debian_pkg-listmaster/spamassassin_config/common/phrase_spam

# -*- mode: spamassassin -*-
# Added some rules from Rule du Jour that I've been testing for a while

#Monotone (from airmax.cf)
body     MONOTONE_WORDS_2_15            /^([a-z]{2,20}[\s\.]+){15}/
describe MONOTONE_WORDS_2_15            Lines with many (long) lowercase words (15+ words, 2+ letters)
body     MONOTONE_WORDS_2_30            /^([a-z]{2,20}[\s\.]+){30}/
describe MONOTONE_WORDS_2_30            Lines with many (long) lowercase words (30+ words, 2+ letters)
body     MONOTONE_WORDS_3_20            /^([a-z]{3,20}[\s\.]+){20}/
describe MONOTONE_WORDS_3_20            Lines with many (long) lowercase words (20+ words, 3+ letters)
body     MONOTONE_WORDS_5_8                     /^([a-z]{5,20}[\s\.]+){8}/
describe MONOTONE_WORDS_5_8                     Lines with many (long) lowercase words (8+ words, 5+ letters)
body     MONOTONE_WORDS_5_12            /^([a-z]{5,20}[\s\.]+){12}/
describe MONOTONE_WORDS_5_12            Lines with many (long) lowercase words (12+ words, 5+ letters)
body     MONOTONE_WORDS_5_20            /^([a-z]{5,20}[\s\.]+){20}/
describe MONOTONE_WORDS_5_20            Lines with many (long) lowercase words (20+ words, 5+ letters)

# Lots of auto-responders seem to have this
body	MDO_AUTORESP1	/online form/i
score	MDO_AUTORESP1	0.1

body	MDO_AUTORESP2	/large amount of (spam|virus)/i
score	MDO_AUTORESP2	0.1

body	MDO_AUTORESP3	/(electronically|automatically) (generated|created) (email|ack)/i
score	MDO_AUTORESP3	0.1

body	MDO_AUTORESP4	/(respond|answer) your enquiry/i
score	MDO_AUTORESP4	0.1

body	MDO_AUTORESP5	/(email|enquiry) has been received/i
score	MDO_AUTORESP5	0.1

body	MDO_AUTORESP6	/will be answered within/i
score	MDO_AUTORESP6	0.1

body	MDO_AUTORESP7	/the e-mail address to which you have written does not support incoming messages/i
score	MDO_AUTORESP7	0.1

meta	MDO_AUTORESP_META1	(MDO_AUTORESP1 + MDO_AUTORESP2 + MDO_AUTORESP3 + MDO_AUTORESP4 + MDO_AUTORESP5 + MDO_AUTORESP6 + MDO_AUTORESP7) > 1
score	MDO_AUTORESP_META1	2.0

body MURPHY_DIPLOMA	/dip[l1]omas?/i
describe MURPHY_DIPLOMA	No Diploma
score MURPHY_DIPLOMA	1

body MURPHY_CALORIES	/calories/
describe MURPHY_CALORIES	No Calories
score MURPHY_CALORIES	1

header MURPHY_CONTENT_GIF	Content-Type =~ /image\/gif/
describe MURPHY_CONTENT_GIF	Content contains image/gif
score MURPHY_CONTENT_GIF	1

# cable tv spam -- pasc 04/05/11-12
body MDO_CABLE_TV1	/pay.?per.?view/i
score MDO_CABLE_TV1	0.5

body MDO_CABLE_TV2	/mature.?channel/i
score MDO_CABLE_TV2	0.5

body MDO_CABLE_TV3	/c(\@|a)ble/i
score MDO_CABLE_TV3	0.5

body MDO_CABLE_TV4	/rem(o|0)te.?control/i
score MDO_CABLE_TV4	0.5

meta MDO_CABLE_META1	(MDO_CABLE_TV1 || MDO_CABLE_TV2 || MDO_CABLE_TV4) && (MDO_CABLE_TV3)
describe MDO_CABLE_META1 Too much cable stuff
score MDO_CABLE_META1	3

header	MDO_TAGSPAM1          	Subject =~ /Unknown Tag *free* Please Fix/
score	MDO_TAGSPAM1            4

body	MDO_BAD_WORD1		/PORTFOLIO/i
score	MDO_BAD_WORD1		2.8

# blarson, 2004-04-30 -> lists --pasc 04/05/11 
body AFFILIATEID        /affiliate.?id/i
describe AFFILIATEID    affiliate id
score AFFILIATEID       3

# blarson 2007-07-13
header REFWD		subject =~ /\b(?:RE|FWD?|AW)(?:\[\d+\])?\:\s*$/i
describe REFWD		re or fwd nothing
score REFWD		3.5

# blarson 2005-11-11
header ONEWORD		subject =~ /^(?:Fw:|re:)?\s*\S+\s*$/i
describe ONEWORD	one word subject
score ONEWORD		2

rawbody ONEWORDBODY	/^\s*\S+\s*$/s
describe ONEWORDBODY 	One word body
score ONEWORDBODY	2

meta  ONEWORDALL	(ONEWORD && ONEWORDBODY)
describe ONEWORDALL	Both subject and body contain one word
score ONEWORDALL	4

# robot101, 2003-09-22
header CROSSWALK	X-UnityUser =~ /^Crosswalk.com, Inc/
describe CROSSWALK	Crosswalk bible mailing list
score CROSSWALK		3

header CROSSWALK_SPAM	From =~ /Crosswalk/
describe CROSSWALK_SPAM	Crosswalk Spam
score CROSSWALK_SPAM	1

# -- joy, 2003-06-28
header BOMDIA		Subject =~ /Bom dia /
describe BOMDIA		Bom dia, usually some Romanic language spam
score BOMDIA		2

header RCVD_FROM_UNCONF_HOST	Received =~ /^from localhost.localdomain/
describe RCVD_FROM_UNCONF_HOST	Mail comes from a host with unconfigured mailer daemon
score RCVD_FROM_UNCONF_HOST	2

# joy, 2003/01/25
body ECOSPAM			/Corridas de Toros para los turistas Ingleses en Barcelona/
describe ECOSPAM		Eco-spam all right
score ECOSPAM			5.0

# cjwatson, 2003/02/24
body SPANISH_FORM_CGI		/Este formulario fue enviado por/
describe SPANISH_FORM_CGI	"Below is the result of your feedback form", eh?
score SPANISH_FORM_CGI		4.0

# joy, 2003-06-18
body TRAFFICMAGNET		/Become a TrafficMagnet Reseller/
describe TRAFFICMAGNET		SpamMagnet
score TRAFFICMAGNET		4

# joy, 2003-06-27
header BKR			Subject =~ /^bkr/
describe BKR			bkr spam
score BKR			4

# joy, 2003-06-27
header RISEANDSHINE		Subject =~ /^Rise and Shine in 15 minutes/
describe RISEANDSHINE		Rise and Shine in 15 minutes spam
score RISEANDSHINE		4

# joy, 2003-09-20
header UNIVDIP		Subject =~ /U N I V E R S I T Y . D I P L O M A S/i
describe UNIVDIP	university diplomas spam
score UNIVDIP		4

# joy, 2003-09-21
header YOUTHERE		Subject =~ /^(Re: )?You/i
describe YOUTHERE	Who, me? Likely spam
score YOUTHERE		2

# cjwatson, 2003-11-20
header HOUSECLEANING	Subject =~ /^Affordable Housecleaning Service/
describe HOUSECLEANING	let's clean out the spam instead
score HOUSECLEANING	3

# cjwatson, 2003-12-11
header OTC_FIRST	Subject =~ /OTC FIRST ALERT/
describe OTC_FIRST	OTC spam
score OTC_FIRST		3

# joy, 2004-01-03
body AVAILABLENOW	/available now/i
describe AVAILABLENOW	must be selling some shit
score AVAILABLENOW	1

# cjwatson, 2004-01-16
body TEDIOUS_WITTER	/If not i included it below so let me know if you like it/
describe TEDIOUS_WITTER	annoying wittering spam, mypillsource.com I think
score TEDIOUS_WITTER	2

# cjwatson, 2004-03-12
# blarson 2004-06-09
header UNI_DIPLOMA	subject =~ /\b(?:university|college|doctora+te|bache+lor|maste+rs?)[\/\s]+(?:(dip[l1][o0]ma|cert|degree)|(?:university|college|doctora+te|bache+lor|maste+rs?))/i
describe UNI_DIPLOMA	Got a diploma, thanks
score UNI_DIPLOMA	4

# blarson 2004-04-27
body UNI2	/university\s+(diploma|cert|degree)/i
describe UNI2	Got one, thanks
score UNI2	4

# don 2007-11-03
body UNI3		/(?:(?:maste+rs|batche+lor|m\s*b\s*a\s*|ph\.?\s*d|doctora+te)\s*[,.\/]?\s*){2,}/i
describe UNI3		multiple types of degrees
score UNI3		2

# cjwatson, 2004-03-12
header JOB_CONFIRM	Subject =~ /Job confirmation/
describe JOB_CONFIRM	Got one of these too, thanks
score JOB_CONFIRM	3

# blarson 2005-09-20
header MESSAGESUB	subject =~ /^\s*\(?message\s*(subject)?\)?$/i
describe MESSAGESUB	really descriptive subject
score MESSAGESUB	3

# blarson 2006-03-16 2007-09-18 not working, replaced 2007-12-08
# body DEARDIGIT		/^(?:well\s+)?(?:Dear|Hey|H[ea]y?ll?.?o|To|Attention|Hi+|Hey+a?|Bonjorno|(?:Yo\s*)+|(?:g[o0]+d\s*)?(?:d?ay|morning|evening?|afternoon|night)|what.?i?s\s+up|wa(?:s|z)+up|greetings?|Salutations|(Mail|News)\s+to|how(?:.?s|\s+is)?\s*(?:(?:it)?(?:\s+is)??\s*going|have\s+you\s+been|are you).?\s*(?:there|to\s+you)?|compliments|Regards|Adieu)\,?\s+(?:Account\s+\#?|\=?3d|)(?:bro|there|sir|Mr\.?)\s*?\d{3,}/i
body DEARDIGIT		/^\s*(?:Good\s*)?(?:evenin|night|day|hi|hello|greetin|Compliment|Wa[sz]+up|dear|Regard|Mornin|(?:yo\s*)+)[sg]?\s+(?:there\s+)?\d{3,}/i
describe DEARDIGIT	Dear number
score DEARDIGIT		3.9

# blarson 2004-11-08
header SIZEMATTERS	subject =~ /^S.ze matters$/i
describe SIZEMATTERS	Size matters spammer
score SIZEMATTERS	3

# cjwatson 2005-01-02
header RNDMX		subject =~ /^<rndmx/
describe RNDMX		weird empty spam
score RNDMX		4

# blarson 2005-01-06
header VERIFYCAT	subject =~ /verifycation mail/
describe VERIFYCAT	verifycation spam
score	VERIFYCAT	4

# blarson 2005-01-10
header D0WNLOAD		subject =~ /\bd[o0]wn[l1][o0]ad.*(?:m[o0]v[i1]e|mp3|tune|music)/i
describe D0WNLOAD	download spam
score D0WNLOAD		3

# blarson 2005-02-11
header REDUCESPAM	subject =~ /Reduce Spam\b/i
describe REDUCESPAM	reduce spam spam
score REDUCESPAM	2

# blarson 2005-04-15
body DIRT		/\.(?:the|\d|)dirty?\d+\.info\//
describe DIRT		dirty spammer
score DIRT		3

# blarson 2005-04-17
body RNDWORD		/^RND_WORD\s*$/
describe RNDWORD	RND_WORD
score RNDWORD		3

# blarson 2005-08-18
header D3GREE		subject =~ /\bd(?:3gres?|esgre|eerge|eeerg|reege|egres)e?s?\b/i
describe D3GREE		Want a used paper from someone who can't spell
score D3GREE		3

# blarson 2005-08-19
body FINALNOTE		/\bfinal\s+notif/i
describe FINALNOTE	yet another final notification
score FINALNOTE		2

# blarson 2005-08-23
header HIITS		subject =~ /\bHi\! It\'s\b/i
describe HIITS		hi its
score HIITS		3

# blarson 2005-08-23
header GOTONE		subject =~ /\bgot one$/i
describe GOTONE		got this spam already
score GOTONE		3

# blarson 2005-09-06
body IMMEDIATEREV	/^ATTENTION- For your immediate review:/
describe IMMEDIATEREV	immediate discard
score IMMEDIATEREV	3

# blarson 2005-09-12
body CLIENTALERT	/^(?:CLIENT ALERT|ATTENTION CLIENT)/i
describe CLIENTALERT	client alert
score CLIENTALERT	3

# cjwatson 2005-10-20
header DEBIANTUX23	From =~ /DebianTux23|wieseltux23/i
describe DEBIANTUX23	Linux spammer, sigh
score DEBIANTUX23	5

# blarson 2005-10-29
body SHITBRO		/^\s*sh[i1]+t\s+bro/i
describe SHITBRO	shitty spam
score SHITBRO		3

# blarson 2005-12-05
header POPPROG		subject =~ /popular programs for everyday use/i
describe POPPROG	unpopular spam
score POPPROG		3

# blarson 2006-02-03
body GREET		/^\%(?:GREET|EXIT)/
describe GREET		broken spamware
score GREET		3

# blarson 2006-10-18
header WROTE		subject =~ /\bwrote\:\s*$/i
describe WROTE		stock scam
score WROTE		2

body DEGREE_SPAM	/earn.+degree.+transcripts/i
describe DEGREE_SPAM	earn a degree with transcripts spam
score	 DEGREE_SPAM    2.5	

# blarson 2006-10-23
body BLUEPILL		/blue pill/i
describe BLUEPILL	Blue pill spam
score BLUEPILL		2

# blarson 2006-11-04
header PHOTOQUEST	subject =~ /question about your photo/i
describe PHOTOQUEST	questioning photo
score PHOTOQUEST	2

# blarson 2006-11-08
body KBDP		/Knowledge Based Degree Program/i
describe KBDP		degree spam
score KBDP		4

# blarson 2006-11-13
body CRITERIAHAS	/\bOur criteria has changed\b/i
describe CRITERIAHAS	Diploma salesman with bad english
score CRITERIAHAS	3

# blarson 2006-11-18
body TORA08		/\b\d{6}   \d{7}   \d{6}         \d             \d{7}   \d{7}/
describe TORA08		TORA.08 spam
score TORA08		3

# blarson 2006-11-21
body SERIOUSBRO		/^Seriously bro\b/i
describe SERIOUSBRO	Seriously bro
score SERIOUSBRO	3

# blarson 2006-12-06
body INSETET		/\bwilson\@insitetcnologia\.com\.br\b/
describe INSETET	please send spammer
score INSETET		4

# blarson 2006-12-09
body USUARIO		/\bEl usuario destinatario no es un usuario valido/
describe USUARIO	No such user -- sent in infinite loop
score	USUARIO		3

# don 2006-12-13
body NOMAILRECBI	/no recibi tu mail/i
describe NOMAILRECBI	No recbi of mail -- was closing way to many bugs
score	NOMAILRECBI	3

# blarson 2007-02-13
header URHELP		subject =~ /\bi need ur help\b/
describe URHELP		blank spam
score URHELP		3

# blarson 2006-12-08
header ACRO8PR0		subject =~ /\bAcr[0o]bat\s*[78]\s+(?:PR[0O]\b|\$?\d+\$?)/i
describe ACRO8PR0	sales spam
score ACRO8PR0	 	4	

# blarson 2007-10-05
body WBRS		/\b(WBRS|FPMC|ADYN|AFML|MISJ|HXPN|WHKA|CBFE|HSBC|PCAI|MPRG|HPRS|AUNI|TGVI|MHII|TAMG|GDKI|ACEN|CDYV|G7Q\.F|mbwc|CHFR|CDPN|DSDI|UTEV|P-S-U-D|GPSI|SGXI|CAON|SREA|ERMX|VPSN|SZSN|PAYI\.OB|LTDI|C\W\W?Y\W\W?T\W\W?V|E\WX\WM\WT|CYTV|VGPM|V\s?G\s?P\s?M(\.PK)?|wwng|WWNG|F\WD\WE\WG|FDEG|UTYW|M\s*I\s*H\s*I|O\W?N\W?C\W?O|P\W?P\W?Y\W?H|S\W?R\W?E\W?A|A\W?C\W?G\W?U|S\W?C\W?Y\W?F|C\W?H\W?V\W?C|D\W?M\W?X\W?C|F\W?R\W?L\W?E|M\W?A\W?K\W?U|C\W?W\W?T\W?E|F\W?R\W?L\W?E|M\W?X\W?X\W?R|P\W?R\W?T\W?H|A\W?L\W?L\W?U|C\W?W\W?T\W?D|T\W?A\W?D\W?F|D\W?M\W?H\W?N|C\W?A\W?O\W?N|Cwtd|N\W?C\W?S\W?H|F\W?R\W?L\W?E|M\W?A\W?K\W?U|d\W?m\W?h\W?n|T\W?R\W?T\W?M|[Ee]\W?[Tt]\W?[Gg]\W?[Uu]|P\W?E\W?R\W?T|EWIN|SXB\.F|OPLO|DCNM|mpix|MPIX|UCSO|TBCO)\b/
describe WBRS		stock spam
score WBRS		4

body FOURLA		/\b([A-Z]\s?){4}\b/
describe FOURLA		Four letter acronym (stock spam?)
score FOURLA		0.1

meta STOCKLIKE		(FOURLA && (MONEY || SUBJMONEY))
describe STOCKLIKE	Four letter acronyms with money; stock scam
score STOCKLIKE		1

# blarson 2007-01-26
header ACROBAT8		subject =~ /\badobe acr[o0]bat 8\b/i
describe ACROBAT8	more sales spam
score ACROBAT8		3

# blarson 2007-03-14
header VLSTA		subject =~ /VlSTA|0FFlCE|ACR0B8T/i
describe VLSTA		misspelled microshit software
score VLSTA		3

# blarson 2007-04-19
header ANGEKUEN		subject =~ /\bTrauer angekuendigt\b/
describe ANGEKUEN	german spam
score ANGEKUEN		3

# blarson 2007-05-06
body INTCAFE		/\binternet caff?e\b/i
describe INTCAFE	internet cafe spam
score INTCAFE		2

# blarson 2007-07-14
header VERIFIC		subject =~ /Your email requires verification/
describe VERIFIC	some people prefer you get their spam
score VERIFIC		3

# blarson 2007-07-14
header WHITELIST	subject =~ /You have been added to .* whitelist/
describe WHITELIST	whitelist spam
score WHITELIST		3

# blarson 2007-07-15
body CASNIO		/^Please be advised that your casnio account is still inactive/
describe CASNIO		casnio account
score CASNIO		3

# don 2007-07-17
header AUTOREPLY	subject =~ /\bauto(?:mated|matic|)[\s-]+re(?:spon[cs]e|ply)\b/i
describe AUTOREPLY	Automatic reply
score AUTOREPLY		2

# blarson 2007-07-18
body CONFSERV		/^Thanks for using our confidential service/
describe CONFSERV	confidential service
score CONFSERV		3

# blarson 2007-07-18
body CONTENC		/^Confirmation has been enclosed/
describe CONTENC	more pdf spam
score CONTENC		4

# blarson 2007-07-23
header PHONE		subject =~ /\b(tele)?phone\b/i
describe PHONE		phone spam
score PHONE		2

# blarson 2007-07-30
body ASPDF		/^We send our messages as Portable Document Format/
describe ASPDF		more pdf spam
score ASPDF		3

# blarson 2007-08-20
body DELAFT		/Please delete your private message after reading/
describe DELAFT		more pdf spam
score DELAFT		3

# blarson 2007-09-13
header OFF1CE		subject =~ /\b[O0Q]f+[1i7l|]ce\s*\W?2[O0Qk]+7\b/i
describe OFF1CE		off1ce spam
score OFF1CE		4

# blarson 2007-09-13
header SOFTSALE		subject =~ /\bsoftware sales\b/i
describe SOFTSALE	software spam
score SOFTSALE		3

# blarson 2007-09-18
body SUPERMACHO		/\bBe a supermacho/i
describe SUPERMACHO	supermacho
score SUPERMACHO	4

# blarson 2007-09-19
body BIGINTER		/\bBig international commercial organization\b/i
describe BIGINTER	job spam
score BIGINTER		4

# blarson 2007-09-20
header HASSENT		subject =~ /\b(?:sent you a (?:personal|confidential)?\s*(?:message|note))\b/i
describe HASSENT	sent a message
score HASSENT		4

# don 2008-04-19
header WANTTOCHAT	subject =~ /\b(?:(?:would like|wants|feels?) (?:to chat|like chatting|to keep up with you))\b/i
describe WANTTOCHAT	I want to chat/keep up with spam
score WANTTOCHAT	5.5

# blarson 2007-09-20
header ORDERNUM		subject =~ /\b(?:Order|Recipet)\s*.?\d{3,}/i
describe ORDERNUM	order number
score ORDERNUM		3

# don 2007-09-20
header DICTIONARYSEQ	subject =~ /\b(\w{3})\w*(?:\s+\1\w*){2}/i
describe DICTIONARYSEQ	Ventricular Vents Venting Ventures
score DICTIONARYSEQ	3.5

# blarson 2007-09-21
header NOLET		subject =~ /^\W{4,}$/
describe NOLET		swearing subject
score NOLET		2

# blarson 2007-09-21
body SSIST		/^ssistant Manager/
describe SSIST		ssistant Manager
score SSIST		4

# blarson 2007-09-21
body GRADUATEUNDER	/\bgraduate in under\b/i
describe GRADUATEUNDER	graduate in under
score GRADUATEUNDER	3

# blarson 2007-09-24
header NOINVEST		subject =~ /\b(?:no investment|high.paid)\b/i
describe NOINVEST	no investment
score NOINVEST		4

# blarson 2007-09-25
header INTEXP		subject =~ /\b[I|]nternet Exp[l|]orer\b/i
describe INTEXP		|nternet Exp|orer
score INTEXP		2

# don 2007-09-29
header WORKATHOME	subject =~ /work\Wat\Whome/i
describe WORKATHOME	Work at home
score WORKATHOME	4	

# don 2007-10-01
body PHONENUMBER	/\b1[\-\.\s]?8[07]+[\-\.\s]?\d+/
describe PHONENUMBER	Toll free phone number
score PHONENUMBER	1.5

# don 2007-10-02
body GERMANSPAM		/Zerix Intern/i
describe GERMANSPAM	Um... no clue what that is.
score GERMANSPAM	3

body URBANNEWS		/UrbaNNews\.ro/
describe URBANNEWS	URBANNEWS Newsletter
score URBANNEWS		3

# blarson 2007-10-05
header JOBS		subject =~ /\b(?:job|Employ(?:ers|ment|ee))s?\b/i
describe JOBS		job spam
score JOBS		1

# don 2007-10-09
header FREEPASSWORD	subject =~ /your\s*free\s*password/i
describe FREEPASSWORD	We don't need free password
score FREEPASSWORD	3

# don 2007-10-11
header AFRICABYBIKE	subject =~ /africa\s*by\s*bike/i
describe AFRICABYBIKE	We don't care about africa by bike or car or bus or train
score AFRICABYBIKE	4

# blarson 2007-10-14
header BRAKETDIGIT	subject =~ /\[\d+\]\:\s*$/
describe BRAKETDIGIT	braketed digit colon last in subject
score BRAKETDIGIT	2

# blarson 2007-10-14
full WHATISOEM		/\bWhat\s*is\s*OEM\b/i
describe WHATISOEM	What is OEM
score WHATISOEM		4

# blarson 2007-10-15
body WORKEXP		/\bwork\s+experience\s+degree\b/i
describe WORKEXP	work experience degree
score WORKEXP		3

# blarson 2007-10-24
body NICEGIRL		/\b(?:nice|young|lonley|unmarried)\s+(?:girl|woman|female)\b/i
describe NICEGIRL	nice girl
score NICEGIRL		3

# blarson 2007-10-18
header DFF1CE		subject =~ /UmU6INDSydfF1CE/i
describe DFF1CE		korean spam
score DFF1CE		4

# blarson 2007-10-23
header FAILNOTE		subject =~ /\bFailure notice\:/i
describe FAILNOTE	bounced spam
score FAILNOTE		4

# blarson 2007-10-25
full STILLSINGLE	/\bstill\s+single\b/i
describe STILLSINGLE	still single
score STILLSINGLE	2

# blarson 2007-10-26
header PERSONALCRED	subject =~ /\bPersonal\s+Credit/i
describe PERSONALCRED	Personal Credit
score PERSONALCRED	2

# blarson 2007-10-26
body XMASGIFT		/\b(?:christ|x)mas gift\b/
describe XMASGIFT	christmas gift
score XMASGIFT		2

# blarson 2007-10-26
body RONPAUL		/\bRon Paul\b/
describe RONPAUL	Ron Paul
score RONPAUL		3

# blarson 2007-10-27
body YOURJOB		/your Job Verification Number/
describe YOURJOB	your Job Verification Number
score YOURJOB		3

# blason 2007-10-28
body PASTERESUME	/\bPASTE your resume\b/i
describe PASTERESUME	PASTE your resume
score PASTERESUME	3

body LETHIHELO		/\{Let\:HI,Hi,Hello,hEllo,heLlo,helLo,hellO,HEllo\} how are you/
describe LETHIHELO	Hello, how are you
score LETHIHELO		4

# blarson 2007-10-29
body DIREKTOR		/Direktor of Softline/i
describe DIREKTOR	Direktor of Softline
score DIREKTOR		3

# blarson 2007-10-29
body THEDEG		/\bthe_degree\b/
describe THEDEG		the_degree
score THEDEG		3

# blason 2007-10-29
body DYNMH		/D Y N A M I C  M EDIA HOLDIN/
describe DYNMH		D Y N A M I C  M EDIA HOLDIN
score DYNMH		4

# blarson 2007-10-30
header LEGBUD		subject =~ /\b(?:Legal|smoking) Bud/i
describe LEGBUD		Legal Bud
score LEGBUD		4

# blarson 2007-10-30
full LEGBUD2		/\b(?:Legal|smoking) Bud/i
describe LEGBUD2	Legal Bud
score LEGBUD2		4

# blarson 2007-10-31
body SMOKING		/\b(?:beat|stop|quit|without)\s+(?:nicotine|smoking|cigarettes)\b/i
describe SMOKING	stop smoking
score SMOKING		3

# blarson 2007-11-04
header WORKHOME		subject =~ /\bwork\b.*\bhome\b/i
describe WORKHOME	work from home
score WORKHOME		2

# blarson 2007-11-04
header HOMEWORK		subject =~ /\bhome\b.*\b(?:work|business|job|based)\b/i
describe HOMEWORK	home business
score HOMEWORK		3

# blarson 2007-11-04
header REPRESENT	subject =~ /\bRepresent(?:ative)?\b.*\b(?:Country|needed)\b/i
describe REPRESENT	represent your country
score REPRESENT		2

# blarson 2007-11-06
header NOFEE		subject =~ /\bNo\s+fee\b/i
describe NOFEE		No fee
score NOFEE		2

# blarson 2007-11-07
body NEEDED		/\b(?:manager|executive)\b.*\bneeded\b/i
describe NEEDED		manager needed
score NEEDED		2

# blarson 2007-11-10
body CRETPROF		/\b(?:creative|perceptive)\b.*\bprofessionals?\b/i
describe CRETPROF	creative and perceptive professionals
score CRETPROF		2

# blarson 2007-11-15
body REMOVEDOT		/\b(?:Remove|erase|take (?:away|out)) (?:the dot\b|\W )/i
describe REMOVEDOT	Remove the dot
score REMOVEDOT		3

# blarson 2007-11-19
full VENTTRANS		/\bVent Transports\b/
describe VENTTRANS	Vent Transports
score VENTTRANS		4

# blarson 2007-11-19
body HOLIDAYHERE	/\bHolidays are here\b/i
describe HOLIDAYHERE	Holidays are here
score HOLIDAYHERE	3

# blarson 2007-11-22
header CAPINIT		subject =~ /^(?:Re:)?\s*(?:(?:[A-Z][a-z-\']+|PaintBrush|Jet (?:plane|fighter)|Tennis racquet|Leather jacket|IWC|\&|Jaeger-LeCoultre)\s+)+(?:[A-Z][a-z-]+|PaintBrush|Jet (?:plane|fighter)|Tennis racquet|Leather jacket)\s*$/
describe CAPINIT	Capinit Every Word
score CAPINIT		0.5

# blarson 2007-11-23
body REMOVESPACE	/\b(?:remove|w\/o|without|delete) spaces?\b/i
describe REMOVESPACE	w/o space
score REMOVESPACE	2

# blason 2007-11-27
header BEAHERO		subject =~ /Be a hero/
describe BEAHERO	Be a hero
score BEAHERO		4

# blarson 2007-11-28
header SOFTCHEAP	subject =~ /Soft and cheap/i
describe SOFTCHEAP	Soft and cheap
score SOFTCHEAP		3

# blarson 2007-11-30
body CHEAPSOFT		/\bcheap (?:OEM)?\s*soft(?:ware)?/i
describe CHEAPSOFT	cheap OEM soft
score CHEAPSOFT		2

# blarson 2007-11-30
header MAKEMONEY	subject =~ /\b(?:Make|need|extra)\s+(?:Cash|money|income)\b/i
describe MAKEMONEY	Make Cash
score MAKEMONEY		3

# blarson 2007-12-07
header PREVED		subject =~ /\bPreved\b/i
describe PREVED		Preved
score PREVED		3

# blarson 2007-12-08
body YOURPROFILE	/\byour profile\b/i
describe YOURPROFILE	your profile
score YOURPROFILE	2

# blarson 2007-12-09
body SEEKEMP		/\bseeking for employees\b/
describe SEEKEMP	seeking for employees
score SEEKEMP		3

# blarson 2007-12-27
body PRICELIST		/(?m:^(?:adobe|microsoft|intuit|autodesk|symantec)\W.*\b\d{2,}$){3,}/i
describe PRICELIST	list of prices
score PRICELIST		1

# blarson 2007-12-30
full OEMSOFT		/\b[O0]EM\s+s[o0][\W_]?ft_?(?:w_?a_?r_?e)?\b/i
describe OEMSOFT	OEM software
score OEMSOFT		2

# tviehmann 2008-07-20
full XORGBUGREPORTS     /\/usr\/lib\/xorg\/modules/
describe XORGBUGREPORTS ameliorate score of xorg bug reports matching OEMSOFT
score XORGBUGREPORTS    -5

# don 2008-02-23
body MSSOFTWARE		/(?:Microsoft|Windows) (?:Office Enterprise|Vista Ultimate)/i
describe MSSOFTWARE	Microsoft Office Enterprise/Vista Ultimate
score MSSOFTWARE	3

# blarson 2008-01-01
header NIGHTGIRL	subject =~ /\bnight\b.*\bgirlfriend\b/
describe NIGHTGIRL	night ... girlfriend
score NIGHTGIRL		3

body SITESUBJECT	/\bPlease see this site in Subject\b/i
describe SITESUBJECT	Pls check this new site
score SITESUBJECT	3

# tomv 2008-01-01
header PLSCHECKSITE	from =~ /\bPls check this new site\b/i
describe PLSCHECKSITE	Pls check this new site
score PLSCHECKSITE	4

# blarson 2008-01-03
header MARRYCH		subject =~ /\bMarry Christmas\b/
describe MARRYCH	Marry Christmas
score MARRYCH		3

# don 2008-01-7
header BUYTHEPRODUCT	subject =~ /Buy the product/i
describe BUYTHEPRODUCT	Buy the product subject
score BUYTHEPRODUCT	3

# blarson 2008-01-11
body IBERIS		/\bIberis Capital Group\b/
describe IBERIS		Iberis Capital Group
score IBERIS		4

# blarson 2008-01-18
header HIFROM		subject =~ /\b(?:hello|hi)\s+from/i
describe HIFROM		hello from
score HIFROM		3

# blarson 2008-01-22
body INTCORP		/\bInternational\s+corporation\b/i
describe INTCORP	International corporation
score INTCORP		2

# blarson 2008-01-23
header ISITYOU		subject =~ /\bis it you\b/i
describe ISITYOU	is it you
score ISITYOU		2

# blarson 2008-01-27
header CUSTOMERALERT	subject =~ /\bCustomer alert\b/i
describe CUSTOMERALERT	Customer alert
score CUSTOMERALERT	3

# blarson 2008-02-16
body SLASHITY		/^\s*\/\/\/.*\\\\\\\s*$/
describe SLASHITY	/// ... \\\ 
score SLASHITY		2

# blarson 2008-02-20
full OPENPOS		/\bopen\s*position/i
describe OPENPOS	open positions
score OPENPOS		3

# don 2008-02-23
header EBAYMEMBER	subject =~ /message from ebay member/i
describe EBAYMEMBER	Message from ebay member
score EBAYMEMBER	4

# blarson 2008-02-25
header RESPONSERES	subject =~ /\bResponse to Resume\b/i
describe RESPONSERES	Response to Resume
score RESPONSERES	3

# blarson 2008-02-29
body INTCOMP		/^International company/
describe INTCOMP	International company
score INTCOMP		3

# blarson 2008-03-04
header VIAGPHRA		subject =~ /\b(?:She want|in bed|love heaven|My hormones|the person|damn goood|more sexy|all night|seven heaven|pounds off|away pounds|She wants|beautiful women)\b/i
describe VIAGPHRA	misc spam phrases
score VIAGPHRA		4

# blarson 2008-03-05
body SEXHEALTH		/\bSexual Health/i
describe SEXHEALTH	Sexual Health
score SEXHEALTH		4

# blarson 2008-03-12
header ADEGREE		subject =~ /\b(a|some|quick)\s+degree\b/i
describe ADEGREE	a degree
score ADEGREE		3

# blarson 2008-03-12
rawbody PZIP		/\bfilename\=\"\w\w?\.zip\"/
describe PZIP		p.zip
score PZIP		3

# blarson 2008-03-13
header RETWO		subject =~ /RE\:(?: [ab][a-z\']+){2,3}\s*$/
describe RETWO		RE: bogus arbitrary
score RETWO		2

# don 2008-03-17
full SUBBODYREP		/Subject: (?:RE\:\s*)?([a-z]+)\s+([a-z]+)(?:\s+[a-z]+)\n.+\1\2/i
describe SUBBODYREP	Repeated word in subject and body without spaces
score SUBBODYREP	3

# don 2008-03-19
full MYMSNNAMEIS	/(?:add\s+me\s+on|my)\s+(?:msn|(?:live|msn|)\s*mess?enger|aim|aol|screen)\s+(?:name\s+)?(?:is)?\s+\S+\@\S+/i
describe MYMSNNAMEIS	My screen name is foo@bar.com
score MYMSNNAMEIS	2.5

# blarson 2008-03-20
body LONGWURL		/^[\w\-]{11,}\s+http\:\/\/[\w\.\-]{4,}\s*$/
describe LONGWURL	longWord URL
score LONGWURL		2

# blarson 2008-03-20
header ITCSTORE		subject =~ /ITC Store/
describe ITCSTORE	ITC Store
score ITCSTORE		4

# blarson 2008-03-26
header GENDER		subject =~ /\b(?:she|her|wom[ae]n|m[ae]n|girls?|males?|females?|herself|wife|ladies|lady|wives|(?:girl|boy)friends?)\b/i
describe GENDER		gender pronoun in subject
score GENDER		0.5

# blarson 2008-03-28
body REBODY		/^re\:\s/
describe REBODY		re: in body
score REBODY		2

# blarson 2008-04-01
header REREHI		subject =~ /^Re: Re: H(i|ello)\s*$/i
describe REREHI		Re: Re: Hi
score REREHI		3

# blarson 2008-04-10
header PEROFF		subject =~ /\d+\%\s+off\b/i
describe PEROFF		xx% off
score PEROFF		3

# blarson 2008-04-10
header SUMHERE		subject =~ /\b(?:summer|winter|fall|spring) is here\b/i
describe SUMHERE	summer is here
score SUMHERE		3

# don 2008-04-24
header INVITATIONFROM	subject =~ /^\s*(Invitation|Invitaci.n)\s*(from|curso)\s*\w+\s*$/i
describe INVITATIONFROM	Invitation from Spammer
score INVITATIONFROM	5

header INVITESYOU	subject =~ /^[\w\s]+(invites|communicates\s+with)\s+you\s+(to|about)[\w\s]+$/i
describe INVITESYOU	Invites or communicates me with spam
score INVITESYOU	5

# blarson 2008-04-28
header RERE		subject =~ /^Re\:\s+Re\:\s+/i
describe RERE		Re: Re:
score RERE			1

# don 2008-04-30
header CLAIMTICKETS	subject =~ /claim.+ticket/i
describe CLAIMTICKETS	Blah blah claim ticket
score CLAIMTICKETS	4

# don 2008-05-05
header WAITINGREPLY	subject =~ /waiting for your? (reply|to repsond|response)/i
describe WAITINGREPLY	Waiting for your reply
score WAITINGREPLY	4

# don 2008-05-15
body CONTACTUS		/contact us by email:/
score CONTACTUS		3
describe CONTACTUS	Don't contact us, we'll spam you

# don 2008-06-18
header FASHION		subject =~ /(?:(?:armani|gucci|chanel|boss|versache|ugg|dsquared)(?:\,\s*|$)){2,}/i
describe FASHION	Fashion designers in subject
score FASHION		2

# don 2008-07-30
header SCOUR		subject =~ /Scour(?:.com)? invite from/
describe SCOUR		Scour invite from some spammer
score SCOUR		3

# don 2008-09-04
body  YOURNAME		/\d+\)\s*y+o+u+r+\s*n+a+m+e+/i
describe YOURNAME	1) your name is spam
score YOURNAME		3

# blarson 2008-12-11
header TWITTER		subject =~ /you on Twitter/
describe TWITTER	Twitter invite spam
score TWITTER		4

# don 2008-12-18
uri DOS_LIVE_SPACES_CID	/cid-.{10,20}\.spaces\.live\.com/
describe DOS_LIVE_SPACES_CID	live spaces uri
score DOS_LIVE_SPACES_CID	3

# don 2008-12-18
header CHRISTMAS	subject =~ /chris+tma+s (pleasure+|night)/i
describe CHRISTMAS	Does christmas really give you pleasure?
score CHRISTMAS		2

# cord 2008-12-27 (transfered from rc.spam)
# don 2010-07-18 (decrease score from 4 to 2.5 for false positives)
full AWARD_WINNING	/Award win/i
describe AWARD_WINNING	Award win(ning); we don't believe that it is
score AWARD_WINNING	2.5

# don 2009-01-10
header LINKEDIN		from =~ /linkedin\.com/
describe LINKEDIN	Linked in spam
score LINKEDIN		4

# don 2009-02-02
header	LIFECHANGERS	from =~ /lifechangers/
describe LIFECHANGERS	Life changers spam
score LIFECHANGERS	4

# don 2009-02-05
header WINESEASON	subject =~ /Wine\s*Season\s*Promo/i
describe WINESEASON	Wine season spam
score WINESEASON	3

# don 2009-02-05
header JOINMEON		subject =~ /(?:friend request|join me) on/i
describe JOINMEON	Lets not join you on anything
score JOINMEON		2

# don 2009-02-09
header ABOUTAPARTMENT	subject =~/about\s*the\s*apartment/i
describe ABOUTAPARTMENT	We don't care about apartments
score ABOUTAPARTMENT	2

# don 2009-02-14
header YARISUBJECT	subject =~ /\byari\b/i
describe YARISUBJECT	Contains YARI in the subject
score YARISUBJECT	2

# don 2009-03-03
body HTMLCOMPATIBLE	/html\s+compatible\s+(?:e-?mail)?\s*(?:viewer|client)/i
describe HTMLCOMPATIBLE	If you want us to use an HTML compatible viewer, we don't want your mail.
score HTMLCOMPATIBLE	3

# zobel 2009-08-31
header AYDA10KILO	subject =~ /Ayda 10 Kilo Vermek Istermisiniz/i
describe AYDA10KILO     We don't care about Ayda 10 Kilo Vermek
score AYDA10KILO        4

# don 2010-08-21
body CANNOTVIEW		/cannot\s+view\s+this\s+email/i
describe CANNOTVIEW	If we cannot view this email, it must be spam
score CANNOTVIEW	4

# don 2010-09-24
header AAVEHICLE	subject =~ /vehicle check report/i
describe AAVEHICLE	The AA Vehicle check report is broken
score AAVEHICLE		4

# don 2010-12-27
header MODERNART	X-BeenThere =~ /group1\@modernartmagazine.com/i
describe MODERNART	Broken mailing list spamers
score MODERNART		5

# formorer 2011-01-07
header NYPOSTCARD	subject =~ /New Year postcard/i
describe NYPOSTCARD	Enough New Year cards for 2011
score	NYPOSTCARD 	4


# don 2011-01-24
header   BIZZBOOSTER	from =~ /bizzbooster/i
describe BIZZBOOSTER	From bizzbooster
score	 BIZZBOOSTER	5

# don 2011-09-22
header QUOTAEXP		subject =~ /mail\s+account(.+)quot[ae]\s+limit/
describe QUOTAEXP	Exceeded quota limit
score QUOTAEXP		4

# don 2011-09-22
body SEOBODY		/search\s+engine\s+traffic/
describe SEOBODY	Body contains SEO terms
score SEOBODY		1

header SEOSUBJECT	subject =~ /\bseo\b/i
describe SEOSUBJECT	Subject contains SEO terms
score SEOSUBJECT	1

meta SEOMETA		(SEOBODY && SEOSUBJECT)
describe SEOMETA	Matches both SEOBODY and SEOSUBJECT
score SEOMETA		3

body WEBINAR		/webinar/i
describe WEBINAR	Contains webinar
score WEBINAR		2


header TRIALVERSION	subject =~ /trial\s*version/i
describe TRIALVERSION	Trial version in subject
score TRIALVERSION	3

header SHARESPAM	subject =~ /shared photos with you/i
describe SHARESPAM 	shares photos
score SHARESPAM		3

header MYNAMEIS		subject =~ /hello(.*)my name is/i
describe MYNAMEIS	Name spam
score	MYNAMEIS	2.5

# formorer 2012-02-28
header VOTREANN     Subject =~ /(votre|Petites) annonce/i
describe VOTREANN   Votre annonce
score VOTREANN      4

# formorer 2010-01-23
header LEXCHANGE 	subject =~ /(?:for|4)\s+L[i1]nks?\s+E?xcha?nge/i
describe LEXCHANGE	ask for link exchange
score LEXCHANGE		4

# formorer 2013-11-08
header IMARKETING   subject =~ /integrated marketing/i
describe IMARKETING integrated marketing
score IMARKETING    4

header LYMBOOMATH   subject =~ /Lymboo Math/i
describe LYMBOOMATH Lymboo Math spam
score LYMBOOMATH    4

# formorer 2014-05-26
header JOB_DE1      subject =~ /(Freie Stellen|Stellenbeschreibungen)/
describe JOB_DE1    german job spam
score JOB_DE1       4

header TODAYSHOW    subject =~ /Today Show/i
describe TODAYSHOW  the today show
score TODAYSHOW     4

header LEADS    subject =~ /business leads/i
describe LEADS  business leads
score LEADS     4

header CLIENTS subject =~ /need more clients/i
describe CLIENTS need more clients
score CLIENTS 4