namespace EmailSearch.SpamDetection; public sealed class SpamDetectorConfig { public List FreeDomains { get; set; } = new(); public List BadTlds { get; set; } = new(); public List BaitKeywords { get; set; } = new(); public DomainConfiguration Domains { get; set; } = new(); public SpamScoreWeights SpamScoreWeights { get; set; } = new(); public List QuarantineKeywords { get; set; } = new(); public List VoicemailKeywords { get; set; } = new(); public List SystemNotificationKeywords { get; set; } = new(); public List ColdEmailKeywords { get; set; } = new(); public List FakeServiceDomains { get; set; } = new(); public static SpamDetectorConfig GetDefault() { return new SpamDetectorConfig { FreeDomains = new List { "gmail.com", "outlook.com", "hotmail.com", "yahoo.com", "icloud.com", "aol.com", "proton.me", "protonmail.com", "live.com", "msn.com", "ymail.com", "mail.com" }, BadTlds = new List { "icu", "top", "click", "xyz", "mom", "quest", "work", "shop", "rest", "tokyo", "pics", "zip", "com.br", "net", "buzz", "cam", "link", "loan", "online", "site", "website" }, BaitKeywords = new List { // Financial "invoice", "overdue", "wire", "zelle", "gift card", "payroll", "remit", "ach", "payment", "past due", "bank transfer", // Urgency/Action "review & sign", "sign now", "action required", "urgent", "verify", "confirm your", "suspended", "expire", "limited time", // Account/System "storage limit", "storage quota", "account", "password", "security alert", "unusual activity", "locked", // Messages/Notifications "voice message", "voicemail", "fax", "document", "shared with you", // Domain/SEO spam "domain for sale", "premium domain", "seo", "website design", // Cold sales "setup request", "follow up", "checking in", "quick question" }, Domains = new DomainConfiguration { Vendors = new Dictionary(), Trusted = new List { "microsoft.com", "office365.com", "google.com", "amazon.com", "apple.com", "github.com", "linkedin.com" } }, SpamScoreWeights = new SpamScoreWeights(), QuarantineKeywords = new List { "quarantine summary", "spam report", "quarantine folder", "email quarantine", "quarantined email", "spam summary", "junk summary", "blocked messages", "held messages" }, VoicemailKeywords = new List { "voicemail", "voice message", "voice mail", "audio message", "new voicemail", "play voicemail", "missed call", "phone message" }, SystemNotificationKeywords = new List { "verify your email", "email verification", "verify now", "confirm your email", "account suspended", "account locked", "storage limit", "storage quota", "mailbox full", "password expir", "credentials expir", "unusual activity", "security alert", "suspicious activity", "action required" }, ColdEmailKeywords = new List { "seo services", "seo affordable", "search engine optimization", "website ranking", "google ranking", "backlinks", "link building", "website redesign", "web development", "web developer", "website design", "graphic designer", "mobile app", "app development", "reaching out", "hope this finds you", "i came across your", "outsource", "offshore", "dedicated team", "cost-effective" }, FakeServiceDomains = new List { "voiceservicing.net", "audios.net", "voicemail.net", "audioservices.net", "mailservicing.net", "emailservicing.net", "securemail.net", "mailprotect.net", "docuservices.net" } }; } } public sealed class DomainConfiguration { public Dictionary Vendors { get; set; } = new(); public List Trusted { get; set; } = new(); } public sealed class VendorDomainInfo { public int Reputation { get; set; } public List DisplayNamePatterns { get; set; } = new(); } public sealed class SpamScoreWeights { public double SpfFail { get; set; } = 0.28; public double DkimFail { get; set; } = 0.25; public double DmarcFail { get; set; } = 0.30; public double ReplyToDomainMismatch { get; set; } = 0.20; public double DisplayImpersonation { get; set; } = 0.22; public double UnicodeLookalike { get; set; } = 0.20; public double HasUrl { get; set; } = 0.06; public double UrlCountMultiplier { get; set; } = 0.02; public double HasIpLink { get; set; } = 0.18; public double UsesShortener { get; set; } = 0.12; public double SuspiciousTld { get; set; } = 0.10; public double HasTrackingPixel { get; set; } = 0.06; public double HasAttachment { get; set; } = 0.06; public double HasRiskyAttachment { get; set; } = 0.22; public double KeywordBait { get; set; } = 0.22; public double FreeMailboxWithUrl { get; set; } = 0.18; public double FreeMailboxOnly { get; set; } = 0.08; public double HasListUnsubscribe { get; set; } = -0.04; public double ReputationMultiplier { get; set; } = 0.05; public double UnknownDomain { get; set; } = 0.15; public double CompanySubdomainSpoof { get; set; } = 0.45; public double FakeQuarantineReport { get; set; } = 0.40; public double HasZeroWidthChars { get; set; } = 0.35; public double HasRandomRefId { get; set; } = 0.18; public double HasTimestampInSubject { get; set; } = 0.15; public double ColdEmailSolicitation { get; set; } = 0.30; public double FakeVoicemailNotification { get; set; } = 0.42; public double FakeSystemNotification { get; set; } = 0.38; }