# SpamAssassin rules file # # Please don't modify this file as your changes will be overwritten with # the next update. Use @@LOCAL_RULES_DIR@@/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # # ########################################################################### require_version @@VERSION@@ ##{ ADVANCE_FEE_2_NEW_FORM meta ADVANCE_FEE_2_NEW_FORM __ADVANCE_FEE_2_NEW_FORM && !__COMMENT_EXISTS && !__THREADED && !__HTML_LINK_IMAGE && !__HDRS_LCASE describe ADVANCE_FEE_2_NEW_FORM Advance Fee fraud and a form tflags ADVANCE_FEE_2_NEW_FORM publish ##} ADVANCE_FEE_2_NEW_FORM ##{ ADVANCE_FEE_2_NEW_FRM_MNY meta ADVANCE_FEE_2_NEW_FRM_MNY __ADVANCE_FEE_2_NEW_FRM_MNY && !__HTML_LINK_IMAGE && !__HDRS_LCASE describe ADVANCE_FEE_2_NEW_FRM_MNY Advance Fee fraud form and lots of money ##} ADVANCE_FEE_2_NEW_FRM_MNY ##{ ADVANCE_FEE_2_NEW_MONEY meta ADVANCE_FEE_2_NEW_MONEY __ADVANCE_FEE_2_NEW_MONEY && !__DOS_HAS_LIST_UNSUB && !__TAG_EXISTS_CENTER && !__LYRIS_EZLM_REMAILER && !__COMMENT_EXISTS && !__UNSUB_LINK && !__VIA_ML && !__HTML_LINK_IMAGE && !__HDRS_LCASE && !__NAME_EQ_EMAIL describe ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money tflags ADVANCE_FEE_2_NEW_MONEY publish ##} ADVANCE_FEE_2_NEW_MONEY ##{ ADVANCE_FEE_3_NEW meta ADVANCE_FEE_3_NEW __ADVANCE_FEE_3_NEW && !__HTML_LINK_IMAGE && !__TAG_EXISTS_CENTER && !__COMMENT_EXISTS && !__VIA_ML && !__THREADED && !__UNSUB_LINK describe ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419) tflags ADVANCE_FEE_3_NEW publish ##} ADVANCE_FEE_3_NEW ##{ ADVANCE_FEE_3_NEW_FORM meta ADVANCE_FEE_3_NEW_FORM __ADVANCE_FEE_3_NEW_FORM && !__HTML_LINK_IMAGE describe ADVANCE_FEE_3_NEW_FORM Advance Fee fraud and a form tflags ADVANCE_FEE_3_NEW_FORM publish ##} ADVANCE_FEE_3_NEW_FORM ##{ ADVANCE_FEE_3_NEW_FRM_MNY meta ADVANCE_FEE_3_NEW_FRM_MNY __ADVANCE_FEE_3_NEW_FRM_MNY && !__HTML_LINK_IMAGE describe ADVANCE_FEE_3_NEW_FRM_MNY Advance Fee fraud form and lots of money ##} ADVANCE_FEE_3_NEW_FRM_MNY ##{ ADVANCE_FEE_3_NEW_MONEY meta ADVANCE_FEE_3_NEW_MONEY __ADVANCE_FEE_3_NEW_MONEY && !__HTML_LINK_IMAGE describe ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money tflags ADVANCE_FEE_3_NEW_MONEY publish ##} ADVANCE_FEE_3_NEW_MONEY ##{ ADVANCE_FEE_4_NEW meta ADVANCE_FEE_4_NEW __ADVANCE_FEE_4_NEW describe ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419) tflags ADVANCE_FEE_4_NEW publish ##} ADVANCE_FEE_4_NEW ##{ ADVANCE_FEE_4_NEW_FORM meta ADVANCE_FEE_4_NEW_FORM __ADVANCE_FEE_4_NEW_FORM describe ADVANCE_FEE_4_NEW_FORM Advance Fee fraud and a form ##} ADVANCE_FEE_4_NEW_FORM ##{ ADVANCE_FEE_4_NEW_FRM_MNY meta ADVANCE_FEE_4_NEW_FRM_MNY __ADVANCE_FEE_4_NEW_FRM_MNY describe ADVANCE_FEE_4_NEW_FRM_MNY Advance Fee fraud form and lots of money ##} ADVANCE_FEE_4_NEW_FRM_MNY ##{ ADVANCE_FEE_4_NEW_MONEY meta ADVANCE_FEE_4_NEW_MONEY __ADVANCE_FEE_4_NEW_MONEY && !__HTML_LINK_IMAGE && !__TAG_EXISTS_CENTER describe ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money ##} ADVANCE_FEE_4_NEW_MONEY ##{ ADVANCE_FEE_5_NEW meta ADVANCE_FEE_5_NEW __ADVANCE_FEE_5_NEW describe ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419) ##} ADVANCE_FEE_5_NEW ##{ ADVANCE_FEE_5_NEW_FORM meta ADVANCE_FEE_5_NEW_FORM __ADVANCE_FEE_5_NEW_FORM describe ADVANCE_FEE_5_NEW_FORM Advance Fee fraud and a form ##} ADVANCE_FEE_5_NEW_FORM ##{ ADVANCE_FEE_5_NEW_FRM_MNY meta ADVANCE_FEE_5_NEW_FRM_MNY __ADVANCE_FEE_5_NEW_FRM_MNY describe ADVANCE_FEE_5_NEW_FRM_MNY Advance Fee fraud form and lots of money ##} ADVANCE_FEE_5_NEW_FRM_MNY ##{ ADVANCE_FEE_5_NEW_MONEY meta ADVANCE_FEE_5_NEW_MONEY __ADVANCE_FEE_5_NEW_MONEY describe ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money ##} ADVANCE_FEE_5_NEW_MONEY ##{ APOSTROPHE_FROM header APOSTROPHE_FROM From:addr =~ /'/ describe APOSTROPHE_FROM From address contains an apostrophe ##} APOSTROPHE_FROM ##{ AXB_HELO_HOME_UN header AXB_HELO_HOME_UN X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\w+\.(lan|home) /i describe AXB_HELO_HOME_UN HELO from home - untrusted ##} AXB_HELO_HOME_UN ##{ AXB_XMID_1212 header AXB_XMID_1212 Message-Id =~ /^<[0-9]{12}\.[0-9]{12}\@/ describe AXB_XMID_1212 Barbera Fingerprint ##} AXB_XMID_1212 ##{ AXB_XMID_1510 header AXB_XMID_1510 Message-Id =~ /<[0-9A-F]{15}\.[0-9A-F]{10}\@/ describe AXB_XMID_1510 Brunello Fingerprint ##} AXB_XMID_1510 ##{ AXB_XMID_OEGOESNULL header AXB_XMID_OEGOESNULL Message-ID =~ /^<[0-9-a-f]{12}\$[0-9-a-f]{8}\$[0]{8}\@/ describe AXB_XMID_OEGOESNULL Amarone Fingerprint ##} AXB_XMID_OEGOESNULL ##{ AXB_XM_SENDMAIL_NOT header AXB_XM_SENDMAIL_NOT Received =~ /\([123456790]{1,2}\.[0-9]{1,2}\.[0-9]{1}\/[0-9]{1,2}\.[0-9]{2}\.[0-9]{1}\)/ describe AXB_XM_SENDMAIL_NOT Nebbiolo fingerprint ##} AXB_XM_SENDMAIL_NOT ##{ AXB_XR_STULDAP header AXB_XR_STULDAP Received =~ /\(8\.12\.3 da nor stuldap\/8\.12\.3\)/ ##} AXB_XR_STULDAP ##{ BANKING_LAWS body BANKING_LAWS /banking laws/i describe BANKING_LAWS Talks about banking laws ##} BANKING_LAWS ##{ BASE64_LENGTH_78_79 ifplugin Mail::SpamAssassin::Plugin::MIMEEval ifplugin Mail::SpamAssassin::Plugin::MIMEEval body BASE64_LENGTH_78_79 eval:check_base64_length('78','79') endif ##} BASE64_LENGTH_78_79 ifplugin Mail::SpamAssassin::Plugin::MIMEEval ##{ BASE64_LENGTH_79_INF ifplugin Mail::SpamAssassin::Plugin::MIMEEval ifplugin Mail::SpamAssassin::Plugin::MIMEEval body BASE64_LENGTH_79_INF eval:check_base64_length('79') endif ##} BASE64_LENGTH_79_INF ifplugin Mail::SpamAssassin::Plugin::MIMEEval ##{ BUG6152_INVALID_DATE_TZ_ABSURD header BUG6152_INVALID_DATE_TZ_ABSURD Date =~ /[-+](?!(?:0\d|1[0-4])(?:[03]0|[14]5))\d{4}/ ##} BUG6152_INVALID_DATE_TZ_ABSURD ##{ CN_B2B_SPAMMER body CN_B2B_SPAMMER /We are a China[-\s]based/i describe CN_B2B_SPAMMER Chinese company introducing itself ##} CN_B2B_SPAMMER ##{ CORRUPT_FROM_LINE_IN_HDRS meta CORRUPT_FROM_LINE_IN_HDRS (MISSING_HEADERS && __BODY_STARTS_WITH_FROM_LINE && MISSING_DATE && NO_RELAYS) describe CORRUPT_FROM_LINE_IN_HDRS Informational: message is corrupt, with a From line in its headers tflags CORRUPT_FROM_LINE_IN_HDRS userconf publish #score CORRUPT_FROM_LINE_IN_HDRS 0.001 ##} CORRUPT_FROM_LINE_IN_HDRS ##{ CTYPE_001C_A meta CTYPE_001C_A (0) # obsolete ##} CTYPE_001C_A ##{ CTYPE_001C_B header CTYPE_001C_B Content-Type =~ /multipart.{0,200}boundary=\"----=_NextPart_000_0000_01C[0-9A-F]{5}\.[0-9A-F]{7}0\"/ ##} CTYPE_001C_B ##{ CTYPE_8SPACE_GIF ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader CTYPE_8SPACE_GIF Content-Type:raw =~ /^image\/gif;\n {8}name=\".+?\"$/s describe CTYPE_8SPACE_GIF Stock spam image part 'Content-Type' found (8 spc) endif ##} CTYPE_8SPACE_GIF ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ CURR_PRICE body CURR_PRICE /\bCurrent Price:/ ##} CURR_PRICE ##{ DATE_IN_FUTURE_96_Q ifplugin Mail::SpamAssassin::Plugin::HeaderEval ifplugin Mail::SpamAssassin::Plugin::HeaderEval header DATE_IN_FUTURE_96_Q eval:check_for_shifted_date('96', '2920') describe DATE_IN_FUTURE_96_Q Date: is 4 days to 4 months after Received: date endif ##} DATE_IN_FUTURE_96_Q ifplugin Mail::SpamAssassin::Plugin::HeaderEval ##{ DATE_IN_FUTURE_Q_PLUS ifplugin Mail::SpamAssassin::Plugin::HeaderEval ifplugin Mail::SpamAssassin::Plugin::HeaderEval header DATE_IN_FUTURE_Q_PLUS eval:check_for_shifted_date('2920', 'undef') describe DATE_IN_FUTURE_Q_PLUS Date: is over 4 months after Received: date endif ##} DATE_IN_FUTURE_Q_PLUS ifplugin Mail::SpamAssassin::Plugin::HeaderEval ##{ DEAR_BENEFICIARY body DEAR_BENEFICIARY /^\s?(?:Dear\s|At+(?:ention|n):?\s?)(?:\S+\s)?Ben[ei]ficiary\b/i describe DEAR_BENEFICIARY Dear Beneficiary: #score DEAR_BENEFICIARY 2.0 ##} DEAR_BENEFICIARY ##{ DEAR_EMAIL body DEAR_EMAIL /^\s*Dear\b.{0,70}\w\@\w/i describe DEAR_EMAIL Message contains Dear email address #score DEAR_EMAIL 1.5 # 20090424 ##} DEAR_EMAIL ##{ DEAR_WINNER body DEAR_WINNER /\bdear.{1,20}winner/i ##} DEAR_WINNER ##{ DOS_ANAL_SPAM_MAILER header DOS_ANAL_SPAM_MAILER X-mailer =~ /^[A-Z][a-z]{6}e \d\.\d{2}$/ describe DOS_ANAL_SPAM_MAILER X-mailer pattern common to anal porn site spam tflags DOS_ANAL_SPAM_MAILER publish ##} DOS_ANAL_SPAM_MAILER ##{ DOS_FIX_MY_URI meta DOS_FIX_MY_URI __MIMEOLE_1106 && __DOS_HAS_ANY_URI && __DOS_SINGLE_EXT_RELAY && __DOS_HI && __DOS_LINK describe DOS_FIX_MY_URI Looks like a "fix my obfu'd URI please" spam ##} DOS_FIX_MY_URI ##{ DOS_HIGH_BAT_TO_MX meta DOS_HIGH_BAT_TO_MX __DOS_DIRECT_TO_MX && __HIGHBITS && __LAST_UNTRUSTED_RELAY_NO_AUTH && __THEBAT_MUA describe DOS_HIGH_BAT_TO_MX The Bat! Direct to MX with High Bits ##} DOS_HIGH_BAT_TO_MX ##{ DOS_LET_GO_JOB meta DOS_LET_GO_JOB __DOS_LET_GO_JOB && __DOS_MY_OLD_JOB && __DOS_I_DRIVE_A && __DOS_TAKING_HOME describe DOS_LET_GO_JOB Let go from their job and now makes lots of dough! ##} DOS_LET_GO_JOB ##{ DOS_OE_TO_MX meta DOS_OE_TO_MX __OE_MUA && __DOS_DIRECT_TO_MX && !DOS_OE_TO_MX_IMAGE describe DOS_OE_TO_MX Delivered direct to MX with OE headers ##} DOS_OE_TO_MX ##{ DOS_OE_TO_MX_IMAGE meta DOS_OE_TO_MX_IMAGE __OE_MUA && __DOS_DIRECT_TO_MX && __ANY_IMAGE_ATTACH describe DOS_OE_TO_MX_IMAGE Direct to MX with OE headers and an image ##} DOS_OE_TO_MX_IMAGE ##{ DOS_OUTLOOK_TO_MX meta DOS_OUTLOOK_TO_MX __ANY_OUTLOOK_MUA && !__OE_MUA && __DOS_DIRECT_TO_MX && !T_DOS_OUTLOOK_TO_MX_IMAGE describe DOS_OUTLOOK_TO_MX Delivered direct to MX with Outlook headers ##} DOS_OUTLOOK_TO_MX ##{ DOS_RCVD_IP_TWICE_B header DOS_RCVD_IP_TWICE_B X-Spam-Relays-External =~ /^\s*\[ ip=(?!127)([\d.]+) [^\[]*\[ ip=\1 [^\]]*\]\s*$/ describe DOS_RCVD_IP_TWICE_B Received from the same IP twice in a row (only one external relay) ##} DOS_RCVD_IP_TWICE_B ##{ DOS_RCVD_IP_TWICE_C header DOS_RCVD_IP_TWICE_C X-Spam-Relays-External =~ /^\s*\[ ip=(?!127)([\d.]+) [^\[]*\bhelo=(?:![\d.]{7,15}!)? [^\[]*\[ ip=\1 [^\]]*\]\s*$/ describe DOS_RCVD_IP_TWICE_C Received from the same IP twice in a row (only one external relay; empty or IP helo) ##} DOS_RCVD_IP_TWICE_C ##{ DOS_STOCK_BAT meta DOS_STOCK_BAT __THEBAT_MUA && (__DOS_BODY_STOCK || __DOS_BODY_TICKER) && (__DOS_REF_TODAY || __DOS_REF_NEXT_WK_DAY || __DOS_REF_2_WK_DAYS) describe DOS_STOCK_BAT Probable pump and dump stock spam ##} DOS_STOCK_BAT ##{ DOS_STOCK_BAT2 meta DOS_STOCK_BAT2 DOS_STOCK_BAT && (__DOS_FIN_ADVANTAGE + __DOS_STRONG_CF + __DOS_STEADY_COURSE > 2) ##} DOS_STOCK_BAT2 ##{ DOS_URI_ASTERISK uri DOS_URI_ASTERISK m{^[Hh][Tt]{2}[Pp][Ss]?://[^/:]+(?:\*[A-Za-z0-9-]*\.|\*)[A-Za-z]{2,3}(?:\.[A-Za-z]{2})?(?:$|:|/)} describe DOS_URI_ASTERISK Found an asterisk in a URI ##} DOS_URI_ASTERISK ##{ DOS_YOUR_PLACE meta DOS_YOUR_PLACE (__DOS_COMING_TO_YOUR_PLACE && __DOS_MEET_EACH_OTHER && (__DOS_DROP_ME_A_LINE || __DOS_CORRESPOND_EMAIL || __DOS_EMAIL_DIRECTLY || __DOS_I_AM_25 || __DOS_WRITE_ME_AT || __DOS_PERSONAL_EMAIL)) describe DOS_YOUR_PLACE Russian dating spam ##} DOS_YOUR_PLACE ##{ DRUGS_HDIA header DRUGS_HDIA Subject =~ /\bhoodia\b/i ##} DRUGS_HDIA ##{ DRUGS_STOCK_MIMEOLE meta DRUGS_STOCK_MIMEOLE (__MIMEOLE_1106 && __MAILER_OL_5510) describe DRUGS_STOCK_MIMEOLE Stock-spam forged headers found (5510) ##} DRUGS_STOCK_MIMEOLE ##{ DYN_RDNS_AND_INLINE_IMAGE meta DYN_RDNS_AND_INLINE_IMAGE (RDNS_DYNAMIC && __ANY_IMAGE_ATTACH) describe DYN_RDNS_AND_INLINE_IMAGE Contains image, and was sent by dynamic rDNS ##} DYN_RDNS_AND_INLINE_IMAGE ##{ DYN_RDNS_SHORT_HELO_HTML meta DYN_RDNS_SHORT_HELO_HTML (__HELO_NO_DOMAIN && RDNS_DYNAMIC && HTML_MESSAGE) describe DYN_RDNS_SHORT_HELO_HTML Sent by dynamic rDNS, short HELO, and HTML ##} DYN_RDNS_SHORT_HELO_HTML ##{ DYN_RDNS_SHORT_HELO_IMAGE meta DYN_RDNS_SHORT_HELO_IMAGE (__HELO_NO_DOMAIN && RDNS_DYNAMIC && __ANY_IMAGE_ATTACH) describe DYN_RDNS_SHORT_HELO_IMAGE Short HELO string, dynamic rDNS, inline image ##} DYN_RDNS_SHORT_HELO_IMAGE ##{ END_FUTURE_EMAILS body END_FUTURE_EMAILS /\bend future (?:email|alert)s?\b/i describe END_FUTURE_EMAILS Pump-and-dump unsubscribe ##} END_FUTURE_EMAILS ##{ FAKE_REPLY_C meta FAKE_REPLY_C (__SUBJ_RE && __MISSING_REF && __NO_INR_YES_REF) ##} FAKE_REPLY_C ##{ FB_ADD_INCHES body FB_ADD_INCHES /(?:add|gain) inches/i describe FB_ADD_INCHES Add / Gain inches ##} FB_ADD_INCHES ##{ FB_ALMOST_SEX body FB_ALMOST_SEX /\b[b-z]sex+\b/i describe FB_ALMOST_SEX It's almost sex, but not! ##} FB_ALMOST_SEX ##{ FB_ANA_TRIM body FB_ANA_TRIM /Ana[^a-z]trim/i describe FB_ANA_TRIM Broken AnaTrim phrase. ##} FB_ANA_TRIM ##{ FB_ANUI body FB_ANUI /A[-_\.]U[-_\.]N[-_\.]I/i describe FB_ANUI Phrase: A_U_N_I ##} FB_ANUI ##{ FB_BILLI0N body FB_BILLI0N /[BM][I1]LL[I1]0N/i describe FB_BILLI0N Phrase: [BM]Illi0n ##} FB_BILLI0N ##{ FB_C0MPANY body FB_C0MPANY /c0mpany/i describe FB_C0MPANY Phrase: C0mpany ##} FB_C0MPANY ##{ FB_CAN_LONGER body FB_CAN_LONGER /can last longer/i describe FB_CAN_LONGER Phrase: can last longer ##} FB_CAN_LONGER ##{ FB_CIALIS_LEO3 body FB_CIALIS_LEO3 /\bC(?!IALIS|eibal|laim|laritas)\s?[a-z]?\s?[Iitl1\\\/]\s?[a-z]?\s?[Aa]\s?[a-z]?\s?[LIl1\\\/]\s?[a-z]?\s?[ilIt1\\\/]\s?[a-z]?\s?[Ss]\b/ describe FB_CIALIS_LEO3 Uses a mis-spelled version of cialis. ##} FB_CIALIS_LEO3 ##{ FB_DOUBLE_0WORDS body FB_DOUBLE_0WORDS /\b[a-z]{1,5}0[a-z]{3,9}\s[a-z]{1,5}0[a-z]{3,9}\b/i describe FB_DOUBLE_0WORDS Looks like double 0 words ##} FB_DOUBLE_0WORDS ##{ FB_EMAIL_HIER body FB_EMAIL_HIER /email hier/i describe FB_EMAIL_HIER Phrase: email hier ##} FB_EMAIL_HIER ##{ FB_EXTRA_INCHES body FB_EXTRA_INCHES /extra inches/ describe FB_EXTRA_INCHES Phrase: extra inches ##} FB_EXTRA_INCHES ##{ FB_FAKE_NUMBERS body FB_FAKE_NUMBERS /\$\d\d?O\s*[MBT]/i describe FB_FAKE_NUMBERS Looks like numbers with O's insted of 0's ##} FB_FAKE_NUMBERS ##{ FB_FAKE_NUMS4 body FB_FAKE_NUMS4 /(?:\b|\b\d)\d,?\d,?OO(?:\b|\d\b)/ describe FB_FAKE_NUMS4 Looks like fake numbers (4) ##} FB_FAKE_NUMS4 ##{ FB_FHARMACY body FB_FHARMACY /Fharmacy/i describe FB_FHARMACY Phrase: Farmacy ##} FB_FHARMACY ##{ FB_FORWARD_LOOK body FB_FORWARD_LOOK /(?!forward look)f[o0]rward l[0o][0o]k/i describe FB_FORWARD_LOOK Phrase: forward look with 0's ##} FB_FORWARD_LOOK ##{ FB_GAPPY_ADDRESS body FB_GAPPY_ADDRESS /(?:[a-z] ){8}, (?:[a-z0-9] ){4}/i describe FB_GAPPY_ADDRESS Too much spacing in Address ##} FB_GAPPY_ADDRESS ##{ FB_GET_MEDS body FB_GET_MEDS /(?:place f[o0]r|[0o]rder|get\s?(?:y[o0]ur)?|online|quality).{1,7}med[isz][^a]/i describe FB_GET_MEDS Looks like trying to sell meds ##} FB_GET_MEDS ##{ FB_GREAT_BEST_SEX body FB_GREAT_BEST_SEX /(?:greater|best|Improved) sex/i describe FB_GREAT_BEST_SEX Phrase: greater, best, improved sex ##} FB_GREAT_BEST_SEX ##{ FB_GVR body FB_GVR /(?:pef-rx|vigrex-ds|gsc-100|vp-rx|gv-promax|phentermine|adipex|xenical)/i describe FB_GVR Looks like generic viagra ##} FB_GVR ##{ FB_HEY_BRO_COMMA body FB_HEY_BRO_COMMA /Hey bro, / describe FB_HEY_BRO_COMMA Phrase hey bro, ##} FB_HEY_BRO_COMMA ##{ FB_HG_H_CAP body FB_HG_H_CAP /\bHGH\b/ describe FB_HG_H_CAP Phrase: HGH ##} FB_HG_H_CAP ##{ FB_HOMELOAN body FB_HOMELOAN /\$\d{3},\d{3} home loan/i describe FB_HOMELOAN Phrase $x home loan ##} FB_HOMELOAN ##{ FB_IMPRESS_GIRL body FB_IMPRESS_GIRL /\bimpress .{0,5}girl\b/ describe FB_IMPRESS_GIRL Phrase: impress ... girl ##} FB_IMPRESS_GIRL ##{ FB_INCREASE_YOUR body FB_INCREASE_YOUR /Increase your energy/i describe FB_INCREASE_YOUR Phrase: Increase your energy ##} FB_INCREASE_YOUR ##{ FB_INDEPEND_RWD body FB_INDEPEND_RWD /independent reward/i describe FB_INDEPEND_RWD Phrase: independent reward ##} FB_INDEPEND_RWD ##{ FB_L0AN body FB_L0AN /\bl0ans?\b/i describe FB_L0AN Phrase: L0an ##} FB_L0AN ##{ FB_LETTERS_21B body FB_LETTERS_21B /-- [a-z]{21}/ describe FB_LETTERS_21B Special people leave special signs! ##} FB_LETTERS_21B ##{ FB_LOSE_WEIGHT_CAP body FB_LOSE_WEIGHT_CAP /LOSE WEIGHT/ describe FB_LOSE_WEIGHT_CAP Phrase: LOSE WEIGHT ##} FB_LOSE_WEIGHT_CAP ##{ FB_LOWER_PAYM body FB_LOWER_PAYM /lower your monthly payments/i describe FB_LOWER_PAYM Phrase: lower your monthly payments ##} FB_LOWER_PAYM ##{ FB_MORE_SIZE body FB_MORE_SIZE /\bmore size\b/ describe FB_MORE_SIZE Phrase: more size ##} FB_MORE_SIZE ##{ FB_NOT_PHONE_NUM1 body FB_NOT_PHONE_NUM1 /(?!\d{3})8(?:66|77|88|[0o][0o])[-\.\s\)]{1,3}[OIL0-9]{3}[-\.\s]/i describe FB_NOT_PHONE_NUM1 Looks like a fake phone number (1) ##} FB_NOT_PHONE_NUM1 ##{ FB_NOT_PHONE_NUM3 body FB_NOT_PHONE_NUM3 /8(?:66|77|88|[0o][0o])[-\.\s\)]{1,3}[OIL0-9]{3}[-\.\s]{1,3}(?!\d{4})[OIL0-9]{4}/i describe FB_NOT_PHONE_NUM3 Looks like a fake phone number (3) ##} FB_NOT_PHONE_NUM3 ##{ FB_NOT_SCHOOL body FB_NOT_SCHOOL /(?!school)[\$s5]ch[o0][o0][il1\|]/i describe FB_NOT_SCHOOL Looks like school but it's not! ##} FB_NOT_SCHOOL ##{ FB_NUMYO body FB_NUMYO /1[0-9][\s\.]?y[\s\.]?o[\s\.]?\b/i describe FB_NUMYO Speaks of teenager. ##} FB_NUMYO ##{ FB_NUMYO2 body FB_NUMYO2 /2[0-9][\s\.]?y[\s\.]?o[\s\.]?\b/i describe FB_NUMYO2 Speaks of 20+ year old. ##} FB_NUMYO2 ##{ FB_ODD_SPACED_MONEY body FB_ODD_SPACED_MONEY /\$\d\s,\s\d\d/ describe FB_ODD_SPACED_MONEY Looks like money but has odd spacing. ##} FB_ODD_SPACED_MONEY ##{ FB_ONIINE body FB_ONIINE /oniine/i describe FB_ONIINE Mis-spelled online ##} FB_ONIINE ##{ FB_P1LL body FB_P1LL /\bp1ll/i describe FB_P1LL Phrase: p1ll ##} FB_P1LL ##{ FB_PENIS_GROWTH body FB_PENIS_GROWTH /pen[i1]s grow(?:th)?/i describe FB_PENIS_GROWTH Phrase: penis growth ##} FB_PENIS_GROWTH ##{ FB_PIPEDOLLAR body FB_PIPEDOLLAR /(?!dollar)d[o0][1|li][1|li]ar/i describe FB_PIPEDOLLAR Phrase: Dollar, with pipes or 0's. ##} FB_PIPEDOLLAR ##{ FB_PIPE_ILLION body FB_PIPE_ILLION /(?!illion)i[l|][l|][i|][o0]n/i describe FB_PIPE_ILLION Looks like illion, but it's not ##} FB_PIPE_ILLION ##{ FB_PROLONGED_HARD body FB_PROLONGED_HARD /(?:prolonged|increased) hardness/i describe FB_PROLONGED_HARD Talks about prolonged hardness ##} FB_PROLONGED_HARD ##{ FB_QUALITY_REPLICA body FB_QUALITY_REPLICA /quality replica/i describe FB_QUALITY_REPLICA Phrase: quality replica ##} FB_QUALITY_REPLICA ##{ FB_REF_CODE_SPACE body FB_REF_CODE_SPACE /r e f c o d e/i describe FB_REF_CODE_SPACE Refcode with spacing ##} FB_REF_CODE_SPACE ##{ FB_REPLICA_ROLEX body FB_REPLICA_ROLEX /replica rolex/i describe FB_REPLICA_ROLEX Phrase: Replica Rolex ##} FB_REPLICA_ROLEX ##{ FB_REPLIC_CAP body FB_REPLIC_CAP /REPLICAS?\b/ describe FB_REPLIC_CAP Phrase: REPLICA ##} FB_REPLIC_CAP ##{ FB_RE_FI body FB_RE_FI /\bre[^a-z]fi\b/ describe FB_RE_FI Looks like refi. ##} FB_RE_FI ##{ FB_ROLLER_IS_T body FB_ROLLER_IS_T /Roller is th/i describe FB_ROLLER_IS_T Phrase: Roller is th ##} FB_ROLLER_IS_T ##{ FB_ROLX body FB_ROLX /\brolx\b/i describe FB_ROLX Phrase: rolx ##} FB_ROLX ##{ FB_SAVE_PERSC body FB_SAVE_PERSC /sav(?:e|ing).{1,45}p[re][re]scr[i1]pt[i1][o0]n/i describe FB_SAVE_PERSC Phrase: save ... prescription. ##} FB_SAVE_PERSC ##{ FB_SOFTTABS body FB_SOFTTABS /\bsoft\s?t?abs\b/i describe FB_SOFTTABS Phrase: Softabs ##} FB_SOFTTABS ##{ FB_SPACED_FREE body FB_SPACED_FREE /F R E E/i describe FB_SPACED_FREE Phrase: F R E E ##} FB_SPACED_FREE ##{ FB_SPACED_PHN_3B body FB_SPACED_PHN_3B /\d\d\d--\d\d\d--?\d\d\d\d/ describe FB_SPACED_PHN_3B Phone number with -- spacing. (B) ##} FB_SPACED_PHN_3B ##{ FB_SPACEY_ZIP body FB_SPACEY_ZIP /\s\d\s\d\s\d\s\d\s\d\s-\s\d\s\d\s\d\s\d/ describe FB_SPACEY_ZIP Looks like a s p a c e d zipcode. ##} FB_SPACEY_ZIP ##{ FB_SPUR_M body FB_SPUR_M /\bSPUR-M\b/i describe FB_SPUR_M Phrase: SPUR-M ##} FB_SPUR_M ##{ FB_SSEX body FB_SSEX /\bssex\b/ describe FB_SSEX Phrase: ssex ##} FB_SSEX ##{ FB_STOCK_EXPLODE body FB_STOCK_EXPLODE /st[0o]ck\b.{4,10}expl[o0]de/i describe FB_STOCK_EXPLODE Looks like stocks exploding. ##} FB_STOCK_EXPLODE ##{ FB_SYMBLO body FB_SYMBLO /\bSymblo\b/i describe FB_SYMBLO Mis-spelled symbol. ##} FB_SYMBLO ##{ FB_THIS_ADVERT body FB_THIS_ADVERT /this advertiser/i describe FB_THIS_ADVERT Phrase: this advertiser ##} FB_THIS_ADVERT ##{ FB_THOUS_PERSONAL body FB_THOUS_PERSONAL /thousand personal/i describe FB_THOUS_PERSONAL Phrase: thousand personal ##} FB_THOUS_PERSONAL ##{ FB_TO_STOP_DISTRO body FB_TO_STOP_DISTRO /To (?:(?:stop further|longer get) distribution|stop (?:receiving )?announcements)/i describe FB_TO_STOP_DISTRO Phrase: to stop further distribution ##} FB_TO_STOP_DISTRO ##{ FB_ULTRA_ALLURE body FB_ULTRA_ALLURE /Ultra Allure/i describe FB_ULTRA_ALLURE Phrase: Ultra Allure ##} FB_ULTRA_ALLURE ##{ FB_UNLOCK_YOUR_G body FB_UNLOCK_YOUR_G /lock ?(?:to ?)? your girlfriend/i describe FB_UNLOCK_YOUR_G Phrase: lock to your girlfriend ##} FB_UNLOCK_YOUR_G ##{ FB_UNRESOLV_PROV body FB_UNRESOLV_PROV /\{PROV_\d_\d\}/ describe FB_UNRESOLV_PROV Pattern Replacement PROV_D ##} FB_UNRESOLV_PROV ##{ FB_YOURSELF_MASTER body FB_YOURSELF_MASTER /yourself master/i describe FB_YOURSELF_MASTER Phrase: yourself master ##} FB_YOURSELF_MASTER ##{ FB_YOUR_REFI body FB_YOUR_REFI /Your refi/i describe FB_YOUR_REFI Phrase: Your refi ##} FB_YOUR_REFI ##{ FH_BAD_OEV1441 header FH_BAD_OEV1441 X-Mailer =~ /^Microsoft Outlook Express 6\.00\.2800\.1441$/ describe FH_BAD_OEV1441 Bad X-Mailer version ##} FH_BAD_OEV1441 ##{ FH_DATE_IS_19XX header FH_DATE_IS_19XX Date =~ /19[789][0-9]/ [if-unset: 2006] describe FH_DATE_IS_19XX The date is not 19xx. ##} FH_DATE_IS_19XX ##{ FH_FAKE_RCVD_LINE header FH_FAKE_RCVD_LINE Received =~ /from\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s*by\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3};\s*[SMTWF].{2},\s*\d{1,2}\s*[JFMASOND].{2,5}\s*\d{4}\s*\d{2}:\d{2}:\d{2}\s*[-+]\d{4}/ describe FH_FAKE_RCVD_LINE RCVD line looks faked (A) ##} FH_FAKE_RCVD_LINE ##{ FH_FAKE_RCVD_LINE_B header FH_FAKE_RCVD_LINE_B Received =~ /from\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s*by\s*[a-z0-9.]{4,24}\.[a-z0-9.]{4,36}\.(?:com|net|org|biz);\s*[SMTWF].{2},\s*\d{1,2}\s*[JFMASOND].{2,5}\s*\d{4}\s*\d{2}:\d{2}:\d{2}\s*[-+]\d{4}/i describe FH_FAKE_RCVD_LINE_B RCVD line looks faked (B) ##} FH_FAKE_RCVD_LINE_B ##{ FH_FROMEML_NOTLD header FH_FROMEML_NOTLD From:addr !~ /\./ [if-unset: foo@bar.com] describe FH_FROMEML_NOTLD E-mail address doesn't have TLD (.com, etc.) ##} FH_FROMEML_NOTLD ##{ FH_FROM_CASH header FH_FROM_CASH From:name =~ /\bcash\b/i describe FH_FROM_CASH From name has "cash" ##} FH_FROM_CASH ##{ FH_FROM_GET_NAME header FH_FROM_GET_NAME From:name =~ /\bGet\b/i describe FH_FROM_GET_NAME From name says Get ##} FH_FROM_GET_NAME ##{ FH_FROM_GIVEAWAY header FH_FROM_GIVEAWAY From =~ /Giveaway/i describe FH_FROM_GIVEAWAY From name is giveaway. ##} FH_FROM_GIVEAWAY ##{ FH_FROM_HOODIA header FH_FROM_HOODIA From =~ /Hoodia/i describe FH_FROM_HOODIA From has Hoodia!!? ##} FH_FROM_HOODIA ##{ FH_HAS_XAIMC header FH_HAS_XAIMC exists:X-AIMC-AUTH describe FH_HAS_XAIMC Has X-AIMC-AUTH header ##} FH_HAS_XAIMC ##{ FH_HAS_XID header FH_HAS_XID exists:X-ID describe FH_HAS_XID Has X-ID ##} FH_HAS_XID ##{ FH_HELO_ALMOST_IP header FH_HELO_ALMOST_IP X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+[a-z][-.]\d{1,3}[-.]\d{1,3}[-.]\d{1,3}[-.][a-z][^ ]+ /i describe FH_HELO_ALMOST_IP Helo is almost an IP addr. ##} FH_HELO_ALMOST_IP ##{ FH_HELO_ENDS_DOT header FH_HELO_ENDS_DOT X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+\. by=/ describe FH_HELO_ENDS_DOT Helo ends with a dot. ##} FH_HELO_ENDS_DOT ##{ FH_HELO_EQ_610HEX header FH_HELO_EQ_610HEX X-Spam-Relays-External =~ /^[^\]]+ helo=-?[A-F0-9]{6,10} / describe FH_HELO_EQ_610HEX Helo is 6-10 hex chr's. ##} FH_HELO_EQ_610HEX ##{ FH_HELO_EQ_CHARTER header FH_HELO_EQ_CHARTER X-Spam-Relays-External =~ /^[^\]]+ helo=\d{2,3}-\d{1,3}-\d{1,3}-\d{1,3}.{5,20}\.charter\.com /i describe FH_HELO_EQ_CHARTER Helo is d-d-d-d charter.com ##} FH_HELO_EQ_CHARTER ##{ FH_HELO_EQ_D_D_D_D header FH_HELO_EQ_D_D_D_D X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]{0,15}\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3}/ describe FH_HELO_EQ_D_D_D_D Helo is d-d-d-d ##} FH_HELO_EQ_D_D_D_D ##{ FH_HELO_GMAILSMTP header FH_HELO_GMAILSMTP Received =~ /HELO gmail-smtp-in/ describe FH_HELO_GMAILSMTP Faked helo of gmail-smtp-in ##} FH_HELO_GMAILSMTP ##{ FH_HOST_EQ_DYNAMICIP header FH_HOST_EQ_DYNAMICIP X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]{0,25}[dD][yY][nN][aA][mM][iI][cC][iI][pP][^ ]{5,25} helo=/ describe FH_HOST_EQ_DYNAMICIP Host is dynamicip ##} FH_HOST_EQ_DYNAMICIP ##{ FH_HOST_EQ_PACBELL_D header FH_HOST_EQ_PACBELL_D X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.dsl\.\w{2,10}\.pacbell\.net / describe FH_HOST_EQ_PACBELL_D Host is pacbell.net dsl ##} FH_HOST_EQ_PACBELL_D ##{ FH_HOST_EQ_VERIZON_P header FH_HOST_EQ_VERIZON_P X-Spam-Relays-External =~ /^[^\]]+ rdns=pool-\d.{5,30}\.verizon\.net/ describe FH_HOST_EQ_VERIZON_P Host is pool-.+verizon.net ##} FH_HOST_EQ_VERIZON_P ##{ FH_HOST_IN_ADDRARPA header FH_HOST_IN_ADDRARPA X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]{0,25}\.in-addr\.arpa / describe FH_HOST_IN_ADDRARPA HOST dns says "in-addr.arpa" ##} FH_HOST_IN_ADDRARPA ##{ FH_MSGID_000000 header FH_MSGID_000000 MESSAGEID =~ /\$00000000\@/ describe FH_MSGID_000000 Special MSGID ##} FH_MSGID_000000 ##{ FH_MSGID_01C67 header FH_MSGID_01C67 Message-ID =~ /^<000001c[67]/ describe FH_MSGID_01C67 Special MSGID ##} FH_MSGID_01C67 ##{ FH_MSGID_01C70XXX header FH_MSGID_01C70XXX MESSAGEID =~ /^<01c70[a-f][a-f0-9]{2}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[a-zA-Z0-9-]+>$/ describe FH_MSGID_01C70XXX MESSAGE ID seen often!!! ##} FH_MSGID_01C70XXX ##{ FH_MSGID_REPLACE header FH_MSGID_REPLACE MESSAGEID =~ /^<%MSGID/ describe FH_MSGID_REPLACE Broken Replace Template ##} FH_MSGID_REPLACE ##{ FH_MSGID_XXBLAH header FH_MSGID_XXBLAH MESSAGEID =~ /6c822ecf/ describe FH_MSGID_XXBLAH Common sign in msg-id's 12/21/2006 ##} FH_MSGID_XXBLAH ##{ FH_MSGID_XXX header FH_MSGID_XXX MESSAGEID =~ /\@xxx/i describe FH_MSGID_XXX Message-Id = @xxx ##} FH_MSGID_XXX ##{ FH_RE_NEW_DDD header FH_RE_NEW_DDD Subject =~ /^Re: new\s?\d{0,3}$/i describe FH_RE_NEW_DDD Subject is Re: new \d\d\d ##} FH_RE_NEW_DDD ##{ FH_XMAIL_REPLACE header FH_XMAIL_REPLACE X-Mailer =~ /%XMAILER/ describe FH_XMAIL_REPLACE Broken Replace Template ##} FH_XMAIL_REPLACE ##{ FILL_THIS_FORM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta FILL_THIS_FORM __FILL_THIS_FORM && !__THREADED && !__FB_TOUR && !__VIA_ML describe FILL_THIS_FORM Fill in a form with personal information tflags FILL_THIS_FORM publish endif ##} FILL_THIS_FORM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FILL_THIS_FORM_FRAUD_PHISH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta FILL_THIS_FORM_FRAUD_PHISH __FILL_THIS_FORM_FRAUD_PHISH && !__UNSUB_LINK && !__SPOOFED_URL && !__DOS_LINK && !__CAN_HELP && !__VIA_ML describe FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s) # score FILL_THIS_FORM_FRAUD_PHISH 1.50 endif ##} FILL_THIS_FORM_FRAUD_PHISH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FILL_THIS_FORM_LOAN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta FILL_THIS_FORM_LOAN __FILL_THIS_FORM_LOAN && !__COMMENT_EXISTS && !__HTML_LINK_IMAGE describe FILL_THIS_FORM_LOAN Answer loan question(s) # score FILL_THIS_FORM_LOAN 0.50 endif ##} FILL_THIS_FORM_LOAN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FILL_THIS_FORM_LONG ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta FILL_THIS_FORM_LONG __FILL_THIS_FORM_LONG && !__VIA_ML && !__DOS_HAS_LIST_UNSUB && !__THREADED describe FILL_THIS_FORM_LONG Fill in a form with personal information # score FILL_THIS_FORM_LONG 1.00 endif ##} FILL_THIS_FORM_LONG ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FM_DOESNT_SAY_STOCK meta FM_DOESNT_SAY_STOCK (__FB_S_SYMBOL && __FM_MY_PRICE && !__FB_S_STOCK && !__FS_S_TRADE) describe FM_DOESNT_SAY_STOCK It's a stock spam but doesn't say stock ##} FM_DOESNT_SAY_STOCK ##{ FM_FAKE_53COM_SPOOF meta FM_FAKE_53COM_SPOOF (__FH_FRM_53 && !__FH_MSG_53 && !__FH_RCV_53) describe FM_FAKE_53COM_SPOOF Spoof mail from 53.com? ##} FM_FAKE_53COM_SPOOF ##{ FM_FAKE_HELO_HOTMAIL meta FM_FAKE_HELO_HOTMAIL (__HOTMAILCOM && !__HOST_HOTMAIL) describe FM_FAKE_HELO_HOTMAIL Looks like a fake hotmail.com helo. ##} FM_FAKE_HELO_HOTMAIL ##{ FM_FAKE_HELO_VERIZON meta FM_FAKE_HELO_VERIZON (__FHELO_VERIZON && !__FHOST_VERIZON) describe FM_FAKE_HELO_VERIZON Looks like a fake verizon.net helo. ##} FM_FAKE_HELO_VERIZON ##{ FM_FRM_RN_L_BRACK meta FM_FRM_RN_L_BRACK (__FROM_RIGH_BRACK && !__FROM_LEFT_BRACK && !__FROM_ISO_2022_JP) describe FM_FRM_RN_L_BRACK From name has > but not < ##} FM_FRM_RN_L_BRACK ##{ FM_IS_IT_OUR_ACCOUNT meta FM_IS_IT_OUR_ACCOUNT (__YOUR_ACCOUNT && __MANY_RECIPS) describe FM_IS_IT_OUR_ACCOUNT Is it our account? ##} FM_IS_IT_OUR_ACCOUNT ##{ FM_LIKE_STOCKS meta FM_LIKE_STOCKS (__FM_STOCK_WORDS && !__FB_S_STOCK && __FB_S_SYMBOL) describe FM_LIKE_STOCKS It looks like a duck, it's a duck! ##} FM_LIKE_STOCKS ##{ FM_LOTTO_YOU_WON meta FM_LOTTO_YOU_WON (__FM_LARGE_MONEY && __FM_NAT_LOTTERY && __YOU_WON_SOMTIN) describe FM_LOTTO_YOU_WON Talks about lotto and you won! ##} FM_LOTTO_YOU_WON ##{ FM_LUX_GIFTS_REDUCED meta FM_LUX_GIFTS_REDUCED (__FB_LUX_GIFTS && __FB_NUM_PERCNT) describe FM_LUX_GIFTS_REDUCED Luxury Gifts with dd% ##} FM_LUX_GIFTS_REDUCED ##{ FM_MANY_DRUG_WORDS meta FM_MANY_DRUG_WORDS (__VA_WORD && __CS_WORD && __VM_WORD) describe FM_MANY_DRUG_WORDS Lot's of almost drug words ##} FM_MANY_DRUG_WORDS ##{ FM_MORTGAGE5PLUS meta FM_MORTGAGE5PLUS (__FM_MORTGAGE5PLUS && !__FM_MORTGAGE6PLUS) describe FM_MORTGAGE5PLUS Looks like a mortgage spam (5+) ##} FM_MORTGAGE5PLUS ##{ FM_MORTGAGE6PLUS meta FM_MORTGAGE6PLUS (__FM_MORTGAGE6PLUS) describe FM_MORTGAGE6PLUS Looks like a mortgage spam (6+) ##} FM_MORTGAGE6PLUS ##{ FM_MULTI_LUX_GIFTS meta FM_MULTI_LUX_GIFTS ((__FB_BRAND_NAME + __FB_TIMEPIECE + __FB_WALLETS + __FB_HANDBAGS + __FB_DESIGNER + __FB_LUX_GIFTS + __FB_NUM_PERCNT + __FB_INK_PEN) > 3) describe FM_MULTI_LUX_GIFTS Talks about variety of luxury gifts ##} FM_MULTI_LUX_GIFTS ##{ FM_PHN_NODNS meta FM_PHN_NODNS (FB_SPACED_PHN_3B && RDNS_NONE) describe FM_PHN_NODNS Phone spacing + no dns ##} FM_PHN_NODNS ##{ FM_RATSIGN_1106 meta FM_RATSIGN_1106 (__MSGID_VGA && __DATE_700) describe FM_RATSIGN_1106 Fingerprint seen in lots of spam. 11/2006 ##} FM_RATSIGN_1106 ##{ FM_RE_HELLO_SPAM meta FM_RE_HELLO_SPAM (__FH_MSGID_01C7 && __FH_HAS_XMSMAIL && __FH_HAS_XPRIORITY && __FS_SUBJ_RE) describe FM_RE_HELLO_SPAM Re: Hello / hi ##} FM_RE_HELLO_SPAM ##{ FM_ROLEX_ADS meta FM_ROLEX_ADS (__FB_ROLEX_MEN && __FB_ROLEX_WMEN && __FB_OMEGA && __FB_GLASHUTE) describe FM_ROLEX_ADS Looks like Rolex spams. ##} FM_ROLEX_ADS ##{ FM_SCHOOLING meta FM_SCHOOLING ((__BACHELORS + __MASTERS + __MBA + __PHD) > 2) describe FM_SCHOOLING Meta Combo Phrase for Schooling (2) ##} FM_SCHOOLING ##{ FM_SCHOOL_DIPLOMA meta FM_SCHOOL_DIPLOMA (FM_SCHOOLING && __DIPLOMA) describe FM_SCHOOL_DIPLOMA Meta for Schooling + Diploma. ##} FM_SCHOOL_DIPLOMA ##{ FM_SCHOOL_TYPES meta FM_SCHOOL_TYPES (__FB_BA && __FB_BCs && __FB_MA && __FB_MBA) describe FM_SCHOOL_TYPES Meta Combo Phrase for Schooling ##} FM_SCHOOL_TYPES ##{ FM_SEX_HELODDDD meta FM_SEX_HELODDDD (__SEX_WRDS && FH_HELO_EQ_D_D_D_D) describe FM_SEX_HELODDDD Sex words + helo = dddd ##} FM_SEX_HELODDDD ##{ FM_SUBJ_APPROVE meta FM_SUBJ_APPROVE (__EXCLAIM_SUBJ && __SUBJ_APPROVE) describe FM_SUBJ_APPROVE Subject has Approve and ! ##} FM_SUBJ_APPROVE ##{ FM_TRUE_LOV_ALL_N meta FM_TRUE_LOV_ALL_N (__FB_P_TRUELOVE && __FB_P_ALLNIGHT) describe FM_TRUE_LOV_ALL_N True Love all Night! ##} FM_TRUE_LOV_ALL_N ##{ FM_VEGAS_CASINO meta FM_VEGAS_CASINO ((__FROM_VEGAS + __SUBJ_3DIGIT + __SUBJ_VEGAS + __FB_GAME) > 2) describe FM_VEGAS_CASINO Looks like vega casino spam ##} FM_VEGAS_CASINO ##{ FM_XMAIL_F_OUT header FM_XMAIL_F_OUT X-Mailer =~ /Microsoft Outlook Express V6.00.2900.2180/ describe FM_XMAIL_F_OUT Looks like Fake Outlook? ##} FM_XMAIL_F_OUT ##{ FORGED_RELAY_MUA_TO_MX header FORGED_RELAY_MUA_TO_MX X-Spam-Relays-External =~ /^\[ ip=(?!127)([\d.]+) [^\[]*\[ ip=\1 [^\[]+ helo=(!(?!(?:10|127|169\.254|172\.(?:1[6-9]|2[0-9]|3[01])|192\.168)\.)| )[^\[]+$/ ##} FORGED_RELAY_MUA_TO_MX ##{ FORM_FRAUD_3 meta FORM_FRAUD_3 __FORM_FRAUD_3 && !__DOS_HAS_LIST_UNSUB && !__THREADED && !__HAS_THREAD_INDEX && !__VIA_ML && !__HTML_LINK_IMAGE && !__MIME_QP describe FORM_FRAUD_3 Fill a form and several fraud phrases tflags FORM_FRAUD_3 publish ##} FORM_FRAUD_3 ##{ FORM_FRAUD_5 meta FORM_FRAUD_5 __FORM_FRAUD_5 && !__DOS_HAS_LIST_UNSUB && !__THREADED && !__HAS_THREAD_INDEX && !__VIA_ML describe FORM_FRAUD_5 Fill a form and many fraud phrases tflags FORM_FRAUD_5 publish ##} FORM_FRAUD_5 ##{ FROM_12LTRDOM meta FROM_12LTRDOM __FROM_12LTRDOM_1 && !__VIA_ML && !__TO___LOWER && !__FS_SUBJ_RE && !__RCD_RDNS_MAIL_MESSY && !__freemail_safe && !__RCVD_IN_DNSWL && !__UNSUB_LINK && !NO_RELAYS && !__UNUSABLE_MSGID && !DATE_IN_PAST_96_XX && !ALL_TRUSTED && !__MSGID_APPLEMAIL && !__RCD_RDNS_SMTP_MESSY && !__FB_NATIONAL && !__MAIL_LINK && !__NAME_EMAIL_DIFF && !__RCD_RDNS_MX_MESSY && !__RCD_RDNS_MX && !__SENDER_BOT && !__IMS_MSGID && !__HS_SUBJ_RE_FW describe FROM_12LTRDOM From a 12-letter domain ##} FROM_12LTRDOM ##{ FROM_IN_TO_AND_SUBJ meta FROM_IN_TO_AND_SUBJ (__TO_EQ_FROM && __SUBJ_HAS_FROM_1) describe FROM_IN_TO_AND_SUBJ From address is in To and Subject tflags FROM_IN_TO_AND_SUBJ publish ##} FROM_IN_TO_AND_SUBJ ##{ FROM_MISSPACED meta FROM_MISSPACED __FROM_MISSPACED && !__RCD_RDNS_MTA_MESSY && !__CTYPE_MULTIPART_ALT && !__REPTO_QUOTE && !__MIME_QP && !__UNSUB_LINK && !__TO___LOWER && !__BUGGED_IMG && !__DOS_HAS_LIST_UNSUB && !__TO_EQ_FROM_DOM && !__MAIL_LINK describe FROM_MISSPACED From: missing whitespace ##} FROM_MISSPACED ##{ FROM_MISSP_DKIM meta FROM_MISSP_DKIM (__FROM_RUNON && __DKIM_DEPENDABLE) describe FROM_MISSP_DKIM From misspaced, DKIM dependable tflags FROM_MISSP_DKIM net ##} FROM_MISSP_DKIM ##{ FROM_MISSP_DYNIP meta FROM_MISSP_DYNIP __FROM_RUNON && RDNS_DYNAMIC describe FROM_MISSP_DYNIP From misspaced + dynamic rDNS #score FROM_MISSP_DYNIP 2.0 ##} FROM_MISSP_DYNIP ##{ FROM_MISSP_EH_MATCH meta FROM_MISSP_EH_MATCH __FROM_MISSP_EH_MATCH && !__RCD_RDNS_MTA_MESSY && !__UNSUB_LINK && !__COMMENT_EXISTS && !__TO___LOWER && !__MIME_QP && !__TO_EQ_FROM_DOM && !__BUGGED_IMG && !__DKIM_EXISTS describe FROM_MISSP_EH_MATCH From misspaced, matches envelope ##} FROM_MISSP_EH_MATCH ##{ FROM_MISSP_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::FreeMail meta FROM_MISSP_FREEMAIL __FROM_RUNON && (FREEMAIL_FROM || FREEMAIL_REPLYTO) describe FROM_MISSP_FREEMAIL From misspaced + freemail provider # score FROM_MISSP_FREEMAIL 2.0 endif ##} FROM_MISSP_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail ##{ FROM_MISSP_MSFT meta FROM_MISSP_MSFT __FROM_RUNON && (__ANY_OUTLOOK_MUA || __HAS_MIMEOLE || __MIMEOLE_MS) describe FROM_MISSP_MSFT From misspaced + supposed Microsoft tool #score FROM_MISSP_MSFT 3.5 ##} FROM_MISSP_MSFT ##{ FROM_MISSP_NO_TO meta FROM_MISSP_NO_TO (__FROM_RUNON && MISSING_HEADERS) describe FROM_MISSP_NO_TO From misspaced, To missing ##} FROM_MISSP_NO_TO ##{ FROM_MISSP_REPLYTO meta FROM_MISSP_REPLYTO __FROM_MISSP_REPLYTO && !__NOT_SPOOFED && !__RCD_RDNS_MTA_MESSY && !__TO___LOWER && !__COMMENT_EXISTS && !__UNSUB_LINK && !__MIME_QP && !__CTYPE_MULTIPART_ALT && !__JM_REACTOR_DATE && !__PLING_QUERY describe FROM_MISSP_REPLYTO From misspaced, has Reply-To ##} FROM_MISSP_REPLYTO ##{ FROM_MISSP_SPF_FAIL meta FROM_MISSP_SPF_FAIL (__FROM_RUNON && SPF_FAIL) tflags FROM_MISSP_SPF_FAIL net ##} FROM_MISSP_SPF_FAIL ##{ FROM_MISSP_TO_UNDISC meta FROM_MISSP_TO_UNDISC (__FROM_RUNON && __TO_UNDISCLOSED) describe FROM_MISSP_TO_UNDISC From misspaced, To undisclosed ##} FROM_MISSP_TO_UNDISC ##{ FROM_MISSP_URI meta FROM_MISSP_URI __FROM_MISSP_URI && !__NOT_SPOOFED && !__RCD_RDNS_MTA_MESSY && !MISSING_MIMEOLE && !__COMMENT_EXISTS && !__REPTO_QUOTE && !__UNSUB_LINK && !__TO___LOWER && !__MSGID_OK_HEX && !__MAIL_LINK && !__MIME_QP && !__BUGGED_IMG && !MIME_BASE64_TEXT describe FROM_MISSP_URI From misspaced, has URI ##} FROM_MISSP_URI ##{ FROM_MISSP_USER meta FROM_MISSP_USER (__FROM_RUNON && NSL_RCVD_FROM_USER) describe FROM_MISSP_USER From misspaced, from "User" ##} FROM_MISSP_USER ##{ FROM_ONE_CHAR header FROM_ONE_CHAR From =~ /^\s*"[^"]"\s*\b(?!adobe)\b/i describe FRT_ADOBE2 ReplaceTags: Adobe endif ##} FRT_ADOBE2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_APPROV ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_APPROV /\b(?!approu?v)

/i describe FRT_APPROV ReplaceTags: Approve endif ##} FRT_APPROV ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_BIGGERMEM1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_BIGGERMEM1 /(?:|).{1,8}(?:

||)/i describe FRT_BIGGERMEM1 ReplaceTags: Bigger / Larger, Penis / Member endif ##} FRT_BIGGERMEM1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_DIPLOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_DIPLOMA /\b(?!d[iy]pl[o\xe2\xc2]m)

/i describe FRT_DIPLOMA ReplaceTags: Diploma endif ##} FRT_DIPLOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_DISCOUNT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_DISCOUNT /\b(?!discount)/i describe FRT_DISCOUNT ReplaceTags: Discount endif ##} FRT_DISCOUNT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_DOLLAR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_DOLLAR /\b(?!dollar)/i describe FRT_DOLLAR ReplaceTags: Dollar endif ##} FRT_DOLLAR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_ESTABLISH2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_ESTABLISH2 /\b(?!estabi?lish)/i describe FRT_ESTABLISH2 ReplaceTags: Establish (2) endif ##} FRT_ESTABLISH2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_FUCK2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_FUCK2 /\b(?!fuck)/i describe FRT_FUCK2 ReplaceTags: Fuck (2) endif ##} FRT_FUCK2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_GUARANTEE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_GUARANTEE1 /(?!guarantee)/i describe FRT_GUARANTEE1 ReplaceTags: Guarantee (1) endif ##} FRT_GUARANTEE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_INVESTOR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_INVESTOR /\b(?!investor)/i describe FRT_INVESTOR ReplaceTags: Investor endif ##} FRT_INVESTOR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_LEVITRA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_LEVITRA /(?!levitra)/i describe FRT_LEVITRA ReplaceTags: Levitra endif ##} FRT_LEVITRA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_MEETING ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_MEETING /\b(?!meeting)\b/i describe FRT_MEETING ReplaceTags: Meeting endif ##} FRT_MEETING ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_OFFER2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_OFFER2 /\b(?!offer)/i describe FRT_OFFER2 ReplaceTags: Offer (2) endif ##} FRT_OFFER2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_OPPORTUN2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_OPPORTUN2 /(?!opportun)

/i describe FRT_OPPORTUN2 ReplaceTags: Oppertun (2) endif ##} FRT_OPPORTUN2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_PENIS1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_PENIS1 /\b(?!pen\s?(?:ie?s|ny[ ']?s))

\b/i describe FRT_PENIS1 ReplaceTags: Penis endif ##} FRT_PENIS1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_PRICE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_PRICE /\b(?!price)

\b/i describe FRT_PRICE ReplaceTags: Price endif ##} FRT_PRICE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_REFINANCE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_REFINANCE1 /\b(?!refinanc)/i describe FRT_REFINANCE1 ReplaceTags: Refinance (1) endif ##} FRT_REFINANCE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_ROLEX ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_ROLEX /\b(?!rolex)/i describe FRT_ROLEX ReplaceTags: Rolex endif ##} FRT_ROLEX ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_SEXUAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_SEXUAL /\b(?!sexual)/i describe FRT_SEXUAL ReplaceTags: Sexual endif ##} FRT_SEXUAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_SOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_SOMA /\b(?!soma|500mg)\b/i describe FRT_SOMA ReplaceTags: Soma endif ##} FRT_SOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_SOMA2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_SOMA2 /\b(?!soma|500? ?mg)\b/i describe FRT_SOMA2 ReplaceTags: Soma (2) endif ##} FRT_SOMA2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_STRONG1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_STRONG1 /\b(?!stro\s?ng)\b/i describe FRT_STRONG1 ReplaceTags: Strong (1) endif ##} FRT_STRONG1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_STRONG2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_STRONG2 /\b(?!strong)\b/i describe FRT_STRONG2 ReplaceTags: Strong (2) endif ##} FRT_STRONG2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_SYMBOL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_SYMBOL /\b(?!symbol)/i describe FRT_SYMBOL ReplaceTags: Symbol endif ##} FRT_SYMBOL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_TODAY2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_TODAY2 /\b(?!today)/i describe FRT_TODAY2 ReplaceTags: Today (2) endif ##} FRT_TODAY2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_VALIUM1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_VALIUM1 /\b(?!valium|verifiquem|volturno|vollum)\b/i describe FRT_VALIUM1 ReplaceTags: Valium endif ##} FRT_VALIUM1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_VALIUM2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_VALIUM2 /\b(?!valium|verifiquem|volturno|vollum)\b/i describe FRT_VALIUM2 ReplaceTags: Valium (2) endif ##} FRT_VALIUM2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_WEIGHT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_WEIGHT2 /\b(?!weight)/i describe FRT_WEIGHT2 ReplaceTags: Weight (2) endif ##} FRT_WEIGHT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_XANAX1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_XANAX1 /\b(?!xanax)\b/i describe FRT_XANAX1 ReplaceTags: Xanax (1) endif ##} FRT_XANAX1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FRT_XANAX2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_XANAX2 /\b(?!xanax)\b/i describe FRT_XANAX2 ReplaceTags: Xanax (2) endif ##} FRT_XANAX2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FR_3TAG_3TAG rawbody FR_3TAG_3TAG m'<[abcefghijklmnoqstuvwxz]{3}>'i describe FR_3TAG_3TAG Looks like 3 small tags. ##} FR_3TAG_3TAG ##{ FR_ALMOST_VIAG2 rawbody FR_ALMOST_VIAG2 /[^a-z](?!viagra)v?ia.?g.?ra/i describe FR_ALMOST_VIAG2 Almost looks like viagra. ##} FR_ALMOST_VIAG2 ##{ FR_CANTSEETEXT rawbody FR_CANTSEETEXT /class="?cantseetext/i describe FR_CANTSEETEXT Phrase class=cantseetext ##} FR_CANTSEETEXT ##{ FR_DOT_FEVER_5 rawbody FR_DOT_FEVER_5 /(?:[a-z ']{2,35}\s[.,]\s){5}/ describe FR_DOT_FEVER_5 Lots of dots inbetween letters. ##} FR_DOT_FEVER_5 ##{ FR_MIDER rawbody FR_MIDER m'http[^ ]{5,30}/gall?/' describe FR_MIDER Sign often seen in spams ##} FR_MIDER ##{ FR_TITLE_NUMS rawbody FR_TITLE_NUMS m'\d+'i describe FR_TITLE_NUMS HTML Title is only numbers ##} FR_TITLE_NUMS ##{ FR_WATCHES_HTTP rawbody FR_WATCHES_HTTP m'watches\s(?:\w+)?\s?http://'i describe FR_WATCHES_HTTP Watches http:// ##} FR_WATCHES_HTTP ##{ FSL_CTYPE_WIN1251 header FSL_CTYPE_WIN1251 Content-Type =~ /charset="Windows-1251"/ describe FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam #score FSL_CTYPE_WIN1251 2.0 ##} FSL_CTYPE_WIN1251 ##{ FSL_FAKE_GMAIL_RCVD header FSL_FAKE_GMAIL_RCVD X-Spam-Relays-External =~ /gmail-smtp-in\.l\.google\.com/ #score FSL_FAKE_GMAIL_RCVD 0.001 ##} FSL_FAKE_GMAIL_RCVD ##{ FSL_FAKE_HOTMAIL_RVCD header FSL_FAKE_HOTMAIL_RVCD X-Spam-Relays-External =~ /mx[1234]\.hotmail\.com/ ##} FSL_FAKE_HOTMAIL_RVCD ##{ FSL_GEO_ABUSE uri FSL_GEO_ABUSE /\/geocities\.com\/\S+$/ #score FSL_GEO_ABUSE 3.0 ##} FSL_GEO_ABUSE ##{ FSL_HELO_BARE_IP_1 header FSL_HELO_BARE_IP_1 X-Spam-Relays-External =~ /^[^\]]+ helo=\d+\.\d+\.\d+\.\d+ /i #score FSL_HELO_BARE_IP_1 0.001 ##} FSL_HELO_BARE_IP_1 ##{ FSL_HELO_DEVICE header FSL_HELO_DEVICE X-Spam-Relays-External =~ /\bhelo=(?:(?:dsl)?device|speedtouch)\.lan\b/i #score FSL_HELO_DEVICE 0.001 ##} FSL_HELO_DEVICE ##{ FSL_HELO_NON_FQDN_1 header FSL_HELO_NON_FQDN_1 X-Spam-Relays-External =~ /^[^\]]+ helo=[a-zA-Z0-9-_]+ /i #score FSL_HELO_NON_FQDN_1 0.001 ##} FSL_HELO_NON_FQDN_1 ##{ FSL_HELO_SETUP header FSL_HELO_SETUP X-Spam-Relays-External =~ /\bhelo=\S+\.setup\b/i #score FSL_HELO_SETUP 0.001 ##} FSL_HELO_SETUP ##{ FSL_INTERIA_ABUSE uri FSL_INTERIA_ABUSE /\/\S+\.(?:w|eu|fm)\.interia\.pl/ #score FSL_INTERIA_ABUSE 15.0 ##} FSL_INTERIA_ABUSE ##{ FSL_MID_419 header FSL_MID_419 MESSAGE-ID =~ /\@User>$/ describe FSL_MID_419 Spam signature in Message-ID #score FSL_MID_419 2.0 ##} FSL_MID_419 ##{ FSL_UA meta FSL_UA (__FSL_UA_1 || __FSL_UA_2) #score FSL_UA 3.0 ##} FSL_UA ##{ FSL_XM_419 header FSL_XM_419 X-Mailer =~ /\s+6\.00\.2600\.0000$/ describe FSL_XM_419 Old OE version in X-Mailer only seen in 419 spam #score FSL_XM_419 2.0 ##} FSL_XM_419 ##{ FSL_YG_ABUSE uri FSL_YG_ABUSE /\/groups\.yahoo\.com\/group\/\S+\/message\/1$/ #score FSL_YG_ABUSE 15.0 ##} FSL_YG_ABUSE ##{ FS_ABIGGER header FS_ABIGGER Subject =~ /a bigger/i describe FS_ABIGGER Subject has "a bigger" ##} FS_ABIGGER ##{ FS_APPROVE_YOU header FS_APPROVE_YOU Subject =~ /approve you/i describe FS_APPROVE_YOU Subject says approve you ##} FS_APPROVE_YOU ##{ FS_AT_NO_COST header FS_AT_NO_COST Subject =~ /\bat no cost/i describe FS_AT_NO_COST Subject says "At No Cost" ##} FS_AT_NO_COST ##{ FS_CHEAP_CAP header FS_CHEAP_CAP Subject =~ /CHEAP/ describe FS_CHEAP_CAP Phrase: Cheap in Caps in Subject. ##} FS_CHEAP_CAP ##{ FS_DOLLAR_BONUS header FS_DOLLAR_BONUS Subject =~ /\$\d\d\d?\.?\d?\d? bonus/i describe FS_DOLLAR_BONUS Subject talks about money bonus! ##} FS_DOLLAR_BONUS ##{ FS_EJACULA header FS_EJACULA Subject =~ /ejaculat(?:[io01][o0i1]n|e)/i describe FS_EJACULA Phrase: ejaculation in subject. ##} FS_EJACULA ##{ FS_ERECTION header FS_ERECTION Subject =~ / erection /i describe FS_ERECTION Phrase: erection in subject. ##} FS_ERECTION ##{ FS_GET_LAID header FS_GET_LAID Subject =~ /get la[i1]d/i describe FS_GET_LAID Phrase: get laid in subj. ##} FS_GET_LAID ##{ FS_HUGECOCK header FS_HUGECOCK Subject =~ /(?:huge|tiny|small) (?:c[o0]ck|d[i1]ck|p[e3]n[1i]s)/i describe FS_HUGECOCK Phrase: Huge Cock ##} FS_HUGECOCK ##{ FS_LARGE_PERCENT2 header FS_LARGE_PERCENT2 Subject =~ /(?!100%)\d[0-9oi][0-9oi]%/i describe FS_LARGE_PERCENT2 Larger than 100% in subj. ##} FS_LARGE_PERCENT2 ##{ FS_LOW_RATES header FS_LOW_RATES Subject =~ / low rates/i describe FS_LOW_RATES Subject says low rates ##} FS_LOW_RATES ##{ FS_MAKE_MONEY header FS_MAKE_MONEY Subject =~ /make money/i describe FS_MAKE_MONEY Subject says "make money" ##} FS_MAKE_MONEY ##{ FS_NEW_SOFT_UPLOAD header FS_NEW_SOFT_UPLOAD Subject =~ /^New software uploaded by/ describe FS_NEW_SOFT_UPLOAD Subj starts with New software uploaded ##} FS_NEW_SOFT_UPLOAD ##{ FS_NEW_XXX header FS_NEW_XXX Subject =~ /^Re: news? [a-z]{1,5}$/ describe FS_NEW_XXX Subject looks like Fharmacy spams. ##} FS_NEW_XXX ##{ FS_NO_SCRIP header FS_NO_SCRIP Subject =~ /n[o0O] p[reRE][erER]scr[i1I]pt[i1I][o0O]n/i describe FS_NO_SCRIP Subject almost says No prescription ##} FS_NO_SCRIP ##{ FS_NUDE header FS_NUDE Subject =~ /\bnude\b/i describe FS_NUDE Subject says Nude ##} FS_NUDE ##{ FS_OBFU_PRMCY header FS_OBFU_PRMCY Subject =~ /\b(?!(?:pharmacy|primacy))p[ph]{0,4}\S{1,3}r\S{0,2}m\S{0,3}c\S{0,2}y\b/i describe FS_OBFU_PRMCY what could this word be? ##} FS_OBFU_PRMCY ##{ FS_PERSCRIPTION header FS_PERSCRIPTION Subject =~ /perscr[i1]pt[i1][o0]n/i describe FS_PERSCRIPTION Subject mis-spelled prescription ##} FS_PERSCRIPTION ##{ FS_PHARMASUB2 header FS_PHARMASUB2 Subject =~ /PH[A-Za-z]{2,7}MA/ describe FS_PHARMASUB2 Looks like Phramacy subject. ##} FS_PHARMASUB2 ##{ FS_RAMROD header FS_RAMROD Subject =~ /ramrod/i describe FS_RAMROD Subject says Ramrod ##} FS_RAMROD ##{ FS_REPLICA header FS_REPLICA Subject =~ /replica/i describe FS_REPLICA Subject says "replica" ##} FS_REPLICA ##{ FS_REPLICAWATCH header FS_REPLICAWATCH Subject =~ /replica watch/i describe FS_REPLICAWATCH Subject says Replica watch ##} FS_REPLICAWATCH ##{ FS_RE_APPROV header FS_RE_APPROV Subject =~ /re approved/i describe FS_RE_APPROV Phrase: re approved ##} FS_RE_APPROV ##{ FS_START_DOYOU2 header FS_START_DOYOU2 Subject =~ /^Do you (?:dream|have|want|love|like|wanna)/i describe FS_START_DOYOU2 Subject starts with Do you dream,have,want,love, etc. ##} FS_START_DOYOU2 ##{ FS_START_LOSE header FS_START_LOSE Subject =~ /^Lose /i describe FS_START_LOSE Subject starts with Lose ##} FS_START_LOSE ##{ FS_TEEN_BAD header FS_TEEN_BAD Subject =~ /teen.{1,15}(?:pussy|sex|slut|ass|fuck|rape)/i describe FS_TEEN_BAD Subject says something bad about teens ##} FS_TEEN_BAD ##{ FS_TIP_DDD header FS_TIP_DDD Subject =~ /(?:tip|good) \d\d\d?\d?/i describe FS_TIP_DDD Phrase: subject = tip ddd ##} FS_TIP_DDD ##{ FS_WEIGHT_LOSS header FS_WEIGHT_LOSS Subject =~ /weight loss/i describe FS_WEIGHT_LOSS Subject says Weight Loss ##} FS_WEIGHT_LOSS ##{ FS_WILL_HELP header FS_WILL_HELP Subject =~ /will help/ describe FS_WILL_HELP Subject says will help ##} FS_WILL_HELP ##{ FS_WITH_SMALL header FS_WITH_SMALL Subject =~ /with (?:\w+\s)?(?:small|short)/i describe FS_WITH_SMALL Subject says With ... small ##} FS_WITH_SMALL ##{ FUZZY_MERIDIA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FUZZY_MERIDIA /\b(?!meridia)\b/i endif ##} FUZZY_MERIDIA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FU_COMMON_SUBS2 uri FU_COMMON_SUBS2 m'/(?:[2w]m|7d|b|ee|lj|j|o|u)/[,.]?$' describe FU_COMMON_SUBS2 Sub-dir seen often in spam (2). ##} FU_COMMON_SUBS2 ##{ FU_ENDS_NUMS_DOTS_CLK uri FU_ENDS_NUMS_DOTS_CLK m'(?:clk|uns)/\d+\.\d+\.\d+'i describe FU_ENDS_NUMS_DOTS_CLK Ends with clk/d+.d+.d+ ##} FU_ENDS_NUMS_DOTS_CLK ##{ FU_END_ET uri FU_END_ET m'/et/$'i describe FU_END_ET ET Phone Home? ##} FU_END_ET ##{ FU_HOODIA uri FU_HOODIA /hoodia/i describe FU_HOODIA URL has hoodia in it. ##} FU_HOODIA ##{ FU_LONG_QUERY3 uri FU_LONG_QUERY3 m'[A-F0-9]{30}\.aspx' describe FU_LONG_QUERY3 URL has a long file name with .aspx extension. ##} FU_LONG_QUERY3 ##{ FU_MIDER uri FU_MIDER m'/gall?/' describe FU_MIDER URL has /gal/ ##} FU_MIDER ##{ FU_UKGEOCITIES uri FU_UKGEOCITIES /\b[a-z]{2}\.geocities\.com/i describe FU_UKGEOCITIES URL with [a-z]{2}.geocities.com ##} FU_UKGEOCITIES ##{ FU_URI_TRACKER_T uri FU_URI_TRACKER_T m'/[yi]/(?:sp|et|vm|xl2)/'i describe FU_URI_TRACKER_T URI style tracker (T) ##} FU_URI_TRACKER_T ##{ GAPPY_HTML meta GAPPY_HTML __GAPPY_HTML && !__UNSUB_LINK describe GAPPY_HTML HTML body with much useless whitespace ##} GAPPY_HTML ##{ GAPPY_PHONE_NA meta GAPPY_PHONE_NA __GAPPY_PHONE_NA describe GAPPY_PHONE_NA Phone number with lots of spaces ##} GAPPY_PHONE_NA ##{ GEO_QUERY_STRING uri GEO_QUERY_STRING /^http:\/\/(?:\w{2,4}\.)?geocities\.com(?::\d*)?\/.+?\/\?/i ##} GEO_QUERY_STRING ##{ HDRS_LCASE_1K meta HDRS_LCASE_1K __HDRS_LCASE_1K && !__VIA_ML describe HDRS_LCASE_1K Odd capitalization of message headers + long header ##} HDRS_LCASE_1K ##{ HDR_ORDER_FTSDMCXX_001C meta HDR_ORDER_FTSDMCXX_001C (__HDR_ORDER_FTSDMCXXXX && __MID_START_001C) describe HDR_ORDER_FTSDMCXX_001C Header order similar to spam (FTSDMCXX/MID variant) ##} HDR_ORDER_FTSDMCXX_001C ##{ HDR_ORDER_FTSDMCXX_BAT meta HDR_ORDER_FTSDMCXX_BAT (__HDR_ORDER_FTSDMCXXXX && __BAT_BOUNDARY) describe HDR_ORDER_FTSDMCXX_BAT Header order similar to spam (FTSDMCXX/boundary variant) ##} HDR_ORDER_FTSDMCXX_BAT ##{ HEADER_COUNT_SUBJECT ifplugin Mail::SpamAssassin::Plugin::HeaderEval ifplugin Mail::SpamAssassin::Plugin::HeaderEval header HEADER_COUNT_SUBJECT eval:check_header_count_range('Subject','2','999') describe HEADER_COUNT_SUBJECT Multiple Subject headers found endif ##} HEADER_COUNT_SUBJECT ifplugin Mail::SpamAssassin::Plugin::HeaderEval ##{ HELO_FRIEND header HELO_FRIEND X-Spam-Relays-External =~ /^[^\]]+ helo=friend /i ##} HELO_FRIEND ##{ HELO_LH_HOME header HELO_LH_HOME X-Spam-Relays-External =~ /^[^\]]+ helo=\S+\.(?:home|lan) /i ##} HELO_LH_HOME ##{ HELO_LH_LD header HELO_LH_LD X-Spam-Relays-External =~ /^[^\]]+ helo=localhost\.localdomain /i ##} HELO_LH_LD ##{ HELO_LOCALHOST header HELO_LOCALHOST X-Spam-Relays-External =~ /^[^\]]+ helo=localhost /i ##} HELO_LOCALHOST ##{ HELO_NO_DOMAIN meta HELO_NO_DOMAIN __HELO_NO_DOMAIN && !HELO_LOCALHOST describe HELO_NO_DOMAIN Relay reports its domain incorrectly ##} HELO_NO_DOMAIN ##{ HELO_OEM header HELO_OEM X-Spam-Relays-External =~ /^[^\]]+ helo=(?:pc|oem\S*) /i ##} HELO_OEM ##{ HK_FAKENAME_EBAY ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM meta HK_FAKENAME_EBAY __HK_NAME_EBAY && !__HK_HELO_EBAY && !SPF_PASS && !DKIM_VALID_AU describe HK_FAKENAME_EBAY From name mentions eBay, but not relayed from there endif endif ##} HK_FAKENAME_EBAY ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM ##{ HK_LOTTO meta HK_LOTTO __HK_LOTTO_1 || __HK_LOTTO_2 || __HK_LOTTO_JACKPOT || __HK_LOTTO_STAATS || __HK_LOTTO_BALLOT ##} HK_LOTTO ##{ HK_NAME_DRUGS header HK_NAME_DRUGS From:name =~ /(viagra|\bcialis|cialis\b)/mi describe HK_NAME_DRUGS From name contains drugs ##} HK_NAME_DRUGS ##{ HK_PNIS body HK_PNIS /\bpenis\b/i ##} HK_PNIS ##{ HK_RANDOM_ENVFROM header HK_RANDOM_ENVFROM EnvelopeFrom =~ /^(?!(?:mail|bounce)[_.-]|[^@]*(?:[+=^~\#]|mcgr|kpmg|nlpbr|ndqv|lcgc|cplpr|-mailer@)|[^@]{20})[^@]*(?:[bcdfgjklmnpqrtvwxz]{5}|[aeiouy]{5}|([a-z]{1,2})(?:\1){3})/mi describe HK_RANDOM_ENVFROM Envelope sender username looks random ##} HK_RANDOM_ENVFROM ##{ HK_RANDOM_FROM header HK_RANDOM_FROM From:addr =~ /^(?!(?:mail|bounce)[_.-]|[^@]*(?:[+=^~\#]|mcgr|kpmg|nlpbr|ndqv|lcgc|cplpr|-mailer@)|[^@]{26}|.*?@.{0,20}\bcmp-info\.com$)[^@]*(?:[bcdfgjklmnpqrtvwxz]{5}|[aeiouy]{5}|([a-z]{1,2})(?:\1){3})/mi describe HK_RANDOM_FROM From username looks random ##} HK_RANDOM_FROM ##{ HK_SCAM_N2 body HK_SCAM_N2 /\bnext of kin\b/i ##} HK_SCAM_N2 ##{ HK_SCAM_N8 body HK_SCAM_N8 /\byour compensation\b/i ##} HK_SCAM_N8 ##{ HS_BOBAX_MID_2 header HS_BOBAX_MID_2 Message-Id =~ /^<\dIX\d{3}EJXVWDA\d{3}\@[a-z\-]+\.[a-z]+>/ describe HS_BOBAX_MID_2 Bobax? Message-Id: <0IX000EJXVWDA000@example.com> ##} HS_BOBAX_MID_2 ##{ HS_BODY_UPLOADED_SOFTWARE body HS_BODY_UPLOADED_SOFTWARE /^\w+ has uploaded some new software/ describe HS_BODY_UPLOADED_SOFTWARE Somebody has uploaded some new software for you ##} HS_BODY_UPLOADED_SOFTWARE ##{ HS_DRUG_DOLLAR_1 body HS_DRUG_DOLLAR_1 m'^[a-z]+[glrt][a-z]?[eir][a-z]?[asx](?: -|:)? \$[\d.]+$'i describe HS_DRUG_DOLLAR_1 Contains a drug and price-like pattern. ##} HS_DRUG_DOLLAR_1 ##{ HS_DRUG_DOLLAR_2 body HS_DRUG_DOLLAR_2 m'^[a-z]+[lmor][a-z]?[aex][a-z]?[mx](?: -|:)? \$[\d.]+$'i describe HS_DRUG_DOLLAR_2 Contains a drug and price-like pattern. ##} HS_DRUG_DOLLAR_2 ##{ HS_DRUG_DOLLAR_3 body HS_DRUG_DOLLAR_3 m'^[a-z]+[dino][a-z]?[aimu][a-z]?[amx](?: -|:)? \$[\d.]+$'i describe HS_DRUG_DOLLAR_3 Contains a drug and price-like pattern. ##} HS_DRUG_DOLLAR_3 ##{ HS_DRUG_DOLLAR_MANY meta HS_DRUG_DOLLAR_MANY HS_DRUG_DOLLAR_1 + HS_DRUG_DOLLAR_2 + HS_DRUG_DOLLAR_3 >= 2 describe HS_DRUG_DOLLAR_MANY Contains several drug and dollar-like patterns. ##} HS_DRUG_DOLLAR_MANY ##{ HS_FORGED_OE_FW meta HS_FORGED_OE_FW __HS_SUBJ_UC_FW && __OE_MUA describe HS_FORGED_OE_FW Outlook does not prefix forwards with "FW:" ##} HS_FORGED_OE_FW ##{ HS_GETMEOFF uri HS_GETMEOFF m'/get(?:me)?off\.php(?:$|[\#?])' describe HS_GETMEOFF Links to common unsubscribe script: 'getmeoff.php' ##} HS_GETMEOFF ##{ HS_INDEX_PARAM uri HS_INDEX_PARAM m'^https?:/*([^/]*/)+(?:index.(?:cgi|html?|php)|default.(?:asp|jsp))?\?(?!(?-i:[A-Z][a-z]{2,}){2,}$)\w+={0,2}$'i describe HS_INDEX_PARAM Link contains a common tracker pattern. ##} HS_INDEX_PARAM ##{ HS_MEETUP_FOR_SEX body HS_MEETUP_FOR_SEX m'(?:meet ?up|see eachother|get together) for (?:some )?(?:action|sex)'i describe HS_MEETUP_FOR_SEX Talks about meeting up for sex. ##} HS_MEETUP_FOR_SEX ##{ HS_SUBJ_NEW_SOFTWARE header HS_SUBJ_NEW_SOFTWARE Subject =~ /^New software uploaded by/ describe HS_SUBJ_NEW_SOFTWARE Subject starts with 'New software uploaded by' ##} HS_SUBJ_NEW_SOFTWARE ##{ HS_SUBJ_ONLINE_PHARMACEUTICAL header HS_SUBJ_ONLINE_PHARMACEUTICAL Subject =~ /\bOnline Pharmaceutical/i describe HS_SUBJ_ONLINE_PHARMACEUTICAL Subject contains the phrase 'Online pharmaceutical' ##} HS_SUBJ_ONLINE_PHARMACEUTICAL ##{ HS_VPXL body HS_VPXL /\bVPXL\b/i describe HS_VPXL Contains VPXL, yet the recommended dose is only 2 tablets. ##} HS_VPXL ##{ HTTPS_HTTP_MISMATCH ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch body HTTPS_HTTP_MISMATCH eval:check_https_http_mismatch('1','10') endif ##} HTTPS_HTTP_MISMATCH ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch ##{ JM_FAKE_PSMTP_RCVD header JM_FAKE_PSMTP_RCVD Received =~ /^from \[\d+\.\d+\.\d+\.\d+\] by \S+\.\S+\.psmtp\.com; /m ##} JM_FAKE_PSMTP_RCVD ##{ JM_I_FEEL_LUCKY uri JM_I_FEEL_LUCKY /(?:\&|\?)btnI=ec(?:$|\&)/ tflags JM_I_FEEL_LUCKY publish # low hitrate, but always a good sign ##} JM_I_FEEL_LUCKY ##{ JM_RCVD_QMAILV1 header JM_RCVD_QMAILV1 Received =~ /by \S+ \(Qmailv1\) with ESMTP/ ##} JM_RCVD_QMAILV1 ##{ JM_SOUGHT_FRAUD_1 meta JM_SOUGHT_FRAUD_1 (0) #score JM_SOUGHT_FRAUD_1 0 describe JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns ##} JM_SOUGHT_FRAUD_1 ##{ JM_SOUGHT_FRAUD_2 meta JM_SOUGHT_FRAUD_2 (__SEEK_FRAUD_TPKDA7 || __SEEK_FRAUD_XJPS4J || __SEEK_FRAUD_ZZVKMO || __SEEK_FRAUD_GRYB_A || __SEEK_FRAUD_4KBBOJ) #score JM_SOUGHT_FRAUD_2 3.0 describe JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns ##} JM_SOUGHT_FRAUD_2 ##{ JM_SOUGHT_FRAUD_3 meta JM_SOUGHT_FRAUD_3 (__SEEK_FRAUD_QU7ENV || __SEEK_FRAUD_DA_SPN || __SEEK_FRAUD_Y6I2KV || __SEEK_FRAUD_HWMBYB || __SEEK_FRAUD_ZA0FLG || __SEEK_FRAUD_Z9HI0T || __SEEK_FRAUD_QJE0YJ || __SEEK_FRAUD_1OMKY9 || __SEEK_FRAUD_UDD6SD || __SEEK_FRAUD_LHMFUQ || __SEEK_FRAUD_0KBZGH || __SEEK_FRAUD_XD3U8U || __SEEK_FRAUD__3AQGB || __SEEK_FRAUD_1YKNCJ || __SEEK_FRAUD_0OPFLV || __SEEK_FRAUD_IGL8BZ || __SEEK_FRAUD_27TPNC || __SEEK_FRAUD_IRYH8O || __SEEK_FRAUD_PXHWDT || __SEEK_FRAUD___VYVJ || __SEEK_FRAUD_55WLGY || __SEEK_FRAUD_AZUWPQ || __SEEK_FRAUD_AUHBXT || __SEEK_FRAUD_MY06YR || __SEEK_FRAUD_SLAG8H || __SEEK_FRAUD_MA4WWH || __SEEK_FRAUD_YKISUY || __SEEK_FRAUD_UV2ATY || __SEEK_FRAUD_ZBJZVN || __SEEK_FRAUD_OVKMST || __SEEK_FRAUD_O3_VB8 || __SEEK_FRAUD_M8ZJ86 || __SEEK_FRAUD_ZMITTF || __SEEK_FRAUD_MZ4KU4 || __SEEK_FRAUD_6OI8QG || __SEEK_FRAUD_AITBFD || __SEEK_FRAUD_VQGIG6 || __SEEK_FRAUD_M8T_DX || __SEEK_FRAUD_MOT82J || __SEEK_FRAUD_UVOSIY || __SEEK_FRAUD_BEAOXU || __SEEK_FRAUD_17TGPW || __SEEK_FRAUD_UJZKNM || __SEEK_FRAUD_KEP1L_ || __SEEK_FRAUD_V3CKGD || __SEEK_FRAUD_0YTF3I || __SEEK_FRAUD_1_DZIV || __SEEK_FRAUD_59PL1E || __SEEK_FRAUD_9TSKUH || __SEEK_FRAUD_AKYCPN || __SEEK_FRAUD_XL24FM || __SEEK_FRAUD_JGGLPC || __SEEK_FRAUD_49FI4O || __SEEK_FRAUD_Y1JTCA || __SEEK_FRAUD_E2_QDF || __SEEK_FRAUD_CTPNAE || __SEEK_FRAUD__JQVGM || __SEEK_FRAUD_F2OR8H || __SEEK_FRAUD_N7NCI8 || __SEEK_FRAUD_GHC0LN || __SEEK_FRAUD_YELH8F || __SEEK_FRAUD_TKBHOI || __SEEK_FRAUD_3WUO8K || __SEEK_FRAUD_CJPQV1 || __SEEK_FRAUD_BRNKW7 || __SEEK_FRAUD_WAAEJ8 || __SEEK_FRAUD__8R822 || __SEEK_FRAUD__SGKIK || __SEEK_FRAUD_0ENSZN || __SEEK_FRAUD_XMTGXX || __SEEK_FRAUD_LUOISR || __SEEK_FRAUD_LTD1IZ || __SEEK_FRAUD_XNCCWK || __SEEK_FRAUD_MEFC9A || __SEEK_FRAUD_VNERKN || __SEEK_FRAUD_US_OFW || __SEEK_FRAUD_R8MXKM || __SEEK_FRAUD__J8HKJ || __SEEK_FRAUD_75EPGH || __SEEK_FRAUD_L2F6_R || __SEEK_FRAUD_WJ_B8R || __SEEK_FRAUD_BOG4XB || __SEEK_FRAUD_ZIZCXR || __SEEK_FRAUD_4YVO5B || __SEEK_FRAUD__2H_ZF || __SEEK_FRAUD_XY_KVM || __SEEK_FRAUD_SUGRCM || __SEEK_FRAUD_JH0IMU || __SEEK_FRAUD_D0SCQY || __SEEK_FRAUD_6SNWNT || __SEEK_FRAUD_S2TCCV || __SEEK_FRAUD_YGQR5E || __SEEK_FRAUD_ZTOV4F || __SEEK_FRAUD_45YXI4 || __SEEK_FRAUD_S4QI3T || __SEEK_FRAUD_MHDF0X || __SEEK_FRAUD_EFJ5G0 || __SEEK_FRAUD_P8F86E || __SEEK_FRAUD_LC7TDH || __SEEK_FRAUD_Y6P5MJ || __SEEK_FRAUD_X1E2EB || __SEEK_FRAUD_J1D82S || __SEEK_FRAUD_SMTAYP || __SEEK_FRAUD_K1G7F9 || __SEEK_FRAUD_H78OXL || __SEEK_FRAUD_LHZDJ_ || __SEEK_FRAUD_MPY_VV || __SEEK_FRAUD_DXLGXY || __SEEK_FRAUD_1LWG1E || __SEEK_FRAUD_UVUS_Y || __SEEK_FRAUD_EBEPD_ || __SEEK_FRAUD_EFET6T || __SEEK_FRAUD_DE87LA || __SEEK_FRAUD_QYJ0F_ || __SEEK_FRAUD_CKWDC_ || __SEEK_FRAUD_SRT80U || __SEEK_FRAUD_ETTPUF || __SEEK_FRAUD_XVM0G_ || __SEEK_FRAUD_CHLODJ || __SEEK_FRAUD_S0K3GF || __SEEK_FRAUD_XOG2QH || __SEEK_FRAUD_AKAEF9 || __SEEK_FRAUD_0XNFH_ || __SEEK_FRAUD_MSZKFU || __SEEK_FRAUD_B5_Q5F || __SEEK_FRAUD__2JC4J || __SEEK_FRAUD_EYJYD5 || __SEEK_FRAUD_JJQFVB || __SEEK_FRAUD_SWKNYQ || __SEEK_FRAUD_NEZYJA || __SEEK_FRAUD_ZGRQSU || __SEEK_FRAUD_EVIVRH || __SEEK_FRAUD_UD45OB || __SEEK_FRAUD_QNKQRV || __SEEK_FRAUD_1MXKDB || __SEEK_FRAUD_TTMYIZ || __SEEK_FRAUD_V5HTKT || __SEEK_FRAUD_I19BXK || __SEEK_FRAUD_CIXFCH || __SEEK_FRAUD_TK7ZE5 || __SEEK_FRAUD_KJCQBN || __SEEK_FRAUD_SF0AZL || __SEEK_FRAUD_B9GHRP || __SEEK_FRAUD_32EE0G || __SEEK_FRAUD_PBZBDQ || __SEEK_FRAUD_CEXPEV || __SEEK_FRAUD_AZ117T || __SEEK_FRAUD_MFX2AC || __SEEK_FRAUD_OW6PZN || __SEEK_FRAUD_KKQM9L || __SEEK_FRAUD_YGGJHJ || __SEEK_FRAUD_YMNO86 || __SEEK_FRAUD_S8_5Y8 || __SEEK_FRAUD_EDORBJ || __SEEK_FRAUD_FKRVOS || __SEEK_FRAUD_DE3CNN || __SEEK_FRAUD_IR89IB || __SEEK_FRAUD_EXFYTU || __SEEK_FRAUD_XBDIGO || __SEEK_FRAUD_FMJP2L || __SEEK_FRAUD_POSXKO || __SEEK_FRAUD_LYNJ8F || __SEEK_FRAUD_AZ58ZB || __SEEK_FRAUD_GGXKDC || __SEEK_FRAUD_2C0NY6 || __SEEK_FRAUD__GBFFZ || __SEEK_FRAUD_JJTCEC || __SEEK_FRAUD__EWXDD || __SEEK_FRAUD_F8VGZN || __SEEK_FRAUD_GTSAAF || __SEEK_FRAUD_ZMFYMV || __SEEK_FRAUD_LHPW8G || __SEEK_FRAUD_3MBUTP || __SEEK_FRAUD_JGFD5P || __SEEK_FRAUD_87YD7W || __SEEK_FRAUD_NV1HR9 || __SEEK_FRAUD_RQRFPM || __SEEK_FRAUD_7SASLI || __SEEK_FRAUD_DIIRM8 || __SEEK_FRAUD_KB6SDS || __SEEK_FRAUD__VYNLD || __SEEK_FRAUD_H9VQEI || __SEEK_FRAUD_BJUJI4 || __SEEK_FRAUD_JHIYQX || __SEEK_FRAUD_4HH4OS || __SEEK_FRAUD_NEK_SA || __SEEK_FRAUD_MHAKVX || __SEEK_FRAUD_8802C6 || __SEEK_FRAUD_JMEGUU || __SEEK_FRAUD_I3HLDY || __SEEK_FRAUD_JTD4OO || __SEEK_FRAUD_6RGTYS || __SEEK_FRAUD_EAHFYY || __SEEK_FRAUD_7MKYRR || __SEEK_FRAUD_UVARBX || __SEEK_FRAUD_IQHXRD || __SEEK_FRAUD_XKEW24 || __SEEK_FRAUD_LXBIXJ || __SEEK_FRAUD_O9Z_CI || __SEEK_FRAUD_UF2Q_4 || __SEEK_FRAUD_8LRGPA || __SEEK_FRAUD_SOMTJG || __SEEK_FRAUD_DI5SMP || __SEEK_FRAUD_3ZEWKC || __SEEK_FRAUD_UKLYHN || __SEEK_FRAUD_OZ6FMP || __SEEK_FRAUD_E96NSG || __SEEK_FRAUD__9IDPT || __SEEK_FRAUD_OSPVFG || __SEEK_FRAUD_BSX___ || __SEEK_FRAUD_FE742Q || __SEEK_FRAUD_TFENYE || __SEEK_FRAUD_ALAIKE || __SEEK_FRAUD_OHRGMW || __SEEK_FRAUD_KXDZWV || __SEEK_FRAUD_UMXZKW || __SEEK_FRAUD_CCF1EW || __SEEK_FRAUD_VMKU09 || __SEEK_FRAUD_1HLDVM || __SEEK_FRAUD_HXXOMT || __SEEK_FRAUD_PLK7HH || __SEEK_FRAUD_OPAU37 || __SEEK_FRAUD_SBLZOX || __SEEK_FRAUD_NZYXPO || __SEEK_FRAUD_NR_I4S || __SEEK_FRAUD_CN2CTT || __SEEK_FRAUD_QRRCLD || __SEEK_FRAUD_6XGKRW || __SEEK_FRAUD_68YEDU || __SEEK_FRAUD_ZXVMN_ || __SEEK_FRAUD_JNQAA1 || __SEEK_FRAUD_EJM0XB || __SEEK_FRAUD_MWUIJQ || __SEEK_FRAUD_LOG1TG || __SEEK_FRAUD_V51UD0 || __SEEK_FRAUD_E1MR3Z || __SEEK_FRAUD_ORHOZJ || __SEEK_FRAUD_SIYSH8 || __SEEK_FRAUD_FNYQLN || __SEEK_FRAUD_JOFPVK || __SEEK_FRAUD_4O7OHH || __SEEK_FRAUD_OWUEYF || __SEEK_FRAUD_3OPYSM || __SEEK_FRAUD_MLFHRU || __SEEK_FRAUD_OUKYFQ || __SEEK_FRAUD_QHXUIZ || __SEEK_FRAUD_XV0VCM || __SEEK_FRAUD_5INAZF || __SEEK_FRAUD_U5YTAO || __SEEK_FRAUD_P8ZIB5 || __SEEK_FRAUD__39VBB || __SEEK_FRAUD__KYBSV || __SEEK_FRAUD_MCEI6K || __SEEK_FRAUD_VBHSSM || __SEEK_FRAUD_LV_HB6 || __SEEK_FRAUD_BERTMT || __SEEK_FRAUD_SNZJVQ || __SEEK_FRAUD_FDV82D || __SEEK_FRAUD_9OJUVS || __SEEK_FRAUD_XNFRMH || __SEEK_FRAUD_PWBOPK || __SEEK_FRAUD_P8Y20W || __SEEK_FRAUD_NZYMII || __SEEK_FRAUD__OPQTY || __SEEK_FRAUD_THHLIU || __SEEK_FRAUD_YXZMUG || __SEEK_FRAUD_RGENNC || __SEEK_FRAUD_ZLALWU || __SEEK_FRAUD_8RBU5C || __SEEK_FRAUD_BGXWIY || __SEEK_FRAUD_RZTEYR || __SEEK_FRAUD_ZARJER || __SEEK_FRAUD_PURFZB || __SEEK_FRAUD_Q3UEYG || __SEEK_FRAUD_R_Y6KV || __SEEK_FRAUD_QILOIM || __SEEK_FRAUD_R3R2VE || __SEEK_FRAUD_OHDPXP || __SEEK_FRAUD_PDDLNK || __SEEK_FRAUD_ZWACFE || __SEEK_FRAUD_TGDRMF || __SEEK_FRAUD_GMUT_1 || __SEEK_FRAUD_WOZDRE || __SEEK_FRAUD_FD5IJO || __SEEK_FRAUD_PPIYVM || __SEEK_FRAUD_DWEVNF || __SEEK_FRAUD_OBKXT3 || __SEEK_FRAUD_ZG_66A || __SEEK_FRAUD_ZG9WSB || __SEEK_FRAUD_4NIRPA || __SEEK_FRAUD_1Z81CI || __SEEK_FRAUD_EHVE3Y || __SEEK_FRAUD_BPT9ZD || __SEEK_FRAUD_LYS3UM || __SEEK_FRAUD_EQOQFJ || __SEEK_FRAUD_RERCVT || __SEEK_FRAUD_QJAXMZ || __SEEK_FRAUD_JGKWCZ || __SEEK_FRAUD_JYBGOP || __SEEK_FRAUD_43CX5K || __SEEK_FRAUD_RDGS_R || __SEEK_FRAUD__7JU9T || __SEEK_FRAUD_QXDEYO || __SEEK_FRAUD_HW7ENB || __SEEK_FRAUD_SIBZHA || __SEEK_FRAUD__BQIMV || __SEEK_FRAUD_BUW_FJ || __SEEK_FRAUD_6EGJH6 || __SEEK_FRAUD_BBKOZZ || __SEEK_FRAUD_XDLBLQ || __SEEK_FRAUD_RXQMYQ || __SEEK_FRAUD_75NRBF || __SEEK_FRAUD_LFNI27 || __SEEK_FRAUD_U1G4IL || __SEEK_FRAUD_WC2DJX || __SEEK_FRAUD_YRLEBH || __SEEK_FRAUD_D_URQY || __SEEK_FRAUD__Y9XPU || __SEEK_FRAUD_EYYR3G || __SEEK_FRAUD_VW0Z64 || __SEEK_FRAUD_8AR9FD || __SEEK_FRAUD_VSMRB_ || __SEEK_FRAUD_WYVOGD || __SEEK_FRAUD_CVF7N_ || __SEEK_FRAUD_ECCV28 || __SEEK_FRAUD_XEKWPO || __SEEK_FRAUD_1Q42RI || __SEEK_FRAUD_58TQIN || __SEEK_FRAUD_UBE1VZ || __SEEK_FRAUD_VKZHQG || __SEEK_FRAUD_QA7MN5 || __SEEK_FRAUD_XI2Y6Z || __SEEK_FRAUD_KM_YXP || __SEEK_FRAUD_9Q29S6 || __SEEK_FRAUD_P8JJBS || __SEEK_FRAUD_OS7__X || __SEEK_FRAUD__IHT37 || __SEEK_FRAUD_AQGCND || __SEEK_FRAUD_IBW3KJ || __SEEK_FRAUD_NS3JMI || __SEEK_FRAUD_RF_LD1 || __SEEK_FRAUD_LP_GQ9 || __SEEK_FRAUD_ETY7LT || __SEEK_FRAUD_KAXALL || __SEEK_FRAUD_VWUGC4 || __SEEK_FRAUD_OO8I_O || __SEEK_FRAUD_DIPNHU || __SEEK_FRAUD_IUMOXY || __SEEK_FRAUD_TCEBVN || __SEEK_FRAUD_YJCYR4 || __SEEK_FRAUD_K0Z_G7 || __SEEK_FRAUD_AM2BHX || __SEEK_FRAUD_XJUWAF || __SEEK_FRAUD_ALSZID || __SEEK_FRAUD_XXKDNE || __SEEK_FRAUD_GWIW5T || __SEEK_FRAUD_9HWDUP || __SEEK_FRAUD_NLVNRE || __SEEK_FRAUD_MXSTN1 || __SEEK_FRAUD__R9RUV || __SEEK_FRAUD_LPKLJU || __SEEK_FRAUD_ZZZGAR || __SEEK_FRAUD_ZMC3N_ || __SEEK_FRAUD_AJIUNF || __SEEK_FRAUD_RBMZ20 || __SEEK_FRAUD_OCO1GZ || __SEEK_FRAUD_NBYKUF || __SEEK_FRAUD_EBL4QT || __SEEK_FRAUD_FLVC7O || __SEEK_FRAUD_6VUONK || __SEEK_FRAUD_QNKXRT || __SEEK_FRAUD_DNXWDS || __SEEK_FRAUD_ZYDQF_ || __SEEK_FRAUD_WX939W || __SEEK_FRAUD_MVD_UL || __SEEK_FRAUD_8IOTQL || __SEEK_FRAUD_GKQDW6 || __SEEK_FRAUD_MHMBRT || __SEEK_FRAUD_BHWNBP || __SEEK_FRAUD_Y6WUAZ || __SEEK_FRAUD_A8CING || __SEEK_FRAUD_JZFBVG || __SEEK_FRAUD_BORYCZ || __SEEK_FRAUD_VBQ9JO || __SEEK_FRAUD_2PPL8T || __SEEK_FRAUD_WZCO5O || __SEEK_FRAUD_PKVKI1 || __SEEK_FRAUD_U5U5GZ || __SEEK_FRAUD_S5PJZQ || __SEEK_FRAUD_QR3CL9 || __SEEK_FRAUD_IG_EAL || __SEEK_FRAUD_LUSJPG || __SEEK_FRAUD_FIWDJB || __SEEK_FRAUD_DV9GWF || __SEEK_FRAUD_FNGZ_9 || __SEEK_FRAUD_R2403I || __SEEK_FRAUD_F5RHSQ || __SEEK_FRAUD_XGEQEE || __SEEK_FRAUD_DDU0Y_ || __SEEK_FRAUD_JAUOV6 || __SEEK_FRAUD_3NIFMV || __SEEK_FRAUD_YY0T6P || __SEEK_FRAUD_GVTOJY || __SEEK_FRAUD_BLDS9E || __SEEK_FRAUD_A_IQTC || __SEEK_FRAUD_EFYHRC || __SEEK_FRAUD_AMZ2AH || __SEEK_FRAUD_6BI3C9 || __SEEK_FRAUD_HDNX7F || __SEEK_FRAUD_UCSJVN || __SEEK_FRAUD_GFNFIK || __SEEK_FRAUD_FUHSU6 || __SEEK_FRAUD_PIVB38 || __SEEK_FRAUD_CO9T0G || __SEEK_FRAUD_FCF_6I || __SEEK_FRAUD_2BLGLA || __SEEK_FRAUD_2DOBJR || __SEEK_FRAUD__KUHHN || __SEEK_FRAUD_CPHODZ || __SEEK_FRAUD_PTJZLE || __SEEK_FRAUD_TZ3TUV || __SEEK_FRAUD_MOD_74 || __SEEK_FRAUD_AXS4G6 || __SEEK_FRAUD_WGFD9Y || __SEEK_FRAUD_UL0ICM || __SEEK_FRAUD_ZNPZ7V || __SEEK_FRAUD_BPS76O || __SEEK_FRAUD_MUHJKV || __SEEK_FRAUD_CYOVLC || __SEEK_FRAUD_C3BRTD || __SEEK_FRAUD_6KHCDD || __SEEK_FRAUD_65IS8I || __SEEK_FRAUD_ZOHUL3 || __SEEK_FRAUD_NM1G_Z || __SEEK_FRAUD_G4RKKF || __SEEK_FRAUD_Q4PFFF || __SEEK_FRAUD_EZFEDE || __SEEK_FRAUD_NRTQUK || __SEEK_FRAUD_2YLAPH || __SEEK_FRAUD_D04MXN || __SEEK_FRAUD_84RQ6W || __SEEK_FRAUD_BOGJJR || __SEEK_FRAUD_MIDFZQ || __SEEK_FRAUD_WPB12A || __SEEK_FRAUD__ERENB || __SEEK_FRAUD_QDBCS4 || __SEEK_FRAUD_MCWOGJ || __SEEK_FRAUD_IBU0WA || __SEEK_FRAUD_8FUQE6 || __SEEK_FRAUD_5PW27G || __SEEK_FRAUD_XLYR4B || __SEEK_FRAUD_8_YZA0 || __SEEK_FRAUD_F6ZEVO || __SEEK_FRAUD_HWE2G1 || __SEEK_FRAUD_6AN_A8 || __SEEK_FRAUD_JSGI1K || __SEEK_FRAUD_XNGIGX || __SEEK_FRAUD_ZFT05W || __SEEK_FRAUD_JQSWAX || __SEEK_FRAUD_AK5MDQ || __SEEK_FRAUD_HDEE2F) #score JM_SOUGHT_FRAUD_3 3.0 describe JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns ##} JM_SOUGHT_FRAUD_3 ##{ JM_TORA_XM meta JM_TORA_XM (__MAILER_OL_6626 && __MOLE_2962 && __NAKED_TO) ##} JM_TORA_XM ##{ KAM_LOTTO1 meta KAM_LOTTO1 (__KAM_LOTTO1 + __KAM_LOTTO2 + __KAM_LOTTO3 + __KAM_LOTTO4 + __KAM_LOTTO5 + __KAM_LOTTO6 + __KAM_LOTTO7 >= 3) describe KAM_LOTTO1 Likely to be a e-Lotto Scam Email #score KAM_LOTTO1 0.5 ##} KAM_LOTTO1 ##{ KAM_LOTTO2 meta KAM_LOTTO2 (__KAM_LOTTO1 + __KAM_LOTTO2 + __KAM_LOTTO3 + __KAM_LOTTO4 + __KAM_LOTTO5 + __KAM_LOTTO6 + __KAM_LOTTO7 >= 4) describe KAM_LOTTO2 Highly Likely to be a e-Lotto Scam Email #score KAM_LOTTO2 1.0 ##} KAM_LOTTO2 ##{ KAM_STOCKOTC meta KAM_STOCKOTC (0) tflags KAM_STOCKOTC publish ##} KAM_STOCKOTC ##{ KAM_STOCKTIP15 meta KAM_STOCKTIP15 (0) tflags KAM_STOCKTIP15 publish ##} KAM_STOCKTIP15 ##{ KAM_STOCKTIP20 meta KAM_STOCKTIP20 (0) tflags KAM_STOCKTIP20 publish ##} KAM_STOCKTIP20 ##{ KAM_STOCKTIP21 meta KAM_STOCKTIP21 (0) tflags KAM_STOCKTIP21 publish ##} KAM_STOCKTIP21 ##{ KAM_STOCKTIP4 meta KAM_STOCKTIP4 (0) tflags KAM_STOCKTIP4 publish ##} KAM_STOCKTIP4 ##{ KAM_STOCKTIP6 meta KAM_STOCKTIP6 (0) tflags KAM_STOCKTIP6 publish ##} KAM_STOCKTIP6 ##{ KB_DATE_CONTAINS_TAB header KB_DATE_CONTAINS_TAB Date:raw =~ /^\t/ ##} KB_DATE_CONTAINS_TAB ##{ KB_FAKED_THE_BAT meta KB_FAKED_THE_BAT (__THEBAT_MUA && KB_DATE_CONTAINS_TAB) ##} KB_FAKED_THE_BAT ##{ KB_FORGED_MOZ4 header KB_FORGED_MOZ4 User-Agent =~ /\bMozilla 4/ describe KB_FORGED_MOZ4 Mozilla 4 uses X-Mailer ##} KB_FORGED_MOZ4 ##{ KB_RATWARE_BOUNDARY meta KB_RATWARE_BOUNDARY __RATWARE_BOUND_A || __RATWARE_BOUND_B ##} KB_RATWARE_BOUNDARY ##{ KB_RATWARE_MSGID meta KB_RATWARE_MSGID (__KB_MSGID_OUTLOOK_888 && __ANY_OUTLOOK_MUA) ##} KB_RATWARE_MSGID ##{ KB_RATWARE_OUTLOOK_08 header KB_RATWARE_OUTLOOK_08 ALL =~ /^Message-Id: <....([0-9a-f]{8})\$[0-9a-f]{8}\$.{100,400}boundary="----=_NextPart_000_...._\1\./msi # " ##} KB_RATWARE_OUTLOOK_08 ##{ KB_RATWARE_OUTLOOK_12 header KB_RATWARE_OUTLOOK_12 ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{4})[0-9a-f]{4}\$.{100,400}boundary="----=_NextPart_000_...._\1\.\2/msi # " ##} KB_RATWARE_OUTLOOK_12 ##{ KB_RATWARE_OUTLOOK_16 header KB_RATWARE_OUTLOOK_16 ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{8})\$.{100,400}boundary="----=_NextPart_000_...._\1\.\2/msi # " ##} KB_RATWARE_OUTLOOK_16 ##{ KB_RATWARE_OUTLOOK_MID header KB_RATWARE_OUTLOOK_MID ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{8})\$[0-9a-f]{8}\@.{100,400}boundary="----=_NextPart_000_...._\1\.\2"/msi ##} KB_RATWARE_OUTLOOK_MID ##{ LIVEFILESTORE uri LIVEFILESTORE m~livefilestore.com/~ ##} LIVEFILESTORE ##{ LONG_TERM_PRICE body LONG_TERM_PRICE /long\W+term\W+(target|projected)(\W+price)?/i ##} LONG_TERM_PRICE ##{ LOOPHOLE_1 body LOOPHOLE_1 /loop-?hole in the banking/i describe LOOPHOLE_1 A loop hole in the banking laws? ##} LOOPHOLE_1 ##{ LOTS_OF_MONEY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta LOTS_OF_MONEY (__LOTSA_MONEY_00 || __LOTSA_MONEY_01 || __LOTSA_MONEY_02 || __LOTSA_MONEY_03 || __LOTSA_MONEY_04 || __LOTSA_MONEY_05) describe LOTS_OF_MONEY Huge... sums of money # score LOTS_OF_MONEY 0.01 tflags LOTS_OF_MONEY publish endif ##} LOTS_OF_MONEY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ LOTTERY_1 meta LOTTERY_1 (__DBLCLAIM && __CASHPRZ) ##} LOTTERY_1 ##{ LOTTERY_PH_004470 meta LOTTERY_PH_004470 (__AFF_004470_NUMBER && __AFF_LOTTERY) ##} LOTTERY_PH_004470 ##{ LOTTO_AGENT body LOTTO_AGENT /\b(?:claim(?:s|ing)?(?:\sprocessing)?|fiducia\w+|reimbursement|(?:prize|international|intl|foreign|win+ing)(?:[\s,.]+(?:rem+it+ance|settlement|payment|award|transfer))+|payment|immunity|grants?)\s?(?:agent|manager|officer|secretary|director|mgr\b)/i describe LOTTO_AGENT Claims Agent #score LOTTO_AGENT 0.50 ##} LOTTO_AGENT ##{ L_SPAM_TOOL_13 header L_SPAM_TOOL_13 Date =~ /\s[+-]\d(?![2358]45)\d[124-9]\d$/ ##} L_SPAM_TOOL_13 ##{ MANY_PILL_PRICE if can(Mail::SpamAssassin::Conf::feature_bug6558_free) if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta MANY_PILL_PRICE (__PILL_PRICE_01 + __PILL_PRICE_02) > 2 describe MANY_PILL_PRICE Prices for pills endif ##} MANY_PILL_PRICE if can(Mail::SpamAssassin::Conf::feature_bug6558_free) ##{ MANY_SPAN_IN_TEXT meta MANY_SPAN_IN_TEXT __MANY_SPAN_IN_TEXT && !__VIA_ML describe MANY_SPAN_IN_TEXT Many tags embedded within text tflags MANY_SPAN_IN_TEXT publish #score MANY_SPAN_IN_TEXT 2.50 ##} MANY_SPAN_IN_TEXT ##{ MANY_SUBDOM meta MANY_SUBDOM __MANY_SUBDOM && !__JM_REACTOR_DATE && !__UNSUB_LINK && !__VIA_ML && !NO_RELAYS && !__UPPERCASE_URI && !__MIME_QP describe MANY_SUBDOM Lots and lots of subdomain parts in a URI ##} MANY_SUBDOM ##{ MID_DEGREES header MID_DEGREES Message-ID =~ /^<\d{14}\.[A-F0-9]{10}\@[A-Z0-9]+>$/ ##} MID_DEGREES ##{ MIME_BOUND_EQ_REL header MIME_BOUND_EQ_REL Content-Type =~ /boundary="=====================_\d+==\.REL"/s ##} MIME_BOUND_EQ_REL ##{ MIME_PHP_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader meta MIME_PHP_NO_TEXT (T_MIME_NO_TEXT && __XM_PHP) # score MIME_PHP_NO_TEXT 2.00 describe MIME_PHP_NO_TEXT No text body parts, X-Mailer: PHP endif ##} MIME_PHP_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ MONEY_ATM_CARD meta MONEY_ATM_CARD LOTS_OF_MONEY && __ATM_CARD describe MONEY_ATM_CARD Lots of money on an ATM card ##} MONEY_ATM_CARD ##{ MONEY_FRAUD_3 meta MONEY_FRAUD_3 __MONEY_FRAUD_3 && !__COMMENT_EXISTS && !__TAG_EXISTS_CENTER && !__IS_EXCH && !__VIA_ML && !__HAS_THREAD_INDEX && !__UNSUB_LINK && !__DOS_HAS_LIST_UNSUB && !__HTML_LINK_IMAGE describe MONEY_FRAUD_3 Lots of money and several fraud phrases tflags MONEY_FRAUD_3 publish ##} MONEY_FRAUD_3 ##{ MONEY_FRAUD_5 meta MONEY_FRAUD_5 __MONEY_FRAUD_5 && !__VIA_ML && !__HAS_THREAD_INDEX && !__COMMENT_EXISTS && !__UNSUB_LINK && !__TAG_EXISTS_CENTER describe MONEY_FRAUD_5 Lots of money and many fraud phrases tflags MONEY_FRAUD_5 publish ##} MONEY_FRAUD_5 ##{ MONEY_FRAUD_8 meta MONEY_FRAUD_8 __MONEY_FRAUD_8 && !__VIA_ML && !__HAS_THREAD_INDEX describe MONEY_FRAUD_8 Lots of money and very many fraud phrases tflags MONEY_FRAUD_8 publish ##} MONEY_FRAUD_8 ##{ MONEY_FROM_MISSP meta MONEY_FROM_MISSP LOTS_OF_MONEY && __FROM_MISSPACED && !__MIME_QP describe MONEY_FROM_MISSP Lots of money and misspaced From #score MONEY_FROM_MISSP 1.5 ##} MONEY_FROM_MISSP ##{ MONEY_LOTTERY meta MONEY_LOTTERY LOTS_OF_MONEY && (__LOTTO_WINNINGS + __LOTTO_WIN_01 + __YOU_WON + LOTTO_AGENT + T_LOTTO_DEPT + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __LOTTO_ADMITS + __LOTTO_RELATED + DEAR_WINNER + __LOTTO_VERIFY > 1) && !__CAN_HELP && !__HTML_LINK_IMAGE && !__DOS_HAS_LIST_UNSUB describe MONEY_LOTTERY Lots of money from a lottery #score MONEY_LOTTERY 1.5 ##} MONEY_LOTTERY ##{ MSOE_MID_WRONG_CASE meta MSOE_MID_WRONG_CASE (__XM_OUTLOOK_EXPRESS && __MSOE_MID_WRONG_CASE && !__MIMEOLE_1106) ##} MSOE_MID_WRONG_CASE ##{ NSL_RCVD_FROM_USER header NSL_RCVD_FROM_USER Received =~ /from User [\[\(]/ describe NSL_RCVD_FROM_USER Received from User ##} NSL_RCVD_FROM_USER ##{ NULL_IN_BODY full NULL_IN_BODY /\x00/ describe NULL_IN_BODY Message has NUL (ASCII 0) byte in message ##} NULL_IN_BODY ##{ OBFU_ATTACH_MISSP ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader meta OBFU_ATTACH_MISSP __FROM_RUNON && (T_OBFU_HTML_ATTACH || OBFU_TEXT_ATTACH || T_OBFU_DOC_ATTACH || T_OBFU_PDF_ATTACH || T_OBFU_JPG_ATTACH || T_OBFU_GIF_ATTACH) describe OBFU_ATTACH_MISSP Obfuscated attachment type and misspaced From endif ##} OBFU_ATTACH_MISSP ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ OBFU_JVSCR_ESC rawbody OBFU_JVSCR_ESC /document\.write\(unescape\("(?:%[0-9a-f]{2}){10}/i describe OBFU_JVSCR_ESC Injects content using obfuscated javascript #score OBFU_JVSCR_ESC 2.75 tflags OBFU_JVSCR_ESC publish ##} OBFU_JVSCR_ESC ##{ OBFU_TEXT_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader OBFU_TEXT_ATTACH Content-Type =~ m,application/octet-stream;.+\.txt\b,i describe OBFU_TEXT_ATTACH Text attachment with non-text MIME type # score OBFU_TEXT_ATTACH 2.5 tflags OBFU_TEXT_ATTACH publish endif ##} OBFU_TEXT_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ PART_CID_STOCK ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader meta PART_CID_STOCK (__ANY_IMAGE_ATTACH&&__PART_STOCK_CID&&!__PART_STOCK_CL&&!__PART_STOCK_CD_F) describe PART_CID_STOCK Has a spammy image attachment (by Content-ID) endif ##} PART_CID_STOCK ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ PART_CID_STOCK_LESS ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader meta PART_CID_STOCK_LESS (__ANY_IMAGE_ATTACH&&__PART_CID_STOCK_LESS) describe PART_CID_STOCK_LESS Has a spammy image attachment (by Content-ID, more specific) endif ##} PART_CID_STOCK_LESS ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ RCVD_BAD_ID header RCVD_BAD_ID Received =~ /\bid\s+[a-zA-Z0-9_+\/\\,-]+(?:[!"\#\$\%&'()*<=>?\@\[\]^\`{|}~]|;\S)/ ##} RCVD_BAD_ID ##{ RCVD_FORGED_WROTE header RCVD_FORGED_WROTE Received =~ / by \S+ with esmtp \([^a-z ]{6,} [^a-z ]{3,}\) id/ describe RCVD_FORGED_WROTE Forged 'Received' header found ('wrote:' spam) ##} RCVD_FORGED_WROTE ##{ RCVD_FORGED_WROTE2 header RCVD_FORGED_WROTE2 Received =~ /from [0-9.]+ \(HELO \S+[A-Za-z]+\) by (\S+) with esmtp \(\S+\s\S+\) id \S{6}-\S{6}-\S\S for \S+@\1;/s ##} RCVD_FORGED_WROTE2 ##{ RCVD_IN_BRBL_LASTEXT ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_BRBL_LASTEXT eval:check_rbl('brbl-lastexternal','bb.barracudacentral.org') tflags RCVD_IN_BRBL_LASTEXT net endif ##} RCVD_IN_BRBL_LASTEXT ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_CSS header RCVD_IN_CSS eval:check_rbl_sub('zen', '127.0.0.3') describe RCVD_IN_CSS Received via a relay in Spamhaus CSS tflags RCVD_IN_CSS net ##} RCVD_IN_CSS ##{ RCVD_IN_DNSWL_HI ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_DNSWL_HI eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.\d+\.3$') describe RCVD_IN_DNSWL_HI Sender listed at http://www.dnswl.org/, high trust tflags RCVD_IN_DNSWL_HI nice net endif ##} RCVD_IN_DNSWL_HI ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_DNSWL_LOW ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_DNSWL_LOW eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.\d+\.1$') describe RCVD_IN_DNSWL_LOW Sender listed at http://www.dnswl.org/, low trust tflags RCVD_IN_DNSWL_LOW nice net endif ##} RCVD_IN_DNSWL_LOW ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_DNSWL_MED ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_DNSWL_MED eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.\d+\.2$') describe RCVD_IN_DNSWL_MED Sender listed at http://www.dnswl.org/, medium trust tflags RCVD_IN_DNSWL_MED nice net endif ##} RCVD_IN_DNSWL_MED ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_DNSWL_NONE ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_DNSWL_NONE eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.\d+\.0$') describe RCVD_IN_DNSWL_NONE Sender listed at http://www.dnswl.org/, no trust tflags RCVD_IN_DNSWL_NONE nice net endif ##} RCVD_IN_DNSWL_NONE ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_DK ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_DK eval:check_rbl_sub('iadb-firsttrusted', '127.2.255.3') describe RCVD_IN_IADB_DK IADB: Sender publishes Domain Keys record tflags RCVD_IN_IADB_DK net nice endif ##} RCVD_IN_IADB_DK ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_DOPTIN eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.10') describe RCVD_IN_IADB_DOPTIN IADB: All mailing list mail is confirmed opt-in tflags RCVD_IN_IADB_DOPTIN net nice endif ##} RCVD_IN_IADB_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_DOPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_DOPTIN_GT50 eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.9') describe RCVD_IN_IADB_DOPTIN_GT50 IADB: Confirmed opt-in used more than 50% of the time tflags RCVD_IN_IADB_DOPTIN_GT50 net nice endif ##} RCVD_IN_IADB_DOPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_DOPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_DOPTIN_LT50 eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.8') describe RCVD_IN_IADB_DOPTIN_LT50 IADB: Confirmed opt-in used less than 50% of the time tflags RCVD_IN_IADB_DOPTIN_LT50 net nice endif ##} RCVD_IN_IADB_DOPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_EDDB ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_EDDB eval:check_rbl_sub('iadb-firsttrusted', '127.0.2.1') describe RCVD_IN_IADB_EDDB IADB: Participates in Email Deliverability Database tflags RCVD_IN_IADB_EDDB net nice endif ##} RCVD_IN_IADB_EDDB ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_EPIA ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_EPIA eval:check_rbl_sub('iadb-firsttrusted', '127.0.2.2') describe RCVD_IN_IADB_EPIA IADB: Member of Email Processing Industry Alliance tflags RCVD_IN_IADB_EPIA net nice endif ##} RCVD_IN_IADB_EPIA ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_GOODMAIL ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_GOODMAIL eval:check_rbl_sub('iadb-firsttrusted', '127.2.255.103') describe RCVD_IN_IADB_GOODMAIL IADB: Sender has been certified by GoodMail tflags RCVD_IN_IADB_GOODMAIL net nice endif ##} RCVD_IN_IADB_GOODMAIL ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_LISTED ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_LISTED eval:check_rbl_sub('iadb-firsttrusted', '^127\.0\.0\.[12]$') describe RCVD_IN_IADB_LISTED Participates in the IADB system tflags RCVD_IN_IADB_LISTED net nice endif ##} RCVD_IN_IADB_LISTED ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_LOOSE ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_LOOSE eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.4') describe RCVD_IN_IADB_LOOSE IADB: Adds relationship addrs w/out opt-in tflags RCVD_IN_IADB_LOOSE net nice endif ##} RCVD_IN_IADB_LOOSE ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_MI_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_MI_CPEAR eval:check_rbl_sub('iadb-firsttrusted', '127.101.1.10') describe RCVD_IN_IADB_MI_CPEAR IADB: Complies with Michigan's CPEAR law tflags RCVD_IN_IADB_MI_CPEAR net nice endif ##} RCVD_IN_IADB_MI_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_MI_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_MI_CPR_30 eval:check_rbl_sub('iadb-firsttrusted', '127.101.101.10') describe RCVD_IN_IADB_MI_CPR_30 IADB: Checked lists against Michigan's CPR within 30 days tflags RCVD_IN_IADB_MI_CPR_30 net nice endif ##} RCVD_IN_IADB_MI_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_MI_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_MI_CPR_MAT eval:check_rbl_sub('iadb-firsttrusted', '127.101.201.10') describe RCVD_IN_IADB_MI_CPR_MAT IADB: Sends no material under Michigan's CPR tflags RCVD_IN_IADB_MI_CPR_MAT net nice endif ##} RCVD_IN_IADB_MI_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_ML_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_ML_DOPTIN eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.100') describe RCVD_IN_IADB_ML_DOPTIN IADB: Mailing list email only, confirmed opt-in tflags RCVD_IN_IADB_ML_DOPTIN net nice endif ##} RCVD_IN_IADB_ML_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_NOCONTROL ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_NOCONTROL eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.0') describe RCVD_IN_IADB_NOCONTROL IADB: Has absolutely no mailing controls in place tflags RCVD_IN_IADB_NOCONTROL net nice endif ##} RCVD_IN_IADB_NOCONTROL ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_OOO ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_OOO eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.200') describe RCVD_IN_IADB_OOO IADB: One-to-one/transactional email only tflags RCVD_IN_IADB_OOO net nice endif ##} RCVD_IN_IADB_OOO ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_OPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_OPTIN eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.7') describe RCVD_IN_IADB_OPTIN IADB: All mailing list mail is opt-in tflags RCVD_IN_IADB_OPTIN net nice endif ##} RCVD_IN_IADB_OPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_OPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_OPTIN_GT50 eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.6') describe RCVD_IN_IADB_OPTIN_GT50 IADB: Opt-in used more than 50% of the time tflags RCVD_IN_IADB_OPTIN_GT50 net nice endif ##} RCVD_IN_IADB_OPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_OPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_OPTIN_LT50 eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.5') describe RCVD_IN_IADB_OPTIN_LT50 IADB: Opt-in used less than 50% of the time tflags RCVD_IN_IADB_OPTIN_LT50 net nice endif ##} RCVD_IN_IADB_OPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_OPTOUTONLY ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_OPTOUTONLY eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.1') describe RCVD_IN_IADB_OPTOUTONLY IADB: Scrapes addresses, pure opt-out only tflags RCVD_IN_IADB_OPTOUTONLY net nice endif ##} RCVD_IN_IADB_OPTOUTONLY ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_RDNS ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_RDNS eval:check_rbl_sub('iadb-firsttrusted', '127.2.255.4') describe RCVD_IN_IADB_RDNS IADB: Sender has reverse DNS record tflags RCVD_IN_IADB_RDNS net nice endif ##} RCVD_IN_IADB_RDNS ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_SENDERID ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_SENDERID eval:check_rbl_sub('iadb-firsttrusted', '127.2.255.2') describe RCVD_IN_IADB_SENDERID IADB: Sender publishes Sender ID record tflags RCVD_IN_IADB_SENDERID net nice endif ##} RCVD_IN_IADB_SENDERID ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_SPF ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_SPF eval:check_rbl_sub('iadb-firsttrusted', '127.2.255.1') describe RCVD_IN_IADB_SPF IADB: Sender publishes SPF record tflags RCVD_IN_IADB_SPF net nice endif ##} RCVD_IN_IADB_SPF ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_UNVERIFIED_1 ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_UNVERIFIED_1 eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.2') describe RCVD_IN_IADB_UNVERIFIED_1 IADB: Accepts unverified sign-ups tflags RCVD_IN_IADB_UNVERIFIED_1 net nice endif ##} RCVD_IN_IADB_UNVERIFIED_1 ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_UNVERIFIED_2 ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_UNVERIFIED_2 eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.3') describe RCVD_IN_IADB_UNVERIFIED_2 IADB: Accepts unverified sign-ups, gives chance to opt out tflags RCVD_IN_IADB_UNVERIFIED_2 net nice endif ##} RCVD_IN_IADB_UNVERIFIED_2 ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_UT_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_UT_CPEAR eval:check_rbl_sub('iadb-firsttrusted', '127.101.2.10') describe RCVD_IN_IADB_UT_CPEAR IADB: Complies with Utah's CPEAR law tflags RCVD_IN_IADB_UT_CPEAR net nice endif ##} RCVD_IN_IADB_UT_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_UT_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_UT_CPR_30 eval:check_rbl_sub('iadb-firsttrusted', '127.101.102.10') describe RCVD_IN_IADB_UT_CPR_30 IADB: Checked lists against Utah's CPR within 30 days tflags RCVD_IN_IADB_UT_CPR_30 net nice endif ##} RCVD_IN_IADB_UT_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_UT_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_UT_CPR_MAT eval:check_rbl_sub('iadb-firsttrusted', '127.101.202.10') describe RCVD_IN_IADB_UT_CPR_MAT IADB: Sends no material under Utah's CPR tflags RCVD_IN_IADB_UT_CPR_MAT net nice endif ##} RCVD_IN_IADB_UT_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_PSBL header RCVD_IN_PSBL eval:check_rbl('psbl-lastexternal', 'psbl.surriel.com.') describe RCVD_IN_PSBL Received via a relay in PSBL tflags RCVD_IN_PSBL net ##} RCVD_IN_PSBL ##{ RCVD_IN_RP_CERTIFIED header RCVD_IN_RP_CERTIFIED eval:check_rbl_txt('ssc-firsttrusted', 'sa-trusted.bondedsender.org.') describe RCVD_IN_RP_CERTIFIED Sender is in Return Path Certified (trusted relay) tflags RCVD_IN_RP_CERTIFIED net nice ##} RCVD_IN_RP_CERTIFIED ##{ RCVD_IN_RP_RNBL header RCVD_IN_RP_RNBL eval:check_rbl('rnbl-lastexternal','bl.score.senderscore.com.') describe RCVD_IN_RP_RNBL Relay in RNBL, https://senderscore.org/blacklistlookup/ tflags RCVD_IN_RP_RNBL net ##} RCVD_IN_RP_RNBL ##{ RCVD_IN_RP_SAFE header RCVD_IN_RP_SAFE eval:check_rbl_txt('ssc-firsttrusted','sa-accredit.habeas.com.') describe RCVD_IN_RP_SAFE Sender is in Return Path Safe (trusted relay) tflags RCVD_IN_RP_SAFE net nice ##} RCVD_IN_RP_SAFE ##{ RCVD_MAIL_COM header RCVD_MAIL_COM Received =~ /[\s\(\[](?:post|mail)\.com[\s\)\]]/is describe RCVD_MAIL_COM Forged Received header (contains post.com or mail.com) ##} RCVD_MAIL_COM ##{ RDNS_LOCALHOST header RDNS_LOCALHOST X-Spam-Relays-External =~ /^\[ ip=(?!127)\d+\.\d+\.\d+\.\d+ rdns=localhost(?:\.localdomain)? /i describe RDNS_LOCALHOST Sender's public rDNS is "localhost" ##} RDNS_LOCALHOST ##{ REPLYTO_WITHOUT_TO_CC meta REPLYTO_WITHOUT_TO_CC (__REPLYTO_EXISTS && !__TOCC_EXISTS) ##} REPLYTO_WITHOUT_TO_CC ##{ RISK_FREE meta RISK_FREE __FRAUD_IOV && !__UNSUB_LINK && !__VIA_ML && !__HTML_LINK_IMAGE && !__SUBSCRIPTION_INFO && !__HS_SUBJ_RE_FW describe RISK_FREE No risk! ##} RISK_FREE ##{ RP_8BIT header RP_8BIT Return-Path:raw =~ /[^\000-\177]/ describe RP_8BIT Return-Path contains 8-bit characters with high bit on ##} RP_8BIT ##{ S25R_4 describe S25R_4 T_S25R: Bottom of rDNS ends w/ num, next lvl has num-num meta S25R_4 __S25R_4 && !(__S25R_1||__S25R_2||__S25R_3||__S25R_5||__S25R_6 || __NOT_SPOOFED || __GREYLISTING) ##} S25R_4 ##{ SB_GIF_AND_NO_URIS meta SB_GIF_AND_NO_URIS (__GIF_ATTACH&&!__HAS_ANY_URI&&!__HAS_ANY_EMAIL) ##} SB_GIF_AND_NO_URIS ##{ SHORT_HELO_AND_INLINE_IMAGE meta SHORT_HELO_AND_INLINE_IMAGE (__HELO_NO_DOMAIN && __ANY_IMAGE_ATTACH) describe SHORT_HELO_AND_INLINE_IMAGE Short HELO string, with inline image ##} SHORT_HELO_AND_INLINE_IMAGE ##{ SHORT_TERM_PRICE body SHORT_TERM_PRICE /short\W+term\W+(target|projected)(\W+price)?/i ##} SHORT_TERM_PRICE ##{ SINGLE_HEADER_2K header SINGLE_HEADER_2K ALL:raw =~ /(?-xim:(?=(?:^|\n)[^\s\n]+:(?:.(?!\n\S)){2048,3071}.(?:\n\S|$)))/s describe SINGLE_HEADER_2K A single header contains 2K-3K characters ##} SINGLE_HEADER_2K ##{ SINGLE_HEADER_3K header SINGLE_HEADER_3K ALL:raw =~ /(?-xim:(?=(?:^|\n)[^\s\n]+:(?:.(?!\n\S)){3072,4095}.(?:\n\S|$)))/s describe SINGLE_HEADER_3K A single header contains 3K-4K characters ##} SINGLE_HEADER_3K ##{ SINGLE_HEADER_4K header SINGLE_HEADER_4K ALL:raw =~ /(?-xim:(?=(?:^|\n)[^\s\n]+:(?:.(?!\n\S)){4096,5119}.(?:\n\S|$)))/s describe SINGLE_HEADER_4K A single header contains 4K-5K characters ##} SINGLE_HEADER_4K ##{ SPAMMY_XMAILER meta SPAMMY_XMAILER (__XM_OL_28001441||__XM_OL_48072300||__XM_OL_28004682||__XM_OL_10_0_4115||__XM_OL_4_72_2106_4) describe SPAMMY_XMAILER X-Mailer string is common in spam and not in ham ##} SPAMMY_XMAILER ##{ STOCK_IMG_CTYPE meta STOCK_IMG_CTYPE (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__CTYPE_ONETAB_GIF&&__HTML_IMG_ONLY) describe STOCK_IMG_CTYPE Stock spam image part, with distinctive Content-Type header ##} STOCK_IMG_CTYPE ##{ STOCK_IMG_HDR_FROM meta STOCK_IMG_HDR_FROM (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__TVD_FW_GRAPHIC_ID1&&__HTML_IMG_ONLY) describe STOCK_IMG_HDR_FROM Stock spam image part, with distinctive From line ##} STOCK_IMG_HDR_FROM ##{ STOCK_IMG_HTML meta STOCK_IMG_HTML (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__PART_STOCK_CID&&__HTML_IMG_ONLY) describe STOCK_IMG_HTML Stock spam image part, with distinctive HTML ##} STOCK_IMG_HTML ##{ STOCK_IMG_OUTLOOK meta STOCK_IMG_OUTLOOK (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__XM_MS_IN_GENERAL&&__HTML_LENGTH_1536_2048) describe STOCK_IMG_OUTLOOK Stock spam image part, with Outlook-like features ##} STOCK_IMG_OUTLOOK ##{ STOCK_PRICES meta STOCK_PRICES (SHORT_TERM_PRICE && LONG_TERM_PRICE) ##} STOCK_PRICES ##{ STOX_AND_PRICE meta STOX_AND_PRICE CURR_PRICE && STOX_REPLY_TYPE ##} STOX_AND_PRICE ##{ STOX_REPLY_TYPE header STOX_REPLY_TYPE Content-Type =~ /text\/plain; .* reply-type=original/ ##} STOX_REPLY_TYPE ##{ STOX_REPLY_TYPE_WITHOUT_QUOTES meta STOX_REPLY_TYPE_WITHOUT_QUOTES (STOX_REPLY_TYPE && !(__HS_SUBJ_RE_FW || __HS_QUOTE)) ##} STOX_REPLY_TYPE_WITHOUT_QUOTES ##{ STYLE_GIBBERISH meta STYLE_GIBBERISH __STYLE_GIBBERISH && !__THREADED && !__MIME_QP && !__RCD_RDNS_MAIL_MESSY && !MPART_ALT_DIFF ##} STYLE_GIBBERISH ##{ SUBJECT_NEEDS_ENCODING meta SUBJECT_NEEDS_ENCODING (!__SUBJECT_ENCODED_B64 && !__SUBJECT_ENCODED_QP) && __SUBJECT_NEEDS_MIME ##} SUBJECT_NEEDS_ENCODING ##{ TAB_IN_FROM header TAB_IN_FROM From:raw =~ /^\t/s describe TAB_IN_FROM From starts with a tab ##} TAB_IN_FROM ##{ TBIRD_SUSP_MIME_BDRY meta TBIRD_SUSP_MIME_BDRY __MUA_TBIRD && __TB_MIME_BDRY_NO_Z describe TBIRD_SUSP_MIME_BDRY Unlikely Thunderbird MIME boundary ##} TBIRD_SUSP_MIME_BDRY ##{ THEBAT_UNREG header THEBAT_UNREG X-Mailer =~ /^The Bat! .{0,20} UNREG$/ ##} THEBAT_UNREG ##{ TINY_FLOAT rawbody TINY_FLOAT /\bstyle\s*=\s*"[^"]{0,40}?(?:(?:FONT-SIZE\s*:\s+\dpx|FLOAT\s*:\s+(?:right|left))(?:;\s+)?(?:(?!(?:FONT-SIZE|FLOAT))\w+:\s+\w+;?\s*)*){2}/i describe TINY_FLOAT Has small-font floating HTML - text obfuscation? #score TINY_FLOAT 2.00 ##} TINY_FLOAT ##{ TO_EQ_FM_DIRECT_MX meta TO_EQ_FM_DIRECT_MX __TO_EQ_FM_DIRECT_MX && !__THREAD_INDEX_GOOD && !__IS_EXCH describe TO_EQ_FM_DIRECT_MX To == From and direct-to-MX ##} TO_EQ_FM_DIRECT_MX ##{ TO_EQ_FM_DOM_HTML_IMG meta TO_EQ_FM_DOM_HTML_IMG __TO_EQ_FM_DOM_HTML_IMG && !__CTYPE_MULTIPART_ALT && !ALL_TRUSTED && !__MIME_QP && !__IS_EXCH && !__BUGGED_IMG && !__UNSUB_LINK && !__COMMENT_EXISTS && !__FM_TO_ALL_NUMS describe TO_EQ_FM_DOM_HTML_IMG To domain == From domain and HTML image link ##} TO_EQ_FM_DOM_HTML_IMG ##{ TO_EQ_FM_DOM_HTML_ONLY meta TO_EQ_FM_DOM_HTML_ONLY __TO_EQ_FM_DOM_HTML_ONLY && !__CTYPE_MULTIPART_ALT && !HTML_MIME_NO_HTML_TAG && !ALL_TRUSTED && !__MIME_QP && !__IS_EXCH && !__MSGID_BEFORE_RECEIVED && !__RCD_RDNS_MAIL_MESSY && !__FM_TO_ALL_NUMS describe TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only ##} TO_EQ_FM_DOM_HTML_ONLY ##{ TO_EQ_FM_DOM_SPF_FAIL meta TO_EQ_FM_DOM_SPF_FAIL __TO_EQ_FM_DOM_SPF_FAIL && !__THREADED && !ALL_TRUSTED describe TO_EQ_FM_DOM_SPF_FAIL To domain == From domain and external SPF failed tflags TO_EQ_FM_DOM_SPF_FAIL net ##} TO_EQ_FM_DOM_SPF_FAIL ##{ TO_EQ_FM_HTML_DIRECT meta TO_EQ_FM_HTML_DIRECT __TO_EQ_FM_HTML_DIRECT && !__HUSH_HUSH describe TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX ##} TO_EQ_FM_HTML_DIRECT ##{ TO_EQ_FM_HTML_ONLY meta TO_EQ_FM_HTML_ONLY __TO_EQ_FM_HTML_ONLY && !ALL_TRUSTED && !__RCD_RDNS_MAIL_MESSY && !__DOS_LINK && !__NOT_SPOOFED && !__DKIM_EXISTS describe TO_EQ_FM_HTML_ONLY To == From and HTML only ##} TO_EQ_FM_HTML_ONLY ##{ TO_EQ_FM_SPF_FAIL meta TO_EQ_FM_SPF_FAIL __TO_EQ_FM_SPF_FAIL && !__THREADED && !ALL_TRUSTED describe TO_EQ_FM_SPF_FAIL To == From and external SPF failed tflags TO_EQ_FM_SPF_FAIL net ##} TO_EQ_FM_SPF_FAIL ##{ TO_IN_SUBJ meta TO_IN_SUBJ __SUBJ_HAS_TO_1 && !__VIA_ML && !MISSING_MIMEOLE && !__THREAD_INDEX_GOOD describe TO_IN_SUBJ To address is in Subject ##} TO_IN_SUBJ ##{ TO_NO_BRKTS_DYNIP meta TO_NO_BRKTS_DYNIP __TO_NO_BRKTS_DYNIP && !__NAME_IS_EMAIL && !__MSGID_OK_HEX && !__UNSUB_LINK && !__THREADED && !__RCD_RDNS_MX_MESSY && !__COMMENT_EXISTS && !__MUA_TBIRD && !__CD && !__ML1 && !__RP_MATCHES_RCVD describe TO_NO_BRKTS_DYNIP To: misformatted and dynamic rDNS ##} TO_NO_BRKTS_DYNIP ##{ TO_NO_BRKTS_FROM_MSSP meta TO_NO_BRKTS_FROM_MSSP __TO_NO_BRKTS_FROM_MSSP && !__RCD_RDNS_MTA_MESSY && !__CTYPE_MULTIPART_ALT && !__REPTO_QUOTE && !__MIME_QP && !__TO___LOWER && !__BUGGED_IMG && !__SUBJECT_ENCODED_QP && !__VIA_ML && !__FR_SPACING_8 && !__TAG_EXISTS_CENTER #score TO_NO_BRKTS_FROM_MSSP 1.00 describe TO_NO_BRKTS_FROM_MSSP Multiple formatting errors ##} TO_NO_BRKTS_FROM_MSSP ##{ TO_NO_BRKTS_HTML_ONLY meta TO_NO_BRKTS_HTML_ONLY __TO_NO_BRKTS_HTML_ONLY && !__MIME_QP && !__MSGID_JAVAMAIL && !__CTYPE_CHARSET_QUOTED && !__SUBJECT_ENCODED_B64 && !__VIA_ML && !__MSGID_BEFORE_RECEIVED && !__MIME_BASE64 && !__RCD_RDNS_MAIL_MESSY && !__COMMENT_EXISTS && !LOTS_OF_MONEY && !__TAG_EXISTS_CENTER && !__UPPERCASE_URI && !__UNSUB_LINK && !__RCD_RDNS_MX_MESSY && !__DKIM_EXISTS && !__BUGGED_IMG && !__FM_TO_ALL_NUMS && !__URI_12LTRDOM && !__RDNS_NO_SUBDOM && !__HDRS_LCASE #score TO_NO_BRKTS_HTML_ONLY 0.20 describe TO_NO_BRKTS_HTML_ONLY To: misformatted and HTML only ##} TO_NO_BRKTS_HTML_ONLY ##{ TO_NO_BRKTS_MSFT meta TO_NO_BRKTS_MSFT __TO_NO_BRKTS_MSFT && !__VIA_ML && !__LYRIS_EZLM_REMAILER && !__THREAD_INDEX_GOOD && !__IS_EXCH && !__UNSUB_LINK && !__NOT_SPOOFED && !__DOS_HAS_LIST_UNSUB && !__NAME_EQ_EMAIL describe TO_NO_BRKTS_MSFT To: misformatted and supposed Microsoft tool #score TO_NO_BRKTS_MSFT 0.20 ##} TO_NO_BRKTS_MSFT ##{ TO_NO_BRKTS_NORDNS meta TO_NO_BRKTS_NORDNS __TO_NO_BRKTS_NORDNS && !__MANY_RECIPS && !__FROM_RUNON && !__VIA_ML && !__TO___LOWER && !ALL_TRUSTED && !__COMMENT_EXISTS && !__DOS_HAS_LIST_UNSUB && !__OE_MSGID_1 #score TO_NO_BRKTS_NORDNS 0.20 describe TO_NO_BRKTS_NORDNS To: misformatted and no rDNS ##} TO_NO_BRKTS_NORDNS ##{ TO_NO_BRKTS_NORDNS_HTML meta TO_NO_BRKTS_NORDNS_HTML __TO_NO_BRKTS_NORDNS_HTML && !ALL_TRUSTED && !__MSGID_JAVAMAIL && !__MSGID_BEFORE_RECEIVED && !__VIA_ML && !__UA_MUTT && !__FROM_FREEMAIL && !__COMMENT_EXISTS && !__HTML_LENGTH_384 && !__MIME_BASE64 && !__UPPERCASE_URI && !__TO___LOWER && !__BUGGED_IMG && !__TAG_EXISTS_CENTER #score TO_NO_BRKTS_NORDNS_HTML 0.20 describe TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only ##} TO_NO_BRKTS_NORDNS_HTML ##{ TT_MSGID_TRUNC header TT_MSGID_TRUNC Message-Id =~ /^\s*\s]+\[\d+$/ describe TT_MSGID_TRUNC Scora: Message-Id ends after left-bracket + digits ##} TT_MSGID_TRUNC ##{ TT_OBSCURED_VALIUM meta TT_OBSCURED_VALIUM ( __TT_BROKEN_VALIUM || __TT_OBSCURED_VALIUM ) && ! __TT_VALIUM describe TT_OBSCURED_VALIUM Scora: obscured "VALIUM" in subject ##} TT_OBSCURED_VALIUM ##{ TT_OBSCURED_VIAGRA meta TT_OBSCURED_VIAGRA ( __TT_BROKEN_VIAGRA || __TT_OBSCURED_VIAGRA ) && ! __TT_VIAGRA describe TT_OBSCURED_VIAGRA Scora: obscured "VIAGRA" in subject ##} TT_OBSCURED_VIAGRA ##{ TVD_ACT_193 body TVD_ACT_193 /\bact of (?:193|nineteen thirty)/i ##} TVD_ACT_193 ##{ TVD_APPROVED body TVD_APPROVED /you.{1,2}re .{0,20}approved/i ##} TVD_APPROVED ##{ TVD_DEAR_HOMEOWNER body TVD_DEAR_HOMEOWNER /^dear homeowner/i ##} TVD_DEAR_HOMEOWNER ##{ TVD_DOLLARS_US body TVD_DOLLARS_US /\s\d[\d.,]+US/ ##} TVD_DOLLARS_US ##{ TVD_EB_PHISH meta TVD_EB_PHISH __FROM_EBAY && NORMAL_HTTP_TO_IP ##} TVD_EB_PHISH ##{ TVD_ENVFROM_APOST header TVD_ENVFROM_APOST EnvelopeFrom =~ /\'/ ##} TVD_ENVFROM_APOST ##{ TVD_FINGER_02 header TVD_FINGER_02 Content-Type =~ /^text\/plain(?:; (?:format=flowed|charset="Windows-1252"|reply-type=original)){3}/i ##} TVD_FINGER_02 ##{ TVD_FLOAT_GENERAL rawbody TVD_FLOAT_GENERAL /\bstyle\s*=\s*"[^"]*\bfloat\s*:\s*[a-z]+\s*">\s*[a-zA-Z]+\s*\b(?!degree)\b/i endif ##} TVD_FUZZY_DEGREE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ TVD_FUZZY_FINANCE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body TVD_FUZZY_FINANCE /(?!finance)/i endif ##} TVD_FUZZY_FINANCE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ TVD_FUZZY_FIXED_RATE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body TVD_FUZZY_FIXED_RATE /(?!fixed rate)\s+/i endif ##} TVD_FUZZY_FIXED_RATE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ TVD_FUZZY_MICROCAP ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body TVD_FUZZY_MICROCAP /(?!microcap)(?!micro-cap)-?

/i endif ##} TVD_FUZZY_MICROCAP ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ TVD_FUZZY_PHARMACEUTICAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body TVD_FUZZY_PHARMACEUTICAL /(?!pharmaceutical)

/i endif ##} TVD_FUZZY_PHARMACEUTICAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ TVD_FUZZY_SYMBOL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body TVD_FUZZY_SYMBOL /(?!symbol)/i endif ##} TVD_FUZZY_SYMBOL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ TVD_FW_GRAPHIC_NAME_LONG ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader TVD_FW_GRAPHIC_NAME_LONG Content-Type =~ /\bname="[a-z]{8,}\.gif/ endif ##} TVD_FW_GRAPHIC_NAME_LONG ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ TVD_FW_GRAPHIC_NAME_MID ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader TVD_FW_GRAPHIC_NAME_MID Content-Type =~ /\bname="[a-z]{6,7}\.gif/ endif ##} TVD_FW_GRAPHIC_NAME_MID ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ TVD_INCREASE_SIZE body TVD_INCREASE_SIZE /\bsize of .{1,20}(?:penis|dick|manhood)/i ##} TVD_INCREASE_SIZE ##{ TVD_LINK_SAVE body TVD_LINK_SAVE /\blink to save\b/i ##} TVD_LINK_SAVE ##{ TVD_PH_BODY_ACCOUNTS_PRE body TVD_PH_BODY_ACCOUNTS_PRE /\baccounts? (?:[a-z_,-]+ )+?(?:record[a-z]*|suspen[a-z]+|notif(?:y|ication)|updated|verifications?|credited)\b/i ##} TVD_PH_BODY_ACCOUNTS_PRE ##{ TVD_PH_BODY_META meta TVD_PH_BODY_META __TVD_PH_BODY_01 || __TVD_PH_BODY_02 || __TVD_PH_BODY_03 || __TVD_PH_BODY_04 || __TVD_PH_BODY_05 || __TVD_PH_BODY_06 || __TVD_PH_BODY_07 || __TVD_PH_BODY_08 ##} TVD_PH_BODY_META ##{ TVD_PH_REC body TVD_PH_REC /\byour .{0,40}account .{0,40}record/i describe TVD_PH_REC Message has a phrase standard for phishing mails ##} TVD_PH_REC ##{ TVD_PH_SEC body TVD_PH_SEC /\byour .{0,40}account .{0,40}security/i describe TVD_PH_SEC Message has a phrase standard for phishing mails ##} TVD_PH_SEC ##{ TVD_PH_SUBJ_ACCOUNTS_POST header TVD_PH_SUBJ_ACCOUNTS_POST Subject =~ /\b(?:(?:re-?)?activat[a-z]*|secure|verify|restore|flagged|limited|unusual|update|report|notif(?:y|ication)|suspen(?:d|ded|sion)|co(?:n|m)firm[a-z]*) (?:[a-z_,-]+ )*?accounts?\b/i ##} TVD_PH_SUBJ_ACCOUNTS_POST ##{ TVD_PH_SUBJ_SEC_MEASURES header TVD_PH_SUBJ_SEC_MEASURES Subject =~ /\bsecurity (?:[a-z_,-]+ )*?measures?\b/i ##} TVD_PH_SUBJ_SEC_MEASURES ##{ TVD_PH_SUBJ_URGENT header TVD_PH_SUBJ_URGENT Subject =~ /^urgent(?:[\s\W]*$|.{1,40}(?:alert|response|assistance|proposal|reply|warning|noti(?:ce|fication)|greeting|matter))/i ##} TVD_PH_SUBJ_URGENT ##{ TVD_PP_PHISH meta TVD_PP_PHISH __FROM_PAYPAL && NORMAL_HTTP_TO_IP ##} TVD_PP_PHISH ##{ TVD_QUAL_MEDS body TVD_QUAL_MEDS /\bquality med(?:ication)?s\b/i ##} TVD_QUAL_MEDS ##{ TVD_RATWARE_CB header TVD_RATWARE_CB Content-Type =~ /\bboundary\b.{1,40}qzsoft_directmail_seperator/i ##} TVD_RATWARE_CB ##{ TVD_RATWARE_CB_2 header TVD_RATWARE_CB_2 Content-Type =~ /\bboundary\s*=\s*"?-+\d+=+\.MRA/ ##} TVD_RATWARE_CB_2 ##{ TVD_RATWARE_MSGID_02 header TVD_RATWARE_MSGID_02 Message-ID =~ /^[^<]*<[a-z]+\@/ ##} TVD_RATWARE_MSGID_02 ##{ TVD_RCVD_IP header TVD_RCVD_IP Received =~ /^from\s+(?:\d+[^0-9a-zA-Z\s]){3}\d+[.\s]/ ##} TVD_RCVD_IP ##{ TVD_RCVD_IP4 header TVD_RCVD_IP4 Received =~ /^from\s+(?:\d+\.){3}\d+\s/ ##} TVD_RCVD_IP4 ##{ TVD_RCVD_SINGLE header TVD_RCVD_SINGLE Received =~ /^from\s+(?!localhost)[^\s.a-z0-9-]+\s/ ##} TVD_RCVD_SINGLE ##{ TVD_RCVD_SPACE_BRACKET header TVD_RCVD_SPACE_BRACKET Received =~ /\(\[(?!UNIX:)[^\[\]]*\s/ ##} TVD_RCVD_SPACE_BRACKET ##{ TVD_SECTION body TVD_SECTION /\bSection (?:27A|21B)/i ##} TVD_SECTION ##{ TVD_SILLY_URI_OBFU body TVD_SILLY_URI_OBFU m!https?://[a-z0-9-]+\.[a-z0-9-]*\.?[^a-z0-9.:/\s"'\@?\)>-]+[a-z0-9.-]*[a-z]{3}(?:\s|$)!i ##} TVD_SILLY_URI_OBFU ##{ TVD_SPACED_SUBJECT_WORD3 header TVD_SPACED_SUBJECT_WORD3 Subject =~ /^(?:(?:Re|Fw)[^:]{0,5}: )?[A-Z]+[a-z]+[A-Z]+$/ ##} TVD_SPACED_SUBJECT_WORD3 ##{ TVD_STOCK1 ifplugin Mail::SpamAssassin::Plugin::BodyEval ifplugin Mail::SpamAssassin::Plugin::BodyEval body TVD_STOCK1 eval:check_stock_info('2') endif ##} TVD_STOCK1 ifplugin Mail::SpamAssassin::Plugin::BodyEval ##{ TVD_SUBJ_ACC_NUM header TVD_SUBJ_ACC_NUM Subject =~ /\b[a-zA-Z]+ [\#\s]{1,4}\d+[A-Z]+/ describe TVD_SUBJ_ACC_NUM Subject has spammy looking monetary reference ##} TVD_SUBJ_ACC_NUM ##{ TVD_SUBJ_FINGER_03 header TVD_SUBJ_FINGER_03 Subject =~ /^\s*\*\s+(?:\w+\W+)+\*\s*$/ ##} TVD_SUBJ_FINGER_03 ##{ TVD_SUBJ_OWE header TVD_SUBJ_OWE Subject =~ /^\s*(?:\w+\s+)+you\s+(?:\w+\s+)*(?:owe|indebted)\s+(?:\w+\s+)+an\s*other/i ##} TVD_SUBJ_OWE ##{ TVD_SUBJ_WIPE_DEBT header TVD_SUBJ_WIPE_DEBT Subject =~ /(?:wipe out|remove|get (?:rid|out) of|eradicate) .{0,20}(?:owe|debt|obligation)/i ##} TVD_SUBJ_WIPE_DEBT ##{ TVD_VISIT_PHARMA body TVD_VISIT_PHARMA /Online Ph.rmacy/i ##} TVD_VISIT_PHARMA ##{ TVD_VIS_HIDDEN rawbody TVD_VIS_HIDDEN /]+style\s*=\s*"visibility:\s*hidden\b/i ##} TVD_VIS_HIDDEN ##{ T_AXB_MIME_IMG830 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader T_AXB_MIME_IMG830 Content-ID =~ /^<[0-9a-f]{30}\@/ describe T_AXB_MIME_IMG830 Valpolicella Fingerprint endif ##} T_AXB_MIME_IMG830 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ T_DKIM_INVALID ifplugin Mail::SpamAssassin::Plugin::DKIM ifplugin Mail::SpamAssassin::Plugin::DKIM meta T_DKIM_INVALID __DKIM_EXISTS && !DKIM_VALID describe T_DKIM_INVALID DKIM-Signature header exists but is not valid endif ##} T_DKIM_INVALID ifplugin Mail::SpamAssassin::Plugin::DKIM ##{ T_DOS_OUTLOOK_TO_MX_IMAGE meta T_DOS_OUTLOOK_TO_MX_IMAGE __ANY_OUTLOOK_MUA && !__OE_MUA && __DOS_DIRECT_TO_MX && __ANY_IMAGE_ATTACH describe T_DOS_OUTLOOK_TO_MX_IMAGE Direct to MX with Outlook headers and an image ##} T_DOS_OUTLOOK_TO_MX_IMAGE ##{ T_DOS_ZIP_HARDCORE ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader T_DOS_ZIP_HARDCORE Content-Type =~ /^application\/zip;\sname="hardcore\.zip"$/ describe T_DOS_ZIP_HARDCORE hardcore.zip file attached; quite certainly a virus # score T_DOS_ZIP_HARDCORE 2.5 endif ##} T_DOS_ZIP_HARDCORE ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ T_DSCL4_PNG ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # { ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # { mimeheader T_DSCL4_PNG Content-Type =~ /name\=\"DS[CL]\d{4,5}\.(?:png|PNG)\"/ describe T_DSCL4_PNG Digital camera filename is PNG # score T_DSCL4_PNG 0.9 # 1.6->0.9 20091019 no recent hits endif ##} T_DSCL4_PNG ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # { ##{ T_EMRCP body T_EMRCP /\bExcess Maximum Return Capital Profit\b/i describe T_EMRCP "Excess Maximum Return Capital Profit" Fidelity scam ##} T_EMRCP ##{ T_FILL_THIS_FORM_SHORT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta T_FILL_THIS_FORM_SHORT __FILL_THIS_FORM_SHORT && !__VIA_ML && !__MSGID_JAVAMAIL describe T_FILL_THIS_FORM_SHORT Fill in a short form with personal information # score T_FILL_THIS_FORM_SHORT 0.25 endif ##} T_FILL_THIS_FORM_SHORT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FORGED_TBIRD_IMG_SIZE ifplugin Mail::SpamAssassin::Plugin::ImageInfo ifplugin Mail::SpamAssassin::Plugin::ImageInfo meta T_FORGED_TBIRD_IMG_SIZE __FORGED_TBIRD_IMG && __ONE_IMG && __IMG_LE_300K describe T_FORGED_TBIRD_IMG_SIZE Likely forged Thunderbird image spam # score T_FORGED_TBIRD_IMG_SIZE 0.8 endif ##} T_FORGED_TBIRD_IMG_SIZE ifplugin Mail::SpamAssassin::Plugin::ImageInfo ##{ T_FREEMAIL_DOC_PDF ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::FreeMail meta T_FREEMAIL_DOC_PDF (__DOC_ATTACH || __PDF_ATTACH) && (FREEMAIL_FROM || FREEMAIL_REPLYTO) describe T_FREEMAIL_DOC_PDF MS document or PDF attachment, from freemail endif ##} T_FREEMAIL_DOC_PDF ifplugin Mail::SpamAssassin::Plugin::FreeMail ##{ T_FREEMAIL_RVW_ATTCH ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::FreeMail meta T_FREEMAIL_RVW_ATTCH (__PLS_REVIEW || __DLND_ATTACH) && T_FREEMAIL_DOC_PDF describe T_FREEMAIL_RVW_ATTCH Please review attached document, from freemail endif ##} T_FREEMAIL_RVW_ATTCH ifplugin Mail::SpamAssassin::Plugin::FreeMail ##{ T_FRM_SILVER_GOLD ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta T_FRM_SILVER_GOLD (__FRT_SILVER && __FRT_GOLD) describe T_FRM_SILVER_GOLD ReplaceTags: Silver & Gold endif ##} T_FRM_SILVER_GOLD ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_ABSOLUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_ABSOLUT /\b(?!absolutely)/i describe T_FRT_ABSOLUT ReplaceTags: Absolutely endif ##} T_FRT_ABSOLUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_ADULT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_ADULT2 /\b(?!adult)/i describe T_FRT_ADULT2 ReplaceTags: Adult endif ##} T_FRT_ADULT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_BEFORE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_BEFORE /\b(?!before)\b/i describe T_FRT_BEFORE ReplaceTags: Before endif ##} T_FRT_BEFORE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_BELOW2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_BELOW2 /\b(?!below)\b/i describe T_FRT_BELOW2 ReplaceTags: Below (2) endif ##} T_FRT_BELOW2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_CANSPAM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_CANSPAM /\b(?!CANSPAM)

/i describe T_FRT_CANSPAM ReplaceTags: Can Spam endif ##} T_FRT_CANSPAM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_CLICK ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_CLICK /\b(?!click)\b/i describe T_FRT_CLICK ReplaceTags: Click endif ##} T_FRT_CLICK ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_COCK ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_COCK /\b(?![cs]ock)/i describe T_FRT_COCK ReplaceTags: Cock endif ##} T_FRT_COCK ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_CONTACT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_CONTACT /\b(?!contr?act)/i describe T_FRT_CONTACT ReplaceTags: Contact endif ##} T_FRT_CONTACT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_ERECTION ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_ERECTION /(?!erection)/i describe T_FRT_ERECTION ReplaceTags: Erection endif ##} T_FRT_ERECTION ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_ESTABLISH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_ESTABLISH /\b(?!estabi?lish)/i describe T_FRT_ESTABLISH ReplaceTags: Establish endif ##} T_FRT_ESTABLISH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_EXPERIENCE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_EXPERIENCE /\b(?!exp[e\xe9\xc9]rience)

\b/i describe T_FRT_EXPERIENCE ReplaceTags: Experience endif ##} T_FRT_EXPERIENCE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_FOLLOW1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_FOLLOW1 /\b(?!follow)/i describe T_FRT_FOLLOW1 ReplaceTags: Follow endif ##} T_FRT_FOLLOW1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_FOLLOW2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_FOLLOW2 /\b(?!follow)/i describe T_FRT_FOLLOW2 ReplaceTags: Follow (2) endif ##} T_FRT_FOLLOW2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_FREE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_FREE /\b(?!free)\b/i describe T_FRT_FREE ReplaceTags: Free endif ##} T_FRT_FREE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_FRIEND ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_FRIEND /\b(?!friend)/i describe T_FRT_FRIEND ReplaceTags: Friend endif ##} T_FRT_FRIEND ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_FUCK1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_FUCK1 /\b(?!fuck)/i describe T_FRT_FUCK1 ReplaceTags: Fuck (1) endif ##} T_FRT_FUCK1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_HEALTH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_HEALTH /\b(?!health)\b/i describe T_FRT_HEALTH ReplaceTags: Health endif ##} T_FRT_HEALTH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_HOUR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_HOUR /\b(?!hour)\b/i describe T_FRT_HOUR ReplaceTags: Hour endif ##} T_FRT_HOUR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_INCOME ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_INCOME /\b(?!income)\b/i describe T_FRT_INCOME ReplaceTags: Income endif ##} T_FRT_INCOME ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_INTEREST ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_INTEREST /\b(?!interest)\b/i describe T_FRT_INTEREST ReplaceTags: Interest endif ##} T_FRT_INTEREST ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_LITTLE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_LITTLE /\b(?!little)/i describe T_FRT_LITTLE ReplaceTags: Little endif ##} T_FRT_LITTLE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_LOLITA1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_LOLITA1 /\b(?!lolita)/i describe T_FRT_LOLITA1 ReplaceTags: Lolita (1) endif ##} T_FRT_LOLITA1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_OPPORTUN1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_OPPORTUN1 /(?!opportun)

/i describe T_FRT_OPPORTUN1 ReplaceTags: Oppertun (1) endif ##} T_FRT_OPPORTUN1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_PACKAGE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_PACKAGE /\b(?!package)

/i describe T_FRT_PACKAGE ReplaceTags: Package endif ##} T_FRT_PACKAGE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_PAYMENT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_PAYMENT /\b(?!payment)

/i describe T_FRT_PAYMENT ReplaceTags: Payment endif ##} T_FRT_PAYMENT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_PHARMAC ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_PHARMAC /(?!pharma[c\@])

/i describe T_FRT_PHARMAC ReplaceTags: Pharmac endif ##} T_FRT_PHARMAC ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_POSSIBLE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_POSSIBLE /\b(?!possible)

\b/i describe T_FRT_POSSIBLE ReplaceTags: Possible endif ##} T_FRT_POSSIBLE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_PROFILE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_PROFILE1 /\b(?!profile)

/i describe T_FRT_PROFILE1 ReplaceTags: Profile (1) endif ##} T_FRT_PROFILE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_PROFILE2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_PROFILE2 /\b(?!profile)

/i describe T_FRT_PROFILE2 ReplaceTags: Profile (2) endif ##} T_FRT_PROFILE2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_PROFIT1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_PROFIT1 /\b(?!profit)

/i describe T_FRT_PROFIT1 ReplaceTags: Profit (1) endif ##} T_FRT_PROFIT1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_PROFIT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_PROFIT2 /\b(?!profit)

/i describe T_FRT_PROFIT2 ReplaceTags: Profit (2) endif ##} T_FRT_PROFIT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_PUSSY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_PUSSY /\b(?!pussy)

/i describe T_FRT_PUSSY ReplaceTags: Pussy endif ##} T_FRT_PUSSY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_SLUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_SLUT /\b(?!slut)/ describe T_FRT_SLUT ReplaceTags: Slut endif ##} T_FRT_SLUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_STOCK1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_STOCK1 /\b(?!stock)/i describe T_FRT_STOCK1 ReplaceTags: Stock (1) endif ##} T_FRT_STOCK1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_STOCK2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_STOCK2 /\b(?!stor?ck)/i describe T_FRT_STOCK2 ReplaceTags: Stock (2) endif ##} T_FRT_STOCK2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FRT_VIRGIN1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FRT_VIRGIN1 /(?!virgin)?\b/i describe T_FRT_VIRGIN1 ReplaceTags: Virgin (1) endif ##} T_FRT_VIRGIN1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FSL_FAKE_HOTMAIL_RCVD #score T_FSL_FAKE_HOTMAIL_RCVD 0.001 ##} T_FSL_FAKE_HOTMAIL_RCVD ##{ T_FUZZY_OPTOUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FUZZY_OPTOUT /\b(?!opt.?out)

.?\b/i describe T_FUZZY_OPTOUT Obfuscated opt-out text endif ##} T_FUZZY_OPTOUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_FUZZY_SPRM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_FUZZY_SPRM /

/i endif ##} T_FUZZY_SPRM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_HK_FAKENAME_MICROSOFT ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM meta T_HK_FAKENAME_MICROSOFT __HK_NAME_MICROSOFT && !__HK_HELO_MICROSOFT && !SPF_PASS && !DKIM_VALID_AU describe T_HK_FAKENAME_MICROSOFT From name mentions Microsoft, but not relayed from there endif endif ##} T_HK_FAKENAME_MICROSOFT ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM ##{ T_HK_FAKENAME_PAYPAL ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM meta T_HK_FAKENAME_PAYPAL __HK_NAME_PAYPAL && !__HK_HELO_PAYPAL && !SPF_PASS && !DKIM_VALID_AU describe T_HK_FAKENAME_PAYPAL From name mentions PayPal, but not relayed from there endif endif ##} T_HK_FAKENAME_PAYPAL ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM ##{ T_HK_FAKENAME_YAHOO ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM meta T_HK_FAKENAME_YAHOO __HK_NAME_YAHOO && !__HK_HELO_YAHOO && !SPF_PASS && !DKIM_VALID_AU describe T_HK_FAKENAME_YAHOO From name mentions Yahoo, but not relayed from there endif endif ##} T_HK_FAKENAME_YAHOO ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM ##{ T_HK_NAME_DR ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::FreeMail meta T_HK_NAME_DR __HK_NAME_DR && !FREEMAIL_FROM endif ##} T_HK_NAME_DR ifplugin Mail::SpamAssassin::Plugin::FreeMail ##{ T_HK_NAME_FM_DR ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::FreeMail meta T_HK_NAME_FM_DR __HK_NAME_DR && FREEMAIL_FROM endif ##} T_HK_NAME_FM_DR ifplugin Mail::SpamAssassin::Plugin::FreeMail ##{ T_HK_NAME_FM_FROM ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::FreeMail meta T_HK_NAME_FM_FROM __HK_NAME_FROM && FREEMAIL_FROM endif ##} T_HK_NAME_FM_FROM ifplugin Mail::SpamAssassin::Plugin::FreeMail ##{ T_HK_NAME_FM_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::FreeMail meta T_HK_NAME_FM_MR_MRS __HK_NAME_MR_MRS && FREEMAIL_FROM endif ##} T_HK_NAME_FM_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail ##{ T_HK_NAME_FROM ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::FreeMail meta T_HK_NAME_FROM __HK_NAME_FROM && !FREEMAIL_FROM endif ##} T_HK_NAME_FROM ifplugin Mail::SpamAssassin::Plugin::FreeMail ##{ T_HK_NAME_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::FreeMail meta T_HK_NAME_MR_MRS __HK_NAME_MR_MRS && !FREEMAIL_FROM endif ##} T_HK_NAME_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail ##{ T_HK_SPAMMY_FILENAME ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader meta T_HK_SPAMMY_FILENAME __HK_SPAMMY_CTFN || __HK_SPAMMY_CDFN endif ##} T_HK_SPAMMY_FILENAME ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ T_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader T_HTML_ATTACH Content-Type =~ m,text/html;.+\.html?\b,i describe T_HTML_ATTACH HTML attachment to bypass scanning? endif ##} T_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ T_IMAGE_MISMATCH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # { ifplugin Mail::SpamAssassin::Plugin::ImageInfo ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # { ifplugin Mail::SpamAssassin::Plugin::ImageInfo meta T_IMAGE_MISMATCH (__GIF_ATTACH && !__GIF_EXISTS) || (__PNG_ATTACH && !__PNG_EXISTS) || (__JPEG_ATTACH && !__JPEG_EXISTS) describe T_IMAGE_MISMATCH Contains wrong image format for MIME header endif endif ##} T_IMAGE_MISMATCH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # { ifplugin Mail::SpamAssassin::Plugin::ImageInfo ##{ T_KHOP_FOREIGN_CLICK if ! plugin (Mail::SpamAssassin::Plugin::URIDetail) if ! plugin (Mail::SpamAssassin::Plugin::URIDetail) rawbody T_KHOP_FOREIGN_CLICK m{\bhref=[^>]{9,199}>[^<]{0,80}(?:<(?!/a\b)[^>]{0,299}>[^<]{0,80}){0,9}[^<]{0,80}\b(?:cli(?:quez\W|ck\Wa)ici\b|cli(?:cca\W|c\Wa|que\Wa)qu[^<.,a ]|klie?k(?:\Whi?er|ni(?:j|nite)\Wtu[tk]aj)\b)}si endif ##} T_KHOP_FOREIGN_CLICK if ! plugin (Mail::SpamAssassin::Plugin::URIDetail) ##{ T_LFUZ_PWRMALE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_LFUZ_PWRMALE /

/i endif ##} T_LFUZ_PWRMALE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_LOTTO_AGENT_FM header T_LOTTO_AGENT_FM From =~ /(?:claim(?:s|ing)?(?:[\s_.]processing)?|fiducia\w+|dispatch|reimbursement|prize[\s_.]transfer|(?:international|foreign|win+ing)[\s_.]rem+it+ance)[\s_.]?(?:agent|manager|officer|secretary|director|department|dept)/i describe T_LOTTO_AGENT_FM Claims Agent #score T_LOTTO_AGENT_FM 0.50 ##} T_LOTTO_AGENT_FM ##{ T_LOTTO_AGENT_RPLY header T_LOTTO_AGENT_RPLY Reply-To =~ /(?:claim(?:s|ing)?(?:[\s_.]processing)?|fiducia\w+|dispatch|reimbursement|prize\stransfer|(?:international|foreign|win+ing)[\s_.]rem+it+ance)[\s_.]?(?:agent|manager|officer|secretary|director|department|dept)/i describe T_LOTTO_AGENT_RPLY Claims Agent #score T_LOTTO_AGENT_RPLY 0.50 ##} T_LOTTO_AGENT_RPLY ##{ T_LOTTO_DEPT body T_LOTTO_DEPT /\b(?:claim(?:s|ing)?(?:\sprocessing)?|fiducia\w+|reimbursement|(?:international|foreign|win+ing)(?:\s(?:rem+it+ance|settlement|payment|award))+|payment|award|compensation|lot+ery)(?:\s\w+)?\s?(?:department|dept|unit|group|committee|bureau)/i describe T_LOTTO_DEPT Claims Department #score T_LOTTO_DEPT 0.50 ##} T_LOTTO_DEPT ##{ T_LOTTO_URI uri T_LOTTO_URI /(?:claim(?:s|ing)?(?:[-_]?processing)?|fiducia\w+|reimbursement|(?:international|foreign|win+ing)?[-_]?rem+it+ance|award)[-_]?(?:department|dept|unit|group|committee|office|agent|manager|secretary)/i describe T_LOTTO_URI Claims Department #score T_LOTTO_URI 0.50 ##} T_LOTTO_URI ##{ T_MANY_BIG_LISTS if can(Mail::SpamAssassin::Conf::feature_bug6558_free) if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta T_MANY_BIG_LISTS __MANY_BIG_LISTS && !HTML_MESSAGE && !__CTYPE_MULTIPART_ANY && !__HS_SUBJ_RE_FW && !__HAS_THREAD_INDEX describe T_MANY_BIG_LISTS Lots of mailing lists / databases available! endif ##} T_MANY_BIG_LISTS if can(Mail::SpamAssassin::Conf::feature_bug6558_free) ##{ T_MIME_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader meta T_MIME_NO_TEXT (__CTYPE_MULTIPART_ANY && !__ANY_TEXT_ATTACH) # score T_MIME_NO_TEXT 1.00 describe T_MIME_NO_TEXT No text body parts endif ##} T_MIME_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ T_MONEY_PERCENT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta T_MONEY_PERCENT LOTS_OF_MONEY && (__PCT_FOR_YOU || __PCT_OF_PMTS || __FIFTY_FIFTY) describe T_MONEY_PERCENT X% of a lot of money for you endif ##} T_MONEY_PERCENT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_OBFU_DOC_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader T_OBFU_DOC_ATTACH Content-Type =~ m,application/octet-stream;.+\.(?:doc|rtf)\b,i describe T_OBFU_DOC_ATTACH MS Document attachment with generic MIME type # score T_OBFU_DOC_ATTACH 0.25 endif ##} T_OBFU_DOC_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ T_OBFU_GIF_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader T_OBFU_GIF_ATTACH Content-Type =~ m,application/octet-stream;.+\.gif\b,i describe T_OBFU_GIF_ATTACH GIF attachment with generic MIME type # score T_OBFU_GIF_ATTACH 1.50 endif ##} T_OBFU_GIF_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ T_OBFU_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader T_OBFU_HTML_ATTACH Content-Type =~ m,application/octet-stream;.+\.html?\b,i describe T_OBFU_HTML_ATTACH HTML attachment with non-text MIME type endif ##} T_OBFU_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ T_OBFU_JPG_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader T_OBFU_JPG_ATTACH Content-Type =~ m,application/octet-stream;.+\.jpe?g\b,i describe T_OBFU_JPG_ATTACH JPG attachment with generic MIME type # score T_OBFU_JPG_ATTACH 1.50 endif ##} T_OBFU_JPG_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ T_OBFU_PDF_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader T_OBFU_PDF_ATTACH Content-Type =~ m,application/octet-stream;.+\.pdf\b,i describe T_OBFU_PDF_ATTACH PDF attachment with generic MIME type # score T_OBFU_PDF_ATTACH 0.25 endif ##} T_OBFU_PDF_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ T_RCVD_IN_SEMBLACK ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header T_RCVD_IN_SEMBLACK eval:check_rbl('semblack-lastexternal', 'bl.spameatingmonkey.net') tflags T_RCVD_IN_SEMBLACK net describe T_RCVD_IN_SEMBLACK Received from an IP listed in bl.spameatingmonkey.net #score T_RCVD_IN_SEMBLACK 0.1 endif ##} T_RCVD_IN_SEMBLACK ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ T_REMOTE_IMAGE ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # { ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # { meta T_REMOTE_IMAGE (__HTML_IMG_ONLY || __HTML_LINK_IMAGE) && !(__SUBSCRIPTION_INFO || __VIA_ML || __SENDER_BOT || __ANY_IMAGE_ATTACH) describe T_REMOTE_IMAGE Message contains an external image endif ##} T_REMOTE_IMAGE ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # { ##{ T_RP_MATCHES_RCVD if version >= 3.003000 ifplugin Mail::SpamAssassin::Plugin::WLBLEval if version >= 3.003000 ifplugin Mail::SpamAssassin::Plugin::WLBLEval header T_RP_MATCHES_RCVD eval:check_mailfrom_matches_rcvd() describe T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain tflags T_RP_MATCHES_RCVD nice endif endif ##} T_RP_MATCHES_RCVD if version >= 3.003000 ifplugin Mail::SpamAssassin::Plugin::WLBLEval ##{ T_SHARE_50_50 meta T_SHARE_50_50 (__SHARE_IT || __AGREED_RATIO) && __FIFTY_FIFTY describe T_SHARE_50_50 Share the money 50/50 ##} T_SHARE_50_50 ##{ T_SURBL_MULTI1 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ifplugin Mail::SpamAssassin::Plugin::URIDNSBL meta T_SURBL_MULTI1 ((URIBL_JP_SURBL + URIBL_SC_SURBL + URIBL_AB_SURBL + URIBL_OB_SURBL + URIBL_WS_SURBL) > 1) endif ##} T_SURBL_MULTI1 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ##{ T_SURBL_MULTI2 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ifplugin Mail::SpamAssassin::Plugin::URIDNSBL meta T_SURBL_MULTI2 ((URIBL_JP_SURBL + URIBL_SC_SURBL + URIBL_AB_SURBL + URIBL_OB_SURBL + URIBL_WS_SURBL) > 2) endif ##} T_SURBL_MULTI2 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ##{ T_SURBL_MULTI3 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ifplugin Mail::SpamAssassin::Plugin::URIDNSBL meta T_SURBL_MULTI3 ((URIBL_JP_SURBL + URIBL_SC_SURBL + URIBL_AB_SURBL + URIBL_OB_SURBL + URIBL_WS_SURBL) > 3) endif ##} T_SURBL_MULTI3 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ##{ T_SURBL_MULTI4 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ifplugin Mail::SpamAssassin::Plugin::URIDNSBL meta T_SURBL_MULTI4 ((URIBL_JP_SURBL + URIBL_SC_SURBL + URIBL_AB_SURBL + URIBL_OB_SURBL + URIBL_WS_SURBL) > 4) endif ##} T_SURBL_MULTI4 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ##{ T_TO_NO_BRKTS_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::FreeMail meta T_TO_NO_BRKTS_FREEMAIL __TO_NO_ARROWS_R && (FREEMAIL_FROM || FREEMAIL_REPLYTO) # score T_TO_NO_BRKTS_FREEMAIL 0.20 endif ##} T_TO_NO_BRKTS_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail ##{ T_TVD_FUZZY_SECTOR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_TVD_FUZZY_SECTOR /(?!sector)/i endif ##} T_TVD_FUZZY_SECTOR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_TVD_FUZZY_SECURITIES ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body T_TVD_FUZZY_SECURITIES /(?!securities)/i endif ##} T_TVD_FUZZY_SECURITIES ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ T_TVD_FW_GRAPHIC_ID2 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader T_TVD_FW_GRAPHIC_ID2 Content-Id =~ /<(?:[0-9A-F]{8}\.){3}[0-9A-F]{8}/ endif ##} T_TVD_FW_GRAPHIC_ID2 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ T_TVD_MIME_EPI ifplugin Mail::SpamAssassin::Plugin::MIMEEval ifplugin Mail::SpamAssassin::Plugin::MIMEEval body T_TVD_MIME_EPI eval:check_msg_parse_flags('mime_epilogue_exists') endif ##} T_TVD_MIME_EPI ifplugin Mail::SpamAssassin::Plugin::MIMEEval ##{ T_TVD_MIME_NO_HEADERS ifplugin Mail::SpamAssassin::Plugin::MIMEEval ifplugin Mail::SpamAssassin::Plugin::MIMEEval body T_TVD_MIME_NO_HEADERS eval:check_msg_parse_flags('missing_mime_headers') endif ##} T_TVD_MIME_NO_HEADERS ifplugin Mail::SpamAssassin::Plugin::MIMEEval ##{ T_URIBL_BLACK_OVERLAP ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ifplugin Mail::SpamAssassin::Plugin::URIDNSBL meta T_URIBL_BLACK_OVERLAP (URIBL_BLACK && (URIBL_AB_SURBL || URIBL_JP_SURBL || URIBL_OB_SURBL || URIBL_WS_SURBL || URIBL_SC_SURBL)) endif ##} T_URIBL_BLACK_OVERLAP ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ##{ T_URIBL_SEM ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ifplugin Mail::SpamAssassin::Plugin::URIDNSBL urirhssub T_URIBL_SEM uribl.spameatingmonkey.net. A 2 body T_URIBL_SEM eval:check_uridnsbl('T_URIBL_SEM') describe T_URIBL_SEM Contains a URI listed in uribl.spameatingmonkey.net tflags T_URIBL_SEM net #score T_URIBL_SEM 0.1 endif ##} T_URIBL_SEM ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ##{ T_URIBL_SEM_FRESH ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ifplugin Mail::SpamAssassin::Plugin::URIDNSBL urirhssub T_URIBL_SEM_FRESH fresh.spameatingmonkey.net. A 2 body T_URIBL_SEM_FRESH eval:check_uridnsbl('T_URIBL_SEM_FRESH') describe T_URIBL_SEM_FRESH Contains a domain registered less than 5 days ago tflags T_URIBL_SEM_FRESH net #score T_URIBL_SEM_FRESH 0.1 endif ##} T_URIBL_SEM_FRESH ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ##{ T_URIBL_SEM_FRESH_10 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ifplugin Mail::SpamAssassin::Plugin::URIDNSBL urirhssub T_URIBL_SEM_FRESH_10 fresh10.spameatingmonkey.net. A 2 body T_URIBL_SEM_FRESH_10 eval:check_uridnsbl('T_URIBL_SEM_FRESH_10') describe T_URIBL_SEM_FRESH_10 Contains a domain registered less than 10 days ago tflags T_URIBL_SEM_FRESH_10 net #score T_URIBL_SEM_FRESH_10 0.1 endif ##} T_URIBL_SEM_FRESH_10 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ##{ T_URIBL_SEM_FRESH_15 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ifplugin Mail::SpamAssassin::Plugin::URIDNSBL urirhssub T_URIBL_SEM_FRESH_15 fresh15.spameatingmonkey.net. A 2 body T_URIBL_SEM_FRESH_15 eval:check_uridnsbl('T_URIBL_SEM_FRESH_15') describe T_URIBL_SEM_FRESH_15 Contains a domain registered less than 15 days ago tflags T_URIBL_SEM_FRESH_15 net #score T_URIBL_SEM_FRESH_15 0.1 endif ##} T_URIBL_SEM_FRESH_15 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ##{ T_URIBL_SEM_RED ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ifplugin Mail::SpamAssassin::Plugin::URIDNSBL urirhssub T_URIBL_SEM_RED urired.spameatingmonkey.net. A 2 body T_URIBL_SEM_RED eval:check_uridnsbl('T_URIBL_SEM_RED') describe T_URIBL_SEM_RED Contains a URI listed in urired.spameatingmonkey.net tflags T_URIBL_SEM_RED net #score T_URIBL_SEM_RED 0.1 endif ##} T_URIBL_SEM_RED ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ##{ URIBL_RHS_DOB ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ifplugin Mail::SpamAssassin::Plugin::URIDNSBL urirhssub URIBL_RHS_DOB dob.sibl.support-intelligence.net A 2 body URIBL_RHS_DOB eval:check_uridnsbl('URIBL_RHS_DOB') describe URIBL_RHS_DOB Contains an URI of a new domain (Day Old Bread) tflags URIBL_RHS_DOB net endif ##} URIBL_RHS_DOB ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ##{ URI_OBFU_DOM meta URI_OBFU_DOM __URI_OBFU_DOM && !__VIA_ML describe URI_OBFU_DOM URI pretending to be different domain ##} URI_OBFU_DOM ##{ URI_OBFU_TLD meta URI_OBFU_TLD __URI_OBFU_TLD && !__MSGID_OK_HOST describe URI_OBFU_TLD URI top-level domain with space obfuscation ##} URI_OBFU_TLD ##{ URI_OBFU_WWW ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body URI_OBFU_WWW /(?+[^[:alnum:]]{1,3})?[[:alnum:]][-\w]{1,20}[[:alnum:]][^[:alnum:]]{1,3}(?:+[^[:alnum:]]{1,3})?(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g|b\s?i\s?z|i\s?n\s?f\s?o)_*\b/i describe URI_OBFU_WWW Obfuscated URI endif ##} URI_OBFU_WWW ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ VANITY meta VANITY (__V_KNOWN_VANITY && (__V_NO_COST + __V_INFORM_YOU + __V_INNERCIRCLE + __V_SHMUCK + __V_EXECS_PROS + __V_PUB_DEADLINE + __V_REGISTRY + __V_NOMINATION + __V_BIOGRAPHY + __V_ACCOLADES + __V_RECOGNITION + __V_DISTINGUISHED + __V_EXCELLENCE + __V_ACHIEVEMENT > 3)) || (__V_BESTOFAWARD && (__V_SBCAVANITY || __V_USCAVANITY)) describe VANITY Vanity or fake awards #score VANITY 2.3 ##} VANITY ##{ XMAILER_MIMEOLE_OL_015D5 meta XMAILER_MIMEOLE_OL_015D5 (__XM_OL_015D5 && __MO_OL_015D5) ##} XMAILER_MIMEOLE_OL_015D5 ##{ XMAILER_MIMEOLE_OL_07794 meta XMAILER_MIMEOLE_OL_07794 (__XM_OL_07794 && __MO_OL_07794) ##} XMAILER_MIMEOLE_OL_07794 ##{ XMAILER_MIMEOLE_OL_09BB4 meta XMAILER_MIMEOLE_OL_09BB4 (__XM_OL_09BB4 && __MO_OL_09BB4) ##} XMAILER_MIMEOLE_OL_09BB4 ##{ XMAILER_MIMEOLE_OL_1ECD5 meta XMAILER_MIMEOLE_OL_1ECD5 (__XM_OL_1ECD5 && __MO_OL_1ECD5) ##} XMAILER_MIMEOLE_OL_1ECD5 ##{ XMAILER_MIMEOLE_OL_20C99 meta XMAILER_MIMEOLE_OL_20C99 (__XM_OL_20C99 && __MO_OL_20C99) ##} XMAILER_MIMEOLE_OL_20C99 ##{ XMAILER_MIMEOLE_OL_22B61 meta XMAILER_MIMEOLE_OL_22B61 (__XM_OL_22B61 && __MO_OL_22B61) ##} XMAILER_MIMEOLE_OL_22B61 ##{ XMAILER_MIMEOLE_OL_25340 meta XMAILER_MIMEOLE_OL_25340 (__XM_OL_25340 && __MO_OL_25340) ##} XMAILER_MIMEOLE_OL_25340 ##{ XMAILER_MIMEOLE_OL_32D97 meta XMAILER_MIMEOLE_OL_32D97 (__XM_OL_32D97 && __MO_OL_32D97) ##} XMAILER_MIMEOLE_OL_32D97 ##{ XMAILER_MIMEOLE_OL_3857F meta XMAILER_MIMEOLE_OL_3857F (__XM_OL_3857F && __MO_OL_3857F) ##} XMAILER_MIMEOLE_OL_3857F ##{ XMAILER_MIMEOLE_OL_3AC1D meta XMAILER_MIMEOLE_OL_3AC1D (__XM_OL_3AC1D && __MO_OL_3AC1D) ##} XMAILER_MIMEOLE_OL_3AC1D ##{ XMAILER_MIMEOLE_OL_3D61D meta XMAILER_MIMEOLE_OL_3D61D (__XM_OL_3D61D && __MO_OL_3D61D) ##} XMAILER_MIMEOLE_OL_3D61D ##{ XMAILER_MIMEOLE_OL_465CD meta XMAILER_MIMEOLE_OL_465CD (__XM_OL_465CD && __MO_OL_465CD) ##} XMAILER_MIMEOLE_OL_465CD ##{ XMAILER_MIMEOLE_OL_4B815 meta XMAILER_MIMEOLE_OL_4B815 (__XM_OL_4B815 && __MO_OL_4B815) ##} XMAILER_MIMEOLE_OL_4B815 ##{ XMAILER_MIMEOLE_OL_4BF4C meta XMAILER_MIMEOLE_OL_4BF4C (__XM_OL_4BF4C && __MO_OL_4BF4C) ##} XMAILER_MIMEOLE_OL_4BF4C ##{ XMAILER_MIMEOLE_OL_4EEDB meta XMAILER_MIMEOLE_OL_4EEDB (__XM_OL_4EEDB && __MO_OL_4EEDB) ##} XMAILER_MIMEOLE_OL_4EEDB ##{ XMAILER_MIMEOLE_OL_4F240 meta XMAILER_MIMEOLE_OL_4F240 (__XM_OL_4F240 && __MO_OL_4F240) ##} XMAILER_MIMEOLE_OL_4F240 ##{ XMAILER_MIMEOLE_OL_58CB5 meta XMAILER_MIMEOLE_OL_58CB5 (__XM_OL_58CB5 && __MO_OL_58CB5) ##} XMAILER_MIMEOLE_OL_58CB5 ##{ XMAILER_MIMEOLE_OL_5B79A meta XMAILER_MIMEOLE_OL_5B79A (__XM_OL_5B79A && __MO_OL_5B79A) ##} XMAILER_MIMEOLE_OL_5B79A ##{ XMAILER_MIMEOLE_OL_6554A meta XMAILER_MIMEOLE_OL_6554A (__XM_OL_6554A && __MO_OL_6554A) ##} XMAILER_MIMEOLE_OL_6554A ##{ XMAILER_MIMEOLE_OL_72641 meta XMAILER_MIMEOLE_OL_72641 (__XM_OL_72641 && __MO_OL_72641) ##} XMAILER_MIMEOLE_OL_72641 ##{ XMAILER_MIMEOLE_OL_7533E meta XMAILER_MIMEOLE_OL_7533E (__XM_OL_7533E && __MO_OL_7533E) ##} XMAILER_MIMEOLE_OL_7533E ##{ XMAILER_MIMEOLE_OL_812FF meta XMAILER_MIMEOLE_OL_812FF (__XM_OL_812FF && __MO_OL_812FF) ##} XMAILER_MIMEOLE_OL_812FF ##{ XMAILER_MIMEOLE_OL_83BF7 meta XMAILER_MIMEOLE_OL_83BF7 (__XM_OL_83BF7 && __MO_OL_83BF7) ##} XMAILER_MIMEOLE_OL_83BF7 ##{ XMAILER_MIMEOLE_OL_8627E meta XMAILER_MIMEOLE_OL_8627E (__XM_OL_8627E && __MO_OL_8627E) ##} XMAILER_MIMEOLE_OL_8627E ##{ XMAILER_MIMEOLE_OL_8E893 meta XMAILER_MIMEOLE_OL_8E893 (__XM_OL_8E893 && __MO_OL_8E893) ##} XMAILER_MIMEOLE_OL_8E893 ##{ XMAILER_MIMEOLE_OL_91287 meta XMAILER_MIMEOLE_OL_91287 (__XM_OL_91287 && __MO_OL_91287) ##} XMAILER_MIMEOLE_OL_91287 ##{ XMAILER_MIMEOLE_OL_9B90B meta XMAILER_MIMEOLE_OL_9B90B (__XM_OL_9B90B && __MO_OL_9B90B) ##} XMAILER_MIMEOLE_OL_9B90B ##{ XMAILER_MIMEOLE_OL_A50F8 meta XMAILER_MIMEOLE_OL_A50F8 (__XM_OL_A50F8 && __MO_OL_A50F8) ##} XMAILER_MIMEOLE_OL_A50F8 ##{ XMAILER_MIMEOLE_OL_A842E meta XMAILER_MIMEOLE_OL_A842E (__XM_OL_A842E && __MO_OL_A842E) ##} XMAILER_MIMEOLE_OL_A842E ##{ XMAILER_MIMEOLE_OL_ADFF7 meta XMAILER_MIMEOLE_OL_ADFF7 (__XM_OL_ADFF7 && __MO_OL_ADFF7) ##} XMAILER_MIMEOLE_OL_ADFF7 ##{ XMAILER_MIMEOLE_OL_B30D1 meta XMAILER_MIMEOLE_OL_B30D1 (__XM_OL_B30D1 && __MO_OL_B30D1) ##} XMAILER_MIMEOLE_OL_B30D1 ##{ XMAILER_MIMEOLE_OL_B4B40 meta XMAILER_MIMEOLE_OL_B4B40 (__XM_OL_B4B40 && __MO_OL_B4B40) ##} XMAILER_MIMEOLE_OL_B4B40 ##{ XMAILER_MIMEOLE_OL_B9B11 meta XMAILER_MIMEOLE_OL_B9B11 (__XM_OL_B9B11 && __MO_OL_B9B11) ##} XMAILER_MIMEOLE_OL_B9B11 ##{ XMAILER_MIMEOLE_OL_BC7E6 meta XMAILER_MIMEOLE_OL_BC7E6 (__XM_OL_BC7E6 && __MO_OL_BC7E6) ##} XMAILER_MIMEOLE_OL_BC7E6 ##{ XMAILER_MIMEOLE_OL_C65FA meta XMAILER_MIMEOLE_OL_C65FA (__XM_OL_C65FA && __MO_OL_C65FA) ##} XMAILER_MIMEOLE_OL_C65FA ##{ XMAILER_MIMEOLE_OL_CAC8F meta XMAILER_MIMEOLE_OL_CAC8F (__XM_OL_CAC8F && __MO_OL_CAC8F) ##} XMAILER_MIMEOLE_OL_CAC8F ##{ XMAILER_MIMEOLE_OL_CF0C0 meta XMAILER_MIMEOLE_OL_CF0C0 (__XM_OL_CF0C0 && __MO_OL_CF0C0) ##} XMAILER_MIMEOLE_OL_CF0C0 ##{ XMAILER_MIMEOLE_OL_EF20B meta XMAILER_MIMEOLE_OL_EF20B (__XM_OL_EF20B && __MO_OL_EF20B) ##} XMAILER_MIMEOLE_OL_EF20B ##{ XMAILER_MIMEOLE_OL_EF222 meta XMAILER_MIMEOLE_OL_EF222 (__XM_OL_EF222 && __MO_OL_EF222) ##} XMAILER_MIMEOLE_OL_EF222 ##{ XMAILER_MIMEOLE_OL_F3B05 meta XMAILER_MIMEOLE_OL_F3B05 (__XM_OL_F3B05 && __MO_OL_F3B05) ##} XMAILER_MIMEOLE_OL_F3B05 ##{ XMAILER_MIMEOLE_OL_F475E meta XMAILER_MIMEOLE_OL_F475E (__XM_OL_F475E && __MO_OL_F475E) ##} XMAILER_MIMEOLE_OL_F475E ##{ XMAILER_MIMEOLE_OL_F6D01 meta XMAILER_MIMEOLE_OL_F6D01 (__XM_OL_F6D01 && __MO_OL_F6D01) ##} XMAILER_MIMEOLE_OL_F6D01 ##{ XMAILER_MIMEOLE_OL_FF5C8 meta XMAILER_MIMEOLE_OL_FF5C8 (__XM_OL_FF5C8 && __MO_OL_FF5C8) ##} XMAILER_MIMEOLE_OL_FF5C8 ##{ X_MAILER_CME_6543_MSN header X_MAILER_CME_6543_MSN X-Mailer =~ /^CME-V6\.5\.4\.3; MSN\s*$/ ##} X_MAILER_CME_6543_MSN ##{ if !(! plugin (Mail::SpamAssassin::Plugin::URIDetail))_sandbox if !(! plugin (Mail::SpamAssassin::Plugin::URIDetail)) uri_detail T_KHOP_FOREIGN_CLICK text =~ /\b(?:cli(?:quez\W|ck\Wa)ici\b|cli(?:cca\W|c\Wa|que\Wa)qu[^<.,a ]|klie?k(?:\Whi?er|ni(?:j|nite)\Wtu[tk]aj)\b)/i endif ##} if !(! plugin (Mail::SpamAssassin::Plugin::URIDetail))_sandbox ##{ ifplugin Mail::SpamAssassin::Plugin::DNSEval_sandbox ifplugin Mail::SpamAssassin::Plugin::DNSEval reuse __RCVD_IN_DNSWL reuse RCVD_IN_DNSWL_NONE reuse RCVD_IN_DNSWL_LOW reuse RCVD_IN_DNSWL_MED reuse RCVD_IN_DNSWL_HI reuse RCVD_IN_IADB_LISTED reuse RCVD_IN_IADB_EDDB reuse RCVD_IN_IADB_EPIA reuse RCVD_IN_IADB_SPF reuse RCVD_IN_IADB_SENDERID reuse RCVD_IN_IADB_DK reuse RCVD_IN_IADB_RDNS reuse RCVD_IN_IADB_GOODMAIL reuse RCVD_IN_IADB_NOCONTROL reuse RCVD_IN_IADB_OPTOUTONLY reuse RCVD_IN_IADB_UNVERIFIED_1 reuse RCVD_IN_IADB_UNVERIFIED_2 reuse RCVD_IN_IADB_LOOSE reuse RCVD_IN_IADB_OPTIN_LT50 reuse RCVD_IN_IADB_OPTIN_GT50 reuse RCVD_IN_IADB_OPTIN reuse RCVD_IN_IADB_DOPTIN_LT50 reuse RCVD_IN_IADB_DOPTIN_GT50 reuse RCVD_IN_IADB_DOPTIN reuse RCVD_IN_IADB_ML_DOPTIN reuse RCVD_IN_IADB_OOO reuse RCVD_IN_IADB_MI_CPEAR reuse RCVD_IN_IADB_UT_CPEAR reuse RCVD_IN_IADB_MI_CPR_30 reuse RCVD_IN_IADB_UT_CPR_30 reuse RCVD_IN_IADB_MI_CPR_MAT reuse RCVD_IN_IADB_UT_CPR_MAT endif ##} ifplugin Mail::SpamAssassin::Plugin::DNSEval_sandbox ##{ ifplugin Mail::SpamAssassin::Plugin::ReplaceTags_sandbox ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_rules __FRT_GOLD replace_rules __FRT_SILVER replace_inter W0 \w? replace_inter SP2 [\s\d_*\$\%(),.:;?!}{\[\]|\/?^\#~\xa1`'+-]? replace_tag GX [gk6] replace_tag IX [ilt|!1y?\xcc\xcd\xce\xcf\xec\xed\xee\xef] replace_tag SX [sz5\xa6\xa7] replace_tag TX [t|] replace_tag UX [u\xb5\xd9\xda\xdb\xdc\xfc\xfb\xfa\xf9\xfd] replace_tag WX (?:[wv]|vv) replace_rules T_FRT_ABSOLUT replace_rules FRT_ADOBE2 replace_rules T_FRT_ADULT2 replace_rules FRT_APPROV replace_rules T_FRT_BEFORE replace_rules T_FRT_BELOW2 replace_rules FRT_BIGGERMEM1 replace_rules T_FRT_CANSPAM replace_rules T_FRT_CLICK replace_rules T_FRT_COCK replace_rules T_FRT_CONTACT replace_rules FRT_DIPLOMA replace_rules FRT_DISCOUNT replace_rules FRT_DOLLAR replace_rules T_FRT_ERECTION replace_rules T_FRT_ESTABLISH replace_rules FRT_ESTABLISH2 replace_rules T_FRT_EXPERIENCE replace_rules T_FRT_FOLLOW1 replace_rules T_FRT_FOLLOW2 replace_rules T_FRT_FREE replace_rules T_FRT_FRIEND replace_rules T_FRT_FUCK1 replace_rules FRT_FUCK2 replace_rules FRT_GUARANTEE1 replace_rules T_FRT_HEALTH replace_rules T_FRT_HOUR replace_rules T_FRT_INCOME replace_rules T_FRT_INTEREST replace_rules FRT_INVESTOR replace_rules FRT_LEVITRA replace_rules T_FRT_LITTLE replace_rules T_FRT_LOLITA1 replace_rules FRT_MEETING replace_rules FRT_OFFER2 replace_rules T_FRT_OPPORTUN1 replace_rules FRT_OPPORTUN2 replace_rules T_FRT_PACKAGE replace_rules T_FRT_PAYMENT replace_rules FRT_PENIS1 replace_rules T_FRT_PHARMAC replace_rules T_FRT_POSSIBLE replace_rules FRT_PRICE replace_rules T_FRT_PROFILE1 replace_rules T_FRT_PROFILE2 replace_rules T_FRT_PROFIT1 replace_rules T_FRT_PROFIT2 replace_rules T_FRT_PUSSY replace_rules FRT_REFINANCE1 replace_rules FRT_ROLEX replace_rules FRT_SEXUAL replace_rules T_FRT_SLUT replace_rules FRT_SOMA replace_rules FRT_SOMA2 replace_rules T_FRT_STOCK1 replace_rules T_FRT_STOCK2 replace_rules FRT_STRONG1 replace_rules FRT_STRONG2 replace_rules FRT_SYMBOL replace_rules FRT_TODAY2 replace_rules FRT_VALIUM1 replace_rules FRT_VALIUM2 replace_rules T_FRT_VIRGIN1 replace_rules FRT_WEIGHT2 replace_rules FRT_XANAX1 replace_rules FRT_XANAX2 replace_rules T_FUZZY_SPRM replace_rules FUZZY_MERIDIA replace_rules TVD_FUZZY_PHARMACEUTICAL replace_rules TVD_FUZZY_SYMBOL replace_rules T_TVD_FUZZY_SECURITIES replace_rules TVD_FUZZY_FINANCE replace_rules TVD_FUZZY_FIXED_RATE replace_rules TVD_FUZZY_MICROCAP replace_rules T_TVD_FUZZY_SECTOR replace_rules TVD_FUZZY_DEGREE replace_tag FF_LNNO (?:(?:\d{1,3}(?:[)}\]:.,]{1,80}|(?:st|nd|rd|th)[)}\]:.,]{0,3})|\W?\([\div]{1,5}\)|\W?\{\d{1,3}\}|\[\d{1,3}\]|\*{1,5}|\#{1,5}|\(?[A-K][)}\]:.,]{1,3})\s?) replace_tag FF_YOUR (?:a?\s?copy\sof\s)?(?:(?:your|din)[\s,:]{1,5})?(?:present\s|c[uo]rrent\s|full(?:st[\xe4]ndigt)?\s?|complete\s|direct\s|private?\s|valid\s|personal\s|nuvarande\s|vollst[\xe4]ndige\s|aktuelle\s){0,3} replace_tag ANDOR (?:\s?[\/&+,]\s?|\sor\s|\sand?\s) replace_tag NUMBER (?:(?:ruf)?num(?:[bm]er)?s?|nos?\.|no\b|\#s?|nbrs?\.?) replace_tag FF_SUFFIX (?:\sin\s(?:full|words))?:?(?:\s?[({][^)}]{1,30}[)}])? replace_tag FF_BLANK1 (?:[\s:;]{0,4}(?:(?:[-=_.,:;*\s]|&\#\d{1,3};){3,100})) replace_tag FF_BLANK2 (?:[^-=_.,:;*\w]{0,3}(?:[-=_.,:;*\s]|&\#\d{1,3};){1,100}) replace_tag FF_A1 (?:(?:countr?y|city|province|ter+itory|(?:zip|postal)(?:\s?code)?|st?ates?|ad+res+e?)?){1,3}(?:\sof\s(?:residence|birth|employment|citizenship|origin))? replace_tag FF_A2 (?:(?:contact|full|house|home|resident[ia]+l|busines+|mailing|work|delivery|ship+ing|post(?:al)?|of+ice|e-?mail|bostads|wohn)?){0,3}\s?(?:ad+res+[es]{0,2}|location)(?:\sline)?(?:\s[0-9])? replace_tag FF_N1 (?:company|first|last|all|busines+|legal|ben[ei]ficiary|vollstaendigen)?\s?(?:name?[sn]?|navne)(?:ad+res+)? replace_tag FF_P1 (?:(?:(?:busines+|contact|fax|voice|house|home|mobile?|cel+(?:ular)?|of+ice|tel+e?(?:\s?(?:ph|f)one?)?|(?:ph|f)one|private)(?:\s(?:ph|f)one)??){1,3}(?:\s?)??){1,3} replace_tag FF_M1 (?:(?:age|marital\s?statu[se]|sex|gender|male\sor\sfemale|(?:date\sof\s)?birth|religion|nationality|email|next\sof\skin|alter|staatsangehoerigkeit|nationalitet)?){1,3} replace_tag FF_L1 (?:(?:previous\s)?work(?:ing)\s?experience|employment|position|profes+ion|(?:monthly|an+ual)?\s?income|purpose\sof\sl(?:oa|ao)n|an+ual\sturn\s?over|l(?:oa|ao)n\sduration|oc+up[ae]tion(?:\/position)?|(?:l(?:oa|ao)n\s|the\s)?amount(?:\sneed(ed)?|\sdesired)?(?:\s(?:as|of)\sloan)?|beruf) replace_tag FF_F1 (?:(?:bank|beneficiary|billing|acc(?:oun)?t|rout(?:ing)?|swift|receiver|user)?){1,3}\s(?:(?:name|ad+res+(?:es)?|location|code|details|a\/c|)?){1,3} replace_tag FF_F2 (?:(?:(?:international\s)?driver'?s?\sli[sc]+(:?en[sc]e)?|pas+\s?port|id\scard|[ia]d(?:entification|entity)(?:\s(?:card||papers?))?)?){1,3}(?:\s)? replace_tag FF_F3 (?:picture|test\squestion|answer|amount\swon|(?:inheritance\s)?funds?\svalue|(?:e-?mail\s)?pas+word|e-?mai?l\sid|amount\s[\w\s]{0,30}lost[\w\s]{0,15}) replace_tag FF_F4 (?:log[-\s]?in|(?:e-?mail\s)?user)\s?names? replace_tag FF_F5 (?:ref(?:erence)?|batch|win+ing|award|billet)[-\s]? replace_tag FF_ALL (?:||||||||||) replace_rules __FILL_THIS_FORM_LONG1 replace_rules __FILL_THIS_FORM_LONG2 replace_rules __FILL_THIS_FORM_PARTIAL replace_rules __FILL_THIS_FORM_PARTIAL_RAW replace_rules __FILL_THIS_FORM_SHORT1 replace_rules __FILL_THIS_FORM_SHORT2 replace_rules __FILL_THIS_FORM_LOAN1 replace_rules __FILL_THIS_FORM_FRAUD_PHISH1 replace_tag CURRENCY [\(\[]?(?:\bUS[D\$]{0,2}|\$(?:US)?|usd|GBP|=[Aa][34]|\xa3|&\#16[34];|(?i:pounds\ssterling)|\xa4|EUR(?:OS)?|[Ee]uro?s?|(?i:eur)\sde|CHF|FCFA)[\]\)]? replace_tag GB_UK \b(?:U\.?K\.?|(?:Great\s)?Brit(?:ain|ish)|G\.?B\.?)\b replace_rules __LOTSA_MONEY_00 __LOTSA_MONEY_01 __LOTSA_MONEY_02 __LOTSA_MONEY_03 __LOTSA_MONEY_04 replace_tag PERCENT \b(?:\d\d|ten|[a-z]+teen|(?:twen|thir|fou?r|fif)ty(?:-?[a-z]+)?)\s?(?:%|percent) replace_rules __PCT_FOR_YOU_1 __PCT_FOR_YOU_2 __PCT_FOR_YOU_3 __PCT_OF_PMTS replace_rules T_FUZZY_OPTOUT replace_rules URI_OBFU_WWW replace_rules T_LFUZ_PWRMALE endif ##} ifplugin Mail::SpamAssassin::Plugin::ReplaceTags_sandbox ##{ ifplugin Mail::SpamAssassin::Plugin::URIDNSBL_sandbox ifplugin Mail::SpamAssassin::Plugin::URIDNSBL reuse T_URIBL_SEM_FRESH reuse T_URIBL_SEM_FRESH_10 reuse T_URIBL_SEM_FRESH_15 endif ##} ifplugin Mail::SpamAssassin::Plugin::URIDNSBL_sandbox ##{ redirector_pattern_sandbox redirector_pattern m'/(?:index.php)?\?.*(?<=[?&])URL=(.*?)(?:$|[&\#])'i redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/url\?.*?(?<=[?&])q=(.*?)(?:$|[&\#])'i redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/search\?.*?(?<=[?&])q=[^&]*?(?<=%20|..[=+\s])(?:site|inurl):(.*?)(?:$|%20|[\s+&\#])'i redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/search\?.*?(?<=[?&])q=[^&]*?(?<=%20|..[=+\s])(?:"|%22)(.*?)(?:$|%22|["\s+&\#])'i redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/translate\?.*?(?<=[?&])u=(.*?)(?:$|[&\#])'i redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/pagead/iclk\?.*?(?<=[?&])adurl=(.*?)(?:$|[&\#])'i redirector_pattern m'^http:/*(?:\w+\.)?aol\.com/redir\.adp\?.*(?<=[?&])_url=(.*?)(?:$|[&\#])'i redirector_pattern m'^https?/*(?:\w+\.)?facebook\.com/l/;(.*)'i ##} redirector_pattern_sandbox ##{ reuse_sandbox reuse RCVD_IN_PSBL reuse T_RCVD_IN_NIX_SPAM ##} reuse_sandbox meta __ADVANCE_FEE_2_NEW (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + T_LOTTO_AGENT_RPLY + T_LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET + __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOU_WON > 1) && !__THREAD_INDEX_GOOD meta __ADVANCE_FEE_2_NEW_FORM __FILL_THIS_FORM && __ADVANCE_FEE_2_NEW meta __ADVANCE_FEE_2_NEW_FRM_MNY __FILL_THIS_FORM && LOTS_OF_MONEY && __ADVANCE_FEE_2_NEW meta __ADVANCE_FEE_2_NEW_MONEY LOTS_OF_MONEY && __ADVANCE_FEE_2_NEW meta __ADVANCE_FEE_3_NEW (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + T_LOTTO_AGENT_RPLY + T_LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET + __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOU_WON > 2) && !__THREAD_INDEX_GOOD meta __ADVANCE_FEE_3_NEW_FORM __FILL_THIS_FORM && __ADVANCE_FEE_3_NEW meta __ADVANCE_FEE_3_NEW_FRM_MNY __FILL_THIS_FORM && LOTS_OF_MONEY && __ADVANCE_FEE_3_NEW meta __ADVANCE_FEE_3_NEW_MONEY LOTS_OF_MONEY && __ADVANCE_FEE_3_NEW meta __ADVANCE_FEE_4_NEW (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + T_LOTTO_AGENT_RPLY + T_LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET + __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOU_WON > 3) && !__THREAD_INDEX_GOOD meta __ADVANCE_FEE_4_NEW_FORM __FILL_THIS_FORM && __ADVANCE_FEE_4_NEW meta __ADVANCE_FEE_4_NEW_FRM_MNY __FILL_THIS_FORM && LOTS_OF_MONEY && __ADVANCE_FEE_4_NEW meta __ADVANCE_FEE_4_NEW_MONEY LOTS_OF_MONEY && __ADVANCE_FEE_4_NEW meta __ADVANCE_FEE_5_NEW (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + T_LOTTO_AGENT_RPLY + T_LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET + __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOU_WON > 4) && !__THREAD_INDEX_GOOD meta __ADVANCE_FEE_5_NEW_FORM __FILL_THIS_FORM && __ADVANCE_FEE_5_NEW meta __ADVANCE_FEE_5_NEW_FRM_MNY __FILL_THIS_FORM && LOTS_OF_MONEY && __ADVANCE_FEE_5_NEW meta __ADVANCE_FEE_5_NEW_MONEY LOTS_OF_MONEY && __ADVANCE_FEE_5_NEW body __AFF_004470_NUMBER /(?:\+|00|011)\W{0,3}44\W{0,3}0?\W{0,3}70/ body __AFF_LOTTERY /(?:lottery|winner)/i meta __AFRICAN_STATE (__NIGERIA || __IVORY_COAST || __BURKINA_FASO || __GHANA || __BENIN || __AFR_UNION) body __AFR_UNION /\bafrican\sunion\b/i body __AGREED_RATIO /\b(?:agreed|sharing)\s(?:ratios?|percent\w+)\b/i body __AM_DYING /\bam\s(?:\S+\s)?dying\b/i ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __ANY_IMAGE_ATTACH Content-Type =~ /image\/(?:gif|jpeg|png)/ endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __ANY_TEXT_ATTACH Content-Type =~ /text\/\w+/i endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __ANY_TEXT_ATTACH_DOC Content-Type =~ /text\/\w+/i endif body __APPROVALFVGT /approval/i body __ATM_CARD /\b(?:your|the|this|through|via)\s(?:atm|debit|(?:money[\s-]?gram\s)?fast\scash)(?:\smaster|swift)?\scard/i body __BACHELORS /Bachelor/i body __BACK_SCRATCH /\bmutual+y?\s(?:benefi(?:t|cial)|interest)\b/i body __BANK_DRAFT /\bbank\sdraft/i body __BARRISTER /\b(?:barrister|solicitor at law|barr\.)/i ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # { full __BASE64_MDAW /^(?:MDAw){12}/ endif body __BENEFICIARY /\bb(?:[e\xe9]n[e\xe9]|[\xc3][\xa9]n[\xc3][\xa9])fi(?:c|sh)i?ai?r(?:y|ies|es?)/i body __BENIN /\bb(?:[e\xe9]|[\xc3][\xa9])nin\b/i body __BIGDOLLARSFVGT /\$\d{2,3},\d{3}/ body __BODY_STARTS_WITH_FROM_LINE /^From \S+ \S\S\S \S\S\S .. ..:..:.. \S+\s+\S+\: /s rawbody __BUGGED_IMG m{]{0,100}\ssrc=.?https?://[^>]{6,80}(?:\?[^>]{8}|[^a-z](?![a-f]{3}|20\d\d[01]\d[0-3]\d)[0-9a-f]{8})}i body __BURKINA_FASO /\bburkina\s?faso\b/i body __CAN_HELP /can help/ body __CASHPRZ /cash prize of/ body __CHARITY /\bcharit(?:y|[ai]ble)\b/i body __COMPENSATION /\b(?:compensat(?:e|ion)|recompensed?|ausgleich)\b/i body __CONTACT_ATTY /\bcontact\smy\s(?:barrister|attou?rney)\b/i body __CONTACT_YOU /\b(?:contact(?:ing)\syou|vous\scontacter)\b/i body __COURIER /\bcourier\s(?:company|service)\b/i body __CS_WORD /\bC[A-Za-z]{2,4}IS\b/ header __CTYPE_MULTIPART_ANY Content-Type =~ /multipart\/\w+/i ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __CTYPE_ONETAB_GIF Content-Type:raw =~ /^image\/gif;\n\tname=\".+?\"$/s endif header __DATE_700 Date =~ /-0700/ body __DBLCLAIM /avoid double claiming/ body __DEAD_PARENT /\bmy\s(?:deceased|dead)\s(?:father|mother)/i body __DEAL /\b(?:business|financial|this|the|mutual|die(?:se)?r?|cette|profitable)\s(?:deal|transa[ck]tion|proposal|offer|venture|suggestion|partnership)/i body __DECEASED /\b(?:the|my|der|du|le)\s(?:deceased|late|verstorbenen|d[\xe9]funt|d[\xc3][\xa9]nt)\b/i body __DESTROY_ME /\b(?:destroy|hunt)\sm[ey]\b/i body __DIED_IN /\bdied\sin\b/i body __DIPLOMA /diploma/i body __DIPLOMATIC /\bdiplomatic\b/i header __DKIM_EXISTS exists:DKIM-Signature tflags __DKIM_EXISTS nice body __DLND_ATTACH /\bdownload\sthe\sattach(?:ed|ment)\b/i ifplugin Mail::SpamAssassin::Plugin::MIMEHeader meta __DOC_ATTACH (__DOC_ATTACH_MT || __DOC_ATTACH_FN1 || __DOC_ATTACH_FN2) endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __DOC_ATTACH_FN1 Content-Type =~ /="[^"]+\.(?:docx?|rtf)"/i endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __DOC_ATTACH_FN2 Content-Disposition =~ /="[^"]+\.(?:docx?|rtf)"/i endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __DOC_ATTACH_MT Content-Type =~ m,\bapplication/(?:msword|rtf|vnd\.ms-word|vnd\.openxmlformats-officedocument\.wordprocessingml\.document)\b,i endif body __DORMANT_ACCT /\b(?:(?:dormant|abandoned|left\s?over)\s(?:account|fund|transaction|sum|deposit)|fonds\sdorment)/i body __DOS_BODY_FRI /\bfri(?:day)?\b/i body __DOS_BODY_MON /\bmon(?:day)?\b/i body __DOS_BODY_SAT /\bsat(?:day)?\b/i body __DOS_BODY_STOCK /\bstock\b/i body __DOS_BODY_SUN /\bsun(?:day)?\b/i body __DOS_BODY_THU /\bthu(?:r(?:s(?:day)?)?)?\b/i body __DOS_BODY_TICKER /\b[A-Z]{4}\.(?:OB|PK)\b/ body __DOS_BODY_TUE /\btue(?:s(?:day)?)?\b/i body __DOS_BODY_WED /\bwed(?:nesday)?\b/i body __DOS_COMING_TO_YOUR_PLACE /I (?:am|might(?: be)?) c[a-z]?o[a-z]?m[a-z]?(?:i[a-z]?n[a-z]?g[a-z]{0,2}|e down) to y[!a-z]{2,4}r (?:city|place[a-z]{0,2}|co[a-z]?u[a-z]?n[a-z]?t[a-z]?ry) in (?:f[a-z]?e[a-z]?w|\d{1,2}) (?:day|week)s/ body __DOS_CORRESPOND_EMAIL /correspond with me using my email/ meta __DOS_DIRECT_TO_MX __DOS_SINGLE_EXT_RELAY && !__DOS_HAS_LIST_ID && !__DOS_HAS_LIST_UNSUB && !__DOS_HAS_MAILING_LIST && !__DOS_RELAYED_EXT body __DOS_DROP_ME_A_LINE /Drop me a line at/ body __DOS_EMAIL_DIRECTLY /(?:Email m[a-z]?e|address) direc(?:tl|lt)y at/ body __DOS_FIN_ADVANTAGE /\bfinancial advantage/i uri __DOS_HAS_ANY_URI /./ header __DOS_HAS_LIST_ID exists:List-ID header __DOS_HAS_LIST_UNSUB exists:List-Unsubscribe header __DOS_HAS_MAILING_LIST exists:Mailing-List body __DOS_HI /^Hi,$/ body __DOS_I_AM_25 /I a.?m 25/ body __DOS_I_DRIVE_A /I drive a/ body __DOS_LET_GO_JOB /I was (?:let go|fired|layed off|dismissed) from a job I h(?:el|a)d for (?:2\d years|\d{3} months)/ body __DOS_LINK /\blink\b/ body __DOS_MEET_EACH_OTHER /(?:meet each other|[Mm]ay ?be we can meet)/ body __DOS_MY_OLD_JOB /my old job/ body __DOS_PERSONAL_EMAIL /personal email at/ header __DOS_RCVD_FRI Received =~ / Fri, / header __DOS_RCVD_MON Received =~ / Mon, / header __DOS_RCVD_SAT Received =~ / Sat, / header __DOS_RCVD_SUN Received =~ / Sun, / header __DOS_RCVD_THU Received =~ / Thu, / header __DOS_RCVD_TUE Received =~ / Tue, / header __DOS_RCVD_WED Received =~ / Wed, / meta __DOS_REF_2_WK_DAYS (__DOS_RCVD_MON && __DOS_BODY_WED) || (__DOS_RCVD_TUE && __DOS_BODY_THU) || (__DOS_RCVD_WED && __DOS_BODY_FRI) || (__DOS_RCVD_THU && __DOS_BODY_MON) || (__DOS_RCVD_FRI && __DOS_BODY_TUE) || (__DOS_RCVD_SAT && __DOS_BODY_TUE) || (__DOS_RCVD_SUN && __DOS_BODY_TUE) meta __DOS_REF_NEXT_WK_DAY (__DOS_RCVD_MON && __DOS_BODY_TUE) || (__DOS_RCVD_TUE && __DOS_BODY_WED) || (__DOS_RCVD_WED && __DOS_BODY_THU) || (__DOS_RCVD_THU && __DOS_BODY_FRI) || (__DOS_RCVD_FRI && __DOS_BODY_MON) || (__DOS_RCVD_SAT && __DOS_BODY_MON) || (__DOS_RCVD_SUN && __DOS_BODY_MON) meta __DOS_REF_TODAY (__DOS_RCVD_MON && __DOS_BODY_MON) || (__DOS_RCVD_TUE && __DOS_BODY_TUE) || (__DOS_RCVD_WED && __DOS_BODY_WED) || (__DOS_RCVD_THU && __DOS_BODY_THU) || (__DOS_RCVD_FRI && __DOS_BODY_FRI) || (__DOS_RCVD_SAT && __DOS_BODY_SAT) || (__DOS_RCVD_SUN && __DOS_BODY_SUN) header __DOS_RELAYED_EXT ALL-EXTERNAL =~ /(?:^|\n)[Rr][eE][cC][eE][iI][vV][eE][dD]:\s.+\n[Rr][eE][cC][eE][iI][vV][eE][dD]:\s/s header __DOS_SINGLE_EXT_RELAY X-Spam-Relays-External =~ /^\[ [^\]]+ \]$/ body __DOS_STEADY_COURSE /\bsteady (?:and increasing )?course\b/i body __DOS_STRONG_CF /\bstrong cash flow/i body __DOS_TAKING_HOME /Taking home \d (?:digit level|figures) in \d{1,2} months/ body __DOS_WRITE_ME_AT /[Ww].?r.?i.?t.?e me at/ body __EARLY_DEMISE /\buntimely\sdeath\b/i header __EXCLAIM_SUBJ Subject =~ /\!/ body __EX_CUSTOMER /\b(?:(?:dead|deceased|late|verstorbenen)\s(?:[ck]lient|customer|ac+ount|invest[eo]r|beneficiary|mr\.|kunde|engr?\.?)|titulaire\sdu\scompte\sest\s(?:d[\xe9]c[\xe9]d[\xe9]|d[\xc3][\xa9]c[\xc3][\xa9]d[\xc3][\xa9])|invest[eo]r\sdied|[\xe9]tranger\sd[\xe9]c[\xe9]d[\xe9]|(?:[ck]lient|customer|ac+ount|invest[eo]r|beneficiary|mr\.|kunde|engr?\.?)\s(?:[a-z]{1,10}\s)?(?:dead|deceased|verstorbenen))/i body __FB_BA /\bBA\b/ body __FB_BCs /\bBSc\b/ body __FB_BRAND_NAME /brand name/i body __FB_CONGRADS /Congratulations/i body __FB_DESIGNER /designer/i body __FB_GAME /game/i body __FB_GLASHUTE /Glashute/ body __FB_HANDBAGS /handbags/i body __FB_HOTTEST /hottest/i body __FB_INK_PEN /ink pen/i body __FB_LOTTERY /lottery/i body __FB_LUX_GIFTS /Luxury (?:\w+\s)?Gifts/i body __FB_MA /\bMA\b/ body __FB_MBA /\bMBA\b/ body __FB_NATIONAL /national/i body __FB_NUM_PERCNT /\d\s?\%/ body __FB_OMEGA /Omega/i body __FB_PICK /\bpick\b/i body __FB_PROJECTED /projected/i body __FB_P_ALLNIGHT /all night!/i body __FB_P_TRUELOVE /true love/i body __FB_ROLEX_MEN /Rolex Men/i body __FB_ROLEX_WMEN /Rolex Lady/i body __FB_S_PRICE /Pri{1,2}c[a-z]?e/i body __FB_S_STOCK /Stock/i body __FB_S_SYMBOL /Symb?o?l?:\s?[A-Z_,\.-]{4,8}/i body __FB_TIMEPIECE /timepiece/i body __FB_TOUR /\btour/i body __FB_WALLETS /wallets/i body __FEES /\b(?:security|safe\w*|courier|registration|pay|paid|up-?front|processing|delivery|transfer)[\s\w]{0,15}\s(?:fee|charge)s?\b/i header __FHELO_VERIZON X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+verizon\.net /i header __FHOST_VERIZON X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+verizon\.net /i header __FH_FRM_53 From =~ /\@53\.com/i header __FH_HAS_XMSMAIL exists:X-MSMail-Priority header __FH_HAS_XPRIORITY exists:X-Priority header __FH_MSGID_01C7 MESSAGEID =~ /^<0{1,5}1c7/ header __FH_MSG_53 MESSAGEID =~ /\@53\.com/i header __FH_RCV_53 Received =~ /\.53\.com/i body __FIFTY_FIFTY /\b(?:50|fifty)(?:%?[\/:]50%?|%|\spercent)\b/ ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta __FILL_THIS_FORM (__FILL_THIS_FORM_LONG || __FILL_THIS_FORM_PARTIAL > 4 || __FILL_THIS_FORM_PARTIAL_RAW > 4) endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta __FILL_THIS_FORM_FRAUD_PHISH (__FILL_THIS_FORM || __FILL_THIS_FORM_SHORT) && __FILL_THIS_FORM_FRAUD_PHISH1 endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __FILL_THIS_FORM_FRAUD_PHISH1 /(?:||||)(?:|$)/i endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta __FILL_THIS_FORM_LOAN __FILL_THIS_FORM && __FILL_THIS_FORM_LOAN1 endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __FILL_THIS_FORM_LOAN1 /(?:|$)/i endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta __FILL_THIS_FORM_LONG __FILL_THIS_FORM_LONG1 || __FILL_THIS_FORM_LONG2 endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __FILL_THIS_FORM_LONG1 /(?:(?:(?:P[a-z\.\s]{10,30})?|)){5}/i endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __FILL_THIS_FORM_LONG2 /(?:(?:(?:P[a-z\.\s]{10,30})?|)){5}/i endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __FILL_THIS_FORM_PARTIAL /^\s*?(?:?){1,3}(?:|(?:[-=_.,:;*\s]|=20){1,4}$)/im tflags __FILL_THIS_FORM_PARTIAL multiple endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags rawbody __FILL_THIS_FORM_PARTIAL_RAW /^\s*?(?:?){1,3}(?:|(?:[-=_.,:;*\s]|=20| |<\/\w+>){0,4}$)/im tflags __FILL_THIS_FORM_PARTIAL_RAW multiple endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta __FILL_THIS_FORM_SHORT !__FILL_THIS_FORM && (__FILL_THIS_FORM_SHORT1 || __FILL_THIS_FORM_SHORT2 || __FILL_THIS_FORM_PARTIAL > 2 || __FILL_THIS_FORM_PARTIAL_RAW > 2) endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __FILL_THIS_FORM_SHORT1 /(?:(?:|)){3}/i endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __FILL_THIS_FORM_SHORT2 /(?:(?:|)){3}/i endif body __FIXED_RATEFVGT /fixed rate/i meta __FM_LARGE_MONEY (__F_LARGE_MONEY || __F_LARGE_MONEY_2) meta __FM_MORTGAGE5PLUS ((__PREAPPROVEDFVGT + __FIXED_RATEFVGT + __YOUR_CREDITFVGT + __HOMELOANFVGT + __APPROVALFVGT + __BIGDOLLARSFVGT + __LOANURIFVGT + __MORTURIFVGT) > 4) meta __FM_MORTGAGE6PLUS ((__PREAPPROVEDFVGT + __FIXED_RATEFVGT + __YOUR_CREDITFVGT + __HOMELOANFVGT + __APPROVALFVGT + __BIGDOLLARSFVGT + __LOANURIFVGT + __MORTURIFVGT) > 5) meta __FM_MY_PRICE (__FB_S_PRICE || FRT_PRICE) meta __FM_NAT_LOTTERY (__FB_NATIONAL && __FB_LOTTERY) meta __FM_STOCK_WORDS (__FB_HOTTEST || __FB_PICK || __FB_PROJECTED) meta __FM_TO_ALL_NUMS __FROM_ALL_NUMS && __TO_ALL_NUMS meta __FORGED_TBIRD_IMG __MUA_TBIRD && __JPEG_ATTACH && __MIME_BDRY_0D0D describe __FORGED_TBIRD_IMG Possibly forged Thunderbird image spam meta __FORM_FRAUD_3 (__FILL_THIS_FORM || __FILL_THIS_FORM_SHORT) && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH + __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + T_LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX + __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 3) meta __FORM_FRAUD_5 (__FILL_THIS_FORM || __FILL_THIS_FORM_SHORT) && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH + __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + T_LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX + __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 5) if can(Mail::SpamAssassin::Conf::feature_bug6558_free) body __FOR_SALE_LTP /00\.? (?:less 10%|LTP)/i tflags __FOR_SALE_LTP multiple endif if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta __FOR_SALE_LTP_MANY __FOR_SALE_LTP > 10 endif if can(Mail::SpamAssassin::Conf::feature_bug6558_free) body __FOR_SALE_NET /00\.? NET/i tflags __FOR_SALE_NET multiple endif if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta __FOR_SALE_NET_MANY __FOR_SALE_NET > 10 endif if can(Mail::SpamAssassin::Conf::feature_bug6558_free) body __FOR_SALE_OBO /\bor best offer\b/i tflags __FOR_SALE_OBO multiple endif if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta __FOR_SALE_OBO_MANY __FOR_SALE_OBO > 5 endif if can(Mail::SpamAssassin::Conf::feature_bug6558_free) body __FOR_SALE_PRC_100K /\bprice:? \$\d\d\d,\d\d\d/i tflags __FOR_SALE_PRC_100K multiple endif if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta __FOR_SALE_PRC_100K_MANY __FOR_SALE_PRC_100K > 5 endif if can(Mail::SpamAssassin::Conf::feature_bug6558_free) body __FOR_SALE_PRC_10K /\bprice:? \$\d\d,\d\d\d/i tflags __FOR_SALE_PRC_10K multiple endif if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta __FOR_SALE_PRC_10K_MANY __FOR_SALE_PRC_10K > 10 endif if can(Mail::SpamAssassin::Conf::feature_bug6558_free) body __FOR_SALE_PRC_1K /\bprice:? \$\d,?\d\d\d[.\s]/i tflags __FOR_SALE_PRC_1K multiple endif if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta __FOR_SALE_PRC_1K_MANY __FOR_SALE_PRC_1K > 10 endif if can(Mail::SpamAssassin::Conf::feature_bug6558_free) rawbody __FOR_SALE_PRC_EOL /\s\$\d{1,3},\d00(?:\.00)?$/m tflags __FOR_SALE_PRC_EOL multiple endif if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta __FOR_SALE_PRC_EOL_MANY __FOR_SALE_PRC_EOL > 10 endif if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta __FOR_SALE_PRC_MANY (__FOR_SALE_PRC_1K + __FOR_SALE_PRC_10K + __FOR_SALE_PRC_100K) > 20 endif body __FOUND_YOU /\b(?:I|we)\sfound\syour?\b/i body __FRAUD /\b(?:de)?fraud/i body __FRAUD_IOV /\b(?:no risks?|risk-? *free|free of risks?|100% safe|v.llig Risikofrei ist)\b/i body __FRAUD_PTX /\b(?:ass?ass?inat(?:ed|ion)|murder(?:e?d)?|poison(?:e?d)?|kill(?:ed|ing)\b[^.]{0,99}\b(?:war veterans|rebels?))\b/i body __FRAUD_XWW /\b(?:honest(?:ly)?\sco(?:-?operat(?:e|ion)|llaborat(?:e|ion))|ehrliche\szusammenarbeit)\b/i header __FROM_12LTRDOM_1 From =~ /\@[a-z]{12}\./ ifplugin Mail::SpamAssassin::Plugin::FreeMail meta __FROM_41_FREEMAIL (__NSL_ORIG_FROM_41 || __NSL_RCVD_FROM_41) && (FREEMAIL_FROM || FREEMAIL_REPLYTO) describe __FROM_41_FREEMAIL Sent from Africa + freemail provider endif header __FROM_ALL_NUMS From:addr =~ /^\d+@/ header __FROM_EBAY From:addr =~ /\@ebay\.com$/i header __FROM_FREEMAIL From =~ /\@(?:googlemail|gmail|yahoo|hotmail|msn|aol|aim)\./ header __FROM_ISO_2022_JP From:raw =~ /=\?ISO-2022-JP\?/ header __FROM_LEFT_BRACK From:name =~ // header __FROM_RUNON From =~ /\S+<\w+/ header __FROM_VEGAS From =~ /Vegas/i ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __FRT_GOLD /\b(?!gold)\b/i endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __FRT_SILVER /\b(?!s[il][li]ver)\b/i endif rawbody __FR_SPACING_8 /[a-z0-9]{6}\s{8}[a-z0-9]{5}/i header __FSL_UA_1 User-Agent =~ /6\.00\.2600\.000/ header __FSL_UA_2 X-Mailer =~ /6\.00\.2600\.000/ header __FS_SUBJ_RE Subject =~ /^Re: / header __FS_S_TRADE Subject =~ /\btrade\b/i body __F_LARGE_MONEY /\d\d\d,\d\d\d/ body __F_LARGE_MONEY_2 /\d\d?\s?(?:thousand|(?:m|b|tr)illion)/i meta __GAPPY_HTML __GAPPY_HTML_01 || __GAPPY_HTML_02 rawbody __GAPPY_HTML_01 m;]{0,40})?>\s{0,80}(?:(?!\d)[\w'()\#,.:!]{1,15}\s{4,80}){7}\S; rawbody __GAPPY_HTML_02 m;\S(?:\s{4,80}(?!\d)[\w'()\#,.:!]{1,15}){7}\s{0,5}; body __GAPPY_PHONE_NA /1 - \d \d \d - \d \d \d - \d \d \d \d/ body __GHANA /\bghana\b/i ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __GIF_ATTACH Content-Type =~ /^image\/gif\b/i endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # { ifplugin Mail::SpamAssassin::Plugin::ImageInfo body __GIF_EXISTS eval:image_count('gif',1) endif endif header __GREYLISTING ALL =~ /(?:^|\n)X-(?:Scam-Grey|Greylist(?:ing)?):\s/m body __HAS_ANY_EMAIL /\w@\S+\.\w/ uri __HAS_ANY_URI /./ header __HAS_THREAD_INDEX exists:Thread-Index body __HAS_WON_01 /\bque ha ganado\b/i header __HDRS_LCASE ALL =~ /\n(?:Message-id|Content-type|X-MSMail-priority|from|subject|to|cc|Disposition-notification-to):/sm tflags __HDRS_LCASE multiple meta __HDRS_LCASE_1K __HDRS_LCASE && __SINGLE_HEADER_1K header __HDR_ORDER_FTSDMCXXXX ALL =~ /\nFrom: .{1,80}?\nTo: .{1,80}?\nSubject: .{1,200}?\nDate: .{1,40}?\nMIME-Version: .{1,40}?\nContent-Type: .{1,120}?\nX-Priority: .{1,40}?\nX-MSMail-Priority: .{1,40}?\nX-Mailer: .{1,80}?\nX-MimeOLE:/s header __HELO_NO_DOMAIN X-Spam-Relays-External =~ /^[^\]]+ helo=[^\.]+ / ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM header __HK_HELO_EBAY X-Spam-Relays-External =~ / helo=[^ ]+\.(?:ebay|emarsys)\b/ endif endif ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM header __HK_HELO_MICROSOFT X-Spam-Relays-External =~ / helo=\S+\.(?:microsoft(?:email)?|msn)\.com / endif endif ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM header __HK_HELO_PAYPAL X-Spam-Relays-External =~ / helo=[^ ]+\.paypal\b/ endif endif ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM header __HK_HELO_YAHOO X-Spam-Relays-External =~ / helo=[^ ]+\.yahoo\.com / endif endif body __HK_LOTTO_1 /\b(?:(?:inter)?national|foundation|mercato|univers|euro ?million|e-?mail|euro-pw|bill ?gates|swiss|prestige|cristal|am.ricaine|coca.?cola|fiduciary|department) ?lot(?:eri[ej]|t(?:ery|o))/i body __HK_LOTTO_2 /\blot(?:eri[ej]|t(?:ery|o)) ?(?:(?:inter)?national|foundation|mercato|univers|euro ?million|e-?mail|euro-pw|bill ?gates|swiss|prestige|cristal|am.ricaine|coca.?cola|fiduciary|department)/i body __HK_LOTTO_BALLOT /\b(?:promotional|on.?line|computer|internet|e-?mail|fran.aise) (?:ballot|draw|sweepstake)/i body __HK_LOTTO_JACKPOT /\bmega jackpot\b/i body __HK_LOTTO_STAATS /\bstaatsloteri/i ifplugin Mail::SpamAssassin::Plugin::FreeMail header __HK_NAME_DR From:name =~ /^DR\b/mi endif ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM header __HK_NAME_EBAY From:name =~ /\bebay\b/i endif endif ifplugin Mail::SpamAssassin::Plugin::FreeMail header __HK_NAME_FROM From:name =~ /^FROM\b/mi endif ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM header __HK_NAME_MICROSOFT From:name =~ /(microsoft|\bmsn\b)/i endif endif ifplugin Mail::SpamAssassin::Plugin::FreeMail header __HK_NAME_MR_MRS From:name =~ /^M(?:RS?|ISS)\b/mi endif ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM header __HK_NAME_PAYPAL From:name =~ /\bpaypal\b/i endif endif ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM header __HK_NAME_YAHOO From:name =~ /\byahoo\b/i endif endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __HK_SPAMMY_CDFN Content-Disposition =~ /name=.*?(?:lot(?:eri[ej]|t(?:ery|o))|award|prize|winn(?:er|ing)|microsoft|congrat|urgent)/mi endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __HK_SPAMMY_CTFN Content-Type =~ /name=.*?(?:lot(?:eri[ej]|t(?:ery|o))|award|prize|winn(?:er|ing)|microsoft|congrat|urgent)/mi endif body __HOMELOANFVGT /home loan/i header __HOST_HOTMAIL X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.hotmail\.com / header __HOTMAILCOM X-Spam-Relays-External =~ /^[^\]]+ helo=hotmail\.com /i rawbody __HS_QUOTE /^> / header __HS_SUBJ_RE_FW Subject =~ /^(?i:re|fw):/ header __HS_SUBJ_UC_FW Subject =~ /^FW:/ body __HUSH_HUSH /\b(?:confiden[tc]i[ae]l(?:\b|ity\b|it(?:[\xe9]|[\xc3][\xa9]))|private\b|secr[e\xe8](?:te?|cy)\b|sensitive\b|concealed\b|obscured?\b|discre(?:et|tion)\b|vertraulich(?:en)?\b|geheim\b|priv(?:[\xe9]|[\xc3][\xa9]))/i ifplugin Mail::SpamAssassin::Plugin::ImageInfo body __IMG_LE_300K eval:pixel_coverage('all',62500,300000) endif body __INHERIT_PMT /\binheritance\spayment\s/i body __INTL_BANK /\b(?:international\s(?:\w+\s)?bank|banque\sinternationale)\b/i body __INVEST_COUNTRY /\binvest\sin\syour?\scountry\b/i body __INVEST_MONEY /\binvest\sthis\smoney\b/i body __IS_LEGAL /\b(?:this\s(?:deal|offer|transaction|proposal|exchange|arrangement|work)|it)?\sis\s(?:(?:guaranteed|completely|absolutely|perfectly|100%|very|fully)\s)?(?:legal|hitch-free)\b/i body __IVORY_COAST /\b(?:Cote\s?D.Ivoire|Ivory\s?Coast)\b/i body __I_INHERIT /\bI\s[a-z\s]{0,30}inherited\b/i body __I_WILL_YOU /\bwill(?:ed)?\s(?:[a-z\s]{0,20}\s(?:fortune|money)\s)?to\syou\b/i header __JM_REACTOR_DATE Date =~ / \+0000$/ ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __JPEG_ATTACH Content-Type =~ /image\/jpeg/i endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # { ifplugin Mail::SpamAssassin::Plugin::ImageInfo body __JPEG_EXISTS eval:image_count('jpeg',1) endif endif body __KAM_LOTTO1 /(e-?mail address (have emerged a winner|has won|attached to (ticket|reference)|was one of the ten winners)|random selection in our computerized email selection system)/is body __KAM_LOTTO2 /((ticket|serial|lucky) number|secret pin ?code|batch number|reference number|promotion date)/is body __KAM_LOTTO3 /(won|claim|cash prize|pounds? sterling)/is body __KAM_LOTTO4 /(claims (officer|agent)|lottery coordinator|fiduciary (officer|agent)|fiduaciary claims)/is body __KAM_LOTTO5 /(freelotto group|Royal Heritage Lottery|UK National (Online)? Lottery|U\.?K\.? Grand Promotions|Lottery Department UK|Euromillion Loteria|Luckyday International Lottery|International Lottery)/is body __KAM_LOTTO6 /(Dear Lucky Winner|Winning Notification|Attention:Winner|Dear Winner)/is header __KAM_LOTTO7 Subject =~ /(Your Lucky Day|(Attention:|ONLINE) WINNER)/i header __KB_MSGID_OUTLOOK_888 Message-Id =~ /^<[0-9a-f]{8}(?:\$[0-9a-f]{8}){2}\@/ if ! plugin (Mail::SpamAssassin::Plugin::OpenPGP) body __KHOP_PGP_I1 /-----BEGIN PGP (?:SIGNATURE|MESSAGE|PUBLIC|PRIVATE)(?:, PART [0-9]{1,4}\/[0-9]{1,4}| KEY BLOCK)?-----/ tflags __KHOP_PGP_I1 nice endif if ! plugin (Mail::SpamAssassin::Plugin::OpenPGP) body __KHOP_PGP_I2 /-----END PGP/ tflags __KHOP_PGP_I2 nice endif uri __LOANURIFVGT /\bloa.?ns?\b/i ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __LOTSA_MONEY_00 /[\s\.]?\d[\dO][,\.][\dO]{3}(?:(?!\d)|\b)/ endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __LOTSA_MONEY_01 /(?:(?i:sum\sof\s)[\(\[]?|\s?)[\s\.]?\d[\d.,\sO]{5,20}[\dO]/ endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __LOTSA_MONEY_02 /\d[\d.,\sO]{5,20}[\dO][\)\]\(]?\s?(?:|Pounds|(?i:dollars?|bucks))\b/ endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __LOTSA_MONEY_03 /(?:(?i:sum\sof\s)[\(\[]?|\s?)\d(?:[\d.,\sO]{0,5})?[\)\]]?\s?(?i:M(?i:il)?\b|mil+(?i:io|)n|hund?[re]+a?[dt]|thousand|tausend)/ endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __LOTSA_MONEY_04 /(?:\d[\d\.]{0,4}M|million(?!s)|milln|hund?rea?d(?!s)[^\.]{1,25}thousand(?!s)|cents?[^\.]{1,25}mille|hundert[^\.]{1,30}tausend|ientos?[^\.]{1,20}mil|cent[a-z\s]{1,20}mil\s[a-z]{1,20}centos)[^\.\$]{0,50}(?:(?:U\.?\s?S\.?\s?(?:A\.?\s?)?|united\s?states?|canad(?:ian|a)\s)?dollars?|bucks|USD|GBP|\spounds?|(?:\s)?pounds?\ssterling|pounds(?!\sof)|(?:d'\s?)?euros?|francs?)\b/i endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __LOTSA_MONEY_05 /(?:(?:sum|value|amount)\sof\s)\d[\d.,\sO]{7,20}[\dO\.][\)\]\(\s]{0,3}(?:pounds?|dollars?|euros?|bucks)\b/i endif meta __LOTTO_ADMITS __LOTTO_ADMITS_1 || __LOTTO_ADMITS_2 || __LOTTO_ADMITS_3 body __LOTTO_ADMITS_1 /\b(?:on-?line|e-?mail|ballot|(?:inter)?national|state|(?:UK|euro)[- ]?(?:mil+ions?|PW)|Canada|Microsoft|MSN|internet|mega|jackpot|Royal Heritage|foundation|mercato|univers|staatsloterij|bill\s?gates|swiss|this|esta)(?:\s\w+)?\s?(?:lot(?:to|tery|eri[ea])|sweepstake|promotion|promocao|promocion)/i body __LOTTO_ADMITS_2 /\b(?:free)?(?:lot(?:to|tery|erie)|sweepstakes)\s(?:(?:inter)?na[tz]ional|department|bureau|group|award)/i uri __LOTTO_ADMITS_3 /lottery/i body __LOTTO_RELATED /\b(?:lott(?:o|ery)|sweepstakes)\s(?:prize|draw(?:s|ing)?|(?:ge)?win(?:n?er|n?ing)?|jackpot|award|fund|com+it+e+|com+is+ion|guild|promotion|promocao|program|day|online|company|(?:in)?corporat|agent|co[-,]?ordinator|team)/i body __LOTTO_VERIFY /\bpromo\sverification/i body __LOTTO_WINNINGS /(?:claim|process(?:ing)?|transfert?(?:\s\w+)?|redeem|payment|virement|zahlung|reivindicar|demandar)\s(?:(?:[a-z]{1,5}\s)?(?:your|of|the|this|de|ihrer|seu|tu)\s)+(?:win+ings?|money|(?:cash\s)?prize|award|f[ou]nds?|grant|gewinne|premio)/i body __LOTTO_WIN_01 /\bwin+ing\s(?:prize|number|notification|draw|check|cheque|details|information|payment)/i body __LUCKY_WINNER /\b(?:lucky|gl.cklich(?:en)?|afortunados)\s(?:(?:ge)?win+ers?|ganador(?:es)?)\b/i body __LUCRATIVE /\b(?:lucrative|profitable|tr[\xe8]s\ssalutaire)\b/i header __MAILER_OL_5510 X-Mailer =~ /^Microsoft Office Outlook, Build 11.0.5510$/ header __MAILER_OL_6626 X-Mailer =~ /^Microsoft Outlook, Build 10\.0\.6626$/ uri __MAIL_LINK /\?.{0,200}\w\@[\w-]{1,20}.\w\w\w?\b/i if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta __MANY_BIG_LISTS (__MANY_RECORDS_1 + __MANY_RECORDS_2 + __MANY_RECORDS_3) > 15 endif header __MANY_RECIPS ToCc =~ /(?:\@[^@]{5,30}){3}/ if can(Mail::SpamAssassin::Conf::feature_bug6558_free) body __MANY_RECORDS_1 /\s[A-Z][a-z]{1,30}s(?:\sDatabase)?[-:\s]{2,5}(?i:1\smillion\s|\d[\d,.]{1,8}[Kk]?\s(?i:thousand\s|million\s)?)(?i:total\s|full\sdata\s)?(?i:email|record)s/ tflags __MANY_RECORDS_1 multiple endif if can(Mail::SpamAssassin::Conf::feature_bug6558_free) body __MANY_RECORDS_2 /\W{1,4}\s(?:[a-z\/]{1,20}\s){0,4}(?:doctor|physician|provider|therapist|counselor|dentist|veterinarian|clinic|hospital|agent|chiropractor|psychologist|companie|supplier)s/i tflags __MANY_RECORDS_2 multiple endif if can(Mail::SpamAssassin::Conf::feature_bug6558_free) body __MANY_RECORDS_3 /\W{1,4}\s(?:(?:[A-Z]{1,2}[a-z\/]{0,20}|and)\s){0,4}[A-Z][a-z]{1,20}s Database/ tflags __MANY_RECORDS_3 multiple endif meta __MANY_SPAN_IN_TEXT (__SPAN_BEG_TEXT > 4) && (__SPAN_END_TEXT > 4) uri __MANY_SUBDOM m;^https?://(?:[^\./]{1,30}\.){6}; body __MASTERS /Masters/i body __MBA /MBA/i header __MID_START_001C Message-ID =~ /^<000001c/ body __MILLIONS /\bmillions\sof\s(?:dollar|euro|pound)/i header __MIMEOLE_1106 X-MimeOLE =~ /^Produced By Microsoft MimeOLE V6.00.2800.1106$/ header __MIME_BDRY_0D0D Content-Type =~ /boundary="-{12}(?:0[1-9]){12}/ header __MISSING_REF References =~ /^UNSET$/ [if-unset: UNSET] header __MISSING_REPLY In-Reply-To =~ /^UNSET$/ [if-unset: UNSET] header __MOLE_2962 X-MimeOLE =~ /^Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2962$/ meta __MONEY_FRAUD_3 LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH + __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + T_LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX + __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 3) meta __MONEY_FRAUD_5 LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH + __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + T_LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX + __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 5) meta __MONEY_FRAUD_8 LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH + __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + T_LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX + __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 8) uri __MORTURIFVGT /\bmor.?t\b/i body __MOVE_MONEY /\b(?:(?:receive|re-?profile|repatriate|rapatrier|secure|r[\xe9]clamation|possession|virer)\s(?:th(?:e|is)|das|sur ce|de ces|cet)|re-?profiling)\s(?:proceeds|funds?|money|balance|account|geld|compte|fonds|argent)\b/i header __MO_OL_015D5 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2905/ header __MO_OL_07794 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1437/ header __MO_OL_09BB4 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.72\.3155\.0/ header __MO_OL_1ECD5 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1081/ header __MO_OL_20C99 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.72\.3338\.1/ header __MO_OL_22B61 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1158/ header __MO_OL_25340 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4963\.1700/ header __MO_OL_32D97 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V9\.0\.2416/ header __MO_OL_3857F X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1409/ header __MO_OL_3AC1D X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.00\.2919\.6700/ header __MO_OL_3D61D X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.71\.2244\.8/ header __MO_OL_465CD X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1506/ header __MO_OL_4B815 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.71\.2730\.2/ header __MO_OL_4BF4C X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4522\.1200/ header __MO_OL_4EEDB X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4963\.1700/ header __MO_OL_4F240 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1158/ header __MO_OL_58CB5 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4133\.2400/ header __MO_OL_5B79A X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.3790\.1830/ header __MO_OL_6554A X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2905/ header __MO_OL_72641 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1441/ header __MO_OL_7533E X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4963\.1700/ header __MO_OL_812FF X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4927\.1200/ header __MO_OL_83BF7 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.72\.3110\.3/ header __MO_OL_8627E X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1437/ header __MO_OL_8E893 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V10\.0\.2616/ header __MO_OL_91287 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.2300/ header __MO_OL_9B90B X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.1700/ header __MO_OL_A50F8 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4922\.1500/ header __MO_OL_A842E X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1441/ header __MO_OL_ADFF7 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1158/ header __MO_OL_B30D1 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.2300/ header __MO_OL_B4B40 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4133\.2400/ header __MO_OL_B9B11 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2462\.0000/ header __MO_OL_BC7E6 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4927\.1200/ header __MO_OL_C65FA X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.1700/ header __MO_OL_CAC8F X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.71\.1712\.3/ header __MO_OL_CF0C0 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.2300/ header __MO_OL_EF20B X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2180/ header __MO_OL_EF222 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2873/ header __MO_OL_F3B05 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1437/ header __MO_OL_F475E X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2741\.2600/ header __MO_OL_F6D01 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4522\.1200/ header __MO_OL_FF5C8 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2741\.2600/ header __MSGID_JAVAMAIL Message-ID =~ /\.JavaMail\./ tflags __MSGID_JAVAMAIL nice header __MSGID_VGA Message-ID =~ /^<000001c[67]/ header __MSOE_MID_WRONG_CASE ALL =~ /\nMessage-Id: / header __MUA_TBIRD User-Agent =~ /Thunderbird/ body __MY_FORTUNE /\b(?:my|his|her)\s(?:fortune|heritage)\b/i header __NAKED_TO To =~ /^[^\s<>]+\@[^\s<>]+$/ meta __NAME_EMAIL_DIFF __NAME_IS_EMAIL && ! __NAME_EQ_EMAIL header __NAME_EQ_EMAIL From:raw =~ /([\w+.-]+\@[\w.-]+\.\w\w+)["'`\s]*<\s*\1>/ header __NAME_IS_EMAIL From:raw =~ /\w\@[\w.-]+\.\w\w+["'`]*\s*<\w+\@\w/ body __NEXT_OF_KIN /\bnext[-\s]of[-\s]kin\b/i body __NIGERIA /\bnigeria\b/i body __NOT_DEAD_YET /\bwill\sinherit\b/i body __NOT_SCAM /\bnot\sa\sscam\b/i tflags __NOT_SPOOFED nice if ! plugin (Mail::SpamAssassin::Plugin::DKIM) if !plugin(Mail::SpamAssassin::Plugin::SPF) meta __NOT_SPOOFED __DKIM_EXISTS || !__LAST_EXTERNAL_RELAY_NO_AUTH || ALL_TRUSTED # no DKIM, no SPF. endif endif if ! plugin (Mail::SpamAssassin::Plugin::DKIM) ifplugin Mail::SpamAssassin::Plugin::SPF meta __NOT_SPOOFED SPF_PASS || __DKIM_EXISTS || !__LAST_EXTERNAL_RELAY_NO_AUTH || ALL_TRUSTED # no DKIM, yes SPF endif endif if !(! plugin (Mail::SpamAssassin::Plugin::DKIM)) if !plugin(Mail::SpamAssassin::Plugin::SPF) meta __NOT_SPOOFED DKIM_VALID || !__LAST_EXTERNAL_RELAY_NO_AUTH || ALL_TRUSTED # yes DKIM, no SPF endif endif if !(! plugin (Mail::SpamAssassin::Plugin::DKIM)) ifplugin Mail::SpamAssassin::Plugin::SPF meta __NOT_SPOOFED SPF_PASS || DKIM_VALID || !__LAST_EXTERNAL_RELAY_NO_AUTH || ALL_TRUSTED # yes DKIM, yes SPF endif endif meta __NO_INR_YES_REF (__XM_GNUS || __XM_MSOE5 || __XM_MSOE6 || __XM_MOZ4 || __XM_SKYRI || __XM_WWWMAIL || __UA_GNUS || __UA_KNODE || __UA_MUTT || __UA_PAN || __UA_XNEWS) header __NSL_ORIG_FROM_41 X-Originating-IP =~ /^(?:.+\[)?41\./ describe __NSL_ORIG_FROM_41 Originates from 41.0.0.0/8 header __NSL_RCVD_FROM_41 Received =~ /\[41\./ describe __NSL_RCVD_FROM_41 Received from 41.0.0.0/8 ifplugin Mail::SpamAssassin::Plugin::ImageInfo body __ONE_IMG eval:image_count('all',1,1) endif body __OUR_BEHALF /\bon\s(?:my|our)\sbehalf\b/i ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __PART_CID_STOCK_LESS Content-ID =~ /^<00[a-f0-9]{10}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[A-Za-z]+>$/ endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __PART_STOCK_CD_F Content-Disposition =~ /filename/ endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __PART_STOCK_CID Content-ID =~ /^<[a-f0-9]{12}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[^\s\.]+>$/ endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __PART_STOCK_CL Content-Location =~ /./ endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta __PCT_FOR_YOU __PCT_FOR_YOU_1 || __PCT_FOR_YOU_2 || __PCT_FOR_YOU_3 || T_SHARE_50_50 endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __PCT_FOR_YOU_1 /[\s)]{0,3}(?:of\s[\w\s]{0,35}?)?(?:for|to|as)\syour?/i endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __PCT_FOR_YOU_2 /\b(?:(?:give|offer)\syou|vous\saurez\sdroit\s[\xe0]|ihnen)\s/i endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __PCT_FOR_YOU_3 /\byour?\s(?!can)[\w\s]{6,20}?(?:(?:share|entitle|assist|comp[ea]nsate|reward|renumerate|paid|deduct|account|tage|keep)[\w\s]{1,25}?)?\s(?/i endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __PCT_OF_PMTS /[\s)]+(?:of\s[\w\s]{0,35}?)?of\s(?:the\s)?(?:payments?|rem+it+ances?|chec(?:k|que)s?)/i endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader meta __PDF_ATTACH (__PDF_ATTACH_MT || __PDF_ATTACH_FN1 || __PDF_ATTACH_FN2) endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __PDF_ATTACH_FN1 Content-Type =~ /="[^"]+\.pdf"/i endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __PDF_ATTACH_FN2 Content-Disposition =~ /="[^"]+\.pdf"/i endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __PDF_ATTACH_MT Content-Type =~ m,\bapplication/pdf\b,i endif if ! plugin (Mail::SpamAssassin::Plugin::OpenPGP) meta __PGP_INLINE ( __KHOP_PGP_I1 && __KHOP_PGP_I2 ) tflags __PGP_INLINE nice noautolearn endif if ! plugin (Mail::SpamAssassin::Plugin::OpenPGP) header __PGP_SIGNED Content-Type =~ /multipart\/signed;.*\/pgp-signature/s tflags __PGP_SIGNED nice noautolearn endif body __PHD /PhD/i if can(Mail::SpamAssassin::Conf::feature_bug6558_free) body __PILL_PRICE_01 m;(?=[\d .f])(?:free|[\d .]{3}(?:/|per|each)) ?(?=[ptc])(?:pill|tablet|cap(?:sule|let))s?\b;i tflags __PILL_PRICE_01 multiple endif if can(Mail::SpamAssassin::Conf::feature_bug6558_free) body __PILL_PRICE_02 /(?=[ptc])(?:pill|tablet|cap(?:sule|let))s[ :-]{1,5}\$?[\d .]{3}/i tflags __PILL_PRICE_02 multiple endif body __PLS_REVIEW /\b(?:please|kindly)\s(?:(?:re)?view|see)(?:\s\w+)?\sattach(?:ed|ment)\b/i ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # { ifplugin Mail::SpamAssassin::Plugin::ImageInfo mimeheader __PNG_ATTACH Content-Type =~ /^image\/png\b/i endif endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # { ifplugin Mail::SpamAssassin::Plugin::ImageInfo body __PNG_EXISTS eval:image_count('png',1) endif endif body __PREAPPROVEDFVGT /pre-approved/i body __RANDOM_PICK /\b(?:random(?:ly)?\s(?:\w+\s)?(?:select(?:ion|ed)|pick(?:ed)?|computer)|(?:select|pick)ed\s(?:at\s)?random(?:ly)?|(?:esco(?:g|lh)idos|seleccion) (?:aleatoria(?:mente)?|al azar))\b/i header __RATWARE_BOUND_A ALL =~ /^Message-Id: <....([0-9a-f]{8})\$[0-9a-f]{8}\$.{10,400}boundary="----=_NextPart_000_...._\1\./msi # " header __RATWARE_BOUND_B ALL =~ /boundary="----=_NextPart_000_...._([0-9a-f]{8})\..{10,400}^Message-Id: <....\1\$[0-9a-f]{8}\$/msi # " header __RCD_RDNS_MAIL_MESSY X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*mail/i header __RCD_RDNS_MTA_MESSY X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*mta/i header __RCD_RDNS_MX X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*\bmx[^a-z]/i header __RCD_RDNS_MX_MESSY X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*mx/ header __RCD_RDNS_SMTP_MESSY X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*smtp/ ifplugin Mail::SpamAssassin::Plugin::DNSEval header __RCVD_IN_BRBL eval:check_rbl('brbl','bb.barracudacentral.org') tflags __RCVD_IN_BRBL net endif ifplugin Mail::SpamAssassin::Plugin::DNSEval header __RCVD_IN_DNSWL eval:check_rbl('dnswl-firsttrusted', 'list.dnswl.org.') tflags __RCVD_IN_DNSWL nice net endif header __RDNS_NO_SUBDOM X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\.\w+ / header __REPLYTO_EXISTS exists:Reply-To if version >= 3.003000 ifplugin Mail::SpamAssassin::Plugin::WLBLEval header __RP_MATCHES_RCVD eval:check_mailfrom_matches_rcvd() endif endif header __S25R_1 X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\d[^0-9. ]+\d\S*\./ header __S25R_2 X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\d{5}/ header __S25R_3 X-Spam-Relays-External =~ /^[^\]]+ rdns=(?:[^. ]+\.)?\d[^. ]*\.[^. ]+\.\S+\.[a-z]/ header __S25R_4 X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\d\.[^. ]*\d-\d/ header __S25R_5 X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\d\.[^. ]*\d\.[^. ]+\.\S+\./ header __S25R_6 X-Spam-Relays-External =~ /^[^\]]+ rdns=(?:dhcp|dialup|ppp|[achrsvx]?dsl)[^. ]*\d/ body __SCAM /\bscam(?:m?e[dr])?s?\b/i body __SEEK_FRAUD_0ENSZN / within the next ten official working days/ body __SEEK_FRAUD_0KBZGH / I believe everyone will die someday\. My name is / body __SEEK_FRAUD_0OPFLV / this money will be used in an ungodly .a/ body __SEEK_FRAUD_0XNFH_ / to keep this information confidential from the public until your claim / body __SEEK_FRAUD_0YTF3I /ll email addresses entered for th.{0,3} promotional draws were randomly / body __SEEK_FRAUD_17TGPW /for the passed 7 months which ended . days ago/ body __SEEK_FRAUD_1HLDVM / in Europe, America, Africa and Asia .acific. / body __SEEK_FRAUD_1LWG1E /M depository made by a foreign investor / body __SEEK_FRAUD_1MXKDB /amily to close one of my accounts and distribute the money .hich/ body __SEEK_FRAUD_1OMKY9 / to be merciful to me and accept my soul/ body __SEEK_FRAUD_1Q42RI /requirements, statutory obligations, verification/ body __SEEK_FRAUD_1YKNCJ /On behalf of the Trustees and Executor of the .state of Late / body __SEEK_FRAUD_1Z81CI / MASTERPIECE POLICY HOLDER OWNERSHIP CLAIM/ body __SEEK_FRAUD_1_DZIV /led man, he must have been in contact with you in the past/ body __SEEK_FRAUD_27TPNC / as this is an illegal act and will have to stop if you / body __SEEK_FRAUD_2BLGLA /siness project from our bank worth US\$..\.5/ body __SEEK_FRAUD_2C0NY6 /nfortunately we learnt that all his supposed next/ body __SEEK_FRAUD_2DOBJR /in this regard because of my health hence / body __SEEK_FRAUD_2PPL8T /If you accept this offer, I will appreciate your timely response/ body __SEEK_FRAUD_2YLAPH / take out a moment of your very busy .chedule to/ body __SEEK_FRAUD_32EE0G /his mail might come to you as a surprise / body __SEEK_FRAUD_3MBUTP / of registered software and domain users/ body __SEEK_FRAUD_3NIFMV /confidential until you claim your prize\./ body __SEEK_FRAUD_3OPYSM /remium and Clearance Certificate Fee of the / body __SEEK_FRAUD_3WUO8K / through our SWIFT CARD PAYMENT CENT.. in Europe, America/ body __SEEK_FRAUD_3ZEWKC / contact me at once to indicate your .nterest/ body __SEEK_FRAUD_43CX5K / to the ownership of the Hong Kong Government if nobody / body __SEEK_FRAUD_45YXI4 /s after you have made the payment for shipping\./ body __SEEK_FRAUD_49FI4O /ants to serve the Lord must serve him in / body __SEEK_FRAUD_4HH4OS / by anybody to pay any other money except / body __SEEK_FRAUD_4KBBOJ /ow are you today\? Hope all is well with you and / body __SEEK_FRAUD_4NIRPA / processed and your prize released to you\./ body __SEEK_FRAUD_4O7OHH /elephone number\/your correct mailing address where you want / body __SEEK_FRAUD_4YVO5B /ed by an advanced automated random computer / body __SEEK_FRAUD_55WLGY /dvantage of you and they will dry you up until you have nothing\./ body __SEEK_FRAUD_58TQIN /Remember, all prize money must be claimed / body __SEEK_FRAUD_59PL1E /Below are few list of tracking numbers you can track / body __SEEK_FRAUD_5INAZF / will let you know how far I have gone with the arrangement\. / body __SEEK_FRAUD_5PW27G / in Bulgaria and Pakistan, they .efused and kept the money to them/ body __SEEK_FRAUD_65IS8I / into your bank account\. I intend to part / body __SEEK_FRAUD_68YEDU /e, because, I believe everyone will die someday\./ body __SEEK_FRAUD_6AN_A8 / to issue you international certified bank draft/ body __SEEK_FRAUD_6BI3C9 / payment center has been mandated to issue out / body __SEEK_FRAUD_6EGJH6 / the way I am going to instruct herein\./ body __SEEK_FRAUD_6KHCDD / and they will never know of this Excess\./ body __SEEK_FRAUD_6OI8QG /atrimonial home which the Bible is against\./ body __SEEK_FRAUD_6RGTYS /I have distributed ..n.. to some charity .rganizations in / body __SEEK_FRAUD_6SNWNT / your country for disbursement according t/ body __SEEK_FRAUD_6VUONK /to avoid any further delay and remember to pay the/ body __SEEK_FRAUD_6XGKRW / by non-participant or unofficial personnel\./ body __SEEK_FRAUD_75EPGH /now that there is more to life than just wanting to have or make all the .oney in the world\./ body __SEEK_FRAUD_75NRBF /But the whole process is simple and we must keep a low profile at all times\./ body __SEEK_FRAUD_7MKYRR / we are giving you a 100\% money back guarantee if you do not receive / body __SEEK_FRAUD_7SASLI /international passport or drivers license/ body __SEEK_FRAUD_84RQ6W /Let me repeat again, try to contact them / body __SEEK_FRAUD_87YD7W /is heart condition was due to the death of / body __SEEK_FRAUD_8802C6 / unnecessary delay in the receipt of your fund/ body __SEEK_FRAUD_8AR9FD /\. I AM WRITING IN RESPECT OF A FOREIGN CLIENT \[MASTERPIECE POLICYHOLDER\] OF THE ABOVE NAMED INSURANCE COMPANY \[ENGR\.WILLIAM F\. ABRAHAMSON OF AMERICA\] WHO PERISHED IN THE U\.S 9\/11\/2001,TERRORIST ATTACK WITH OTHER PASSENGERS ABOARD AS YOU ARE AWARE OF THIS FACT OR CAN CONFIRM IT YOURSELF\./ body __SEEK_FRAUD_8FUQE6 / About me, im just a very loving and caring girl and i want someone who is very honest and loving/ body __SEEK_FRAUD_8IOTQL /his and other reasons .{0,40} prompted me to reach out for help/ body __SEEK_FRAUD_8LRGPA / your Approval Slip which contains details o. / body __SEEK_FRAUD_8RBU5C / paid that but they said no because they do/ body __SEEK_FRAUD_8_YZA0 / you about the present arrangement to pay you/ body __SEEK_FRAUD_9HWDUP /So you are hereby strongly advised once more to keep your winnings strictly/ body __SEEK_FRAUD_9OJUVS /If your are interested,I have the sum of \$.{0,20}ollars created aside that I intended to invest in your country profitable\. So if you are capable to handle this transaction kindly get back to me to enable us discuss and workout the modalities\./ body __SEEK_FRAUD_9Q29S6 / stopped further payment through bank to bank transfer/ body __SEEK_FRAUD_9TSKUH /sion of your ATM CARD, you are hereby advi.e/ body __SEEK_FRAUD_A8CING / as part of our international promotions .rogram which .. conduct/ body __SEEK_FRAUD_AITBFD /ed to him by one of his numerous friends / body __SEEK_FRAUD_AJIUNF /\. Your own part of this deal is to find a safe place / body __SEEK_FRAUD_AK5MDQ / we were both born again Christians\. Since / body __SEEK_FRAUD_AKAEF9 /e said whoever is contacting us through emails .r/ body __SEEK_FRAUD_AKYCPN /t want them to know about this development\./ body __SEEK_FRAUD_ALAIKE / including taxes, custom paper and clearance duty/ body __SEEK_FRAUD_ALSZID / for their requirements to proceed and procure your Approval Slip on your behalf whi.. / body __SEEK_FRAUD_AM2BHX / foreign partner in a country of my choice where . w..l/ body __SEEK_FRAUD_AMZ2AH /About me if you want to know i just like honest people and i am a very loving girl / body __SEEK_FRAUD_AQGCND /secured medium of communication\. However, this correspondence is / body __SEEK_FRAUD_AUHBXT / lack of co-operation and not fulfilling the obligations giving to you in respect to your / body __SEEK_FRAUD_AXS4G6 /implore you to exercise the utmost indulgence to keep this matter extraordinary confidential. / body __SEEK_FRAUD_AZ117T / to boost the exercise of clearing all foreign debts owed to .{0,40}s and organizations who have been found not to have receive/ body __SEEK_FRAUD_AZ58ZB / because of impostors, we hereby issued you our/ body __SEEK_FRAUD_AZUWPQ / CARD PAYMENT CENTRE in Europe, America,/ body __SEEK_FRAUD_A_IQTC /DIRECTORATE OF INTERNATIONAL PAYMENT AND TRANSFER/ body __SEEK_FRAUD_B5_Q5F / and whereby you are not interested; please indicate in your reply so that I can seek for the assistance of someone else\./ body __SEEK_FRAUD_B9GHRP /t want you to feel sorry for me, because,/ body __SEEK_FRAUD_BBKOZZ / that any double claim discovered by the/ body __SEEK_FRAUD_BEAOXU / and assets to my immediate and .xtended family members / body __SEEK_FRAUD_BERTMT / due to the death of all the members of his family / body __SEEK_FRAUD_BGXWIY / as soon as you receive this important message/ body __SEEK_FRAUD_BHWNBP / barrels with piles of weapons and ammunition/ body __SEEK_FRAUD_BJUJI4 / was capable of assisting me in this great venture/ body __SEEK_FRAUD_BLDS9E / am delighted to inform you that the contract panel/ body __SEEK_FRAUD_BOG4XB /I hereby attempt to reach you again by this .ame email address / body __SEEK_FRAUD_BOGJJR /MY DATA: MY NAME: MISS NICHOLA ANDREA BUDHAN/ body __SEEK_FRAUD_BORYCZ /Courier Delivery Of your Certified Winning Cheque Name and other / body __SEEK_FRAUD_BPS76O / Christians\. Since his death I decided not to r/ body __SEEK_FRAUD_BPT9ZD /should there be any change of address do .nform / body __SEEK_FRAUD_BRNKW7 /f this business proposition offends your moral / body __SEEK_FRAUD_BSX___ / you at this stage is for you to provide me with your / body __SEEK_FRAUD_BUW_FJ / social responsibility to the citizens in the communities where they have operational base/ body __SEEK_FRAUD_C3BRTD / 30\% of this fund to you while 70\% shall be for me\. / body __SEEK_FRAUD_CCF1EW /\. This panel was primarily delegated .. / body __SEEK_FRAUD_CEXPEV / have successfully passed a mandate to the current / body __SEEK_FRAUD_CHLODJ / to enable us seeing this deal through\. I guarantee / body __SEEK_FRAUD_CIXFCH / your information you have to stop any further .ommunication with any/ body __SEEK_FRAUD_CJPQV1 /othing ventured is nothing gained and that success and riches never come easy or on a platter of gold/ body __SEEK_FRAUD_CKWDC_ /nd Monitory Crime Division\. Federal Bureau .f Investigation\./ body __SEEK_FRAUD_CN2CTT /All we require from you henceforth is an update / body __SEEK_FRAUD_CO9T0G / contact immediately the real office of / body __SEEK_FRAUD_CPHODZ / from my private banking clients\. Do not betray/ body __SEEK_FRAUD_CTPNAE / trying to get my payment all to no avail\./ body __SEEK_FRAUD_CVF7N_ / fax numbers and a forwarding address to enable .. file / body __SEEK_FRAUD_CYOVLC /pon your response, I shall then provide you with / body __SEEK_FRAUD_D04MXN / that will back you up as the next of kin / body __SEEK_FRAUD_D0SCQY /I contacted him and he explained everything to me/ body __SEEK_FRAUD_DA_SPN / to all the people that have been scammed in / body __SEEK_FRAUD_DDU0Y_ /e more to keep your winnings strictly confidential until/ body __SEEK_FRAUD_DE3CNN / Any prize not claimed within this period / body __SEEK_FRAUD_DE87LA /I will want you to help me collect this deposit and .i/ body __SEEK_FRAUD_DI5SMP /maintained\. The Bible made us to understand that / body __SEEK_FRAUD_DIIRM8 /With God all things are possible\. As soon as I / body __SEEK_FRAUD_DIPNHU /To file for your claim, please contact our fiduciary agent:/ body __SEEK_FRAUD_DNXWDS / has discovered a huge number of double claims due to ..n/ body __SEEK_FRAUD_DV9GWF /I have urgent and very confidential business propos/ body __SEEK_FRAUD_DWEVNF /ou for being part of our promotional lottery program/ body __SEEK_FRAUD_DXLGXY /If this proposal is acceptable by you, I expect that you will not take undue advantage of the trust I Will bestow .n you/ body __SEEK_FRAUD_D_URQY /MY HIGHEST CONSIDERATIONS AND REGARDS AS I AWAIT YOUR URGENT RESPONSE\./ body __SEEK_FRAUD_E1MR3Z / came to our bank to engage in business discussions with / body __SEEK_FRAUD_E2_QDF /I need your urgent assistance in transferring the / body __SEEK_FRAUD_E96NSG / representative in Nigeria, contact h.. / body __SEEK_FRAUD_EAHFYY /I would respectfully request that you keep the contents of this mail / body __SEEK_FRAUD_EBEPD_ /Please if I reach you as I am hopeful, endeavo/ body __SEEK_FRAUD_EBL4QT /\. I,m a single female medical\. I come from / body __SEEK_FRAUD_ECCV28 / processing and eventual payment of the above prize to you/ body __SEEK_FRAUD_EDORBJ / who almost held the fund to themselves for their selfish reason/ body __SEEK_FRAUD_EFET6T / for this same purpose\. Please assure me that you will act according/ body __SEEK_FRAUD_EFJ5G0 / will be effected to your designated home address without any further delay/ body __SEEK_FRAUD_EFYHRC / the bank, I cannot be directly connected to this money thus I am / body __SEEK_FRAUD_EHVE3Y / PERSONAL INSURANCE CASH ACCUMULATION MASTERPIECE POLICY/ body __SEEK_FRAUD_EJM0XB / with him at the plane crash leaving nobody behind .o/ body __SEEK_FRAUD_EQOQFJ / to his forwarding address but got no reply/ body __SEEK_FRAUD_ETTPUF / presence of my husband\'s relatives around me / body __SEEK_FRAUD_ETY7LT /s I never really cared for anyone\(not even myself\)/ body __SEEK_FRAUD_EVIVRH / was a very dedicated .hristian who loved to / body __SEEK_FRAUD_EXFYTU /ynthetic nylon seal and padded with machine/ body __SEEK_FRAUD_EYJYD5 /I will appreciate your early reply for commencement of business\./ body __SEEK_FRAUD_EYYR3G /SINCE THE DEMISE OF ENGR\.WILLIAM F\. ABRAHAMSON,/ body __SEEK_FRAUD_EZFEDE /: Telephone\/Fax number: Nationality: Age: Occupation:/ body __SEEK_FRAUD_F2OR8H / with the help of our Intelligence Monitoring Network System / body __SEEK_FRAUD_F5RHSQ / from my private banking clients. .o not betray/ body __SEEK_FRAUD_F6ZEVO / is not mandatory nor will I in any manner compel you to hono/ body __SEEK_FRAUD_F8VGZN /more, as they seem not to be contended with what I have / body __SEEK_FRAUD_FCF_6I /his is part of an instruction\/mandate passed by the / body __SEEK_FRAUD_FD5IJO /elvin Young of HSBC, Ben of FedEx, Ibrahim Sule,/ body __SEEK_FRAUD_FDV82D / I have the intention to invest in your home town but I don\'t know anybody that can help me to execute this plan when I come over to your country ,This is the simple reason I/ body __SEEK_FRAUD_FE742Q / be executed under legitimate arrangement that will protect you from any breach of / body __SEEK_FRAUD_FIWDJB /e do await your response so we can move on with / body __SEEK_FRAUD_FKRVOS /they refused and kept the money to themselves\./ body __SEEK_FRAUD_FLVC7O /mail address emerged as one of the online Winning emails in the / body __SEEK_FRAUD_FMJP2L / to charity organizations, as I want this to be one of the last good deeds I / body __SEEK_FRAUD_FNGZ_9 /used by unbelievers\. I don.t want a situation where this money will be used in/ body __SEEK_FRAUD_FNYQLN /He informed us that he had a financial portfolio .. / body __SEEK_FRAUD_FUHSU6 / years in our Bank here without any body coming for it\./ body __SEEK_FRAUD_G4RKKF / I want to inform you that I have successfully transferred the / body __SEEK_FRAUD_GFNFIK / that if such money remained unclaimed after / body __SEEK_FRAUD_GGXKDC / and confidentiality please contact me on my personal email address/ body __SEEK_FRAUD_GHC0LN / and subsequent disbursement since nobody / body __SEEK_FRAUD_GKQDW6 / Customers Service Hours \/ Monday To Saturday / body __SEEK_FRAUD_GMUT_1 /e informed that you are not allowed to correspond / body __SEEK_FRAUD_GRYB_A /t need any telephone communication in this / body __SEEK_FRAUD_GTSAAF / while in the US, trying to get my payment / body __SEEK_FRAUD_GVTOJY /propagating the word of God and to endeavor that the house of God is / body __SEEK_FRAUD_GWIW5T /contacting the card center by using it as your subject/ body __SEEK_FRAUD_H78OXL /ould live my life a different way from how . have .ived/ body __SEEK_FRAUD_H9VQEI / evidencing your claim purported to have been signed personally by you / body __SEEK_FRAUD_HDEE2F / to go into our Bank treasury as an abandoned fund. .o this is the reason why . contacted you, so that / body __SEEK_FRAUD_HDNX7F /used by unbelievers\. I don\'t want a situation where this money will be used in/ body __SEEK_FRAUD_HW7ENB /ssue a letter of authorization to somebody to receive it on my behalf / body __SEEK_FRAUD_HWE2G1 / and it was agreed by all party present t/ body __SEEK_FRAUD_HWMBYB / that failed due to Government problems / body __SEEK_FRAUD_HXXOMT /Therefore, we have contacted the Federal Ministry .f Finance / body __SEEK_FRAUD_I19BXK /his message might meet you in utmost .urprise/ body __SEEK_FRAUD_I3HLDY /m one of those that took part in the Compensation in / body __SEEK_FRAUD_IBU0WA /REMITTANCE OF US\$15,200,000\.00 CONFIDENTIAL IS THE CASE\./ body __SEEK_FRAUD_IBW3KJ / Drug Money or meant to sponsor Terroris. attack in your Country/ body __SEEK_FRAUD_IGL8BZ / part of our precautionary measure to avoid / body __SEEK_FRAUD_IG_EAL / Jonathan to boost the exercise of clearing all foreign debts owed to / body __SEEK_FRAUD_IQHXRD / any atom of fear as all required arrangements have been made for the / body __SEEK_FRAUD_IR89IB /e spun the money around various opportunities and made attractive margins for our first months of operation. / body __SEEK_FRAUD_IRYH8O / details and relevant documents that will help you / body __SEEK_FRAUD_IUMOXY /I was able to get the package out to a safe / body __SEEK_FRAUD_J1D82S / private, and it should be treated as such\./ body __SEEK_FRAUD_JAUOV6 /we noticed that the reason why you have not received your payment is because you have not fulfilled your .inancial .bligation given to you in respect of your .ontract/ body __SEEK_FRAUD_JGFD5P /This is a reward program for the patronage of internet services.? and all email addresses entered for th/ body __SEEK_FRAUD_JGGLPC /hey are not with your fund, .hey are only / body __SEEK_FRAUD_JGKWCZ /anel was primarily delegated to investigate / body __SEEK_FRAUD_JH0IMU /econd chance to come to this world I .ould live my life/ body __SEEK_FRAUD_JHIYQX / any member of his family hence I contacted you\./ body __SEEK_FRAUD_JJQFVB /I know within me that nothing ventured is / body __SEEK_FRAUD_JJTCEC /, none officials of Oceanic Bank, Zenith Banks, / body __SEEK_FRAUD_JMEGUU /e that no one except me knew of his deposit in my .ank\./ body __SEEK_FRAUD_JNQAA1 /contacting you, this have been agreed upon and have been signed\./ body __SEEK_FRAUD_JOFPVK / you without your prior consent and writing through this / body __SEEK_FRAUD_JQSWAX /I am seeking your assistance to evacuate the sum of/ body __SEEK_FRAUD_JSGI1K / now I seek your consent to present you as the/ body __SEEK_FRAUD_JTD4OO /Monday To Saturday Office Hours Monday .o Saturday/ body __SEEK_FRAUD_JYBGOP / showed at the course of the transaction I / body __SEEK_FRAUD_JZFBVG / at once with all the claims requirements / body __SEEK_FRAUD_K0Z_G7 / sent a routine notification to his forward/ body __SEEK_FRAUD_K1G7F9 /I believe when God gives me a .econd chance/ body __SEEK_FRAUD_KAXALL / agent will immediately commence the process to facilitate the release of your / body __SEEK_FRAUD_KB6SDS /ontact the processing office immediately upon receipt of this message/ body __SEEK_FRAUD_KEP1L_ /ed all forms of medical treatment, and right now I have only about a few months to live. / body __SEEK_FRAUD_KJCQBN /our identity such as, international .assport or driver/ body __SEEK_FRAUD_KKQM9L /choose to reach you through it because it / body __SEEK_FRAUD_KM_YXP / have the opportunity of transferring the left over .unds/ body __SEEK_FRAUD_KXDZWV /ntelligence Monitoring Network System that you / body __SEEK_FRAUD_L2F6_R / will put you in place as the next of kin\. The Attorney will draft and / body __SEEK_FRAUD_LC7TDH /man on earth because I have received my / body __SEEK_FRAUD_LFNI27 /15,860 000\.00 \[FIFTEEN MILLION EIGHT HUNDRED AND SIXTY THOUSAND POUNDS STERLING\] ONLY, EXITING WITH THE INSURANCE COMPANY WHEN ADDED UP THE FOLLOWING BONUS: BASIC ALLOWANCE, WAIVER PREMIUM AND ACCIDENTAL INDEMNITY, WHICH HAS BEEN WITH THE INSURANCE COMPANY FOR A VERY LONG TIME UNCLAIMED\./ body __SEEK_FRAUD_LHMFUQ /their contract sum, and people that have had an/ body __SEEK_FRAUD_LHPW8G / as part of their social responsibility / body __SEEK_FRAUD_LHZDJ_ / that has remained dormant for years now\. / body __SEEK_FRAUD_LOG1TG / in this matter until the task is accomplish/ body __SEEK_FRAUD_LPKLJU / no body came forward all these years\. I/ body __SEEK_FRAUD_LP_GQ9 /The above figure was given to me as my share/ body __SEEK_FRAUD_LTD1IZ / did not declare any next of kin in his official papers including the paper/ body __SEEK_FRAUD_LUOISR / was a member of the Helicopter Society and the Institute of Electronic \& Electrical Engineers/ body __SEEK_FRAUD_LUSJPG / and make sure your ATM SWIFT CARD gets to you\./ body __SEEK_FRAUD_LV_HB6 / or rather issue a letter of .uthorization to some.o.. / body __SEEK_FRAUD_LXBIXJ /is WILL is now ready for execution\. According to him this money is to / body __SEEK_FRAUD_LYNJ8F / was conducted from an exclusive list of / body __SEEK_FRAUD_LYS3UM /I want you and the church to always pray for me/ body __SEEK_FRAUD_M8T_DX / so we could act upon and commence investigation\./ body __SEEK_FRAUD_M8ZJ86 /who will accompany the boxes to your house / body __SEEK_FRAUD_MA4WWH / people that are active online, among the millions that subscribed to / body __SEEK_FRAUD_MCEI6K / from public notice until your claim has been / body __SEEK_FRAUD_MCWOGJ / of the Google search engine and the Google ancillary/ body __SEEK_FRAUD_MEFC9A /ue to your lack of co-operation and not fulfilling the / body __SEEK_FRAUD_MFX2AC /The National Central Bureau of Interpol enhanced by the U/ body __SEEK_FRAUD_MHAKVX / and some individuals who have taken advantage of your fund all in an attempt to swindle your fund which has led to / body __SEEK_FRAUD_MHDF0X /e took me to the paying bank for the claim of my Compensation payment/ body __SEEK_FRAUD_MHMBRT / of your fiscal activity, we have determined that you are eligible to receive a tax refund/ body __SEEK_FRAUD_MIDFZQ / declared to them as the contents is Sensitive Photographic Film Material. / body __SEEK_FRAUD_MLFHRU / COMPENSATION UNIT, IN AFFILIATION WITH / body __SEEK_FRAUD_MOD_74 /Thanks and God bless you and your family\. Hoping to hear from you as..o/ body __SEEK_FRAUD_MOT82J /Anti-Terrorist And Monitory Crime Division\./ body __SEEK_FRAUD_MPY_VV /, but can only be approved to a foreigner\. If you will stand as next of kin to the fund, it will be shared 50\%\/50\%/ body __SEEK_FRAUD_MSZKFU /ed to stop dealing with some non-officials in the bank/ body __SEEK_FRAUD_MUHJKV /t is my duty to write and reach out to you/ body __SEEK_FRAUD_MVD_UL / and your Certificate of Merit Payment No/ body __SEEK_FRAUD_MWUIJQ / confidential till your claims is processed and your / body __SEEK_FRAUD_MXSTN1 / Development Bank of Singapore \(DBS\)\. . / body __SEEK_FRAUD_MY06YR /the lord will fight my case and I shall hold my peace/ body __SEEK_FRAUD_MZ4KU4 / prepare the necessary documents and affidavit/ body __SEEK_FRAUD_N7NCI8 / unnecessary delays and complications, please / body __SEEK_FRAUD_NBYKUF / transaction of this magnitude will make any/ body __SEEK_FRAUD_NEK_SA /I have already submitted an approved end/ body __SEEK_FRAUD_NEZYJA / and his WILL is now ready for execution/ body __SEEK_FRAUD_NLVNRE /u and then you and me can share the money/ body __SEEK_FRAUD_NM1G_Z / you because you bear the surname identity / body __SEEK_FRAUD_NRTQUK / and to conceal this kind of money became a problem for me, so with the help of a / body __SEEK_FRAUD_NR_I4S / already been worked out even before you were contacted.{0,20} note that we will be monitoring all your ..a/ body __SEEK_FRAUD_NS3JMI /by warned not to communicate or duplicate this message to / body __SEEK_FRAUD_NV1HR9 /My dear friend I will like you to contact / body __SEEK_FRAUD_NZYMII / and show my gratitude to you with the sum / body __SEEK_FRAUD_NZYXPO / Insurance premium and Clearance Certificate/ body __SEEK_FRAUD_O3_VB8 / electronic balloting .ystem without the winner/ body __SEEK_FRAUD_O9Z_CI / relation died alongside with him .. the plane crash leaving nobody behind .o/ body __SEEK_FRAUD_OBKXT3 / own direction as I never knew you before nor have we meet in any where before but may God.? name be praised for his ways are not like the ways of men, for he is perfect and never miss leads his loved ones\./ body __SEEK_FRAUD_OCO1GZ /s that will help you understand the transaction\. I need your assistance and co-operation to this reality/ body __SEEK_FRAUD_OHDPXP /ly lost their lives\. Since then I have made several/ body __SEEK_FRAUD_OHRGMW /or example submitting invalid records or applying after / body __SEEK_FRAUD_OO8I_O / surprise to receive this message from complete stranger / body __SEEK_FRAUD_OPAU37 /d over-invoiced payment as the effect has eaten deep into the economy of our / body __SEEK_FRAUD_ORHOZJ /Due to your effort, sincerity, courage and trust/ body __SEEK_FRAUD_OS7__X /y from any ATM MACHINE CENTER anywhere in the world/ body __SEEK_FRAUD_OSPVFG / will be executed and also note that you will / body __SEEK_FRAUD_OUKYFQ /corporate bodies picked by an advanced automated/ body __SEEK_FRAUD_OVKMST /isregard any email you get from any impostors or offices claiming to be in posses/ body __SEEK_FRAUD_OW6PZN / this medium \(Internet\) has been greatly abused, I/ body __SEEK_FRAUD_OWUEYF / within our European booklet representative/ body __SEEK_FRAUD_OZ6FMP / to avoid any hitches in receiving your / body __SEEK_FRAUD_P8F86E /Economic and Financial Crimes Commission/ body __SEEK_FRAUD_P8JJBS / category and therefore attracted a cash award of / body __SEEK_FRAUD_P8Y20W /This Lottery was promoted and sponsored by / body __SEEK_FRAUD_P8ZIB5 /fficially inform you that it has come to our notice and we have / body __SEEK_FRAUD_PBZBDQ /I must use this opportunity to implore you to exercise the utmost indulgence to keep this matter extraordinar/ body __SEEK_FRAUD_PDDLNK /sure that this fund is not wasted or end/ body __SEEK_FRAUD_PIVB38 /e sickness\. Having known my condition I decided to / body __SEEK_FRAUD_PKVKI1 /I send you this mail not without a measure of fear as to / body __SEEK_FRAUD_PLK7HH / life of my family at stake with this venture\. Although nothing ventured / body __SEEK_FRAUD_POSXKO / bank account\. The ATM card comes with a handbook or manual to enlighten you about how to use it\./ body __SEEK_FRAUD_PPIYVM /after the war another notification was sent and still no response came from/ body __SEEK_FRAUD_PTJZLE /As a result of this, these friends try to claim/ body __SEEK_FRAUD_PURFZB /I am writing to solicit your assistance .. / body __SEEK_FRAUD_PWBOPK /am contacting you to know if you can be able to assist me in championing this venture to the best of our benefit\./ body __SEEK_FRAUD_PXHWDT /he UNITED NATIONS have agreed to compensate them / body __SEEK_FRAUD_Q3UEYG /After the last annual calculations of your fiscal activity/ body __SEEK_FRAUD_Q4PFFF / law and guideline here stipulates that if such money .emain/ body __SEEK_FRAUD_QA7MN5 /information confidential till your claim/ body __SEEK_FRAUD_QDBCS4 /I did not declare money to them please\. If they call you and .sk you the contents please tell them the same thing/ body __SEEK_FRAUD_QHXUIZ / Pacific, which is the instruction given by / body __SEEK_FRAUD_QILOIM /e necessary documentations evidencing your claim purported to have been signed / body __SEEK_FRAUD_QJAXMZ / your full house address and your identity such as,/ body __SEEK_FRAUD_QJE0YJ /and people that have had an unfinished transaction or/ body __SEEK_FRAUD_QNKQRV /divine wish and accept it with a deep sense of humility/ body __SEEK_FRAUD_QNKXRT /\*This message was transferred with a trial version of CommuniGate\(/ body __SEEK_FRAUD_QR3CL9 /PRINCIPAL PARTNERS: Barrister Aidan Walsh\.Esq M/ body __SEEK_FRAUD_QRRCLD / successfully transferred into your account, / body __SEEK_FRAUD_QU7ENV / is your honest co-operation to enable us see/ body __SEEK_FRAUD_QXDEYO /As a matter of fact, you are required to Deal and Communicate only / body __SEEK_FRAUD_QYJ0F_ / understand that blessed is the hand that / body __SEEK_FRAUD_R2403I / health and because of the presence of my / body __SEEK_FRAUD_R3R2VE /gger made you a beneficiary to his WILL\. He left the sum of Thirty Million, One Hundred Thousand Dollars \(USD\$30, 100\.000\.00\) to you in the Codicil and last testament to his WILL\./ body __SEEK_FRAUD_R8MXKM /I was always hostile to people and only focused on my business as that was the only thing I cared for/ body __SEEK_FRAUD_RBMZ20 / As this is a TWO-man business deal transaction\./ body __SEEK_FRAUD_RDGS_R / in all his official documents, including his .ank .eposit paper/ body __SEEK_FRAUD_RERCVT / is still reflecting .n our .entral .omputer/ body __SEEK_FRAUD_RF_LD1 / and to conceal this kind of money became a problem for me.{0,40} contact working / body __SEEK_FRAUD_RGENNC /A winning .heque will be issued in your name / body __SEEK_FRAUD_RQRFPM / which you will use to withdraw up to \$.{0,40} per day from any ATM machine that has the ..s/ body __SEEK_FRAUD_RXQMYQ /Hence we do believe with your winning prize, you/ body __SEEK_FRAUD_RZTEYR /of one of my bank clients who died .long with his entire family .. / body __SEEK_FRAUD_R_Y6KV / talk and my doctors have told me that I have / body __SEEK_FRAUD_S0K3GF /s and organizations who have been found not to have receive their Contract/ body __SEEK_FRAUD_S2TCCV / that you are having an illegal Transaction with / body __SEEK_FRAUD_S4QI3T / respect the integrity of the information you come by as a result of this / body __SEEK_FRAUD_S5PJZQ /fter further investigation it was also discovered that / body __SEEK_FRAUD_S8_5Y8 / that you will not expose or betray this trust and confident that . am about to / body __SEEK_FRAUD_SBLZOX /o you via our accredited shipping company / body __SEEK_FRAUD_SF0AZL / on your behalf and they have brought a solution to your problem by co/ body __SEEK_FRAUD_SIBZHA / for the collection of this international .ertified .ank / body __SEEK_FRAUD_SIYSH8 / to always pray for me because the lord is my / body __SEEK_FRAUD_SLAG8H /I once again try to notify you as my earlier letter/ body __SEEK_FRAUD_SMTAYP / the full information of those that are yet to receive their payments and I saw your / body __SEEK_FRAUD_SNZJVQ / be liquidated because he needed to make an urgent investment requiring cash payments/ body __SEEK_FRAUD_SOMTJG /, this correspondence is purely private,/ body __SEEK_FRAUD_SRT80U / to you as the nearest person to our deceased customer/ body __SEEK_FRAUD_SUGRCM /now I have only about a few months to live, according to medical experts\./ body __SEEK_FRAUD_SWKNYQ / to confirm people like you who have received their / body __SEEK_FRAUD_TCEBVN / further contact with them in your best interest and / body __SEEK_FRAUD_TFENYE /I know that I am going to be in the bosom of the Lord\. Exodus/ body __SEEK_FRAUD_TGDRMF /\. Please I will like you to accept this token with good faith as this is from the bottom of my heart/ body __SEEK_FRAUD_THHLIU /Winners shall be paid in accordance with / body __SEEK_FRAUD_TK7ZE5 /usiness as that was the only thing I cared for\. But .ow I regret all this as I / body __SEEK_FRAUD_TKBHOI /urther communication with anybody or office/ body __SEEK_FRAUD_TPKDA7 / to avoid double claiming and unwarranted / body __SEEK_FRAUD_TTMYIZ /istributed money to some charity .rganizations in / body __SEEK_FRAUD_TZ3TUV /ny delay in your reply will give me room in sourcing another/ body __SEEK_FRAUD_U1G4IL /FORGIVE MY INDIGNATION IF THIS MESSAGE COMES TO YOU AS A SURPRISE AND MAY OFFEND YOUR PERSONALITY FOR CONTACTING YOU WITHOUT YOUR PRIOR CONSENT AND/ body __SEEK_FRAUD_U5U5GZ /s was mentioned by one of the .yndicates/ body __SEEK_FRAUD_U5YTAO /Against this backdrop, my suggestion to you is that . w..l/ body __SEEK_FRAUD_UBE1VZ /ve 40\% of the above mentioned amount if you agree to help me execute this / body __SEEK_FRAUD_UCSJVN / from his account unless someone applies for/ body __SEEK_FRAUD_UD45OB / might come to you as a surprise and the temptation to/ body __SEEK_FRAUD_UDD6SD /you are hereby advice only to be in contact with / body __SEEK_FRAUD_UF2Q_4 /election process was carried out through / body __SEEK_FRAUD_UJZKNM /I will like you to provide immediately your full .ame/ body __SEEK_FRAUD_UKLYHN /00 per day from any ATM machine that has the Master Card Logo on it/ body __SEEK_FRAUD_UL0ICM /e were also made to understand that a lady / body __SEEK_FRAUD_UMXZKW / if this message comes to you as a surprise / body __SEEK_FRAUD_US_OFW /hilanthropy earned him numerous awards during his life/ body __SEEK_FRAUD_UV2ATY /I have set aside 25\% for you and for your time/ body __SEEK_FRAUD_UVARBX / in Nigeria many years ago and they refused to pay me. I had paid / body __SEEK_FRAUD_UVOSIY /r to get back to me as soon as possible to enable me conclude my job/ body __SEEK_FRAUD_UVUS_Y /Please submit the tax refund request and allow / body __SEEK_FRAUD_V3CKGD /documents and letter of probate\/administration in your favo/ body __SEEK_FRAUD_V51UD0 / will appreciate your utmost confidentiality .n/ body __SEEK_FRAUD_V5HTKT / family to close one of my accounts and / body __SEEK_FRAUD_VBHSSM /claims due to .{0,20}s informing close friends / body __SEEK_FRAUD_VBQ9JO /this, these friends try to claim the lottery on behalf of the real/ body __SEEK_FRAUD_VKZHQG /aving received these vital payment number/ body __SEEK_FRAUD_VMKU09 / has called me, I have willed and given .ost of my propert/ body __SEEK_FRAUD_VNERKN /I was never generous, I was always hostile to people and only focus/ body __SEEK_FRAUD_VQGIG6 / includes every foreign contractors that may/ body __SEEK_FRAUD_VSMRB_ /http:\/\/news\.bbc\.co\.uk\/2\/hi\/middle_east\/2988455\.stm/ body __SEEK_FRAUD_VW0Z64 /WRITING THROUGH THIS CHANNEL\.I GOT YOUR CONTACT FROM A PROFESSIONAL DATABASE FOUND ON THE INTERNET WHILE SEARCHING FOR A RELIABLE AND HONEST PERSON THAT WILL ASSIST ME TO SAFE GUARD/ body __SEEK_FRAUD_VWUGC4 / Canada, Australia, United States, Asia, Europe, Middle East, / body __SEEK_FRAUD_WAAEJ8 /s your moral values, do accept my apology/ body __SEEK_FRAUD_WC2DJX /I PERSONALLY HAVE WATCHED WITH KEEN INTEREST TO SEE THE BENEFICIARY TO HIS MASTERPIECE POLICYHOLDER, BUT ALL HAS PROVED ABORTIVE AS NO ONE HAS REPORTED TO CLAIM HIS BENEFIT OF \[PERSONAL INSURANCE CASH ACCUMULATION MASTERPIECE POLICYHOLDER OWNERSHIP\] OF TOTAL SUM AMOUNTING TO / body __SEEK_FRAUD_WGFD9Y /I will appreciate your timely response\./ body __SEEK_FRAUD_WJ_B8R / PAYMENT and forward any emails you get from / body __SEEK_FRAUD_WOZDRE /iplomatic immunity clearance .ertificate/ body __SEEK_FRAUD_WPB12A / does not know the original contents of the boxes\./ body __SEEK_FRAUD_WX939W /Congratulations from the Staffs \& Members of the / body __SEEK_FRAUD_WYVOGD / and is organized to encourage the use of the Internet / body __SEEK_FRAUD_WZCO5O / file letter of claim to the appropriate/ body __SEEK_FRAUD_X1E2EB / to come over and claim his money because we can/ body __SEEK_FRAUD_XBDIGO /ot trust them anymore, as they seem not to be .onte/ body __SEEK_FRAUD_XD3U8U / disbursement according to .he percentage/ body __SEEK_FRAUD_XDLBLQ / Please forgive this unusual manner .. contact/ body __SEEK_FRAUD_XEKWPO /ank deposit\. And he also confided in me the last time he was .. my..f/ body __SEEK_FRAUD_XGEQEE / relation or next of kin .. the deceased/ body __SEEK_FRAUD_XI2Y6Z /FEDERAL BUREAU OF INVESTIGATION FBI\.WASHINGTON D/ body __SEEK_FRAUD_XJPS4J /ssure me that you will act accordingly as I / body __SEEK_FRAUD_XJUWAF /The request of foreigner as next of kin in this / body __SEEK_FRAUD_XKEW24 / that will protect you and I from any breach of the law\./ body __SEEK_FRAUD_XL24FM / FEDERAL BUREAU OF INVESTIGATION UNITED STATES DEPARTMENT OF JUSTICE WASHINGTON, D\.C\. 20535/ body __SEEK_FRAUD_XLYR4B /if you want me to forward you my picture or facebook id please mail me at my direct personal id / body __SEEK_FRAUD_XMTGXX /It is understandable that you might be a little bit apprehensive because you do not know me/ body __SEEK_FRAUD_XNCCWK / activities and to help the poor and the needy in our society\./ body __SEEK_FRAUD_XNFRMH /\(2\) Address where you want the payment cent.. to send your ATM CARD/ body __SEEK_FRAUD_XNGIGX / I have been diagnosed with Esophageal cancer \./ body __SEEK_FRAUD_XOG2QH / you should not entertain any atom of fear a. / body __SEEK_FRAUD_XV0VCM / contains details of the agent who will process your transaction/ body __SEEK_FRAUD_XVM0G_ /ill make any one apprehensive and worried, but I/ body __SEEK_FRAUD_XXKDNE /During our Investigation, we noticed that the reason why you have not received your payment is because you / body __SEEK_FRAUD_XY_KVM / will be safe in your care until I complete my service here/ body __SEEK_FRAUD_Y1JTCA /hat my health has deteriorated so badly,/ body __SEEK_FRAUD_Y6I2KV / to observe utmost discretion in all matters concerning this ..s/ body __SEEK_FRAUD_Y6P5MJ / contacting us through emails are fake\./ body __SEEK_FRAUD_Y6WUAZ /ourt probate division for the release of this .u/ body __SEEK_FRAUD_YELH8F / were selected randomly from World Wide / body __SEEK_FRAUD_YGGJHJ / and promote computer literacy worldwide\./ body __SEEK_FRAUD_YGQR5E / keep your winning information confidential / body __SEEK_FRAUD_YJCYR4 / next of kin in this business is occasioned by the fact that the / body __SEEK_FRAUD_YKISUY / foreign partner that made me to contact you/ body __SEEK_FRAUD_YMNO86 / to themselves\. Hence, I do not trust them any/ body __SEEK_FRAUD_YRLEBH /INSPIRED TO PICK YOUR NAME AMONG ALL OTHER NAMES FOUND IN THE DATABASE\./ body __SEEK_FRAUD_YXZMUG / remains the fastest, surest and most secured medium of communication\./ body __SEEK_FRAUD_YY0T6P / I am impelled to request for your assistance to receive this ..n.. into your bank account/ body __SEEK_FRAUD_Z9HI0T / and forward any emails you get from impostors to / body __SEEK_FRAUD_ZA0FLG /Do Not Reply to this Email\. We do not reply to text inquiries, and our server will reject all response traffic\. We apologize for any inconvenience this may have caused you\./ body __SEEK_FRAUD_ZARJER / to avoid unnecessary delay and complications/ body __SEEK_FRAUD_ZBJZVN / who is the rightful person to deal with in regards to your / body __SEEK_FRAUD_ZFT05W /We wish to congratulate you once again on this note, for being part of our/ body __SEEK_FRAUD_ZG9WSB / of your fiscal activity we have determined that you are eligible to receive a tax re/ body __SEEK_FRAUD_ZGRQSU / need you to assist me in executing a business project from / body __SEEK_FRAUD_ZG_66A /lmighty that connects people and makes out of them whatsoever he desires, and this my having to write you in the first place regarding this / body __SEEK_FRAUD_ZIZCXR /he explained everything to me\. He said whoever is/ body __SEEK_FRAUD_ZLALWU / per transaction\. So, if you like to receive your fund this way,/ body __SEEK_FRAUD_ZMC3N_ /A foreigner with thesame last name as yours, died here in Singapore, twelve years ago leaving behind an estate\/capital \(US\$31\.8M/ body __SEEK_FRAUD_ZMFYMV /Furthermore, should there be any change .. / body __SEEK_FRAUD_ZMITTF /This may sound strange and unbelievable to you/ body __SEEK_FRAUD_ZNPZ7V /Winners are advised to keep their winning / body __SEEK_FRAUD_ZOHUL3 / need to stress that there are practically no risk involved in this\. It is going to be a bank-to-bank transfer to your nominated bank account anywhere you feel / body __SEEK_FRAUD_ZTOV4F / COPY OF YOUR INT\'L PASSPORT\/DRIVERS LICENSE/ body __SEEK_FRAUD_ZWACFE /ou have to be rest assured for this is 100\% risk free it is our duty to protect / body __SEEK_FRAUD_ZXVMN_ /wait your prompt response\. Yours in Service/ body __SEEK_FRAUD_ZYDQF_ / to contact the ATM CARD CENTER via email / body __SEEK_FRAUD_ZZVKMO /international businesses that failed due to/ body __SEEK_FRAUD_ZZZGAR / your FULL NAME, DATE OF BIRTH, TELEPHONE NUMBER, FAX NUMBER/ body __SEEK_FRAUD__2H_ZF /I have not particularly lived my life so well,/ body __SEEK_FRAUD__2JC4J / as I have done my Home-work and fine tune the best way to create you as the beneficiary of the fund\. My position as the branch manager of the bank will be used to advance this deal\./ body __SEEK_FRAUD__39VBB /ur foreign customer who died along .i.. / body __SEEK_FRAUD__3AQGB /, we have resolved in .inding a solution to / body __SEEK_FRAUD__7JU9T / humanitarian activities and to help the poor and the needy in / body __SEEK_FRAUD__8R822 /nce I know where I am going\. I know that I am going to be in the bosom of / body __SEEK_FRAUD__9IDPT /hall be paid in accordance with his\/her Settlement Cent..\. / body __SEEK_FRAUD__BQIMV /hat disturbs me most is my stroke sickness\./ body __SEEK_FRAUD__ERENB /Confirm the receipt of this message and send the requirements to me immediately / body __SEEK_FRAUD__EWXDD /Since the Federal Bureau of Investigation / body __SEEK_FRAUD__GBFFZ / of the Central Bank Of Nigeria, Mr\. Patrick Aziza, / body __SEEK_FRAUD__IHT37 /t release it unless somebody applie. for it/ body __SEEK_FRAUD__J8HKJ /This promotion was set-up to encourage the/ body __SEEK_FRAUD__JQVGM /For security reasons, you are advised to keep your / body __SEEK_FRAUD__KUHHN / the way I am going to instruct here in\./ body __SEEK_FRAUD__KYBSV / the cancer stage has gotten to a very bad stage\./ body __SEEK_FRAUD__OPQTY / have recently been informed through our .lobal intelligence monitoring network that you/ body __SEEK_FRAUD__R9RUV / I, working with you can secure the funds in the account for us instead of allowing / body __SEEK_FRAUD__SGKIK /as I want this to be one of the last good deeds I do on earth\./ body __SEEK_FRAUD__VYNLD / through random selection .n .ur .omputerized/ body __SEEK_FRAUD__Y9XPU /ON THIS VERY NOTE; AS NO ONE HAS COME TO PUT UP ANY CLAIM REPORT TO OUR OFFICE AS REGARDS TO THE BENEFICIARY TO THE MASTERPIECE POLICYHOLDER OWNERSHIP AND THE INSURANCE ETHIC HERE IN THE UK, REGULATED BY THE FINANCIAL SERVICE AUTHORITY \(FSA\) RULES FOR THE CONDUCT OF UK BUSINESS, INSURANCE CODE AND BUSINESS INSURANCE CODE STANDARDS OF WHICH CHUBB INSURANCE COMPANY IS A MEMB.?ER OF THE FINANCIAL OMBUDSMAN SCHEME\. DOES NOT ALLOW SUCH CLAIM TO STAY FOR OVER MORE THAN MANY YEARS, BECAUSE THE COMPANY SHALL HAVE POWER AFTER TEN GOOD YEARS TO DISCONTINUE THE POLICY AND TERMINATE THE INSURED MASTERPIECE POLICYHOLDER OWNERSHIP BENEFITS\./ body __SEEK_FRAUD___VYVJ /You really have to stop dealing with those people that are contacting you and telling you that your fund is with them/ header __SENDER_BOT ALL =~ /(?:not?\W?repl[yi]|bounce|contact|daemon|subscri|report|respon[ds]e?r?s?\b|\b(?:root|news|nobody|agent|(?:post|web)?master|manag|send(?:er|ing)?|out|(?:bot|web|www)\b))[^\@ >]{0,5}s?\@\w/i tflags __SENDER_BOT nice meta __SEX_WRDS (__WORD_SEX || __WORD_CUM || __WORD_SPERM || __WORD_SLUTS || __WORD_RAPED) body __SHARE_IT /\b(?:(?:share|allocate|teilen|parteger(?:ez|ons)?|partage)\s(?:th(?:e|is)|das|les?|des)\s(?:proceeds|funds?|money|balance|account|geld|compte|fonds)|partager(?:ez|ons)? (?:avec (?:vous|moi)|ratio|suivant un pourcentage))\b/i header __SINGLE_HEADER_1K ALL:raw =~ /(?-xim:(?=(?!X-Spam|X-MailScan)(?:^|\n)[^\s\n]+:(?:.(?!\n\S)){1024,2047}.(?:\n\S|$)))/s rawbody __SPAN_BEG_TEXT /[a-z]{2}<(?i:span)\s/ tflags __SPAN_BEG_TEXT multiple rawbody __SPAN_END_TEXT /[^;>]<\/(?i:span)>[a-z]{3}/ tflags __SPAN_END_TEXT multiple meta __SPF_FULL_PASS (SPF_PASS && SPF_HELO_PASS) tflags __SPF_FULL_PASS net rawbody __SPOOFED_URL m/]{0,99}\bhref=(?:3D)?.?(https?:[^>"' ]{8,30})[^>]{0,99}>(?:[^<]{0,99}<(?!\/a)[^>]{1,99}>)*(?!\1)https?:\/\/[^<]{5}/i rawbody __STYLE_GIBBERISH /]{0,30}>(?:\s{0,80}[^\s:;<]){150}/im header __SUBJ_3DIGIT Subject =~ /\b\d{3}[^0-9]/ header __SUBJ_APPROVE Subject =~ /Approve/i header __SUBJ_HAS_FROM_1 ALL =~ /\nFrom:\s+(?:[^\n<]{0,80}<)?([^\n\s>]+)>?\n(?:[^\n]{1,100}\n)*Subject:\s+[^\n]{0,100}\1[>,\s\n]/ism header __SUBJ_HAS_TO_1 ALL =~ /\nTo:\s+(?:[^\n<]{0,80}<)?([^\n\s>,]+)>?\n(?:[^\n]{1,100}\n)*Subject:\s+[^\n]{0,100}\1[>,\s\n]/ism header __SUBJ_RE Subject =~ /^R[eE]:/ header __SUBJ_VEGAS Subject =~ /(?:Vegas|Casino)/i body __SUBSCRIPTION_INFO /\b(?:e?newsletters?|(?:un)?(?:subscrib|register)|you(?:r| are) subscri(?:b|ption)|opt(?:.|ing)?out\b|further info|you do ?n[o']t w(?:ish|ant)|remov\w{1,3}.{1,9}\blists?\b|to your white.?list)/i body __SUM_OF_FUND /\b(?:sum|release|freigabe)\s(?:of|der)\s(?:amount|fund|investment|mittel)\b/i body __SURVIVORS /\b(?:widow|son|daughter|husband|wife|brother|sister|attorney)\s(?:of|to)\s(?:the\s)?late\s\w+\b/i header __TB_MIME_BDRY_NO_Z Content-Type =~ /boundary="-{8,}(?:[1-9]){16}/ body __THEY_INHERIT /\binherit\sth(?:e|is)\smoney\b/i meta __THREADED (!__MISSING_REPLY && !__NO_INR_YES_REF) || (__MISSING_REPLY && !__MISSING_REF) tflags __THREADED nice header __THREAD_INDEX_GOOD Thread-Index =~ m,^A[a-z0-9][A-Za-z0-9+/]{27}(?:[A-Za-z0-9+/]{20})?(?:[AQgw]==|[A-Za-z0-9+/]{7}|[A-Za-z0-9+/]{13}[AEIMQUYcgkosw048]=)$, header __TO_ALL_NUMS To:addr =~ /^\d+@/ meta __TO_EQ_FM_DIRECT_MX __TO_EQ_FROM && __DOS_DIRECT_TO_MX meta __TO_EQ_FM_DOM_HTML_IMG __TO_EQ_FROM_DOM && __HTML_LINK_IMAGE meta __TO_EQ_FM_DOM_HTML_ONLY __TO_EQ_FROM_DOM && MIME_HTML_ONLY meta __TO_EQ_FM_DOM_SPF_FAIL __TO_EQ_FROM_DOM && SPF_FAIL tflags __TO_EQ_FM_DOM_SPF_FAIL net meta __TO_EQ_FM_HTML_DIRECT __TO_EQ_FM_DIRECT_MX && MIME_HTML_ONLY meta __TO_EQ_FM_HTML_ONLY __TO_EQ_FROM && MIME_HTML_ONLY meta __TO_EQ_FM_SPF_FAIL __TO_EQ_FROM && SPF_FAIL tflags __TO_EQ_FM_SPF_FAIL net meta __TO_EQ_FROM (__TO_EQ_FROM_1 || __TO_EQ_FROM_2) describe __TO_EQ_FROM To: same as From: header __TO_EQ_FROM_1 ALL =~ /\nFrom:\s+(?:[^\n<]{0,80}<)?([^\n\s>]+)>?\n(?:[^\n]{1,100}\n)*To:\s+(?:[^\n]{0,80}<)?\1[>,\s\n]/ism header __TO_EQ_FROM_2 ALL =~ /\nTo:\s+(?:[^\n<]{0,80}<)?([^\n\s>]+)>?\n(?:[^\n]{1,100}\n)*From:\s+(?:[^\n]{0,80}<)?\1[>,\s\n]/ism meta __TO_EQ_FROM_DOM (__TO_EQ_FROM_DOM_1 || __TO_EQ_FROM_DOM_2) describe __TO_EQ_FROM_DOM To: domain same as From: domain header __TO_EQ_FROM_DOM_1 ALL =~ /\nFrom:\s+[^\n@]{0,80}@([^\n\s>]+)>?\n(?:[^\n]{1,100}\n)*To:\s+[^\n]+@\1[>,\s\n]/ism header __TO_EQ_FROM_DOM_2 ALL =~ /\nTo:\s+[^\n@]{0,80}@([^\n\s>]+)>?\n(?:[^\n]{1,100}\n)*From:\s+[^\n]+@\1[>,\s\n]/ism header __TO_NO_ARROWS_R To !~ /(?:>$|>,)/ meta __TO_NO_BRKTS_DYNIP __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && RDNS_DYNAMIC meta __TO_NO_BRKTS_FROM_MSSP __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && __FROM_MISSPACED meta __TO_NO_BRKTS_HTML_ONLY __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && MIME_HTML_ONLY meta __TO_NO_BRKTS_MSFT __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && (__ANY_OUTLOOK_MUA || __HAS_MIMEOLE || __MIMEOLE_MS) meta __TO_NO_BRKTS_NORDNS __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && RDNS_NONE meta __TO_NO_BRKTS_NORDNS_HTML __TO_NO_BRKTS_HTML_ONLY && RDNS_NONE header __TO_UNDISCLOSED To =~ /(?:undisclosed-recipients|destinataires inconnus):/i header __TO___LOWER ALL =~ /to:\s\S{5}/ body __TRTMT_DEFILED /\bdefiled\sall\s(?:forms\sof\s)?(?:medical\s)treatments?\b/i body __TRUNK_BOX /\b(?:(?:trunk|metallic|proof|security|consignment)\sbox(?:es)?|sealed\ssafe)\b/i body __TRUSTED_CHECK /\b(?:cashier'?s?|certified)\sche(?:ck|que)/i header __TT_BROKEN_VALIUM Subject =~ /V[:^."%()*\[\\]?A[:^."%()*\[\\]?L[:^."%()*\[\\]?I[:^."%()*\[\\]?U[:^."%()*\[\\]?M/i header __TT_BROKEN_VIAGRA Subject =~ /V[:^."%()*\[\\]?I[:^."%()*\[\\]?A[:^."%()*\[\\]?G[:^."%()*\[\\]?R[:^."%()*\[\\]?A/i header __TT_OBSCURED_VALIUM Subject =~ /(v|V|\\\/)(a|A|\(a\)|4|@)(l|L|\|)(i|I|1|\xef|\|)(u|U|\(u\))(m|M)/ header __TT_OBSCURED_VIAGRA Subject =~ /(v|V|\\\/)(i|I|1|\xef|\|)(a|A|\(a\)|4|@)(g|G)(r|R)(a|A|\(a\)|4|@)/ header __TT_VALIUM Subject =~ /VALIUM/i header __TT_VIAGRA Subject =~ /VIAGRA/i ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __TVD_FW_GRAPHIC_ID1 Content-Id =~ /<[0-9a-f]{12}(?:\$[0-9a-f]{8}){2}\@/ endif ifplugin Mail::SpamAssassin::Plugin::MIMEEval mimeheader __TVD_MIME_ATT_AOPDF Content-Type =~ /^application\/octet-stream.*\.pdf/i endif ifplugin Mail::SpamAssassin::Plugin::MIMEEval mimeheader __TVD_MIME_ATT_AP Content-Type =~ /^application\/pdf/i endif ifplugin Mail::SpamAssassin::Plugin::MIMEEval mimeheader __TVD_MIME_ATT_TP Content-Type =~ /^text\/plain/i endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __TVD_OUTLOOK_IMG Content-Id =~ /