PHONE2B))

# Math
body		__JR_BODY_MATH_PHONE1	/\((\xf0\x9d\x9f\x8e|\xf0\x9d\x9f\x8f|\xf0\x9d\x9f\x90|\xf0\x9d\x9f\x91|\xf0\x9d\x9f\x92|\xf0\x9d\x9f\x93|\xf0\x9d\x9f\x94|\xf0\x9d\x9f\x95|\xf0\x9d\x9f\x96|\xf0\x9d\x9f\x97|\xf0\x9d\x9f\x98|\xf0\x9d\x9f\x99|\xf0\x9d\x9f\x9a|\xf0\x9d\x9f\x9b|\xf0\x9d\x9f\x9c|\xf0\x9d\x9f\x9d|\xf0\x9d\x9f\x9e|\xf0\x9d\x9f\x9f|\xf0\x9d\x9f\xa0|\xf0\x9d\x9f\xa1|\xf0\x9d\x9f\xa2|\xf0\x9d\x9f\xa3|\xf0\x9d\x9f\xa4|\xf0\x9d\x9f\xa5|\xf0\x9d\x9f\xa6|\xf0\x9d\x9f\xa7|\xf0\x9d\x9f\xa8|\xf0\x9d\x9f\xa9|\xf0\x9d\x9f\xaa|\xf0\x9d\x9f\xab|\xf0\x9d\x9f\xac|\xf0\x9d\x9f\xad|\xf0\x9d\x9f\xae|\xf0\x9d\x9f\xaf|\xf0\x9d\x9f\xb0|\xf0\x9d\x9f\xb1|\xf0\x9d\x9f\xb2|\xf0\x9d\x9f\xb3|\xf0\x9d\x9f\xb4|\xf0\x9d\x9f\xb5|\xf0\x9d\x9f\xb6|\xf0\x9d\x9f\xb7|\xf0\x9d\x9f\xb8|\xf0\x9d\x9f\xb9|\xf0\x9d\x9f\xba|\xf0\x9d\x9f\xbb|\xf0\x9d\x9f\xbc|\xf0\x9d\x9f\xbd|\xf0\x9d\x9f\xbe|\xf0\x9d\x9f\xbf){3}\)/
# Letterlike Symbols
body        __JR_BODY_MATH_PHONE2	/(\xf0\x9f\x84\x80|\xf0\x9f\x84\x81|\xf0\x9f\x84\x82|\xf0\x9f\x84\x83|\xf0\x9f\x84\x84|\xf0\x9f\x84\x85|\xf0\x9f\x84\x86|\xf0\x9f\x84\x87|\xf0\x9f\x84\x88|\xf0\x9f\x84\x89|\xf0\x9f\x84\x8a){3}/
# Encased digits
body        __JR_BODY_MATH_PHONE3	/(\xe2\x91\xa0|\xe2\x91\xa1|\xe2\x91\xa2|\xe2\x91\xa3|\xe2\x91\xa4|\xe2\x91\xa5|\xe2\x91\xa6|\xe2\x91\xa7|\xe2\x91\xa8|\xe2\x91\xa9|\xe2\x91\xaa|\xe2\x91\xab|\xe2\x91\xac|\xe2\x91\xad|\xe2\x91\xae|\xe2\x91\xaf|\xe2\x91\xb0|\xe2\x91\xb1|\xe2\x91\xb2|\xe2\x91\xb3\xe2\x91\xb4|\xe2\x91\xb5|\xe2\x91\xb6|\xe2\x91\xb7|\xe2\x91\xb8|\xe2\x91\xb9|\xe2\x91\xba|\xe2\x91\xbb|\xe2\x91\xbc|\xe2\x91\xbd|\xe2\x91\xbe|\xe2\x91\xbf|\xe2\x92\x80|\xe2\x92\x81|\xe2\x92\x82|\xe2\x92\x83|\xe2\x92\x84|\xe2\x92\x85|\xe2\x92\x86|\xe2\x92\x87|\xe2\x92\x88|\xe2\x92\x89|\xe2\x92\x8a|\xe2\x92\x8b|\xe2\x92\x8c|\xe2\x92\x8d|\xe2\x92\x8e|\xe2\x92\x8f|\xe2\x92\x90|\xe2\x92\x91|\xe2\x92\x92|\xe2\x92\x93|\xe2\x92\x94|\xe2\x92\x95|\xe2\x92\x96|\xe2\x92\x97|\xe2\x92\x98|\xe2\x92\x99|\xe2\x92\x9a|\xe2\x92\x9b|\xe2\x93\xaa|\xe2\x93\xab|\xe2\x93\xac|\xe2\x93\xad|\xe2\x93\xae|\xe2\x93\xaf|\xe2\x93\xb0|\xe2\x93\xb1|\xe2\x93\xb2|\xe2\x93\xb3|\xe2\x93\xb4|\xe2\x93\xb5|\xe2\x93\xb6|\xe2\x93\xb7|\xe2\x93\xb8|\xe2\x93\xb9|\xe2\x93\xba|\xe2\x93\xbb|\xe2\x93\xbc|\xe2\x93\xbd|\xe2\x93\xbe|\xe2\x93\xbf){3}/

meta		T_JR_BODY_MATH_PHONE	(__JR_BODY_MATH_PHONE1 || __JR_BODY_MATH_PHONE2 || __JR_BODY_MATH_PHONE3)
describe	T_JR_BODY_MATH_PHONE	Three Unicode digit-like symbols detected in the Email body

#
#######################-BANKING-#########################

####################
### NAVY FEDERAL ###
####################
header  __JR_PHISH_NAVYFED1A	From:name =~ /^(Navy\sFederal|My\sNavy\sFederal|NavyFed|NFCU\.ORG)/i
header  __JR_PHISH_NAVYFED1B	From:addr !~ /.*\@(.*\.)?(navyfederal|mynavyfederal)\.org$/i
header  __JR_PHISH_NAVYFED1C	Reply-To:addr !~ /.*\@(.*\.)?(navyfederal|mynavyfederal)\.org$/i	
meta	JR_PHISH_NAVYFED1		(__JR_PHISH_NAVYFED1A && (__JR_PHISH_NAVYFED1B || (__JR_PHISH_REPLY && __JR_PHISH_NAVYFED1C)))
describe	JR_PHISH_NAVYFED1	Name Spoof/Phish Detected
score	JR_PHISH_NAVYFED1		15.0

#
#######################
### BANK OF AMERICA ###
#######################
header  __JR_PHISH_BOFA1A		From:name =~ /^(Bank\s?Of\s?America|B\s0\sA\sCustomer\sSupport)/i
header  __JR_PHISH_BOFA1B		From:addr !~ /.*\@(.*\.)?(bankofamerica|baml|ml|bofasecurities|bofa)\.com$/i
header  __JR_PHISH_BOFA1C		Reply-To:addr !~ /.*\@(.*\.)?(bankofamerica|baml|ml|bofasecurities|bofa)\.com$/i
header  __JR_PHISH_BOFA1E		Subject =~ /(Bank\sof\sAmerica\sAlert\:\sSign\-in\sto\sOnline\sBanking\sLocked)/
meta	JR_PHISH_BOFA1			(__JR_PHISH_BOFA1A && (__JR_PHISH_BOFA1B || (__JR_PHISH_REPLY && __JR_PHISH_BOFA1C)))
describe	JR_PHISH_BOFA1		Name Spoof/Phish Detected
score	JR_PHISH_BOFA1			15.0
meta	JR_PHISH_BOFA2			(__JR_PHISH_BOFA1E && __JR_PHISH_BOFA1B)
describe	JR_PHISH_BOFA2		Name Spoof/Phish Detected
score   JR_PHISH_BOFA2			15.0

#
#################
### BB&T BANK ###
#################
header  __JR_PHISH_BBT1A		From:name =~ /^((.*\s)?BB\&T\s?)/i
header  __JR_PHISH_BBT1B		From:addr !~ /.*\@(.*\.)?(bbt|bbandt|truist)\.com$/i
header  __JR_PHISH_BBT1C		Reply-To:addr !~ /.*\@(.*\.)?(bbt|bbandt|truist)\.com$/i
meta	JR_PHISH_BBT1			(__JR_PHISH_BBT1A && (__JR_PHISH_BBT1B || (__JR_PHISH_REPLY && __JR_PHISH_BBT1C)))
describe	JR_PHISH_BBT1		Name Spoof/Phish Detected
score	JR_PHISH_BBT1			15.0

#
####################
### REGIONS BANK ###
####################
header  __JR_PHISH_REGIONS1A		From:name =~ /^Regions\sBank(ing)?\s?/i
header  __JR_PHISH_REGIONS1B		From:addr !~ /.*\@(.*\.)?(regions)\.com$/i
header	__JR_PHISH_REGIONS1C		Reply-To:addr !~ /.*\@(.*\.)?(regions)\.com$/i
body	__JR_PHISH_REGIONS1D		/(a\strademark\sof\sRegions\sBank|copy\s201[89]\sRegions\sBank)/
meta	JR_PHISH_REGIONS1			((__JR_PHISH_REGIONS1A || __JR_PHISH_REGIONS1D) && (__JR_PHISH_REGIONS1B || JR_BODY_GREETINGS || (__JR_PHISH_REPLY && __JR_PHISH_REGIONS1C)))
describe	JR_PHISH_REGIONS1		Name Spoof/Phish Detected
score	JR_PHISH_REGIONS1			15.0

#
################
### CITIBANK ###
################
header  __JR_PHISH_CITI1A		From:name =~ /^(.*\s)?(Citibank|Citi|Citigroup|Citicards?|Citibusiness)(\s|\.com|$)/i
header  __JR_PHISH_CITI1B		From:addr !~ /.*\@(.*\.)?(citi|citibank|citigroup|citibusiness)\.(com|com\.au)$/i
header  __JR_PHISH_CITI1C		Reply-To:addr !~ /.*\@(.*\.)?(citi|citibank|citigroup|citibusiness)\.(com|com\.au)$/i
meta	JR_PHISH_CITI1			(__JR_PHISH_CITI1A && (__JR_PHISH_CITI1B || (__JR_PHISH_REPLY && __JR_PHISH_CITI1C)))
describe	JR_PHISH_CITI1		Name Spoof/Phish Detected
score	JR_PHISH_CITI1			15.0

#
###################
### WELLS FARGO ###
###################
header  __JR_PHISH_WELLS1A		From:name =~ /^(.*\s)?(Wells\s?Fargo|Wellsfargo\sBank\sInc)/i
header  __JR_PHISH_WELLS1B		From:addr !~ /.*\@(.*\.)?(wellsfargo|wellsfargoemail|wellsfargomedia|wellsfargodealerservices|wellsfargofunds|wellsfargoadvisors|wellsfargojobs|wf)\.com$/i
header  __JR_PHISH_WELLS1C		Reply-To:addr !~ /.*\@(.*\.)?(wellsfargo|wellsfargoemail|wellsfargomedia|wellsfargodealerservices|wellsfargofunds|wellsfargoadvisors|wellsfargojobs|wf)\.com$/i
# |Wells\sFargo\sBank\,\sN\.A\. removed 1/16/2025
body	__JR_PHISH_WELLS1D		/(This\sis\sa\ssecure\smessage\sfrom\sWellsfargo|WELLS\sFARGO\sACCOUNT\sUPDATE)/
meta	JR_PHISH_WELLS1			((__JR_PHISH_WELLS1A || __JR_PHISH_WELLS1D) && (__JR_PHISH_WELLS1B || (__JR_PHISH_REPLY &&  __JR_PHISH_WELLS1C)))
describe	JR_PHISH_WELLS1		Name Spoof/Phish Detected
score	JR_PHISH_WELLS1			15.0

#
#######################
### HUNTINGTON BANK ###
#######################
header  __JR_PHISH_HUNT1A	From:name =~ /^(.*\s)?(Huntington\sBank)/i
header  __JR_PHISH_HUNT1B	From:addr !~ /.*\@(.*\.)?(huntington\.com|cadencebank\.com|veritexbank\.com|firstmerit\.com|advantagebank\.com|camcofinancial\.com|capstonepartners\.com|capstoneheadwaters\.com)$/i
meta    JR_PHISH_HUNT1		(__JR_PHISH_HUNT1A && __JR_PHISH_HUNT1B)
describe	JR_PHISH_HUNT1	Name Spoof/Phish Detected
score   JR_PHISH_HUNT1      15.0

#
##################
### CHASE BANK ###
##################
header  __JR_PHISH_CHASE1A		From:name =~ /^((.*\s)?Chase\s?(Bank|Online|Fraud)|eChase\.Services\xC2\xAE|Chase\xE2\x9C\x89\sSecured\sMessages|Chase\xE2\x84\xA0\sMessages|JPMorgan[Cc]hase)([\|\s_:]|$|\b)|((?=.*J)(?=.*P)(?=.*M))(?=.*(?=[\s_\-|:.]Fraud[\s_\-|:.](Alert|Online|Prevention|Noti(ce|fication)|(PreventDetect)(ed|ion)?)$))/
# |J\.?P\.?\s?Morgan
header  __JR_PHISH_CHASE1B		From:addr !~ /.*\@(.*\.)?(chase|jpmorganchase|jpmchase|gslbjpmchase|jpmorgan|proxyvote)\.com$/i
header  __JR_PHISH_CHASE1C		Reply-To:addr !~ /.*\@(.*\.)?(chase|jpmorganchase|jpmchase|gslbjpmchase|jpmorgan|proxyvote)\.com$/i
meta	JR_PHISH_CHASE1			(__JR_PHISH_CHASE1A && __JR_PHISH_CHASE1B)
describe	JR_PHISH_CHASE1		Name Spoof/Phish Detected
score	JR_PHISH_CHASE1			15.0
body	JR_PHISH_CHASE3A		/C\s?H\s?A\s?S\s?E\xE2\x84\xA0/
header	JR_PHISH_CHASE3B		Subject:raw =~ /(=?UTF-8?Q?CHASE=E2=84=A0?=\sUrgent\sNotice:)/
meta	JR_PHISH_CHASE3			((JR_PHISH_CHASE3A || JR_PHISH_CHASE3B) && __JR_PHISH_CHASE1B)
describe	JR_PHISH_CHASE3		Name Spoof/Phish Detected
score   JR_PHISH_CHASE3			15.0
meta    JR_PHISH_CHASE4			(T_JR_BODY_MATH_PHONE && (__JR_PHISH_CHASE1A))
describe	JR_PHISH_CHASE4		Name Spoof/Phish Detected
score	JR_PHISH_CHASE4			15.0
# body	__JR_PHISH_CHASE5A		/(20[0-9][0-9]\sJPMorgan\sChase\s\&\sCo\.|information\sabout\syour\sChase\srelationship|\bChase\sMobile\xC2\xAE\sapp\b|\xD0\xA1h\xD0\xB0s\xD0\xB5\xD0\x92\xD0\xB0nk\sID\:|ChaseBank\sID\:)/
# meta	JR_PHISH_CHASE5			(__JR_PHISH_CHASE5A && __JR_PHISH_CHASE1B)
# describe	JR_PHISH_CHASE5		Name Spoof/Phish Detected
# score	JR_PHISH_CHASE5			15.0
# header  __JR_PHISH_CHASE1A		From:name =~ /^((.*\s)?Chase\s?(Bank|Online|Fraud)|eChase\.Services\xC2\xAE|Chase\xE2\x9C\x89\sSecured\sMessages|Chase\xE2\x84\xA0\sMessages|J\.?P\.?\s?Morgan|JPMorganchase)([\|\s_:]|$|\b)/
# ((?=.*J)(?=.*P)(?=.*M)(?=.*[Cc]))\s?\|\s?Fraud[\s\-_.](Alert|Online|Prevention)
# ((?=.*J)(?=.*P)(?=.*M))(?=.*(?=[\s_-|:]Fraud))
# ((?=.*J)(?=.*P)(?=.*M))(?=.*(?=[\s_\-|:.]Fraud[\s_\-|:.](Alert|Online|Prevention)))
# ^((?=.*J)(?=.*P)(?=.*M))(?=.*(?=[\s_\-|:.]Fraud[\s_\-|:.](Alert|Online|Prevention)))
# JPMC|Fraud-Alert <info@111bf15f-bc7-10.com>
# JPMorganchase|Fraud-Online <n.kudryavtseva@plazalotus.com>
# JPMorganchase|Fraud Prevention <noreply@gamblerspick.com>


#
#################
### HSBC BANK ###
#################
header  __JR_PHISH_HSBC1A		From:name =~ /^(.*\s)?HSBC(BANK|\s|$)/i
header  __JR_PHISH_HSBC1B		From:addr !~ /.*\@(.*\.)?(hsbc\.com|hsbc\.ca)$/i
header	__JR_PHISH_HSBC1C		Reply-To:addr !~ /.*\@(.*\.)?(hsbc\.com|hsbc\.ca)$/i
meta	JR_PHISH_HSBC1			(__JR_PHISH_HSBC1A && (__JR_PHISH_HSBC1B || (__JR_PHISH_REPLY &&  __JR_PHISH_HSBC1C)))
describe	JR_PHISH_HSBC1		Name Spoof/Phish Detected
score	JR_PHISH_HSBC1			15.0

#
#############################
# NATIONAL WESTMINSTER BANK #
#############################
header  __JR_PHISH_NATWEST1A	From:name =~ /(NatWest(\s.{2,20})?)$/i
header  __JR_PHISH_NATWEST1B	From:addr !~ /.*\@(.*\.)?(natwest\.com)$/i
meta	JR_PHISH_NATWEST1		(__JR_PHISH_NATWEST1A && __JR_PHISH_NATWEST1B)
describe	JR_PHISH_NATWEST1	Name Spoof/Phish Detected
score	JR_PHISH_NATWEST1		15.0

#
#####################
### REPUBLIC BANK ###
#####################
header  __JR_PHISH_1REPUB1A		From:name =~ /^First\sRepublic\sBank\s?/i
header  __JR_PHISH_1REPUB1B		From:addr !~ /.*\@(.*\.)?(firstrepublic)\.com$/i
header	__JR_PHISH_1REPUB1C		Reply-To:addr !~ /.*\@(.*\.)?(firstrepublic)\.com$/i
meta	JR_PHISH_1REPUB1		(__JR_PHISH_1REPUB1A && (__JR_PHISH_1REPUB1B || (__JR_PHISH_REPLY && __JR_PHISH_1REPUB1C)))
describe	JR_PHISH_1REPUB1	Name Spoof/Phish Detected
score	JR_PHISH_1REPUB1		15.0

#
#####################
### CITIZENS BANK ###
#####################
header  __JR_PHISH_CITIZENS1A	From:name =~ /^Citizens$|^Citizens\sBank|^Citizens\sFinancial\sGroup/i
header  __JR_PHISH_CITIZENS1B	From:addr !~ /.*\@(.*\.)?(citizensbank)\.com$/i
meta    JR_PHISH_CITIZENS1      (__JR_PHISH_CITIZENS1A && __JR_PHISH_CITIZENS1B)
describe	JR_PHISH_CITIZENS1	Name Spoof/Phish Detected
score	JR_PHISH_CITIZENS1		15.0

#
################
### LANDBANK ###
################
header  __JR_PHISH_LANDBANK1A	From:name =~ /(^Landbank\s?|landbank\.com)/i
header  __JR_PHISH_LANDBANK1B	From:addr !~ /.*\@(.*\.)?(landbank\.com|lbpiaccess\.com|ofbank\.com\.ph)$/i
meta	JR_PHISH_LANDBANK1		(__JR_PHISH_LANDBANK1A && __JR_PHISH_LANDBANK1B)
describe	JR_PHISH_LANDBANK1	Name Spoof/Phish Detected
score	JR_PHISH_LANDBANK1		15.0

#
########################
### MIDLAND NATIONAL ###
########################
header  __JR_PHISH_MIDLAND1A	From:name =~ /^Midland\sNational$/i
header  __JR_PHISH_MIDLAND1B	From:addr !~ /.*\@(.*\.)?(midlandnational\.com)$/i
meta	JR_PHISH_MIDLAND1		(__JR_PHISH_MIDLAND1A && __JR_PHISH_MIDLAND1B)
describe	JR_PHISH_MIDLAND1	Name Spoof/Phish Detected
score	JR_PHISH_MIDLAND1		15.0

#
#####################################
### PENTAGON FEDERAL CREDIT UNION ###
#####################################
header  __JR_PHISH_PENFED1A	From:name =~ /(PenFed(\b|$)|Pentagon\sFederal\sCredit\sUnion|PenFed\sCredit\sUnion)/i
header  __JR_PHISH_PENFED1B	From:addr !~ /.*\@(.*\.)?(penfed\.org)$/i
meta	JR_PHISH_PENFED1		(__JR_PHISH_PENFED1A && __JR_PHISH_PENFED1B)
describe	JR_PHISH_PENFED1	Name Spoof/Phish Detected
score	JR_PHISH_PENFED1		15.0

#
############################
### BANKID BANKAXEPT AS  ###
############################
header  __JR_PHISH_BANKAXEPT1A	From:name =~ /(BankID|BankAxept|NYBnkID)/
header  __JR_PHISH_BANKAXEPT1B	From:addr !~ /.*\@(.*\.)?(bankid\.no)$/i
meta	JR_PHISH_BANKAXEPT1		(__JR_PHISH_BANKAXEPT1A && __JR_PHISH_BANKAXEPT1B)
describe	JR_PHISH_BANKAXEPT1	Name Spoof/Phish Detected
score	JR_PHISH_BANKAXEPT1		15.0

#
################
### ING BANK ###
################
header  __JR_PHISH_ING1A	From:name =~ /^ING(\s.*)?$/
header  __JR_PHISH_ING1B	From:addr !~ /.*\@(.*\.)?(ing\.(com|nl|es|fr|ru|be|it|pl|cz|lu|ch|at|de|com\.tr|jobs)|bank\.ing|ingwb\.com)$/i
meta	JR_PHISH_ING1		(__JR_PHISH_ING1A && __JR_PHISH_ING1B)
describe	JR_PHISH_ING1	Name Spoof/Phish Detected
score	JR_PHISH_ING1		15.0

#
###################
### VALLEY BANK ###
###################
header  __JR_PHISH_VALLEY1A		From:name =~ /^(Valley\sBank|Valley\sNational\sBank)/i
header  __JR_PHISH_VALLEY1B		From:addr !~ /.*\@(.*\.)?(valley\.com|qualtrics\-research\.com)$/i
meta	JR_PHISH_VALLEY1		(__JR_PHISH_VALLEY1A && __JR_PHISH_VALLEY1B)
describe	JR_PHISH_VALLEY1	Name Spoof/Phish Detected
score	JR_PHISH_VALLEY1		15.0

#
###################
###  GLOBAL CU  ###
###################
header  __JR_PHISH_GLOBALCU1A		From:name =~ /^(.+\s)?Global\s(Credit\sUnion|CU|Federal\sCredit\sUnion)/i
header  __JR_PHISH_GLOBALCU1B		From:addr !~ /.*\@(.*\.)?(globalcu\.org)$/i
meta	JR_PHISH_GLOBALCU1		(__JR_PHISH_GLOBALCU1A && __JR_PHISH_GLOBALCU1B)
describe	JR_PHISH_GLOBALCU1	Name Spoof/Phish Detected
score	JR_PHISH_GLOBALCU1		15.0

#
###################
### TRUIST BANK ###
###################
header  __JR_PHISH_TRUIST1A		From:name =~ /^Truist(\s.*)?$/i
header  __JR_PHISH_TRUIST1B		From:addr !~ /.*\@(.*\.)?((bbandt|truist|mybrokerageinfo)\.com)$/i
meta	JR_PHISH_TRUIST1		(__JR_PHISH_TRUIST1A && __JR_PHISH_TRUIST1B)
describe	JR_PHISH_TRUIST1	Name Spoof/Phish Detected
score	JR_PHISH_TRUIST1		15.0
meta    JR_PHISH_TRUIST2		(T_JR_BODY_MATH_PHONE && (__JR_PHISH_TRUIST1A))
describe	JR_PHISH_TRUIST2	Name Spoof/Phish Detected
score	JR_PHISH_TRUIST2		15.0

#
########################
### FIFTH THIRD BANK ###
########################
header  __JR_PHISH_53RD1A		From:name =~ /^Fifth\sThird\sBank(\s.*)?$/i
header  __JR_PHISH_53RD1B		From:addr !~ /.*\@(.*\.)?((53|fifththirdbank)\.com)$/i
meta	JR_PHISH_53RD1			(__JR_PHISH_53RD1A && __JR_PHISH_53RD1B)
describe	JR_PHISH_53RD1		Name Spoof/Phish Detected
score	JR_PHISH_53RD1			15.0
meta    JR_PHISH_53RD2			(T_JR_BODY_MATH_PHONE && (__JR_PHISH_53RD1A))
describe	JR_PHISH_53RD2		Name Spoof/Phish Detected
score	JR_PHISH_53RD2			15.0

#
###############
### TF BANK ###
###############
header  __JR_PHISH_TFBANK1A		From:name =~ /TF\s?Bank(\s.*)?$/i
header  __JR_PHISH_TFBANK1B		From:addr !~ /.*\@(.*\.)?tfbank\.(de|se|no|dk|pl|fi|lv|at|es|ee|it|lt)$/i
body	__JR_PHISH_TFBANK1D		/\bTF\s?BANK\sNORGE\s20[0-9]{2}\b/im
meta	JR_PHISH_TFBANK1		((__JR_PHISH_TFBANK1A || __JR_PHISH_TFBANK1D)  && __JR_PHISH_TFBANK1B)
describe	JR_PHISH_TFBANK1	Name Spoof/Phish Detected
score	JR_PHISH_TFBANK1		15.0

#
#######################
### HUNTINGTON BANK ###
#######################
header  __JR_PHISH_HUNTBANK1A	From:name =~ /Huntington[\s_\.\-]?(Bank|National|Alerts|Welcome|Heads\s?Up|State)(\s|$)/i
header  __JR_PHISH_HUNTBANK1B	From:addr !~ /.*\@(.*\.)?(huntington|huntingtonbank\.com)$/i
header  __JR_PHISH_HUNTBANK1C   Subject =~ /Huntington\sDetected\sSuspicious\sAccount\sActivity/
body	__JR_PHISH_HUNTBANK1D	/\b(Huntington\sBancshares\sIncorporated|The\sHuntington\sNational\sBank|Huntington\.Welcome\.\xC2\xAE)\b/im
meta	JR_PHISH_HUNTBANK1		((__JR_PHISH_HUNTBANK1A || __JR_PHISH_HUNTBANK1C || __JR_PHISH_HUNTBANK1D)  && __JR_PHISH_HUNTBANK1B)
describe	JR_PHISH_HUNTBANK1	Name Spoof/Phish Detected
score	JR_PHISH_HUNTBANK1		15.0

#
################################
### SPACE COAST CREDIT UNION ###
################################
header  __JR_PHISH_SCCU1A		From:name =~ /^(Space\sCoast\sCredit\sUnion)/i
header  __JR_PHISH_SCCU1B		From:addr !~ /.*\@(.*\.)?(sccu\.com)$/i
meta	JR_PHISH_SCCU1		(__JR_PHISH_SCCU1A && __JR_PHISH_SCCU1B)
describe	JR_PHISH_SCCU1	Name Spoof/Phish Detected
score	JR_PHISH_SCCU1		15.0

#
#####################################
### WASHINGTON TRUST BANK/COMPANY ###
#####################################
header  __JR_PHISH_WTRUST1A		From:name =~ /^(Washington\sTrust\s?(Bank|Company)?)/i
header  __JR_PHISH_WTRUST1B		From:addr !~ /.*\@(.*\.)?(watrust|washtrust)\.com$/i
meta	JR_PHISH_WTRUST1		(__JR_PHISH_WTRUST1A && __JR_PHISH_WTRUST1B)
describe	JR_PHISH_WTRUST1	Name Spoof/Phish Detected
score	JR_PHISH_WTRUST1		15.0

#
###################### FINANCIAL SERVICES #########################

########################
### AMERICAN EXPRESS ###
########################

header  __JR_PHISH_AMEX1A		From:name =~ /^[\s]{0,6}(Amer[i1]can\s?Express|Amex\s|America\sExpress\.|Departures)/i
header  __JR_PHISH_AMEX1B		From:addr !~ /.*\@(.*\.)?((aexp|americanexpress|aexpfeedback|amexnetwork)\.com|securetrust\.com|transunion\.com|nedbank\.co\.za|departures\.com|amexgiftcard\.com)$/i
header  __JR_PHISH_AMEX1C		Reply-To:addr !~ /.*\@(.*\.)?((aexp|americanexpress|aexpfeedback|amexnetwork)\.com|securetrust\.com|transunion\.com|nedbank\.co\.za|departures\.com|amexgiftcard\.com)$/i
meta	JR_PHISH_AMEX1			(__JR_PHISH_AMEX1A && (__JR_PHISH_AMEX1B || (__JR_PHISH_REPLY && __JR_PHISH_AMEX1C)))
describe	JR_PHISH_AMEX1	Name Spoof/Phish Detected
score	JR_PHISH_AMEX1			15.0

#
############
### USAA ###
############
header  __JR_PHISH_USAA1A		From:name =~ /^USAA(\s|\.[Cc][Oo][Mm]|$)/
header  __JR_PHISH_USAA1B		From:addr !~ /.*\@(.*\.)?usaa\.com$/i
meta	JR_PHISH_USAA1			(__JR_PHISH_USAA1A && __JR_PHISH_USAA1B)
describe	JR_PHISH_USAA1	Name Spoof/Phish Detected
score	JR_PHISH_USAA1			15.0

header  __JR_PHISH_USAA2A		Subject =~ /(FROM\sUSAA\.COM\sONLINE\sBANKING)/
body    __JR_PHISH_USAA2B       /(Your\sUSAA\sBanking\ssecurity\svalidation\sis\sout\sof\sdate)/
meta    JR_PHISH_USAA2			((__JR_PHISH_USAA2A || __JR_PHISH_USAA2B) && __JR_PHISH_USAA1B)
describe	JR_PHISH_USAA2	Name Spoof/Phish Detected
score   JR_PHISH_USAA2			15.0

#
################
### DISCOVER ###
################
header  __JR_PHISH_DISCOVER1A	From:name =~ /^(.*\s)?(Discover\s?Card|Discover$)/i
header  __JR_PHISH_DISCOVER1B	From:addr !~ /.*\@(.*\.)?(discover\.com)$/i
meta    JR_PHISH_DISCOVER1		(__JR_PHISH_DISCOVER1A && __JR_PHISH_DISCOVER1B)
describe	JR_PHISH_DISCOVER1	Name Spoof/Phish Detected
score   JR_PHISH_DISCOVER1      15.0

#
###################
### CAPITAL ONE ###
###################
header  __JR_PHISH_CAPITAL1A		From:name =~ /^Capital[\s\._]One/i
header  __JR_PHISH_CAPITAL1B		From:addr !~ /.*\@(.*\.)?capitalone\.com$/i
meta	JR_PHISH_CAPITAL1			(__JR_PHISH_CAPITAL1A && __JR_PHISH_CAPITAL1B)
describe	JR_PHISH_CAPITAL1	Name Spoof/Phish Detected
score	JR_PHISH_CAPITAL1			15.0

#
#####################
### TD AMERITRADE ###
#####################
header  __JR_PHISH_TDAMER1A		From:name =~ /^(.*\s)?(TD\sAmeritrade)/
header  __JR_PHISH_TDAMER1B		From:addr !~ /.*\@(.*\.)?(tdameritrade|tda4advisors.com|proxyvote)\.com$/i
meta    JR_PHISH_TDAMER1		(__JR_PHISH_TDAMER1A && __JR_PHISH_TDAMER1B)
describe	JR_PHISH_TDAMER1	Name Spoof/Phish Detected
score   JR_PHISH_TDAMER1        15.0

#
################################
### INTERNAL REVENUE SERVICE ###
################################
header  __JR_PHISH_IRS1A		From:name =~ /^(IRS|Internal\sRevenue\sService)(\s|$)/i
header  __JR_PHISH_IRS1B		From:addr !~ /.*\@(.*\.)?(irs\.gov|irs\.com)$/i
header	__JR_PHISH_IRS1C		Reply-To:addr !~ /.*\@(.*\.)?(irs\.gov|irs\.com)$/i
header   __JR_PHISH_IRS1G		From:addr =~ /.*\@(.*\.)?(irs\.gov|irs\.com)$/i
meta	JR_PHISH_IRS1			(__JR_PHISH_IRS1A && (__JR_PHISH_IRS1B || (__JR_PHISH_REPLY && __JR_PHISH_IRS1C)))
describe	JR_PHISH_IRS1		Name Spoof/Phish Detected
score	JR_PHISH_IRS1			15.0
meta    JR_PHISH_IRS2			((__JR_PHISH_IRS1A || __JR_PHISH_IRS1G) && (JR_PHISH_ARCHIVE || JR_PHISH_DOC))
describe	JR_PHISH_IRS2		Name Spoof/Phish Detected
score	JR_PHISH_IRS2		    15.0

#
##############
### STRIPE ###
##############
header  __JR_PHISH_STRIPE1A		From:name =~ /^(Stripe)$/i
header  __JR_PHISH_STRIPE1B		From:addr !~ /.*\@(.*\.)?(stripe\.com)$/i
meta	JR_PHISH_STRIPE1		(__JR_PHISH_STRIPE1A && __JR_PHISH_STRIPE1B)
describe	JR_PHISH_STRIPE1	Name Spoof/Phish Detected
score	JR_PHISH_STRIPE1		15.0
meta    JR_PHISH_STRIPE2		(T_JR_BODY_MATH_PHONE && __JR_PHISH_STRIPE1A)
describe	JR_PHISH_STRIPE2	Name Spoof/Phish Detected
score	JR_PHISH_STRIPE2		15.0

#
##############
### SQUARE ###
##############
header  __JR_PHISH_SQUARE1A		From:name =~ /(^Square[\s_\.\|]?|.*\svia\sSquare)\s?$/i
header  __JR_PHISH_SQUARE1B		From:addr !~ /.*\@(.*\.)?(squareup\.com|square\.com|squareup\.net)$/i
header  __JR_PHISH_SQUARE1C		From:addr =~ /.*\@(.*\.)?(squareup\.com|square\.com|squareup\.net)$/i
meta	JR_PHISH_SQUARE1		(__JR_PHISH_SQUARE1A && __JR_PHISH_SQUARE1B)
describe	JR_PHISH_SQUARE1	Name Spoof/Phish Detected
score	JR_PHISH_SQUARE1		15.0
meta    JR_PHISH_SQUARE2		(T_JR_BODY_MATH_PHONE && (__JR_PHISH_SQUARE1A || __JR_PHISH_SQUARE1C))
describe	JR_PHISH_SQUARE2	Name Spoof/Phish Detected
score	JR_PHISH_SQUARE2		15.0

#
##############
### PAYPAL ###
##############
header  __JR_PHISH_PPAL1A		From:name =~ /(^(PayPal\s?|.*\@paypal\.com)|Via\sPayPal)/i
header  __JR_PHISH_PPAL1B		From:addr !~ /.*\@(.*\.)?(paypal|paypal\-communication|synchrony|synchronybank|synchronyfinancial)\.(com|de|fr|jp|uk|es|mx|it)$/i
header	__JR_PHISH_PPAL1C		Reply-To:addr !~ /.*\@(.*\.)?(paypal|paypal\-communication)\.(com|de|fr|jp|uk|es|mx|it)$/i
header  __JR_PHISH_PPAL1G		From:addr =~ /.*\@(.*\.)?(paypal|paypal\-communication|synchrony|synchronybank|synchronyfinancial)\.(com|de|fr|jp|uk|es|mx|it)$/i
meta	JR_PHISH_PPAL1			(__JR_PHISH_PPAL1A && __JR_PHISH_PPAL1B)
describe	JR_PHISH_PPAL1	    PayPal Spoof/Phish Detected: From Name suggests PayPal but Address does not
score	JR_PHISH_PPAL1			15.0
header  __JR_PHISH_SUBJ__PPAL1	Subject =~ /^(Warning.*\sYour\sPayPal\saccount\sis\slimited|Notice.*\sYour\sAccount\sPayPal\sHas\sBeen\sLimited|Receipt\sfor\syour\sPayPal\spayment\sto|Receipt\sfor\syour\sPayPal\spayment|CONFIRM\sYOUR\sPAYPAL\sBANK\sACCOUNT|PayPal\sSecurity\sQuestion\sand\sAnswer\sChange|Paypal\sSecurity\sBreach).*/i
meta	JR_PHISH_PPAL2			(__JR_PHISH_SUBJ__PPAL1 && (__JR_PHISH_PPAL1B || (__JR_PHISH_REPLY && __JR_PHISH_PPAL1C)))
describe	JR_PHISH_PPAL2	    PayPal Spoof/Phish Detected: Subject indicates PayPal but Address does not
score	JR_PHISH_PPAL2			15.0
body	__JR_PHISH_PPAL3A		/(go\sto\sthe\sPayPal\swebsite|We\snoticed\sunusual\sactivity\sin\syour\sPayPal\saccount\.|You\sreceived\sthis\se\-mail\sas\sa\smember\sof\spaypal\.|PayPal\sSupport\sAll\srights\sare\sreserved|Copyright\s1999\-2019\sPayPal|This\sis\sthe\sLast\sreminder\sto\slog\sin\sto\sPayPal|PayPal\ssecure|imposed\stemporary\slimits\son\scertain\sfeatures\son\syour\sPayPal\saccount|Copyright\s\xC2\xA9\s1999\-2021\sPayPal\.\sCopyright\sis\sprotected\sby\slaw\.|detected\sa\stransaction\son\syour\sPayPal\saccount\sfor\sthe\spurchase\sof\sa\sBitcoin|we\shave\stemporarily\ssuspended\syour\sPayPal\saccount)/m
tflags	__JR_PHISH_PPAL3A		nosubject
header  __JR_PHISH_PPAL3B		Subject =~ /(Your\saccount\sPayPal\swill\sbe\slimited|Unusual\sActivity\sOn\sYour\sPaypal\sAccount|K\xC3\xBCrzlich\shaben\swir\sIhr\sKonto\svor\xC3\xBCbergehend\seingeschr\xC3\xA4nkt)/i
meta    JR_META_PPAL4			((__JR_PHISH_PPAL1A || __JR_PHISH_PPAL1G) && JR_PHISH_DOC)
describe	JR_META_PPAL4		Name Spoof/Phish Detected
score	JR_META_PPAL4			15.0
header  __JR_PHISH_PPAL5A       ALL:raw !~ /Received:\sfrom\s(.*\.)?(paypal\.com|epsl1\.com|synchrony\.com|synchronybank\.com|synchronyfinancial\.com|zetaglobal\.net)\s/m
meta    JR_PHISH_PPAL5          ((__JR_PHISH_PPAL1A || __JR_PHISH_PPAL1G) && __JR_PHISH_PPAL5A)
describe	JR_PHISH_PPAL5	    PayPal Spoof/Phish Detected: No PayPal Received header
score   JR_PHISH_PPAL5          15.0 
meta	JR_PHISH_PPAL6			((__JR_PHISH_PPAL3A || __JR_PHISH_PPAL3B) && __JR_PHISH_PPAL1B)
describe	JR_PHISH_PPAL6	    PayPal Spoof/Phish Detected: Nob-PayPal Domain w/ PayPal message descriptors
score   JR_PHISH_PPAL6			2.5
header	__JR_PHISH_XORIG		exists:X-OriginatorOrg
header  __JR_PHISH_PP_TOCC		ToCc:addr =~ /.*\@(.*\.)?onmicrosoft\.com$/i
meta	JR_PHISH_PPAL7			((__JR_PHISH_PPAL1A || __JR_PHISH_PPAL1G) && (__JR_PHISH_XORIG || __JR_PHISH_MPROD_OLK || __JR_PHISH_PP_TOCC))
describe	JR_PHISH_PPAL7	    PayPal Spoof/Phish Detected: Bogus Microsoft headers
score   JR_PHISH_PPAL7			15.0
meta    JR_PHISH_PPAL8			((T_JR_SUBJ_PHONE || T_JR_FROM_PHONE || T_JR_REPLY_PHONE) && (__JR_PHISH_PPAL1A || __JR_PHISH_PPAL1G))
describe	JR_PHISH_PPAL8		PayPal Spoof/Phish Detected: MATH DIGITS in Email Address fields
score	JR_PHISH_PPAL8			15.0
meta    JR_PHISH_PPAL9			(T_JR_BODY_MATH_PHONE && (__JR_PHISH_PPAL1A || __JR_PHISH_PPAL1G))
describe	JR_PHISH_PPAL9		PayPal Spoof/Phish Detected: MATH DIGITS in Email Body
score	JR_PHISH_PPAL9			15.0

# PayPal valid phone numbers:
# Support: 1-888-221-1161
# International: 1-402-935-2050
# Espanol: 1-888-914-8072

#
#############
### ZELLE ###
#############
header  __JR_PHISH_ZELLE1A		From:name =~ /^(\s?Zelle(\b.*)?)$/i
header  __JR_PHISH_ZELLE1B		From:addr !~ /.*\@(.*\.)?(zellepay\.com)$/i
header  __JR_PHISH_ZELLE1C		From:addr =~ /.*\@(.*\.)?(zellepay\.com)$/i
meta	JR_PHISH_ZELLE1			(__JR_PHISH_ZELLE1A && __JR_PHISH_ZELLE1B)
describe	JR_PHISH_ZELLE1	Name Spoof/Phish Detected
score	JR_PHISH_ZELLE1			15.0
meta	JR_PHISH_ZELLE2			((__JR_PHISH_ZELLE1A || __JR_PHISH_ZELLE1C)  && __JR_PHISH_MPROD_OLK)
describe	JR_PHISH_ZELLE2	Name Spoof/Phish Detected: Outlook Header Failover
score	JR_PHISH_ZELLE2			15.0

#
#############
### SUMUP ###
#############
header  __JR_PHISH_SUMUP1A		From:name =~ /^(\s?SumUp[\-_\s]Limited)(\b|$)/i
header  __JR_PHISH_SUMUP1B		From:addr !~ /.*\@(.*\.)?(sumup\.com|sumup\.net)$/i
body	__JR_PHISH_SUMUP1C		/(The\sSumUp\sTeam|SumUp\sLimited\sis\san\selectronic\smoney\sinstitution|important\supdate\sregarding\syour\sSumUp\saccount|trust SumUp\sfor\syour\spayment\sprocessing\sneeds)/
meta	JR_PHISH_SUMUP1			((__JR_PHISH_SUMUP1A || __JR_PHISH_SUMUP1C) && __JR_PHISH_SUMUP1B)
describe	JR_PHISH_SUMUP1	Name Spoof/Phish Detected
score	JR_PHISH_SUMUP1			15.0

#
################
### METAMASK ###
################
header  __JR_PHISH_MMASK1A		From:name =~ /^(MetaMask(\s.*)?)$/i
Header	__JR_PHISH_MMASK2A		From:raw =~ /=?UTF-8?B?TdC1dGFN0LBzaw==?=/
header  __JR_PHISH_MMASK3A		Reply-To:addr =~ /metamask\@/i
header  __JR_PHISH_MMASK1B		From:addr !~ /.*\@(.*\.)?(metamask\.io|metamask\-portfolio\.zendesk\.com|metamask\.discoursemail\.com|consensys\.zendesk\.com)$/i
body	__JR_PHISH_MMASK1C		/(^|\b|\s)(?:\xC2\xA9\s2024\sM\xD0\xB5taM\xD0\xB0sk|\xC2\xA9\s2024\sMetaMask)(\W|$)/m
meta	JR_PHISH_MMASK1			((__JR_PHISH_MMASK1A || __JR_PHISH_MMASK2A || __JR_PHISH_MMASK3A || __JR_PHISH_MMASK1C) && __JR_PHISH_MMASK1B)
describe	JR_PHISH_MMASK1		Name Spoof/Phish Detected
score	JR_PHISH_MMASK1			15.0

#
################
### COINBASE ###
################
header  __JR_PHISH_CBASE1A		From:name =~ /^(Coinbase(\s.*)?)$/i
header  __JR_PHISH_CBASE1B		From:addr !~ /.*\@(.*\.)?(coinbase\.com)$/i
meta	JR_PHISH_CBASE1			(__JR_PHISH_CBASE1A && __JR_PHISH_CBASE1B)
describe	JR_PHISH_CBASE1	Name Spoof/Phish Detected
score	JR_PHISH_CBASE1			15.0

#
###############
### BINANCE ###
###############
header  __JR_PHISH_BINANCE1A		From:name =~ /^(Binance(\s.*)?)$/i
header  __JR_PHISH_BINANCE1B		From:addr !~ /.*\@(.*\.)?(binance\.com)$/i
meta	JR_PHISH_BINANCE1			(__JR_PHISH_BINANCE1A && __JR_PHISH_BINANCE1B)
describe	JR_PHISH_BINANCE1	Name Spoof/Phish Detected
score	JR_PHISH_BINANCE1			15.0

#
##################
### NERDWALLET ###
##################
header  __JR_PHISH_NWALLET1A		From:name =~ /^(Nerd[\s_\-\.]?Wallet(\s.*)?)$/i
header  __JR_PHISH_NWALLET1B		From:addr !~ /.*\@(.*\.)?(nerdwallet\.com)$/i
meta	JR_PHISH_NWALLET1			(__JR_PHISH_NWALLET1A && __JR_PHISH_NWALLET1B)
describe	JR_PHISH_NWALLET1	Name Spoof/Phish Detected
score	JR_PHISH_NWALLET1			15.0

#
#################
### ETHERSCAN ###
#################
body  __JR_PHISH_ETHER1A		/\xC2\xA9\s202[0-9]\sEtherscan|Support\sEtherscan/
header  __JR_PHISH_ETHER1B		From:addr !~ /.*\@(.*\.)?(etherscan\.com|etherscan\.io)$/i
meta	JR_PHISH_ETHER1			(__JR_PHISH_ETHER1A && __JR_PHISH_ETHER1B)
describe	JR_PHISH_ETHER1	Name Spoof/Phish Detected
score	JR_PHISH_ETHER1			15.0

#
###############
### OPENSEA ###
###############
header	__JR_PHISH_OPENSEA1A	From:name =~ /^(OpenSea(\s.*)?)$/i 
header	__JR_PHISH_OPENSEA1B	From:addr !~ /.*\@(.*\.)?(opensea\.io)$/i
header	__JR_PHISH_OPENSEA1C    Subject =~ /OpenSea\saccount\shas\sbeen\stemporarily\sdisabled/i
meta	JR_PHISH_OPENSEA1		((__JR_PHISH_OPENSEA1A || __JR_PHISH_OPENSEA1C) && __JR_PHISH_OPENSEA1B)
describe	JR_PHISH_OPENSEA1	Name Spoof/Phish Detected
score	JR_PHISH_OPENSEA1		15.0
meta    JR_PHISH_OPENSEA2			(T_JR_BODY_MATH_PHONE && __JR_PHISH_OPENSEA1A)
describe	JR_PHISH_OPENSEA2		PayPal Spoof/Phish Detected: MATH DIGITS in Email Body
score	JR_PHISH_OPENSEA2			15.0

#
#####################
### WESTERN UNION ###
#####################
header  __JR_PHISH_WUNION1A		From:name =~ /^Western[\s_\-]Union(\s|$)/i
header  __JR_PHISH_WUNION1B		From:addr !~ /.*\@(.*\.)?(westernunion\.com)$/i
body	__JR_PHISH_WUNION1C		/(Western\sUnion\sHoldings\,\sInc\.|Thank\syou\sfor\susing\sWestern\sUnion)/
meta	JR_PHISH_WUNION1		((__JR_PHISH_WUNION1A || __JR_PHISH_WUNION1C) && __JR_PHISH_WUNION1B)
describe	JR_PHISH_WUNION1	Name Spoof/Phish Detected
score	JR_PHISH_WUNION1		15.0

#
#####################
### VANGUARD GROUP ##
#####################
header  __JR_PHISH_VGUARD1A		From:name =~ /^Vanguard$/i
header  __JR_PHISH_VGUARD1B		From:addr !~ /.*\@(.*\.)?(vanguard\.com)$/i
meta	JR_PHISH_VGUARD1		(__JR_PHISH_VGUARD1A && __JR_PHISH_VGUARD1B)
describe	JR_PHISH_VGUARD1	Name Spoof/Phish Detected
score	JR_PHISH_VGUARD1		15.0

#
#####################
### CHARLES SCHWAB ##
#####################
header  __JR_PHISH_SCHWAB1A		From:name =~ /(^Schwab\s[A-z]{3,15}|Charles\sSchwab|Schwab\s\&\sCo)/i
header  __JR_PHISH_SCHWAB1B		From:addr !~ /.*\@(.*\.)?(schwab\.com|proxyvote\.com)$/i
meta	JR_PHISH_SCHWAB1		(__JR_PHISH_SCHWAB1A && __JR_PHISH_SCHWAB1B)
describe	JR_PHISH_SCHWAB1	Name Spoof/Phish Detected
score	JR_PHISH_SCHWAB1		15.0

#
########################### SHIPPING ###########################

#######################
### MAERSK SHIPPING ###
#######################
header  __JR_PHISH_MAERSK1A		From:name =~ /^Maersk(line)?(\s|$)/i
header  __JR_PHISH_MAERSK1B		From:addr !~ /.*\@(.*\.)?(maersk|maerskline)\.com$/i
header	__JR_PHISH_MAERSK1C		Reply-To:addr !~ /.*\@(.*\.)?(maersk|maerskline)\.com$/i
header  __JR_PHISH_MAERSK1D		From:addr =~ /.*\@(.*\.)?(maersk|maerskline)\.com$/i
meta	JR_PHISH_MAERSK1		(__JR_PHISH_MAERSK1A && (__JR_PHISH_MAERSK1B || (__JR_PHISH_REPLY && __JR_PHISH_MAERSK1C)))
describe	JR_PHISH_MAERSK1	Name Spoof/Phish Detected
score	JR_PHISH_MAERSK1		15.0
meta    JR_PHISH_MAERSK2		((__JR_PHISH_MAERSK1A || __JR_PHISH_MAERSK1D) && JR_PHISH_ARCHIVE)
describe	JR_PHISH_MAERSK2	Name Spoof/Phish Detected
score	JR_PHISH_MAERSK2    	15.0

#
####################
### DHL SHIPPING ###
####################
header	__JR_PHISH_DHL_1B		Reply-To:addr !~ /.*\@(.*\.)?((dhl|dhlexpress|dhl\-usa)\.com|dhlparcel\.co\.uk)$/i
header  __JR_PHISH_DHL_1C		From:name =~ /^(My(\s|\.))?DHL([\s\-_]?Express)?(\s|$)/i
header  __JR_PHISH_DHL_1D       From:addr !~ /.*\@(.*\.)?(dhl|dhlexpress|dhl\-usa)\.com$/i
header  __JR_PHISH_DHL_1G       From:addr =~ /.*\@(.*\.)?((dhl|dhlexpress|dhl\-usa)\.com|dhlparcel\.co\.uk)$/i
header  __JR_PHISH_DHL_1H		Subject =~ /DHL\sBILL\sOF\sLADING\sSHIPPING|DHL\sDELIVERY\sNOTICE|\{Dhl\sCustomer\}/i
body	__JR_PHISH_DHL_1L		/Support\@dhl\.com|This\smessage\sis\sfrom\sDHL\sand\smay|DHL\sEXPRESS\s\-Excellence\.\sSimply\sdelivered|Powered\sby\sDHL\sExpress|A\sPackage\sis\scoming\syour\sway\sthrough\sDHL\sExpress\,|names\sthat\sshow\sup\sin\sconnection\swith\sDHL\'s\sservices|DHL\sCOURIER\sCOMPANY|DHL\sCOURIER\sAND\sLOGISTICS|DHL\sGlobal\sTeam\.|DHL\s2020\.\sDHL\sExpress\,\sDHL\sBrandmark|DHL\sExpress\sTeam|from\sdhl\sdelivery\scompany|20(19|20)\sDHL\sExpress\sCustomer\sService|Powered\sby\sDHL\sExpress|DHL\sInternational\sGmbH|DHL\sExpress\s\-\sExcellence\.\sSimply\sdelivered\.|DHL\sGlobal\s\\xC2\xA9\s2020\s\|\sAll\srights\sreserved\.|thank\syou\sfor\saccepting\sthe\sservices\sof\sDHL\sExpress|Your\spackage\sarrived\sat\sthe\sHead\soffice\sand\sis\swaiting|GOGREEN\s\xE2\x80\x93\sEnvironmental\sProtection\swith\sDHL|DHL\sLast\snote\:\sThis\semail\sinforms\syou\sthat\syour\sshipment\sis\sstill\swaiting\sto\sbe\sprocessed\.|Pending\sDHL\sShipment\sNotification/
tflags	__JR_PHISH_DHL_1L		nosubject
meta	JR_PHISH_DHL1			(__JR_PHISH_DHL_1C && (__JR_PHISH_DHL_1D || (__JR_PHISH_REPLY && __JR_PHISH_DHL_1B)))
describe	JR_PHISH_DHL1	Name Spoof/Phish Detected
score	JR_PHISH_DHL1			15.0

meta    JR_PHISH_DHL2			((__JR_PHISH_DHL_1C || __JR_PHISH_DHL_1G) && (JR_PHISH_ARCHIVE))
describe	JR_PHISH_DHL2	Name Spoof/Phish Detected
score	JR_PHISH_DHL2		    15.0

meta	JR_PHISH_DHL3			((__JR_PHISH_DHL_1H || __JR_PHISH_DHL_1L) && __JR_PHISH_DHL_1D)
describe	JR_PHISH_DHL3	Name Spoof/Phish Detected
score   JR_PHISH_DHL3			15.0

#
###########
### UPS ###
###########
header	__JR_PHISH_UPS_1B		Reply-To:addr !~ /.*\@(.*\.)?(ups|i\-parcel)\.com$/i
header  __JR_PHISH_UPS_1C		From:name =~ /^(UPS|U\-P\-S)(\s|$)/
header  __JR_PHISH_UPS_1D       From:addr !~ /.*\@(.*\.)?(ups|i\-parcel)\.com$/i
header  __JR_PHISH_UPS_1G       From:addr =~ /.*\@(.*\.)?(ups|i\-parcel)\.com$/i
header  __JR_PHISH_UPS_1H		Subject =~ /^(UPS\s(Delivery|Ship|Tracking)\s(Exception|Notice|Notification|Number)|WELCOME\sTO\sUNITED\sPARCEL\sSERVICE|You\shave\sa\sUPS\sparcel)/
body	__JR_PHISH_UPS_1L		/(trademarks\sof\sUnited\sParcel\sService\sof\sAmerica|20[0-9]{2}\sUnited\sParcel\sService\sof\sAmerica\,\sInc\.|the\srequest\sof\sUPS\sShip\sNotification|20[0-9]{2}\sUPS\sCorporation|Copyright\s20[0-9]{2}\sUPS\.|This\sis\sa\snotification\sregarding\syour\sUPS\saccount\.|CONTACT\sUNITED\sPARCELS\sSERVICES|Due\sto\sOngoing\speriodic\supdate\son\sall\sUPS\saccount)/m
meta	JR_PHISH_UPS1			((__JR_PHISH_UPS_1L || __JR_PHISH_UPS_1C) && __JR_PHISH_UPS_1D)
describe	JR_PHISH_UPS1	Name Spoof/Phish Detected
score   JR_PHISH_UPS1			2.5

meta    JR_PHISH_UPS2           (__JR_PHISH_UPS_1G && (__JR_PHISH_REPLY && __JR_PHISH_UPS_1B))
describe	JR_PHISH_UPS2	Name Spoof/Phish Detected
score   JR_PHISH_UPS2           15.0

meta	JR_PHISH_UPS3			(__JR_PHISH_UPS_1H && __JR_PHISH_UPS_1D)
describe	JR_PHISH_UPS3	Name Spoof/Phish Detected
score   JR_PHISH_UPS3			15.5

#
####################
### TNT SHIPPING ###
####################
header	__JR_PHISH_TNT_1B		Reply-To:addr !~ /.*\@(.*\.)?tnt\.com$/i
header  __JR_PHISH_TNT_1C		From:name =~ /^TNT(\s?E[Xx][Pp][Rr][Ee][Ss][Ss]|\s|$)/
header  __JR_PHISH_TNT_1D       From:addr !~ /.*\@(.*\.)?tnt\.com$/i
header  __JR_PHISH_TNT_1G       From:addr =~ /.*\@(.*\.)?tnt\.com$/i
meta	JR_PHISH_TNT1			(__JR_PHISH_TNT_1C && (__JR_PHISH_TNT_1D || (__JR_PHISH_REPLY && __JR_PHISH_TNT_1B)))
describe	JR_PHISH_TNT1		Name Spoof/Phish Detected
score	JR_PHISH_TNT1			15.0
meta    JR_PHISH_TNT2			((__JR_PHISH_TNT_1C || __JR_PHISH__TNT_1G) && JR_PHISH_ARCHIVE)
describe	JR_PHISH_TNT2	Name Spoof/Phish Detected
score	JR_PHISH_TNT2		    15.0

#
########################
### FASTWAY COURIERS ###
########################
header  __JR_PHISH_FASTWAY1A	From:name =~ /^(Fastway\sCouriers|fastway\.co\.za)$/i
header  __JR_PHISH_FASTWAY1B	From:addr !~ /.*\@(.*\.)?fastway\.co\.za$/i
meta	JR_PHISH_FASTWAY1		(__JR_PHISH_FASTWAY1A && (__JR_PHISH_FASTWAY1B))
describe	JR_PHISH_FASTWAY1	Name Spoof/Phish Detected
score	JR_PHISH_FASTWAY1		15.0

#
#######################
### FEDERAL EXPRESS ###
#######################
# |FedEx\s?(Freight|Service|Express|Ground)|fedex\.com
header	__JR_PHISH_FEDEX_1B		Reply-To:addr !~ /.*\@(.*\.)?((fedex|federalexpress|fedex\-usa|fedexfreight|fedexservices?|fedexground|fedexexpress|fedextracking)\.com|fedex\.ca)$/i
header  __JR_PHISH_FEDEX_1C		From:name =~ /^(FEDEX$|Fedex\s|Federal\s?Express|einvoice_fedex)/i
header  __JR_PHISH_FEDEX_1D		From:addr !~ /.*\@(.*\.)?((fedex|federalexpress|fedex\-usa|fedexfreight|fedexservices?|fedexground|fedexexpress|fedextracking)\.com|fedex.ca)$/i
header  __JR_PHISH_FEDEX_1G		From:addr =~ /.*\@(.*\.)?((fedex|federalexpress|fedex\-usa|fedexfreight|fedexservices?|fedexground|fedexexpress|fedextracking)\.com|fedex.ca)$/i
body	__JR_PHISH_FEDEX_1H		/(FedEx\sRedstar\snewsletter|Support\sTeam\s-\sFed\sEx|package\shas\sbeen\sreturned\sto\sthe\sFedEx\soffice)/
header  __JR_PHISH_FEDEX_1J		Subject =~ /^(FedEx:\sNot\spossible\sto\smake\sdelivery)/
# FedEx Name Field Variants
header  __JR_PHISH_FEDEX_1K		From:name =~ /(\(FedEx\))/i
meta	JR_PHISH_FEDEX1			((__JR_PHISH_FEDEX_1C || __JR_PHISH_FEDEX_1H) && (__JR_PHISH_FEDEX_1D || (__JR_PHISH_REPLY && __JR_PHISH_FEDEX_1B)))
describe	JR_PHISH_FEDEX1	Name Spoof/Phish Detected
score	JR_PHISH_FEDEX1			15.0

meta    JR_PHISH_FEDEX2			((__JR_PHISH_FEDEX_1C || __JR_PHISH_FEDEX_1G) && (JR_PHISH_ARCHIVE))
describe	JR_PHISH_FEDEX2	Name Spoof/Phish Detected
score	JR_PHISH_FEDEX2		    15.0

meta    JR_PHISH_FEDEX3         (__JR_PHISH_FEDEX_1J && __JR_PHISH_FEDEX_1D)
describe	JR_PHISH_FEDEX3	Name Spoof/Phish Detected
score   JR_PHISH_FEDEX3         15.0

meta    JR_PHISH_FEDEX4         (__JR_PHISH_FEDEX_1K && __JR_PHISH_FEDEX_1D)
describe	JR_PHISH_FEDEX4	Name Spoof/Phish Detected
score   JR_PHISH_FEDEX4         15.0

#
##################
### SAUDI POST ###
##################
header  __JR_PHISH_SAUDIPOST1A	From:name =~ /Saudi\sPost$/
header  __JR_PHISH_SAUDIPOST1B	From:addr !~ /.*\@(.*\.)?(sp|splonline)\.com\.sa$/i
header	__JR_PHISH_SAUDIPOST1C	Reply-To:addr !~ /.*\@(.*\.)?(sp|splonline)\.com\.sa$/i
meta	JR_PHISH_SAUDIPOST1		(__JR_PHISH_SAUDIPOST1A && (__JR_PHISH_SAUDIPOST1B || (__JR_PHISH_REPLY &&  __JR_PHISH_SAUDIPOST1C)))
describe	JR_PHISH_SAUDIPOST1	Name Spoof/Phish Detected
score	JR_PHISH_SAUDIPOST1		15.0

#
############################## FILE SERVICES #############################

###############
### DROPBOX ###
###############
header  __JR_PHISH_DBOX1A		From:name =~ /^DROPBOX(\s|\.com|$)/i
header  __JR_PHISH_DBOX1B		From:addr !~ /.*\@(.*\.)?((dropbox|dropboxmail)\.com|dropbox\.co\.uk)$/i
header	__JR_PHISH_DBOX1C		Reply-To:addr !~ /.*\@(.*\.)?(dropbox)\.com$/i
meta	JR_PHISH_DBOX1			(__JR_PHISH_DBOX1A && (__JR_PHISH_DBOX1B || (__JR_PHISH_REPLY && __JR_PHISH_DBOX1C)))
describe	JR_PHISH_DBOX1	Name Spoof/Phish Detected
score	JR_PHISH_DBOX1			15.0

#
###################
### WETRANSFTER ###
###################
header  __JR_PHISH_WETX1A		From:name =~ /\bWeTransfer\b/i
header  __JR_PHISH_WETX1B		From:addr !~ /.*\@(.*\.)?wetransfer\.(net|com)$/i
header  __JR_PHISH_WETX1C		Subject:raw =~ /=E2=9D=B6=E2=9C=89\sYou\s+have\s+received\s+a\s+file\s+via\s+WeTransfer/
body    __JR_PHISH_WETX2A       /(Download\s[0-9]{1,2}\sfiles\ssent\sto\syou\svia\sWeTransfer)/
meta	JR_PHISH_WETX1			(__JR_PHISH_WETX1A && (__JR_PHISH_WETX1B))
describe	JR_PHISH_WETX1	Name Spoof/Phish Detected
score   JR_PHISH_WETX1			15.0

meta	JR_PHISH_WETX2			(__JR_PHISH_WETX2A && __JR_PHISH_WETX1B)
describe	JR_PHISH_WETX2	Name Spoof/Phish Detected
score   JR_PHISH_WETX2			15.0

meta    JR_PHISH_WETX3			(__JR_PHISH_WETX1C && (__JR_PHISH_WETX1B))
describe	JR_PHISH_WETX3	Name Spoof/Phish Detected
score   JR_PHISH_WETX3			15.0

#
############################################# COMPANIES #############################################

#############
### APPLE ###
#############
header  __JR_PHISH_APPLE1A		From:name =~ /^(AppleID|iCloud|Apple|Apple\sInc\.|i\-?Tunes)$/i
header  __JR_PHISH_APPLE1B		From:addr !~ /.*\@(.*\.)?(apple|me|mac|itunes|icloud)\.com$/i
header  __JR_PHISH_APPLE1C		Subject =~ /(Your Account Has Been Blocked|Account Notification \- ID: \#\d{7,8}|Update\syour\sApple\sAccount\sInformation)/i
meta    JR_PHISH_APPLE1			(__JR_PHISH_APPLE1A && __JR_PHISH_APPLE1B)
describe	JR_PHISH_APPLE1	Name Spoof/Phish Detected
score   JR_PHISH_APPLE1			10.0

body	__JR_PHISH_APPLE2A		/(Your\sApple\sID\swas\sreviewed|Copyright\s\xC2\xA9\s2019\sApple\sInc\.\sAll\srights\sreserved\.|Copyright\s2019\sAppleID\,\sInc\.|Your\sApple\sID\sAccount\swas\sused\sto\ssign\sin|problem\sin\sthe\siTunes\sAccount)/
meta	JR_PHISH_APPLE2			(__JR_PHISH_APPLE2A && __JR_PHISH_APPLE1B)
describe	JR_PHISH_APPLE2	Name Spoof/Phish Detected
score   JR_PHISH_APPLE2			10.0

meta    JR_PHISH_APPLE3			(__JR_PHISH_APPLE1C && __JR_PHISH_APPLE1B)
describe	JR_PHISH_APPLE3	Name Spoof/Phish Detected
score   JR_PHISH_APPLE3			10.0

#
##############
### AMAZON ###
##############
header  __JR_PHISH_AMAZON1A		From:name =~ /^Amazon(\s|\.com|$)/i
header  __JR_PHISH_AMAZON1A1	From:name =~ /^Prime$/i
header  __JR_PHISH_AMAZON1B		From:addr !~ /.*\@(.*\.)?((amazon|chase|amazon(music|books|tv|prime))\.com|amazon\.jobs|amazonbusiness\.com|primevideo\.com|amazon\.(co\.jp|co\.uk|uk|de))$/i
header	__JR_PHISH_AMAZON1C		Reply-To:addr !~ /.*\@(.*\.)?((amazon|chase|amazon(music|books|tv|prime))\.com|amazon\.jobs|amazonbusiness\.com|primevideo\.com|amazon\.(co\.jp|co\.uk|uk|de))$/i
header  __JR_PHISH_AMAZON1G		From:addr =~ /.*\@(.*\.)?((amazon|chase|amazon(music|books|tv|prime))\.com|amazon\.jobs|amazonbusiness\.com|primevideo\.com|amazon\.(co\.jp|co\.uk|uk|de))$/i
# body	__JR_PHISH_AMAZON1D		/(he\sAmazon\.com\slogo\sand\s1\-Click\sare\sregistered\strademarks|Amazon\.com\sServices\,\sInc\.\sor\sAmazon\sDigital\sServices\sLLC\.|you\sagree\sto\sAmazon\.com\xE2\x80\x99|items\ssold\sby\sAmazon\.com\sLLC|Amazon\.com\sPrimecard|Your\sAmazon\.com\scan\sbe\saccessed|Dear\sPrime\sUser\,)/
meta	JR_PHISH_AMAZON1		((__JR_PHISH_AMAZON1A) && (__JR_PHISH_AMAZON1B || (__JR_PHISH_REPLY && __JR_PHISH_AMAZON1C)))
describe	JR_PHISH_AMAZON1	Name Spoof/Phish Detected
score	JR_PHISH_AMAZON1		15.0

header  __JR_PHISH_AMAZON2A		From:name =~ /(Amazon[\s\.\-_](Reward|Member|Prime|Customer|Giveaway|Loyalty)|From[\s\.\-_]Amazon(\s|$)|Unlock[\s\.\-_]Amazon|Am\xCE\xB1zo\xC9\xB4\sPri\xE2\x85\xBF\xC3\xAB)/i
header  __JR_PHISH_AMAZON2B		Subject =~ /(pre\-?loaded\sAmazon\scard|your\sAmazon\sgift\scard|your\sAmazon\sbonus|Amazon\sperks|yours\son\sAmazon|unlock\syour\sAmazon\scard|Amazon\scard\sis\sunlock|your\sAmazon\scard\sperks|Your\sAmazon\scard\sactivation\snotice|your\scard\sby\smidnight\s\-\sAmazon|Your\sPrime\smembership\sis\sRenewing)/i
meta    JR_PHISH_AMAZON2		((__JR_PHISH_AMAZON2A || __JR_PHISH_AMAZON2B) && __JR_PHISH_AMAZON1B)
describe	JR_PHISH_AMAZON2	Name Spoof/Phish Detected
score   JR_PHISH_AMAZON2		10.0

header  __JR_PHISH_MSOFT		Received =~ /\b(outlook\.com|onmicrosoft\.com)\b/i
meta    JR_PHISH_AMAZON3		(__JR_PHISH_MSOFT && (__JR_PHISH_AMAZON1A || __JR_PHISH_AMAZON1A1))
describe	JR_PHISH_AMAZON3	Name Spoof/Phish Detected
score   JR_PHISH_AMAZON3        10.0

header  JR_PHISH_AMAZON4		From:name =~ /Am\xF3\xA0\x84\x82\xF3\xA0\x84\x82az\xF3\xA0\x84\x82on\xF3\xA0\x84\x82\xF3\xA0\x84\x82\sPr\xF3\xA0\x84\x82i\xF3\xA0\x84\x82m\xF3\xA0\x84\x82\xF3\xA0\x84\x82\xCD\x8Fe/
describe	JR_PHISH_AMAZON4	Name Spoof/Phish Detected
score   JR_PHISH_AMAZON4		15.0

meta     JR_PHISH_AMAZON5       (T_JR_BODY_MATH_PHONE && (__JR_PHISH_AMAZON1A || __JR_PHISH_AMAZON1A1 || __JR_PHISH_AMAZON1G))
Describe	JR_PHISH_AMAZON5	Name Spoof/Phish Detected
score   JR_PHISH_AMAZON5		15.0

# U+E0102	??	\xf3\xa0\x84\x82	VARIATION SELECTOR-19
# U+034F	?	\xcd\x8f			COMBINING GRAPHEME JOINER

#
###############
### NETFLIX ###
###############
header  __JR_PHISH_NETFLIX1A	From:name =~ /^Netflix$/i
header  __JR_PHISH_NETFLIX1B	From:addr !~ /.*\@(.*\.)?(netflix)\.com$/i
header	__JR_PHISH_NETFLIX1C	Reply-To:addr !~ /.*\@(.*\.)?(netflix)\.com$/i
meta	JR_PHISH_NETFLIX1		(__JR_PHISH_NETFLIX1A && (__JR_PHISH_NETFLIX1B || (__JR_PHISH_REPLY &&  __JR_PHISH_NETFLIX1C)))
describe	JR_PHISH_NETFLIX1	Name Spoof/Phish Detected
score	JR_PHISH_NETFLIX1		15.0

#
############
### HULU ###
############
header  __JR_PHISH_HULU1A	From:name =~ /^((Hulu|HuluRenewal)(?!\sDisney))(\s|$)/i
header  __JR_PHISH_HULU1B	From:addr !~ /.*\@(.*\.)?(hulu|hulumail)\.com$/i
meta	JR_PHISH_HULU1		(__JR_PHISH_HULU1A && __JR_PHISH_HULU1B)
describe	JR_PHISH_HULU1	Name Spoof/Phish Detected
score	JR_PHISH_HULU1		15.0

#
###########
### TV2 ###
###########
header  __JR_PHISH_TV2_1A	From:name =~ /^(T[Vv]\s?2\sPlay)(\s|$)/i
header  __JR_PHISH_TV2_1B	From:addr !~ /.*\@(.*\.)?(tv2\.no|tv2\.dk)$/i
meta	JR_PHISH_TV2_1		(__JR_PHISH_TV2_1A && __JR_PHISH_TV2_1B)
describe	JR_PHISH_TV2_1	PHISH: TV2 - Name and Address mismatch
score	JR_PHISH_TV2_1		15.0

#
############
### WOW! ###
############
header  __JR_PHISH_WOW1A	From:name =~ /^WOW\!(\s|$)/i
header  __JR_PHISH_WOW1B	From:addr !~ /.*\@(.*\.)?((wowway|wowwayonline)\.com|knology\.net)$/i
meta	JR_PHISH_WOW1		(__JR_PHISH_WOWA && __JR_PHISH_WOW1B)
describe	JR_PHISH_WOW1	Name Spoof/Phish Detected
score	JR_PHISH_WOW1		15.0

#
##################
### PARAMOUNT+ ###
##################
header  __JR_PHISH_PMOUNT1A	From:name =~ /^Paramount\s?\+(\s|$)/i
header  __JR_PHISH_PMOUNT1B	From:addr !~ /.*\@(.*\.)?paramountplus\.com$/i
meta	JR_PHISH_PMOUNT1		(__JR_PHISH_PMOUNT1A && __JR_PHISH_PMOUNT1B)
describe	JR_PHISH_PMOUNT1	Name Spoof/Phish Detected
score	JR_PHISH_PMOUNT1		15.0

#
##################
### PEACOCK TV ###
##################
header  __JR_PHISH_PEACOCK1A	From:name =~ /^(Peacock(\s(TV|Premium|Membership))?)$/i
header  __JR_PHISH_PEACOCK1B	From:addr !~ /.*\@(.*\.)?(peacocktv\.com|nbc\.com|nbcuniversal.com)$/i
meta	JR_PHISH_PEACOCK1		(__JR_PHISH_PEACOCK1A && __JR_PHISH_PEACOCK1B)
describe	JR_PHISH_PEACOCK1	Name Spoof/Phish Detected
score	JR_PHISH_PEACOCK1		15.0

#
#################
### SAMS CLUB ###
#################
header  __JR_PHISH_SAMSCLUB1A	From:name =~ /^(Sam\'?s[_\|\-\s]C[l1iI]ub|Sams[_\s\-](Advantage|Deals))($|\s)/i
header  __JR_PHISH_SAMSCLUB1B	From:addr !~ /.*\@(.*\.)?(samsclub|medallia)\.com$/i
meta	JR_PHISH_SAMSCLUB1		(__JR_PHISH_SAMSCLUB1A && __JR_PHISH_SAMSCLUB1B)
describe	JR_PHISH_SAMSCLUB1	PHISH: Sam's Club - Name and Address mismatch
score	JR_PHISH_SAMSCLUB1		15.0
header  __JR_PHISH_SAMSCLUB1C	From:addr =~ /^(SamsCIub|samsclub|medallia).*\@/i
meta	JR_PHISH_SAMSCLUB2		(__JR_PHISH_SAMSCLUB1C && __JR_PHISH_SAMSCLUB1B)
describe	JR_PHISH_SAMSCLUB2	PHISH: Sam's Club - Bad address format
score	JR_PHISH_SAMSCLUB2		15.0

#
##############
### KOHL'S ###
##############
header  __JR_PHISH_KOHLS1A		From:name =~ /^(Kohl\'s|Kohls|kohls_)(\s)?/i
header	__JR_PHISH_KOHLS1B		From:raw =~ /\=?UTF\-8\?B\?S29obOKAmXM\=\?\=/
header  __JR_PHISH_KOHLS1C		From:addr !~ /.*\@(.*\.)?(kohls|medallia)\.com$/i
header  __JR_PHISH_KOHLS1D		Reply-To:name =~ /^Kohl\'s$/i
meta	JR_PHISH_KOHLS1			((__JR_PHISH_KOHLS1A || __JR_PHISH_KOHLS1B) && (__JR_PHISH_KOHLS1C || !__JR_PHISH_KOHLS1D))
describe	JR_PHISH_KOHLS1	PHISH: Kohl's - Name and Address mismatch
score	JR_PHISH_KOHLS1			15.0

#
###############
### SEPHORA ###
###############
# |sephora\.fr|sephora\.de|sephora\.it
header  __JR_PHISH_SEPHORA1A		From:name =~ /^Sephora\s?.*$/i
header  __JR_PHISH_SEPHORA1B		From:addr !~ /.*\@(.*\.)?((sephora|feelunique|sephorausa|soportesephora|medallia|epsl1)\.com|sephora\.co\.uk|legalmail\.it|sephora\.com\.(br|mx)|sephora\.[a-z]{2})$/i
meta	JR_PHISH_SEPHORA1			(__JR_PHISH_SEPHORA1A && __JR_PHISH_SEPHORA1B)
describe	JR_PHISH_SEPHORA1	PHISH: Sephora - Name and Address mismatch
score	JR_PHISH_SEPHORA1			15.0

#
##############
### COSTCO ###
##############
header  __JR_PHISH_COSTCO1A		From:name =~ /(^Costco([_\|\-\s]|$)|(via|from)\sCostco$)/i
header	__JR_PHISH_COSTCO1B		From:addr !~ /.*\@(.*\.)?(costco|billmatrix|groupon|livingsocial|medallia|costcochecks|costcotravel)\.com$/i
header  __JR_PHISH_COSTCO1C     Subject =~ /(\bCostco\s(Loyalty|Membership)\b)/i
body	__JR_PHISH_COSTCO1D		/1998\-202[0-9]\sCostco\sWholesale\sCorporation/
meta	JR_PHISH_COSTCO1		((__JR_PHISH_COSTCO1A || __JR_PHISH_COSTCO1D) && __JR_PHISH_COSTCO1B)
describe	JR_PHISH_COSTCO1	PHISH: Costco - Name and Address mismatch
score	JR_PHISH_COSTCO1		15.0
meta	JR_PHISH_COSTCO2		((__JR_PHISH_COSTCO1A || __JR_PHISH_COSTCO1C) && __JR_PHISH_BEENTHERE)
describe	JR_PHISH_COSTCO2	PHISH: Costco -  Subject with X-BeenThere
score	JR_PHISH_COSTCO2		15.0
header  __JR_PHISH_COSTCO3A		From:name =~ /^(C0STC0|COSTC0|C0STCO)(\s|$)/i
meta	JR_PHISH_COSTCO3		(__JR_PHISH_COSTCO3A && __JR_PHISH_COSTCO1B)
describe	JR_PHISH_COSTCO3	PHISH: Costco - Bad Name and Address
score	JR_PHISH_COSTCO3		15.0

#
###############
### WAYFAIR ###
###############
header  __JR_PHISH_WAYFAIR1A		From:name =~ /^Wayfair(\s)?/i
header  __JR_PHISH_WAYFAIR1B		From:addr !~ /.*\@(.*\.)?wayfair\.com$/i
meta	JR_PHISH_WAYFAIR1			(__JR_PHISH_WAYFAIR1A && __JR_PHISH_WAYFAIR1B)
describe	JR_PHISH_WAYFAIR1	PHISH: Wayfair - Name and Address mismatch
score	JR_PHISH_WAYFAIR1			15.0

#
####################
### CVS PHARMACY ###
####################
header  __JR_PHISH_CVS1A		From:name =~ /(^|\s)(CVS([\-_\s]Pharmacy)?|CVS\sHealth|CVS\sTeam)(\s|\.|$)/i
header  __JR_PHISH_CVS1B		From:addr !~ /.*\@(.*\.)?(cvs\.com?|cvshealth\.com|medallia\.com)$/i
header	__JR_PHISH_CVS1C		Subject	=~	/CVSReward|CVS\sPharmacy\s[Rr]eward|our\snew\sCVS|Congratulations\!\sA\sCVS|CVS\sreward\s\-|CVS\sRewards?\s(Are\s)?(Expires?|Expiring)|CVS\sCard\sExpires|CVS\sExtra[Cc]are\s(Rewards?|Bucks)|CVS\sRewards\sAre\sHere|CVS\sRewards\sAre\sExpiring|Enjoy\sCVS\sReward|Your\sCVS\sReward|CVS\sMedicare\sKit|Reward\-Card\sfrom\sCVS/
meta	JR_PHISH_CVS1			(__JR_PHISH_CVS1A && __JR_PHISH_CVS1B)
describe	JR_PHISH_CVS1	PHISH: CVS - Name and Address mismatch
score	JR_PHISH_CVS1			15.0
meta	JR_PHISH_CVS2			(__JR_PHISH_CVS1C && __JR_PHISH_CVS1B)
describe	JR_PHISH_CVS2	PHISH: CVS -  Irrational Subject and From Address
score	JR_PHISH_CVS2			15.0

#
##################
### HOME DEPOT ###
##################
header  __JR_PHISH_HDEPOT1A		From:name =~ /((The)?[_\.\s\|]?Home[_\.\s\|]?Depot)(\s|$)/i
header  __JR_PHISH_HDEPOT1B		From:addr !~ /.*\@(.*\.)?(homedepot\.com|homedepot\.ca|squaretrade\.com)$/i
meta	JR_PHISH_HDEPOT1			(__JR_PHISH_HDEPOT1A && __JR_PHISH_HDEPOT1B)
describe	JR_PHISH_HDEPOT1	PHISH: Home Depot - Name and Address mismatch
score	JR_PHISH_HDEPOT1			15.0

#
######################
### HARBOR FREIGHT ###
######################
header  __JR_PHISH_HFREIGHT1A		From:name =~ /^(\-\s)?Harbor[_\.\s\|]?Freight(\.|_|\s|$)/i
header  __JR_PHISH_HFREIGHT1B		From:addr !~ /.*\@(.*\.)?(harborfreight\.com)$/i
meta	JR_PHISH_HFREIGHT1			(__JR_PHISH_HFREIGHT1A && __JR_PHISH_HFREIGHT1B)
describe	JR_PHISH_HFREIGHT1	PHISH: Harbor Freight - Name and Address mismatch
score	JR_PHISH_HFREIGHT1			15.0

#
#####################
### NORTHERN TOOL ###
#####################
header  __JR_PHISH_NTOOL1A		From:name =~ /(^Northern[_\.\s\|]?Tool)(\s|$)/i
header  __JR_PHISH_NTOOL1B		From:addr !~ /.*\@(.*\.)?(northerntool\.com)$/i
meta	JR_PHISH_NTOOL1			(__JR_PHISH_NTOOL1A && __JR_PHISH_NTOOL1B)
describe	JR_PHISH_NTOOL1	PHISH: Northern Tool - Name and Address mismatch
score	JR_PHISH_NTOOL1			15.0

#
######################
### TRACTOR SUPPLY ###
######################
header  __JR_PHISH_TSC1A		From:name =~ /(^Tractor[_\.\s\|]?Supp[lI]y|Support\-Tractor|from\sTractor\sSupply)(\s|$)/i
header  __JR_PHISH_TSC1B		From:addr !~ /.*\@(.*\.)?(tractorsupply\.com)$/i
meta	JR_PHISH_TSC1			(__JR_PHISH_TSC1A && __JR_PHISH_TSC1B)
describe	JR_PHISH_TSC1	PHISH: Tractor Supply - Name and Address mismatch
score	JR_PHISH_TSC1			15.0

#
#####################
### FOODORA NORGE ###
#####################
header  __JR_PHISH_FOODORA1A		From:name =~ /(^Foodora[_\.\s\|]?(Norway|Norge))(\s|$)/i
header  __JR_PHISH_FOODORA1B		From:addr !~ /.*\@(.*\.)?(foodora\.no)$/i
meta	JR_PHISH_FOODORA1			(__JR_PHISH_FOODORA1A && __JR_PHISH_FOODORA1B)
describe	JR_PHISH_FOODORA1	PHISH: Foodora - Name and Address mismatch
score	JR_PHISH_FOODORA1			15.0

#
#####################
### QATAR AIRWAYS ###
#####################
header  __JR_PHISH_QATAR1A	From:name =~ /Qatar[_\.\s\|]?Airways/i
header  __JR_PHISH_QATAR1B	From:addr !~ /.*\@(.*\.)?(qatarairways\.com|qatarairways\.com\.qa)$/i
header	__JR_PHISH_QATAR1C	Reply-To:addr !~ /.*\@(.*\.)?(qatarairways\.com|qatarairways\.com\.qa)$/i
header  __JR_PHISH_QATAR1D	Subject =~ /QATAR\sAIRWAYS\s(PROCUREMENT|PROPOSAL|GIFT|REWARD|PRIVILEGE|FREQUENT)/i
meta	JR_PHISH_QATAR1		(__JR_PHISH_QATAR1A && (__JR_PHISH_QATAR1B || (__JR_PHISH_REPLY &&  __JR_PHISH_QATAR1C)))
describe	JR_PHISH_QATAR1	PHISH: Qatar Air - Name and Address mismatch
score	JR_PHISH_QATAR1		15.0
meta	JR_PHISH_QATAR2		(__JR_PHISH_QATAR1D && __JR_PHISH_QATAR1B)
describe	JR_PHISH_QATAR2	PHISH: Qatar Air -  Irrational Subject and From Address
score	JR_PHISH_QATAR2		15.0

#
#######################
### UNITED AIRLINES ###
#######################
header  __JR_PHISH_UNITED1A	From:name =~ /(^|\b)(United[_\.\s\|]?Airlines?|Mileage[_\.\s\|]?Plus)(\b|$)/
header  __JR_PHISH_UNITED1B	From:addr !~ /.*\@(.*\.)?(united|ual|unitedairlines|mileageplus)\.com$/i
header	__JR_PHISH_UNITED1C	Reply-To:addr !~ /.*\@(.*\.)?(united|ual|unitedairlines|mileageplus)\.com$/i
meta	JR_PHISH_UNITED1		(__JR_PHISH_UNITED1A && (__JR_PHISH_UNITED1B || (__JR_PHISH_REPLY &&  __JR_PHISH_UNITED1C)))
describe	JR_PHISH_UNITED1	PHISH: United Air - Name and Address mismatch
score	JR_PHISH_UNITED1		15.0

#
############################# CLOUD SERVICES #############################
#
##############
### REDDIT ###
##############
header  __JR_PHISH_REDDIT1A	From:name =~ /^Reddit$/
header  __JR_PHISH_REDDIT1B	From:addr !~ /.*\@(.*\.)?(reddit|redditmail|redditinc)\.com$/i
header	__JR_PHISH_REDDIT1C	Reply-To:addr !~ /.*\@(.*\.)?(reddit|redditmail|redditinc)\.com$/i
meta	JR_PHISH_REDDIT1		(__JR_PHISH_REDDIT1A && (__JR_PHISH_REDDIT1B || (__JR_PHISH_REPLY &&  __JR_PHISH_REDDIT1C)))
describe	JR_PHISH_REDDIT1	PHISH: Reddit - Name and Address mismatch
score	JR_PHISH_REDDIT1		15.0

#
##############
### LINODE ###
##############
header  __JR_PHISH_LNODE1A   	From:name =~ /^(Linode\s?|.*\@linode\.com)/i
header  __JR_PHISH_LNODE1B		From:addr !~ /.*\@(.*\.)?(linode)\.com$/i
header	__JR_PHISH_LNODE1C		Reply-To:addr !~ /.*\@(.*\.)?(linode)\.com$/i
header  __JR_PHISH_LNODE1G		From:addr =~ /.*\@(.*\.)?(linode)\.com$/i
meta	JR_PHISH_LNODE1			(__JR_PHISH_LNODE1A && __JR_PHISH_LNODE1B)
describe	JR_PHISH_LNODE1	PHISH: Linode - Name and Address mismatch
score	JR_PHISH_LNODE1			15.0

header  __JR_PHISH_LNODE3A       ALL:raw !~ /^Received:\sfrom\s.*\b(linode\.com|marketo\.org)\b/m
meta    JR_PHISH_LNODE3          ((__JR_PHISH_LNODE1A || __JR_PHISH_LNODE1G) && __JR_PHISH_LNODE3A)
describe	JR_PHISH_LNODE3	PHISH: Linode -  Incorrect Received headers
score   JR_PHISH_LNODE3          15.0 

#
###############
### SPOTIFY ###
###############
header  __JR_PHISH_SPOTFY1A   	From:name =~ /Spotify\s?/i
header  __JR_PHISH_SPOTFY1B		From:addr !~ /.*\@(.*\.)?spotify\.com$/i
body	__JR_PHISH_SPOTIFY1D	/pagamento\sdo\sSpotifyPremium/
meta	JR_PHISH_SPOTFY1		((__JR_PHISH_SPOTFY1A || __JR_PHISH_SPOTIFY1D) && __JR_PHISH_SPOTFY1B)
describe	JR_PHISH_SPOTFY1	PHISH: Spotify - Name and Address mismatch
score	JR_PHISH_SPOTFY1		15.0

#
################
### SIRIUSXM ###
################
header  __JR_PHISH_SIRIUS1A   	From:name =~ /SiriusXM\s?/i
header  __JR_PHISH_SIRIUS1B		From:addr !~ /.*\@(.*\.)?((sirius(xm)?|xmradio)\.com|siriusxm\.ca)$/i
meta	JR_PHISH_SIRIUS1			(__JR_PHISH_SIRIUS1A && __JR_PHISH_SIRIUS1B)
describe	JR_PHISH_SIRIUS1	PHISH: SiriusXM - Name and Address mismatch
score	JR_PHISH_SIRIUS1			15.0

#
################
### ONLYFANS ###
################
header  __JR_PHISH_ONLYFAN1A   	From:name =~ /^(OnlyFans)(\s|\,|$)/i
header  __JR_PHISH_ONLYFAN1B	From:addr !~ /.*\@(.*\.)?(onlyfans\.com)$/i
body	__JR_PHISH_ONLYFAN1D	/(^|\b|\s)(?:\xC2\xA920[0-9]{2}\sOnlyFans)/
meta	JR_PHISH_ONLYFAN1		((__JR_PHISH_ONLYFAN1A || __JR_PHISH_ONLYFAN1D) && __JR_PHISH_ONLYFAN1B)
describe	JR_PHISH_ONLYFAN1	PHISH: OnlyFans - Name and Address mismatch
score	JR_PHISH_ONLYFAN1		15.0

#
##############
### TINDER ###
##############
header  __JR_PHISH_TINDER1A   	From:name =~ /^(Tinder)(\s|\,|$)/i
header  __JR_PHISH_TINDER1B		From:addr !~ /.*\@(.*\.)?(gotinder\.com)$/i
body	__JR_PHISH_TINDER1D		/(^|\b|\s)(?:This\semail\swas\ssent\sby\sTinder\.)/
meta	JR_PHISH_TINDER1		((__JR_PHISH_TINDER1A || __JR_PHISH_TINDER1D) && __JR_PHISH_TINDER1B)
describe	JR_PHISH_TINDER1	PHISH: Tinder - Name and Address mismatch
score	JR_PHISH_TINDER1		15.0

#
############################## MISCELLANEOUS ##############################
#
################
### LINKEDIN ###
################
header  __JR_PHISH_LINKEDIN1A	From:name =~ /LinkedIn$/
header  __JR_PHISH_LINKEDIN1B	From:addr !~ /.*\@(.*\.)?(linkedin)\.com$/i
header	__JR_PHISH_LINKEDIN1C	Reply-To:addr !~ /.*\@(.*\.)?(linkedin)\.com$/i
uri     __JR_PHISH_LINKEDIN_URI	m;[/\#]linkedin/;

meta	JR_PHISH_LINKEDIN1		(__JR_PHISH_LINKEDIN1A && (__JR_PHISH_LINKEDIN1B || (__JR_PHISH_REPLY &&  __JR_PHISH_LINKEDIN1C)))
describe	JR_PHISH_LINKEDIN1	PHISH: LinkedIn - Name and Address mismatch
score	JR_PHISH_LINKEDIN1		15.0


#
######################
### VETERANS ADMIN ###
######################
header  __JR_PHISH_VA1A	From:name =~ /Department\sof\sVeterans\sAffairs|My\sHealtheVet|Veterans\sHealth|VA\sNews|VA\sHealthcare\sSystem|Department\sOf\sVeterans\sHealth|Department\sVeterans\sAffairs/
header  __JR_PHISH_VA1B	From:addr !~ /.*\@(.*\.)?(va)\.gov$/i
header	__JR_PHISH_VA1C	Reply-To:addr !~ /.*\@(.*\.)?(va)\.gov$/i

meta	JR_PHISH_VA1		(__JR_PHISH_VA1A && (__JR_PHISH_VA1B || (__JR_PHISH_REPLY &&  __JR_PHISH_VA1C)))
describe	JR_PHISH_VA1	PHISH: Veterans Admin - Name and Address mismatch
score	JR_PHISH_VA1		15.0

#
################
### FACEBOOK ###
################
header  __JR_PHISH_FB1A		From:name =~ /^(Meta\s(Business|for|Security|Support|Platforms|Help)|Busines\sSP|((FB|Facebook)\s(Business|Copyright|Security|Support))|Facebook$|Meta$)/
header  __JR_PHISH_FB1B		From:addr !~ /.*\@(.*\.)?((facebookmail|facebook|meta|metamail|fb)\.com)$/i
header	__JR_PHISH_FB1C		Subject	=~	/Your\s(Facebook|Meta\sBusiness\sAccount)\sHas\sBeen\sRestricted|Notice\sof\sViolation\sof\sMeta\sPolicies|Violations\son\sYour\sFacebook\sPage|people\swho\smanage\sFacebook\sPages/
body	__JR_PHISH_FB1D	/(^|\b|\s)(?:Media\sOperations\sTeam\sMeta|Meta\s(Business\sServices|Security\sTeam|Platform\,\sIns|For\sBusiness|Support\sTeam)|Facebook\s(Support\s)?Team|request\sto\sreset\syour\sFacebook\spassword|Delete\sFacebook\sadvertising\saccount|your\saccount\shas\sviolated\sFacebook\spolicies|regarding\syour\sFacebook\sadvertising\saccount)/
tflags	__JR_PHISH_FB1D		noflags
meta	JR_PHISH_FB1		((__JR_PHISH_FB1A || __JR_PHISH_FB1C || __JR_PHISH_FB1D) && (__JR_PHISH_FB1B))
describe	JR_PHISH_FB1	PHISH: Facebook - Name and Address mismatch
score	JR_PHISH_FB1		15.0

#
#################
### INSTAGRAM ###
#################
header  __JR_PHISH_IGRAM1A		From:name =~ /^(Instagram)(_|\s|$)/
header  __JR_PHISH_IGRAM1B		From:addr !~ /.*\@(.*\.)?(instagram\.(com|es|pe|se|de|cn|co\.il)|(meta|metamail|fb|facebook(mail)?)\.com)$/i
meta    JR_PHISH_IGRAM1       (__JR_PHISH_IGRAM1A && __JR_PHISH_IGRAM1B)
describe	JR_PHISH_IGRAM1	PHISH: Instagram - Name and Address mismatch
score   JR_PHISH_IGRAM1       15.0

#
############
### USPS ###
############
header  __JR_PHISH_USPS1A	From:name =~ /^(USPS|U\.?S\.?A?\sPostal\sService|USPS\sDelivery)/
header  __JR_PHISH_USPS1B	From:addr !~ /.*\@(.*\.)?(usps\.gov|usps\.com|uspis\.gov)$/i
header	__JR_PHISH_USPS1C	Reply-To:addr !~ /.*\@(.*\.)?(usps\.gov|usps\.com|uspis\.gov)$/i
# || __JR_PHISH_URL removed
meta	JR_PHISH_USPS1		(__JR_PHISH_USPS1A && (__JR_PHISH_USPS1B || (__JR_PHISH_REPLY &&  __JR_PHISH_USPS1C)))
describe	JR_PHISH_USPS1	PHISH: US Post - Name and Address mismatch
score	JR_PHISH_USPS1		15.0

# USPS doesn't update delivery via email: https://bestlifeonline.com/delivery-failure-usps-email-news/
body    __JR_PHISH_USPS2A       /(Delivery\sproblems\snotification|wish\sto\snotify\syou\sthat\swe\sreceived\sBank\sdraft|parcel\sthat\swas\sbeen\sregistered\swith\sus\sBy|DELIVERY\sOF\sTHE\sSUSPENDED\sPACKAGE)/
header  __JR_PHISH_USPS2B		Subject =~ /(An\s(email|package)\scontaining\sconfidential\spersonal\sinformation|IMPORTANT\s?:\s?Check\sYour\sPackage\sDetails|Failure\sto\sdeliver|Delivery\sFailure\sNotification|Delivery\sOnhold)/
meta   JR_PHISH_USPS2		(__JR_PHISH_USPS1A && (__JR_PHISH_USPS2A || __JR_PHISH_USPS2B))
describe	JR_PHISH_USPS2	PHISH: US Post - Irrational Subject/Body with From Name
score  JR_PHISH_USPS2       15.0

#
#############
### E-FAX ###
#############
header  __JR_PHISH_EEFAX1A		From:name =~ /^Eastlink\s?E\-?fax/i
header  __JR_PHISH_EEFAX1B		From:addr !~ /.*\@(.*\.)?(eastlink)\.ca$/i
header	__JR_PHISH_EEFAX1C		Reply-To:addr !~ /.*\@(.*\.)?(eastlink)\.ca$/i
meta	JR_PHISH_EEFAX1			(__JR_PHISH_EEFAX1A && (__JR_PHISH_EEFAX1B || (__JR_PHISH_REPLY && __JR_PHISH_EEFAX1C)))
describe	JR_PHISH_EEFAX1	PHISH: E-Fax - Name and Address mismatch
score	JR_PHISH_EEFAX1			15.0

#
#########################
### UNITED HEALTHCARE ###
#########################
header  __JR_PHISH_UHG1A		From:name =~ /^(United\s?Health\s?care|United\s?Health\s?Group|United\sHealth$|MyUHC)(\s|$)/i
header  __JR_PHISH_UHG1B		From:addr !~ /.*\@(.*\.)?(uhc|optum|uhg|unitedhealthgroup|myuhc|unitedhealthcare\.com)\.com$/i
meta	JR_PHISH_UHG1			(__JR_PHISH_UHG1A && (__JR_PHISH_UHG1B))
describe	JR_PHISH_UHG1	PHISH: United Health - Name and Address mismatch
score	JR_PHISH_UHG1			15.0

#
##############
### UNICEF ###
##############
header  __JR_PHISH_UNICEF1A		From:name =~ /\bUNICEF\b/i
header  __JR_PHISH_UNICEF1B		From:addr !~ /.*\@(.*\.)?(unicef|un)\.org$/i
header  __JR_PHISH_UNICEF1C		Reply-To:addr !~ /.*\@(.*\.)?(unicef|un)\.org$/i
meta    JR_PHISH_UNICEF1		(__JR_PHISH_UNICEF1A && (__JR_PHISH_UNICEF1B || (__JR_PHISH_REPLY && __JR_PHISH_UNICEF1C)))
describe	JR_PHISH_UNICEF1	PHISH: UNICEF - Name and Address mismatch
score   JR_PHISH_UNICEF1		15.0

#
################
### DOCUSIGN ###
################
header  __JR_PHISH_DSIGN1A		From:name =~ /((^(SignRequest|Docu?[\-_]?Signs?)(\s|$))|\sDocu?[\-_]?Signs?$|\svia\sDoc\sSIgn)/i
header  __JR_PHISH_DSIGN1B		From:addr !~ /.*\@(.*\.)?docusign\.(com|net)$/i
header  __JR_PHISH_DSIGN1C		From:addr =~ /.*\@(.*\.)?docusign\.(com|net)$/i
header  __JR_PHISH_DSIGN1D		Subject =~ /(sign|review)\sVia\sDocusign/i
body	__JR_PHISH_DSIGN2A		/(This\semail\scontains\sa\ssecure\slink\sto\sDocuSign\.|DocuSign\.\sThe\sfastest\sway\sto\sget\sa\ssignature\.|using\sthe\sDocuSign\sElectronic\sSignature\sService|\xC2\xA9\sDocuSign\sInc\.\s20[0-9]{2}|Powered\sby\sDocuSign)/m
header  __JR_PHISH_DSIGN3A       ALL:raw !~ /Received:\sfrom\s(.*\.)?(docusign\.(net|com)|amazonses\.com|sparkpostmail\.com|pphosted\.com)\s/m

meta    JR_PHISH_DOCUSIGN1		(__JR_PHISH_DSIGN1A && __JR_PHISH_DSIGN1B)
describe	JR_PHISH_DOCUSIGN1	PHISH: DocuSign - Name and Address mismatch
score   JR_PHISH_DOCUSIGN1		15.0

meta    JR_PHISH_DOCUSIGN2		(__JR_PHISH_DSIGN2A && (__JR_PHISH_DSIGN1B || __JR_PHISH_DSIGN3A))
describe	JR_PHISH_DOCUSIGN2	Name Spoof/Phish Detected
score   JR_PHISH_DOCUSIGN2		5.0

meta    JR_PHISH_DOCUSIGN3		((__JR_PHISH_DSIGN1A || __JR_PHISH_DSIGN1C) && __JR_PHISH_DSIGN3A)
describe	JR_PHISH_DOCUSIGN3	Name Spoof/Phish Detected
score   JR_PHISH_DOCUSIGN3		15.0

meta    JR_PHISH_DOCUSIGN4		((__JR_PHISH_DSIGN1A || __JR_PHISH_DSIGN1C) && !(DKIM_VALID_AU))
describe	JR_PHISH_DOCUSIGN4	Name Spoof/Phish Detected
score   JR_PHISH_DOCUSIGN4		15.0

meta    JR_PHISH_DOCUSIGN5		(__JR_PHISH_DSIGN1D && __JR_PHISH_DSIGN1B)
describe	JR_PHISH_DOCUSIGN5	Name Spoof/Phish Detected
score   JR_PHISH_DOCUSIGN5		15.0

#
#############
### ADOBE ###
#############
header  __JR_PHISH_ADOBE1A	From:name =~ /(^Adobe(\s.*)?$|Acrobat[_\s\-]Sign|Via[_\s\-](Adobe|Acrobat))/i
header  __JR_PHISH_ADOBE1B	From:addr !~ /.*\@(.*\.)?(adobe|photoshop|creativecloud|documentcloud|adobesign|echosign)\.com$/i
header  __JR_PHISH_ADOBE1C	From:addr =~ /.*\@(.*\.)?(adobe|photoshop|creativecloud|documentcloud|adobesign|echosign)\.com$/i
meta    JR_PHISH_ADOBE1       (__JR_PHISH_ADOBE1A && __JR_PHISH_ADOBE1B)
describe	JR_PHISH_ADOBE1	Name Spoof/Phish Detected
score   JR_PHISH_ADOBE1       15.0

meta    JR_PHISH_ADOBE2       ((__JR_PHISH_ADOBE1A || __JR_PHISH_ADOBE1C) && !(DKIM_VALID_AU))
describe	JR_PHISH_ADOBE2	Name Spoof/Phish Detected
score   JR_PHISH_ADOBE2		15.0

#
###############
### ALIBABA ###
###############
header  __JR_PHISH_ALIBABA1A	From:name =~ /(^Alibaba|^alibaba\.com)/
header  __JR_PHISH_ALIBABA1B	From:addr !~ /.*\@(.*\.)?(alibaba\.com|alibabagroup\.com|alibabacloud\.com|aliexpress\.com|alimama\.com|alios\.cn|taobao\.com)$/i
meta    JR_PHISH_ALIBABA1       (__JR_PHISH_ALIBABA1A && __JR_PHISH_ALIBABA1B)
describe	JR_PHISH_ALIBABA1	Name Spoof/Phish Detected
score   JR_PHISH_ALIBABA1       15.0

#
###################
### BOOKING.COM ###
###################
header  __JR_PHISH_BOOKING1A	From:name =~ /(^Booking|^Booking\.com)$/
header  __JR_PHISH_BOOKING1B	From:addr !~ /.*\@(.*\.)?(booking\.com)$/i
meta    JR_PHISH_BOOKING1       (__JR_PHISH_BOOKING1A && __JR_PHISH_BOOKING1B)
describe	JR_PHISH_BOOKING1	Name Spoof/Phish Detected
score   JR_PHISH_BOOKING1       15.0

#
#######################
### SOCIAL SECURITY ###
#######################
header  __JR_PHISH_SSA1A	From:name =~ /(^Social\sSecurity\sAdministration)/
header  __JR_PHISH_SSA1B	From:addr !~ /.*\@(.*\.)?(ssa\.gov|govdelivery\.com)$/i
meta    JR_PHISH_SSA1       (__JR_PHISH_SSA1A && __JR_PHISH_SSA1B)
describe	JR_PHISH_SSA1	Name Spoof/Phish Detected
score   JR_PHISH_SSA1       15.0

#
####################
### CREDIT KARMA ###
####################
header  __JR_PHISH_CKARMA1A	From:name =~ /(^|\s)Credit[_\s]Karma/i
header  __JR_PHISH_CKARMA1B	From:addr !~ /.*\@(.*\.)?(creditkarma\.com)$/i
meta    JR_PHISH_CKARMA1       (__JR_PHISH_CKARMA1A && __JR_PHISH_CKARMA1B)
describe	JR_PHISH_CKARMA1	Name Spoof/Phish Detected
score   JR_PHISH_CKARMA1       15.0

#
###############
### ONEPARK ###
###############
header  __JR_PHISH_1PARK1A   	From:name =~ /^(ONEPARK\s?(AS|Refusjon|FRA\sAUTOPAY\.IO)?)$/i
header  __JR_PHISH_1PARK1B		From:addr !~ /.*\@(.*\.)?onepark\.no$/i
meta	JR_PHISH_1PARK1			(__JR_PHISH_1PARK1A && __JR_PHISH_1PARK1B)
describe	JR_PHISH_1PARK1	Name Spoof/Phish Detected
score	JR_PHISH_1PARK1			15.0

#
##############################
### NORWEGIAN PUBLIC ROADS ###
##############################
header  __JR_PHISH_NOPRA1A   	From:name =~ /^(St\xC4\x81tens[\s_\-.]+v\xC4\x99gvesen|Statens[\s_\-.]+Vegvesenn)$/i
header  __JR_PHISH_NOPRA1B		From:addr !~ /.*\@(.*\.)?vegvesen\.no$/i
meta	JR_PHISH_NOPRA1			(__JR_PHISH_NOPRA1A && __JR_PHISH_NOPRA1B)
describe	JR_PHISH_NOPRA1	Name Spoof/Phish Detected
score	JR_PHISH_NOPRA1			15.0

#
############################
### NORWEGIAN FERRY PASS ###
############################
header  __JR_PHISH_NOPASS1A   	From:name =~ /^(AutoPASS\-[Ff]erje)$/i
header  __JR_PHISH_NOPASS1B		From:addr !~ /.*\@(.*\.)?autopassferje\.no$/i
meta	JR_PHISH_NOPASS1			(__JR_PHISH_NOPASS1A && __JR_PHISH_NOPASS1B)
describe	JR_PHISH_NOPASS1	Name Spoof/Phish Detected
score	JR_PHISH_NOPASS1			15.0

#
#############################
### MOHRE - ARAB EMIRATES ###
#############################
header  __JR_PHISH_MOHRE1A    	From:name =~ /(Ministry\sof\sHuman\sResources\s(\&|and)\sEmiratisation)$/i
header  __JR_PHISH_MOHRE1B		From:addr !~ /.*\@(.*\.)?mohre\.gov\.ae$/i
meta	JR_PHISH_MOHRE1			(__JR_PHISH_MOHRE1A && __JR_PHISH_MOHRE1B)
describe	JR_PHISH_MOHRE1	Name Spoof/Phish Detected
score	JR_PHISH_MOHRE1			15.0

#
################
### EASYPARK ###
################
header  __JR_PHISH_EPARK1A   	From:name =~ /^(EasyPark)([\s_\.]|$)/i
header  __JR_PHISH_EPARK1B		From:addr !~ /.*\@(.*\.)?(easypark|easyparkgroup)\.(com|net|no|se|de|es|fr|nl|dk)$/i
meta	JR_PHISH_EPARK1			(__JR_PHISH_EPARK1A && __JR_PHISH_EPARK1B)
describe	JR_PHISH_EPARK1	Name Spoof/Phish Detected
score	JR_PHISH_EPARK1			15.0

#
##################
### FJORDKRAFT ###
##################
header  __JR_PHISH_FJORD1A		From:name =~ /^(Fjordkraft(\sAS)?)$/i
header  __JR_PHISH_FJORD1B		From:addr !~ /.*\@(.*\.)?fjordkraft\.no$/i
meta	JR_PHISH_FJORD1			(__JR_PHISH_FJORD1A && __JR_PHISH_FJORD1B)
describe	JR_PHISH_FJORD1	Name Spoof/Phish Detected
score	JR_PHISH_FJORD1			15.0

#
########################
### VINCI AUTOROUTES ###
########################
header  __JR_PHISH_VINCI1A		From:name =~ /^(VINCI[_.\-\s]?Autoroutes)(\.|_|\s|$)/i
header  __JR_PHISH_VINCI1B		From:addr !~ /.*\@(.*\.)?(vinci\-autoroutes|vinci)\.com$/i
meta	JR_PHISH_VINCI1			(__JR_PHISH_VINCI1A && __JR_PHISH_VINCI1B)
describe	JR_PHISH_VINCI1	Name Spoof/Phish Detected
score	JR_PHISH_VINCI1			15.0

#
#####################
### LOUIS VUITTON ###
#####################
header  __JR_PHISH_LOUISV1A		From:name =~ /^(Louis[_\.\s\|]?Vuitton)$/i
header  __JR_PHISH_LOUISV1B		From:addr !~ /.*\@(.*\.)?louisvuitton\.com$/i
meta	JR_PHISH_LOUISV1		(__JR_PHISH_LOUISV1A && __JR_PHISH_LOUISV1B)
describe	JR_PHISH_LOUISV1	Name Spoof/Phish Detected
score	JR_PHISH_LOUISV1		15.0

#
###############
### RAY-BAN ###
###############
header  __JR_PHISH_RAYBAN1A		From:name =~ /^(Ray-Ban|RayBan|Ray\sBan)(\s?|$)/
header  __JR_PHISH_RAYBAN1B		From:addr !~ /.*\@(.*\.)?(ray\-ban\.com|luxottica\.com)$/i
meta	JR_PHISH_RAYBAN1		(__JR_PHISH_RAYBAN1A && __JR_PHISH_RAYBAN1B)
describe	JR_PHISH_RAYBAN1	Name Spoof/Phish Detected
score	JR_PHISH_RAYBAN1		15.0

#
##############
### PFIZER ###
##############
header  __JR_PHISH_PFIZER1A		From:name =~ /^(Pfizer)(\s|\,|$)/i
header  __JR_PHISH_PFIZER1B		From:addr !~ /.*\@(.*\.)?(pfizer\.com)$/i
meta	JR_PHISH_PFIZER1		(__JR_PHISH_PFIZER1A && __JR_PHISH_PFIZER1B)
describe	JR_PHISH_PFIZER1	Name Spoof/Phish Detected
score	JR_PHISH_PFIZER1		15.0

#
############
### OOMA ###
############
header  __JR_PHISH_OOMA1A		From:name =~ /^(Ooma)(\s|\,|$)/i
header  __JR_PHISH_OOMA1B		From:addr !~ /.*\@(.*\.)?(ooma\.com)$/i
meta	JR_PHISH_OOMA1		(__JR_PHISH_OOMA1A && __JR_PHISH_OOMA1B)
describe	JR_PHISH_OOMA1	Name Spoof/Phish Detected
score	JR_PHISH_OOMA1		15.0

#
#########################
### INTUIT/QUICKBOOKS ###
#########################
header  __JR_PHISH_INTUIT1A	From:name =~ /(^|\b)(Intuit|QuickBooks)($|\b)/i
header  __JR_PHISH_INTUIT1B	From:addr !~ /.*\@(.*\.)?(intuit\.com|selfemployed\.intuit\.com|quickbooks\.intuit\.com|turbotax\.intuit\.com|macpayroll\.com|tsheets\.com|quickbooks\.com)$/i
meta    JR_PHISH_INTUIT1       (__JR_PHISH_INTUIT1A && __JR_PHISH_INTUIT1B)
describe	JR_PHISH_INTUIT1	Name Spoof/Phish Detected
score   JR_PHISH_INTUIT1       15.0

#
#############################
### ETIHAD AVIATION GROUP ###
#############################
header  __JR_PHISH_ETIHAD1A	From:name =~ /(^|\b)(Etihad\s(Airways|Aviation))($|\b)/i
header  __JR_PHISH_ETIHAD1B	From:addr !~ /.*\@(.*\.)?(etihad\.ae|etihadaviationgroup\.com)$/i
meta    JR_PHISH_ETIHAD1       (__JR_PHISH_ETIHAD1A && __JR_PHISH_ETIHAD1B)
describe	JR_PHISH_ETIHAD1	Name Spoof/Phish Detected
score   JR_PHISH_ETIHAD1       15.0

#
#################
### SWISSPASS ###
#################
header  __JR_PHISH_SWISSPASS1A	From:name =~ /(^|\b)(Swiss\s?Pass)($|\b)/i
header  __JR_PHISH_SWISSPASS1B	From:addr !~ /.*\@(.*\.)?(swisspass\.ch)$/i
meta    JR_PHISH_SWISSPASS1       (__JR_PHISH_SWISSPASS1A && __JR_PHISH_SWISSPASS1B)
describe	JR_PHISH_SWISSPASS1	Name Spoof/Phish Detected
score   JR_PHISH_SWISSPASS1       15.0

#
#####################################
### ST. ANTHONY CATHEDRAL CHARITY ###
#####################################
header  __JR_PHISH_STACC1A	From:name =~ /(^|\b)(St\.[\s_]?Anthony[\s_]?Cathedral[\s_]?Charit(y|ies))($|\b)/i
header  __JR_PHISH_STACC1B	From:addr !~ /.*\@(.*\.)?(santantonio\.org)$/i
meta    JR_PHISH_STACC1       (__JR_PHISH_STACC1A && __JR_PHISH_STACC1B)
describe	JR_PHISH_STACC1	Name Spoof/Phish Detected
score   JR_PHISH_STACC1       15.0

#
################
### T-MOBILE ###
################
header  __JR_PHISH_TMOBILE1A		From:name =~ /(T\-Mobile)/i
header  __JR_PHISH_TMOBILE1B		From:addr !~ /.*\@(.*\.)?((t\-mobile|t\-mobile\-email|tmomail)\.com|tmobileus\.(net|com))$/i
meta	JR_PHISH_TMOBILE1			(__JR_PHISH_TMOBILE1A && __JR_PHISH_TMOBILE1B)
describe	JR_PHISH_TMOBILE1	Name Spoof/Phish Detected
score	JR_PHISH_TMOBILE1			15.0