debian_pkg-listmaster/spamassassin_config/common/sare/70_sare_specific.cf

# SARE Specific Ruleset for SpamAssassin 
# Version: 01.03.13
# Created: 2004-05-28
# Modified: 2006-05-27
#@@# Revision History: 
#    01.00.00 - Created new rule set 
#    01.00.01 - Shortened some descriptions for version 3.0 lint
#    01.01.00 - Added rules for Word of Mouth / Shared Experiences spammer
#    01.01.01 - Removed rules duplicated elsewhere
#             - Minor score tweaks based on recent mass-check
#    01.01.02 - Migrated some rules here from HTML rule set
#             - Minor score tweaks based on recent mass-check
#    01.02.00 - Added a rule
#             - Removed some obsolete rules (spam nolonger hitting)
#    01.02.01 - Improved WoM rules. 
#               Moved ANUMA rule to new uri.cf file
#    01.02.02 - Added SARE_SPEC_FROM_WOMR
#               Added exclusion to SARE_SPEC_URI_WOMR
#    01.02.03 - Added __SARE_SPEC_BDY_WOMR8
#    01.02.04 - Added SARE_STRIPE
#    01.02.05 - Archived SARE_SPEC_MOOSQ, SARE_HTML_PILL3, SARE_HTML_PILL4
#    01.03.00 - Added Rolex rules
#    01.03.01 - Added SARE_SPEC_ROLEX_BRANDS and SARE_LOTTO rules
#    01.03.02 - Added SARE_SPEC_HDR_WOMR2 and SARE_SPEC_URI_WOMR2
#    01.03.03: May 26 2005
#              Minor score updates based on additional mass-check
#              Added "rawlex" intentional misspelling to rolex rules
#              Added SARE_SPEC_URI_GGFF
#              Added SARE_BODY_URI_STOCK
#    01.03.04: May 27 2005
#              No rule changes; simply correcting revision history. 
#    01.03.05: May 27 2005
#              Added SARE_SPEC_BODY_NONEED
#    01.03.06: Sept 22 2005
#              Modified WOMR From, Header, and URI rules. 
#              Added file 0:           SARE_SPEC_LEO_CHEM
#              Added file 0:           SARE_SPEC_LEO_COST
#              Added file 0:           SARE_SPEC_LEO_DOLLARS
#              Added file 0:           SARE_SPEC_LEO_DRUGS
#              Added file 0:           SARE_SPEC_LEO_LINE02
#              Added file 0:           SARE_SPEC_LEO_LINE03
#              Added file 0:           SARE_SPEC_LEO_LINE04
#              Added file 0:           SARE_SPEC_LEO_LINE04d
#              Added file 0:           SARE_SPEC_LEO_LINE06
#              Added file 0:           SARE_SPEC_LEO_MEDS
#              Added file 0:           SARE_SPEC_LEO_PHARM
#              Added file 0:           SARE_SPEC_LEO_PHARM2
#              Added file 0:           SARE_SPEC_SPAMIS_FROM
#              Added file 0:           SARE_SPEC_SPAMIS_RECV
#    01.03.07: Oct 1 2005
#              Added:           SARE_SPEC_SPAMIS_BDY1, _BDY2
#    01.03.08: Oct 13 2005
#              Added SARE_SPEC_LRD_COST_M1 and SARE_SPEC_LRD_COST_M2
#    01.03.09: Nov 18 2005
#              Minor score tweaks based on recent mass-check
#              Added SARE_SPEC_CLIENT_TOS
#              Added SARE_SPEC_CLIENT_TOS2
#              Added SARE_SPEC_DIPLOMA
#              Added SARE_SPEC_GETITFREE
#              Added SARE_SPEC_LEO_BORD
#              Added SARE_SPEC_LEO_PIE2
#              Added SARE_SPEC_PLEASEDOTHIS
#              Added SARE_SPEC_PROLEO_M1
#              Added SARE_SPEC_PROLEO_M1, M2, M2a
#              Added SARE_SPEC_REALLY_WORKS, WORK2, WORK3, WORK4
#              Added SARE_SPEC_ROLEX_HIQLT
#              Added SARE_SPEC_ROLEX_NOV5A
#              Added SARE_SPEC_XXGEOCITIES
#              Archive Aruba rules
#              Archive SARE_SPEC_BANNEDCD
#              Archive SARE_SPEC_DIRMEDIA
#              Archive SARE_SPEC_FROM_BOB
#              Archive SARE_SPEC_LEO_LINE06
#              Archive SARE_SPEC_URI_GGFF
#              Archive WOMR rules
#    01.03.10: Nov 18 2005
#              Added SARE_SPEC_ROLEX_NOV5B
#    01.03.11: Nov 24 2005
#              Minor score tweaks based on recent mass-check
#              Enhanced SARE_SPEC_XXGEOCITIES
#              Modified SARE_SPEC_PROLEO_M1 subrules
#              Added SARE_SPEC_ROLEX_NOV5C, NOV5D, NOV5E
#              Added SARE_SPEC_REPL_OBFU1, OBFU2, OBFU3, OBFU4, OBFU5, OBFU6
#              Added SARE_SPEC_REPLICA     
#              Added SARE_SPEC_SHORTQ      
#              Added SARE_SPEC_SPAMARREST  
#    01.03.12: Nov 25 2005
#              Improved SARE_SPEC_SPAMARREST to key only on spamarrest bounces
#              Expanded watch spam tests 
#@@# 01.03.13: May 27 2006
#@@#           Modified repetition counts for efficiency
#@@#           Minor score tweaks based on recent mass-check
#@@#           Added SARE_SPEC_XXGEOCITIE5
#@@#           Archived SARE_SPEC_CLIENT_TOS, SARE_SPEC_CLIENT_TOS2
#@@#           Archived SARE_SPEC_PLEASEDOTHIS
#@@#           Archived SARE_SPEC_GETITFREE
#@@#           Archived SARE_SPEC_GETITFREE2
#@@#           Archived SARE_SPEC_XXGEOCITIES
#@@#           Archived SARE_STRIPE
#@@#           Archived SARE_LOTTO_GREENCARD
#@@#           Archived SARE_SPEC_SHORTQ
#@@#           Archived SARE_SPEC_ROLEX_SUB2
#@@#           Archived SARE_SPEC_ROLEX_NOV5C

# License: Artistic - see http://www.rulesemporium.com/license.txt 
# Current Maintainer: Bob Menschel - RMSA@Menschel.net
# Current Home: http://www.rulesemporium.com/rules/70_sare_specific.cf 
#
# This rule set is intended to catch the M.O. of specific spammers and/or
# specific spam that might otherwise elude more general-purpose rules. 
# Our intent is that this rule set should not hit any non-spam. 
# Because of the nature of the specific spams this rules file aims for, 
# we cannot avoid ALL non-spam. However, any rule that hits ham hits 
# spam/ham by at least 1000:1. 
#
# Note that __subrules used within this rule set will frequently hit ham, 
# but the meta tests or other tests with scores should NOT hit any ham. 

body      __SARE_SPEC_SPAMARR_UR   m'http://(?:www\.)?spamarrest\.com/\w'
header    __SARE_SPEC_SPAMARR_SB   Subject =~ /Spam Arrest Verification Confirmation/
meta      SARE_SPEC_SPAMARREST     __SARE_SPEC_SPAMARR_UR && !__SARE_SPEC_SPAMARR_SB
describe  SARE_SPEC_SPAMARREST     probable invalid spam bounce 
score     SARE_SPEC_SPAMARREST     0.822
#ham      SARE_SPEC_SPAMARREST     confirmed
#hist     SARE_SPEC_SPAMARREST     Bob Menschel, Nov 2005
#note     SARE_SPEC_SPAMARREST     Since SpamArrest bounces contain only the headers of the original message, it's extremely 
#note     SARE_SPEC_SPAMARREST     difficult to get a false positive on them. We use a high score, so that subject tests can flag emails as spam.
#note     SARE_SPEC_SPAMARREST     We do require at least a 1.666 score from other rule(s), to avoid false positives
#counts   SARE_SPEC_SPAMARREST     45s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_SPAMARREST     403s/6h of 366082 corpus (108301s/257781h RM) 11/25/05
#counts   SARE_SPEC_SPAMARREST     3s/0h of 106098 corpus (72789s/33309h ML) 05/14/06

########  ######################   ##################################################
#  Rolex Rules
########  ######################   ##################################################

header    __SARE_SPEC_ROLEX_SUBJ   Subject =~ /\b(?:r(?:[0o@]|aw)[1l|][3e]x|[g6]ucc[1l|])/i
describe  __SARE_SPEC_ROLEX_SUBJ   Subject: mentions a Rolex/Gucci/etc.
body      __SARE_SPEC_ROLEX_BODY   /\b(?:r(?:[0o@]|aw)[1l|][3e]x|[g6]ucc[1l|])/i
describe  __SARE_SPEC_ROLEX_BODY   Body: mentions a Rolex/Gucci/etc.
header    __SARE_SPEC_WATCH_SUBJ   Subject =~ /\b(?:w[a@]tch|h[a@]ndb[a@][g6])/i
describe  __SARE_SPEC_WATCH_SUBJ   Subject: mentions watch/handbag/etc.
body      __SARE_SPEC_WATCH_BODY   /\b(?:w[a@]tch|h[a@]ndb[a@][g6])/i
describe  __SARE_SPEC_WATCH_BODY   Body: mentions watch/handbag/etc.

meta      SARE_SPEC_ROLEX          ( ( __SARE_SPEC_WATCH_SUBJ && __SARE_SPEC_ROLEX_BODY ) || ( __SARE_SPEC_ROLEX_SUBJ && __SARE_SPEC_WATCH_BODY ) || ( __SARE_SPEC_ROLEX_SUBJ && __SARE_SPEC_ROLEX_BODY ) )
describe  SARE_SPEC_ROLEX          Rolex watch spam
score     SARE_SPEC_ROLEX          1.666
#ham      SARE_SPEC_ROLEX          confirmed (2)
#hist     SARE_SPEC_ROLEX          Brent J. Nordquist -- b-nordquist at bethel.edu
#counts   SARE_SPEC_ROLEX          890s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_ROLEX          4335s/1h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_SPEC_ROLEX          115s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#counts   SARE_SPEC_ROLEX          15s/0h of 682 corpus (290s/392h CRF) 02/20/05
#counts   SARE_SPEC_ROLEX          93s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_ROLEX          151s/0h of 10801 corpus (6349s/4452h CT) 05/24/05
#counts   SARE_SPEC_ROLEX          611s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_ROLEX          434s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_ROLEX          680s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_ROLEX          556s/0h of 54874 corpus (17700s/37174h JH-3.01) 03/13/05
#counts   SARE_SPEC_ROLEX          298s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#counts   SARE_SPEC_ROLEX          76s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#max      SARE_SPEC_ROLEX          250s/0h of 57287 corpus (52272s/5015h MY) 09/22/05

rawbody   SARE_SPEC_WANT_ROLEX     /^\s{0,30}(?:do\s{1,30})?(?:you\s{1,30})?(?:want|need)\s{1,30}(?:a\s{1,30})?(?:(?:cheap|non.?(?:expensive|pricey))s{1,30})?(R(?:[0o@]|aw)lex\s{1,30})?watch\s{0,30}\?/i
describe  SARE_SPEC_WANT_ROLEX     Body: asks if we want/need a Rolex
score     SARE_SPEC_WANT_ROLEX     2.333
#hist     SARE_SPEC_WANT_ROLEX     Brent J. Nordquist -- b-nordquist at bethel.edu
#counts   SARE_SPEC_WANT_ROLEX     0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_WANT_ROLEX     2038s/0h of 238467 corpus (112478s/125989h RM) 02/28/05
#counts   SARE_SPEC_WANT_ROLEX     1s/0h of 682 corpus (290s/392h CRF) 02/20/05
#counts   SARE_SPEC_WANT_ROLEX     4s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_WANT_ROLEX     51s/0h of 11002 corpus (6572s/4430h CT) 03/10/05
#counts   SARE_SPEC_WANT_ROLEX     39s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#max      SARE_SPEC_WANT_ROLEX     169s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
#counts   SARE_SPEC_WANT_ROLEX     0s/0h of 4358 corpus (754s/3604h ft) 05/24/05
#counts   SARE_SPEC_WANT_ROLEX     264s/0h of 54874 corpus (17700s/37174h JH-3.01) 03/13/05
#counts   SARE_SPEC_WANT_ROLEX     4s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#counts   SARE_SPEC_WANT_ROLEX     0s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
#max      SARE_SPEC_WANT_ROLEX     6s/0h of 27712 corpus (24263s/3449h MY) 02/27/05

body      __SARE_SPEC_ROLEX_REP1   /r(?:[0o@]|aw)lex.{1,30}replica/i
body      __SARE_SPEC_ROLEX_REP2   /replica.{1,30}r(?:[0o@]|aw)lex/i
meta      SARE_SPEC_ROLEX_REP      (__SARE_SPEC_ROLEX_REP1 || __SARE_SPEC_ROLEX_REP2)
describe  SARE_SPEC_ROLEX_REP      Rolex Replica
score     SARE_SPEC_ROLEX_REP      1.666
#ham      SARE_SPEC_ROLEX_REP      Actual watch dealer / repair shop who occasionally fixes replicas
#hist     SARE_SPEC_ROLEX_REP      ninjaz -at- webexpress.com
#counts   SARE_SPEC_ROLEX_REP      383s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_ROLEX_REP      6436s/0h of 494544 corpus (223913s/270631h RM) 10/08/05
#counts   SARE_SPEC_ROLEX_REP      191s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#counts   SARE_SPEC_ROLEX_REP      1s/0h of 682 corpus (290s/392h CRF) 02/20/05
#counts   SARE_SPEC_ROLEX_REP      83s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_ROLEX_REP      128s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_ROLEX_REP      714s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_ROLEX_REP      392s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_ROLEX_REP      537s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_ROLEX_REP      255s/0h of 54874 corpus (17700s/37174h JH-3.01) 03/13/05
#counts   SARE_SPEC_ROLEX_REP      310s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#counts   SARE_SPEC_ROLEX_REP      25s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#max      SARE_SPEC_ROLEX_REP      112s/0h of 57287 corpus (52272s/5015h MY) 09/22/05

body      SARE_SPEC_ROLEX_SEL      /\bselection\b.{1,5}\bof\b.{1,30}\br(?:[0o@]|aw)lex/i
describe  SARE_SPEC_ROLEX_SEL      Large selection of Rolex
score     SARE_SPEC_ROLEX_SEL      2.222
#hist     SARE_SPEC_ROLEX_SEL      ninjaz -at- webexpress.com
#counts   SARE_SPEC_ROLEX_SEL      56s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_ROLEX_SEL      1411s/0h of 174352 corpus (98963s/75389h RM) 02/18/05
#counts   SARE_SPEC_ROLEX_SEL      17s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#counts   SARE_SPEC_ROLEX_SEL      2s/0h of 682 corpus (290s/392h CRF) 02/20/05
#counts   SARE_SPEC_ROLEX_SEL      6s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_ROLEX_SEL      27s/0h of 10801 corpus (6349s/4452h CT) 05/24/05
#counts   SARE_SPEC_ROLEX_SEL      7s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#max      SARE_SPEC_ROLEX_SEL      42s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
#counts   SARE_SPEC_ROLEX_SEL      12s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#counts   SARE_SPEC_ROLEX_SEL      65s/0h of 54874 corpus (17700s/37174h JH-3.01) 03/13/05
#counts   SARE_SPEC_ROLEX_SEL      23s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#counts   SARE_SPEC_ROLEX_SEL      0s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#max      SARE_SPEC_ROLEX_SEL      4s/0h of 57287 corpus (52272s/5015h MY) 09/22/05

body      SARE_SPEC_ROLEX_ORD      /\border\b.{1,30}\br(?:[0o@]|aw)lex/i
describe  SARE_SPEC_ROLEX_ORD      Order rolex
score     SARE_SPEC_ROLEX_ORD      2.222
#hist     SARE_SPEC_ROLEX_ORD      ninjaz -at- webexpress.com
#counts   SARE_SPEC_ROLEX_ORD      1s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_ROLEX_ORD      1166s/0h of 174352 corpus (98963s/75389h RM) 02/18/05
#counts   SARE_SPEC_ROLEX_ORD      1s/0h of 682 corpus (290s/392h CRF) 02/20/05
#counts   SARE_SPEC_ROLEX_ORD      0s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#max      SARE_SPEC_ROLEX_ORD      5s/0h of 11002 corpus (6572s/4430h CT) 03/10/05
#counts   SARE_SPEC_ROLEX_ORD      7s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#max      SARE_SPEC_ROLEX_ORD      51s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
#counts   SARE_SPEC_ROLEX_ORD      0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#max      SARE_SPEC_ROLEX_ORD      1s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_ROLEX_ORD      67s/0h of 54131 corpus (16957s/37174h JH-3.01) 03/02/05
#counts   SARE_SPEC_ROLEX_ORD      2s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#counts   SARE_SPEC_ROLEX_ORD      0s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
#max      SARE_SPEC_ROLEX_ORD      7s/0h of 27712 corpus (24263s/3449h MY) 02/27/05

body      SARE_SPEC_ROLEX_ITAL     /\bitalian\b.{1,30}\bcrafted\b.{1,30}\br(?:[0o@]|aw)lex/i
describe  SARE_SPEC_ROLEX_ITAL     Italian Crafted Rolex
score     SARE_SPEC_ROLEX_ITAL     2.222
#hist     SARE_SPEC_ROLEX_ITAL     ninjaz -at- webexpress.com
#counts   SARE_SPEC_ROLEX_ITAL     56s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_ROLEX_ITAL     118s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_SPEC_ROLEX_ITAL     17s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#counts   SARE_SPEC_ROLEX_ITAL     2s/0h of 682 corpus (290s/392h CRF) 02/20/05
#counts   SARE_SPEC_ROLEX_ITAL     2s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_ROLEX_ITAL     33s/0h of 11002 corpus (6572s/4430h CT) 03/10/05
#counts   SARE_SPEC_ROLEX_ITAL     12s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#max      SARE_SPEC_ROLEX_ITAL     83s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
#counts   SARE_SPEC_ROLEX_ITAL     12s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#counts   SARE_SPEC_ROLEX_ITAL     150s/0h of 54874 corpus (17700s/37174h JH-3.01) 03/13/05
#counts   SARE_SPEC_ROLEX_ITAL     24s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#counts   SARE_SPEC_ROLEX_ITAL     1s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
#max      SARE_SPEC_ROLEX_ITAL     12s/0h of 27712 corpus (24263s/3449h MY) 02/27/05

body      SARE_SPEC_ROLEX_PRICE    /r(?:[0o@]|aw)le.?x.{1,30}\bfrom\b.{1,30}\$\d{1,30}/i
describe  SARE_SPEC_ROLEX_PRICE    Rolex for only...
score     SARE_SPEC_ROLEX_PRICE    1.666
#hist     SARE_SPEC_ROLEX_PRICE    ninjaz -at- webexpress.com
#counts   SARE_SPEC_ROLEX_PRICE    1s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_ROLEX_PRICE    638s/0h of 174352 corpus (98963s/75389h RM) 02/18/05
#counts   SARE_SPEC_ROLEX_PRICE    0s/0h of 682 corpus (290s/392h CRF) 02/20/05
#counts   SARE_SPEC_ROLEX_PRICE    0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
#max      SARE_SPEC_ROLEX_PRICE    2s/0h of 11002 corpus (6572s/4430h CT) 03/10/05
#counts   SARE_SPEC_ROLEX_PRICE    5s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#max      SARE_SPEC_ROLEX_PRICE    42s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
#counts   SARE_SPEC_ROLEX_PRICE    0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#max      SARE_SPEC_ROLEX_PRICE    9s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_ROLEX_PRICE    72s/0h of 54131 corpus (16957s/37174h JH-3.01) 03/02/05
#counts   SARE_SPEC_ROLEX_PRICE    0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_ROLEX_PRICE    7s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
#counts   SARE_SPEC_ROLEX_PRICE    1s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
#max      SARE_SPEC_ROLEX_PRICE    8s/0h of 27712 corpus (24263s/3449h MY) 02/27/05

body      SARE_SPEC_ROLEX_BUY      /\bbuy\b.{1,30}\br(?:[0o@]|aw)lex/i
describe  SARE_SPEC_ROLEX_BUY      Buy rolex
score     SARE_SPEC_ROLEX_BUY      1.666
#ham      SARE_SPEC_ROLEX_BUY      confirmed (3) 
#hist     SARE_SPEC_ROLEX_BUY      ninjaz -at- webexpress.com
#counts   SARE_SPEC_ROLEX_BUY      191s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_ROLEX_BUY      5938s/0h of 494544 corpus (223913s/270631h RM) 10/08/05
#counts   SARE_SPEC_ROLEX_BUY      54s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#counts   SARE_SPEC_ROLEX_BUY      2s/0h of 682 corpus (290s/392h CRF) 02/20/05
#counts   SARE_SPEC_ROLEX_BUY      28s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_ROLEX_BUY      55s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_ROLEX_BUY      355s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_ROLEX_BUY      26s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_ROLEX_BUY      174s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_ROLEX_BUY      130s/0h of 54874 corpus (17700s/37174h JH-3.01) 03/13/05
#counts   SARE_SPEC_ROLEX_BUY      91s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#counts   SARE_SPEC_ROLEX_BUY      1s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#max      SARE_SPEC_ROLEX_BUY      23s/0h of 47717 corpus (43727s/3990h MY) 05/25/05

body      __SARE_SPEC_GENU_REPL    /\bgenuine\b.{1,30}\breplica/i
meta      SARE_SPEC_ROLEX_GENREP   ( __SARE_SPEC_GENU_REPL && SARE_SPEC_ROLEX )
describe  SARE_SPEC_ROLEX_GENREP   Genuine Replica Rolex!
score     SARE_SPEC_ROLEX_GENREP   1.666
#hist     SARE_SPEC_ROLEX_GENREP   ninjaz -at- webexpress.com
#counts   SARE_SPEC_ROLEX_GENREP   0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_ROLEX_GENREP   243s/0h of 400503 corpus (178160s/222343h RM) 03/31/05
#counts   SARE_SPEC_ROLEX_GENREP   2s/0h of 682 corpus (290s/392h CRF) 02/20/05
#counts   SARE_SPEC_ROLEX_GENREP   2s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_ROLEX_GENREP   25s/0h of 11002 corpus (6572s/4430h CT) 03/10/05
#counts   SARE_SPEC_ROLEX_GENREP   3s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#max      SARE_SPEC_ROLEX_GENREP   20s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
#counts   SARE_SPEC_ROLEX_GENREP   24s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#counts   SARE_SPEC_ROLEX_GENREP   83s/0h of 54874 corpus (17700s/37174h JH-3.01) 03/13/05
#counts   SARE_SPEC_ROLEX_GENREP   2s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#counts   SARE_SPEC_ROLEX_GENREP   0s/0h of 53432 corpus (48386s/5046h MY) 10/08/05
#max      SARE_SPEC_ROLEX_GENREP   12s/0h of 31513 corpus (27912s/3601h MY) 03/09/05

body      SARE_SPEC_ROLEX_CHEAP    /(?:cheap|non.?expensive){1,30}r(?:[0o@]|aw)le.?x/i
describe  SARE_SPEC_ROLEX_CHEAP    Cheap Rolex!
score     SARE_SPEC_ROLEX_CHEAP    1.178
#hist     SARE_SPEC_ROLEX_CHEAP    ninjaz -at- webexpress.com
#ham      SARE_SPEC_ROLEX_CHEAP    Spam statement quoted from NBC Universal CEO Bob Wright on electronic newsletter
#counts   SARE_SPEC_ROLEX_CHEAP    0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_ROLEX_CHEAP    81s/0h of 174380 corpus (98964s/75416h RM) 02/19/05
#counts   SARE_SPEC_ROLEX_CHEAP    0s/0h of 682 corpus (290s/392h CRF) 02/20/05
#counts   SARE_SPEC_ROLEX_CHEAP    0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
#max      SARE_SPEC_ROLEX_CHEAP    5s/0h of 11002 corpus (6572s/4430h CT) 03/10/05
#counts   SARE_SPEC_ROLEX_CHEAP    0s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#max      SARE_SPEC_ROLEX_CHEAP    2s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
#counts   SARE_SPEC_ROLEX_CHEAP    0s/0h of 4358 corpus (754s/3604h ft) 05/24/05
#counts   SARE_SPEC_ROLEX_CHEAP    15s/0h of 54131 corpus (16957s/37174h JH-3.01) 03/02/05
#counts   SARE_SPEC_ROLEX_CHEAP    0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_ROLEX_CHEAP    6s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
#counts   SARE_SPEC_ROLEX_CHEAP    0s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
#max      SARE_SPEC_ROLEX_CHEAP    3s/0h of 47717 corpus (43727s/3990h MY) 05/25/05

body      SARE_SPEC_REPLICA_OBFU   /\b(?:rep[l|]i[ck]a|rep lica|watach|wacth)\b/i
describe  SARE_SPEC_REPLICA_OBFU   Rolex with obfuscated replica
score     SARE_SPEC_REPLICA_OBFU   1.812
#stype    SARE_SPEC_REPLICA_OBFU   obfu
#ham      SARE_SPEC_REPLICA_OBFU   Replika in non-English emails
#hist     SARE_SPEC_REPLICA_OBFU   Robert Brooks, Feb 18 2005; Fred Taresevicius, Nov 2005
#counts   SARE_SPEC_REPLICA_OBFU   821s/4h of 173230 corpus (99061s/74169h RM) 05/11/06
#counts   SARE_SPEC_REPLICA_OBFU   1s/0h of 9999 corpus (5651s/4348h AxB) 05/14/06
#counts   SARE_SPEC_REPLICA_OBFU   0s/0h of 682 corpus (290s/392h CRF) 02/20/05
#counts   SARE_SPEC_REPLICA_OBFU   31s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#counts   SARE_SPEC_REPLICA_OBFU   58s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_REPLICA_OBFU   61s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#counts   SARE_SPEC_REPLICA_OBFU   4s/0h of 54131 corpus (16957s/37174h JH-3.01) 03/02/05
#counts   SARE_SPEC_REPLICA_OBFU   143s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#counts   SARE_SPEC_REPLICA_OBFU   12s/0h of 23026 corpus (17290s/5736h MY) 05/14/06

header    SARE_SPEC_ROLEX_AFFRD    Subject =~ /\bafford\b.{1,30}\br(?:[0o@]|aw)lex\b/i
describe  SARE_SPEC_ROLEX_AFFRD    Can you afford a rolex?
score     SARE_SPEC_ROLEX_AFFRD    0.867
#hist     SARE_SPEC_ROLEX_AFFRD    Robert Brooks, Feb 18 2005
#counts   SARE_SPEC_ROLEX_AFFRD    0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_ROLEX_AFFRD    47s/0h of 400503 corpus (178160s/222343h RM) 03/31/05
#counts   SARE_SPEC_ROLEX_AFFRD    0s/0h of 682 corpus (290s/392h CRF) 02/20/05
#counts   SARE_SPEC_ROLEX_AFFRD    0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
#max      SARE_SPEC_ROLEX_AFFRD    1s/0h of 11002 corpus (6572s/4430h CT) 03/10/05
#counts   SARE_SPEC_ROLEX_AFFRD    1s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
#counts   SARE_SPEC_ROLEX_AFFRD    3s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_ROLEX_AFFRD    4s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_ROLEX_AFFRD    3s/0h of 54131 corpus (16957s/37174h JH-3.01) 03/02/05
#counts   SARE_SPEC_ROLEX_AFFRD    0s/0h of 27712 corpus (24263s/3449h MY) 02/27/05

header    SARE_SPEC_ROLEX_BRANDS   Subject =~ /(\b(cartier|piaget|omega|longines|vuitton|r(?:[0o@]|aw)lex)\b.{0,30}){3,}/i
describe  SARE_SPEC_ROLEX_BRANDS   Spammer subject - multiple brands
score     SARE_SPEC_ROLEX_BRANDS   1.111
#stype    SARE_SPEC_ROLEX_BRANDS   spamp
#hist     SARE_SPEC_ROLEX_BRANDS   Robert Brooks, Feb 21 2005
#counts   SARE_SPEC_ROLEX_BRANDS   25s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_ROLEX_BRANDS   48s/0h of 400503 corpus (178160s/222343h RM) 03/31/05
#counts   SARE_SPEC_ROLEX_BRANDS   1s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#counts   SARE_SPEC_ROLEX_BRANDS   0s/0h of 11002 corpus (6572s/4430h CT) 03/10/05
#counts   SARE_SPEC_ROLEX_BRANDS   1s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
#counts   SARE_SPEC_ROLEX_BRANDS   26s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#counts   SARE_SPEC_ROLEX_BRANDS   20s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#counts   SARE_SPEC_ROLEX_BRANDS   0s/0h of 27712 corpus (24263s/3449h MY) 02/27/05
#counts   SARE_SPEC_ROLEX_BRANDS   0s/0h of 54131 corpus (16957s/37174h JH-3.01) 03/02/05

header    SARE_SPEC_ROLEX_BRAND2   Subject =~ /(?:yearn for|want) (?:cartier|piaget|omega|longines|vuitton|r(?:[0o@]|aw)lex)/i
describe  SARE_SPEC_ROLEX_BRAND2   Spammer subject - multiple brands
score     SARE_SPEC_ROLEX_BRAND2   1.111
#stype    SARE_SPEC_ROLEX_BRAND2   spamp
#hist     SARE_SPEC_ROLEX_BRAND2   Bob Menschel, Nov 2005
#counts   SARE_SPEC_ROLEX_BRAND2   8s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#counts   SARE_SPEC_ROLEX_BRAND2   4s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#counts   SARE_SPEC_ROLEX_BRAND2   2s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#counts   SARE_SPEC_ROLEX_BRAND2   2s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#counts   SARE_SPEC_ROLEX_BRAND2   3s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06

body      SARE_SPEC_ROLEX_HIQLT    m'high(?:est)?[- ]qualit(?:y|ies) (:?rep[|l]i[ck]a|reproduction|dup[l|]i[ck]ate|look)'i
describe  SARE_SPEC_ROLEX_HIQLT    replica watch spam sign
score     SARE_SPEC_ROLEX_HIQLT    1.666
#ham      SARE_SPEC_ROLEX_HIQLT    confirmation pending
#hist     SARE_SPEC_ROLEX_HIQLT    Bob Menschel, Nov 2005
#counts   SARE_SPEC_ROLEX_HIQLT    366s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_ROLEX_HIQLT    1051s/0h of 386238 corpus (131050s/255188h RM) 11/17/05
#counts   SARE_SPEC_ROLEX_HIQLT    63s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#counts   SARE_SPEC_ROLEX_HIQLT    37s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_ROLEX_HIQLT    53s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_ROLEX_HIQLT    325s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_ROLEX_HIQLT    13s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#counts   SARE_SPEC_ROLEX_HIQLT    16s/1h of 23026 corpus (17290s/5736h MY) 05/14/06
#counts   SARE_SPEC_ROLEX_HIQLT    79s/0h of 106098 corpus (72789s/33309h ML) 05/14/06

body      SARE_SPEC_ROLEX_NOV5A    /(?!want, watch)(?!(?:see|want)(?:[,s]|ed|ing)? (?:> )?(?:(?:me|you|him|her|them|us|--) )?(?:> )?(?:and|it|to|the|your) (?:> )?(?:clock|watch))(?:too many|see your|present of|replicas?|reproductions?|imitations?|duplicates?|look.?alike|decent|producing|acquire|(?:want|do not blow).{1,10}|solid(?:ly.?built)|wear.{1,10}new.{1,10}|(?:retail|consignment|Fair buys|fashionable|(?:gift|treat) for you|swiss.?(?:made|style)|be (?:trendy|visible) with).{1,25}) \b(?:(wrist(?:wear)? ?)?(?:watch(es)?|clocks?)|chrono(?:meter|piece|keeper)s?|time.?(?:piece|keeper)s?)\b/i
describe  SARE_SPEC_ROLEX_NOV5A    replica watch spam sign
score     SARE_SPEC_ROLEX_NOV5A    1.062
#hist     SARE_SPEC_ROLEX_NOV5A    Bob Menschel, Nov 2005
#counts   SARE_SPEC_ROLEX_NOV5A    142s/1h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_ROLEX_NOV5A    392s/7h of 386802 corpus (130807s/255995h RM) 11/13/05
#counts   SARE_SPEC_ROLEX_NOV5A    200s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#counts   SARE_SPEC_ROLEX_NOV5A    45s/4h of 13339 corpus (7462s/5877h CT) 05/14/06
#counts   SARE_SPEC_ROLEX_NOV5A    138s/3h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#counts   SARE_SPEC_ROLEX_NOV5A    288s/4h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_ROLEX_NOV5A    305s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#counts   SARE_SPEC_ROLEX_NOV5A    67s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#max      SARE_SPEC_ROLEX_NOV5A    71s/0h of 42678 corpus (37399s/5279h MY) 11/18/05

body      SARE_SPEC_ROLEX_NOV5B    /(?:appearance|brand.?name) at (?:a )?(?:dis[ck]ount|reasonable|sensible|(?:quarter|fra[ck]tion).{1,15}(?:[ck]ost|price|fee))|noteworthy variety|[ck]oveted provider|deluxe masterpiece|(?:more than|over) \d{4}.{1,15}(?:brands|styles)|Shopper gratifi[ck]ation|[ck]hronomaster|(?:sele[ck]tion of|solid(?:ly.?build|superb)) (?:repli[ck]as?|reprodu[ck]tions?|dupli[ck]ates?|look.?alikes?)|noteworthy [ck]onsignments?|(?:repli[ck]as?|reprodu[ck]tions?|dupli[ck]ates?|look.?alikes?) trade|fusion of craftmanship and affordability/i
describe  SARE_SPEC_ROLEX_NOV5B    replica watch spam sign
score     SARE_SPEC_ROLEX_NOV5B    1.111
#stype    SARE_SPEC_ROLEX_NOV5B    spamp
#hist     SARE_SPEC_ROLEX_NOV5B    Bob Menschel, Nov 2005
#counts   SARE_SPEC_ROLEX_NOV5B    0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_ROLEX_NOV5B    16s/0h of 330817 corpus (115576s/215241h RM) 11/19/05
#counts   SARE_SPEC_ROLEX_NOV5B    5s/0h of 4891 corpus (3546s/1345h AxB) 11/20/05
#counts   SARE_SPEC_ROLEX_NOV5B    0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#counts   SARE_SPEC_ROLEX_NOV5B    0s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#counts   SARE_SPEC_ROLEX_NOV5B    1s/0h of 74875 corpus (25026s/49849h DOC) 11/19/05
#counts   SARE_SPEC_ROLEX_NOV5B    0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_ROLEX_NOV5B    2s/0h of 9802 corpus (4922s/4880h FT) 11/20/05
#counts   SARE_SPEC_ROLEX_NOV5B    12s/0h of 42567 corpus (37305s/5262h MY) 11/19/05
#counts   SARE_SPEC_ROLEX_NOV5B    1s/0h of 106098 corpus (72789s/33309h ML) 05/14/06

body      SARE_SPEC_ROLEX_NOV5D    /online.{1,20}purchase.{1,20}watch|purchase.{1,20}watch.{1,20}online|purchase.{1,20}online.{1,20}watch|watch.{1,10}purchase.{1,20}online|Online trailing system/i
describe  SARE_SPEC_ROLEX_NOV5D    replica watch spam sign
score     SARE_SPEC_ROLEX_NOV5D    1.111
#stype    SARE_SPEC_ROLEX_NOV5D    spamp
#hist     SARE_SPEC_ROLEX_NOV5D    Bob Menschel, Nov 2005
#counts   SARE_SPEC_ROLEX_NOV5D    0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_ROLEX_NOV5D    4s/0h of 366082 corpus (108301s/257781h RM) 11/25/05
#counts   SARE_SPEC_ROLEX_NOV5D    1s/0h of 9999 corpus (5651s/4348h AxB) 05/14/06
#counts   SARE_SPEC_ROLEX_NOV5D    2s/0h of 106098 corpus (72789s/33309h ML) 05/14/06

body      SARE_SPEC_ROLEX_NOV5E    /(?!watch(?:ed|ing)?.{1,15}for you)\b(?:(wrist(?:wear)? ?)?(?:watch(es)?|clocks?)|chrono(?:meter|piece|keeper)s?|time.?(?:piece|keeper)s?).{1,15}for you\b/i
describe  SARE_SPEC_ROLEX_NOV5E    replica watch spam sign
score     SARE_SPEC_ROLEX_NOV5E    0.500
#hist     SARE_SPEC_ROLEX_NOV5E    Bob Menschel, Nov 2005
#stype    SARE_SPEC_ROLEX_NOV5E    spamp
#counts   SARE_SPEC_ROLEX_NOV5E    0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_ROLEX_NOV5E    6s/3h of 366109 corpus (108323s/257786h RM) 11/25/05
#counts   SARE_SPEC_ROLEX_NOV5E    1s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_ROLEX_NOV5E    1s/0h of 23026 corpus (17290s/5736h MY) 05/14/06

body      SARE_SPEC_ROLEX_NOV5F    /(?:decadent|brand.?name).{1,15}\b(?:(wrist(?:wear)? ?)?(?:watch(es)?|clocks?)|chrono(?:meter|piece|keeper)s?|time.?(?:piece|keeper)s?)\b/i
describe  SARE_SPEC_ROLEX_NOV5F    replica watch spam sign
score     SARE_SPEC_ROLEX_NOV5F    0.666
#stype    SARE_SPEC_ROLEX_NOV5F    spamp
#ham      SARE_SPEC_ROLEX_NOV5F    valid watch/clock importer/wholesaler
#hist     SARE_SPEC_ROLEX_NOV5F    Bob Menschel, Nov 2005
#counts   SARE_SPEC_ROLEX_NOV5F    0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_ROLEX_NOV5F    11s/2h of 366082 corpus (108301s/257781h RM) 11/25/05
#counts   SARE_SPEC_ROLEX_NOV5F    8s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_ROLEX_NOV5F    2s/0h of 23026 corpus (17290s/5736h MY) 05/14/06

body      SARE_SPEC_REPL_OBFU1     /(?!watches)(?!watch \* ?s)(?:w|\\\/\\\/|VV|[\xC5][\xB4-\xB5]|[\xCF][\x88-\x89]|[\xCF]\x8E])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|[\xC4][\x80-\x85]|[\xC7][\x8D-\x8E]|[\xC7][\xBA-\xBB]|[\xCE][\x86]|[\xCE][\x91]|[\xCE][\x94]|[\xCE][\x9B]|[\xCE][\xAC]|[\xCE][\xB1]|[\xD0][\x90]|[\xD0]\xB0)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|[\xC5][\xA2-\xA7]|[\xCE][\xA4]|[\xCF][\x84]|[\xD0][\xA2]|[\xD1]\x82)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[c\*\xC7\xE7\xA2\xA9]|[\xC4][\x86-\x8D]|[\xD0][\xA1]|[\xD1]\x81)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:h|[\xC4][\xA4-\xA7]|[\xCE][\x89]|[\xCE][\x97]|[\xD0][\x9D]|[\xD0][\xBD]|[\xD1][\x92]|[\xD2][\xA2-\xA3]|[\xD2][\xBA-\xBB]|[\xD5]\xB0])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE][\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|[\xD1]\x91)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[s5\$\xA7]|[\xC5][\x9A-\xA1]|[\xD0][\x85]|[\xD1][\x95]|[\xD5]\x8F)\b/i 
body      SARE_SPEC_REPL_OBFU2     /(?!wrist.?watch)(?:w|\\\/\\\/|VV|[\xC5][\xB4-\xB5]|[\xCF][\x88-\x89]|[\xCF]\x8E])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|[\xC5][\x94-\x99]|[\xD1]\x93)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|[\xC4][\xA8-\xB0]|[\xC4][\xBA]|[\xC4][\xBC]|[\xC4][\xBE]|[\xC5][\x80]|[\xC5][\x82]|[\xC7][\x8F-\x90]|[\xD0][\x86-\x87]|[\xD1][\x96-\x97]|[\xCE][\x8A]|[\xCE][\x90]|[\xCE][\x99]|[\xCE][\xAA]|[\xCE][\xAF]|[\xCE][\xB9]|[\xCF]\x8A)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[s5\$\xA7]|[\xC5][\x9A-\xA1]|[\xD0][\x85]|[\xD1][\x95]|[\xD5]\x8F)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|[\xC5][\xA2-\xA7]|[\xCE][\xA4]|[\xCF][\x84]|[\xD0][\xA2]|[\xD1]\x82)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:w|\\\/\\\/|VV|[\xC5][\xB4-\xB5]|[\xCF][\x88-\x89]|[\xCF]\x8E])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|[\xC4][\x80-\x85]|[\xC7][\x8D-\x8E]|[\xC7][\xBA-\xBB]|[\xCE][\x86]|[\xCE][\x91]|[\xCE][\x94]|[\xCE][\x9B]|[\xCE][\xAC]|[\xCE][\xB1]|[\xD0][\x90]|[\xD0]\xB0)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|[\xC5][\xA2-\xA7]|[\xCE][\xA4]|[\xCF][\x84]|[\xD0][\xA2]|[\xD1]\x82)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[c\*\xC7\xE7\xA2\xA9]|[\xC4][\x86-\x8D]|[\xD0][\xA1]|[\xD1]\x81)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:h|[\xC4][\xA4-\xA7]|[\xCE][\x89]|[\xCE][\x97]|[\xD0][\x9D]|[\xD0][\xBD]|[\xD1][\x92]|[\xD2][\xA2-\xA3]|[\xD2][\xBA-\xBB]|[\xD5]\xB0])/i
body      SARE_SPEC_REPL_OBFU3     /(?:w|\\\/\\\/|VV|[\xC5][\xB4-\xB5]|[\xCF][\x88-\x89]|[\xCF\x8E])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|[\xC5][\x94-\x99]|[\xD1\x93])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|[\xC4][\xA8-\xB0]|[\xC4][\xBA]|[\xC4][\xBC]|[\xC4][\xBE]|[\xC5][\x80]|[\xC5][\x82]|[\xC7][\x8F-\x90]|[\xD0][\x86-\x87]|[\xD1][\x96-\x97]|[\xCE][\x8A]|[\xCE][\x90]|[\xCE][\x99]|[\xCE][\xAA]|[\xCE][\xAF]|[\xCE][\xB9]|[\xCF\x8A])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[s5\$\xA7]|[\xC5][\x9A-\xA1]|[\xD0][\x85]|[\xD1][\x95]|[\xD5]\x8F)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|[\xC5][\xA2-\xA7]|[\xCE][\xA4]|[\xCF][\x84]|[\xD0][\xA2]|[\xD1]\x82)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[c\*\xC7\xE7\xA2\xA9]|[\xC4][\x86-\x8D]|[\xD0][\xA1]|[\xD1]\x81)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[l1I\|\xA3]|(?:\xC5[\x80-\x82]|[\xC4][\xB9-\xBF]))[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|[\xC5][\x8C-\x91]|[\xC6][\xA0-\xA1]|[\xC7][\x91-\x92]|[\xC7][\xBE-\xBF]|[\xCE][\x8C]|[\xCE][\x98]|[\xCE][\x9F]|[\xCE][\xB8]|[\xCE][\xBF]|[\xCF][\x8C]|[\xD0][\x9E]|[\xD0][\xBE]|[\xD5]\x95)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[c\*\xC7\xE7\xA2\xA9]|[\xC4][\x86-\x8D]|[\xD0][\xA1]|[\xD1\x81])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:k|[\xC4][\xB6-\xB8]|[\xCE][\x9A]|[\xCE][\xBA]|[\xD0][\x8C]|[\xD0][\x9A]|[\xD0][\xBA]|[\xD1][\x9C]|[\xD2][\x9A-\x9D]])/i
body      SARE_SPEC_REPL_OBFU4     /(?!chronometer)(?:[c\*\xC7\xE7\xA2\xA9]|[\xC4][\x86-\x8D]|[\xD0][\xA1]|[\xD1]\x81)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:h|[\xC4][\xA4-\xA7]|[\xCE][\x89]|[\xCE][\x97]|[\xD0][\x9D]|[\xD0][\xBD]|[\xD1][\x92]|[\xD2][\xA2-\xA3]|[\xD2][\xBA-\xBB]|[\xD5]\xB0])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|[\xC5][\x94-\x99]|[\xD1]\x93)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|[\xC5][\x8C-\x91]|[\xC6][\xA0-\xA1]|[\xC7][\x91-\x92]|[\xC7][\xBE-\xBF]|[\xCE][\x8C]|[\xCE][\x98]|[\xCE][\x9F]|[\xCE][\xB8]|[\xCE][\xBF]|[\xCF][\x8C]|[\xD0][\x9E]|[\xD0][\xBE]|[\xD5]\x95)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[n\xD1\xF1]|\|\\\||[\xC5][\x83-\x8B]|[\xCE][\x9D]|[\xCE][\xA0]|[\xCE][\xAE]|[\xCE][\xB7]|[\xD5][\xB2]|[\xD5]\xB8)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|[\xC5][\x8C-\x91]|[\xC6][\xA0-\xA1]|[\xC7][\x91-\x92]|[\xC7][\xBE-\xBF]|[\xCE][\x8C]|[\xCE][\x98]|[\xCE][\x9F]|[\xCE][\xB8]|[\xCE][\xBF]|[\xCF][\x8C]|[\xD0][\x9E]|[\xD0][\xBE]|[\xD5]\x95)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:m|rn|\/V\\|\/\\\/\\|[\xCE][\x9C]|[\xD0][\x9C]|[\xD0]\xBC])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE][\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|[\xD1]\x91)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|[\xC5][\xA2-\xA7]|[\xCE][\xA4]|[\xCF][\x84]|[\xD0][\xA2]|[\xD1]\x82)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE][\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|[\xD1\x91])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|[\xC5][\x94-\x99]|[\xD1\x93])/i
body      SARE_SPEC_REPL_OBFU5     /(?!time.?piece)(?:[t\+]|[\xC5][\xA2-\xA7]|[\xCE][\xA4]|[\xCF][\x84]|[\xD0][\xA2]|[\xD1]\x82)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|[\xC4][\xA8-\xB0]|[\xC4][\xBA]|[\xC4][\xBC]|[\xC4][\xBE]|[\xC5][\x80]|[\xC5][\x82]|[\xC7][\x8F-\x90]|[\xD0][\x86-\x87]|[\xD1][\x96-\x97]|[\xCE][\x8A]|[\xCE][\x90]|[\xCE][\x99]|[\xCE][\xAA]|[\xCE][\xAF]|[\xCE][\xB9]|[\xCF]\x8A)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:m|rn|\/V\\|\/\\\/\\|[\xCE][\x9C]|[\xD0][\x9C]|[\xD0]\xBC])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE][\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|[\xD1]\x91)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[p\xDE]|[\xCE][\xA1]|[\xCF][\x81]|[\xD0][\xA0]|[\xD1]\x80)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|[\xC4][\xA8-\xB0]|[\xC4][\xBA]|[\xC4][\xBC]|[\xC4][\xBE]|[\xC5][\x80]|[\xC5][\x82]|[\xC7][\x8F-\x90]|[\xD0][\x86-\x87]|[\xD1][\x96-\x97]|[\xCE][\x8A]|[\xCE][\x90]|[\xCE][\x99]|[\xCE][\xAA]|[\xCE][\xAF]|[\xCE][\xB9]|[\xCF]\x8A)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE][\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|[\xD1]\x91)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[c\*\xC7\xE7\xA2\xA9]|[\xC4][\x86-\x8D]|[\xD0][\xA1]|[\xD1]\x81)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE][\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|[\xD1]\x91)/i
body      SARE_SPEC_REPL_OBFU6     /(?!time.?keeper)(?:[t\+]|[\xC5][\xA2-\xA7]|[\xCE][\xA4]|[\xCF][\x84]|[\xD0][\xA2]|[\xD1]\x82)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|[\xC4][\xA8-\xB0]|[\xC4][\xBA]|[\xC4][\xBC]|[\xC4][\xBE]|[\xC5][\x80]|[\xC5][\x82]|[\xC7][\x8F-\x90]|[\xD0][\x86-\x87]|[\xD1][\x96-\x97]|[\xCE][\x8A]|[\xCE][\x90]|[\xCE][\x99]|[\xCE][\xAA]|[\xCE][\xAF]|[\xCE][\xB9]|[\xCF]\x8A)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:m|rn|\/V\\|\/\\\/\\|[\xCE][\x9C]|[\xD0][\x9C]|[\xD0]\xBC])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE][\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|[\xD1]\x91)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:k|[\xC4][\xB6-\xB8]|[\xCE][\x9A]|[\xCE][\xBA]|[\xD0][\x8C]|[\xD0][\x9A]|[\xD0][\xBA]|[\xD1][\x9C]|[\xD2][\x9A-\x9D]])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE][\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|[\xD1]\x91)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE][\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|[\xD1]\x91)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[p\xDE]|[\xCE][\xA1]|[\xCF][\x81]|[\xD0][\xA0]|[\xD1]\x80)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE][\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|[\xD1]\x91)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|[\xC5][\x94-\x99]|[\xD1]\x93)/i
score     SARE_SPEC_REPL_OBFU1     1.666
score     SARE_SPEC_REPL_OBFU2     1.666
score     SARE_SPEC_REPL_OBFU3     1.666
score     SARE_SPEC_REPL_OBFU4     1.666
score     SARE_SPEC_REPL_OBFU5     1.666
score     SARE_SPEC_REPL_OBFU6     1.666
#stype    SARE_SPEC_REPL_OBFU1     obfu
#stype    SARE_SPEC_REPL_OBFU2     obfu
#stype    SARE_SPEC_REPL_OBFU3     obfu
#stype    SARE_SPEC_REPL_OBFU4     obfu
#stype    SARE_SPEC_REPL_OBFU5     obfu
#stype    SARE_SPEC_REPL_OBFU6     obfu
#hist     SARE_SPEC_REPL_OBFU1     Bob Menschel, Nov 2005
#hist     SARE_SPEC_REPL_OBFU2     Bob Menschel, Nov 2005
#hist     SARE_SPEC_REPL_OBFU3     Bob Menschel, Nov 2005
#hist     SARE_SPEC_REPL_OBFU4     Bob Menschel, Nov 2005
#hist     SARE_SPEC_REPL_OBFU5     Bob Menschel, Nov 2005
#hist     SARE_SPEC_REPL_OBFU6     Bob Menschel, Nov 2005
#counts   SARE_SPEC_REPL_OBFU1     0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#counts   SARE_SPEC_REPL_OBFU1     8s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#counts   SARE_SPEC_REPL_OBFU1     1s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#counts   SARE_SPEC_REPL_OBFU1     10s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_REPL_OBFU1     37s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#counts   SARE_SPEC_REPL_OBFU1     7s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#counts   SARE_SPEC_REPL_OBFU1     2s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#counts   SARE_SPEC_REPL_OBFU2     0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#counts   SARE_SPEC_REPL_OBFU2     1s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_REPL_OBFU3     0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#counts   SARE_SPEC_REPL_OBFU3     4s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#counts   SARE_SPEC_REPL_OBFU3     1s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_REPL_OBFU4     0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#counts   SARE_SPEC_REPL_OBFU5     0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#counts   SARE_SPEC_REPL_OBFU5     6s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#counts   SARE_SPEC_REPL_OBFU6     0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_REPL_OBFU1     8s/0h of 366109 corpus (108323s/257786h RM) 11/25/05
#max      SARE_SPEC_REPL_OBFU2     6s/0h of 366109 corpus (108323s/257786h RM) 11/25/05
#max      SARE_SPEC_REPL_OBFU3     22s/0h of 366109 corpus (108323s/257786h RM) 11/25/05
#max      SARE_SPEC_REPL_OBFU4     1s/0h of 366109 corpus (108323s/257786h RM) 11/25/05
#max      SARE_SPEC_REPL_OBFU5     0s/0h of 366109 corpus (108323s/257786h RM) 11/25/05
#max      SARE_SPEC_REPL_OBFU6     0s/0h of 366109 corpus (108323s/257786h RM) 11/25/05

########  ######################   ##################################################
#  Lottery spam
########  ######################   ##################################################

body      __SARE_LOTTO_LOTTERY     /\blott(?:o|ery)/i
body      __SARE_LOTTO_BATCH       /batch number/i
body      __SARE_LOTTO_SERIAL      /serial number/i
body      __SARE_LOTTO_TICKET      /ticket number/i
body      __SARE_LOTTO_LUCKY       /lucky number/i
body      __SARE_LOTTO_CATEGORY    /categor(?:y|ies)/i
body      __SARE_LOTTO_CONGRAT     /congratulation/i

meta      SARE_LOTTO_SPAM          __SARE_LOTTO_LOTTERY && __SARE_LOTTO_SERIAL && __SARE_LOTTO_TICKET && __SARE_LOTTO_CATEGORY && __SARE_LOTTO_CONGRAT
describe  SARE_LOTTO_SPAM          Lottery Spam
score     SARE_LOTTO_SPAM          2.444
#hist     SARE_LOTTO_SPAM          Robert Brooks, Feb 18 2005
#stype    SARE_LOTTO_SPAM          spamg
#counts   SARE_LOTTO_SPAM          111s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_LOTTO_SPAM          3270s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_LOTTO_SPAM          60s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#counts   SARE_LOTTO_SPAM          3s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_LOTTO_SPAM          3s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
#counts   SARE_LOTTO_SPAM          200s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_LOTTO_SPAM          120s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_LOTTO_SPAM          160s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_LOTTO_SPAM          44s/0h of 54874 corpus (17700s/37174h JH-3.01) 03/13/05
#counts   SARE_LOTTO_SPAM          134s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#counts   SARE_LOTTO_SPAM          6s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#max      SARE_LOTTO_SPAM          24s/0h of 31513 corpus (27912s/3601h MY) 03/09/05

meta      SARE_LOTTO_SPAM2         __SARE_LOTTO_LOTTERY && __SARE_LOTTO_BATCH
describe  SARE_LOTTO_SPAM2         Lottery Spam
score     SARE_LOTTO_SPAM2         2.444
#hist     SARE_LOTTO_SPAM2         Robert Brooks, Feb 18 2005
#stype    SARE_LOTTO_SPAM2         spamg
#counts   SARE_LOTTO_SPAM2         178s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_LOTTO_SPAM2         3607s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_LOTTO_SPAM2         114s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#counts   SARE_LOTTO_SPAM2         25s/0h of 682 corpus (290s/392h CRF) 03/11/05
#counts   SARE_LOTTO_SPAM2         3s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#counts   SARE_LOTTO_SPAM2         238s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_LOTTO_SPAM2         145s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_LOTTO_SPAM2         180s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_LOTTO_SPAM2         54s/0h of 54874 corpus (17700s/37174h JH-3.01) 03/13/05
#counts   SARE_LOTTO_SPAM2         166s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#counts   SARE_LOTTO_SPAM2         4s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#max      SARE_LOTTO_SPAM2         27s/0h of 31513 corpus (27912s/3601h MY) 03/09/05

########  ######################   ##################################################
#  Spammers who identify themselves or their specific product in message body
########  ######################   ##################################################

body      SARE_BODY_URI_STOCK      /st[0o]ck\s{0,30}\d{1,30}\s{0,30}\@\s{0,30}yahoo.com/i 
describe  SARE_BODY_URI_STOCK      Signature of stock market spammer
score     SARE_BODY_URI_STOCK      1.666
#hist     SARE_BODY_URI_STOCK      Bob Menschel, Apr 17 2005, from a variety of suggestions
#counts   SARE_BODY_URI_STOCK      0s/0h of 494544 corpus (223913s/270631h RM) 10/08/05
#max      SARE_BODY_URI_STOCK      400s/0h of 281295 corpus (109907s/171388h RM) 05/06/05
#counts   SARE_BODY_URI_STOCK      0s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_BODY_URI_STOCK      4s/0h of 10801 corpus (6349s/4452h CT) 05/24/05
#counts   SARE_BODY_URI_STOCK      172s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_BODY_URI_STOCK      0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#max      SARE_BODY_URI_STOCK      26s/0h of 4358 corpus (754s/3604h ft) 05/24/05
#counts   SARE_BODY_URI_STOCK      0s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
#max      SARE_BODY_URI_STOCK      2s/0h of 47717 corpus (43727s/3990h MY) 05/25/05

body      SARE_SPEC_BODY_NONEED    /\b(?:noneed|st0ck)\d{2,4}/
describe  SARE_SPEC_BODY_NONEED    No need to spam us!
score     SARE_SPEC_BODY_NONEED    1.666
#hist     SARE_SPEC_BODY_NONEED    Robert Brooks, May 27 2005
#counts   SARE_SPEC_BODY_NONEED    0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_BODY_NONEED    313s/0h of 256964 corpus (112869s/144095h RM) 05/27/05
#counts   SARE_SPEC_BODY_NONEED    0s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_BODY_NONEED    5s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
#counts   SARE_SPEC_BODY_NONEED    222s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_BODY_NONEED    0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#max      SARE_SPEC_BODY_NONEED    34s/0h of 4359 corpus (759s/3600h ft) 05/27/05
#counts   SARE_SPEC_BODY_NONEED    0s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#max      SARE_SPEC_BODY_NONEED    4s/0h of 57287 corpus (52272s/5015h MY) 09/22/05

header    SARE_SPEC_DIPLOMA        Subject =~ m'\bd.?iplomas?\b'i
describe  SARE_SPEC_DIPLOMA        educational spam subject
score     SARE_SPEC_DIPLOMA        1.094
#hist     SARE_SPEC_DIPLOMA        Bob Menschel, Nov 2005
#counts   SARE_SPEC_DIPLOMA        117s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#counts   SARE_SPEC_DIPLOMA        0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#max      SARE_SPEC_DIPLOMA        1s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
#counts   SARE_SPEC_DIPLOMA        10s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#counts   SARE_SPEC_DIPLOMA        46s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_DIPLOMA        8s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#counts   SARE_SPEC_DIPLOMA        196s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#counts   SARE_SPEC_DIPLOMA        4s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#max      SARE_SPEC_DIPLOMA        6s/0h of 42678 corpus (37399s/5279h MY) 11/18/05

body      SARE_SPEC_ANTIDOTE       /(?:"The Antidote"|Health Monthly Newsletter|Kills all Known|full-guarantee)/i
describe  SARE_SPEC_ANTIDOTE       Antidote spammer
score     SARE_SPEC_ANTIDOTE       1.666
#hist     SARE_SPEC_ANTIDOTE       Loren Wilton, May 29 2005
#ham      SARE_SPEC_ANTIDOTE       mentions book with title "The Antidote" avail from amazon.com
#counts   SARE_SPEC_ANTIDOTE       0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_ANTIDOTE       329s/0h of 273328 corpus (132835s/140493h RM) 05/30/05
#counts   SARE_SPEC_ANTIDOTE       0s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_ANTIDOTE       26s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
#counts   SARE_SPEC_ANTIDOTE       3s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#max      SARE_SPEC_ANTIDOTE       10s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
#counts   SARE_SPEC_ANTIDOTE       0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#max      SARE_SPEC_ANTIDOTE       82s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_ANTIDOTE       0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_ANTIDOTE       1s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
#counts   SARE_SPEC_ANTIDOTE       0s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#max      SARE_SPEC_ANTIDOTE       227s/0h of 57287 corpus (52272s/5015h MY) 09/22/05

header    SARE_SPEC_SPAMIS_FROM    From =~ /\bspamis\b/i 
describe  SARE_SPEC_SPAMIS_FROM    Possibly from or via spammer system
score     SARE_SPEC_SPAMIS_FROM    1.666
#stype    SARE_SPEC_SPAMIS_FROM    spamg
#hist     SARE_SPEC_SPAMIS_FROM    Bob Menschel, Aug 07 2005
#counts   SARE_SPEC_SPAMIS_FROM    0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_SPAMIS_FROM    79s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_SPEC_SPAMIS_FROM    0s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_SPAMIS_FROM    15s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_SPAMIS_FROM    0s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#max      SARE_SPEC_SPAMIS_FROM    1s/0h of 57287 corpus (52272s/5015h MY) 09/22/05

header    SARE_SPEC_SPAMIS_RECV    Received =~ /\bspamis\b/i 
describe  SARE_SPEC_SPAMIS_RECV    Possibly from or via spammer system
score     SARE_SPEC_SPAMIS_RECV    1.666
#stype    SARE_SPEC_SPAMIS_RECV    spamg
#hist     SARE_SPEC_SPAMIS_RECV    Bob Menschel, Aug 07 2005
#counts   SARE_SPEC_SPAMIS_RECV    0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_SPAMIS_RECV    80s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_SPEC_SPAMIS_RECV    0s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_SPAMIS_RECV    15s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_SPAMIS_RECV    0s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#max      SARE_SPEC_SPAMIS_RECV    1s/0h of 57287 corpus (52272s/5015h MY) 09/22/05

body      SARE_SPEC_SPAMIS_BDY1    /\b(?:spamis|s p a m i s)\b/i 
describe  SARE_SPEC_SPAMIS_BDY1    Possibly from or via spammer system
score     SARE_SPEC_SPAMIS_BDY1    1.666
#stype    SARE_SPEC_SPAMIS_BDY1    spamg
#hist     SARE_SPEC_SPAMIS_BDY1    Bob Menschel, Sep 26 2005
#counts   SARE_SPEC_SPAMIS_BDY1    0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_SPAMIS_BDY1    93s/0h of 646449 corpus (258764s/387685h RM) 09/30/05
#counts   SARE_SPEC_SPAMIS_BDY1    0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#counts   SARE_SPEC_SPAMIS_BDY1    5s/0h of 3327 corpus (2029s/1298h AXB) 10/02/05
#counts   SARE_SPEC_SPAMIS_BDY1    0s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_SPAMIS_BDY1    21s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_SPAMIS_BDY1    3s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#max      SARE_SPEC_SPAMIS_BDY1    4s/0h of 54753 corpus (49767s/4986h MY) 10/01/05
#counts   SARE_SPEC_SPAMIS_BDY1    0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#max      SARE_SPEC_SPAMIS_BDY1    13s/0h of 139999 corpus (133260s/6739h ft) 10/09/05

body      SARE_SPEC_SPAMIS_BDY2    /P\s?O\s?B\s?o\s?x\s?1\s?2\s?5\s?9\s?,\s?S\s?e\s?a\s?t\s?t\s?l\s?e\s?,\s?W\s?A\s?9\s?8\s?1\s?0\s?1/i 
describe  SARE_SPEC_SPAMIS_BDY2    Possibly from or via spammer system
score     SARE_SPEC_SPAMIS_BDY2    1.666
#stype    SARE_SPEC_SPAMIS_BDY2    spamg
#hist     SARE_SPEC_SPAMIS_BDY2    Bob Menschel, Sep 26 2005
#counts   SARE_SPEC_SPAMIS_BDY2    0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#counts   SARE_SPEC_SPAMIS_BDY2    0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#max      SARE_SPEC_SPAMIS_BDY2    5s/0h of 3327 corpus (2029s/1298h AXB) 10/02/05
#counts   SARE_SPEC_SPAMIS_BDY2    15s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_SPAMIS_BDY2    27s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_SPAMIS_BDY2    0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_SPAMIS_BDY2    10s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
#counts   SARE_SPEC_SPAMIS_BDY2    5s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
#counts   SARE_SPEC_SPAMIS_BDY2    0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#max      SARE_SPEC_SPAMIS_BDY2    203s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_SPAMIS_BDY2    6s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05

body      SARE_SPEC_LEO_DOLLARS    /(?:\$[13]\s){3}/
score     SARE_SPEC_LEO_DOLLARS    2.444
describe  SARE_SPEC_LEO_DOLLARS    Leo table drug spam
#hist     SARE_SPEC_LEO_DOLLARS    Loren Wilton, Sept 07, 2005
#counts   SARE_SPEC_LEO_DOLLARS    0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_LEO_DOLLARS    3095s/0h of 494544 corpus (223913s/270631h RM) 10/08/05
#counts   SARE_SPEC_LEO_DOLLARS    3s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_LEO_DOLLARS    12s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_LEO_DOLLARS    24s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_LEO_DOLLARS    0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#max      SARE_SPEC_LEO_DOLLARS    59s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_LEO_DOLLARS    0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_LEO_DOLLARS    122s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
#counts   SARE_SPEC_LEO_DOLLARS    11s/0h of 53432 corpus (48386s/5046h MY) 10/08/05

body      SARE_SPEC_LEO_DOLLARSa   /(?:\$\s?[123]\s){3}/
score     SARE_SPEC_LEO_DOLLARSa   1.666
describe  SARE_SPEC_LEO_DOLLARSa   Leo table drug spam
#ham      SARE_SPEC_LEO_DOLLARSa   source code, list of $n parameters
#hist     SARE_SPEC_LEO_DOLLARSa   Loren Wilton, Sept 07, 2005, mod Oct 8 2005
#counts   SARE_SPEC_LEO_DOLLARSa   0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_LEO_DOLLARSa   3095s/1h of 494544 corpus (223913s/270631h RM) 10/08/05
#counts   SARE_SPEC_LEO_DOLLARSa   3s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_LEO_DOLLARSa   12s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_LEO_DOLLARSa   25s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_LEO_DOLLARSa   0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#max      SARE_SPEC_LEO_DOLLARSa   59s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_LEO_DOLLARSa   0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_LEO_DOLLARSa   122s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
#counts   SARE_SPEC_LEO_DOLLARSa   11s/0h of 53432 corpus (48386s/5046h MY) 10/08/05

body      SARE_SPEC_LEO_COST       /(?:\s\$[13]){3}\s(?:(?:21|75|33)[\.\s]){3}/
score     SARE_SPEC_LEO_COST       2.222
describe  SARE_SPEC_LEO_COST       Table drug cost
#hist     SARE_SPEC_LEO_COST       Loren Wilton, Sept 07, 2005
#counts   SARE_SPEC_LEO_COST       0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_LEO_COST       1595s/0h of 494544 corpus (223913s/270631h RM) 10/08/05
#counts   SARE_SPEC_LEO_COST       0s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_LEO_COST       7s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_LEO_COST       0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#max      SARE_SPEC_LEO_COST       8s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_LEO_COST       0s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
#counts   SARE_SPEC_LEO_COST       0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_LEO_COST       48s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
#counts   SARE_SPEC_LEO_COST       5s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05

body      SARE_SPEC_LEO_COSTa      /(?:\s\$\s?[123]){3}\s(?:\d\d[\.\s]){3}/
score     SARE_SPEC_LEO_COSTa      2.222
describe  SARE_SPEC_LEO_COSTa      Table drug cost
#hist     SARE_SPEC_LEO_COSTa      Loren Wilton, Sept 07, 2005, mod Oct 8 2005
#counts   SARE_SPEC_LEO_COSTa      0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_LEO_COSTa      1612s/0h of 494544 corpus (223913s/270631h RM) 10/08/05
#counts   SARE_SPEC_LEO_COSTa      1s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_LEO_COSTa      8s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_LEO_COSTa      0s/0h of 53432 corpus (48386s/5046h MY) 10/08/05
#counts   SARE_SPEC_LEO_COSTa      0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#max      SARE_SPEC_LEO_COSTa      8s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_LEO_COSTa      0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_LEO_COSTa      54s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
#counts   SARE_SPEC_LEO_COSTa      5s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05

body      __SARE_SPEC_LRD_COST1    /3\.75/
body      __SARE_SPEC_LRD_COST2    /1\.21/
body      __SARE_SPEC_LRD_COST3    /3\.33/
meta      SARE_SPEC_LRD_COST_M1    __SARE_SPEC_LRD_COST1 && __SARE_SPEC_LRD_COST2 && __SARE_SPEC_LRD_COST3
describe  SARE_SPEC_LRD_COST_M1    LEO drug pricing variations
score     SARE_SPEC_LRD_COST_M1    0.698
#ham      SARE_SPEC_LRD_COST_M1    firewall logs emailed 
#hist     SARE_SPEC_LRD_COST_M1    Raymond Dijkxhoorn, Oct 2005
#counts   SARE_SPEC_LRD_COST_M1    0s/2h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_LRD_COST_M1    4374s/32h of 494544 corpus (223913s/270631h RM) 10/08/05
#counts   SARE_SPEC_LRD_COST_M1    0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#max      SARE_SPEC_LRD_COST_M1    3s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
#counts   SARE_SPEC_LRD_COST_M1    17s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#counts   SARE_SPEC_LRD_COST_M1    101s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_LRD_COST_M1    0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_LRD_COST_M1    589s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_LRD_COST_M1    55s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#counts   SARE_SPEC_LRD_COST_M1    5s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_LRD_COST_M1    189s/0h of 19215 corpus (15849s/3366h ML) 11/18/05

body      __SARE_SPEC_PROLEO1      /85(\,|\.)45|1(\,|\.)(20|21|22|56)/
body      __SARE_SPEC_PROLEO2      /69(\,|\.)95|2(\,|\.)78|3(\,|\.)(32|33|70)/
body      __SARE_SPEC_PROLEO3      /99(\,|\.)95|3(\,|\.)(00|35|75)/
uri       __SARE_SPEC_PROLEO4      /http:\/\/.{0,30}\.tripod\.com/
body      __SARE_SPEC_PROLEO5      /http:\/\/www\.\b/
meta      SARE_SPEC_PROLEO_M1      (__SARE_SPEC_PROLEO1 && __SARE_SPEC_PROLEO2 && __SARE_SPEC_PROLEO3 && __SARE_SPEC_PROLEO4)
describe  SARE_SPEC_PROLEO_M1      Leo drug spam signs
score     SARE_SPEC_PROLEO_M1      4.000
#stype    SARE_SPEC_PROLEO_M1      spamg 
#hist     SARE_SPEC_PROLEO_M1      Raymond Dijkxhoorn, Nov 2005
#counts   SARE_SPEC_PROLEO_M1      0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#counts   SARE_SPEC_PROLEO_M1      0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#max      SARE_SPEC_PROLEO_M1      248s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
#counts   SARE_SPEC_PROLEO_M1      18s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#counts   SARE_SPEC_PROLEO_M1      6s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#counts   SARE_SPEC_PROLEO_M1      27s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
#counts   SARE_SPEC_PROLEO_M1      0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_PROLEO_M1      84s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#counts   SARE_SPEC_PROLEO_M1      0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_PROLEO_M1      316s/0h of 19215 corpus (15849s/3366h ML) 11/18/05

meta      SARE_SPEC_PROLEO_M2      (__SARE_SPEC_PROLEO1 && __SARE_SPEC_PROLEO2 && __SARE_SPEC_PROLEO3 && __SARE_SPEC_PROLEO5 && !SARE_SPEC_PROLEO_M2a)
describe  SARE_SPEC_PROLEO_M2      Leo drug spam signs
score     SARE_SPEC_PROLEO_M2      0.692
#hist     SARE_SPEC_PROLEO_M2      Raymond Dijkxhoorn, Nov 2005
#counts   SARE_SPEC_PROLEO_M2      1s/5h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_PROLEO_M2      108s/20h of 366082 corpus (108301s/257781h RM) 11/25/05
#counts   SARE_SPEC_PROLEO_M2      42s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#counts   SARE_SPEC_PROLEO_M2      0s/3h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#max      SARE_SPEC_PROLEO_M2      4s/0h of 4178 corpus (2833s/1345h AxB) 11/12/05
#counts   SARE_SPEC_PROLEO_M2      27s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#counts   SARE_SPEC_PROLEO_M2      142s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_PROLEO_M2      0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_PROLEO_M2      1s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#counts   SARE_SPEC_PROLEO_M2      9s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_PROLEO_M2      10s/0h of 19215 corpus (15849s/3366h ML) 11/18/05

meta      SARE_SPEC_PROLEO_M2a     (__SARE_SPEC_PROLEO1 && __SARE_SPEC_PROLEO2 && __SARE_SPEC_PROLEO3 && __SARE_SPEC_PROLEO5 && MIME_QP_LONG_LINE)
describe  SARE_SPEC_PROLEO_M2a     Leo drug spam signs
score     SARE_SPEC_PROLEO_M2a     3.333
#stype    SARE_SPEC_PROLEO_M2a     spamg 
rawbody   MIME_QP_LONG_LINE        eval:check_for_mime('mime_qp_long_line')
#hist     SARE_SPEC_PROLEO_M2a     Raymond Dijkxhoorn, Nov 2005
#counts   SARE_SPEC_PROLEO_M2a     0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_PROLEO_M2a     255s/0h of 366082 corpus (108301s/257781h RM) 11/25/05
#counts   SARE_SPEC_PROLEO_M2a     0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#max      SARE_SPEC_PROLEO_M2a     4s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
#counts   SARE_SPEC_PROLEO_M2a     5s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_PROLEO_M2a     7s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_PROLEO_M2a     25s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_PROLEO_M2a     0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_PROLEO_M2a     13s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#counts   SARE_SPEC_PROLEO_M2a     0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_PROLEO_M2a     134s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
#counts   SARE_SPEC_PROLEO_M2a     0s/0h of 42678 corpus (37399s/5279h MY) 11/18/05

body      __SARE_SPEC_LRD_COST4    /134/                                                              
body      __SARE_SPEC_LRD_COST5    /169/                                                              
body      __SARE_SPEC_LRD_COST6    /218/                                                              
header    __SARE_SPEC_LRD_COST7    Subject =~ /ceutical/i                                             
meta      SARE_SPEC_LRD_COST_M2    __SARE_SPEC_LRD_COST4 && __SARE_SPEC_LRD_COST5 && __SARE_SPEC_LRD_COST6 && __SARE_SPEC_LRD_COST7
describe  SARE_SPEC_LRD_COST_M2    LEO drug pricing variations
score     SARE_SPEC_LRD_COST_M2    1.111
#stype    SARE_SPEC_LRD_COST_M2    spamp
#hist     SARE_SPEC_LRD_COST_M2    Raymond Dijkxhoorn, Oct 2005
#counts   SARE_SPEC_LRD_COST_M2    0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_LRD_COST_M2    36s/0h of 366109 corpus (108323s/257786h RM) 11/25/05
#counts   SARE_SPEC_LRD_COST_M2    1s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_LRD_COST_M2    0s/0h of 53432 corpus (48386s/5046h MY) 10/08/05
#counts   SARE_SPEC_LRD_COST_M2    0s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_LRD_COST_M2    0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_LRD_COST_M2    17s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
#counts   SARE_SPEC_LRD_COST_M2    4s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05

body      __SARE_SPEC_LEO_DRGS     /^(?:Am|Me|Pr|Le|Xa|Ci|Ce|Vi|Ul|Va){3,}\s(?:bi|ri|op|vi|na|al|le|ag|tr|li){3,}\s(?:en|dia|ecia|tra|x|is|brex|ra|am|um){3,}\s/   # no /i
body      __SARE_SPEC_LEO_DRGS5a   /\b(?:(?:Am|AM|Me|ME|Pr|PR|Le|LE|Xa|XA|Ci|CI|Ce|CE|Vi|VI|Ul|UL|Va|VA)(?:$|\s{1,30})){10}/
body      __SARE_SPEC_LEO_DRGS5b   /\b(?:(?:bi|ri|op|vi|na|al|le|ag|tr|li)(?:$|\s{1,30})){10}/i
body      __SARE_SPEC_LEO_DRGS5c   /\b(?:(?:am|di|dia|br|brex|ra|en|x|um|ec|ecia|is|tr|tra)(?:$|\s{1,30})){10}/i
body      __SARE_SPEC_LEO_DRGS6a   /\b(?:(?:M|L|A|P|C|V|V|X|U|C)(?:$|\s{1,30})){10}/
body      __SARE_SPEC_LEO_DRGS6b   /\b(?:(?:e|e|m|r|I|I|A|a|l|e)(?:$|\s{1,30})){10}/i
body      __SARE_SPEC_LEO_DRGS6c   /\b(?:(?:r|v|b|o|A|A|L|n|t|l)(?:$|\s{1,30})){10}/i
body      __SARE_SPEC_LEO_DRGS6d   /\b(?:(?:d|t|e|e|I|R|U|x|a|b)(?:$|\s{1,30})){10}/i

meta      SARE_SPEC_LEO_DRUGS      __SARE_SPEC_LEO_DRGS || (__SARE_SPEC_LEO_DRGS5a && __SARE_SPEC_LEO_DRGS5b && __SARE_SPEC_LEO_DRGS5c) || (__SARE_SPEC_LEO_DRGS6a && __SARE_SPEC_LEO_DRGS6b && __SARE_SPEC_LEO_DRGS6c && __SARE_SPEC_LEO_DRGS6d)
score     SARE_SPEC_LEO_DRUGS      2.888
describe  SARE_SPEC_LEO_DRUGS      Vertical table drug spam
#hist     SARE_SPEC_LEO_DRUGS      Loren Wilton, Sept 07, 2005
#counts   SARE_SPEC_LEO_DRUGS      0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_LEO_DRUGS      6734s/0h of 494544 corpus (223913s/270631h RM) 10/08/05
#counts   SARE_SPEC_LEO_DRUGS      230s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
#counts   SARE_SPEC_LEO_DRUGS      0s/1h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_LEO_DRUGS      27s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_LEO_DRUGS      0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#max      SARE_SPEC_LEO_DRUGS      48s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_LEO_DRUGS      0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_LEO_DRUGS      238s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
#counts   SARE_SPEC_LEO_DRUGS      21s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05

body      SARE_SPEC_LEO_MEDS       /(?!medications?)\b(?:m|rn|\/V\\|\/\\\/\\]).?(?:[e3\*\xC8-\xCB\xE8-\xEB]).?(?:[d\xD0]).?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]).?(?:[c\*\xC7\xE7\xA2\xA9]).?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\).?(?:[t\+]).?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]).?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]).?(?:[n\xD1\xF1]|\|\\\|).?(?:[s5\$\xA7])?/i
describe  SARE_SPEC_LEO_MEDS       obfuscated subject body  
score     SARE_SPEC_LEO_MEDS       1.666
#hist     SARE_SPEC_LEO_MEDS       Bob Menschel, Sept 11, 2005
#ham      SARE_SPEC_LEO_MEDS       misspelling
#counts   SARE_SPEC_LEO_MEDS       263s/1h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_LEO_MEDS       6780s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_SPEC_LEO_MEDS       34s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#counts   SARE_SPEC_LEO_MEDS       12s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_LEO_MEDS       40s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
#counts   SARE_SPEC_LEO_MEDS       191s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#max      SARE_SPEC_LEO_MEDS       240s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
#counts   SARE_SPEC_LEO_MEDS       46s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_LEO_MEDS       722s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_LEO_MEDS       67s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#max      SARE_SPEC_LEO_MEDS       452s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
#counts   SARE_SPEC_LEO_MEDS       307s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_LEO_MEDS       355s/0h of 19215 corpus (15849s/3366h ML) 11/18/05

body      SARE_SPEC_LEO_PHARM      /(?!pharmac(?:y|ies))\b(?:[p\xDE]).?h.?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\).?(?:[r\xAE]).?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\)?(?:m|rn|\/V\\|\/\\\/\\]).?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\)?(?:[c\*\xC7\xE7\xA2\xA9])(?:(?:[y\xA5\xDD\xFD])|(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]).?(?:[e3\*\xC8-\xCB\xE8-\xEB]).?(?:[s5\$\xA7]))/i
describe  SARE_SPEC_LEO_PHARM      obfuscated subject body  
score     SARE_SPEC_LEO_PHARM      1.666
#hist     SARE_SPEC_LEO_PHARM      Bob Menschel, Sept 11, 2005
#ham      SARE_SPEC_LEO_PHARM      misspelling (2)
#counts   SARE_SPEC_LEO_PHARM      413s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_LEO_PHARM      3205s/3h of 679260 corpus (323056s/356204h RM) 09/13/05
#counts   SARE_SPEC_LEO_PHARM      87s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#counts   SARE_SPEC_LEO_PHARM      167s/2h of 13339 corpus (7462s/5877h CT) 05/14/06
#counts   SARE_SPEC_LEO_PHARM      1000s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_LEO_PHARM      45s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_LEO_PHARM      692s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_LEO_PHARM      105s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#max      SARE_SPEC_LEO_PHARM      462s/0h of 53432 corpus (48386s/5046h MY) 10/08/05
#counts   SARE_SPEC_LEO_PHARM      1996s/0h of 106098 corpus (72789s/33309h ML) 05/14/06

body      SARE_SPEC_LEO_PHARM2     /(?!Pharmaceuticals?)\b(?:[p\xDE]).?h.?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\).?(?:[r\xAE]).?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\)?(?:m|rn|\/V\\|\/\\\/\\]).?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\).?(?:[c\*\xC7\xE7\xA2\xA9]).?(?:[e3\*\xC8-\xCB\xE8-\xEB]).?(?:[uv\*\xB5\xD9-\xDC\xF9-\xFC]).?(?:[t\+]).?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]).?(?:[c\*\xC7\xE7\xA2\xA9]).?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\).?(?:[l1I\|\xA3]).?(?:[s5\$\xA7])?/i
describe  SARE_SPEC_LEO_PHARM2     obfuscated subject body  
score     SARE_SPEC_LEO_PHARM2     1.666
#hist     SARE_SPEC_LEO_PHARM2     Bob Menschel, Sept 11, 2005
#ham      SARE_SPEC_LEO_PHARM2     Intentional strange spacing
#counts   SARE_SPEC_LEO_PHARM2     30s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_LEO_PHARM2     5774s/2h of 494544 corpus (223913s/270631h RM) 10/08/05
#counts   SARE_SPEC_LEO_PHARM2     23s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#counts   SARE_SPEC_LEO_PHARM2     188s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_LEO_PHARM2     27s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_LEO_PHARM2     467s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_LEO_PHARM2     134s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#max      SARE_SPEC_LEO_PHARM2     167s/0h of 53432 corpus (48386s/5046h MY) 10/08/05
#counts   SARE_SPEC_LEO_PHARM2     9s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_LEO_PHARM2     137s/0h of 19215 corpus (15849s/3366h ML) 11/18/05

body      SARE_SPEC_LEO_CHEM       /(?!chemist)\b(?:[c\*\xC7\xE7\xA2\xA9]).?h.?(?:[e3\*\xC8-\xCB\xE8-\xEB]).?(?:m|rn|\/V\\|\/\\\/\\]).?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]).?(?:[s5\$\xA7]).?(?:[t\+])/i
describe  SARE_SPEC_LEO_CHEM       obfuscated subject body  
score     SARE_SPEC_LEO_CHEM       0.992
#hist     SARE_SPEC_LEO_CHEM       Bob Menschel, Sept 11, 2005
#counts   SARE_SPEC_LEO_CHEM       1s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_LEO_CHEM       50s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_SPEC_LEO_CHEM       0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#max      SARE_SPEC_LEO_CHEM       1s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
#counts   SARE_SPEC_LEO_CHEM       0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
#counts   SARE_SPEC_LEO_CHEM       0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#max      SARE_SPEC_LEO_CHEM       1s/0h of 7500 corpus (1767s/5733h ft) 09/18/05
#counts   SARE_SPEC_LEO_CHEM       3s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#max      SARE_SPEC_LEO_CHEM       152s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
#counts   SARE_SPEC_LEO_CHEM       0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_LEO_CHEM       2s/0h of 19215 corpus (15849s/3366h ML) 11/18/05

body      SARE_SPEC_LEO_LINE02     m'(?:[A-Z][a-z]{1,2}){5}\w{1,30}\s[a-z]{10}'
describe  SARE_SPEC_LEO_LINE02     common Leo body text
score     SARE_SPEC_LEO_LINE02     2.666
#hist     SARE_SPEC_LEO_LINE02     Bob Menschel, Sept 11, 2005
#counts   SARE_SPEC_LEO_LINE02     3s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_LEO_LINE02     5058s/0h of 494544 corpus (223913s/270631h RM) 10/08/05
#counts   SARE_SPEC_LEO_LINE02     1s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_LEO_LINE02     20s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_LEO_LINE02     27s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_LEO_LINE02     0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_LEO_LINE02     72s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_LEO_LINE02     0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_LEO_LINE02     205s/0h of 19215 corpus (15849s/3366h ML) 11/18/05

rawbody   SARE_SPEC_LEO_LINE03a    m'<DIV[^>]{0,40}style=[^>]{0,40}FLOAT: left;'i
describe  SARE_SPEC_LEO_LINE03a    common Leo body text
score     SARE_SPEC_LEO_LINE03a    0.408
#hist     SARE_SPEC_LEO_LINE03a    Bob Menschel, Sept 11, 2005, modified Oct 8 2005
#counts   SARE_SPEC_LEO_LINE03a    3s/19h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_LEO_LINE03a    11045s/41h of 494544 corpus (223913s/270631h RM) 10/08/05
#counts   SARE_SPEC_LEO_LINE03a    43s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#counts   SARE_SPEC_LEO_LINE03a    26s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_LEO_LINE03a    36s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_LEO_LINE03a    153s/42h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_LEO_LINE03a    0s/1h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_LEO_LINE03a    860s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_LEO_LINE03a    0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_LEO_LINE03a    368s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
#counts   SARE_SPEC_LEO_LINE03a    260s/4h of 23026 corpus (17290s/5736h MY) 05/14/06

rawbody   SARE_SPEC_LEO_LINE03b    m'<DIV[^>]{0,40}style=[^>]{0,40}(?:BORDER|MARGIN|PADDING)-(?:BOTTOM|LEFT|RIGHT|TOP)-WIDTH: 0px;'i
describe  SARE_SPEC_LEO_LINE03b    common Leo body text
score     SARE_SPEC_LEO_LINE03b    2.222
#hist     SARE_SPEC_LEO_LINE03b    Bob Menschel, Oct 8 2005
#counts   SARE_SPEC_LEO_LINE03b    81s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_LEO_LINE03b    380s/0h of 366082 corpus (108301s/257781h RM) 11/25/05
#counts   SARE_SPEC_LEO_LINE03b    8s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#counts   SARE_SPEC_LEO_LINE03b    38s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#counts   SARE_SPEC_LEO_LINE03b    303s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_LEO_LINE03b    46s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#counts   SARE_SPEC_LEO_LINE03b    7s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#counts   SARE_SPEC_LEO_LINE03b    134s/0h of 106098 corpus (72789s/33309h ML) 05/14/06

rawbody   SARE_SPEC_LEO_LINE03e    m'<TABLE[^>]{0,40}style=[^>]{0,40}(?:BORDER|MARGIN|PADDING)-(?:BOTTOM|LEFT|RIGHT|TOP)-WIDTH: 0px;'i
describe  SARE_SPEC_LEO_LINE03e    common Leo body text
score     SARE_SPEC_LEO_LINE03e    0.635
#ham      SARE_SPEC_LEO_LINE03e    confirmed (3)
#hist     SARE_SPEC_LEO_LINE03e    Bob Menschel, Oct 8 2005
#counts   SARE_SPEC_LEO_LINE03e    2s/1h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_LEO_LINE03e    759s/5h of 366082 corpus (108301s/257781h RM) 11/25/05
#counts   SARE_SPEC_LEO_LINE03e    1s/1h of 9999 corpus (5651s/4348h AxB) 05/14/06
#max      SARE_SPEC_LEO_LINE03e    25s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
#counts   SARE_SPEC_LEO_LINE03e    4s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_LEO_LINE03e    5s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_LEO_LINE03e    33s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_LEO_LINE03e    0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_LEO_LINE03e    55s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_LEO_LINE03e    17s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
#counts   SARE_SPEC_LEO_LINE03e    0s/1h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_LEO_LINE03e    162s/1h of 19215 corpus (15849s/3366h ML) 11/18/05

rawbody   SARE_SPEC_LEO_LINE03f    m'<TABLE[^>]{0,40}style=[^>]{0,40}(?:BORDER|MARGIN|PADDING)-(?:BOTTOM|LEFT|RIGHT|TOP): 0px;'i
describe  SARE_SPEC_LEO_LINE03f    common Leo body text
score     SARE_SPEC_LEO_LINE03f    0.612
#hist     SARE_SPEC_LEO_LINE03f    Bob Menschel, Oct 8 2005
#counts   SARE_SPEC_LEO_LINE03f    0s/1h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_LEO_LINE03f    2134s/22h of 366082 corpus (108301s/257781h RM) 11/25/05
#counts   SARE_SPEC_LEO_LINE03f    0s/3h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#max      SARE_SPEC_LEO_LINE03f    47s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
#counts   SARE_SPEC_LEO_LINE03f    11s/2h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_LEO_LINE03f    15s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_LEO_LINE03f    68s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_LEO_LINE03f    0s/4h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_LEO_LINE03f    144s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_LEO_LINE03f    43s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#counts   SARE_SPEC_LEO_LINE03f    0s/1h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_LEO_LINE03f    436s/1h of 19215 corpus (15849s/3366h ML) 11/18/05

rawbody   SARE_SPEC_LEO_LINE04     m'(?:(?:<BR>+)+(?:<B>)?[a-z]{1,3}(?:<\B>)?){5}'i
describe  SARE_SPEC_LEO_LINE04     common Leo body text
score     SARE_SPEC_LEO_LINE04     1.666
#hist     SARE_SPEC_LEO_LINE04     Bob Menschel, Sept 11, 2005
#ham      SARE_SPEC_LEO_LINE04     S P O I L E R spelled vertically to give people a chance to not scroll down to the spoiler.
#counts   SARE_SPEC_LEO_LINE04     0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_LEO_LINE04     8643s/2h of 494544 corpus (223913s/270631h RM) 10/08/05
#counts   SARE_SPEC_LEO_LINE04     0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#max      SARE_SPEC_LEO_LINE04     50s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
#counts   SARE_SPEC_LEO_LINE04     42s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#counts   SARE_SPEC_LEO_LINE04     179s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_LEO_LINE04     185s/1h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_LEO_LINE04     815s/1h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_LEO_LINE04     198s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#counts   SARE_SPEC_LEO_LINE04     16s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_LEO_LINE04     398s/0h of 19215 corpus (15849s/3366h ML) 11/18/05

rawbody   SARE_SPEC_LEO_LINE04d    m'(?:(?:<BR>+)(?:<B>)?[a-z]{1,3}(?:<\B>)?){9}'i
describe  SARE_SPEC_LEO_LINE04d    common Leo body text
score     SARE_SPEC_LEO_LINE04d    1.666
#ham      SARE_SPEC_LEO_LINE04d    confirmed 
#hist     SARE_SPEC_LEO_LINE04d    Bob Menschel, Sept 11, 2005
#counts   SARE_SPEC_LEO_LINE04d    0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_LEO_LINE04d    3605s/0h of 494544 corpus (223913s/270631h RM) 10/08/05
#counts   SARE_SPEC_LEO_LINE04d    1s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_LEO_LINE04d    19s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_LEO_LINE04d    26s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_LEO_LINE04d    0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#max      SARE_SPEC_LEO_LINE04d    39s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
#counts   SARE_SPEC_LEO_LINE04d    134s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
#counts   SARE_SPEC_LEO_LINE04d    16s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_LEO_LINE04d    206s/0h of 19215 corpus (15849s/3366h ML) 11/18/05

full      SARE_SPEC_LEO_PIE2       />(?:[a-z]\s){3,7}[a-z]<.{4,50}>(?:[a-z]\s){3,7}[a-z]<.{4,50}>(?:[a-z]\s){3,5}[a-z]/is
describe  SARE_SPEC_LEO_PIE2       pseudo-table-format spam
score     SARE_SPEC_LEO_PIE2       4.000
#stype    SARE_SPEC_LEO_PIE2       spamg
#hist     SARE_SPEC_LEO_PIE2       Fred Tarasevicius, Nov 2005
#counts   SARE_SPEC_LEO_PIE2       0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_LEO_PIE2       1462s/0h of 366109 corpus (108323s/257786h RM) 11/25/05
#counts   SARE_SPEC_LEO_PIE2       0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#max      SARE_SPEC_LEO_PIE2       304s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
#counts   SARE_SPEC_LEO_PIE2       8s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#counts   SARE_SPEC_LEO_PIE2       36s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_LEO_PIE2       0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_LEO_PIE2       102s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#counts   SARE_SPEC_LEO_PIE2       12s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#counts   SARE_SPEC_LEO_PIE2       1s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#counts   SARE_SPEC_LEO_PIE2       425s/0h of 19215 corpus (15849s/3366h ML) 11/18/05

header    __SARE_SPEC_SUBJ_LEO     Subject =~ /^(?:Re:\s?)?(?:\w{4,20}\s){2,4}\s?$/
rawbody   __SARE_SPEC_BORDER_W0    /BORDER-(?:RIGHT|TOP)-WIDTH: 0/
meta      SARE_SPEC_LEO_BORD       (__SARE_SPEC_SUBJ_LEO && __SARE_SPEC_BORDER_W0)
score     SARE_SPEC_LEO_BORD       0.639
#stype    SARE_SPEC_LEO_BORD       spamg
#hist     SARE_SPEC_LEO_BORD       Fred Tarasevicius, Nov 2005
#counts   SARE_SPEC_LEO_BORD       6s/1h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_LEO_BORD       410s/6h of 366082 corpus (108301s/257781h RM) 11/25/05
#counts   SARE_SPEC_LEO_BORD       0s/1h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#counts   SARE_SPEC_LEO_BORD       1s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_LEO_BORD       19s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_LEO_BORD       0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_LEO_BORD       16s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#counts   SARE_SPEC_LEO_BORD       0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_LEO_BORD       4s/0h of 8121 corpus (6866s/1255h ML) 11/04/05
#counts   SARE_SPEC_LEO_BORD       19s/0h of 23026 corpus (17290s/5736h MY) 05/14/06

header    SARE_SPEC_REALLY_WORKS   Subject =~ m'really works (?:wonder|excellent|good|amazing|great|fine|very)'i
describe  SARE_SPEC_REALLY_WORKS   spamsign for specific drug spammer
score     SARE_SPEC_REALLY_WORKS   1.666
#hist     SARE_SPEC_REALLY_WORKS   Bob Menschel, Nov 2005
#counts   SARE_SPEC_REALLY_WORKS   0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_REALLY_WORKS   478s/0h of 386238 corpus (131050s/255188h RM) 11/17/05
#counts   SARE_SPEC_REALLY_WORKS   0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#max      SARE_SPEC_REALLY_WORKS   6s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
#counts   SARE_SPEC_REALLY_WORKS   1s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_REALLY_WORKS   2s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_REALLY_WORKS   6s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_REALLY_WORKS   0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_REALLY_WORKS   10s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#counts   SARE_SPEC_REALLY_WORKS   0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_REALLY_WORKS   48s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
#counts   SARE_SPEC_REALLY_WORKS   17s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#max      SARE_SPEC_REALLY_WORKS   24s/0h of 42678 corpus (37399s/5279h MY) 11/18/05

header    SARE_SPEC_REALLY_WORK2   Subject =~ m'works wonders?$'i 
describe  SARE_SPEC_REALLY_WORK2   spamsign for specific drug spammer
score     SARE_SPEC_REALLY_WORK2   0.617
#hist     SARE_SPEC_REALLY_WORK2   Bob Menschel, Nov 2005
#counts   SARE_SPEC_REALLY_WORK2   0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_REALLY_WORK2   118s/1h of 386238 corpus (131050s/255188h RM) 11/17/05
#counts   SARE_SPEC_REALLY_WORK2   0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#max      SARE_SPEC_REALLY_WORK2   5s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
#counts   SARE_SPEC_REALLY_WORK2   0s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#max      SARE_SPEC_REALLY_WORK2   1s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_REALLY_WORK2   1s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
#counts   SARE_SPEC_REALLY_WORK2   0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#max      SARE_SPEC_REALLY_WORK2   6s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
#counts   SARE_SPEC_REALLY_WORK2   0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_REALLY_WORK2   13s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
#counts   SARE_SPEC_REALLY_WORK2   5s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#max      SARE_SPEC_REALLY_WORK2   13s/0h of 42678 corpus (37399s/5279h MY) 11/18/05

header    SARE_SPEC_REALLY_WORK3   Subject =~ m'really works\!$'i 
describe  SARE_SPEC_REALLY_WORK3   spamsign for specific drug spammer
score     SARE_SPEC_REALLY_WORK3   1.017
#hist     SARE_SPEC_REALLY_WORK3   Bob Menschel, Nov 2005
#counts   SARE_SPEC_REALLY_WORK3   0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_REALLY_WORK3   54s/0h of 386238 corpus (131050s/255188h RM) 11/17/05
#counts   SARE_SPEC_REALLY_WORK3   0s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
#counts   SARE_SPEC_REALLY_WORK3   23s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_REALLY_WORK3   6s/0h of 106098 corpus (72789s/33309h ML) 05/14/06

header    SARE_SPEC_REALLY_WORK4   Subject =~ m'(?:\b(?:you|u) (?:could|might|do|maybe)? ?need it|(?:useful|interesting) information|don\'t (?:miss (?:the|a good) chance|miss it)|good proposal|just (?:do|think about) it|very good news|to let you know|(?:upi|u) can (?:do|ride) it|just have a look|(?:new|good) offr)\W{0,30}$'i
describe  SARE_SPEC_REALLY_WORK4   spamsign for specific drug spammer
score     SARE_SPEC_REALLY_WORK4   0.665
#hist     SARE_SPEC_REALLY_WORK4   Bob Menschel, Nov 2005
#counts   SARE_SPEC_REALLY_WORK4   14s/10h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_REALLY_WORK4   2566s/11h of 366082 corpus (108301s/257781h RM) 11/25/05
#counts   SARE_SPEC_REALLY_WORK4   12s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
#max      SARE_SPEC_REALLY_WORK4   130s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
#counts   SARE_SPEC_REALLY_WORK4   11s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#counts   SARE_SPEC_REALLY_WORK4   101s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_REALLY_WORK4   34s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#counts   SARE_SPEC_REALLY_WORK4   29s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#max      SARE_SPEC_REALLY_WORK4   254s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
#counts   SARE_SPEC_REALLY_WORK4   16s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#max      SARE_SPEC_REALLY_WORK4   31s/0h of 42678 corpus (37399s/5279h MY) 11/18/05

########  ######################   ##################################################
#         Spammers identified by their web site or "service"
########  ######################   ##################################################

uri       __SARE_SPEC_XXGEOCITIE   m'\b(?:(?!www)[a-z]{2,3})\.(?:geocities|tripod)\.com/\w{1,30}/\?'i
uri       __SARE_SPEC_XX2GEOCIT    /\b[a-z]{2}\.geocities\.com/i

meta      SARE_SPEC_XXGEOCITIES2   !__SARE_SPEC_XXGEOCITIE &&  __SARE_SPEC_XX2GEOCIT
describe  SARE_SPEC_XXGEOCITIES2   spamsign pointing to free webhost spam site
score     SARE_SPEC_XXGEOCITIES2   1.666
#hist     SARE_SPEC_XXGEOCITIES2   Fred Tarasevicius, Nov 2005
#counts   SARE_SPEC_XXGEOCITIES2   497s/18h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_XXGEOCITIES2   1237s/2h of 369947 corpus (112058s/257889h RM) 11/24/05
#counts   SARE_SPEC_XXGEOCITIES2   66s/2h of 9999 corpus (5651s/4348h AxB) 05/14/06
#counts   SARE_SPEC_XXGEOCITIES2   238s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#counts   SARE_SPEC_XXGEOCITIES2   698s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_XXGEOCITIES2   1251s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#counts   SARE_SPEC_XXGEOCITIES2   2881s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#counts   SARE_SPEC_XXGEOCITIES2   62s/0h of 23026 corpus (17290s/5736h MY) 05/14/06

meta      SARE_SPEC_XXGEOCITIES3   __SARE_SPEC_XXGEOCITIE  &&  __SARE_SPEC_XX2GEOCIT
describe  SARE_SPEC_XXGEOCITIES3   spamsign pointing to free webhost spam site
score     SARE_SPEC_XXGEOCITIES3   1.666
#hist     SARE_SPEC_XXGEOCITIES3   Fred Tarasevicius, Nov 2005
#ham      SARE_SPEC_XXGEOCITIES3   confirmed (1) 
#counts   SARE_SPEC_XXGEOCITIES3   0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
#max      SARE_SPEC_XXGEOCITIES3   499s/0h of 366082 corpus (108301s/257781h RM) 11/25/05
#counts   SARE_SPEC_XXGEOCITIES3   8s/0h of 9999 corpus (5651s/4348h AxB) 05/14/06
#counts   SARE_SPEC_XXGEOCITIES3   27s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
#counts   SARE_SPEC_XXGEOCITIES3   23s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_XXGEOCITIES3   168s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#counts   SARE_SPEC_XXGEOCITIES3   75s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
#counts   SARE_SPEC_XXGEOCITIES3   916s/0h of 23026 corpus (17290s/5736h MY) 05/14/06

uri       __SARE_SPEC_XXGEOCIT5    m'\bgeocities\.yahoo\.com\b'i
meta      SARE_SPEC_XXGEOCITIE5    __SARE_SPEC_XXGEOCIT5
describe  SARE_SPEC_XXGEOCITIE5    spamsign pointing to free webhost spam site
score     SARE_SPEC_XXGEOCITIE5    0.667
#hist     SARE_SPEC_XXGEOCITIE5    Bob Menschel, Dec 2005
#counts   SARE_SPEC_XXGEOCITIE5    31s/12h of 173230 corpus (99061s/74169h RM) 05/11/06
#counts   SARE_SPEC_XXGEOCITIE5    6s/0h of 9999 corpus (5651s/4348h AxB) 05/14/06
#counts   SARE_SPEC_XXGEOCITIE5    11s/1h of 13339 corpus (7462s/5877h CT) 05/14/06
#counts   SARE_SPEC_XXGEOCITIE5    14s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
#counts   SARE_SPEC_XXGEOCITIE5    16s/1h of 42419 corpus (34292s/8127h FVGT) 05/15/06
#counts   SARE_SPEC_XXGEOCITIE5    5s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
#counts   SARE_SPEC_XXGEOCITIE5    197s/0h of 106098 corpus (72789s/33309h ML) 05/14/06

########  ######################   ##################################################
#         Other specific spammers
########  ######################   ##################################################

# EOF