debian_pkg-listmaster/spamassassin_config/common/sare/70_sare_header1.cf

# SARE Header Abuse Ruleset for SpamAssassin -- file 1
# Version:  01.03.21
# Created:  2004-04-25
# Modified: 2006-05-21
# Usage instructions and documentation in 70_sare_header0.cf 

# Full Revision History / Change Log in 70_sare_header.log
#@@# 01.03.20  May 20 2005 
#@@#           Minor score updates based on additional mass-check
#@@#           Modified "rule has been moved" meta flags 
#@@#           Archived from file 1             SARE_FROM_SPAM_DOMN0
#@@#           Archived from file 1             SARE_HEAD_HDR_ALTREC
#@@#           Archived from file 1             SARE_HEAD_HDR_XBBOUNC
#@@#           Archived from file 1             SARE_HEAD_HDR_XLEGAL2
#@@#           Archived from file 1             SARE_HEAD_HDR_XLEGAL4
#@@#           Archived from file 1             SARE_HEAD_HDR_XMEBDOM
#@@#           Archived from file 1             SARE_HEAD_HDR_XWTID
#@@#           Archived from file 1             SARE_HEAD_HDR_XWTVERS
#@@#           Archived from file 1             SARE_HEAD_ORIG_RECIP
#@@#           Archived from file 1             SARE_RECV_IP_195229
#@@#           Moved file 0 to file 1           SARE_FREE_WEBM_EsTerra
#@@#           Moved file 0 to file 1           SARE_FROM_SPAM_NAME2A
#@@#           Moved file 0 to file 1           SARE_HEAD_DATE46
#@@#           Moved file 0 to file 1           SARE_HEAD_HDR_XEMAIL
#@@#           Moved file 0 to file 1           SARE_HEAD_MIME_INVALID
#@@#           Moved file 0 to file 1           SARE_RECV_IP_063106130
#@@#           Moved file 1 to file 0           SARE_HEAD_HDR_XLISTAD
#@@#           Moved file 1 to file 0           SARE_HEAD_MSMPR_RNDSTR
#@@#           Moved file 1 to file 0           SARE_RECV_IP_209190
#@@#           Moved file 1 to file 2           SARE_HEAD_DATE_RNDDATE
#@@#           Moved file 1 to file 2           SARE_HEAD_HDR_MSGTYPE
#@@#           Moved file 1 to file 2           SARE_HEAD_HDR_X400RCV
#@@#           Moved file 1 to file 2           SARE_HEAD_HDR_XCNDINF
#@@#           Moved file 1 to file 2           SARE_HEAD_HDR_XRIPE
#@@#           Moved file 1 to file 2           SARE_HEAD_HDR_XSAFMMI
#@@#           Moved file 1 to file 2           SARE_RECV_IP_062023
#@@#           Moved file 1 to file 2           SARE_RECV_IP_065205157
#@@#           Moved file 1 to file 2           SARE_RECV_IP_066248154
#@@#           Moved file 1 to file 2           SARE_RECV_IP_206248152
#@@#           Moved file 1 to file 2           SARE_RECV_RND_DATE
#@@#           Moved file 1 to file 2           SARE_XMAIL_GDI
#@@#           Moved file 1 to file 3           SARE_HEAD_DATE_5L
#@@#           Moved file 1 to file 3           SARE_HEAD_XWORD
#@@#           Moved file 1 to file 3           SARE_RECV_IP_063106130
#@@#           Moved file 1 to file 3           SARE_RECV_IP_064034
#@@#           Moved file 1 to file 3           SARE_XMAIL_GOMAIL
#@@#           Moved file 1 to file 3           SARE_XMAIL_TOLMAIL
#@@#           Moved from file 1 to 3           SARE_FROM_DVDCOPY
#@@#           Moved from file 1 to 3           SARE_RECV_FREESERVE
#@@#           Returned file 1 to file 0        SARE_HEAD_HDR_XTID
#@@#           Returned file 1 to file 0        SARE_RECV_IP_163125
#@@#           Returned file 2 to file 1        SARE_RECV_IP_142046
#@@# 01.03.21  May 21 2005 
#@@#           Minor repairs to "downgraded rule" metas. 

# License: Artistic - see http://www.rulesemporium.com/license.txt 
# Current Maintainer: Bob Menschel - RMSA@Menschel.net
# Current Home: http://www.rulesemporium.com/rules/70_sare_header1.cf 

########  ######################   ##################################################
#    Component rules used within meta rules 
########  ######################   ##################################################

header    __SARE_HEAD_8BIT_SUBJ    Subject =~ /[\x80-\xff]{3,}/

########  ######################   ##################################################
#    Meta rules used to prevent --lint errors after moving/changing rules
########  ######################   ##################################################

meta      __SARE_HEAD_FALSE        __FROM_AOL_COM && !__FROM_AOL_COM
meta      SARE_FREE_WEBM_CZSEZNA   __SARE_HEAD_FALSE
meta      SARE_FROM_MULTI_DASH     __SARE_HEAD_FALSE
meta      SARE_HEAD_DATE18         __SARE_HEAD_FALSE
meta      SARE_MSGID_LONG40        __SARE_HEAD_FALSE
meta      SARE_MSGID_LONG55        __SARE_HEAD_FALSE
meta      SARE_MULT_VIA_FWCATS     __SARE_HEAD_FALSE
meta      SARE_RECV_IP_064080      __SARE_HEAD_FALSE
meta      SARE_RECV_ISWEST         __SARE_HEAD_FALSE
meta      SARE_FROM_AMERICA        __SARE_HEAD_FALSE
meta      SARE_MSGID_06D6          __SARE_HEAD_FALSE
meta      SARE_RECV_IP_212164      __SARE_HEAD_FALSE
meta      SARE_BOUNDARY_MULTB      __SARE_HEAD_FALSE
meta      SARE_FROM_NUM_9DIG       __SARE_HEAD_FALSE
meta      SARE_FROM_PRINTER        __SARE_HEAD_FALSE
meta      SARE_HEAD_8BIT_NOSPM     __SARE_HEAD_FALSE
meta      SARE_HEAD_8BIT_SPAM      __SARE_HEAD_FALSE
meta      SARE_HEAD_HDR_XCCDIAG    __SARE_HEAD_FALSE
meta      SARE_HEAD_HDR_XMAILTH    __SARE_HEAD_FALSE
meta      SARE_HEAD_HDR_XSMTPSV    __SARE_HEAD_FALSE
meta      SARE_HEAD_HDR_XUMAIL     __SARE_HEAD_FALSE
meta      SARE_HELO_SERVER         __SARE_HEAD_FALSE
meta      SARE_MSGID_LONG35        __SARE_HEAD_FALSE
meta      SARE_MSGID_LONG65        __SARE_HEAD_FALSE
meta      SARE_MSGID_LONG75        __SARE_HEAD_FALSE
meta      SARE_RECV_IP_066111      __SARE_HEAD_FALSE
meta      SARE_RECV_SUSP_3         __SARE_HEAD_FALSE
meta      SARE_XMAIL_XMAIL         __SARE_HEAD_FALSE
meta      SARE_HEAD_HDR_XEMGBMS    __SARE_HEAD_FALSE
meta      SARE_HEAD_XCANIT1        __SARE_HEAD_FALSE
meta      SARE_HEAD_XCANIT2        __SARE_HEAD_FALSE
meta      SARE_MSGID_SPAM_DOMN0    __SARE_HEAD_FALSE
meta      SARE_MSGID_SUSP2         __SARE_HEAD_FALSE
meta      SARE_RECV_IP_081019      __SARE_HEAD_FALSE
meta      SARE_RECV_IP_211049      __SARE_HEAD_FALSE
meta      SARE_RECV_RND_NUMBER     __SARE_HEAD_FALSE
meta      SARE_FROM_NONAME         __SARE_HEAD_FALSE
meta      SARE_FROM_SPAM_CHAR0     __SARE_HEAD_FALSE
meta      SARE_HEAD_XCOM_RFCMIN    __SARE_HEAD_FALSE
meta      SARE_RECV_IP_080178      __SARE_HEAD_FALSE
meta      SARE_XMAIL_SUSP3         __SARE_HEAD_FALSE
meta      SARE_MSGID_DBL_AT        __SARE_HEAD_FALSE
meta      SARE_FREE_WEBM_USACOPS   __SARE_HEAD_FALSE
meta      SARE_FROM_SPAM_DOMN0     __SARE_HEAD_FALSE
meta      SARE_HEAD_HDR_ALTREC     __SARE_HEAD_FALSE
meta      SARE_HEAD_HDR_XBBOUNC    __SARE_HEAD_FALSE
meta      SARE_HEAD_HDR_XLEGAL2    __SARE_HEAD_FALSE
meta      SARE_HEAD_HDR_XLEGAL4    __SARE_HEAD_FALSE
meta      SARE_HEAD_HDR_XMEBDOM    __SARE_HEAD_FALSE
meta      SARE_HEAD_HDR_XWTID      __SARE_HEAD_FALSE
meta      SARE_HEAD_HDR_XWTVERS    __SARE_HEAD_FALSE
meta      SARE_HEAD_ORIG_RECIP     __SARE_HEAD_FALSE
meta      SARE_RECV_IP_195229      __SARE_HEAD_FALSE
meta      SARE_FREE_WEBM_EsTerra   __SARE_HEAD_FALSE
meta      SARE_FROM_SPAM_NAME2A    __SARE_HEAD_FALSE
meta      SARE_HEAD_DATE46         __SARE_HEAD_FALSE
meta      SARE_HEAD_HDR_XEMAIL     __SARE_HEAD_FALSE
meta      SARE_HEAD_MIME_INVALID   __SARE_HEAD_FALSE
meta      SARE_RECV_IP_063106130   __SARE_HEAD_FALSE
meta      SARE_HEAD_HDR_XLISTAD    __SARE_HEAD_FALSE
meta      SARE_HEAD_MSMPR_RNDSTR   __SARE_HEAD_FALSE
meta      SARE_RECV_IP_209190      __SARE_HEAD_FALSE
meta      SARE_HEAD_DATE_RNDDATE   __SARE_HEAD_FALSE
meta      SARE_HEAD_HDR_MSGTYPE    __SARE_HEAD_FALSE
meta      SARE_HEAD_HDR_X400RCV    __SARE_HEAD_FALSE
meta      SARE_HEAD_HDR_XCNDINF    __SARE_HEAD_FALSE
meta      SARE_HEAD_HDR_XRIPE      __SARE_HEAD_FALSE
meta      SARE_HEAD_HDR_XSAFMMI    __SARE_HEAD_FALSE
meta      SARE_RECV_IP_062023      __SARE_HEAD_FALSE
meta      SARE_RECV_IP_065205157   __SARE_HEAD_FALSE
meta      SARE_RECV_IP_066248154   __SARE_HEAD_FALSE
meta      SARE_RECV_IP_206248152   __SARE_HEAD_FALSE
meta      SARE_RECV_RND_DATE       __SARE_HEAD_FALSE
meta      SARE_XMAIL_GDI           __SARE_HEAD_FALSE
meta      SARE_HEAD_DATE_5L        __SARE_HEAD_FALSE
meta      SARE_HEAD_XWORD          __SARE_HEAD_FALSE
meta      SARE_RECV_IP_063106130   __SARE_HEAD_FALSE
meta      SARE_RECV_IP_064034      __SARE_HEAD_FALSE
meta      SARE_XMAIL_GOMAIL        __SARE_HEAD_FALSE
meta      SARE_XMAIL_TOLMAIL       __SARE_HEAD_FALSE
meta      SARE_FROM_DVDCOPY        __SARE_HEAD_FALSE
meta      SARE_RECV_FREESERVE      __SARE_HEAD_FALSE

#####################################################################################
#         SARE Header-Exists rules
########  ######################   ##################################################

header    SARE_HEAD_HDR_APPROV     exists:Approved
describe  SARE_HEAD_HDR_APPROV     Message headers used which identify spam
score     SARE_HEAD_HDR_APPROV     0.166
#hist     SARE_HEAD_HDR_APPROV     Moved file 0 to 1, version 01.03.09, 2 ham confirmed
#counts   SARE_HEAD_HDR_APPROV     0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_HEAD_HDR_APPROV     163s/0h of 114271 corpus (81068s/33203h RM) 01/15/05
#counts   SARE_HEAD_HDR_APPROV     1s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_HEAD_HDR_APPROV     0s/0h of 18196 corpus (15673s/2523h MY) 08/16/04
#counts   SARE_HEAD_HDR_APPROV     19s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_HEAD_HDR_APPROV     21s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_HEAD_HDR_APPROV     0s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_HEAD_HDR_APPROV     19s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_HEAD_HDR_APPROV     2s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_HEAD_HDR_APPROV     0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_HEAD_HDR_DISCREC    exists:Disclose-Recipients
describe  SARE_HEAD_HDR_DISCREC    Message headers used which identify spam
score     SARE_HEAD_HDR_DISCREC    0.772
#ham      SARE_HEAD_HDR_DISCREC    confirmed (4), Used by usdoj.gov
#counts   SARE_HEAD_HDR_DISCREC    1s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_HEAD_HDR_DISCREC    210s/0h of 114271 corpus (81068s/33203h RM) 01/15/05
#counts   SARE_HEAD_HDR_DISCREC    1s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_HEAD_HDR_DISCREC    0s/0h of 18196 corpus (15673s/2523h MY) 08/16/04
#counts   SARE_HEAD_HDR_DISCREC    32s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_HEAD_HDR_DISCREC    33s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_HEAD_HDR_DISCREC    0s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_HEAD_HDR_DISCREC    9s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_HEAD_HDR_DISCREC    4s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_HEAD_HDR_DISCREC    1s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_HEAD_HDR_XEMAIL     exists:X-EMail
describe  SARE_HEAD_HDR_XEMAIL     Message headers used which identify spam
score     SARE_HEAD_HDR_XEMAIL     1.666
#ham      SARE_HEAD_HDR_XEMAIL     confirmed (several, one source)
#counts   SARE_HEAD_HDR_XEMAIL     221s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_HEAD_HDR_XEMAIL     841s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HEAD_HDR_XEMAIL     78s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_HEAD_HDR_XEMAIL     0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_HEAD_HDR_XEMAIL     458s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_HEAD_HDR_XEMAIL     6s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06
#counts   SARE_HEAD_HDR_XEMAIL     0s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_HEAD_HDR_XEMAIL     0s/0h of 18196 corpus (15673s/2523h MY) 08/16/04

header    SARE_HEAD_HDR_XENC       exists:X-ENC
describe  SARE_HEAD_HDR_XENC       Message headers used which identify spam
score     SARE_HEAD_HDR_XENC       0.872
#stype    SARE_HEAD_HDR_XENC       spamp
#hist     SARE_HEAD_HDR_XENC       Created by Bob Menschel Sep 03 2004
#counts   SARE_HEAD_HDR_XENC       0s/0h of 273595 corpus (108821s/164774h RM) 05/13/05
#max      SARE_HEAD_HDR_XENC       19s/0h of 115509 corpus (81073s/34436h RM) 01/16/05
#counts   SARE_HEAD_HDR_XENC       0s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_HEAD_HDR_XENC       1s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_HEAD_HDR_XENC       0s/0h of 44754 corpus (16523s/28231h JH-SA3.0rc1) 09/06/04
#counts   SARE_HEAD_HDR_XENC       0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_HEAD_HDR_XENC       57s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_HEAD_HDR_XENC       0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    __HAS_RCVD               exists:Received
header    __SARE_HEAD_HDR_IDKEY    exists:X-Identity-Key
meta      SARE_HEAD_HDR_XIDKEY     __SARE_HEAD_HDR_IDKEY  && __HAS_RCVD
header    SARE_HEAD_HDR_XIDKEY     exists:X-Identity-Key
describe  SARE_HEAD_HDR_XIDKEY     Apparent spam sign in headers
score     SARE_HEAD_HDR_XIDKEY     1.666
#ham      SARE_HEAD_HDR_XIDKEY     verified (4)
#hist     SARE_HEAD_HDR_XIDKEY     Created by Chris Santerre Aug 31 2004
#counts   SARE_HEAD_HDR_XIDKEY     30s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_HEAD_HDR_XIDKEY     3611s/2h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HEAD_HDR_XIDKEY     232s/0h of 9991 corpus (5650s/4341h AxB) 05/14/06
#counts   SARE_HEAD_HDR_XIDKEY     68s/2h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_HEAD_HDR_XIDKEY     0s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#counts   SARE_HEAD_HDR_XIDKEY     104s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_HEAD_HDR_XIDKEY     367s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_HEAD_HDR_XIDKEY     859s/1h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    __SARE_HEAD_HDR_XLEGAL   exists:X-Legal
header    __SARE_HEAD_HDR_XLEGAC   X-Legal =~ m'copyright|\(c\)'i
header    __SARE_HEAD_HDR_XLEGAI   X-Legal =~ m'in compliance'i
header    __SARE_HEAD_HDR_XLEGAB   X-Legal =~ m'BE ADVISED'i
meta      SARE_HEAD_HDR_XLEGAL1    __SARE_HEAD_HDR_XLEGAB && __SARE_HEAD_HDR_XLEGAI && !__SARE_HEAD_HDR_XLEGAC
describe  SARE_HEAD_HDR_XLEGAL1    Message headers used which identify spam
score     SARE_HEAD_HDR_XLEGAL1    1.666
#stype    SARE_HEAD_HDR_XLEGAL1    spamgg
#hist     SARE_HEAD_HDR_XLEGAL1    Bob Menschel, Aug 07 2005
#counts   SARE_HEAD_HDR_XLEGAL1    0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_HEAD_HDR_XLEGAL1    7s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HEAD_HDR_XLEGAL1    0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
#counts   SARE_HEAD_HDR_XLEGAL1    1s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_HEAD_HDR_XLEGAL1    0s/0h of 7500 corpus (1767s/5733h ft) 09/18/05

meta      SARE_HEAD_HDR_XLEGAL3    __SARE_HEAD_HDR_XLEGAL && !SARE_HEAD_HDR_XLEGAL1 && !__SARE_HEAD_HDR_XLEGAC
describe  SARE_HEAD_HDR_XLEGAL3    Message headers used which identify spam
score     SARE_HEAD_HDR_XLEGAL3    1.666
#stype    SARE_HEAD_HDR_XLEGAL3    spamgg
#hist     SARE_HEAD_HDR_XLEGAL3    Bob Menschel, Aug 07 2005
#counts   SARE_HEAD_HDR_XLEGAL3    1s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#counts   SARE_HEAD_HDR_XLEGAL3    0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
#counts   SARE_HEAD_HDR_XLEGAL3    0s/0h of 7500 corpus (1767s/5733h ft) 09/18/05

header    SARE_HEAD_HDR_XMAILID    exists:X-Mailid
describe  SARE_HEAD_HDR_XMAILID    Message headers used which identify spam
score     SARE_HEAD_HDR_XMAILID    1.666
#ham      SARE_HEAD_HDR_XMAILID    confirmed
#counts   SARE_HEAD_HDR_XMAILID    248s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#counts   SARE_HEAD_HDR_XMAILID    4s/0h of 9991 corpus (5650s/4341h AxB) 05/14/06
#counts   SARE_HEAD_HDR_XMAILID    0s/0h of 18196 corpus (15673s/2523h MY) 08/16/04
#counts   SARE_HEAD_HDR_XMAILID    0s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_HEAD_HDR_XMAILID    0s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#was      SARE_HEAD_HDR_XMAILID    0s/3h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_HEAD_HDR_XMAILID    5s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_HEAD_HDR_XMLRSRV    exists:X-Mailer-Server
describe  SARE_HEAD_HDR_XMLRSRV    Message headers used which identify spam
score     SARE_HEAD_HDR_XMLRSRV    0.555 
#ham      SARE_HEAD_HDR_XMLRSRV    verified (1)
#counts   SARE_HEAD_HDR_XMLRSRV    2s/5h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_HEAD_HDR_XMLRSRV    67s/10h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HEAD_HDR_XMLRSRV    0s/0h of 18196 corpus (15673s/2523h MY) 08/16/04
#counts   SARE_HEAD_HDR_XMLRSRV    0s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_HEAD_HDR_XMLRSRV    0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_HEAD_HDR_XMLRSRV    84s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_HEAD_HDR_XMLRSRV    0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_HEAD_HDR_XRESPID    exists:X-Response-ID
describe  SARE_HEAD_HDR_XRESPID    Message headers used which identify spam
score     SARE_HEAD_HDR_XRESPID    0.528
#ham      SARE_HEAD_HDR_XRESPID    confirmed (1) 
#counts   SARE_HEAD_HDR_XRESPID    0s/1h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_HEAD_HDR_XRESPID    35s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HEAD_HDR_XRESPID    18s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_HEAD_HDR_XRESPID    0s/0h of 18196 corpus (15673s/2523h MY) 08/16/04
#counts   SARE_HEAD_HDR_XRESPID    0s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_HEAD_HDR_XRESPID    0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_HEAD_HDR_XRESPID    1s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_HEAD_HDR_XSIDPRA    exists:X-SID-PRA
describe  SARE_HEAD_HDR_XSIDPRA    fingerprint
score     SARE_HEAD_HDR_XSIDPRA    0.616
#ham      SARE_HEAD_HDR_XSIDPRA    confirmed 
#hist     SARE_HEAD_HDR_XSIDPRA    Alex Broens, Aug 3 2005
#counts   SARE_HEAD_HDR_XSIDPRA    3s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_HEAD_HDR_XSIDPRA    113s/4h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HEAD_HDR_XSIDPRA    2s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_HEAD_HDR_XSIDPRA    0s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_HEAD_HDR_XSIDPRA    3s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
#counts   SARE_HEAD_HDR_XSIDPRA    3s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06

header    SARE_HEAD_HDR_XSIDRES    exists:X-SID-Result
describe  SARE_HEAD_HDR_XSIDRES    fingerprint
score     SARE_HEAD_HDR_XSIDRES    0.616
#ham      SARE_HEAD_HDR_XSIDRES    confirmed 
#hist     SARE_HEAD_HDR_XSIDRES    Alex Broens, Aug 3 2005
#counts   SARE_HEAD_HDR_XSIDRES    3s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_HEAD_HDR_XSIDRES    113s/4h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HEAD_HDR_XSIDRES    2s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_HEAD_HDR_XSIDRES    0s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_HEAD_HDR_XSIDRES    3s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
#counts   SARE_HEAD_HDR_XSIDRES    3s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06

#####################################################################################
#         SARE Content-Type and Boundary rules
########  ######################   ##################################################

header    SARE_BOUNDARY_05         Content-Type =~ /boundary="-{8}[a-z]{20}"/
describe  SARE_BOUNDARY_05         Content type boundary used in spam 
score     SARE_BOUNDARY_05         1.666  
#stype    SARE_BOUNDARY_05         vbggg
#hist     SARE_BOUNDARY_05         Moved from file 0 to 1 May 2005
#counts   SARE_BOUNDARY_05         0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_BOUNDARY_05         451s/0h of 66979 corpus (41757s/25222h RM) 09/04/04
#counts   SARE_BOUNDARY_05         0s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_BOUNDARY_05         5s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_BOUNDARY_05         6s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_BOUNDARY_05         4s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_BOUNDARY_05         9s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_BOUNDARY_05         0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_BOUNDARY_06         Content-Type =~ /boundary="Boundary_\w{5}_\w{4}_\w{23}"/i
describe  SARE_BOUNDARY_06         Content type boundary used in spam 
score     SARE_BOUNDARY_06         1.666
#stype    SARE_BOUNDARY_06         vbggg
#hist     SARE_BOUNDARY_06         Created by Bob Menschel May 4 2004
#hist     SARE_BOUNDARY_06         Moved from file 0 to 1 May 2005
#counts   SARE_BOUNDARY_06         36s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_BOUNDARY_06         84s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_BOUNDARY_06         0s/0h of 32586 corpus (9341s/23245h JH) 06/10/04
#counts   SARE_BOUNDARY_06         0s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_BOUNDARY_06         0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_BOUNDARY_06         0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_BOUNDARY_08         Content-Type =~ /boundary="[\.\_]*(?:[A-Z\d]+[\.\_]+){4,20}[A-Z\d]*\"/s
describe  SARE_BOUNDARY_08         Improbable MIME boundary format
score     SARE_BOUNDARY_08         1.666
#hist     SARE_BOUNDARY_08         LW_BOUNDARY1
#ham      SARE_BOUNDARY_08         ServiceMagic <customerservice@servicemagic.com>, 2001
#ham      SARE_BOUNDARY_08         verizon wireless picture phone transmission
#counts   SARE_BOUNDARY_08         613s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_BOUNDARY_08         5929s/6h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_BOUNDARY_08         38s/3h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_BOUNDARY_08         15s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_BOUNDARY_08         228s/0h of 38398 corpus (14914s/23484h JH) 08/14/04 TM2 SA3.0-pre2
#counts   SARE_BOUNDARY_08         0s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#max      SARE_BOUNDARY_08         1s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_BOUNDARY_08         1s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_BOUNDARY_08         18s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_BOUNDARY_08         826s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_BOUNDARY_08         243s/2h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_BOUNDARY_D10        Content-Type =~ /boundary="\d{10}"/
describe  SARE_BOUNDARY_D10        Content type boundary used in spam or virus
score     SARE_BOUNDARY_D10        0.444
#ham      SARE_BOUNDARY_D10        verified (1) 
#hist     SARE_BOUNDARY_D10        Created by Bob Menschel May 31 2004
#counts   SARE_BOUNDARY_D10        0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_BOUNDARY_D10        134s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_BOUNDARY_D10        3s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_BOUNDARY_D10        0s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#counts   SARE_BOUNDARY_D10        0s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_BOUNDARY_D10        5s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#counts   SARE_BOUNDARY_D10        5s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_BOUNDARY_D10        0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_BOUNDARY_LC         Content-Type =~ /boundary="(?!ffff)[a-z]+"/
describe  SARE_BOUNDARY_LC         Content type boundary used in spam 
score     SARE_BOUNDARY_LC         1.666
#ham      SARE_BOUNDARY_LC         questionable newsletters
#hist     SARE_BOUNDARY_LC         Created by Bob Menschel May 31 2004
#ham      SARE_BOUNDARY_LC         "ffff": Game Rival <newsletter@gamerival.com>, ThePerfectGreeting <updates@perfectgreeting.com>
#counts   SARE_BOUNDARY_LC         0s/3h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_BOUNDARY_LC         899s/4h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_BOUNDARY_LC         44s/2h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_BOUNDARY_LC         83s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_BOUNDARY_LC         0s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_BOUNDARY_LC         0s/1h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_BOUNDARY_LC         125s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_BOUNDARY_LC         15s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_BOUNDARY_LC         0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_BOUNDARY_NP2        Content-Type =~ /boundary=".*_NextPart_.*_NextPart_/
describe  SARE_BOUNDARY_NP2        Content type boundary used in spam and viruses
score     SARE_BOUNDARY_NP2        4.000
#stype    SARE_BOUNDARY_NP2        vbg
#hist     SARE_BOUNDARY_NP2        Created by Bob Menschel May 31 2004
#hist     SARE_BOUNDARY_NP2        Bugzilla entry 3861, Oct 03 2004
#counts   SARE_BOUNDARY_NP2        0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_BOUNDARY_NP2        1118s/0h of 68491 corpus (41115s/27376h RM) 09/18/04
#counts   SARE_BOUNDARY_NP2        7s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#max      SARE_BOUNDARY_NP2        37s/0h of 32586 corpus (9341s/23245h JH) 06/10/04
#counts   SARE_BOUNDARY_NP2        0s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_BOUNDARY_NP2        0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_BOUNDARY_NP2        0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

#####################################################################################
#         SARE From Rules 
########  ######################   ##################################################

header    SARE_FROM_AST            From =~ /<\*\@.{1,50}\..{1,3}/
describe  SARE_FROM_AST            Invalid character in email address
score     SARE_FROM_AST            0.666
#hist     SARE_FROM_AST            Originally submitted by Fred Tarasevicius
#hist     SARE_FROM_AST            Returned from file 2 to file 1 Oct 2005
#counts   SARE_FROM_AST            0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FROM_AST            20s/0h of 89541 corpus (67467s/22074h RM) 05/28/04
#counts   SARE_FROM_AST            0s/0h of 32586 corpus (9341s/23245h JH) 06/10/04
#counts   SARE_FROM_AST            0s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_FROM_AST            0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_FROM_AST            0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_FROM_CAPS_MSN       From =~ /"[^"]+" <[A-Z]+\@msn.com>/   # no /i 
describe  SARE_FROM_CAPS_MSN       Ratware all-caps MSN from address
score     SARE_FROM_CAPS_MSN       0.828
#ham      SARE_FRMO_CAPS_MSN       verified (3)
#hist     SARE_FROM_CAPS_MSN       Created by Bob Menschel May 15 2004
#counts   SARE_FROM_CAPS_MSN       18s/3h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FROM_CAPS_MSN       421s/0h of 85084 corpus (62489s/22595h RM) 06/08/04
#counts   SARE_FROM_CAPS_MSN       4s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_FROM_CAPS_MSN       48s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_FROM_CAPS_MSN       102s/0h of 38398 corpus (14914s/23484h JH) 08/14/04 TM2 SA3.0-pre2
#counts   SARE_FROM_CAPS_MSN       6s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#max      SARE_FROM_CAPS_MSN       59s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_FROM_CAPS_MSN       28s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_FROM_CAPS_MSN       51s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_FROM_CAPS_MSN       61s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FROM_CAPS_MSN       28s/1h of 42275 corpus (34158s/8117h FVGT) 05/15/06
	
header    SARE_FROM_DRUGS2         From =~ /\bsoma\b/i
describe  SARE_FROM_DRUGS2         From a drug
score     SARE_FROM_DRUGS2         0.644
#ham      SARE_FROM_DRUGS2         verified (3) 
#hist     SARE_FROM_DRUGS2         Bob Menschel June 25 2005; ham email from userid = soma
#counts   SARE_FROM_DRUGS2         1s/1h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FROM_DRUGS2         79s/3h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_FROM_DRUGS2         0s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06
#max      SARE_FROM_DRUGS2         2s/0h of 6924 corpus (1403s/5521h ft) 07/27/05
#counts   SARE_FROM_DRUGS2         20s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FROM_DRUGS2         62s/0h of 47809 corpus (43224s/4585h MY) 07/27/05
#counts   SARE_FROM_DRUGS2         0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
#counts   SARE_FROM_DRUGS2         11s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06

header    FROM_BLANK_NAME          From =~ /(?:\s|^)"" <\S+>/i  # SA 3.1.0
header    __SARE_FROM_NONAME       From =~ /"" ?</
meta      SARE_FROM_NONAME         __SARE_FROM_NONAME && !FROM_BLANK_NAME
score     SARE_FROM_NONAME         1.294
#hist     SARE_FROM_NONAME         Created by Fred Tarasevicius 
#overlap  SARE_FROM_NONAME         SARE rule catches spam missed by SA rule. Use meta to avoid duplication
#counts   SARE_FROM_NONAME         256s/2h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FROM_NONAME         371s/12h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_FROM_NONAME         1s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_FROM_NONAME         11s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_FROM_NONAME         129s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FROM_NONAME         2s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_FROM_SPAM_DOMN0Y    From =~ /\byahoo\.net/i
describe  SARE_FROM_SPAM_DOMN0Y    From address suggests this is spam
score     SARE_FROM_SPAM_DOMN0Y    0.555
#ham      SARE_FROM_SPAM_DOMN0Y    confirmed: 1 yahoo.net, perhaps a user's error
#counts   SARE_FROM_SPAM_DOMN0Y    0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FROM_SPAM_DOMN0Y    36s/0h of 114271 corpus (81068s/33203h RM) 01/15/05

header    __SARE_FROM_SPAM_MONY1   From =~ /money.*\@/i
header    __SARE_FROM_SPAM_MONY2   From =~ /money\S*\@/i
meta      SARE_FROM_SPAM_MONEY     __SARE_FROM_SPAM_MONY2
describe  SARE_FROM_SPAM_MONEY     From address suggests this is spam
score     SARE_FROM_SPAM_MONEY     1.208
#ham      SARE_FROM_SPAM_MONEY     confirmed (1) 
#addsto   SARE_FROM_SPAM_MONEY     SARE_FROM_SPAM_MONEY2  
#hist     SARE_FROM_SPAM_MONEY     RM_fw_Money. Meta created Aug 20 2004 to improve scoring.
#counts   SARE_FROM_SPAM_MONEY     257s/8h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FROM_SPAM_MONEY     249s/5h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_FROM_SPAM_MONEY     68s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_FROM_SPAM_MONEY     4s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_FROM_SPAM_MONEY     14s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FROM_SPAM_MONEY     31s/0h of 47809 corpus (43224s/4585h MY) 07/27/05
#counts   SARE_FROM_SPAM_MONEY     3s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_FROM_SPAM_MONEY     33s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#counts   SARE_FROM_SPAM_MONEY     693s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FROM_SPAM_MONEY     18s/0h of 6924 corpus (1403s/5521h ft) 07/27/05

header    __SARE_FROM_SPAM_MONY1   From =~ /money.*\@/i
header    __SARE_FROM_SPAM_MONY2   From =~ /money\S*\@/i
meta      SARE_FROM_SPAM_MONEY2    __SARE_FROM_SPAM_MONY1 && !__SARE_FROM_SPAM_MONY2
describe  SARE_FROM_SPAM_MONEY2    From address suggests this is spam
score     SARE_FROM_SPAM_MONEY2    0.890
#ham      SARE_FROM_SPAM_MONEY2    Valid end-users with "money" in their display name
#counts   SARE_FROM_SPAM_MONEY2    84s/1h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FROM_SPAM_MONEY2    290s/7h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_FROM_SPAM_MONEY2    33s/1h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_FROM_SPAM_MONEY2    1s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_FROM_SPAM_MONEY2    61s/3h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FROM_SPAM_MONEY2    62s/3h of 47809 corpus (43224s/4585h MY) 07/27/05
#counts   SARE_FROM_SPAM_MONEY2    0s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_FROM_SPAM_MONEY2    12s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#counts   SARE_FROM_SPAM_MONEY2    176s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FROM_SPAM_MONEY2    6s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_FROM_SPAM_NAME0     From =~ /(?:Direct Marketing|FreeOffers|FunBenefits|salestonight|WESTEC SALES|\bWSEAS\b)/i
describe  SARE_FROM_SPAM_NAME0     From address suggests this is spam
score     SARE_FROM_SPAM_NAME0     3.333
#stype    SARE_FROM_SPAM_NAME0     spamg
#hist     SARE_FROM_SPAM_NAME0     COMBINED.FROM and other sources
#counts   SARE_FROM_SPAM_NAME0     0s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#max      SARE_FROM_SPAM_NAME0     369s/0h of 85084 corpus (62489s/22595h RM) 06/08/04
#counts   SARE_FROM_SPAM_NAME0     0s/0h of 32586 corpus (9341s/23245h JH) 06/10/04
#counts   SARE_FROM_SPAM_NAME0     0s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_FROM_SPAM_NAME0     0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_FROM_SPAM_NAME0     12s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FROM_SPAM_NAME0     16s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_FROM_SPAM_NAME2A    From =~ /\bfunpage\b/i
describe  SARE_FROM_SPAM_NAME2A    From address suggests this is spam
score     SARE_FROM_SPAM_NAME2A    0.111
#stype    SARE_FROM_SPAM_NAME2A    spamp
#hist     SARE_FROM_SPAM_NAME2A    COMBINED.FROM and other sources
#counts   SARE_FROM_SPAM_NAME2A    0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#counts   SARE_FROM_SPAM_NAME2A    0s/0h of 13303 corpus (7429s/5874h CT) 05/14/06
#counts   SARE_FROM_SPAM_NAME2A    2s/0h of 105832 corpus (72573s/33259h ML) 05/14/06

header    SARE_FROM_SPAM_PL1       From =~ /\@tpnet\.pl\b/
describe  SARE_FROM_SPAM_PL1       A lot of spam comes from here
score     SARE_FROM_SPAM_PL1       0.500
#stype    SARE_FRMO_SPAM_PL1       max:0.5      # possible valid ISP in Poland
#hist     SARE_FROM_SPAM_PL1       Loren Wilton, Feb 21 2005
#counts   SARE_FROM_SPAM_PL1       2s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FROM_SPAM_PL1       26s/0h of 400432 corpus (178148s/222284h RM) 03/31/05
#counts   SARE_FROM_SPAM_PL1       14s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_FROM_SPAM_PL1       0s/0h of 54179 corpus (17002s/37177h JH-3.01) 03/01/05
#counts   SARE_FROM_SPAM_PL1       0s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FROM_SPAM_PL1       6s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_FROM_SPAM_PL1       0s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#max      SARE_FROM_SPAM_PL1       1s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_FROM_SPAM_PL1       12s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FROM_SPAM_PL1       0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_FROM_SPAM_WORD2     From =~ /\b(?:^high.?speed|interacial)\b/i
describe  SARE_FROM_SPAM_WORD2     From address suggests this is spam
score     SARE_FROM_SPAM_WORD2     0.555
#stype    SARE_FRM_SPAM_WORD2      spamp
#hist     SARE_FROM_SPAM_WORD2     COMBINED.FROM and other sources
#counts   SARE_FROM_SPAM_WORD2     0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FROM_SPAM_WORD2     9s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_FROM_SPAM_WORD2     0s/0h of 32586 corpus (9341s/23245h JH) 06/10/04
#counts   SARE_FROM_SPAM_WORD2     0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_FROM_SPAM_WORD2     3s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FROM_SPAM_WORD2     0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

#####################################################################################
#         SARE From Rules -- Emails coming from free webmail accounts
#         Since spam from these can vary depending upon country of origin, 
#         country of destination, policies, and enforcement of policies, 
#         most of these are kept as separate rules rather than combined. 
########  ######################   ##################################################

header    SARE_FREE_WEBM_BIGMAIL   From =~ /\bbigmailbox\.com/i
describe  SARE_FREE_WEBM_BIGMAIL   Sender used free email account - may be spammer
score     SARE_FREE_WEBM_BIGMAIL   0.667
#counts   SARE_FREE_WEBM_BIGMAIL   14s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#counts   SARE_FREE_WEBM_BIGMAIL   2s/0h of 9991 corpus (5650s/4341h AxB) 05/14/06
#counts   SARE_FREE_WEBM_BIGMAIL   0s/0h of 32586 corpus (9341s/23245h JH) 06/10/04
#counts   SARE_FREE_WEBM_BIGMAIL   0s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FREE_WEBM_BIGMAIL   4s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_FREE_WEBM_BIGMAIL   0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_FREE_WEBM_BIGMAIL   0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_FREE_WEBM_EsTerra   From =~ /\bterra\.es/i
describe  SARE_FREE_WEBM_EsTerra   Sender used free email account - may be spammer
score     SARE_FREE_WEBM_EsTerra   1.666
#counts   SARE_FREE_WEBM_EsTerra   4s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_EsTerra   228s/0h of 274235 corpus (109066s/165169h RM) 05/15/05
#counts   SARE_FREE_WEBM_EsTerra   2s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_FREE_WEBM_EsTerra   8s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_FREE_WEBM_EsTerra   0s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FREE_WEBM_EsTerra   6s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_FREE_WEBM_EsTerra   0s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_FREE_WEBM_EsTerra   2s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_FREE_WEBM_EsTerra   6s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FREE_WEBM_EsTerra   0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_FREE_WEBM_FrVoila   From =~ /\bvoila\.fr/i
describe  SARE_FREE_WEBM_FrVoila   Sender used free email account - may be spammer
score     SARE_FREE_WEBM_FrVoila   0.444
#ham      SARE_FREE_WEBM_FrVoila   confirmed: 1
#counts   SARE_FREE_WEBM_FrVoila   0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_FrVoila   40s/0h of 400432 corpus (178148s/222284h RM) 03/31/05
#counts   SARE_FREE_WEBM_FrVoila   2s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_FREE_WEBM_FrVoila   2s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_FREE_WEBM_FrVoila   0s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#max      SARE_FREE_WEBM_FrVoila   3s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_FREE_WEBM_FrVoila   1s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_FREE_WEBM_FrVoila   3s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FREE_WEBM_FrVoila   0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_FREE_WEBM_Jpop      From =~ /\bjpopmail\.com/i 
describe  SARE_FREE_WEBM_Jpop      Sender used free email account - may be spammer 
score     SARE_FREE_WEBM_Jpop      0.989
#counts   SARE_FREE_WEBM_Jpop      0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_Jpop      66s/0h of 125163 corpus (104972s/20191h) 03/28/04
#counts   SARE_FREE_WEBM_Jpop      1s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_FREE_WEBM_Jpop      1s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_FREE_WEBM_Jpop      1s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FREE_WEBM_Jpop      2s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_FREE_WEBM_Jpop      0s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#max      SARE_FREE_WEBM_Jpop      1s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_FREE_WEBM_Jpop      3s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FREE_WEBM_Jpop      4s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_FREE_WEBM_MailD     From =~ /mail\d{1,3}\.com/i
describe  SARE_FREE_WEBM_MailD     Sender used free email account - may be spammer
score     SARE_FREE_WEBM_MailD     1.485
#ham      SARE_FREE_WEBM_MailD     questionable
#counts   SARE_FREE_WEBM_MailD     124s/2h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_MailD     2051s/4h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_FREE_WEBM_MailD     10s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_FREE_WEBM_MailD     21s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_FREE_WEBM_MailD     27s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_FREE_WEBM_MailD     31s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FREE_WEBM_MailD     75s/0h of 47283 corpus (43206s/4077h MY) 06/05/05
#counts   SARE_FREE_WEBM_MailD     10s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_FREE_WEBM_MailD     234s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FREE_WEBM_MailD     72s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_FREE_WEBM_Mailexc   From =~ /\bmailexcite\.com/i
describe  SARE_FREE_WEBM_Mailexc   Sender used free email account - may be spammer 
score     SARE_FREE_WEBM_Mailexc   0.889
#ham      SARE_FREE_WEMB_Mailexc   verified (6)
#counts   SARE_FREE_WEBM_Mailexc   2s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_Mailexc   44s/0h of 125163 corpus (104972s/20191h) 03/28/04
#counts   SARE_FREE_WEBM_Mailexc   4s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_FREE_WEBM_Mailexc   5s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_FREE_WEBM_Mailexc   1s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FREE_WEBM_Mailexc   7s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_FREE_WEBM_Mailexc   2s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#counts   SARE_FREE_WEBM_Mailexc   40s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FREE_WEBM_Mailexc   6s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_FREE_WEBM_NETCITY   From =~ /\@netcity\w+\.com/i
describe  SARE_FREE_WEBM_NETCITY   Maybe spammer with free email
score     SARE_FREE_WEBM_NETCITY   1.111
#stype    SARE_FREE_WEBM_NETCITY   spamp
#hist     SARE_FREE_WEBM_NETCITY   Created by Bob Menschel Aug 20 2004
#counts   SARE_FREE_WEBM_NETCITY   2s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_NETCITY   12s/0h of 115509 corpus (81073s/34436h RM) 01/16/05
#counts   SARE_FREE_WEBM_NETCITY   1s/0h of 9991 corpus (5650s/4341h AxB) 05/14/06
#counts   SARE_FREE_WEBM_NETCITY   4s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_FREE_WEBM_NETCITY   1s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FREE_WEBM_NETCITY   2s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_FREE_WEBM_NETCITY   0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_FREE_WEBM_NETCITY   2s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FREE_WEBM_NETCITY   0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_FREE_WEBM_NetFs     From =~ /\bfsmail\.net/i
describe  SARE_FREE_WEBM_NetFs     Sender used free email account - may be spammer
score     SARE_FREE_WEBM_NetFs     0.500
#ham      SARE_FREE_WEBM_NetFs     confirmed (1)
#counts   SARE_FREE_WEBM_NetFs     0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_NetFs     129s/0h of 125163 corpus (104972s/20191h) 03/28/04
#counts   SARE_FREE_WEBM_NetFs     4s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_FREE_WEBM_NetFs     0s/0h of 32586 corpus (9341s/23245h JH) 06/10/04
#counts   SARE_FREE_WEBM_NetFs     2s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FREE_WEBM_NetFs     8s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_FREE_WEBM_NetFs     0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_FREE_WEBM_NETCITY   2s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FREE_WEBM_NetFs     1s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_FREE_WEBM_NetSafe   From =~ /\bsafe-mail\.net/i
describe  SARE_FREE_WEBM_NetSafe   Sender used free email account - may be spammer
score     SARE_FREE_WEBM_NetSafe   0.667
#counts   SARE_FREE_WEBM_NetSafe   0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_NetSafe   28s/1h of 283497 corpus (129933s/153564h RM) 03/08/05
#counts   SARE_FREE_WEBM_NetSafe   1s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_FREE_WEBM_NetSafe   2s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_FREE_WEBM_NetSafe   9s/0h of 32586 corpus (9341s/23245h JH) 06/10/04
#counts   SARE_FREE_WEBM_NetSafe   1s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FREE_WEBM_NetSafe   19s/0h of 47283 corpus (43206s/4077h MY) 06/05/05
#counts   SARE_FREE_WEBM_NetSafe   0s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_FREE_WEBM_NetSafe   3s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#counts   SARE_FREE_WEBM_NetSafe   16s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FREE_WEBM_NetSafe   0s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06
#max      SARE_FREE_WEBM_NetSafe   6s/0h of 5653 corpus (1019s/4634h ft) 06/04/05

header    SARE_FREE_WEBM_Netster   From =~ /\bnetster\.com/i
describe  SARE_FREE_WEBM_Netster   Sender used free email account - may be spammer
score     SARE_FREE_WEBM_Netster   0.222
#ham      SARE_FREE_WEBM_Netster   confirmed (1)
#counts   SARE_FREE_WEBM_Netster   0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_Netster   43s/0h of 125163 corpus (104972s/20191h) 03/28/04
#counts   SARE_FREE_WEBM_Netster   0s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#max      SARE_FREE_WEBM_Netster   2s/0h of 32586 corpus (9341s/23245h JH) 06/10/04
#counts   SARE_FREE_WEBM_Netster   0s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FREE_WEBM_Netster   12s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_FREE_WEBM_Netster   3s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_FREE_WEBM_Netster   3s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_FREE_WEBM_Netster   1s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FREE_WEBM_Netster   0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_FREE_WEBM_PlTenbi   From =~ /\btenbit\.pl/i
describe  SARE_FREE_WEBM_PlTenbi   Sender used free email account - may be spammer 
score     SARE_FREE_WEBM_PlTenbi   1.083
#counts   SARE_FREE_WEBM_PlTenbi   0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_PlTenbi   83s/0h of 115937 corpus (94614s/21323h) 04/29/04
#counts   SARE_FREE_WEBM_PlTenbi   1s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_FREE_WEBM_PlTenbi   4s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_FREE_WEBM_PlTenbi   0s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#max      SARE_FREE_WEBM_PlTenbi   2s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_FREE_WEBM_PlTenbi   0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#max      SARE_FREE_WEBM_PlTenbi   1s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_FREE_WEBM_PlTenbi   4s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FREE_WEBM_PlTenbi   0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_FREE_WEBM_ZCom05    From =~ /\b(?:redwhitearmy|emailaccount)\.com/i
describe  SARE_FREE_WEBM_ZCom05    Sender used free email account - may be spammer
score     SARE_FREE_WEBM_ZCom05    0.972
#ham      SARE_FREE_WEBM_ZCom05    confirmed (1)
#counts   SARE_FREE_WEBM_ZCom05    2s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_ZCom05    183s/2h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_FREE_WEBM_ZCom05    7s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#max      SARE_FREE_WEBM_ZCom05    9s/0h of 38398 corpus (14914s/23484h JH) 08/14/04 TM2 SA3.0-pre2
#counts   SARE_FREE_WEBM_ZCom05    3s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FREE_WEBM_ZCom05    54s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#counts   SARE_FREE_WEBM_ZCom05    6s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_FREE_WEBM_ZCom05    14s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#counts   SARE_FREE_WEBM_ZCom05    25s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FREE_WEBM_ZCom05    32s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_FREE_WEBM_Whoever   From =~ /\bWhoever\.com/i
describe  SARE_FREE_WEBM_Whoever   Sender used free email account - may be spammer 
score     SARE_FREE_WEBM_Whoever   0.711
#counts   SARE_FREE_WEBM_Whoever   0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_Whoever   18s/0h of 85901 corpus (63701s/22200h RM) 06/05/04
#counts   SARE_FREE_WEBM_Whoever   2s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_FREE_WEBM_Whoever   5s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_FREE_WEBM_Whoever   0s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#max      SARE_FREE_WEBM_Whoever   1s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_FREE_WEBM_Whoever   2s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_FREE_WEBM_Whoever   2s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_FREE_WEBM_WOWMAIL   From =~ /\@wowmail\.com/i
describe  SARE_FREE_WEBM_WOWMAIL   Sender used free email account - may be spammer 
score     SARE_FREE_WEBM_WOWMAIL   0.789
#hist     SARE_FREE_WEBM_WOWMAIL   Created by Bob Menschel June 16 2004
#counts   SARE_FREE_WEBM_WOWMAIL   0s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#max      SARE_FREE_WEBM_WOWMAIL   18s/0h of 92181 corpus (67808s/24373h RM) 07/18/04
#counts   SARE_FREE_WEBM_WOWMAIL   2s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_FREE_WEBM_WOWMAIL   0s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FREE_WEBM_WOWMAIL   7s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#counts   SARE_FREE_WEBM_WOWMAIL   7s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_FREE_WEBM_WOWMAIL   0s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_FREE_WEBM_WOWMAIL   6s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_FREE_WEBM_WOWMAIL   2s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_FREE_WEBM_ZCom01    From =~ /\b(?:sify|superonline|coolgoose)\.com/i
describe  SARE_FREE_WEBM_ZCom01    Sender used free email account - may be spammer
score     SARE_FREE_WEBM_ZCom01    0.630
#ham      SARE_FREE_WEBM_ZCom01    confirmed
#counts   SARE_FREE_WEBM_ZCom01    7s/3h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_ZCom01    150s/2h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_FREE_WEBM_ZCom01    3s/1h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_FREE_WEBM_ZCom01    4s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_FREE_WEBM_ZCom01    4s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FREE_WEBM_ZCom01    5s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_FREE_WEBM_ZCom01    16s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_FREE_WEBM_ZCom01    33s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FREE_WEBM_ZCom01    0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_FREE_WEBM_ZCom02    From =~ /\b(?:macmail|emailacc)\.com/i
describe  SARE_FREE_WEBM_ZCom02    Sender used free email account - may be spammer
score     SARE_FREE_WEBM_ZCom02    0.900
#ham      SARE_FREE_WEBM_ZCom02    Confirmed: macmail.com(2) 
#counts   SARE_FREE_WEBM_ZCom02    0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_ZCom02    122s/5h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_FREE_WEBM_ZCom02    1s/0h of 9991 corpus (5650s/4341h AxB) 05/14/06
#counts   SARE_FREE_WEBM_ZCom02    6s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#max      SARE_FREE_WEBM_ZCom02    10s/0h of 38398 corpus (14914s/23484h JH) 08/14/04 TM2 SA3.0-pre2
#counts   SARE_FREE_WEBM_ZCom02    0s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FREE_WEBM_ZCom02    5s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_FREE_WEBM_ZCom02    3s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_FREE_WEBM_ZCom02    4s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#counts   SARE_FREE_WEBM_ZCom02    9s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FREE_WEBM_ZCom02    43s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_FREE_WEBM_ZCom03    From =~ /\b(?:pakistanmail|prontomail)\.com/i
describe  SARE_FREE_WEBM_ZCom03    Sender used free email account - may be spammer
score     SARE_FREE_WEBM_ZCom03    0.656
#ham      SARE_FREE_WEBM_ZCom03    valid email bounce messages
#hist     SARE_FREE_WEBM_ZCom03    Removed mail2world.com since it hit ham. 
#counts   SARE_FREE_WEBM_ZCom03    0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_ZCom03    139s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_FREE_WEBM_ZCom03    1s/0h of 9991 corpus (5650s/4341h AxB) 05/14/06
#counts   SARE_FREE_WEBM_ZCom03    13s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_FREE_WEBM_ZCom03    0s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FREE_WEBM_ZCom03    18s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_FREE_WEBM_ZCom03    1s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_FREE_WEBM_ZCom03    8s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#counts   SARE_FREE_WEBM_ZCom03    1s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FREE_WEBM_ZCom03    2s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_FREE_WEBM_ZCom03B   From =~ /\bmail2world\.com/i
describe  SARE_FREE_WEBM_ZCom03B   Sender used free email account - may be spammer
score     SARE_FREE_WEBM_ZCom03B   0.917
#ham      SARE_FREE_WEBM_ZCom03B   valid email bounce messages
#counts   SARE_FREE_WEBM_ZCom03B   12s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_ZCom03B   139s/14h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_FREE_WEBM_ZCom03B   1s/0h of 9991 corpus (5650s/4341h AxB) 05/14/06
#counts   SARE_FREE_WEBM_ZCom03B   13s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_FREE_WEBM_ZCom03B   1s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FREE_WEBM_ZCom03B   18s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_FREE_WEBM_ZCom03B   2s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_FREE_WEBM_ZCom03B   8s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#counts   SARE_FREE_WEBM_ZCom03B   7s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FREE_WEBM_ZCom03B   29s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_FREE_WEBM_ZCom04    From =~ /\b(?:luxmail|olemail|sailormoon)\.com/i
describe  SARE_FREE_WEBM_ZCom04    Sender used free email account - may be spammer
score     SARE_FREE_WEBM_ZCom04    0.778
#counts   SARE_FREE_WEBM_ZCom04    4s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_ZCom04    19s/0h of 97268 corpus (79437s/17831h RM) 01/24/04
#counts   SARE_FREE_WEBM_ZCom04    1s/0h of 9991 corpus (5650s/4341h AxB) 05/14/06
#counts   SARE_FREE_WEBM_ZCom04    1s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_FREE_WEBM_ZCom04    1s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FREE_WEBM_ZCom04    7s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_FREE_WEBM_ZCom04    0s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#max      SARE_FREE_WEBM_ZCom04    1s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_FREE_WEBM_ZCom04    10s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FREE_WEBM_ZCom04    1s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_FREE_WEBM_ZCom06    From =~ /\b(?:clickitmail|deskpilot|killergreenmail|lancsmail|lovecat)\.com/i
describe  SARE_FREE_WEBM_ZCom06    Sender used free email account - may be spammer
score     SARE_FREE_WEBM_ZCom06    0.711
#ham      SARE_FREE_WEBM_ZCom06    confirmed
#counts   SARE_FREE_WEBM_ZCom06    3s/1h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_ZCom06    23s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_FREE_WEBM_ZCom06    2s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_FREE_WEBM_ZCom06    9s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_FREE_WEBM_ZCom06    3s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FREE_WEBM_ZCom06    5s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_FREE_WEBM_ZCom06    4s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_FREE_WEBM_ZCom06    26s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FREE_WEBM_ZCom06    9s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_FREE_WEBM_ZCom07    From =~ /\b(?:bolt|amnestymail)\.com/i
describe  SARE_FREE_WEBM_ZCom07    Sender used free email account - may be spammer
score     SARE_FREE_WEBM_ZCom07    0.856  
#counts   SARE_FREE_WEBM_ZCom07    2s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_ZCom07    25s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_FREE_WEBM_ZCom07    5s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_FREE_WEBM_ZCom07    1s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FREE_WEBM_ZCom07    14s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_FREE_WEBM_ZCom07    1s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_FREE_WEBM_ZCom07    5s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_FREE_WEBM_ZCom07    3s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FREE_WEBM_ZCom07    1s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_FREE_WEBM_ZZa001    From =~ /\@702mail\.co\.za/i
describe  SARE_FREE_WEBM_ZZa001    Sender used free email account - may be spammer 
score     SARE_FREE_WEBM_ZZa001    0.822
#counts   SARE_FREE_WEBM_ZZa001    0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_ZZa001    38s/0h of 85901 corpus (63701s/22200h RM) 06/05/04
#counts   SARE_FREE_WEBM_ZZa001    0s/0h of 32586 corpus (9341s/23245h JH) 06/10/04
#counts   SARE_FREE_WEBM_ZZa001    0s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#max      SARE_FREE_WEBM_ZZa001    3s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_FREE_WEBM_ZZa001    0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_FREE_WEBM_ZZa001    1s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FREE_WEBM_ZZa001    6s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

body      __SARE_FREE_WEBM_SERV1   /Mail sent from WebMail service/i
body      __SARE_FREE_WEBM_SERV2   /spedita dal servizio WebMail/i
body      __SARE_FREE_WEBM_SERV3   /Mail enviado desde el servicio de  WebMail/i
body      __SARE_FREE_WEBM_SERV4   /Mail inviata dal WebMail service/i
body      __SARE_FREE_WEBM_SERV5   /le module WebMail des service/i
body      __SARE_FREE_WEBM_SERV6   /Servizio WebMail offerto/i
meta      SARE_FREE_WEBM_SERV      (__SARE_FREE_WEBM_SERV1 || __SARE_FREE_WEBM_SERV2 || __SARE_FREE_WEBM_SERV3 || __SARE_FREE_WEBM_SERV4 || __SARE_FREE_WEBM_SERV5 || __SARE_FREE_WEBM_SERV6)
describe  SARE_FREE_WEBM_SERV      Sent from Webmail server
score     SARE_FREE_WEBM_SERV      0.698
#ham      SARE_FREE_WEBM_SERV      confirmed (several)
#hist     SARE_FREE_WEBM_SERV      Kevin Peuhkurinen, May 2005
#counts   SARE_FREE_WEBM_SERV      25s/4h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_FREE_WEBM_SERV      1104s/7h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_FREE_WEBM_SERV      28s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_FREE_WEBM_SERV      0s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_FREE_WEBM_SERV      4s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#counts   SARE_FREE_WEBM_SERV      48s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_FREE_WEBM_SERV      9s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06
#counts   SARE_FREE_WEBM_SERV      10s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_FREE_WEBM_SERV      58s/0h of 47809 corpus (43224s/4585h MY) 07/27/05
#counts   SARE_FREE_WEBM_SERV      9s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05

#####################################################################################
#         SARE Message-ID rules
########  ######################   ##################################################

header    __SARE_RECV_LOCALHOST    Received =~ /LOCALHOST/
header    __SARE_MSGID_D1D1D2D16   MESSAGEID =~ /<\d\.\d\.\d\d\.\d{16}[a-f0-9]{6}@/
meta      SARE_MSGID_D1D1D2D16     !__SARE_RECV_LOCALHOST && __SARE_MSGID_D1D1D2D16
describe  SARE_MSGID_D1D1D2D16     Message-ID has ratware pattern (9.9.99.9999999hex@
score     SARE_MSGID_D1D1D2D16     1.666
#counts   SARE_MSGID_D1D1D2D16     13s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_MSGID_D1D1D2D16     590s/0h of 115439 corpus (94250s/21189h) 04/30/04
#counts   SARE_MSGID_D1D1D2D16     3s/0h of 9991 corpus (5650s/4341h AxB) 05/14/06
#counts   SARE_MSGID_D1D1D2D16     46s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_MSGID_D1D1D2D16     1s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#counts   SARE_MSGID_D1D1D2D16     22s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_MSGID_D1D1D2D16     109s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_MSGID_D1D1D2D16     0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_MSGID_D5D7          MESSAGEID =~ /<\d{5}\.\d{7}\@/
describe  SARE_MSGID_D5D7          Message-ID has ratware pattern (99999.9999999@)
score     SARE_MSGID_D5D7          0.622
#ham      SARE_MSGID_D5D7          confirmed
#counts   SARE_MSGID_D5D7          0s/0h of 274235 corpus (109066s/165169h RM) 05/15/05
#max      SARE_MSGID_D5D7          4s/1h of 114238 corpus (81067s/33171h RM) 01/15/05
#counts   SARE_MSGID_D5D7          11s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_MSGID_D5D7          0s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_MSGID_D5D7          25s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#counts   SARE_MSGID_D5D7          0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_MSGID_D5D7          1s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    __SARE_RECV_LOCALHOST    Received =~ /LOCALHOST/
header    __SARE_MSGID_DDDASH      MESSAGEID =~ /<\d\d?[\$-]/
meta      SARE_MSGID_DDDASH        __SARE_MSGID_DDDASH && !__SARE_RECV_LOCALHOST
describe  SARE_MSGID_DDDASH        Message-ID has ratware pattern (9-, 9$, 99-)
score     SARE_MSGID_DDDASH        1.666
#counts   SARE_MSGID_DDDASH        2420s/5h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_MSGID_DDDASH        3039s/8h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_MSGID_DDDASH        3230s/2h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_MSGID_DDDASH        10s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_MSGID_DDDASH        114s/0h of 38374 corpus (14893s/23481h JH-SA3.0rc1) 08/18/04
#counts   SARE_MSGID_DDDASH        8s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#counts   SARE_MSGID_D5D7          1s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_MSGID_DDDASH        3s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_MSGID_DDDASH        13030s/3h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_MSGID_DDDASH        206s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_MSGID_LONG50        MESSAGEID =~ /[a-z0-9\$]{50}/
describe  SARE_MSGID_LONG50        Exceedingly long message id
score     SARE_MSGID_LONG50        0.619
#ihst     SARE_MSGID_LONG50        Created by Frederic Tarasevicius
#counts   SARE_MSGID_LONG50        4s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_MSGID_LONG50        575s/0h of 400432 corpus (178148s/222284h RM) 03/31/05
#counts   SARE_MSGID_LONG50        14s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_MSGID_LONG50        15s/5h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_MSGID_LONG50        38s/2h of 47283 corpus (43206s/4077h MY) 06/05/05
#counts   SARE_MSGID_LONG50        0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#max      SARE_MSGID_LONG50        2s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_MSGID_LONG50        26s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_MSGID_LONG50        10s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_MSGID_QMAIL1        MESSAGEID =~ /^<.*[a-z].*\.qmail\@.*>/
describe  SARE_MSGID_QMAIL1        Contains spoofing message id
score     SARE_MSGID_QMAIL1        0.056
#ham      SARE_MSGID_QMAIL1        confirmed
#hist     SARE_MSGID_QMAIL1        David Hooton, Fri, 11 Jun 2004
#counts   SARE_MSGID_QMAIL1        0s/1h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_MSGID_QMAIL1        31s/0h of 68491 corpus (41115s/27376h RM) 09/18/04
#counts   SARE_MSGID_QMAIL1        0s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#max      SARE_MSGID_QMAIL1        12s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_MSGID_QMAIL1        1s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_MSGID_QMAIL1        9s/0h of 38398 corpus (14914s/23484h JH) 08/14/04 TM2 SA3.0-pre2
#counts   SARE_MSGID_QMAIL1        0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_MSGID_QMAIL1        1s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_MSGID_QMAIL1        0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_MSGID_RATWARE2      MESSAGEID =~ /\<\d{10,15}\.\d{18,40}\@[a-z]+\>/          # no /i!
describe  SARE_MSGID_RATWARE2      Message-Id is <digits.digits@letters>
score     SARE_MSGID_RATWARE2      0.639
#hist     SARE_MSGID_RATWARE2      Loren Wilton Sat, 3 Apr 2004 20:29:32 -0800
#matches  SARE_MSGID_RATWARE2      numbers.numbers@letters
#counts   SARE_MSGID_RATWARE2      7s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_MSGID_RATWARE2      1640s/0h of 115925 corpus (94616s/21309h) 05/01/04
#counts   SARE_MSGID_RATWARE2      1s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_MSGID_RATWARE2      33s/2h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_MSGID_RATWARE2      66s/2h of 38398 corpus (14914s/23484h JH) 08/14/04 TM2 SA3.0-pre2
#counts   SARE_MSGID_RATWARE2      0s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_MSGID_RATWARE2      31s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_MSGID_RATWARE2      0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#max      SARE_MSGID_RATWARE2      3s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_MSGID_RATWARE2      3s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_MSGID_RATWARE2      1s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_MSGID_SHORT         MESSAGEID =~ /^.{1,6}$/
describe  SARE_MSGID_SHORT         Message ID is too short to be valid. 
score     SARE_MSGID_SHORT         0.856
#hist     SARE_MSGID_SHORT         RM_hm_ShortMsgid6
#counts   SARE_MSGID_SHORT         11s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_MSGID_SHORT         191s/0h of 115925 corpus (94616s/21309h RM) 05/01/04
#counts   SARE_MSGID_SHORT         16s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_MSGID_SHORT         34s/1h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_MSGID_SHORT         40s/1h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_MSGID_SHORT         1s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_MSGID_SHORT         68s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_MSGID_SHORT         18s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_MSGID_SHORT         28s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

#####################################################################################
#         SARE Received Header Rules
########  ######################   ##################################################

header    SARE_HELO_EQ_DSL_3       X-Spam-Relays-Untrusted =~ /helo=dsl-/
score     SARE_HELO_EQ_DSL_3       1.022
#ham      SARE_HELO_EQ_DSL_3       confirmed (several)
#hist     SARE_HELO_EQ_DSL_3       Frederic Tarasevicius, Feb 22 2005
#counts   SARE_HELO_EQ_DSL_3       232s/1h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_HELO_EQ_DSL_3       529s/18h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HELO_EQ_DSL_3       51s/2h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_HELO_EQ_DSL_3       143s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_HELO_EQ_DSL_3       149s/0h of 54179 corpus (17002s/37177h JH-3.01) 03/01/05
#counts   SARE_HELO_EQ_DSL_3       23s/1h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_HELO_EQ_DSL_3       42s/1h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_HELO_EQ_DSL_3       22s/2h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_HELO_EQ_DSL_3       68s/1h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_HELO_EQ_DSL_3       84s/1h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_HELO_EQ_DSL_3       117s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_HELO_EQ_PPPOE       X-Spam-Relays-Untrusted =~ /helo=pppoe-\d{2,3}-\d{1,3}-\d{1,3}-\d{1,3}/i
score     SARE_HELO_EQ_PPPOE       0.555
#stype    SARE_HELO_EQ_PPPOE       spamp
#hist     SARE_HELO_EQ_PPPOE       Frederic Tarasevicius, Feb 22 2005
#counts   SARE_HELO_EQ_PPPOE       0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_HELO_EQ_PPPOE       3s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HELO_EQ_PPPOE       1s/0h of 9991 corpus (5650s/4341h AxB) 05/14/06
#counts   SARE_HELO_EQ_PPPOE       0s/0h of 54179 corpus (17002s/37177h JH-3.01) 03/01/05
#counts   SARE_HELO_EQ_PPPOE       0s/0h of 27758 corpus (24297s/3461h MY) 02/27/05
#counts   SARE_HELO_EQ_PPPOE       0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_HELO_EQ_PPPOE       0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_HELO_YAHOO          Received =~ /helo=yahoo\.com/i
describe  SARE_HELO_YAHOO          Received header has spamsign
score     SARE_HELO_YAHOO          0.828
#ham      SARE_HELO_YAHOO          confirmed (6), generated by X-Mailer: Apple Mail (2.552)
#hist     SARE_HELO_YAHOO          Created by Bob Menschel Oct 26 2004
#counts   SARE_HELO_YAHOO          41s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_HELO_YAHOO          663s/1h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HELO_YAHOO          0s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_HELO_YAHOO          0s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#counts   SARE_HELO_YAHOO          5s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_HELO_YAHOO          0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_HEAD_8BIT_RECV      Received =~ /[\x80-\xff]{3,}/
describe  SARE_HEAD_8BIT_RECV      High-ascii characters found in strange header
score     SARE_HEAD_8BIT_RECV      1.666
#ham      SARE_HEAD_8BIT_RECV      verified (1) 
#hist     SARE_HEAD_8BIT_RECV      From Bugzilla # 2243
#counts   SARE_HEAD_8BIT_RECV      20s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_HEAD_8BIT_RECV      1029s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HEAD_8BIT_RECV      21s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_HEAD_8BIT_RECV      10s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_HEAD_8BIT_RECV      0s/0h of 26190 corpus (22790s/3400h MY) 02/15/05
#counts   SARE_HEAD_8BIT_RECV      10s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_HEAD_8BIT_RECV      13s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_HEAD_8BIT_RECV      182s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_FEP5           Received =~ /by fep5\./i
describe  SARE_RECV_FEP5           Message contains known spam format
score     SARE_RECV_FEP5           1.666
#ham      SARE_RECV_FEP5           verified (1) 
#counts   SARE_RECV_FEP5           7s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_FEP5           528s/0h of 280812 corpus (109490s/171322h RM) 05/05/05
#counts   SARE_RECV_FEP5           7s/0h of 54179 corpus (17002s/37177h JH-3.01) 03/01/05
#counts   SARE_RECV_FEP5           27s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_FEP5           479s/0h of 47283 corpus (43206s/4077h MY) 06/05/05
#counts   SARE_RECV_FEP5           208s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_RECV_FEP5           72s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_FEP5           6s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_RECV_MDNETCOMBR     Received =~ /\bmdnet\.com\.br/
describe  SARE_RECV_MDNETCOMBR     Came through/fromsite used by spammer
score     SARE_RECV_MDNETCOMBR     0.756
#counts   SARE_RECV_MDNETCOMBR     0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_MDNETCOMBR     33s/0h of 115509 corpus (81073s/34436h RM) 01/16/05
#counts   SARE_RECV_MDNETCOMBR     3s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_RECV_MDNETCOMBR     0s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#counts   SARE_RECV_MDNETCOMBR     0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_RECV_MDNETCOMBR     0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_RECV_PATMEDIA       Received =~ /\bpatmedia\.net/i
describe  SARE_RECV_PATMEDIA       Passed through possible spammer relay or source
score     SARE_RECV_PATMEDIA       0.964
#stype    SARE_RECV_PATMEDIA       spamp
#hist     SARE_RECV_PATMEDIA       Created by Bob Menschel Aug 19 2004
#counts   SARE_RECV_PATMEDIA       10s/19h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_PATMEDIA       47s/1h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_PATMEDIA       15s/0h of 9991 corpus (5650s/4341h AxB) 05/14/06
#counts   SARE_RECV_PATMEDIA       6s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_RECV_PATMEDIA       6s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_RECV_PATMEDIA       1s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_PATMEDIA       3s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_RECV_PATMEDIA       93s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_PATMEDIA       16s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    __SARE_RECV_PORTHELOA    Received =~ /helo=\[\w+\]/i
header    __SARE_RECV_PORTHELOB    Received =~ /\(port=\d{4} helo=\[\w+\]\)/i
header    SARE_RECV_PORTHELO_1     Received =~ /from \[\d+\.\d+\.\d+\.\d+\] \(port=\d{4} helo=\[\w+\]\)/i
meta      SARE_RECV_PORTHELO_2     __SARE_RECV_PORTHELOB && !SARE_RECV_PORTHELO_1
meta      SARE_RECV_PORTHELO_3     __SARE_RECV_PORTHELOA && !__SARE_RECV_PORTHELOB && !SARE_RECV_PORTHELO_1
describe  SARE_RECV_PORTHELO_1     Apparent Spamsign in Received header
describe  SARE_RECV_PORTHELO_2     Apparent Spamsign in Received header
describe  SARE_RECV_PORTHELO_3     Apparent Spamsign in Received header
score     SARE_RECV_PORTHELO_1     1.666
#note     SARE_RECV_PORTHELO_1     As of June 8 2005, all three rules in this family hit identically.
#note     SARE_RECV_PORTHELO_1     We score them based on their "safety". 
#hist     SARE_RECV_PORTHELO_1     Loren Wilton, June 2005
#counts   SARE_RECV_PORTHELO_1     0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_PORTHELO_1     5201s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_PORTHELO_1     2s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_PORTHELO_1     42s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#counts   SARE_RECV_PORTHELO_1     116s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_PORTHELO_1     0s/1h of 42275 corpus (34158s/8117h FVGT) 05/15/06
#max      SARE_RECV_PORTHELO_1     83s/1h of 7500 corpus (1767s/5733h ft) 09/18/05
#counts   SARE_RECV_PORTHELO_1     69s/0h of 55754 corpus (18581s/37173h JH-3.01) 06/10/05
#counts   SARE_RECV_PORTHELO_1     230s/1h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_PORTHELO_1     286s/0h of 47809 corpus (43224s/4585h MY) 07/27/05
score     SARE_RECV_PORTHELO_2     2.000
#counts   SARE_RECV_PORTHELO_2     0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
score     SARE_RECV_PORTHELO_3     2.222
#counts   SARE_RECV_PORTHELO_3     0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_PORTHELO_3     499s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_PORTHELO_3     6s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06

header    SARE_RECV_SKANOVA        Received =~ /\bskanova\.com/i
describe  SARE_RECV_SKANOVA        From or passed through spammer/unreliable domain
score     SARE_RECV_SKANOVA        0.660
#ham      SARE_RECV_SKANOVA        verified (several)
#hist     SARE_RECV_SKANOVA        Created by Bob Menschel Apr 03 2004
#counts   SARE_RECV_SKANOVA        37s/2h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_SKANOVA        197s/6h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_SKANOVA        6s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_SKANOVA        5s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_SKANOVA        18s/0h of 47809 corpus (43224s/4585h MY) 07/27/05
#counts   SARE_RECV_SKANOVA        15s/0h of 54840 corpus (17664s/37176h JH-3.01) 03/13/05
#counts   SARE_RECV_SKANOVA        1s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_SKANOVA        4s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#counts   SARE_RECV_SKANOVA        43s/3h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_SKANOVA        6s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_SPAM_DOMN02    Received =~ /\b(?:dsl\.telesp|speedyterra)\.(?:com|net)\.br/
describe  SARE_RECV_SPAM_DOMN02    Email passed through apparent spammer domain 
score     SARE_RECV_SPAM_DOMN02    1.666
#ham      SARE_RECV_SPAM_DOMN02    Confirmed (5)
#counts   SARE_RECV_SPAM_DOMN02    31s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_SPAM_DOMN02    1953s/8h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_SPAM_DOMN02    138s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_RECV_SPAM_DOMN02    168s/1h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#max      SARE_RECV_SPAM_DOMN02    187s/0h of 38398 corpus (14914s/23484h JH) 08/14/04 TM2 SA3.0-pre2
#counts   SARE_RECV_SPAM_DOMN02    17s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_SPAM_DOMN02    64s/0h of 47283 corpus (43206s/4077h MY) 06/05/05
#counts   SARE_RECV_SPAM_DOMN02    60s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_RECV_SPAM_DOMN02    631s/3h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_SPAM_DOMN02    194s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_SPAM_DOMN04    Received =~ /\b(?:megared)\.(?:com|net)\.mx/
describe  SARE_RECV_SPAM_DOMN04    Email passed through apparent spammer domain 
score     SARE_RECV_SPAM_DOMN04    0.772
#ham      SARE_RECV_SPAM_DOMN04    verified (3) 
#counts   SARE_RECV_SPAM_DOMN04    1s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_SPAM_DOMN04    244s/9h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_SPAM_DOMN04    29s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_RECV_SPAM_DOMN04    34s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_RECV_SPAM_DOMN04    6s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#counts   SARE_RECV_SPAM_DOMN04    1s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_SPAM_DOMN04    3s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_RECV_SPAM_DOMN04    1s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_SPAM_DOMN04    1s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_SPAM_DOMN06    Received =~ /adsl.cust.tie.cl/i
describe  SARE_RECV_SPAM_DOMN06    Passed through possible spammer relay or source
score     SARE_RECV_SPAM_DOMN06    0.678
#ham      SARE_RECV_SPAM_DOMN06    verified (1) 
#hist     SARE_RECV_SPAM_DOMN06    Created by Bob Menschel Jul 17 2004
#counts   SARE_RECV_SPAM_DOMN06    9s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_SPAM_DOMN06    161s/2h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_SPAM_DOMN06    5s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_SPAM_DOMN06    7s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_RECV_SPAM_DOMN06    2s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_SPAM_DOMN06    6s/0h of 47283 corpus (43206s/4077h MY) 06/05/05
#counts   SARE_RECV_SPAM_DOMN06    1s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_SPAM_DOMN06    2s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_RECV_SPAM_DOMN06    27s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_SPAM_DOMN06    15s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_SPAM_DOMN0a    Received =~ /\b(?:cyberemailings|netmedia-corp|themailservers|ucanrecover|vnuemedia|winnerssweepstakes|wseas|www--directory)\.(?:com|net|org|info)/
describe  SARE_RECV_SPAM_DOMN0a    Email passed through apparent spammer domain 
score     SARE_RECV_SPAM_DOMN0a    0.917
#ham      SARE_RECV_SPAM_DOMN0a    218-162-39-132.dynamic.hinet.net, valid/appropriate UCE
#hist     SARE_RECV_SPAM_DOMN0a    freeserve.com removed May 16 2005
#counts   SARE_RECV_SPAM_DOMN0a    28s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_SPAM_DOMN0a    242s/0h of 115509 corpus (81073s/34436h RM) 01/16/05
#counts   SARE_RECV_SPAM_DOMN0a    19s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_SPAM_DOMN0a    4s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_RECV_SPAM_DOMN0a    7s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_RECV_SPAM_DOMN0a    0s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_SPAM_DOMN0a    2s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_RECV_SPAM_DOMN0a    2s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_RECV_SPAM_DOMN0a    8s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_SPAM_DOMN0a    4s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_SPAM_DOMN0b    Received =~ /\bdynamic.hinet\.(?:com|net|org|info)/
describe  SARE_RECV_SPAM_DOMN0b    Email passed through apparent spammer domain 
score     SARE_RECV_SPAM_DOMN0b    1.666
#ham      SARE_RECV_SPAM_DOMN0b    confirmed (many)
#counts   SARE_RECV_SPAM_DOMN0b    1272s/39h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_SPAM_DOMN0b    4287s/20h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_SPAM_DOMN0b    809s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_SPAM_DOMN0b    40s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_RECV_SPAM_DOMN0b    25s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_SPAM_DOMN0b    59s/0h of 47283 corpus (43206s/4077h MY) 06/05/05
#counts   SARE_RECV_SPAM_DOMN0b    43s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_RECV_SPAM_DOMN0b    600s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_SPAM_DOMN0b    399s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_SPEEDY_AR      Received =~ /\b(?:speedy)\.(?:com|net)\.ar/
describe  SARE_RECV_SPEEDY_AR      Email passed through apparent spammer domain 
score     SARE_RECV_SPEEDY_AR      0.808
#ham      SARE_RECV_SPEEDY_AR      From: "Hushport Admin" <postmaster@hushport.com>, Received: from nairobi (200-63-141-89.speedy.com.ar [200.63.141.89])
#counts   SARE_RECV_SPEEDY_AR      60s/3h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_SPEEDY_AR      278s/2h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_SPEEDY_AR      10s/0h of 9991 corpus (5650s/4341h AxB) 05/14/06
#counts   SARE_RECV_SPEEDY_AR      32s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_RECV_SPEEDY_AR      0s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_SPEEDY_AR      14s/0h of 47283 corpus (43206s/4077h MY) 06/05/05
#counts   SARE_RECV_SPEEDY_AR      4s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_SPEEDY_AR      8s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_RECV_SPEEDY_AR      25s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_SPEEDY_AR      51s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_UK2NET2        Received =~ /\buk2\.net\b/i
describe  SARE_RECV_UK2NET2        Passed through possible spammer relay or source
score     SARE_RECV_UK2NET2        0.917
#hist     SARE_RECV_UK2NET2        Created by Bob Menschel Oct 01 2004
#counts   SARE_RECV_UK2NET2        32s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#counts   SARE_RECV_UK2NET2        2s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_UK2NET2        7s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_RECV_UK2NET2        8s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_RECV_UK2NET2        0s/0h of 47809 corpus (43224s/4585h MY) 07/27/05
#max      SARE_RECV_UK2NET2        2s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#counts   SARE_RECV_UK2NET2        1s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_UK2NET2        3s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#counts   SARE_RECV_UK2NET2        11s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_UK2NET2        7s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_VIRTUACOMBR    Received =~ /\bvirtua\.com\.br/
describe  SARE_RECV_VIRTUACOMBR    Came through/fromsite used by spammer
score     SARE_RECV_VIRTUACOMBR    1.193
#ham      SARE_RECV_VIRTUACOMBR    confirmed (4)
#hist     SARE_RECV_VIRTUACOMBR    RM_hr_VirtuaComBr
#counts   SARE_RECV_VIRTUACOMBR    32s/3h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_VIRTUACOMBR    882s/45h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_VIRTUACOMBR    36s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_VIRTUACOMBR    6s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_VIRTUACOMBR    20s/0h of 47809 corpus (43224s/4585h MY) 07/27/05
#counts   SARE_RECV_VIRTUACOMBR    104s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_RECV_VIRTUACOMBR    25s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_VIRTUACOMBR    37s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_RECV_VIRTUACOMBR    193s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_VIRTUACOMBR    63s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

#####################################################################################
#         SARE Received Header IP Address Rules
########  ######################   ##################################################

#eader    __SARE_RECV_BEZEQINT     Received =~ /\bbezeqint\.net/
header    __SARE_RECV_BEZEQINT1    Received =~ /\[212\.179\.13\.\d{1,3}\]/
header    __SARE_RECV_BEZEQINT2    Received =~ /\[212\.179\.(?:8\d|9[1-46-9]|10[0-6]|11[6-9]|12[89]|1[3-6]\d|17[0-36-9]|19[02-9]|2\d\d)\.\d{1,3}\]/
header    __SARE_RECV_BEZEQINT3    Received =~ /\[62\.219\.(?:4[89]|5[1-9]|[67]\d|11[2-9]|1[2-5]\d|189|192)\.\d{1,3}\]/
header    __SARE_RECV_BEZEQINT4    Received =~ /\[81\.218\.(?:\d{1,2}|1[01]\d|12[0-7]|13[2-9]|1[4-9]\d|2\d\d)\.\d{1,3}\]/
header    __SARE_RECV_BEZEQINT5    Received =~ /\[82\.80\.(?:\d|[1-5]\d|6[0-3]|12[89]|1[3-9]\d|2[01]\d|22[0-3])\.\d{1,3}\]/
header    __SARE_RECV_BEZEQINT6    Received =~ /\[82\.81\.(?:\d|\d\d|1[01]\d|12[0-7]|19[2-9]|2[01]\d|22[0-3])\.\d{1,3}\]/
meta      SARE_RECV_BEZEQINT_B     __SARE_RECV_BEZEQINT1 || __SARE_RECV_BEZEQINT2 || __SARE_RECV_BEZEQINT3 || __SARE_RECV_BEZEQINT4 || __SARE_RECV_BEZEQINT5 || __SARE_RECV_BEZEQINT6
describe  SARE_RECV_BEZEQINT_B     Came through/fromsite used by spammer
score     SARE_RECV_BEZEQINT_B     0.763
#ham      SARE_RECV_BEZEQINT_B     verified (4)
#hist     SARE_RECV_BEZEQINT_B     Created by Bob Menschel Jan 29 from data supplied by Bezeqint.net to replace SARE_RECV_BEZEQINT
#counts   SARE_RECV_BEZEQINT_B     23s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_BEZEQINT_B     494s/6h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_BEZEQINT_B     21s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_RECV_BEZEQINT_B     24s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_RECV_BEZEQINT_B     5s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_BEZEQINT_B     18s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_RECV_BEZEQINT_B     5s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_BEZEQINT_B     6s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_RECV_BEZEQINT_B     38s/2h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_BEZEQINT_B     20s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_FROMIP1     Received =~ /from\s+((?:1?\d\d?|2[0-4]\d|25[0-4])\.){3}(?:1?\d\d?|2[0-4]\d|25[0-4])\s+by\s+((?:1?\d\d?|2[0-4]\d|25[0-4])\.){3}(?:1?\d\d?|2[0-4]\d|25[0-4])/i
describe  SARE_RECV_IP_FROMIP1     Received line is IP address from IP address
score     SARE_RECV_IP_FROMIP1     1.666
#hist     SARE_RECV_IP_FROMIP1     From Regis Wilson, Wed, 24 Mar 2004, SUSP_IP_RECEIVED
#ham      SARE_RECV_IP_FROMIP1     ham: South Valley Bank
#counts   SARE_RECV_IP_FROMIP1     598s/3h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_FROMIP1     2940s/7h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_FROMIP1     186s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_FROMIP1     1547s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_RECV_IP_FROMIP1     1784s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_RECV_IP_FROMIP1     18s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_FROMIP1     639s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_RECV_IP_FROMIP1     81s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_IP_FROMIP1     661s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_RECV_IP_FROMIP1     173s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_FROMIP1     730s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_FROMIP3     ALL =~ /Received: from \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} by [a-z0-9.]{4,24}\.[a-z0-9.]{4,36}\.(?:com|net|org|biz); [SMTWF].{2}, \d{1,2} [JFMASOND].{2,5} \d{4} \d{2}:\d{2}:\d{2} [-+]\d{4}/i
describe  SARE_RECV_IP_FROMIP3     Received line is IP address from IP address
score     SARE_RECV_IP_FROMIP3     0.711
#match    SARE_RECV_IP_FROMIP3     Received: from 2.19.230.24 by web9DKKRb8QDIGIT.mail.yahoo.com; Sun, 28 Mar 2004 22:08:01 -0500
#ham      SARE_RECV_IP_FROMIP3     Messages from a cell phone
#hist     SARE_RECV_IP_FROMIP3     From Fred <tech2@i-is.com>, Fri, 2 Apr 2004, RE_hrip_IPfromIPc
#counts   SARE_RECV_IP_FROMIP3     2s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_FROMIP3     587s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_FROMIP3     1s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_FROMIP3     111s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_RECV_IP_FROMIP3     155s/0h of 38398 corpus (14914s/23484h JH) 08/14/04 TM2 SA3.0-pre2
#counts   SARE_RECV_IP_FROMIP3     1s/4h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_FROMIP3     46s/3h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_RECV_IP_FROMIP3     0s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_IP_FROMIP3     42s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_RECV_IP_FROMIP3     6s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_FROMIP3     19s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_061050      Received =~ /\[61\.5[01]\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_061050      Spam passed through possible spammer relay
score     SARE_RECV_IP_061050      1.544
#ham      SARE_RECV_IP_061050      confirmed (2) 
#counts   SARE_RECV_IP_061050      66s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_061050      757s/1h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_061050      62s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_061050      7s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_RECV_IP_061050      2s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_061050      14s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_RECV_IP_061050      7s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_RECV_IP_061050      23s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_061050      11s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_061072      Received =~ /\[61\.7[2-7]\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_061072      Passed through possible spammer relay or source
score     SARE_RECV_IP_061072      1.592
#note     SARE_RECV_IP_061072      Korea Telecom
#hist     SARE_RECV_IP_061072      Created by Bob Menschel Nov 02 2004
#ham      SARE_RECV_IP_061072      verified (1)
#counts   SARE_RECV_IP_061072      42s/1h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_061072      2043s/5h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_061072      61s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_061072      38s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_RECV_IP_061072      11s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_061072      48s/0h of 47809 corpus (43224s/4585h MY) 07/27/05
#counts   SARE_RECV_IP_061072      11s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_IP_061072      21s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#counts   SARE_RECV_IP_061072      177s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_061072      33s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_061187      Received =~ /\[61\.187\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_061187      Passed through possible spammer relay or source
score     SARE_RECV_IP_061187      0.694
#hist     SARE_RECV_IP_061187      Created by Bob Menschel Aug 09 2004
#counts   SARE_RECV_IP_061187      1s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_061187      36s/1h of 114241 corpus (81067s/33174h RM) 01/15/05
#counts   SARE_RECV_IP_061187      4s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_061187      4s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_RECV_IP_061187      4s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04
#counts   SARE_RECV_IP_061187      0s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_061187      20s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_RECV_IP_061187      3s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_RECV_IP_061187      7s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_061187      6s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_061190      Received =~ /\[61\.190\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_061190      Spam passed through possible spammer relay
score     SARE_RECV_IP_061190      1.111
#stype    SARE_RECV_IP_061190      spamp
#hist     SARE_RECV_IP_061190      Created by Bob Menschel Apr 04 2004
#counts   SARE_RECV_IP_061190      11s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_061190      42s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_061190      5s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_061190      2s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_RECV_IP_061190      3s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_RECV_IP_061190      2s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_061190      5s/0h of 47283 corpus (43206s/4077h MY) 06/05/05
#counts   SARE_RECV_IP_061190      6s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_RECV_IP_061190      7s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_061190      6s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_061228      Received =~ /\[61\.(?:22[89]|23[01])\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_061228      Spam passed through possible spammer relay
score     SARE_RECV_IP_061228      0.895
#ham      SARE_RECV_IP_061228      verified (1)
#counts   SARE_RECV_IP_061228      229s/8h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_061228      757s/3h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_061228      140s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_061228      6s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_RECV_IP_061228      2s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_061228      9s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_RECV_IP_061228      8s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_RECV_IP_061228      85s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_061228      80s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_066017      Received =~ /\[66\.17\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}\]/
describe  SARE_RECV_IP_066017      Passed through possible spammer relay or source
score     SARE_RECV_IP_066017      0.637
#ham      SARE_RECV_IP_066017      confirmed (8)
#note     SARE_RECV_IP_066017      Yipes Communications Inc
#hist     SARE_RECV_IP_066017      Created by Bob Menschel Nov 20 2004
#counts   SARE_RECV_IP_066017      16s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_066017      88s/12h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_066017      2s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_066017      1s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_RECV_IP_066017      2s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_RECV_IP_066017      61s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_066017      335s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_RECV_IP_066017      0s/8h of 10590 corpus (5819s/4771h CT) 07/26/05
#max      SARE_RECV_IP_066017      149s/8h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_RECV_IP_066017      52s/1h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_066017      0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_RECV_IP_066165224   Received =~ /\[66\.165\.2(?:2[4-9]|3\d)\.\d{1,3}\]/
describe  SARE_RECV_IP_066165224   Spam passed through possible spammer relay
score     SARE_RECV_IP_066165224   1.278  
#ham      SARE_RECV_IP_066165224   confirmed: 3
#hist     SARE_RECV_IP_066165224   Created by Bob Menschel May 14 2005
#note     SARE_RECV_IP_066165224   Cyber World Internet Services
#counts   SARE_RECV_IP_066165224   0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_066165224   34s/0h of 272483 corpus (108035s/164448h RM) 05/15/05
#counts   SARE_RECV_IP_066165224   0s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_IP_066165224   1s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_RECV_IP_066165224   2s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_066165224   0s/0h of 2500 corpus (531s/1969h ft) 05/17/05
#counts   SARE_RECV_IP_066165224   4s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_066165224   124s/0h of 45478 corpus (41529s/3949h MY) 05/16/05

header    SARE_RECV_IP_069050210   Received =~ /\[69\.50\.210\.\d{1,3}\]/
describe  SARE_RECV_IP_069050210   Spam passed through possible spammer relay
score     SARE_RECV_IP_069050210   0.700
#ham      SARE_RECV_IP_069050210   confirmed (2) 
#hist     SARE_RECV_IP_069050210   Created by Fred Tarasevicius May 2005
#counts   SARE_RECV_IP_069050210   0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_069050210   49s/2h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_069050210   2s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_069050210   0s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06
#max      SARE_RECV_IP_069050210   12s/0h of 6924 corpus (1403s/5521h ft) 07/27/05
#counts   SARE_RECV_IP_069050210   0s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_069050210   12s/0h of 47809 corpus (43224s/4585h MY) 07/27/05

header    SARE_RECV_IP_069060096   Received =~ /\[69\.60\.(?:9[6-9]|1(?:[01]\d|2[0-7]))\.\d{1,3}\]/
describe  SARE_RECV_IP_069060096   Spam passed through possible spammer relay
score     SARE_RECV_IP_069060096   1.666
#ham      SARE_RECV_IP_069060096   verified (1) 
#hist     SARE_RECV_IP_069060096   Created by Bob Menschel May 14 2005
#counts   SARE_RECV_IP_069060096   112s/2h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_069060096   6813s/2h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_069060096   11s/0h of 9991 corpus (5650s/4341h AxB) 05/14/06
#counts   SARE_RECV_IP_069060096   1s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_RECV_IP_069060096   409s/3h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_069060096   166s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06
#counts   SARE_RECV_IP_069060096   368s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_069060096   398s/0h of 47809 corpus (43224s/4585h MY) 07/27/05

header    SARE_RECV_IP_082080      Received =~ /\[82\.80\.(?:12[89]|1[3-8]\d|191)\.\d{1,3}\]/
describe  SARE_RECV_IP_082080      Spam passed through possible spammer relay
score     SARE_RECV_IP_082080      1.111
#stype    SARE_RECV_IP_082080      spamp
#counts   SARE_RECV_IP_082080      0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_082080      26s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_082080      2s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_RECV_IP_082080      3s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_RECV_IP_082080      0s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_082080      2s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#counts   SARE_RECV_IP_082080      0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_RECV_IP_082080      3s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_082080      0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_RECV_IP_082102      Received =~ /\[82\.102\.(?:3[2-9]|[45]\d|6[0-3]).\d{1,3}\]/
describe  SARE_RECV_IP_082102      Spam passed through possible spammer relay
score     SARE_RECV_IP_082102      0.555
#stype    SARE_RECV_IP_082102      spamp
#hist     SARE_RECV_IP_082102      Created by Bob Menschel May 20 2004
#counts   SARE_RECV_IP_082102      0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_082102      9s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_082102      1s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_RECV_IP_082102      0s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_082102      1s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_RECV_IP_082102      0s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_IP_082102      1s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_RECV_IP_082102      3s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_082102      2s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_082154      Received =~ /\[82\.15[45]\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_082154      Passed through possible spammer relay or source
score     SARE_RECV_IP_082154      1.666
#ham      SARE_RECV_IP_082154      confirmed (1) 
#hist     SARE_RECV_IP_082154      Created by Bob Menschel Aug 10 2004
#counts   SARE_RECV_IP_082154      256s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_082154      572s/5h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_082154      62s/1h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_082154      13s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_RECV_IP_082154      8s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_082154      43s/0h of 47809 corpus (43224s/4585h MY) 07/27/05
#counts   SARE_RECV_IP_082154      9s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_RECV_IP_082154      231s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_082154      11s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_083028      Received =~ /\[83\.28\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_083028      Passed through possible spammer relay or source
score     SARE_RECV_IP_083028      1.666
#ham      SARE_RECV_IP_083028      verified (1)
#hist     SARE_RECV_IP_083028      Created by Bob Menschel Sep 10 2004
#note     SARE_RECV_IP_083028      Large block of IP addresses in Poland
#counts   SARE_RECV_IP_083028      8s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_083028      171s/2h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_083028      157s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_083028      0s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_RECV_IP_083028      3s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_083028      4s/0h of 27758 corpus (24297s/3461h MY) 02/27/05
#counts   SARE_RECV_IP_083028      5s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_RECV_IP_083028      42s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_083028      19s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_140117      Received =~ /\[140\.1(?:1[789]|2\d|3[0-8])\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_140117      Passed through possible spammer relay or source
score     SARE_RECV_IP_140117      0.690
#ham      SARE_RECV_IP_140117      confirmed (1) 
#hist     SARE_RECV_IP_140117      Created by Bob Menschel Oct 03 2004
#note     SARE_RECV_IP_140117      Ministry of Education Computing Center, Taipei, Taiwan
#counts   SARE_RECV_IP_140117      26s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_140117      87s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_140117      7s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_140117      17s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_RECV_IP_140117      8s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#counts   SARE_RECV_IP_140117      1s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_IP_140117      9s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_RECV_IP_140117      22s/4h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_140117      16s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_142046      Received =~ /\[142\.46\.148\.\d{1,3}\]/
describe  SARE_RECV_IP_142046      Passed through possible spammer relay or source
score     SARE_RECV_IP_142046      0.555
#stype    SARE_RECV_IP_142046      spamp
#hist     SARE_RECV_IP_142046      Created by Bob Menschel Feb 10 2005 from Spam-L info
#counts   SARE_RECV_IP_142046      0s/0h of 273595 corpus (108821s/164774h RM) 05/13/05
#max      SARE_RECV_IP_142046      8s/0h of 238550 corpus (112525s/126025h RM) 02/28/05
#counts   SARE_RECV_IP_142046      0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_RECV_IP_142046      5s/0h of 155106 corpus (103557s/51549h DOC) 05/14/06
#counts   SARE_RECV_IP_142046      0s/0h of 2500 corpus (531s/1969h ft) 05/17/05
#counts   SARE_RECV_IP_142046      0s/0h of 54179 corpus (17002s/37177h JH-3.01) 03/01/05
#counts   SARE_RECV_IP_142046      0s/0h of 27758 corpus (24297s/3461h MY) 02/27/05

header    SARE_RECV_IP_192116      Received =~ /\[192\.116\.13[3-7]\.\d{1,3}\]/
describe  SARE_RECV_IP_192116      Passed through possible spammer relay or source
score     SARE_RECV_IP_192116      0.861
#note     SARE_RECV_IP_192116      GILAT-SATCOM
#hist     SARE_RECV_IP_192116      Created by Bob Menschel Nov 16 2004
#counts   SARE_RECV_IP_192116      0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_192116      52s/0h of 400432 corpus (178148s/222284h RM) 03/31/05
#counts   SARE_RECV_IP_192116      1s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_RECV_IP_192116      1s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#counts   SARE_RECV_IP_192116      0s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_IP_192116      1s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_RECV_IP_192116      0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_RECV_IP_200150      Received =~ /\[200\.150\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_200150      Spam passed through possible spammer relay
score     SARE_RECV_IP_200150      0.612
#ham      SARE_RECV_IP_200150      confirmed (2) 
#hist     SARE_RECV_IP_200150      Created by Bob Menschel Aug 29 2004
#counts   SARE_RECV_IP_200150      9s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_200150      142s/1h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_200150      6s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_200150      19s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_RECV_IP_200150      8s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#counts   SARE_RECV_IP_200150      1s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_IP_200150      3s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_RECV_IP_200150      14s/5h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_200150      4s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_203210128   Received =~ /\[203.210\.(?:1(?:2[89]|[3-9]\d)|2\d\d)\.\d{1,3}\]/
describe  SARE_RECV_IP_203210128   Spam passed through possible spammer relay
score     SARE_RECV_IP_203210128   0.959
#ham      SARE_RECV_IP_203210128   verified (3)
#hist     SARE_RECV_IP_203210128   Created by Bob Menschel May 14 2005
#note     SARE_RECV_IP_203210128   Vietnam Posts and Telecommunications (VNPT)
#counts   SARE_RECV_IP_203210128   36s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_203210128   56s/13h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_203210128   43s/2h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_203210128   1s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_IP_203210128   2s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_RECV_IP_203210128   13s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_203210128   7s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_203210128   79s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_RECV_IP_203210128   2s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_RECV_IP_203210128   116s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_203177      Received =~ /\[203\.177\.1(?:2[89]|[3-8]\d|9[01])\.\d{1,3}\]/
describe  SARE_RECV_IP_203177      Passed through possible spammer relay or source
score     SARE_RECV_IP_203177      0.772
#hist     SARE_RECV_IP_203177      Created by Bob Menschel Aug 20 2004
#ham      SARE_RECV_IP_203177      verified (1)
#counts   SARE_RECV_IP_203177      8s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#max      SARE_RECV_IP_203177      42s/0h of 400432 corpus (178148s/222284h RM) 03/31/05
#counts   SARE_RECV_IP_203177      23s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_203177      1s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_RECV_IP_203177      1s/0h of 47809 corpus (43224s/4585h MY) 07/27/05
#max      SARE_RECV_IP_203177      5s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_RECV_IP_203177      1s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_IP_203177      4s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_RECV_IP_203177      1s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_203177      4s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_206131      Received =~ /\[206\.131\.2(?:2[4-9]|[345]\d)\.\d{1,3}\]/
describe  SARE_RECV_IP_206131      Spam passed through possible spammer relay
score     SARE_RECV_IP_206131      1.666
#ham      SARE_RECV_IP_206131      confirmed (1) 
#hist     SARE_RECV_IP_206131      Created by Bob Menschel Feb 5 2005 from Spam-L info
#note     SARE_RECV_IP_206131      Minerva Network Systems, Inc.
#counts   SARE_RECV_IP_206131      54s/1h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_206131      2849s/2h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_206131      692s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_206131      0s/0h of 54840 corpus (17664s/37176h JH-3.01) 03/13/05
#counts   SARE_RECV_IP_206131      13s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_206131      34s/0h of 47809 corpus (43224s/4585h MY) 07/27/05
#counts   SARE_RECV_IP_206131      9s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_RECV_IP_206131      1699s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_206131      31s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_209051      Received =~ /\[209\.51\.(?:19[2-9]|2\d\d)\.\d{1,3}\]/
describe  SARE_RECV_IP_209051      Spam passed through possible spammer relay
score     SARE_RECV_IP_209051      1.111  
#stype    SARE_RECV_IP_209051      spamp 
#hist     SARE_RECV_IP_209051      Created by Bob Menschel Aug 07 2005
#note     SARE_RECV_IP_209051      S-INFOTECH, Inc.
#counts   SARE_RECV_IP_209051      1s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_209051      56s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_209051      0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
#counts   SARE_RECV_IP_209051      22s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_209051      2s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06
#counts   SARE_RECV_IP_209051      1s/1h of 22942 corpus (17234s/5708h MY) 05/14/06

header    SARE_RECV_IP_216118120   Received =~ /\[216\.118\.120\.(?:6[4-9]|[78]\d|9[0-1])\]/
describe  SARE_RECV_IP_216118120   Spam passed through possible spammer relay
score     SARE_RECV_IP_216118120   2.222  
#hist     SARE_RECV_IP_216118120   Created by Bob Menschel Aug 07 2005
#counts   SARE_RECV_IP_216118120   0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_216118120   1224s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_216118120   0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
#counts   SARE_RECV_IP_216118120   10s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_216118120   0s/0h of 7500 corpus (1767s/5733h ft) 09/18/05

header    SARE_RECV_IP_211216      Received =~ /\[211\.2(?:1[6-9]|2[0-5]\d)\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_211216      Passed through possible spammer relay or source
score     SARE_RECV_IP_211216      0.978
#stype    SARE_RECV_IP_211216      max:1.000
#ham      SARE_RECV_IP_211216      confirmed (1) - YahooGroups moderated group, posting approved by moderator
#hist     SARE_RECV_IP_211216      Created by Bob Menschel Aug 20 2004
#note     SARE_RECV_IP_211216      Korea Telecom
#note     SARE_RECV_IP_211216      Score kept low to avoid FPs for naver.com
#counts   SARE_RECV_IP_211216      32s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_211216      1308s/2h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_211216      33s/1h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_211216      27s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_RECV_IP_211216      13s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_211216      40s/0h of 47809 corpus (43224s/4585h MY) 07/27/05
#counts   SARE_RECV_IP_211216      8s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_IP_211216      14s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_RECV_IP_211216      25s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_211216      14s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_212068      Received =~ /\[212\.68\.2[45]\d\.\d{1,3}\]/
describe  SARE_RECV_IP_212068      Spam passed through possible spammer relay
score     SARE_RECV_IP_212068      1.111
#stype    SARE_RECV_IP_212068      spamp
#hist     SARE_RECV_IP_212068      Created by Bob Menschel Apr 09 2004
#counts   SARE_RECV_IP_212068      0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_212068      18s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_212068      1s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_RECV_IP_212068      0s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_212068      1s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_RECV_IP_212068      1s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_IP_212068      1s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_RECV_IP_212068      3s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_212068      1s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_216022      Received =~ /\[216\.22\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_216022      Spam passed through possible spammer relay
score     SARE_RECV_IP_216022      1.666
#hist     SARE_RECV_IP_216022      Created by Bob Menschel May 14 2005
#counts   SARE_RECV_IP_216022      270s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_216022      1146s/5h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_216022      196s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_216022      0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_RECV_IP_216022      554s/6h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_216022      212s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06
#counts   SARE_RECV_IP_216022      307s/0h of 22942 corpus (17234s/5708h MY) 05/14/06

header    SARE_RECV_IP_218070      Received =~ /\[218\.70\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_218070      Spam passed through possible spammer relay
score     SARE_RECV_IP_218070      1.111
#stype    SARE_RECV_IP_218070      spamp
#counts   SARE_RECV_IP_218070      1s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_218070      21s/0h of 112471 corpus (92494s/19977h) 03/14/04
#counts   SARE_RECV_IP_218070      1s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_RECV_IP_218070      2s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#max      SARE_RECV_IP_218070      2s/0h of 38398 corpus (14914s/23484h JH) 08/14/04 TM2 SA3.0-pre2
#counts   SARE_RECV_IP_218070      0s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_218070      1s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_RECV_IP_218070      0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_RECV_IP_218070      3s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_218072      Received =~ /\[218\.72\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_218072      Spam passed through possible spammer relay
score     SARE_RECV_IP_218072      0.813
#hist     SARE_RECV_IP_218072      Created by Bob Menschel May 23 2004
#counts   SARE_RECV_IP_218072      87s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#counts   SARE_RECV_IP_218072      16s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_RECV_IP_218072      22s/0h of 38398 corpus (14914s/23484h JH) 08/14/04 TM2 SA3.0-pre2
#counts   SARE_RECV_IP_218072      13s/2h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_218072      2s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_218072      133s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_RECV_IP_218072      3s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_IP_218072      13s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_RECV_IP_218072      2s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_218072      16s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_218078      Received =~ /\[218\.(?:7[89]|8[0123])\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_218078      Passed through possible spammer relay or source
score     SARE_RECV_IP_218078      1.666
#hist     SARE_RECV_IP_218078      Created by Bob Menschel Oct 07 2004
#ham      SARE_RECV_IP_218078      confirmed (1) 
#note     SARE_RECV_IP_218078      ChinaNet, Shanghai Province 
#counts   SARE_RECV_IP_218078      34s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_218078      581s/0h of 400432 corpus (178148s/222284h RM) 03/31/05
#counts   SARE_RECV_IP_218078      51s/1h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_218078      38s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_RECV_IP_218078      136s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_218078      677s/0h of 47283 corpus (43206s/4077h MY) 06/05/05
#counts   SARE_RECV_IP_218078      53s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_IP_218078      74s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_RECV_IP_218078      67s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_218078      58s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_218088      Received =~ /\[218\.8[89]\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_218088      Passed through possible spammer relay or source
score     SARE_RECV_IP_218088      1.100
#ham      SARE_RECV_IP_218088      confirmed: 1
#note     SARE_RECV_IP_218088      CHINANET sichuan province network 
#hist     SARE_RECV_IP_218088      Created by Bob Menschel Nov 04 2004
#counts   SARE_RECV_IP_218088      29s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_218088      111s/0h of 115509 corpus (81073s/34436h RM) 01/16/05
#counts   SARE_RECV_IP_218088      15s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_218088      11s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_RECV_IP_218088      13s/0h of 54840 corpus (17664s/37176h JH-3.01) 03/13/05
#counts   SARE_RECV_IP_218088      6s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_218088      19s/0h of 47283 corpus (43206s/4077h MY) 06/05/05
#counts   SARE_RECV_IP_218088      3s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_IP_218088      5s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_RECV_IP_218088      9s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_218088      25s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_218216      Received =~ /\[218\.(?:21[6-9]|22\d|23[01])\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_218216      Passed through possible spammer relay or source
score     SARE_RECV_IP_218216      0.629
#ham      SARE_RECV_IP_218216      confirmed (2) 
#hist     SARE_RECV_IP_218216      Created by Bob Menschel Oct 23 2004
#counts   SARE_RECV_IP_218216      88s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_218216      260s/8h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_218216      31s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_218216      21s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_RECV_IP_218216      6s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_218216      12s/0h of 45478 corpus (41529s/3949h MY) 05/16/05
#counts   SARE_RECV_IP_218216      3s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_IP_218216      11s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_RECV_IP_218216      121s/22h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_218216      35s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_219128      Received =~ /\[219\.1(?:2[89]|3[0-7])\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_219128      Passed through possible spammer relay or source
score     SARE_RECV_IP_219128      1.666 
#hist     SARE_RECV_IP_219128      Created by Bob Menschel Aug 23 2004
#counts   SARE_RECV_IP_219128      381s/1h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_219128      1752s/2h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_219128      114s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_219128      100s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_RECV_IP_219128      79s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_219128      225s/0h of 47809 corpus (43224s/4585h MY) 07/27/05
#counts   SARE_RECV_IP_219128      52s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_RECV_IP_219128      36s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_219128      116s/1h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_220116      Received =~ /\[220\.(?:11[6-9]|12[0-7])\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_220116      Passed through possible spammer relay or source
score     SARE_RECV_IP_220116      1.666
#ham      SARE_RECV_IP_220116      confirmed (1)
#hist     SARE_RECV_IP_220116      Created by Bob Menschel Jul 17 2004
#note     SARE_RECV_IP_220116      Korea Telecom
#counts   SARE_RECV_IP_220116      180s/1h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_220116      1177s/1h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_220116      192s/1h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_220116      108s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_RECV_IP_220116      13s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_220116      161s/0h of 47809 corpus (43224s/4585h MY) 07/27/05
#counts   SARE_RECV_IP_220116      23s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_IP_220116      58s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#counts   SARE_RECV_IP_220116      206s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_220116      182s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_221124      Received =~ /\[221\.12[4-7]\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_221124      Spam passed through possible spammer relay
score     SARE_RECV_IP_221124      1.666
#hist     SARE_RECV_IP_221124      Created by Bob Menschel May 30 2004
#counts   SARE_RECV_IP_221124      91s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_221124      633s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_221124      88s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_221124      66s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_RECV_IP_221124      74s/0h of 54840 corpus (17664s/37176h JH-3.01) 03/13/05
#counts   SARE_RECV_IP_221124      4s/1h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_221124      16s/1h of 47283 corpus (43206s/4077h MY) 06/05/05
#counts   SARE_RECV_IP_221124      15s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_IP_221124      24s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_RECV_IP_221124      56s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_221124      119s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_222000      Received =~ /\[222\.(?:\d|1[0-5])\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_222000      Passed through possible spammer relay or source
score     SARE_RECV_IP_222000      1.508
#ham      SARE_RECV_IP_222000      confirmed (1)
#hist     SARE_RECV_IP_222000      Created by Bob Menschel Aug 09 2004
#counts   SARE_RECV_IP_222000      79s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_222000      171s/19h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_RECV_IP_222000      80s/1h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_222000      20s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_RECV_IP_222000      7s/0h of 22942 corpus (17234s/5708h MY) 05/14/06
#counts   SARE_RECV_IP_222000      6s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_IP_222000      7s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_RECV_IP_222000      133s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_222000      18s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_RECV_IP_222064      Received =~ /\[222\.(?:6[4-9]|7[0-3])\.\d{1,3}\.\d{1,3}\]/
describe  SARE_RECV_IP_222064      Spam passed through possible spammer relay
score     SARE_RECV_IP_222064      1.666
#ham      SARE_RECV_IP_222064      verified (1) 
#hist     SARE_RECV_IP_222064      Created by Bob Menschel Apr 18 2004
#counts   SARE_RECV_IP_222064      115s/1h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_RECV_IP_222064      831s/0h of 114271 corpus (81068s/33203h RM) 01/15/05
#counts   SARE_RECV_IP_222064      54s/1h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_RECV_IP_222064      95s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_RECV_IP_222064      97s/0h of 54840 corpus (17664s/37176h JH-3.01) 03/13/05
#counts   SARE_RECV_IP_222064      189s/1h of 22942 corpus (17234s/5708h MY) 05/14/06
#max      SARE_RECV_IP_222064      849s/1h of 47283 corpus (43206s/4077h MY) 06/05/05
#counts   SARE_RECV_IP_222064      17s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_RECV_IP_222064      65s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_RECV_IP_222064      352s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_RECV_IP_222064      35s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

#####################################################################################
#         SARE Reply-To Rules 
########  ######################   ##################################################

#####################################################################################
#         SARE To/Cc Destination rules
########  ######################   ##################################################

header    SARE_TO_EMPTY            To =~ /<>/
describe  SARE_TO_EMPTY            To address is set to empty 
#core     SARE_TO_EMPTY            0.330 0.550 0.000 0.550 # prev target: 0.660 when added to TO_NO_USER
score     SARE_TO_EMPTY            0.000 0.222 0.000 0.222 # curr target: 0.333 when added to TO_NO_USER
#hist     SARE_TO_EMPTY            Originally submitted by Bob Menschel
#overlap  SARE_TO_EMPTY            Distrib: TO_NO_USER: score TO_NO_USER 0.332 0.116 1.615 0.128
#counts   SARE_TO_EMPTY            0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_TO_EMPTY            26s/0h of 114241 corpus (81067s/33174h RM) 01/15/05
#counts   SARE_TO_EMPTY            12s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_TO_EMPTY            0s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#counts   SARE_TO_EMPTY            0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
#max      SARE_TO_EMPTY            0s/1h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_TO_EMPTY            0s/2h of 5653 corpus (1019s/4634h ft) 06/04/05

#####################################################################################
#         SARE X-Mailer Rules
########  ######################   ##################################################

header    SARE_XMAIL_PSSMAILER     X-Mailer =~ /PSS Mailer/
describe  SARE_XMAIL_PSSMAILER     Apparently uses bulk mailer
score     SARE_XMAIL_PSSMAILER     1.111  
#stype    SARE_XMAIL_PSSMAILER     spamp
#hist     SARE_XMAIL_PSSMAILER     RM_hxm_PSSMailer
#counts   SARE_XMAIL_PSSMAILER     0s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_XMAIL_PSSMAILER     12s/0h of 273595 corpus (108821s/164774h RM) 05/13/05
#counts   SARE_XMAIL_PSSMAILER     0s/0h of 18651 corpus (16120s/2531h MY) 08/29/04
#counts   SARE_XMAIL_PSSMAILER     0s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04
#counts   SARE_XMAIL_PSSMAILER     1s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_XMAIL_PSSMAILER     0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_XMAIL_RLSP          X-Mailer =~ /RLSP/
describe  SARE_XMAIL_RLSP          Uses Bulk Mailer used by spammers
score     SARE_XMAIL_RLSP          0.740
#ham      SARE_XMAIL_RLSP          cartoon newsletter, personal emails (2) 
#hist     SARE_XMAIL_RLSP          Created by Bob Menschel Sep 27 2004
#counts   SARE_XMAIL_RLSP          26s/4h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_XMAIL_RLSP          1782s/4h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_XMAIL_RLSP          52s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_XMAIL_RLSP          11s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_XMAIL_RLSP          0s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#counts   SARE_XMAIL_RLSP          0s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_XMAIL_RLSP          5s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#counts   SARE_XMAIL_RLSP          68s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_XMAIL_RLSP          9s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06

#####################################################################################
#         SARE Miscellaneous and X-Header header rules 
########  ######################   ##################################################

header    SARE_HEAD_DATE14         Date =~ /^.{1,14}$/
score     SARE_HEAD_DATE14         0.847
#counts   SARE_HEAD_DATE14         3s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_HEAD_DATE14         313s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HEAD_DATE14         43s/0h of 54072 corpus (16898s/37174h JH-3.01) 02/18/05
#counts   SARE_HEAD_DATE14         0s/0h of 27758 corpus (24297s/3461h MY) 02/27/05
#counts   SARE_HEAD_DATE14         0s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_HEAD_DATE14         0s/1h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_HEAD_DATE14         57s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_HEAD_DATE14         2s/1h of 42275 corpus (34158s/8117h FVGT) 05/15/06

header    SARE_HEAD_DATE46         Date =~ /^.{46}$/
describe  SARE_HEAD_DATE46         Date header suggests this is spam
score     SARE_HEAD_DATE46         1.666
#ham      SARE_HEAD_DATE46         Confirmed (1) 
#counts   SARE_HEAD_DATE46         409s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HEAD_DATE46         7s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_HEAD_DATE46         0s/0h of 54179 corpus (17002s/37177h JH-3.01) 03/01/05
#counts   SARE_HEAD_DATE46         0s/0h of 27758 corpus (24297s/3461h MY) 02/27/05
#counts   SARE_HEAD_DATE46         0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_HEAD_DATE46         6s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_HEAD_DATE46         0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    __MIME_VERSION           exists:MIME-Version
header    __SARE_HEAD_MIME_VALID   Mime-Version =~ m'^\s*1.0\b'
meta      SARE_HEAD_MIME_INVALID   !__SARE_HEAD_MIME_VALID && __MIME_VERSION
describe  SARE_HEAD_MIME_INVALID   Invalid mime version
score     SARE_HEAD_MIME_INVALID   1.116
#ham      SARE_HEAD_MIME_INVALID   confirmed 
#hist     SARE_HEAD_MIME_INVALID   Bob Menschel, June 15 2005, inspired by Alex Broens
#counts   SARE_HEAD_MIME_INVALID   433s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#counts   SARE_HEAD_MIME_INVALID   7s/0h of 9987 corpus (5650s/4337h AxB) 05/14/06
#counts   SARE_HEAD_MIME_INVALID   3s/0h of 13303 corpus (7429s/5874h CT) 05/14/06
#counts   SARE_HEAD_MIME_INVALID   0s/5h of 15713 corpus (7767s/7946h FT) 05/14/06
#counts   SARE_HEAD_MIME_INVALID   172s/0h of 105832 corpus (72573s/33259h ML) 05/14/06

header    SARE_HEAD_ORG_PREFIXW    Organization =~ /Prefix that with/i
describe  SARE_HEAD_ORG_PREFIXW    Spam sign in Organization header
score     SARE_HEAD_ORG_PREFIXW    0.617
#hist     SARE_HEAD_ORG_PREFIXW    Alex Broens, Feb 20 2005
#counts   SARE_HEAD_ORG_PREFIXW    0s/0h of 327690 corpus (159737s/167953h RM) 07/27/05
#max      SARE_HEAD_ORG_PREFIXW    10s/0h of 238550 corpus (112525s/126025h RM) 02/28/05
#counts   SARE_HEAD_ORG_PREFIXW    0s/0h of 54179 corpus (17002s/37177h JH-3.01) 03/01/05
#counts   SARE_HEAD_ORG_PREFIXW    0s/0h of 27758 corpus (24297s/3461h MY) 02/27/05
#counts   SARE_HEAD_ORG_PREFIXW    0s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_HEAD_ORG_PREFIXW    1s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_HEAD_ORG_PREFIXW    0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_HEAD_XLIB_INDY1     X-Library=~ /Indy 10.00.14-B/
describe  SARE_HEAD_XLIB_INDY1     Uses S/W version which has only been seen in spam
score     SARE_HEAD_XLIB_INDY1     0.844
#hist     SARE_HEAD_XLIB_INDY1     Originally submitted by Bob Menschel, RM.hxl_ForgedIndy
#counts   SARE_HEAD_XLIB_INDY1     0s/0h of 196688 corpus (96191s/100497h RM) 02/21/05
#max      SARE_HEAD_XLIB_INDY1     30s/0h of 66979 corpus (41757s/25222h RM) 09/04/04
#counts   SARE_HEAD_XLIB_INDY1     2s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_HEAD_XLIB_INDY1     9s/0h of 38398 corpus (14914s/23484h JH) 08/14/04 TM2 SA3.0-pre2
#counts   SARE_HEAD_XLIB_INDY1     0s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#max      SARE_HEAD_XLIB_INDY1     13s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_HEAD_XLIB_INDY1     0s/0h of 10853 corpus (6391s/4462h CT) 05/16/05
#counts   SARE_HEAD_XLIB_INDY1     0s/0h of 2500 corpus (531s/1969h ft) 05/17/05

header    SARE_HEAD_XLIB_INDY2     X-Library=~ /Indy 8.0.25/
describe  SARE_HEAD_XLIB_INDY2     Uses S/W version which has only been seen in spam
score     SARE_HEAD_XLIB_INDY2     1.272
#ham      SARE_HEAD_XLIB_INDY2     verified (1)
#hist     SARE_HEAD_XLIB_INDY2     Created by Bob Menschel May 31 2004
#counts   SARE_HEAD_XLIB_INDY2     3s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_HEAD_XLIB_INDY2     130s/1h of 327690 corpus (159737s/167953h RM) 07/27/05
#counts   SARE_HEAD_XLIB_INDY2     91s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_HEAD_XLIB_INDY2     3s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_HEAD_XLIB_INDY2     0s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#max      SARE_HEAD_XLIB_INDY2     1s/0h of 17050 corpus (14617s/2433h MY) 08/08/04
#counts   SARE_HEAD_XLIB_INDY2     0s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#max      SARE_HEAD_XLIB_INDY2     2s/0h of 11052 corpus (6614s/4438h CT) 03/10/05
#counts   SARE_HEAD_XLIB_INDY2     30s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_HEAD_XLIB_INDY2     2s/0h of 6924 corpus (1403s/5521h ft) 07/27/05

header    SARE_HEAD_XUNSENT        X-Unsent =~ /\b1\b/i
describe  SARE_HEAD_XUNSENT        Found spamsign header
score     SARE_HEAD_XUNSENT        1.666
#hist     SARE_HEAD_XUNSENT        Alex Broens, June 10 2005
#counts   SARE_HEAD_XUNSENT        4s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_HEAD_XUNSENT        15436s/2h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HEAD_XUNSENT        1s/0h of 9991 corpus (5650s/4341h AxB) 05/14/06
#counts   SARE_HEAD_XUNSENT        0s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#max      SARE_HEAD_XUNSENT        57s/0h of 10590 corpus (5819s/4771h CT) 07/26/05
#counts   SARE_HEAD_XUNSENT        126s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_HEAD_XUNSENT        0s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06
#max      SARE_HEAD_XUNSENT        2s/0h of 6924 corpus (1403s/5521h ft) 07/27/05
#counts   SARE_HEAD_XUNSENT        98s/0h of 53950 corpus (16777s/37173h JH-3.01) 06/11/05
#counts   SARE_HEAD_XUNSENT        1s/0h of 47809 corpus (43224s/4585h MY) 07/27/05

#####################################################################################
#         SARE Rules which examine multiple header types
########  ######################   ##################################################

header    SARE_HEAD_8BIT_DATE      Date =~ /[\x80-\xff]{3}/
describe  SARE_HEAD_8BIT_DATE      High-ascii characters found in strange header
score     SARE_HEAD_8BIT_DATE      1.666
#hist     SARE_HEAD_8BIT_DATE      From Bugzilla # 2243
#ham      SARE_HEAD_8BIT_DATE      verified (1) 
#counts   SARE_HEAD_8BIT_DATE      20s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_HEAD_8BIT_DATE      433s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HEAD_8BIT_DATE      116s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_HEAD_8BIT_DATE      4s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#counts   SARE_HEAD_8BIT_DATE      0s/0h of 26190 corpus (22790s/3400h MY) 02/15/05
#counts   SARE_HEAD_8BIT_DATE      71s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06
#counts   SARE_HEAD_8BIT_DATE      3s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_HEAD_8BIT_DATE      65s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06

header    SARE_MULT_VIA_CITIZNET   ALL =~ /\@(?:\w+\.)?citiz\.net\b/i
describe  SARE_MULT_VIA_CITIZNET   header references apparent spam source
score     SARE_MULT_VIA_CITIZNET   1.394
#ham      SARE_MULT_VIA_CITIZNET   confirmed (2)
#hist     SARE_MULT_VIA_CITIZNET   Created by Bob Menschel Aug 23 2004
#counts   SARE_MULT_VIA_CITIZNET   25s/0h of 173032 corpus (99056s/73976h RM) 05/11/06
#max      SARE_MULT_VIA_CITIZNET   37s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_MULT_VIA_CITIZNET   60s/0h of 55929 corpus (51589s/4340h AxB2) 05/14/06
#counts   SARE_MULT_VIA_CITIZNET   0s/0h of 20489 corpus (17189s/3300h MY) 01/30/05
#max      SARE_MULT_VIA_CITIZNET   8s/0h of 18651 corpus (16120s/2531h MY) 08/29/04
#counts   SARE_MULT_VIA_CITIZNET   10s/0h of 55848 corpus (18671s/37177h JH-3.01) 06/10/05
#max      SARE_MULT_VIA_CITIZNET   11s/0h of 54176 corpus (16997s/37179h JH-3.01) 02/01/05
#counts   SARE_MULT_VIA_CITIZNET   3s/0h of 13313 corpus (7438s/5875h CT) 05/14/06
#counts   SARE_MULT_VIA_CITIZNET   40s/0h of 155430 corpus (103881s/51549h DOC) 05/15/06
#counts   SARE_MULT_VIA_CITIZNET   13s/0h of 42275 corpus (34158s/8117h FVGT) 05/15/06


# EOF