phishingkit email phishing yara rule

/*
    Phishing Kit Emails
*/
rule PhishingKitEmail
{
    strings:
        $domain1 = "@gmail.com"
        $domain2 = "@yandex.com"
        $domain3 = "@outlook.com"
        $domain4 = "@protonmail.com"
        $domain5 = "@yahoo.com"
        $domain6 = "@hotmail.com"
        $domain7 = "@zoho.com"
        $domain8 = "@yandex.ru"
        $domain9 = "@163.com"
        $domain10 = "@aol.com"
        $domain11 = "@mail.ru"
    condition:
        (file_type contains "php") and (file_name contains "mail" or file_name contains "result" or file_name contains "next" or file_name contains "send" or file_name contains "connect" or file_name contains "info" or file_name contains "config" or file_name contains "process" or file_name contains "step" or file_name contains "success" or file_name contains "to" or file_name contains "login" or file_name contains "logon" or file_name contains "3d" or file_name contains "action" or file_name contains "pass" or file_name contains "user" or file_name contains "verif" or file_name contains "post" or file_name contains "finish" or file_name contains "log" or file_name contains "submit" or file_name contains "check") and any of ($domain*)
}