# SpamAssassin rules file # # Please don't modify this file as your changes will be overwritten with # the next update. Use @@LOCAL_RULES_DIR@@/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # # ########################################################################### require_version @@VERSION@@ ##{ APOSTROPHE_FROM header APOSTROPHE_FROM From:addr =~ /'/ describe APOSTROPHE_FROM From address contains an apostrophe ##} APOSTROPHE_FROM ##{ AXB_HELO_HOME_UN header AXB_HELO_HOME_UN X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\w+\.(lan|home) /i describe AXB_HELO_HOME_UN HELO from home - untrusted ##} AXB_HELO_HOME_UN ##{ AXB_XMID_1212 header AXB_XMID_1212 Message-Id =~ /^<[0-9]{12}\.[0-9]{12}\@/ describe AXB_XMID_1212 Barbera Fingerprint ##} AXB_XMID_1212 ##{ AXB_XMID_1510 header AXB_XMID_1510 Message-Id =~ /<[0-9A-F]{15}\.[0-9A-F]{10}\@/ describe AXB_XMID_1510 Brunello Fingerprint ##} AXB_XMID_1510 ##{ AXB_XMID_OEGOESNULL header AXB_XMID_OEGOESNULL Message-ID =~ /^<[0-9-a-f]{12}\$[0-9-a-f]{8}\$[0]{8}\@/ describe AXB_XMID_OEGOESNULL Amarone Fingerprint ##} AXB_XMID_OEGOESNULL ##{ AXB_XM_SENDMAIL_NOT header AXB_XM_SENDMAIL_NOT Received =~ /\([123456790]{1,2}\.[0-9]{1,2}\.[0-9]{1}\/[0-9]{1,2}\.[0-9]{2}\.[0-9]{1}\)/ describe AXB_XM_SENDMAIL_NOT Nebbiolo fingerprint ##} AXB_XM_SENDMAIL_NOT ##{ AXB_XR_STULDAP header AXB_XR_STULDAP Received =~ /\(8\.12\.3 da nor stuldap\/8\.12\.3\)/ ##} AXB_XR_STULDAP ##{ BANKING_LAWS body BANKING_LAWS /banking laws/i describe BANKING_LAWS Talks about banking laws ##} BANKING_LAWS ##{ BASE64_LENGTH_78_79 ifplugin Mail::SpamAssassin::Plugin::MIMEEval body BASE64_LENGTH_78_79 eval:check_base64_length('78','79') endif ##} BASE64_LENGTH_78_79 ##{ BASE64_LENGTH_79_INF ifplugin Mail::SpamAssassin::Plugin::MIMEEval body BASE64_LENGTH_79_INF eval:check_base64_length('79') endif ##} BASE64_LENGTH_79_INF ##{ BUG6152_INVALID_DATE_TZ_ABSURD header BUG6152_INVALID_DATE_TZ_ABSURD Date =~ /[-+](?!(?:0\d|1[0-4])(?:[03]0|[14]5))\d{4}/ ##} BUG6152_INVALID_DATE_TZ_ABSURD ##{ CORRUPT_FROM_LINE_IN_HDRS meta CORRUPT_FROM_LINE_IN_HDRS (MISSING_HEADERS && __BODY_STARTS_WITH_FROM_LINE && MISSING_DATE && NO_RELAYS) describe CORRUPT_FROM_LINE_IN_HDRS Informational: message is corrupt, with a From line in its headers tflags CORRUPT_FROM_LINE_IN_HDRS userconf publish #score CORRUPT_FROM_LINE_IN_HDRS 0.001 ##} CORRUPT_FROM_LINE_IN_HDRS ##{ CTYPE_001C_A meta CTYPE_001C_A (0) # obsolete ##} CTYPE_001C_A ##{ CTYPE_001C_B header CTYPE_001C_B Content-Type =~ /multipart.{0,200}boundary=\"----=_NextPart_000_0000_01C[0-9A-F]{5}\.[0-9A-F]{7}0\"/ ##} CTYPE_001C_B ##{ CTYPE_8SPACE_GIF ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader CTYPE_8SPACE_GIF Content-Type:raw =~ /^image\/gif;\n {8}name=\".+?\"$/s describe CTYPE_8SPACE_GIF Stock spam image part 'Content-Type' found (8 spc) endif ##} CTYPE_8SPACE_GIF ##{ CURR_PRICE body CURR_PRICE /\bCurrent Price:/ ##} CURR_PRICE ##{ DEAR_BENEFICIARY body DEAR_BENEFICIARY /^\s?(?:Dear\s|At+(?:ention|n):?\s?)Beneficiary\b/i describe DEAR_BENEFICIARY Dear Beneficiary: #score DEAR_BENEFICIARY 2.0 ##} DEAR_BENEFICIARY ##{ DEAR_EMAIL body DEAR_EMAIL /^\s*Dear\b.{0,70}\w\@\w/i describe DEAR_EMAIL Message contains Dear email address ##} DEAR_EMAIL ##{ DEAR_WINNER body DEAR_WINNER /\bdear.{1,20}winner/i ##} DEAR_WINNER ##{ DOS_ANAL_SPAM_MAILER header DOS_ANAL_SPAM_MAILER X-mailer =~ /^[A-Z][a-z]{6}e \d\.\d{2}$/ describe DOS_ANAL_SPAM_MAILER X-mailer pattern common to anal porn site spam tflags DOS_ANAL_SPAM_MAILER publish ##} DOS_ANAL_SPAM_MAILER ##{ DOS_FIX_MY_URI meta DOS_FIX_MY_URI __MIMEOLE_1106 && __DOS_HAS_ANY_URI && __DOS_SINGLE_EXT_RELAY && __DOS_HI && __DOS_LINK describe DOS_FIX_MY_URI Looks like a "fix my obfu'd URI please" spam ##} DOS_FIX_MY_URI ##{ DOS_HIGHBIT_HDRS_BODY meta DOS_HIGHBIT_HDRS_BODY __FROM_NEEDS_MIME && __SUBJECT_ENCODED_B64 && __FROM_ENCODED_B64 && __SUBJECT_NEEDS_MIME && __HIGHBITS describe DOS_HIGHBIT_HDRS_BODY Headers need encoding and body is highbit ##} DOS_HIGHBIT_HDRS_BODY ##{ DOS_HIGH_BAT_TO_MX meta DOS_HIGH_BAT_TO_MX __DOS_DIRECT_TO_MX && __HIGHBITS && __LAST_UNTRUSTED_RELAY_NO_AUTH && __THEBAT_MUA describe DOS_HIGH_BAT_TO_MX The Bat! Direct to MX with High Bits ##} DOS_HIGH_BAT_TO_MX ##{ DOS_LET_GO_JOB meta DOS_LET_GO_JOB __DOS_LET_GO_JOB && __DOS_MY_OLD_JOB && __DOS_I_DRIVE_A && __DOS_TAKING_HOME describe DOS_LET_GO_JOB Let go from their job and now makes lots of dough! ##} DOS_LET_GO_JOB ##{ DOS_OE_TO_MX meta DOS_OE_TO_MX __OE_MUA && __DOS_DIRECT_TO_MX && !DOS_OE_TO_MX_IMAGE describe DOS_OE_TO_MX Delivered direct to MX with OE headers ##} DOS_OE_TO_MX ##{ DOS_OE_TO_MX_IMAGE meta DOS_OE_TO_MX_IMAGE __OE_MUA && __DOS_DIRECT_TO_MX && __ANY_IMAGE_ATTACH describe DOS_OE_TO_MX_IMAGE Direct to MX with OE headers and an image ##} DOS_OE_TO_MX_IMAGE ##{ DOS_OUTLOOK_TO_MX meta DOS_OUTLOOK_TO_MX __ANY_OUTLOOK_MUA && !__OE_MUA && __DOS_DIRECT_TO_MX && !T_DOS_OUTLOOK_TO_MX_IMAGE describe DOS_OUTLOOK_TO_MX Delivered direct to MX with Outlook headers ##} DOS_OUTLOOK_TO_MX ##{ DOS_RCVD_IP_TWICE_C header DOS_RCVD_IP_TWICE_C X-Spam-Relays-External =~ /^\s*\[ ip=(?!127)([\d.]+) [^\[]*\bhelo=(?:![\d.]{7,15}!)? [^\[]*\[ ip=\1 [^\]]*\]\s*$/ describe DOS_RCVD_IP_TWICE_C Received from the same IP twice in a row (only one external relay; empty or IP helo) ##} DOS_RCVD_IP_TWICE_C ##{ DOS_STOCK_BAT meta DOS_STOCK_BAT __THEBAT_MUA && (__DOS_BODY_STOCK || __DOS_BODY_TICKER) && (__DOS_REF_TODAY || __DOS_REF_NEXT_WK_DAY || __DOS_REF_2_WK_DAYS) describe DOS_STOCK_BAT Probable pump and dump stock spam ##} DOS_STOCK_BAT ##{ DOS_STOCK_BAT2 meta DOS_STOCK_BAT2 DOS_STOCK_BAT && (__DOS_FIN_ADVANTAGE + __DOS_STRONG_CF + __DOS_STEADY_COURSE > 2) ##} DOS_STOCK_BAT2 ##{ DOS_URI_ASTERISK uri DOS_URI_ASTERISK m{^[Hh][Tt]{2}[Pp][Ss]?://[^/:]+(?:\*[A-Za-z0-9-]*\.|\*)[A-Za-z]{2,3}(?:\.[A-Za-z]{2})?(?:$|:|/)} describe DOS_URI_ASTERISK Found an asterisk in a URI ##} DOS_URI_ASTERISK ##{ DOS_YOUR_PLACE meta DOS_YOUR_PLACE (__DOS_COMING_TO_YOUR_PLACE && __DOS_MEET_EACH_OTHER && (__DOS_DROP_ME_A_LINE || __DOS_CORRESPOND_EMAIL || __DOS_EMAIL_DIRECTLY || __DOS_I_AM_25 || __DOS_WRITE_ME_AT || __DOS_PERSONAL_EMAIL)) describe DOS_YOUR_PLACE Russian dating spam ##} DOS_YOUR_PLACE ##{ DRUGS_HDIA header DRUGS_HDIA Subject =~ /\bhoodia\b/i ##} DRUGS_HDIA ##{ DRUGS_STOCK_MIMEOLE meta DRUGS_STOCK_MIMEOLE (__MIMEOLE_1106 && __MAILER_OL_5510) describe DRUGS_STOCK_MIMEOLE Stock-spam forged headers found (5510) ##} DRUGS_STOCK_MIMEOLE ##{ DYN_RDNS_AND_INLINE_IMAGE meta DYN_RDNS_AND_INLINE_IMAGE (RDNS_DYNAMIC && __ANY_IMAGE_ATTACH) describe DYN_RDNS_AND_INLINE_IMAGE Contains image, and was sent by dynamic rDNS ##} DYN_RDNS_AND_INLINE_IMAGE ##{ DYN_RDNS_SHORT_HELO_HTML meta DYN_RDNS_SHORT_HELO_HTML (__HELO_NO_DOMAIN && RDNS_DYNAMIC && HTML_MESSAGE) describe DYN_RDNS_SHORT_HELO_HTML Sent by dynamic rDNS, short HELO, and HTML ##} DYN_RDNS_SHORT_HELO_HTML ##{ DYN_RDNS_SHORT_HELO_IMAGE meta DYN_RDNS_SHORT_HELO_IMAGE (__HELO_NO_DOMAIN && RDNS_DYNAMIC && __ANY_IMAGE_ATTACH) describe DYN_RDNS_SHORT_HELO_IMAGE Short HELO string, dynamic rDNS, inline image ##} DYN_RDNS_SHORT_HELO_IMAGE ##{ FAKE_REPLY_C meta FAKE_REPLY_C (__SUBJ_RE && __MISSING_REF && __NO_INR_YES_REF) ##} FAKE_REPLY_C ##{ FB_ADD_INCHES body FB_ADD_INCHES /(?:add|gain) inches/i describe FB_ADD_INCHES Add / Gain inches ##} FB_ADD_INCHES ##{ FB_ALMOST_SEX body FB_ALMOST_SEX /\b[b-z]sex+\b/i describe FB_ALMOST_SEX It's almost sex, but not! ##} FB_ALMOST_SEX ##{ FB_ANA_TRIM body FB_ANA_TRIM /Ana[^a-z]trim/i describe FB_ANA_TRIM Broken AnaTrim phrase. ##} FB_ANA_TRIM ##{ FB_ANUI body FB_ANUI /A[-_\.]U[-_\.]N[-_\.]I/i describe FB_ANUI Phrase: A_U_N_I ##} FB_ANUI ##{ FB_BILLI0N body FB_BILLI0N /[BM][I1]LL[I1]0N/i describe FB_BILLI0N Phrase: [BM]Illi0n ##} FB_BILLI0N ##{ FB_C0MPANY body FB_C0MPANY /c0mpany/i describe FB_C0MPANY Phrase: C0mpany ##} FB_C0MPANY ##{ FB_CAN_LONGER body FB_CAN_LONGER /can last longer/i describe FB_CAN_LONGER Phrase: can last longer ##} FB_CAN_LONGER ##{ FB_CIALIS_LEO3 body FB_CIALIS_LEO3 /(?!CIALIS)\bC\s?[a-z]?\s?[Iitl1\\\/]\s?[a-z]?\s?[Aa]\s?[a-z]?\s?[LIl1\\\/]\s?[a-z]?\s?[ilIt1\\\/]\s?[a-z]?\s?[Ss]\b/ describe FB_CIALIS_LEO3 Uses a mis-spelled version of cialis. ##} FB_CIALIS_LEO3 ##{ FB_DOUBLE_0WORDS body FB_DOUBLE_0WORDS /\b[a-z]{1,5}0[a-z]{3,9}\s[a-z]{1,5}0[a-z]{3,9}\b/i describe FB_DOUBLE_0WORDS Looks like double 0 words ##} FB_DOUBLE_0WORDS ##{ FB_EMAIL_HIER body FB_EMAIL_HIER /email hier/i describe FB_EMAIL_HIER Phrase: email hier ##} FB_EMAIL_HIER ##{ FB_EXTRA_INCHES body FB_EXTRA_INCHES /extra inches/ describe FB_EXTRA_INCHES Phrase: extra inches ##} FB_EXTRA_INCHES ##{ FB_FAKE_NUMBERS body FB_FAKE_NUMBERS /\$\d\d?O\s*[MBT]/i describe FB_FAKE_NUMBERS Looks like numbers with O's insted of 0's ##} FB_FAKE_NUMBERS ##{ FB_FAKE_NUMS4 body FB_FAKE_NUMS4 /(?:\b|\b\d)\d,?\d,?OO(?:\b|\d\b)/ describe FB_FAKE_NUMS4 Looks like fake numbers (4) ##} FB_FAKE_NUMS4 ##{ FB_FHARMACY body FB_FHARMACY /Fharmacy/i describe FB_FHARMACY Phrase: Farmacy ##} FB_FHARMACY ##{ FB_FORWARD_LOOK body FB_FORWARD_LOOK /(?!forward look)f[o0]rward l[0o][0o]k/i describe FB_FORWARD_LOOK Phrase: forward look with 0's ##} FB_FORWARD_LOOK ##{ FB_GAPPY_ADDRESS body FB_GAPPY_ADDRESS /(?:[a-z] ){8}, (?:[a-z0-9] ){4}/i describe FB_GAPPY_ADDRESS Too much spacing in Address ##} FB_GAPPY_ADDRESS ##{ FB_GET_MEDS body FB_GET_MEDS /(?:place f[o0]r|[0o]rder|get\s?(?:y[o0]ur)?|online|quality).{1,7}med[isz][^a]/i describe FB_GET_MEDS Looks like trying to sell meds ##} FB_GET_MEDS ##{ FB_GVR body FB_GVR /(?:pef-rx|vigrex-ds|gsc-100|vp-rx|gv-promax|phentermine|adipex|xenical)/i describe FB_GVR Looks like generic viagra ##} FB_GVR ##{ FB_HEY_BRO_COMMA body FB_HEY_BRO_COMMA /Hey bro, / describe FB_HEY_BRO_COMMA Phrase hey bro, ##} FB_HEY_BRO_COMMA ##{ FB_HG_H_CAP body FB_HG_H_CAP /\bHGH\b/ describe FB_HG_H_CAP Phrase: HGH ##} FB_HG_H_CAP ##{ FB_HOMELOAN body FB_HOMELOAN /\$\d{3},\d{3} home loan/i describe FB_HOMELOAN Phrase $x home loan ##} FB_HOMELOAN ##{ FB_IMPRESS_GIRL body FB_IMPRESS_GIRL /\bimpress .{0,5}girl\b/ describe FB_IMPRESS_GIRL Phrase: impress ... girl ##} FB_IMPRESS_GIRL ##{ FB_INCREASE_YOUR body FB_INCREASE_YOUR /Increase your energy/i describe FB_INCREASE_YOUR Phrase: Increase your energy ##} FB_INCREASE_YOUR ##{ FB_INDEPEND_RWD body FB_INDEPEND_RWD /independent reward/i describe FB_INDEPEND_RWD Phrase: independent reward ##} FB_INDEPEND_RWD ##{ FB_L0AN body FB_L0AN /\bl0ans?\b/i describe FB_L0AN Phrase: L0an ##} FB_L0AN ##{ FB_LETTERS_21B body FB_LETTERS_21B /-- [a-z]{21}/ describe FB_LETTERS_21B Special people leave special signs! ##} FB_LETTERS_21B ##{ FB_LOSE_WEIGHT_CAP body FB_LOSE_WEIGHT_CAP /LOSE WEIGHT/ describe FB_LOSE_WEIGHT_CAP Phrase: LOSE WEIGHT ##} FB_LOSE_WEIGHT_CAP ##{ FB_LOWER_PAYM body FB_LOWER_PAYM /lower your monthly payments/i describe FB_LOWER_PAYM Phrase: lower your monthly payments ##} FB_LOWER_PAYM ##{ FB_MORE_SIZE body FB_MORE_SIZE /\bmore size\b/ describe FB_MORE_SIZE Phrase: more size ##} FB_MORE_SIZE ##{ FB_NOT_PHONE_NUM1 body FB_NOT_PHONE_NUM1 /(?!\d{3})8(?:66|77|88|[0o][0o])[-\.\s\)]{1,3}[OIL0-9]{3}[-\.\s]/i describe FB_NOT_PHONE_NUM1 Looks like a fake phone number (1) ##} FB_NOT_PHONE_NUM1 ##{ FB_NOT_PHONE_NUM3 body FB_NOT_PHONE_NUM3 /8(?:66|77|88|[0o][0o])[-\.\s\)]{1,3}[OIL0-9]{3}[-\.\s]{1,3}(?!\d{4})[OIL0-9]{4}/i describe FB_NOT_PHONE_NUM3 Looks like a fake phone number (3) ##} FB_NOT_PHONE_NUM3 ##{ FB_NOT_SCHOOL body FB_NOT_SCHOOL /(?!school)[\$s5]ch[o0][o0][il1\|]/i describe FB_NOT_SCHOOL Looks like school but it's not! ##} FB_NOT_SCHOOL ##{ FB_NO_SCRIP_NEEDED body FB_NO_SCRIP_NEEDED /No.{1,10}P(?:er|re)scr[i1]pt[i1][o0]n (?:needed|requ[1i]re)/i describe FB_NO_SCRIP_NEEDED Phrase: no prescription needed. ##} FB_NO_SCRIP_NEEDED ##{ FB_NUMYO body FB_NUMYO /1[0-9][\s\.]?y[\s\.]?o[\s\.]?\b/i describe FB_NUMYO Speaks of teenager. ##} FB_NUMYO ##{ FB_NUMYO2 body FB_NUMYO2 /2[0-9][\s\.]?y[\s\.]?o[\s\.]?\b/i describe FB_NUMYO2 Speaks of 20+ year old. ##} FB_NUMYO2 ##{ FB_ODD_SPACED_MONEY body FB_ODD_SPACED_MONEY /\$\d\s,\s\d\d/ describe FB_ODD_SPACED_MONEY Looks like money but has odd spacing. ##} FB_ODD_SPACED_MONEY ##{ FB_ONIINE body FB_ONIINE /oniine/i describe FB_ONIINE Mis-spelled online ##} FB_ONIINE ##{ FB_P1LL body FB_P1LL /\bp1ll/i describe FB_P1LL Phrase: p1ll ##} FB_P1LL ##{ FB_PENIS_GROWTH body FB_PENIS_GROWTH /pen[i1]s grow(?:th)?/i describe FB_PENIS_GROWTH Phrase: penis growth ##} FB_PENIS_GROWTH ##{ FB_PIPEDOLLAR body FB_PIPEDOLLAR /(?!dollar)d[o0][1|li][1|li]ar/i describe FB_PIPEDOLLAR Phrase: Dollar, with pipes or 0's. ##} FB_PIPEDOLLAR ##{ FB_PIPE_ILLION body FB_PIPE_ILLION /(?!illion)i[l|][l|][i|][o0]n/i describe FB_PIPE_ILLION Looks like illion, but it's not ##} FB_PIPE_ILLION ##{ FB_PROLONGED_HARD body FB_PROLONGED_HARD /(?:prolonged|increased) hardness/i describe FB_PROLONGED_HARD Talks about prolonged hardness ##} FB_PROLONGED_HARD ##{ FB_QUALITY_REPLICA body FB_QUALITY_REPLICA /quality replica/i describe FB_QUALITY_REPLICA Phrase: quality replica ##} FB_QUALITY_REPLICA ##{ FB_REF_CODE_SPACE body FB_REF_CODE_SPACE /r e f c o d e/i describe FB_REF_CODE_SPACE Refcode with spacing ##} FB_REF_CODE_SPACE ##{ FB_REPLICA_ROLEX body FB_REPLICA_ROLEX /replica rolex/i describe FB_REPLICA_ROLEX Phrase: Replica Rolex ##} FB_REPLICA_ROLEX ##{ FB_REPLIC_CAP body FB_REPLIC_CAP /REPLICAS?\b/ describe FB_REPLIC_CAP Phrase: REPLICA ##} FB_REPLIC_CAP ##{ FB_RE_FI body FB_RE_FI /\bre[^a-z]fi\b/ describe FB_RE_FI Looks like refi. ##} FB_RE_FI ##{ FB_ROLLER_IS_T body FB_ROLLER_IS_T /Roller is th/i describe FB_ROLLER_IS_T Phrase: Roller is th ##} FB_ROLLER_IS_T ##{ FB_ROLX body FB_ROLX /\brolx\b/i describe FB_ROLX Phrase: rolx ##} FB_ROLX ##{ FB_SAVE_PERSC body FB_SAVE_PERSC /sav(?:e|ing).{1,45}p[re][re]scr[i1]pt[i1][o0]n/i describe FB_SAVE_PERSC Phrase: save ... prescription. ##} FB_SAVE_PERSC ##{ FB_SOFTTABS body FB_SOFTTABS /\bsoft\s?t?abs\b/i describe FB_SOFTTABS Phrase: Softabs ##} FB_SOFTTABS ##{ FB_SPACED_FREE body FB_SPACED_FREE /F R E E/i describe FB_SPACED_FREE Phrase: F R E E ##} FB_SPACED_FREE ##{ FB_SPACED_PHN_3B body FB_SPACED_PHN_3B /\d\d\d--\d\d\d--?\d\d\d\d/ describe FB_SPACED_PHN_3B Phone number with -- spacing. (B) ##} FB_SPACED_PHN_3B ##{ FB_SPACEY_ZIP body FB_SPACEY_ZIP /\s\d\s\d\s\d\s\d\s\d\s-\s\d\s\d\s\d\s\d/ describe FB_SPACEY_ZIP Looks like a s p a c e d zipcode. ##} FB_SPACEY_ZIP ##{ FB_SPUR_M body FB_SPUR_M /\bSPUR-M\b/i describe FB_SPUR_M Phrase: SPUR-M ##} FB_SPUR_M ##{ FB_SSEX body FB_SSEX /\bssex\b/ describe FB_SSEX Phrase: ssex ##} FB_SSEX ##{ FB_STOCK_EXPLODE body FB_STOCK_EXPLODE /st[0o]ck\b.{4,10}expl[o0]de/i describe FB_STOCK_EXPLODE Looks like stocks exploding. ##} FB_STOCK_EXPLODE ##{ FB_SYMBLO body FB_SYMBLO /\bSymblo\b/i describe FB_SYMBLO Mis-spelled symbol. ##} FB_SYMBLO ##{ FB_THIS_ADVERT body FB_THIS_ADVERT /this advertiser/i describe FB_THIS_ADVERT Phrase: this advertiser ##} FB_THIS_ADVERT ##{ FB_THOUS_PERSONAL body FB_THOUS_PERSONAL /thousand personal/i describe FB_THOUS_PERSONAL Phrase: thousand personal ##} FB_THOUS_PERSONAL ##{ FB_TO_STOP_DISTRO body FB_TO_STOP_DISTRO /To (?:(?:stop further|longer get) distribution|stop (?:receiving )?announcements)/i describe FB_TO_STOP_DISTRO Phrase: to stop further distribution ##} FB_TO_STOP_DISTRO ##{ FB_ULTRA_ALLURE body FB_ULTRA_ALLURE /Ultra Allure/i describe FB_ULTRA_ALLURE Phrase: Ultra Allure ##} FB_ULTRA_ALLURE ##{ FB_UNLOCK_YOUR_G body FB_UNLOCK_YOUR_G /lock ?(?:to ?)? your girlfriend/i describe FB_UNLOCK_YOUR_G Phrase: lock to your girlfriend ##} FB_UNLOCK_YOUR_G ##{ FB_UNRESOLV_PROV body FB_UNRESOLV_PROV /\{PROV_\d_\d\}/ describe FB_UNRESOLV_PROV Pattern Replacement PROV_D ##} FB_UNRESOLV_PROV ##{ FB_YOURSELF_MASTER body FB_YOURSELF_MASTER /yourself master/i describe FB_YOURSELF_MASTER Phrase: yourself master ##} FB_YOURSELF_MASTER ##{ FB_YOUR_REFI body FB_YOUR_REFI /Your refi/i describe FB_YOUR_REFI Phrase: Your refi ##} FB_YOUR_REFI ##{ FH_BAD_OEV1441 header FH_BAD_OEV1441 X-Mailer =~ /^Microsoft Outlook Express 6\.00\.2800\.1441$/ describe FH_BAD_OEV1441 Bad X-Mailer version ##} FH_BAD_OEV1441 ##{ FH_DATE_IS_19XX header FH_DATE_IS_19XX Date =~ /19[789][0-9]/ [if-unset: 2006] describe FH_DATE_IS_19XX The date is not 19xx. ##} FH_DATE_IS_19XX ##{ FH_FAKE_RCVD_LINE header FH_FAKE_RCVD_LINE Received =~ /from\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s*by\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3};\s*[SMTWF].{2},\s*\d{1,2}\s*[JFMASOND].{2,5}\s*\d{4}\s*\d{2}:\d{2}:\d{2}\s*[-+]\d{4}/ describe FH_FAKE_RCVD_LINE RCVD line looks faked (A) ##} FH_FAKE_RCVD_LINE ##{ FH_FAKE_RCVD_LINE_B header FH_FAKE_RCVD_LINE_B Received =~ /from\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s*by\s*[a-z0-9.]{4,24}\.[a-z0-9.]{4,36}\.(?:com|net|org|biz);\s*[SMTWF].{2},\s*\d{1,2}\s*[JFMASOND].{2,5}\s*\d{4}\s*\d{2}:\d{2}:\d{2}\s*[-+]\d{4}/i describe FH_FAKE_RCVD_LINE_B RCVD line looks faked (B) ##} FH_FAKE_RCVD_LINE_B ##{ FH_FROMEML_NOTLD header FH_FROMEML_NOTLD From:addr !~ /\./ [if-unset: foo@bar.com] describe FH_FROMEML_NOTLD E-mail address doesn't have TLD (.com, etc.) ##} FH_FROMEML_NOTLD ##{ FH_FROM_CASH header FH_FROM_CASH From:name =~ /\bcash\b/i describe FH_FROM_CASH From name has "cash" ##} FH_FROM_CASH ##{ FH_FROM_GET_NAME header FH_FROM_GET_NAME From:name =~ /\bGet\b/i describe FH_FROM_GET_NAME From name says Get ##} FH_FROM_GET_NAME ##{ FH_FROM_GIVEAWAY header FH_FROM_GIVEAWAY From =~ /Giveaway/i describe FH_FROM_GIVEAWAY From name is giveaway. ##} FH_FROM_GIVEAWAY ##{ FH_FROM_HOODIA header FH_FROM_HOODIA From =~ /Hoodia/i describe FH_FROM_HOODIA From has Hoodia!!? ##} FH_FROM_HOODIA ##{ FH_HAS_XAIMC header FH_HAS_XAIMC exists:X-AIMC-AUTH describe FH_HAS_XAIMC Has X-AIMC-AUTH header ##} FH_HAS_XAIMC ##{ FH_HAS_XID header FH_HAS_XID exists:X-ID describe FH_HAS_XID Has X-ID ##} FH_HAS_XID ##{ FH_HELO_ALMOST_IP header FH_HELO_ALMOST_IP X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+[a-z][-.]\d{1,3}[-.]\d{1,3}[-.]\d{1,3}[-.][a-z][^ ]+ /i describe FH_HELO_ALMOST_IP Helo is almost an IP addr. ##} FH_HELO_ALMOST_IP ##{ FH_HELO_ENDS_DOT header FH_HELO_ENDS_DOT X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+\. by=/ describe FH_HELO_ENDS_DOT Helo ends with a dot. ##} FH_HELO_ENDS_DOT ##{ FH_HELO_EQ_610HEX header FH_HELO_EQ_610HEX X-Spam-Relays-External =~ /^[^\]]+ helo=-?[A-F0-9]{6,10} / describe FH_HELO_EQ_610HEX Helo is 6-10 hex chr's. ##} FH_HELO_EQ_610HEX ##{ FH_HELO_EQ_CHARTER header FH_HELO_EQ_CHARTER X-Spam-Relays-External =~ /^[^\]]+ helo=\d{2,3}-\d{1,3}-\d{1,3}-\d{1,3}.{5,20}\.charter\.com /i describe FH_HELO_EQ_CHARTER Helo is d-d-d-d charter.com ##} FH_HELO_EQ_CHARTER ##{ FH_HELO_EQ_D_D_D_D header FH_HELO_EQ_D_D_D_D X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]{0,15}\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3}/ describe FH_HELO_EQ_D_D_D_D Helo is d-d-d-d ##} FH_HELO_EQ_D_D_D_D ##{ FH_HELO_GMAILSMTP header FH_HELO_GMAILSMTP Received =~ /HELO gmail-smtp-in/ describe FH_HELO_GMAILSMTP Faked helo of gmail-smtp-in ##} FH_HELO_GMAILSMTP ##{ FH_HOST_EQ_DYNAMICIP header FH_HOST_EQ_DYNAMICIP X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]{0,25}[dD][yY][nN][aA][mM][iI][cC][iI][pP][^ ]{5,25} helo=/ describe FH_HOST_EQ_DYNAMICIP Host is dynamicip ##} FH_HOST_EQ_DYNAMICIP ##{ FH_HOST_EQ_PACBELL_D header FH_HOST_EQ_PACBELL_D X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.dsl\.\w{2,10}\.pacbell\.net / describe FH_HOST_EQ_PACBELL_D Host is pacbell.net dsl ##} FH_HOST_EQ_PACBELL_D ##{ FH_HOST_EQ_VERIZON_P header FH_HOST_EQ_VERIZON_P X-Spam-Relays-External =~ /^[^\]]+ rdns=pool-\d.{5,30}\.verizon\.net/ describe FH_HOST_EQ_VERIZON_P Host is pool-.+verizon.net ##} FH_HOST_EQ_VERIZON_P ##{ FH_HOST_IN_ADDRARPA header FH_HOST_IN_ADDRARPA X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]{0,25}\.in-addr\.arpa / describe FH_HOST_IN_ADDRARPA HOST dns says "in-addr.arpa" ##} FH_HOST_IN_ADDRARPA ##{ FH_MSGID_000000 header FH_MSGID_000000 MESSAGEID =~ /\$00000000\@/ describe FH_MSGID_000000 Special MSGID ##} FH_MSGID_000000 ##{ FH_MSGID_01C67 header FH_MSGID_01C67 Message-ID =~ /^<000001c[67]/ describe FH_MSGID_01C67 Special MSGID ##} FH_MSGID_01C67 ##{ FH_MSGID_01C70XXX header FH_MSGID_01C70XXX MESSAGEID =~ /^<01c70[a-f][a-f0-9]{2}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[a-zA-Z0-9-]+>$/ describe FH_MSGID_01C70XXX MESSAGE ID seen often!!! ##} FH_MSGID_01C70XXX ##{ FH_MSGID_REPLACE header FH_MSGID_REPLACE MESSAGEID =~ /^<%MSGID/ describe FH_MSGID_REPLACE Broken Replace Template ##} FH_MSGID_REPLACE ##{ FH_MSGID_XXBLAH header FH_MSGID_XXBLAH MESSAGEID =~ /6c822ecf/ describe FH_MSGID_XXBLAH Common sign in msg-id's 12/21/2006 ##} FH_MSGID_XXBLAH ##{ FH_MSGID_XXX header FH_MSGID_XXX MESSAGEID =~ /\@xxx/i describe FH_MSGID_XXX Message-Id = @xxx ##} FH_MSGID_XXX ##{ FH_RE_NEW_DDD header FH_RE_NEW_DDD Subject =~ /^Re: new\s?\d{0,3}$/i describe FH_RE_NEW_DDD Subject is Re: new \d\d\d ##} FH_RE_NEW_DDD ##{ FH_XMAIL_REPLACE header FH_XMAIL_REPLACE X-Mailer =~ /%XMAILER/ describe FH_XMAIL_REPLACE Broken Replace Template ##} FH_XMAIL_REPLACE ##{ FILL_THIS_FORM_FRAUD_PHISH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags describe FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s) meta FILL_THIS_FORM_FRAUD_PHISH (T_FILL_THIS_FORM || T_FILL_THIS_FORM_SHORT) && __FILL_THIS_FORM_FRAUD_PHISH # score FILL_THIS_FORM_FRAUD_PHISH 1.50 endif ##} FILL_THIS_FORM_FRAUD_PHISH ##{ FILL_THIS_FORM_LOAN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags describe FILL_THIS_FORM_LOAN Answer loan question(s) meta FILL_THIS_FORM_LOAN T_FILL_THIS_FORM && __FILL_THIS_FORM_LOAN # score FILL_THIS_FORM_LOAN 0.50 endif ##} FILL_THIS_FORM_LOAN ##{ FILL_THIS_FORM_LONG ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FILL_THIS_FORM_LONG /(?:?(?:|)){5,}/i describe FILL_THIS_FORM_LONG Fill in a form with personal information # score FILL_THIS_FORM_LONG 1.00 endif ##} FILL_THIS_FORM_LONG ##{ FM_DOESNT_SAY_STOCK meta FM_DOESNT_SAY_STOCK (__FB_S_SYMBOL && __FM_MY_PRICE && !__FB_S_STOCK && !__FS_S_TRADE) describe FM_DOESNT_SAY_STOCK It's a stock spam but doesn't say stock ##} FM_DOESNT_SAY_STOCK ##{ FM_FAKE_53COM_SPOOF meta FM_FAKE_53COM_SPOOF (__FH_FRM_53 && !__FH_MSG_53 && !__FH_RCV_53) describe FM_FAKE_53COM_SPOOF Spoof mail from 53.com? ##} FM_FAKE_53COM_SPOOF ##{ FM_FAKE_HELO_HOTMAIL meta FM_FAKE_HELO_HOTMAIL (__HOTMAILCOM && !__HOST_HOTMAIL) describe FM_FAKE_HELO_HOTMAIL Looks like a fake hotmail.com helo. ##} FM_FAKE_HELO_HOTMAIL ##{ FM_FAKE_HELO_VERIZON meta FM_FAKE_HELO_VERIZON (__FHELO_VERIZON && !__FHOST_VERIZON) describe FM_FAKE_HELO_VERIZON Looks like a fake verizon.net helo. ##} FM_FAKE_HELO_VERIZON ##{ FM_FRM_RN_L_BRACK meta FM_FRM_RN_L_BRACK (__FROM_RIGH_BRACK && !__FROM_LEFT_BRACK && !__FROM_ISO_2022_JP) describe FM_FRM_RN_L_BRACK From name has > but not < ##} FM_FRM_RN_L_BRACK ##{ FM_IS_IT_OUR_ACCOUNT meta FM_IS_IT_OUR_ACCOUNT (__YOUR_ACCOUNT && __MANY_RECIPS) describe FM_IS_IT_OUR_ACCOUNT Is it our account? ##} FM_IS_IT_OUR_ACCOUNT ##{ FM_LIKE_STOCKS meta FM_LIKE_STOCKS (__FM_STOCK_WORDS && !__FB_S_STOCK && __FB_S_SYMBOL) describe FM_LIKE_STOCKS It looks like a duck, it's a duck! ##} FM_LIKE_STOCKS ##{ FM_LOTTO_YOU_WON meta FM_LOTTO_YOU_WON (__FM_LARGE_MONEY && __FM_NAT_LOTTERY && __YOU_WON_SOMTIN) describe FM_LOTTO_YOU_WON Talks about lotto and you won! ##} FM_LOTTO_YOU_WON ##{ FM_LUX_GIFTS_REDUCED meta FM_LUX_GIFTS_REDUCED (__FB_LUX_GIFTS && __FB_NUM_PERCNT) describe FM_LUX_GIFTS_REDUCED Luxury Gifts with dd% ##} FM_LUX_GIFTS_REDUCED ##{ FM_MANY_DRUG_WORDS meta FM_MANY_DRUG_WORDS (__VA_WORD && __CS_WORD && __VM_WORD) describe FM_MANY_DRUG_WORDS Lot's of almost drug words ##} FM_MANY_DRUG_WORDS ##{ FM_MORTGAGE5PLUS meta FM_MORTGAGE5PLUS (__FM_MORTGAGE5PLUS && !__FM_MORTGAGE6PLUS) describe FM_MORTGAGE5PLUS Looks like a mortgage spam (5+) ##} FM_MORTGAGE5PLUS ##{ FM_MORTGAGE6PLUS meta FM_MORTGAGE6PLUS (__FM_MORTGAGE6PLUS) describe FM_MORTGAGE6PLUS Looks like a mortgage spam (6+) ##} FM_MORTGAGE6PLUS ##{ FM_MULTI_LUX_GIFTS meta FM_MULTI_LUX_GIFTS ((__FB_BRAND_NAME + __FB_TIMEPIECE + __FB_WALLETS + __FB_HANDBAGS + __FB_DESIGNER + __FB_LUX_GIFTS + __FB_NUM_PERCNT + __FB_INK_PEN) > 3) describe FM_MULTI_LUX_GIFTS Talks about variety of luxury gifts ##} FM_MULTI_LUX_GIFTS ##{ FM_PHN_NODNS meta FM_PHN_NODNS (FB_SPACED_PHN_3B && RDNS_NONE) describe FM_PHN_NODNS Phone spacing + no dns ##} FM_PHN_NODNS ##{ FM_RATSIGN_1106 meta FM_RATSIGN_1106 (__MSGID_VGA && __DATE_700) describe FM_RATSIGN_1106 Fingerprint seen in lots of spam. 11/2006 ##} FM_RATSIGN_1106 ##{ FM_RE_HELLO_SPAM meta FM_RE_HELLO_SPAM (__FH_MSGID_01C7 && __FH_HAS_XMSMAIL && __FH_HAS_XPRIORITY && __FS_SUBJ_RE) describe FM_RE_HELLO_SPAM Re: Hello / hi ##} FM_RE_HELLO_SPAM ##{ FM_ROLEX_ADS meta FM_ROLEX_ADS (__FB_ROLEX_MEN && __FB_ROLEX_WMEN && __FB_OMEGA && __FB_GLASHUTE) describe FM_ROLEX_ADS Looks like Rolex spams. ##} FM_ROLEX_ADS ##{ FM_SCHOOLING meta FM_SCHOOLING ((__BACHELORS + __MASTERS + __MBA + __PHD) > 2) describe FM_SCHOOLING Meta Combo Phrase for Schooling (2) ##} FM_SCHOOLING ##{ FM_SCHOOL_DIPLOMA meta FM_SCHOOL_DIPLOMA (FM_SCHOOLING && __DIPLOMA) describe FM_SCHOOL_DIPLOMA Meta for Schooling + Diploma. ##} FM_SCHOOL_DIPLOMA ##{ FM_SCHOOL_TYPES meta FM_SCHOOL_TYPES (__FB_BA && __FB_BCs && __FB_MA && __FB_MBA) describe FM_SCHOOL_TYPES Meta Combo Phrase for Schooling ##} FM_SCHOOL_TYPES ##{ FM_SEX_HELODDDD meta FM_SEX_HELODDDD (__SEX_WRDS && FH_HELO_EQ_D_D_D_D) describe FM_SEX_HELODDDD Sex words + helo = dddd ##} FM_SEX_HELODDDD ##{ FM_SUBJ_APPROVE meta FM_SUBJ_APPROVE (__EXCLAIM_SUBJ && __SUBJ_APPROVE) describe FM_SUBJ_APPROVE Subject has Approve and ! ##} FM_SUBJ_APPROVE ##{ FM_TRUE_LOV_ALL_N meta FM_TRUE_LOV_ALL_N (__FB_P_TRUELOVE && __FB_P_ALLNIGHT) describe FM_TRUE_LOV_ALL_N True Love all Night! ##} FM_TRUE_LOV_ALL_N ##{ FM_VEGAS_CASINO meta FM_VEGAS_CASINO ((__FROM_VEGAS + __SUBJ_3DIGIT + __SUBJ_VEGAS + __FB_GAME) > 2) describe FM_VEGAS_CASINO Looks like vega casino spam ##} FM_VEGAS_CASINO ##{ FM_XMAIL_F_OUT header FM_XMAIL_F_OUT X-Mailer =~ /Microsoft Outlook Express V6.00.2900.2180/ describe FM_XMAIL_F_OUT Looks like Fake Outlook? ##} FM_XMAIL_F_OUT ##{ FORGED_RELAY_MUA_TO_MX header FORGED_RELAY_MUA_TO_MX X-Spam-Relays-External =~ /^\[ ip=(?!127)([\d.]+) [^\[]*\[ ip=\1 [^\[]+ helo=(!(?!(?:10|127|169\.254|172\.(?:1[6-9]|2[0-9]|3[01])|192\.168)\.)| )[^\[]+$/ ##} FORGED_RELAY_MUA_TO_MX ##{ FORGED_TBIRD_IMG_ARROW meta FORGED_TBIRD_IMG_ARROW __FORGED_TBIRD_IMG && __TO_NO_ARROWS_R && !__TO_UNDISCLOSED describe FORGED_TBIRD_IMG_ARROW Likely forged Thunderbird image spam #score FORGED_TBIRD_IMG_ARROW 0.8 ##} FORGED_TBIRD_IMG_ARROW ##{ FORGED_TBIRD_IMG_SIZE ifplugin Mail::SpamAssassin::Plugin::ImageInfo meta FORGED_TBIRD_IMG_SIZE __FORGED_TBIRD_IMG && __ONE_IMG && __IMG_LE_300K describe FORGED_TBIRD_IMG_SIZE Likely forged Thunderbird image spam # score FORGED_TBIRD_IMG_SIZE 0.8 endif ##} FORGED_TBIRD_IMG_SIZE ##{ FORGED_TBIRD_IMG_TO_MX meta FORGED_TBIRD_IMG_TO_MX __FORGED_TBIRD_IMG && __DOS_DIRECT_TO_MX describe FORGED_TBIRD_IMG_TO_MX Likely forged Thunderbird image spam #score FORGED_TBIRD_IMG_TO_MX 2.5 ##} FORGED_TBIRD_IMG_TO_MX ##{ FROM_MISSP_DYNIP meta FROM_MISSP_DYNIP __FROM_RUNON && RDNS_DYNAMIC describe FROM_MISSP_DYNIP From misspaced + dynamic rDNS #score FROM_MISSP_DYNIP 2.0 ##} FROM_MISSP_DYNIP ##{ FROM_MISSP_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail meta FROM_MISSP_FREEMAIL __FROM_RUNON && (FREEMAIL_FROM || FREEMAIL_REPLYTO) describe FROM_MISSP_FREEMAIL From misspaced + freemail provider # score FROM_MISSP_FREEMAIL 2.0 endif ##} FROM_MISSP_FREEMAIL ##{ FROM_MISSP_MSFT meta FROM_MISSP_MSFT __FROM_RUNON && (__ANY_OUTLOOK_MUA || __HAS_MIMEOLE || __MIMEOLE_MS) describe FROM_MISSP_MSFT From misspaced + supposed Microsoft tool #score FROM_MISSP_MSFT 3.5 ##} FROM_MISSP_MSFT ##{ FRT_ADOBE2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_ADOBE2 /\b(?!adobe)\b/i describe FRT_ADOBE2 ReplaceTags: Adobe endif ##} FRT_ADOBE2 ##{ FRT_APPROV ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_APPROV /\b(?!approv)

/i describe FRT_APPROV ReplaceTags: Approve endif ##} FRT_APPROV ##{ FRT_BIGGERMEM1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_BIGGERMEM1 /(?:|).{1,8}(?:

||)/i describe FRT_BIGGERMEM1 ReplaceTags: Bigger / Larger, Penis / Member endif ##} FRT_BIGGERMEM1 ##{ FRT_DIPLOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_DIPLOMA /\b(?!diploma)

/i describe FRT_DIPLOMA ReplaceTags: Diploma endif ##} FRT_DIPLOMA ##{ FRT_DISCOUNT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_DISCOUNT /\b(?!discount)/i describe FRT_DISCOUNT ReplaceTags: Discount endif ##} FRT_DISCOUNT ##{ FRT_DOLLAR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_DOLLAR /\b(?!dollar)/i describe FRT_DOLLAR ReplaceTags: Dollar endif ##} FRT_DOLLAR ##{ FRT_ESTABLISH2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_ESTABLISH2 /\b(?!estabi?lish)/i describe FRT_ESTABLISH2 ReplaceTags: Establish (2) endif ##} FRT_ESTABLISH2 ##{ FRT_FUCK2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_FUCK2 /\b(?!fuck)/i describe FRT_FUCK2 ReplaceTags: Fuck (2) endif ##} FRT_FUCK2 ##{ FRT_GUARANTEE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_GUARANTEE1 /(?!guarantee)/i describe FRT_GUARANTEE1 ReplaceTags: Guarantee (1) endif ##} FRT_GUARANTEE1 ##{ FRT_INVESTOR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_INVESTOR /\b(?!investor)/i describe FRT_INVESTOR ReplaceTags: Investor endif ##} FRT_INVESTOR ##{ FRT_LEVITRA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_LEVITRA /(?!levitra)/i describe FRT_LEVITRA ReplaceTags: Levitra endif ##} FRT_LEVITRA ##{ FRT_MEETING ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_MEETING /\b(?!meeting)\b/i describe FRT_MEETING ReplaceTags: Meeting endif ##} FRT_MEETING ##{ FRT_OFFER2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_OFFER2 /\b(?!offer)/i describe FRT_OFFER2 ReplaceTags: Offer (2) endif ##} FRT_OFFER2 ##{ FRT_OPPORTUN2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_OPPORTUN2 /(?!opportun)

/i describe FRT_OPPORTUN2 ReplaceTags: Oppertun (2) endif ##} FRT_OPPORTUN2 ##{ FRT_PENIS1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_PENIS1 /\b(?!pen\s?is)(?!penny[ ']?s)

\b/i describe FRT_PENIS1 ReplaceTags: Penis endif ##} FRT_PENIS1 ##{ FRT_PHARMAC ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_PHARMAC /(?!pharma[c\@])

/i describe FRT_PHARMAC ReplaceTags: Pharmac endif ##} FRT_PHARMAC ##{ FRT_PRICE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_PRICE /\b(?!price)

\b/i describe FRT_PRICE ReplaceTags: Price endif ##} FRT_PRICE ##{ FRT_REFINANCE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_REFINANCE1 /\b(?!refinanc)/i describe FRT_REFINANCE1 ReplaceTags: Refinance (1) endif ##} FRT_REFINANCE1 ##{ FRT_ROLEX ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_ROLEX /\b(?!rolex)/i describe FRT_ROLEX ReplaceTags: Rolex endif ##} FRT_ROLEX ##{ FRT_SEXUAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_SEXUAL /\b(?!sexual)/i describe FRT_SEXUAL ReplaceTags: Sexual endif ##} FRT_SEXUAL ##{ FRT_SOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_SOMA /\b(?!soma|500mg)\b/i describe FRT_SOMA ReplaceTags: Soma endif ##} FRT_SOMA ##{ FRT_SOMA2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_SOMA2 /\b(?!soma|500? ?mg)\b/i describe FRT_SOMA2 ReplaceTags: Soma (2) endif ##} FRT_SOMA2 ##{ FRT_STRONG1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_STRONG1 /\b(?!stro\s?ng)\b/i describe FRT_STRONG1 ReplaceTags: Strong (1) endif ##} FRT_STRONG1 ##{ FRT_STRONG2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_STRONG2 /\b(?!strong)\b/i describe FRT_STRONG2 ReplaceTags: Strong (2) endif ##} FRT_STRONG2 ##{ FRT_SYMBOL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_SYMBOL /\b(?!symbol)/i describe FRT_SYMBOL ReplaceTags: Symbol endif ##} FRT_SYMBOL ##{ FRT_TODAY2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_TODAY2 /\b(?!today)/i describe FRT_TODAY2 ReplaceTags: Today (2) endif ##} FRT_TODAY2 ##{ FRT_VALIUM1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_VALIUM1 /\b(?!valium|verifiquem)\b/i describe FRT_VALIUM1 ReplaceTags: Valium endif ##} FRT_VALIUM1 ##{ FRT_VALIUM2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_VALIUM2 /\b(?!valium)\b/i describe FRT_VALIUM2 ReplaceTags: Valium (2) endif ##} FRT_VALIUM2 ##{ FRT_WEIGHT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_WEIGHT2 /\b(?!weight)/i describe FRT_WEIGHT2 ReplaceTags: Weight (2) endif ##} FRT_WEIGHT2 ##{ FRT_XANAX1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_XANAX1 /\b(?!xanax)\b/i describe FRT_XANAX1 ReplaceTags: Xanax (1) endif ##} FRT_XANAX1 ##{ FRT_XANAX2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FRT_XANAX2 /\b(?!xanax)\b/i describe FRT_XANAX2 ReplaceTags: Xanax (2) endif ##} FRT_XANAX2 ##{ FR_3TAG_3TAG rawbody FR_3TAG_3TAG m'<[abcefghijklmnoqstuvwxz]{3}>'i describe FR_3TAG_3TAG Looks like 3 small tags. ##} FR_3TAG_3TAG ##{ FR_ALMOST_VIAG2 rawbody FR_ALMOST_VIAG2 /[^a-z](?!viagra)v?ia.?g.?ra/i describe FR_ALMOST_VIAG2 Almost looks like viagra. ##} FR_ALMOST_VIAG2 ##{ FR_CANTSEETEXT rawbody FR_CANTSEETEXT /class="?cantseetext/i describe FR_CANTSEETEXT Phrase class=cantseetext ##} FR_CANTSEETEXT ##{ FR_MIDER rawbody FR_MIDER m'http[^ ]{5,30}/gall?/' describe FR_MIDER Sign often seen in spams ##} FR_MIDER ##{ FR_TITLE_NUMS rawbody FR_TITLE_NUMS m'\d+'i describe FR_TITLE_NUMS HTML Title is only numbers ##} FR_TITLE_NUMS ##{ FSL_FAKE_GMAIL_RCVD header FSL_FAKE_GMAIL_RCVD X-Spam-Relays-External =~ /gmail-smtp-in\.l\.google\.com/ #score FSL_FAKE_GMAIL_RCVD 0.001 ##} FSL_FAKE_GMAIL_RCVD ##{ FSL_FAKE_HOTMAIL_RVCD header FSL_FAKE_HOTMAIL_RVCD X-Spam-Relays-External =~ /mx[1234]\.hotmail\.com/ ##} FSL_FAKE_HOTMAIL_RVCD ##{ FSL_GEO_ABUSE uri FSL_GEO_ABUSE /\/geocities\.com\/\S+$/ #score FSL_GEO_ABUSE 3.0 ##} FSL_GEO_ABUSE ##{ FSL_HELO_BARE_IP_1 header FSL_HELO_BARE_IP_1 X-Spam-Relays-External =~ /^[^\]]+ helo=\d+\.\d+\.\d+\.\d+ /i #score FSL_HELO_BARE_IP_1 0.001 ##} FSL_HELO_BARE_IP_1 ##{ FSL_HELO_DEVICE header FSL_HELO_DEVICE X-Spam-Relays-External =~ /\bhelo=(?:(?:dsl)?device|speedtouch)\.lan\b/i #score FSL_HELO_DEVICE 0.001 ##} FSL_HELO_DEVICE ##{ FSL_HELO_NON_FQDN_1 header FSL_HELO_NON_FQDN_1 X-Spam-Relays-External =~ /^[^\]]+ helo=[a-zA-Z0-9-_]+ /i #score FSL_HELO_NON_FQDN_1 0.001 ##} FSL_HELO_NON_FQDN_1 ##{ FSL_HELO_SETUP header FSL_HELO_SETUP X-Spam-Relays-External =~ /\bhelo=\S+\.setup\b/i #score FSL_HELO_SETUP 0.001 ##} FSL_HELO_SETUP ##{ FSL_INTERIA_ABUSE uri FSL_INTERIA_ABUSE /\/\S+\.(?:w|eu|fm)\.interia\.pl/ #score FSL_INTERIA_ABUSE 15.0 ##} FSL_INTERIA_ABUSE ##{ FSL_LSPACES_ABUSE uri FSL_LSPACES_ABUSE /cid\-\S+\.spaces\.live\.com/ #score FSL_LSPACES_ABUSE 15.0 ##} FSL_LSPACES_ABUSE ##{ FSL_YG_ABUSE uri FSL_YG_ABUSE /\/groups\.yahoo\.com\/group\/\S+\/message\/1$/ #score FSL_YG_ABUSE 15.0 ##} FSL_YG_ABUSE ##{ FS_ABIGGER header FS_ABIGGER Subject =~ /a bigger/i describe FS_ABIGGER Subject has "a bigger" ##} FS_ABIGGER ##{ FS_APPROVE_YOU header FS_APPROVE_YOU Subject =~ /approve you/i describe FS_APPROVE_YOU Subject says approve you ##} FS_APPROVE_YOU ##{ FS_AT_NO_COST header FS_AT_NO_COST Subject =~ /\bat no cost/i describe FS_AT_NO_COST Subject says "At No Cost" ##} FS_AT_NO_COST ##{ FS_CHEAP_CAP header FS_CHEAP_CAP Subject =~ /CHEAP/ describe FS_CHEAP_CAP Phrase: Cheap in Caps in Subject. ##} FS_CHEAP_CAP ##{ FS_DOLLAR_BONUS header FS_DOLLAR_BONUS Subject =~ /\$\d\d\d?\.?\d?\d? bonus/i describe FS_DOLLAR_BONUS Subject talks about money bonus! ##} FS_DOLLAR_BONUS ##{ FS_EJACULA header FS_EJACULA Subject =~ /ejaculat(?:[io01][o0i1]n|e)/i describe FS_EJACULA Phrase: ejaculation in subject. ##} FS_EJACULA ##{ FS_ERECTION header FS_ERECTION Subject =~ / erection /i describe FS_ERECTION Phrase: erection in subject. ##} FS_ERECTION ##{ FS_HUGECOCK header FS_HUGECOCK Subject =~ /(?:huge|tiny|small) (?:c[o0]ck|d[i1]ck|p[e3]n[1i]s)/i describe FS_HUGECOCK Phrase: Huge Cock ##} FS_HUGECOCK ##{ FS_LARGE_PERCENT2 header FS_LARGE_PERCENT2 Subject =~ /(?!100%)\d[0-9oi][0-9oi]%/i describe FS_LARGE_PERCENT2 Larger than 100% in subj. ##} FS_LARGE_PERCENT2 ##{ FS_LOW_RATES header FS_LOW_RATES Subject =~ / low rates/i describe FS_LOW_RATES Subject says low rates ##} FS_LOW_RATES ##{ FS_NEW_SOFT_UPLOAD header FS_NEW_SOFT_UPLOAD Subject =~ /^New software uploaded by/ describe FS_NEW_SOFT_UPLOAD Subj starts with New software uploaded ##} FS_NEW_SOFT_UPLOAD ##{ FS_NEW_XXX header FS_NEW_XXX Subject =~ /^Re: news? [a-z]{1,5}$/ describe FS_NEW_XXX Subject looks like Fharmacy spams. ##} FS_NEW_XXX ##{ FS_NO_SCRIP header FS_NO_SCRIP Subject =~ /n[o0O] p[reRE][erER]scr[i1I]pt[i1I][o0O]n/i describe FS_NO_SCRIP Subject almost says No prescription ##} FS_NO_SCRIP ##{ FS_NUDE header FS_NUDE Subject =~ /\bnude\b/i describe FS_NUDE Subject says Nude ##} FS_NUDE ##{ FS_OBFU_PRMCY header FS_OBFU_PRMCY Subject =~ /\b(?!(?:pharmacy|primacy))p[ph]{0,4}\S{1,3}r\S{0,2}m\S{0,3}c\S{0,2}y\b/i describe FS_OBFU_PRMCY what could this word be? ##} FS_OBFU_PRMCY ##{ FS_PERSCRIPTION header FS_PERSCRIPTION Subject =~ /perscr[i1]pt[i1][o0]n/i describe FS_PERSCRIPTION Subject mis-spelled prescription ##} FS_PERSCRIPTION ##{ FS_PHARMASUB2 header FS_PHARMASUB2 Subject =~ /PH[A-Za-z]{2,7}MA/ describe FS_PHARMASUB2 Looks like Phramacy subject. ##} FS_PHARMASUB2 ##{ FS_RAMROD header FS_RAMROD Subject =~ /ramrod/i describe FS_RAMROD Subject says Ramrod ##} FS_RAMROD ##{ FS_REPLICA header FS_REPLICA Subject =~ /replica/i describe FS_REPLICA Subject says "replica" ##} FS_REPLICA ##{ FS_REPLICAWATCH header FS_REPLICAWATCH Subject =~ /replica watch/i describe FS_REPLICAWATCH Subject says Replica watch ##} FS_REPLICAWATCH ##{ FS_RE_APPROV header FS_RE_APPROV Subject =~ /re approved/i describe FS_RE_APPROV Phrase: re approved ##} FS_RE_APPROV ##{ FS_START_DOYOU2 header FS_START_DOYOU2 Subject =~ /^Do you (?:dream|have|want|love|like|wanna)/i describe FS_START_DOYOU2 Subject starts with Do you dream,have,want,love, etc. ##} FS_START_DOYOU2 ##{ FS_START_LOSE header FS_START_LOSE Subject =~ /^Lose /i describe FS_START_LOSE Subject starts with Lose ##} FS_START_LOSE ##{ FS_TEEN_BAD header FS_TEEN_BAD Subject =~ /teen.{1,15}(?:pussy|sex|slut|ass|fuck|rape)/i describe FS_TEEN_BAD Subject says something bad about teens ##} FS_TEEN_BAD ##{ FS_TIP_DDD header FS_TIP_DDD Subject =~ /(?:tip|good) \d\d\d?\d?/i describe FS_TIP_DDD Phrase: subject = tip ddd ##} FS_TIP_DDD ##{ FS_WEIGHT_LOSS header FS_WEIGHT_LOSS Subject =~ /weight loss/i describe FS_WEIGHT_LOSS Subject says Weight Loss ##} FS_WEIGHT_LOSS ##{ FS_WILL_HELP header FS_WILL_HELP Subject =~ /will help/ describe FS_WILL_HELP Subject says will help ##} FS_WILL_HELP ##{ FS_WITH_SMALL header FS_WITH_SMALL Subject =~ /with (?:\w+\s)?(?:small|short)/i describe FS_WITH_SMALL Subject says With ... small ##} FS_WITH_SMALL ##{ FUZZY_MERIDIA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FUZZY_MERIDIA /\b(?!meridia)\b/i endif ##} FUZZY_MERIDIA ##{ FU_COMMON_SUBS2 uri FU_COMMON_SUBS2 m'/(?:[2w]m|7d|b|ee|lj|j|o|u)/[,.]?$' describe FU_COMMON_SUBS2 Sub-dir seen often in spam (2). ##} FU_COMMON_SUBS2 ##{ FU_ENDS_NUMS_DOTS_CLK uri FU_ENDS_NUMS_DOTS_CLK m'(?:clk|uns)/\d+\.\d+\.\d+'i describe FU_ENDS_NUMS_DOTS_CLK Ends with clk/d+.d+.d+ ##} FU_ENDS_NUMS_DOTS_CLK ##{ FU_END_ET uri FU_END_ET m'/et/$'i describe FU_END_ET ET Phone Home? ##} FU_END_ET ##{ FU_HOODIA uri FU_HOODIA /hoodia/i describe FU_HOODIA URL has hoodia in it. ##} FU_HOODIA ##{ FU_LONG_QUERY3 uri FU_LONG_QUERY3 m'[A-F0-9]{30}\.aspx' describe FU_LONG_QUERY3 URL has a long file name with .aspx extension. ##} FU_LONG_QUERY3 ##{ FU_MIDER uri FU_MIDER m'/gall?/' describe FU_MIDER URL has /gal/ ##} FU_MIDER ##{ FU_UKGEOCITIES uri FU_UKGEOCITIES /\b[a-z]{2}\.geocities\.com/i describe FU_UKGEOCITIES URL with [a-z]{2}.geocities.com ##} FU_UKGEOCITIES ##{ FU_URI_TRACKER_T uri FU_URI_TRACKER_T m'/[yi]/(?:sp|et|vm|xl2)/'i describe FU_URI_TRACKER_T URI style tracker (T) ##} FU_URI_TRACKER_T ##{ GEO_QUERY_STRING uri GEO_QUERY_STRING /^http:\/\/(?:\w{2,4}\.)?geocities\.com(?::\d*)?\/.+?\/\?/i ##} GEO_QUERY_STRING ##{ HDRS_MISSP header HDRS_MISSP ALL =~ /\n(?:Subject|From):\S/ism describe HDRS_MISSP Misspaced headers #score HDRS_MISSP 2.0 ##} HDRS_MISSP ##{ HDR_ORDER_FTSDMCXX_001C meta HDR_ORDER_FTSDMCXX_001C (__HDR_ORDER_FTSDMCXXXX && __MID_START_001C) describe HDR_ORDER_FTSDMCXX_001C Header order similar to spam (FTSDMCXX/MID variant) ##} HDR_ORDER_FTSDMCXX_001C ##{ HDR_ORDER_FTSDMCXX_BAT meta HDR_ORDER_FTSDMCXX_BAT (__HDR_ORDER_FTSDMCXXXX && __BAT_BOUNDARY) describe HDR_ORDER_FTSDMCXX_BAT Header order similar to spam (FTSDMCXX/boundary variant) ##} HDR_ORDER_FTSDMCXX_BAT ##{ HEADER_COUNT_SUBJECT ifplugin Mail::SpamAssassin::Plugin::HeaderEval header HEADER_COUNT_SUBJECT eval:check_header_count_range('Subject','2','999') describe HEADER_COUNT_SUBJECT Multiple Subject headers found endif ##} HEADER_COUNT_SUBJECT ##{ HELO_FRIEND header HELO_FRIEND X-Spam-Relays-External =~ /^[^\]]+ helo=friend /i ##} HELO_FRIEND ##{ HELO_LH_HOME header HELO_LH_HOME X-Spam-Relays-External =~ /^[^\]]+ helo=\S+\.(?:home|lan) /i ##} HELO_LH_HOME ##{ HELO_LH_LD header HELO_LH_LD X-Spam-Relays-External =~ /^[^\]]+ helo=localhost\.localdomain /i ##} HELO_LH_LD ##{ HELO_LOCALHOST header HELO_LOCALHOST X-Spam-Relays-External =~ /^[^\]]+ helo=localhost /i ##} HELO_LOCALHOST ##{ HELO_NO_DOMAIN meta HELO_NO_DOMAIN __HELO_NO_DOMAIN && !HELO_LOCALHOST describe HELO_NO_DOMAIN Relay reports its domain incorrectly ##} HELO_NO_DOMAIN ##{ HELO_OEM header HELO_OEM X-Spam-Relays-External =~ /^[^\]]+ helo=(?:pc|oem\S*) /i ##} HELO_OEM ##{ HK_FAKENAME_EBAY meta HK_FAKENAME_EBAY __HK_NAME_EBAY && !__HK_HELO_EBAY describe HK_FAKENAME_EBAY From name mentions eBay, but not relayed from there ##} HK_FAKENAME_EBAY ##{ HK_LOTTO meta HK_LOTTO __HK_LOTTO_1 || __HK_LOTTO_2 || __HK_LOTTO_JACKPOT || __HK_LOTTO_STAATS || __HK_LOTTO_BALLOT ##} HK_LOTTO ##{ HK_NAME_DRUGS header HK_NAME_DRUGS From:name =~ /(viagra|cialis)/mi describe HK_NAME_DRUGS From name contains drugs ##} HK_NAME_DRUGS ##{ HK_NAME_FREE header HK_NAME_FREE From:name =~ /\b(?:get)?free\b/mi describe HK_NAME_FREE From name mentions free stuff ##} HK_NAME_FREE ##{ HK_RANDOM_ENVFROM header HK_RANDOM_ENVFROM EnvelopeFrom =~ /^(?!(?:mail|bounce)[_.-]|[^@]*(?:[+=^~\#]|mcgr|kpmg|nlpbr|ndqv|lcgc|cplpr|-mailer@)|[^@]{20})[^@]*(?:[bcdfgjklmnpqrtvwxz]{5}|[aeiouy]{5}|([a-z]{1,2})(?:\1){3})/mi describe HK_RANDOM_ENVFROM Envelope sender username looks random ##} HK_RANDOM_ENVFROM ##{ HK_SCAM_N2 body HK_SCAM_N2 /\bnext of kin\b/i ##} HK_SCAM_N2 ##{ HS_BOBAX_MID_2 header HS_BOBAX_MID_2 Message-Id =~ /^<\dIX\d{3}EJXVWDA\d{3}\@[a-z\-]+\.[a-z]+>/ describe HS_BOBAX_MID_2 Bobax? Message-Id: <0IX000EJXVWDA000@example.com> ##} HS_BOBAX_MID_2 ##{ HS_BODY_UPLOADED_SOFTWARE body HS_BODY_UPLOADED_SOFTWARE /^\w+ has uploaded some new software/ describe HS_BODY_UPLOADED_SOFTWARE Somebody has uploaded some new software for you ##} HS_BODY_UPLOADED_SOFTWARE ##{ HS_DRUG_DOLLAR_1 body HS_DRUG_DOLLAR_1 m'^[a-z]+[glrt][a-z]?[eir][a-z]?[asx](?: -|:)? \$[\d.]+$'i describe HS_DRUG_DOLLAR_1 Contains a drug and price-like pattern. ##} HS_DRUG_DOLLAR_1 ##{ HS_DRUG_DOLLAR_2 body HS_DRUG_DOLLAR_2 m'^[a-z]+[lmor][a-z]?[aex][a-z]?[mx](?: -|:)? \$[\d.]+$'i describe HS_DRUG_DOLLAR_2 Contains a drug and price-like pattern. ##} HS_DRUG_DOLLAR_2 ##{ HS_DRUG_DOLLAR_3 body HS_DRUG_DOLLAR_3 m'^[a-z]+[dino][a-z]?[aimu][a-z]?[amx](?: -|:)? \$[\d.]+$'i describe HS_DRUG_DOLLAR_3 Contains a drug and price-like pattern. ##} HS_DRUG_DOLLAR_3 ##{ HS_DRUG_DOLLAR_MANY meta HS_DRUG_DOLLAR_MANY HS_DRUG_DOLLAR_1 + HS_DRUG_DOLLAR_2 + HS_DRUG_DOLLAR_3 >= 2 describe HS_DRUG_DOLLAR_MANY Contains several drug and dollar-like patterns. ##} HS_DRUG_DOLLAR_MANY ##{ HS_FORGED_OE_FW meta HS_FORGED_OE_FW __HS_SUBJ_UC_FW && __OE_MUA describe HS_FORGED_OE_FW Outlook does not prefix forwards with "FW:" ##} HS_FORGED_OE_FW ##{ HS_GETMEOFF uri HS_GETMEOFF m'/get(?:me)?off\.php(?:$|[\#?])' describe HS_GETMEOFF Links to common unsubscribe script: 'getmeoff.php' ##} HS_GETMEOFF ##{ HS_INDEX_PARAM uri HS_INDEX_PARAM m'^https?:/*([^/]*/)+(?:index.(?:cgi|html?|php)|default.(?:asp|jsp))?\?(?!(?-i:[A-Z][a-z]{2,}){2,}$)\w+={0,2}$'i describe HS_INDEX_PARAM Link contains a common tracker pattern. ##} HS_INDEX_PARAM ##{ HS_MEETUP_FOR_SEX body HS_MEETUP_FOR_SEX m'(?:meet ?up|see eachother|get together) for (?:some )?(?:action|sex)'i describe HS_MEETUP_FOR_SEX Talks about meeting up for sex. ##} HS_MEETUP_FOR_SEX ##{ HS_SUBJ_NEW_SOFTWARE header HS_SUBJ_NEW_SOFTWARE Subject =~ /^New software uploaded by/ describe HS_SUBJ_NEW_SOFTWARE Subject starts with 'New software uploaded by' ##} HS_SUBJ_NEW_SOFTWARE ##{ HS_SUBJ_ONLINE_PHARMACEUTICAL header HS_SUBJ_ONLINE_PHARMACEUTICAL Subject =~ /\bOnline Pharmaceutical/i describe HS_SUBJ_ONLINE_PHARMACEUTICAL Subject contains the phrase 'Online pharmaceutical' ##} HS_SUBJ_ONLINE_PHARMACEUTICAL ##{ HS_VPXL body HS_VPXL /\bVPXL\b/i describe HS_VPXL Contains VPXL, yet the recommended dose is only 2 tablets. ##} HS_VPXL ##{ HTTPS_HTTP_MISMATCH ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch body HTTPS_HTTP_MISMATCH eval:check_https_http_mismatch('1','10') endif ##} HTTPS_HTTP_MISMATCH ##{ IMG_DIRECT_TO_MX meta IMG_DIRECT_TO_MX __DOS_DIRECT_TO_MX && __JPEG_ATTACH && __ONE_IMG && __IMG_LE_300K #score IMG_DIRECT_TO_MX 0.20 ##} IMG_DIRECT_TO_MX ##{ JM_I_FEEL_LUCKY uri JM_I_FEEL_LUCKY /(?:\&|\?)btnI=ec(?:$|\&)/ tflags JM_I_FEEL_LUCKY publish # low hitrate, but always a good sign ##} JM_I_FEEL_LUCKY ##{ JM_RCVD_QMAILV1 header JM_RCVD_QMAILV1 Received =~ /by \S+ \(Qmailv1\) with ESMTP/ ##} JM_RCVD_QMAILV1 ##{ JM_SOUGHT_FRAUD_1 meta JM_SOUGHT_FRAUD_1 (__SEEK_FRAUD_GO_RAY || __SEEK_FRAUD_RCLBZD || __SEEK_FRAUD_GYU7SL || __SEEK_FRAUD_YM7Q1U) #score JM_SOUGHT_FRAUD_1 3.0 describe JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns ##} JM_SOUGHT_FRAUD_1 ##{ JM_SOUGHT_FRAUD_2 meta JM_SOUGHT_FRAUD_2 (__SEEK_FRAUD_SGFSMN || __SEEK_FRAUD_RGFON2 || __SEEK_FRAUD_IGL8BZ || __SEEK_FRAUD_KBGNWU || __SEEK_FRAUD_LX2RCD || __SEEK_FRAUD_9_SYQR || __SEEK_FRAUD_UKFOFG || __SEEK_FRAUD_XABL7X || __SEEK_FRAUD_MFD6AB || __SEEK_FRAUD_BGO5Z1 || __SEEK_FRAUD_HYB6XM || __SEEK_FRAUD_2PBFIF || __SEEK_FRAUD_I6RD6K || __SEEK_FRAUD_CTSHG_ || __SEEK_FRAUD_GQ_III || __SEEK_FRAUD__RO8LU || __SEEK_FRAUD_3ZGAWE || __SEEK_FRAUD_WMI_AD || __SEEK_FRAUD_F9YLOI || __SEEK_FRAUD_8DOXAD || __SEEK_FRAUD_7XOY_V || __SEEK_FRAUD_1CSABX || __SEEK_FRAUD_UHGEL7 || __SEEK_FRAUD_YVZE_1 || __SEEK_FRAUD_US_OFW || __SEEK_FRAUD_BXYWIK || __SEEK_FRAUD_BOG4XB || __SEEK_FRAUD_LQKNLO || __SEEK_FRAUD_IQFKX9 || __SEEK_FRAUD_IOGCLT || __SEEK_FRAUD_ZR4ER1 || __SEEK_FRAUD_4IGE4U || __SEEK_FRAUD_N4IAWN || __SEEK_FRAUD_FOSRJQ || __SEEK_FRAUD_1L3YC8 || __SEEK_FRAUD_S8TD6S || __SEEK_FRAUD_3K585T) #score JM_SOUGHT_FRAUD_2 3.0 describe JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns ##} JM_SOUGHT_FRAUD_2 ##{ JM_SOUGHT_FRAUD_3 meta JM_SOUGHT_FRAUD_3 (__SEEK_FRAUD_BT7WE_ || __SEEK_FRAUD_ZMFYMV || __SEEK_FRAUD_F6XEM3 || __SEEK_FRAUD_U0YN9X || __SEEK_FRAUD__IA9KC || __SEEK_FRAUD_4JAYKU || __SEEK_FRAUD_EH1G11 || __SEEK_FRAUD_LMWIWP || __SEEK_FRAUD_E0LMNE || __SEEK_FRAUD_LKZGK5 || __SEEK_FRAUD_OUSGU0 || __SEEK_FRAUD_4ZJ4MM || __SEEK_FRAUD_CHLODJ || __SEEK_FRAUD_P8AQ1J || __SEEK_FRAUD_38GETZ || __SEEK_FRAUD_YGHQXE || __SEEK_FRAUD_OPAU37 || __SEEK_FRAUD_SBLZOX || __SEEK_FRAUD_OWE2LK || __SEEK_FRAUD_DJ79KN || __SEEK_FRAUD_3_8NUB || __SEEK_FRAUD_QFLIUL || __SEEK_FRAUD_W7O0I7 || __SEEK_FRAUD_ZO4YVB || __SEEK_FRAUD_CMBNY9 || __SEEK_FRAUD_AQLP4X || __SEEK_FRAUD_HWGAFY || __SEEK_FRAUD_5L07LP || __SEEK_FRAUD_NM1G_Z || __SEEK_FRAUD_KCB1NC || __SEEK_FRAUD_WTP_AR || __SEEK_FRAUD_0LP0QC || __SEEK_FRAUD_NH9TNM || __SEEK_FRAUD_6B2FK_ || __SEEK_FRAUD_TKRYFP || __SEEK_FRAUD_8D5ZCH || __SEEK_FRAUD_MBZLTR || __SEEK_FRAUD_HX12Z9 || __SEEK_FRAUD_YA_RGO || __SEEK_FRAUD_PRKDOF || __SEEK_FRAUD_TXS4Z8 || __SEEK_FRAUD_LPT60S || __SEEK_FRAUD_L5CHVT || __SEEK_FRAUD_DI4MKD || __SEEK_FRAUD_6X9KKX || __SEEK_FRAUD_SRZ_KN || __SEEK_FRAUD_VKUVK9 || __SEEK_FRAUD_TFGP0H || __SEEK_FRAUD_WJGJCF || __SEEK_FRAUD_VXUYZK || __SEEK_FRAUD_T3QROW || __SEEK_FRAUD_J8PIFZ || __SEEK_FRAUD_JVSA_I || __SEEK_FRAUD_AKYCPN || __SEEK_FRAUD_MRKTQJ || __SEEK_FRAUD_WTLSNH || __SEEK_FRAUD_QLR0BH || __SEEK_FRAUD_HPCAW3 || __SEEK_FRAUD_HS90OD || __SEEK_FRAUD_YGIICU || __SEEK_FRAUD_IOVTJB || __SEEK_FRAUD__HJ2Y5 || __SEEK_FRAUD_2T5MRE || __SEEK_FRAUD_MUZG_5 || __SEEK_FRAUD_Y1JTCA || __SEEK_FRAUD_ID2SB5 || __SEEK_FRAUD__2H_ZF || __SEEK_FRAUD_DJQ9TI || __SEEK_FRAUD_GSYHFX || __SEEK_FRAUD_NNFYWE || __SEEK_FRAUD_KJQY5E || __SEEK_FRAUD_07NUWC || __SEEK_FRAUD_FYILNB || __SEEK_FRAUD_3XHS33 || __SEEK_FRAUD_3BWYGW || __SEEK_FRAUD_TSWC8H || __SEEK_FRAUD_XDHW_C || __SEEK_FRAUD_KFEOGR || __SEEK_FRAUD_DCYEFP || __SEEK_FRAUD_H6IXQ5 || __SEEK_FRAUD_P_7YRN || __SEEK_FRAUD_KY9RF_ || __SEEK_FRAUD_PNYKVG || __SEEK_FRAUD_FHCU_P || __SEEK_FRAUD_QJAXD2 || __SEEK_FRAUD_JIUMW4 || __SEEK_FRAUD_X7EJQN || __SEEK_FRAUD_PA_EWE || __SEEK_FRAUD_FLVC7O || __SEEK_FRAUD_CZSHS_ || __SEEK_FRAUD_EGCOZC || __SEEK_FRAUD_GM86W_ || __SEEK_FRAUD_A4QUVB || __SEEK_FRAUD_BRNKW7 || __SEEK_FRAUD__K6QXJ || __SEEK_FRAUD_C1B0QK || __SEEK_FRAUD_NPIVP9 || __SEEK_FRAUD_E_N5XO || __SEEK_FRAUD_UHLUPC || __SEEK_FRAUD_TZVEWH || __SEEK_FRAUD_SCUVYQ || __SEEK_FRAUD__50GYI || __SEEK_FRAUD_49FI4O || __SEEK_FRAUD_VSTK_A || __SEEK_FRAUD_WKGUZG || __SEEK_FRAUD_HLTNBY || __SEEK_FRAUD_4YVO5B || __SEEK_FRAUD_PQTBKM || __SEEK_FRAUD_0EY1BH || __SEEK_FRAUD_2BERS9 || __SEEK_FRAUD_SBFKHU || __SEEK_FRAUD_N87C1L || __SEEK_FRAUD_BT6SO9 || __SEEK_FRAUD_NABBSF || __SEEK_FRAUD_WYNEG6 || __SEEK_FRAUD_F_KZOZ || __SEEK_FRAUD_QSWUVB || __SEEK_FRAUD_XUO6FU || __SEEK_FRAUD_PZKR_K || __SEEK_FRAUD_LC7TDH || __SEEK_FRAUD__OXXSN || __SEEK_FRAUD_8FSJKQ || __SEEK_FRAUD_GS5NT6 || __SEEK_FRAUD_E2ESY7 || __SEEK_FRAUD_3WFXLT || __SEEK_FRAUD_TWEN6R || __SEEK_FRAUD_215XVW || __SEEK_FRAUD_LYNJ8F || __SEEK_FRAUD_JK6E_X || __SEEK_FRAUD_EXFYTU || __SEEK_FRAUD_QHAHKB || __SEEK_FRAUD_MY06YR || __SEEK_FRAUD_PSPGBR || __SEEK_FRAUD_J2YHWJ || __SEEK_FRAUD_PKVKI1 || __SEEK_FRAUD_SJUAFZ || __SEEK_FRAUD_2TMRP1 || __SEEK_FRAUD_QVAQMZ || __SEEK_FRAUD__O3CDN || __SEEK_FRAUD_BSJPWO || __SEEK_FRAUD_NPQMIG || __SEEK_FRAUD_UJSOEL || __SEEK_FRAUD_RON849 || __SEEK_FRAUD_3Y2BZT || __SEEK_FRAUD_ZUGTOV || __SEEK_FRAUD_FMGOAT || __SEEK_FRAUD_IYJGAG || __SEEK_FRAUD_8WXZC4 || __SEEK_FRAUD_GLBFPT || __SEEK_FRAUD_9EM_BD || __SEEK_FRAUD_V4GLSO || __SEEK_FRAUD_OSTMZF || __SEEK_FRAUD_Z9MGXL || __SEEK_FRAUD_3UF3BG || __SEEK_FRAUD_N2TUPL || __SEEK_FRAUD_0WTPZI || __SEEK_FRAUD_7A8HJM || __SEEK_FRAUD_ZA0FLG || __SEEK_FRAUD_V6WK7U || __SEEK_FRAUD_4VQT79 || __SEEK_FRAUD_RG_9_1 || __SEEK_FRAUD_XD3U8U || __SEEK_FRAUD_RIVPNL || __SEEK_FRAUD_HPKGEO || __SEEK_FRAUD_1QSMCG || __SEEK_FRAUD_BLDS9E || __SEEK_FRAUD_SIYSH8 || __SEEK_FRAUD_FFM0SF || __SEEK_FRAUD_0WHPB1 || __SEEK_FRAUD_RGLRBD || __SEEK_FRAUD_QKKKMG || __SEEK_FRAUD_T6QSEI || __SEEK_FRAUD_LP_GQ9 || __SEEK_FRAUD__LDOW2 || __SEEK_FRAUD_N1QADF || __SEEK_FRAUD_EZFEDE || __SEEK_FRAUD_XBF8EX || __SEEK_FRAUD_STNPOT || __SEEK_FRAUD_BY5FQK || __SEEK_FRAUD_YNMXUS || __SEEK_FRAUD_W0MUAO || __SEEK_FRAUD_9UX63H || __SEEK_FRAUD_EONOG2 || __SEEK_FRAUD_NV1CZX || __SEEK_FRAUD_G8JW6K || __SEEK_FRAUD_JGKWCZ || __SEEK_FRAUD_F9PTJZ || __SEEK_FRAUD_SGH_BE || __SEEK_FRAUD_MWUIJQ || __SEEK_FRAUD_5AOJ6M || __SEEK_FRAUD_8FAPXC || __SEEK_FRAUD_M3W0LK || __SEEK_FRAUD_9ACOLT || __SEEK_FRAUD_RDZY_Z || __SEEK_FRAUD_ZC2ZFP || __SEEK_FRAUD_UGUIOV || __SEEK_FRAUD_YSQL2G || __SEEK_FRAUD_C4LA4T || __SEEK_FRAUD_MZXYFH || __SEEK_FRAUD_E3KTBE || __SEEK_FRAUD_SZOTOL || __SEEK_FRAUD_OPXSIA || __SEEK_FRAUD_TTAUPG || __SEEK_FRAUD_00CSUL || __SEEK_FRAUD_JRCNZ0 || __SEEK_FRAUD_0CUBFG || __SEEK_FRAUD_PWR5MZ || __SEEK_FRAUD_VNIWHY || __SEEK_FRAUD_RC7YZH || __SEEK_FRAUD_FKRVOS || __SEEK_FRAUD_4ONVKC || __SEEK_FRAUD_QWYVZJ || __SEEK_FRAUD_ZPZ5UU || __SEEK_FRAUD_EJ6AJR || __SEEK_FRAUD_VGW1Y2 || __SEEK_FRAUD_PZEJXH || __SEEK_FRAUD_DI5SMP || __SEEK_FRAUD_7E9IDU || __SEEK_FRAUD_P8JJBS || __SEEK_FRAUD_CPG3SG || __SEEK_FRAUD__Q0H7E || __SEEK_FRAUD_MTD5KL || __SEEK_FRAUD_C4M8O6 || __SEEK_FRAUD_0MX8JO || __SEEK_FRAUD_N21EJ1 || __SEEK_FRAUD_MA7TQS || __SEEK_FRAUD_1LS8UW || __SEEK_FRAUD_KDGYCE || __SEEK_FRAUD_OB_SPK || __SEEK_FRAUD_CTKQAR || __SEEK_FRAUD_RO2TAX || __SEEK_FRAUD_GA5IFR || __SEEK_FRAUD_BQVFV6 || __SEEK_FRAUD_T2PQH_ || __SEEK_FRAUD_1OMKY9 || __SEEK_FRAUD_JAORYH || __SEEK_FRAUD_WZCXWN || __SEEK_FRAUD_SRCLWP || __SEEK_FRAUD_MBOSRB || __SEEK_FRAUD_TH3PHS || __SEEK_FRAUD_E3FWEB || __SEEK_FRAUD_CQN7_5 || __SEEK_FRAUD_HHEBIG || __SEEK_FRAUD_PFBAPT || __SEEK_FRAUD_QK7QNG || __SEEK_FRAUD_WI_PXU || __SEEK_FRAUD_NICJUW || __SEEK_FRAUD___VYVJ || __SEEK_FRAUD_Q1JQ6T || __SEEK_FRAUD_Y6P5MJ || __SEEK_FRAUD_556GEJ || __SEEK_FRAUD_3HKWCI || __SEEK_FRAUD_WTOIOJ || __SEEK_FRAUD_AKSAOK || __SEEK_FRAUD_QMDFLB || __SEEK_FRAUD_VXEHN_ || __SEEK_FRAUD_QJ58__ || __SEEK_FRAUD_GVP80_ || __SEEK_FRAUD_EV4LPC || __SEEK_FRAUD_5_1_MB || __SEEK_FRAUD_HHL9OS || __SEEK_FRAUD_VSMRB_ || __SEEK_FRAUD_ZN9EIN || __SEEK_FRAUD_YCIKWZ || __SEEK_FRAUD_7H66PN || __SEEK_FRAUD_S9BKX_ || __SEEK_FRAUD_ZLALWU || __SEEK_FRAUD_8G4MVH || __SEEK_FRAUD__STWOQ || __SEEK_FRAUD_Y1JN21 || __SEEK_FRAUD_OFB_9X || __SEEK_FRAUD_RIZ_7T || __SEEK_FRAUD_YKTGTU || __SEEK_FRAUD_XADCD3 || __SEEK_FRAUD_TZQSNN || __SEEK_FRAUD__9MFA7 || __SEEK_FRAUD_HFSJ50 || __SEEK_FRAUD_FKMQSA || __SEEK_FRAUD_U1T7IN || __SEEK_FRAUD_MC1YAI || __SEEK_FRAUD_RWS7HA || __SEEK_FRAUD_FYI5WN || __SEEK_FRAUD_CKPXGA || __SEEK_FRAUD__ERENB || __SEEK_FRAUD_GPAQI8 || __SEEK_FRAUD_UQ94CD || __SEEK_FRAUD_NMDNZN || __SEEK_FRAUD_RZZRJV || __SEEK_FRAUD_C7BE4W || __SEEK_FRAUD_6LGTFG || __SEEK_FRAUD_ORHOZJ || __SEEK_FRAUD_JOSDVP || __SEEK_FRAUD_XWTJ0S || __SEEK_FRAUD_7QHU_W || __SEEK_FRAUD_MKLICT || __SEEK_FRAUD_2ODBT6 || __SEEK_FRAUD_RL7Z6K || __SEEK_FRAUD_XD5HNK || __SEEK_FRAUD_QEGOBV || __SEEK_FRAUD_MCEI6K || __SEEK_FRAUD_XFMQVE || __SEEK_FRAUD_AN3GQI || __SEEK_FRAUD_QLJWTR || __SEEK_FRAUD_ORCHU5 || __SEEK_FRAUD_GXGKLM || __SEEK_FRAUD_3OPYSM || __SEEK_FRAUD_QKMOJL || __SEEK_FRAUD_RBSKB2 || __SEEK_FRAUD_WZIO9H || __SEEK_FRAUD_ATTT9H || __SEEK_FRAUD_72_V0Y || __SEEK_FRAUD_XG7DBD || __SEEK_FRAUD_FLKBRE || __SEEK_FRAUD_L6ICNJ || __SEEK_FRAUD_238_G_ || __SEEK_FRAUD_M03WB9 || __SEEK_FRAUD_TUOYBL || __SEEK_FRAUD_LQICIN || __SEEK_FRAUD_EAL6NF || __SEEK_FRAUD_TELOJY || __SEEK_FRAUD_DNFIPA || __SEEK_FRAUD_W2UMWG || __SEEK_FRAUD_EWZZ2M || __SEEK_FRAUD_TIWDAE || __SEEK_FRAUD_R9RCJX || __SEEK_FRAUD__GI7UC || __SEEK_FRAUD_EAL_DT || __SEEK_FRAUD_M_U4VI || __SEEK_FRAUD_H2OMNV || __SEEK_FRAUD_VN55YN || __SEEK_FRAUD_EBEFON || __SEEK_FRAUD_LN_G0D || __SEEK_FRAUD_PUSLFS || __SEEK_FRAUD_0YEXVQ || __SEEK_FRAUD_1M9C5T || __SEEK_FRAUD_I3HLDY || __SEEK_FRAUD_VDWAJV || __SEEK_FRAUD__CHQMV || __SEEK_FRAUD_JW7I0T || __SEEK_FRAUD_VBQ9JO || __SEEK_FRAUD_J1WFB_ || __SEEK_FRAUD_IUQ6A9 || __SEEK_FRAUD_A1ARCI || __SEEK_FRAUD_8A1Q6M || __SEEK_FRAUD_YFJVJR || __SEEK_FRAUD_WBUWZR || __SEEK_FRAUD_S_M1GN || __SEEK_FRAUD_ZRUAWA || __SEEK_FRAUD_V86CVT || __SEEK_FRAUD_E2US_V || __SEEK_FRAUD_KT_TR7 || __SEEK_FRAUD_RAQSMO || __SEEK_FRAUD_ZXQJ3E || __SEEK_FRAUD_UDENCE || __SEEK_FRAUD_HDZKRN || __SEEK_FRAUD_DWEVNF || __SEEK_FRAUD_FTO6II || __SEEK_FRAUD_Q3BSST || __SEEK_FRAUD_KCVY4L || __SEEK_FRAUD_DNXWDS || __SEEK_FRAUD_IY4ZBV || __SEEK_FRAUD_QIOHEI || __SEEK_FRAUD_4HH4OS || __SEEK_FRAUD_OBTMVR || __SEEK_FRAUD_6VUONK || __SEEK_FRAUD_F41XLX || __SEEK_FRAUD_9KCDA8 || __SEEK_FRAUD_8FHHRV || __SEEK_FRAUD_IILB8R || __SEEK_FRAUD_GTSAAF || __SEEK_FRAUD_0Q_1PX || __SEEK_FRAUD_ENAUAY || __SEEK_FRAUD_SH1EZL || __SEEK_FRAUD_HCCWXL || __SEEK_FRAUD_PYPH_Q || __SEEK_FRAUD_6EGJH6 || __SEEK_FRAUD_55WLGY || __SEEK_FRAUD_UVV3P5 || __SEEK_FRAUD_FSYFC_ || __SEEK_FRAUD__UEMNA || __SEEK_FRAUD_ZSK9XC || __SEEK_FRAUD_KS6HHB || __SEEK_FRAUD_77PGQK || __SEEK_FRAUD_5MCR_O || __SEEK_FRAUD_JVIQUO || __SEEK_FRAUD_XZHQ8G || __SEEK_FRAUD_6ZE0ZK || __SEEK_FRAUD_BRP46Y || __SEEK_FRAUD_KLGHT2 || __SEEK_FRAUD_G7TLJZ || __SEEK_FRAUD_UCSJVN || __SEEK_FRAUD__KZVBM || __SEEK_FRAUD_NH1RHX || __SEEK_FRAUD_NAWNBX || __SEEK_FRAUD_ZSQUMG || __SEEK_FRAUD_NXGM0O || __SEEK_FRAUD_RODZKF || __SEEK_FRAUD_NJRW4J || __SEEK_FRAUD__EVXD7 || __SEEK_FRAUD_KR9WGG || __SEEK_FRAUD_SEBSU_ || __SEEK_FRAUD__O41EP || __SEEK_FRAUD_IYEOHL || __SEEK_FRAUD_F2DKBP || __SEEK_FRAUD_VEGVH5 || __SEEK_FRAUD_POCEH_ || __SEEK_FRAUD_7OGMRE || __SEEK_FRAUD_MEMBMQ || __SEEK_FRAUD_OL815K || __SEEK_FRAUD_QLUR_M || __SEEK_FRAUD_39_UGR || __SEEK_FRAUD_L4OF4_ || __SEEK_FRAUD_6OYTMK || __SEEK_FRAUD__6TXBR || __SEEK_FRAUD_EGRZ5T || __SEEK_FRAUD_RLKX_U || __SEEK_FRAUD_BVXMQB || __SEEK_FRAUD_JU0DNT || __SEEK_FRAUD_7_3VAV || __SEEK_FRAUD_ELURRJ || __SEEK_FRAUD_3TU436 || __SEEK_FRAUD_I2R70M || __SEEK_FRAUD_G2JDK8 || __SEEK_FRAUD_BPL3YK || __SEEK_FRAUD_4ZVC1C || __SEEK_FRAUD_8DEPUJ || __SEEK_FRAUD_F6ZEVO || __SEEK_FRAUD_H_JSIS || __SEEK_FRAUD_ESXXFQ || __SEEK_FRAUD_GN2203 || __SEEK_FRAUD_TMBKSM || __SEEK_FRAUD_QT5OWK || __SEEK_FRAUD_GI_LXG || __SEEK_FRAUD_1ZPDPI || __SEEK_FRAUD_5Y6ILV || __SEEK_FRAUD_R2DFPW || __SEEK_FRAUD_DPW8DR || __SEEK_FRAUD_7NCZI_ || __SEEK_FRAUD_YGSXRP || __SEEK_FRAUD_7HMGZ1 || __SEEK_FRAUD_28G2B2 || __SEEK_FRAUD__2TQ2_ || __SEEK_FRAUD_CIDHJP || __SEEK_FRAUD_1UPTM9 || __SEEK_FRAUD_GKVMSG || __SEEK_FRAUD_MVBG8Z || __SEEK_FRAUD_GMLT7O || __SEEK_FRAUD_VQ2UGD || __SEEK_FRAUD_PLG_K_ || __SEEK_FRAUD_SLSYFP || __SEEK_FRAUD_NAXE2Z || __SEEK_FRAUD_GYYTYT || __SEEK_FRAUD_VUPAEQ || __SEEK_FRAUD_TCYHCF || __SEEK_FRAUD_82HMFF || __SEEK_FRAUD_EG28P6 || __SEEK_FRAUD_G4RKKF || __SEEK_FRAUD_FOT6IF || __SEEK_FRAUD_OP4FZV || __SEEK_FRAUD__UWBXC || __SEEK_FRAUD__MMCUC || __SEEK_FRAUD_1SZQH_ || __SEEK_FRAUD_RS8OQV || __SEEK_FRAUD_WU7H4Y || __SEEK_FRAUD_BSHI01 || __SEEK_FRAUD_VYVEY7 || __SEEK_FRAUD_ZBR4PG || __SEEK_FRAUD_XBAISM || __SEEK_FRAUD_RQIFJU || __SEEK_FRAUD_J_8IHB || __SEEK_FRAUD_GY4RJE || __SEEK_FRAUD_VMKU09 || __SEEK_FRAUD_JVQE1K || __SEEK_FRAUD_MNSFWO || __SEEK_FRAUD_AHTDME || __SEEK_FRAUD_4L1CUF || __SEEK_FRAUD_FDHM4O || __SEEK_FRAUD_C_HP37 || __SEEK_FRAUD_Z93JKO || __SEEK_FRAUD_JJ2QOC || __SEEK_FRAUD_SV6SWN || __SEEK_FRAUD_XVOXCD || __SEEK_FRAUD_IEV_CE || __SEEK_FRAUD_RZIRDL || __SEEK_FRAUD_D7_SRO || __SEEK_FRAUD_84RQ6W || __SEEK_FRAUD_8HKOPI || __SEEK_FRAUD_BOVAPH || __SEEK_FRAUD_C17QX1 || __SEEK_FRAUD_JLSUKM || __SEEK_FRAUD_LQGQPO || __SEEK_FRAUD_MB4NHA || __SEEK_FRAUD_UJZKNM || __SEEK_FRAUD_M_UYU5 || __SEEK_FRAUD_GOYZPG || __SEEK_FRAUD_6HUWEQ || __SEEK_FRAUD_IHV47A || __SEEK_FRAUD_XNIO3Q || __SEEK_FRAUD_37UB9O || __SEEK_FRAUD_AR89UY || __SEEK_FRAUD_LIQ9CK || __SEEK_FRAUD_0ENSZN || __SEEK_FRAUD_PADMFK || __SEEK_FRAUD_AB6ELR || __SEEK_FRAUD_VD8CIS || __SEEK_FRAUD_G0IS4D || __SEEK_FRAUD_7UXDY2 || __SEEK_FRAUD_TWJR_E || __SEEK_FRAUD_HW7ENB || __SEEK_FRAUD_2LI5N4 || __SEEK_FRAUD_SESJTR || __SEEK_FRAUD_YSIB2_ || __SEEK_FRAUD__BXKBH || __SEEK_FRAUD_B2MWEQ || __SEEK_FRAUD_HTRHIY || __SEEK_FRAUD_8GOL16 || __SEEK_FRAUD__GKS7V || __SEEK_FRAUD_R_EW6F || __SEEK_FRAUD_RUAEP8 || __SEEK_FRAUD_EVB_T3 || __SEEK_FRAUD_NVFQGO || __SEEK_FRAUD_TLPAKX || __SEEK_FRAUD_59Y9WZ || __SEEK_FRAUD_DI9349 || __SEEK_FRAUD_WQ2NTM || __SEEK_FRAUD_05MSDR || __SEEK_FRAUD_ZIXFEC || __SEEK_FRAUD_HWMBYB || __SEEK_FRAUD_GRFNHQ || __SEEK_FRAUD_YSRIAC || __SEEK_FRAUD_LX42QL || __SEEK_FRAUD_EBGSSZ || __SEEK_FRAUD_TATA_B || __SEEK_FRAUD_7MXFV8 || __SEEK_FRAUD_9OLSG2 || __SEEK_FRAUD_WN6DGZ || __SEEK_FRAUD_6LMXWQ || __SEEK_FRAUD_GRI_IZ || __SEEK_FRAUD_8N4OLG || __SEEK_FRAUD_FMTQVG || __SEEK_FRAUD_4IQVP5 || __SEEK_FRAUD_GOB8DP || __SEEK_FRAUD_WEX7TC || __SEEK_FRAUD_QHHJOT || __SEEK_FRAUD_F5EASW || __SEEK_FRAUD_RK7ST3 || __SEEK_FRAUD_7ICRYZ || __SEEK_FRAUD_ESYOL3 || __SEEK_FRAUD_FTFQJK || __SEEK_FRAUD_O8HLCQ || __SEEK_FRAUD_SEXGXK || __SEEK_FRAUD_X73ESB || __SEEK_FRAUD_KGXNR0 || __SEEK_FRAUD_YXMY7P || __SEEK_FRAUD_F6LCUO || __SEEK_FRAUD_AWGSAH || __SEEK_FRAUD_PBDQ4T || __SEEK_FRAUD_HA1KZT || __SEEK_FRAUD_0BHYFO || __SEEK_FRAUD_5U1LX_ || __SEEK_FRAUD_NMFPFW || __SEEK_FRAUD_DVQ_OH || __SEEK_FRAUD_A5PM6O || __SEEK_FRAUD_WKB0PH || __SEEK_FRAUD_SUOVUP || __SEEK_FRAUD_B0BTNE || __SEEK_FRAUD_T5JBS7 || __SEEK_FRAUD_M1S8EA || __SEEK_FRAUD_SVVXNA || __SEEK_FRAUD_V4_LC8 || __SEEK_FRAUD_N_W2ZS || __SEEK_FRAUD_VTLF_0 || __SEEK_FRAUD_UWS9PO || __SEEK_FRAUD_YTHL2Y || __SEEK_FRAUD_IGWSWV || __SEEK_FRAUD_NCXX2C || __SEEK_FRAUD_HIQMMW || __SEEK_FRAUD_LGPUCE || __SEEK_FRAUD_HXZ_XC || __SEEK_FRAUD_MQOXUR || __SEEK_FRAUD_AZLPG8 || __SEEK_FRAUD_KTN2PE) #score JM_SOUGHT_FRAUD_3 3.0 describe JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns ##} JM_SOUGHT_FRAUD_3 ##{ JM_TORA_XM meta JM_TORA_XM (__MAILER_OL_6626 && __MOLE_2962 && __NAKED_TO) ##} JM_TORA_XM ##{ KAM_LOTTO1 meta KAM_LOTTO1 (__KAM_LOTTO1 + __KAM_LOTTO2 + __KAM_LOTTO3 + __KAM_LOTTO4 + __KAM_LOTTO5 + __KAM_LOTTO6 + __KAM_LOTTO7 >= 3) describe KAM_LOTTO1 Likely to be a e-Lotto Scam Email #score KAM_LOTTO1 0.5 ##} KAM_LOTTO1 ##{ KAM_LOTTO2 meta KAM_LOTTO2 (__KAM_LOTTO1 + __KAM_LOTTO2 + __KAM_LOTTO3 + __KAM_LOTTO4 + __KAM_LOTTO5 + __KAM_LOTTO6 + __KAM_LOTTO7 >= 4) describe KAM_LOTTO2 Highly Likely to be a e-Lotto Scam Email #score KAM_LOTTO2 1.0 ##} KAM_LOTTO2 ##{ KAM_STOCKOTC meta KAM_STOCKOTC (0) tflags KAM_STOCKOTC publish ##} KAM_STOCKOTC ##{ KAM_STOCKTIP15 meta KAM_STOCKTIP15 (0) tflags KAM_STOCKTIP15 publish ##} KAM_STOCKTIP15 ##{ KAM_STOCKTIP20 meta KAM_STOCKTIP20 (0) tflags KAM_STOCKTIP20 publish ##} KAM_STOCKTIP20 ##{ KAM_STOCKTIP21 meta KAM_STOCKTIP21 (0) tflags KAM_STOCKTIP21 publish ##} KAM_STOCKTIP21 ##{ KAM_STOCKTIP4 meta KAM_STOCKTIP4 (0) tflags KAM_STOCKTIP4 publish ##} KAM_STOCKTIP4 ##{ KAM_STOCKTIP6 meta KAM_STOCKTIP6 (0) tflags KAM_STOCKTIP6 publish ##} KAM_STOCKTIP6 ##{ KB_DATE_CONTAINS_TAB header KB_DATE_CONTAINS_TAB Date:raw =~ /^\t/ ##} KB_DATE_CONTAINS_TAB ##{ KB_FAKED_THE_BAT meta KB_FAKED_THE_BAT (__THEBAT_MUA && KB_DATE_CONTAINS_TAB) ##} KB_FAKED_THE_BAT ##{ KB_RATWARE_BOUNDARY meta KB_RATWARE_BOUNDARY __RATWARE_BOUND_A || __RATWARE_BOUND_B ##} KB_RATWARE_BOUNDARY ##{ KB_RATWARE_MSGID meta KB_RATWARE_MSGID (__KB_MSGID_OUTLOOK_888 && __ANY_OUTLOOK_MUA) ##} KB_RATWARE_MSGID ##{ KB_RATWARE_OUTLOOK_08 header KB_RATWARE_OUTLOOK_08 ALL =~ /^Message-Id: <....([0-9a-f]{8})\$[0-9a-f]{8}\$.{100,400}boundary="----=_NextPart_000_...._\1\./msi # " ##} KB_RATWARE_OUTLOOK_08 ##{ KB_RATWARE_OUTLOOK_12 header KB_RATWARE_OUTLOOK_12 ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{4})[0-9a-f]{4}\$.{100,400}boundary="----=_NextPart_000_...._\1\.\2/msi # " ##} KB_RATWARE_OUTLOOK_12 ##{ KB_RATWARE_OUTLOOK_16 header KB_RATWARE_OUTLOOK_16 ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{8})\$.{100,400}boundary="----=_NextPart_000_...._\1\.\2/msi # " ##} KB_RATWARE_OUTLOOK_16 ##{ KB_RATWARE_OUTLOOK_MID header KB_RATWARE_OUTLOOK_MID ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{8})\$[0-9a-f]{8}\@.{100,400}boundary="----=_NextPart_000_...._\1\.\2"/msi ##} KB_RATWARE_OUTLOOK_MID ##{ LIVEFILESTORE uri LIVEFILESTORE m~livefilestore.com/~ ##} LIVEFILESTORE ##{ LONG_TERM_PRICE body LONG_TERM_PRICE /long\W+term\W+(target|projected)(\W+price)?/i ##} LONG_TERM_PRICE ##{ LOOPHOLE_1 body LOOPHOLE_1 /loop-?hole in the banking/i describe LOOPHOLE_1 A loop hole in the banking laws? ##} LOOPHOLE_1 ##{ LOTTERY_1 meta LOTTERY_1 (__DBLCLAIM && __CASHPRZ) ##} LOTTERY_1 ##{ LOTTERY_PH_004470 meta LOTTERY_PH_004470 (__AFF_004470_NUMBER && __AFF_LOTTERY) ##} LOTTERY_PH_004470 ##{ LOTTO_AGENT body LOTTO_AGENT /\b(?:claim(?:s|ing)?(?:\sprocessing)?|fiducia\w+|reimbursement|prize\stransfer|(?:international|foreign)\sremittance|payment|immunity|grants?)\s?(?:agent|manager|officer|secretary)/i describe LOTTO_AGENT Claims Agent #score LOTTO_AGENT 0.50 ##} LOTTO_AGENT ##{ L_SPAM_TOOL_13 header L_SPAM_TOOL_13 Date =~ /\s[+-]\d(?![2358]45)\d[124-9]\d$/ ##} L_SPAM_TOOL_13 ##{ MANY_GOOG_PROXY meta MANY_GOOG_PROXY __FEEDPROXY > 5 describe MANY_GOOG_PROXY Many Google feedproxy URIs ##} MANY_GOOG_PROXY ##{ MANY_SPAN_IN_TEXT meta MANY_SPAN_IN_TEXT (__SPAN_BEG_TEXT > 5) && (__SPAN_END_TEXT > 5) describe MANY_SPAN_IN_TEXT Many tags embedded within text ##} MANY_SPAN_IN_TEXT ##{ MANY_TINY_FLOAT meta MANY_TINY_FLOAT __TINY_FLOAT > 5 describe MANY_TINY_FLOAT Many small-font floating HTML elements - text obfuscation? ##} MANY_TINY_FLOAT ##{ MID_DEGREES header MID_DEGREES Message-ID =~ /^<\d{14}\.[A-F0-9]{10}\@[A-Z0-9]+>$/ ##} MID_DEGREES ##{ MIME_BOUND_EQ_REL header MIME_BOUND_EQ_REL Content-Type =~ /boundary="=====================_\d+==\.REL"/s ##} MIME_BOUND_EQ_REL ##{ MIME_PHP_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader meta MIME_PHP_NO_TEXT (T_MIME_NO_TEXT && __XM_PHP) # score MIME_PHP_NO_TEXT 2.00 describe MIME_PHP_NO_TEXT No text body parts, X-Mailer: PHP endif ##} MIME_PHP_NO_TEXT ##{ MONEY_FROM_MISSP meta MONEY_FROM_MISSP T_LOTS_OF_MONEY && T_FROM_MISSPACED describe MONEY_FROM_MISSP Lots of money and misspaced From #score MONEY_FROM_MISSP 1.5 ##} MONEY_FROM_MISSP ##{ MSOE_MID_WRONG_CASE meta MSOE_MID_WRONG_CASE (__XM_OUTLOOK_EXPRESS && __MSOE_MID_WRONG_CASE && !__MIMEOLE_1106) ##} MSOE_MID_WRONG_CASE ##{ NULL_IN_BODY full NULL_IN_BODY /\x00/ describe NULL_IN_BODY Message has NUL (ASCII 0) byte in message ##} NULL_IN_BODY ##{ PART_CID_STOCK ifplugin Mail::SpamAssassin::Plugin::MIMEHeader meta PART_CID_STOCK (__ANY_IMAGE_ATTACH&&__PART_STOCK_CID&&!__PART_STOCK_CL&&!__PART_STOCK_CD_F) describe PART_CID_STOCK Has a spammy image attachment (by Content-ID) endif ##} PART_CID_STOCK ##{ PART_CID_STOCK_LESS ifplugin Mail::SpamAssassin::Plugin::MIMEHeader meta PART_CID_STOCK_LESS (__ANY_IMAGE_ATTACH&&__PART_CID_STOCK_LESS) describe PART_CID_STOCK_LESS Has a spammy image attachment (by Content-ID, more specific) endif ##} PART_CID_STOCK_LESS ##{ RCVD_BAD_ID header RCVD_BAD_ID Received =~ /\bid\s+[a-zA-Z0-9_+\/\\,-]+(?:[!"\#\$\%&'()*:<=>?\@\[\]^\`{|}~]|;\S)/ ##} RCVD_BAD_ID ##{ RCVD_FORGED_WROTE header RCVD_FORGED_WROTE Received =~ / by \S+ with esmtp \([^a-z ]{6,} [^a-z ]{3,}\) id/ describe RCVD_FORGED_WROTE Forged 'Received' header found ('wrote:' spam) ##} RCVD_FORGED_WROTE ##{ RCVD_FORGED_WROTE2 header RCVD_FORGED_WROTE2 Received =~ /from [0-9.]+ \(HELO \S+[A-Za-z]+\) by (\S+) with esmtp \(\S+\s\S+\) id \S{6}-\S{6}-\S\S for \S+@\1;/s ##} RCVD_FORGED_WROTE2 ##{ RCVD_IN_BRBL_LASTEXT ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_BRBL_LASTEXT eval:check_rbl('brbl-lastexternal','bb.barracudacentral.org') tflags RCVD_IN_BRBL_LASTEXT net endif ##} RCVD_IN_BRBL_LASTEXT ##{ RCVD_IN_CSS header RCVD_IN_CSS eval:check_rbl_sub('zen', '127.0.0.3') describe RCVD_IN_CSS Received via a relay in Spamhaus CSS tflags RCVD_IN_CSS net ##} RCVD_IN_CSS ##{ RCVD_IN_DNSWL_HI ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_DNSWL_HI eval:check_rbl_sub('dnswl-firsttrusted', '127.0.\d+.3') describe RCVD_IN_DNSWL_HI Sender listed at http://www.dnswl.org/, high trust tflags RCVD_IN_DNSWL_HI nice net endif ##} RCVD_IN_DNSWL_HI ##{ RCVD_IN_DNSWL_LOW ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_DNSWL_LOW eval:check_rbl_sub('dnswl-firsttrusted', '127.0.\d+.1') describe RCVD_IN_DNSWL_LOW Sender listed at http://www.dnswl.org/, low trust tflags RCVD_IN_DNSWL_LOW nice net endif ##} RCVD_IN_DNSWL_LOW ##{ RCVD_IN_DNSWL_MED ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_DNSWL_MED eval:check_rbl_sub('dnswl-firsttrusted', '127.0.\d+.2') describe RCVD_IN_DNSWL_MED Sender listed at http://www.dnswl.org/, medium trust tflags RCVD_IN_DNSWL_MED nice net endif ##} RCVD_IN_DNSWL_MED ##{ RCVD_IN_DNSWL_NONE ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_DNSWL_NONE eval:check_rbl_sub('dnswl-firsttrusted', '127.0.\d+.0') describe RCVD_IN_DNSWL_NONE Sender listed at http://www.dnswl.org/, low trust tflags RCVD_IN_DNSWL_NONE nice net endif ##} RCVD_IN_DNSWL_NONE ##{ RCVD_IN_IADB_DK ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_DK eval:check_rbl_sub('iadb-firsttrusted', '^127.2.255.3$') describe RCVD_IN_IADB_DK IADB: Sender publishes Domain Keys record tflags RCVD_IN_IADB_DK net nice endif ##} RCVD_IN_IADB_DK ##{ RCVD_IN_IADB_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_DOPTIN eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.10$') describe RCVD_IN_IADB_DOPTIN IADB: All mailing list mail is confirmed opt-in tflags RCVD_IN_IADB_DOPTIN net nice endif ##} RCVD_IN_IADB_DOPTIN ##{ RCVD_IN_IADB_DOPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_DOPTIN_GT50 eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.9$') describe RCVD_IN_IADB_DOPTIN_GT50 IADB: Confirmed opt-in used more than 50% of the time tflags RCVD_IN_IADB_DOPTIN_GT50 net nice endif ##} RCVD_IN_IADB_DOPTIN_GT50 ##{ RCVD_IN_IADB_DOPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_DOPTIN_LT50 eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.8$') describe RCVD_IN_IADB_DOPTIN_LT50 IADB: Confirmed opt-in used less than 50% of the time tflags RCVD_IN_IADB_DOPTIN_LT50 net nice endif ##} RCVD_IN_IADB_DOPTIN_LT50 ##{ RCVD_IN_IADB_EDDB ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_EDDB eval:check_rbl_sub('iadb-firsttrusted', '^127.0.2.1$') describe RCVD_IN_IADB_EDDB IADB: Participates in Email Deliverability Database tflags RCVD_IN_IADB_EDDB net nice endif ##} RCVD_IN_IADB_EDDB ##{ RCVD_IN_IADB_EPIA ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_EPIA eval:check_rbl_sub('iadb-firsttrusted', '^127.0.2.2$') describe RCVD_IN_IADB_EPIA IADB: Member of Email Processing Industry Alliance tflags RCVD_IN_IADB_EPIA net nice endif ##} RCVD_IN_IADB_EPIA ##{ RCVD_IN_IADB_GOODMAIL ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_GOODMAIL eval:check_rbl_sub('iadb-firsttrusted', '^127.2.255.103$') describe RCVD_IN_IADB_GOODMAIL IADB: Sender has been certified by GoodMail tflags RCVD_IN_IADB_GOODMAIL net nice endif ##} RCVD_IN_IADB_GOODMAIL ##{ RCVD_IN_IADB_LISTED ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_LISTED eval:check_rbl_sub('iadb-firsttrusted', '^127.0.0.[12]$') describe RCVD_IN_IADB_LISTED Participates in the IADB system tflags RCVD_IN_IADB_LISTED net nice endif ##} RCVD_IN_IADB_LISTED ##{ RCVD_IN_IADB_LOOSE ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_LOOSE eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.4$') describe RCVD_IN_IADB_LOOSE IADB: Adds relationship addrs w/out opt-in tflags RCVD_IN_IADB_LOOSE net nice endif ##} RCVD_IN_IADB_LOOSE ##{ RCVD_IN_IADB_MI_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_MI_CPEAR eval:check_rbl_sub('iadb-firsttrusted', '^127.101.1.10$') describe RCVD_IN_IADB_MI_CPEAR IADB: Complies with Michigan's CPEAR law tflags RCVD_IN_IADB_MI_CPEAR net nice endif ##} RCVD_IN_IADB_MI_CPEAR ##{ RCVD_IN_IADB_MI_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_MI_CPR_30 eval:check_rbl_sub('iadb-firsttrusted', '^127.101.101.10$') describe RCVD_IN_IADB_MI_CPR_30 IADB: Checked lists against Michigan's CPR within 30 days tflags RCVD_IN_IADB_MI_CPR_30 net nice endif ##} RCVD_IN_IADB_MI_CPR_30 ##{ RCVD_IN_IADB_MI_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_MI_CPR_MAT eval:check_rbl_sub('iadb-firsttrusted', '^127.101.201.10$') describe RCVD_IN_IADB_MI_CPR_MAT IADB: Sends no material under Michigan's CPR tflags RCVD_IN_IADB_MI_CPR_MAT net nice endif ##} RCVD_IN_IADB_MI_CPR_MAT ##{ RCVD_IN_IADB_ML_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_ML_DOPTIN eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.100$') describe RCVD_IN_IADB_ML_DOPTIN IADB: Mailing list email only, confirmed opt-in tflags RCVD_IN_IADB_ML_DOPTIN net nice endif ##} RCVD_IN_IADB_ML_DOPTIN ##{ RCVD_IN_IADB_NOCONTROL ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_NOCONTROL eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.0$') describe RCVD_IN_IADB_NOCONTROL IADB: Has absolutely no mailing controls in place tflags RCVD_IN_IADB_NOCONTROL net nice endif ##} RCVD_IN_IADB_NOCONTROL ##{ RCVD_IN_IADB_OOO ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_OOO eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.200$') describe RCVD_IN_IADB_OOO IADB: One-to-one/transactional email only tflags RCVD_IN_IADB_OOO net nice endif ##} RCVD_IN_IADB_OOO ##{ RCVD_IN_IADB_OPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_OPTIN eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.7$') describe RCVD_IN_IADB_OPTIN IADB: All mailing list mail is opt-in tflags RCVD_IN_IADB_OPTIN net nice endif ##} RCVD_IN_IADB_OPTIN ##{ RCVD_IN_IADB_OPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_OPTIN_GT50 eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.6$') describe RCVD_IN_IADB_OPTIN_GT50 IADB: Opt-in used more than 50% of the time tflags RCVD_IN_IADB_OPTIN_GT50 net nice endif ##} RCVD_IN_IADB_OPTIN_GT50 ##{ RCVD_IN_IADB_OPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_OPTIN_LT50 eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.5$') describe RCVD_IN_IADB_OPTIN_LT50 IADB: Opt-in used less than 50% of the time tflags RCVD_IN_IADB_OPTIN_LT50 net nice endif ##} RCVD_IN_IADB_OPTIN_LT50 ##{ RCVD_IN_IADB_OPTOUTONLY ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_OPTOUTONLY eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.1$') describe RCVD_IN_IADB_OPTOUTONLY IADB: Scrapes addresses, pure opt-out only tflags RCVD_IN_IADB_OPTOUTONLY net nice endif ##} RCVD_IN_IADB_OPTOUTONLY ##{ RCVD_IN_IADB_RDNS ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_RDNS eval:check_rbl_sub('iadb-firsttrusted', '^127.2.255.4$') describe RCVD_IN_IADB_RDNS IADB: Sender has reverse DNS record tflags RCVD_IN_IADB_RDNS net nice endif ##} RCVD_IN_IADB_RDNS ##{ RCVD_IN_IADB_SENDERID ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_SENDERID eval:check_rbl_sub('iadb-firsttrusted', '^127.2.255.2$') describe RCVD_IN_IADB_SENDERID IADB: Sender publishes Sender ID record tflags RCVD_IN_IADB_SENDERID net nice endif ##} RCVD_IN_IADB_SENDERID ##{ RCVD_IN_IADB_SPF ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_SPF eval:check_rbl_sub('iadb-firsttrusted', '^127.2.255.1$') describe RCVD_IN_IADB_SPF IADB: Sender publishes SPF record tflags RCVD_IN_IADB_SPF net nice endif ##} RCVD_IN_IADB_SPF ##{ RCVD_IN_IADB_UNVERIFIED_1 ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_UNVERIFIED_1 eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.2$') describe RCVD_IN_IADB_UNVERIFIED_1 IADB: Accepts unverified sign-ups tflags RCVD_IN_IADB_UNVERIFIED_1 net nice endif ##} RCVD_IN_IADB_UNVERIFIED_1 ##{ RCVD_IN_IADB_UNVERIFIED_2 ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_UNVERIFIED_2 eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.3$') describe RCVD_IN_IADB_UNVERIFIED_2 IADB: Accepts unverified sign-ups, gives chance to opt out tflags RCVD_IN_IADB_UNVERIFIED_2 net nice endif ##} RCVD_IN_IADB_UNVERIFIED_2 ##{ RCVD_IN_IADB_UT_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_UT_CPEAR eval:check_rbl_sub('iadb-firsttrusted', '^127.101.2.10$') describe RCVD_IN_IADB_UT_CPEAR IADB: Complies with Utah's CPEAR law tflags RCVD_IN_IADB_UT_CPEAR net nice endif ##} RCVD_IN_IADB_UT_CPEAR ##{ RCVD_IN_IADB_UT_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_UT_CPR_30 eval:check_rbl_sub('iadb-firsttrusted', '^127.101.102.10$') describe RCVD_IN_IADB_UT_CPR_30 IADB: Checked lists against Utah's CPR within 30 days tflags RCVD_IN_IADB_UT_CPR_30 net nice endif ##} RCVD_IN_IADB_UT_CPR_30 ##{ RCVD_IN_IADB_UT_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_UT_CPR_MAT eval:check_rbl_sub('iadb-firsttrusted', '^127.101.202.10$') describe RCVD_IN_IADB_UT_CPR_MAT IADB: Sends no material under Utah's CPR tflags RCVD_IN_IADB_UT_CPR_MAT net nice endif ##} RCVD_IN_IADB_UT_CPR_MAT ##{ RCVD_IN_PSBL header RCVD_IN_PSBL eval:check_rbl('psbl-lastexternal', 'psbl.surriel.com.') describe RCVD_IN_PSBL Received via a relay in PSBL tflags RCVD_IN_PSBL net ##} RCVD_IN_PSBL ##{ RCVD_IN_RP_CERTIFIED header RCVD_IN_RP_CERTIFIED eval:check_rbl_txt('ssc-firsttrusted', 'sa-trusted.bondedsender.org.') describe RCVD_IN_RP_CERTIFIED Sender is in Return Path Certified (trusted relay) tflags RCVD_IN_RP_CERTIFIED net nice ##} RCVD_IN_RP_CERTIFIED ##{ RCVD_IN_RP_RNBL header RCVD_IN_RP_RNBL eval:check_rbl('rnbl-lastexternal','bl.score.senderscore.com.') describe RCVD_IN_RP_RNBL Relay in RNBL, https://senderscore.org/blacklistlookup/ tflags RCVD_IN_RP_RNBL net ##} RCVD_IN_RP_RNBL ##{ RCVD_IN_RP_SAFE header RCVD_IN_RP_SAFE eval:check_rbl_txt('ssc-firsttrusted','sa-accredit.habeas.com.') describe RCVD_IN_RP_SAFE Sender is in Return Path Safe (trusted relay) tflags RCVD_IN_RP_SAFE net nice ##} RCVD_IN_RP_SAFE ##{ RCVD_MAIL_COM header RCVD_MAIL_COM Received =~ /[\s\(\[](?:post|mail)\.com[\s\)\]]/is describe RCVD_MAIL_COM Forged Received header (contains post.com or mail.com) ##} RCVD_MAIL_COM ##{ RDNS_LOCALHOST header RDNS_LOCALHOST X-Spam-Relays-External =~ /^\[ ip=(?!127)\d+\.\d+\.\d+\.\d+ rdns=localhost(?:\.localdomain)? /i describe RDNS_LOCALHOST Sender's public rDNS is "localhost" ##} RDNS_LOCALHOST ##{ REPLYTO_WITHOUT_TO_CC meta REPLYTO_WITHOUT_TO_CC (__REPLYTO_EXISTS && !__TOCC_EXISTS) ##} REPLYTO_WITHOUT_TO_CC ##{ S25R_4 describe S25R_4 S25R: Bottom of rDNS ends w/ num, next lvl has num-num meta S25R_4 __LAST_EXTERNAL_RELAY_NO_AUTH && __S25R_4 && !(__S25R_1||__S25R_2||__S25R_3||__S25R_5||__S25R_6 || __NOT_SPOOFED || __GREYLISTED) ##} S25R_4 ##{ S25R_6 describe S25R_6 S25R: rDNS looks dynamic or customer-facing meta S25R_6 __LAST_EXTERNAL_RELAY_NO_AUTH && __S25R_6 && !(__S25R_1||__S25R_2||__S25R_3||__S25R_4||__S25R_5 || __NOT_SPOOFED || __GREYLISTED) ##} S25R_6 ##{ SANE_04e8bf28eb445199a7f11b943c44d209 body SANE_04e8bf28eb445199a7f11b943c44d209 /replica watches/ describe SANE_04e8bf28eb445199a7f11b943c44d209 Email.Spam.Gen3177.Sanesecurity.08051611 #score SANE_04e8bf28eb445199a7f11b943c44d209 0.01 ##} SANE_04e8bf28eb445199a7f11b943c44d209 ##{ SANE_1c4f3286fa4aed6424ced88bfaf8b09c body SANE_1c4f3286fa4aed6424ced88bfaf8b09c /innerhalb von 2\-3 Tagen/ #score SANE_1c4f3286fa4aed6424ced88bfaf8b09c 0.01 describe SANE_1c4f3286fa4aed6424ced88bfaf8b09c Email.Spam.Gen3234.Sanesecurity.08052309 ##} SANE_1c4f3286fa4aed6424ced88bfaf8b09c ##{ SANE_2b173a7fb7518c75ac8a2d294d773fd8 body SANE_2b173a7fb7518c75ac8a2d294d773fd8 /High Quality Watches/ #score SANE_2b173a7fb7518c75ac8a2d294d773fd8 0.01 describe SANE_2b173a7fb7518c75ac8a2d294d773fd8 Email.Spam.Sanesecurity.Url_2496 ##} SANE_2b173a7fb7518c75ac8a2d294d773fd8 ##{ SANE_3b92eda751c992f230f215fb7eb36844 body SANE_3b92eda751c992f230f215fb7eb36844 /Replica Watches/ describe SANE_3b92eda751c992f230f215fb7eb36844 Email.Spam.Gen158.Sanesecurity.07012700 #score SANE_3b92eda751c992f230f215fb7eb36844 0.01 ##} SANE_3b92eda751c992f230f215fb7eb36844 ##{ SANE_4ef8302546bf270a19baf98508afacc4 body SANE_4ef8302546bf270a19baf98508afacc4 /replica watch/ #score SANE_4ef8302546bf270a19baf98508afacc4 0.01 describe SANE_4ef8302546bf270a19baf98508afacc4 Email.Spam.Gen1941.Sanesecurity.07112519 ##} SANE_4ef8302546bf270a19baf98508afacc4 ##{ SANE_7429530a7398f43f1f1b795f9420714e body SANE_7429530a7398f43f1f1b795f9420714e /MSN Featured Offers/ describe SANE_7429530a7398f43f1f1b795f9420714e Email.Spam.Gen2507.Sanesecurity.08021303 #score SANE_7429530a7398f43f1f1b795f9420714e 0.01 ##} SANE_7429530a7398f43f1f1b795f9420714e ##{ SANE_91eb43f705d25c804374a746d7519660 body SANE_91eb43f705d25c804374a746d7519660 /online casino/ describe SANE_91eb43f705d25c804374a746d7519660 Email.Malware.Sanesecurity.07011300 #score SANE_91eb43f705d25c804374a746d7519660 0.01 ##} SANE_91eb43f705d25c804374a746d7519660 ##{ SANE_d0d2b0f6373bf91253d66dd74c594b87 body SANE_d0d2b0f6373bf91253d66dd74c594b87 /Luxury Watches/ #score SANE_d0d2b0f6373bf91253d66dd74c594b87 0.01 describe SANE_d0d2b0f6373bf91253d66dd74c594b87 Email.Spam.Sanesecurity.Url_2499 ##} SANE_d0d2b0f6373bf91253d66dd74c594b87 ##{ SB_GIF_AND_NO_URIS meta SB_GIF_AND_NO_URIS (__GIF_ATTACH&&!__HAS_ANY_URI&&!__HAS_ANY_EMAIL) ##} SB_GIF_AND_NO_URIS ##{ SHORT_HELO_AND_INLINE_IMAGE meta SHORT_HELO_AND_INLINE_IMAGE (__HELO_NO_DOMAIN && __ANY_IMAGE_ATTACH) describe SHORT_HELO_AND_INLINE_IMAGE Short HELO string, with inline image ##} SHORT_HELO_AND_INLINE_IMAGE ##{ SHORT_TERM_PRICE body SHORT_TERM_PRICE /short\W+term\W+(target|projected)(\W+price)?/i ##} SHORT_TERM_PRICE ##{ SPAMMY_XMAILER meta SPAMMY_XMAILER (__XM_OL_28001441||__XM_OL_48072300||__XM_OL_28004682||__XM_OL_10_0_4115||__XM_OL_4_72_2106_4) describe SPAMMY_XMAILER X-Mailer string is common in spam and not in ham ##} SPAMMY_XMAILER ##{ STOCK_IMG_CTYPE meta STOCK_IMG_CTYPE (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__CTYPE_ONETAB_GIF&&__HTML_IMG_ONLY) describe STOCK_IMG_CTYPE Stock spam image part, with distinctive Content-Type header ##} STOCK_IMG_CTYPE ##{ STOCK_IMG_HDR_FROM meta STOCK_IMG_HDR_FROM (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__TVD_FW_GRAPHIC_ID1&&__HTML_IMG_ONLY) describe STOCK_IMG_HDR_FROM Stock spam image part, with distinctive From line ##} STOCK_IMG_HDR_FROM ##{ STOCK_IMG_HTML meta STOCK_IMG_HTML (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__PART_STOCK_CID&&__HTML_IMG_ONLY) describe STOCK_IMG_HTML Stock spam image part, with distinctive HTML ##} STOCK_IMG_HTML ##{ STOCK_IMG_OUTLOOK meta STOCK_IMG_OUTLOOK (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__XM_MS_IN_GENERAL&&__HTML_LENGTH_1536_2048) describe STOCK_IMG_OUTLOOK Stock spam image part, with Outlook-like features ##} STOCK_IMG_OUTLOOK ##{ STOCK_PRICES meta STOCK_PRICES (SHORT_TERM_PRICE && LONG_TERM_PRICE) ##} STOCK_PRICES ##{ STOX_AND_PRICE meta STOX_AND_PRICE CURR_PRICE && STOX_REPLY_TYPE ##} STOX_AND_PRICE ##{ STOX_REPLY_TYPE header STOX_REPLY_TYPE Content-Type =~ /text\/plain; .* reply-type=original/ ##} STOX_REPLY_TYPE ##{ STOX_REPLY_TYPE_WITHOUT_QUOTES meta STOX_REPLY_TYPE_WITHOUT_QUOTES (STOX_REPLY_TYPE && !(__HS_SUBJ_RE_FW || __HS_QUOTE)) ##} STOX_REPLY_TYPE_WITHOUT_QUOTES ##{ SUBJECT_NEEDS_ENCODING meta SUBJECT_NEEDS_ENCODING (!__SUBJECT_ENCODED_B64 && !__SUBJECT_ENCODED_QP) && __SUBJECT_NEEDS_MIME ##} SUBJECT_NEEDS_ENCODING ##{ TAB_IN_FROM header TAB_IN_FROM From:raw =~ /^\t/s describe TAB_IN_FROM From starts with a tab ##} TAB_IN_FROM ##{ TBIRD_SUSP_MIME_BDRY meta TBIRD_SUSP_MIME_BDRY __MUA_TBIRD && __TB_MIME_BDRY_NO_Z describe TBIRD_SUSP_MIME_BDRY Unlikely Thunderbird MIME boundary ##} TBIRD_SUSP_MIME_BDRY ##{ THEBAT_UNREG header THEBAT_UNREG X-Mailer =~ /^The Bat! .{0,20} UNREG$/ ##} THEBAT_UNREG ##{ TO_NO_BRKTS_DYNIP meta TO_NO_BRKTS_DYNIP __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && RDNS_DYNAMIC #score TO_NO_BRKTS_DYNIP 0.20 ##} TO_NO_BRKTS_DYNIP ##{ TT_MSGID_TRUNC header TT_MSGID_TRUNC Message-Id =~ /^\s*\s]+\[\d+$/ describe TT_MSGID_TRUNC Scora: Message-Id ends after left-bracket + digits ##} TT_MSGID_TRUNC ##{ TT_OBSCURED_VALIUM meta TT_OBSCURED_VALIUM ( __TT_BROKEN_VALIUM || __TT_OBSCURED_VALIUM ) && ! __TT_VALIUM describe TT_OBSCURED_VALIUM Scora: obscured "VALIUM" in subject ##} TT_OBSCURED_VALIUM ##{ TT_OBSCURED_VIAGRA meta TT_OBSCURED_VIAGRA ( __TT_BROKEN_VIAGRA || __TT_OBSCURED_VIAGRA ) && ! __TT_VIAGRA describe TT_OBSCURED_VIAGRA Scora: obscured "VIAGRA" in subject ##} TT_OBSCURED_VIAGRA ##{ TVD_ACT_193 body TVD_ACT_193 /\bact of (?:193|nineteen thirty)/i ##} TVD_ACT_193 ##{ TVD_APPROVED body TVD_APPROVED /you.{1,2}re .{0,20}approved/i ##} TVD_APPROVED ##{ TVD_DEAR_HOMEOWNER body TVD_DEAR_HOMEOWNER /^dear homeowner/i ##} TVD_DEAR_HOMEOWNER ##{ TVD_EB_PHISH meta TVD_EB_PHISH __FROM_EBAY && NORMAL_HTTP_TO_IP ##} TVD_EB_PHISH ##{ TVD_ENVFROM_APOST header TVD_ENVFROM_APOST EnvelopeFrom =~ /\'/ ##} TVD_ENVFROM_APOST ##{ TVD_FINGER_02 header TVD_FINGER_02 Content-Type =~ /^text\/plain(?:; (?:format=flowed|charset="Windows-1252"|reply-type=original)){3}/i ##} TVD_FINGER_02 ##{ TVD_FLOAT_GENERAL rawbody TVD_FLOAT_GENERAL /\bstyle\s*=\s*"[^"]*\bfloat\s*:\s*[a-z]+\s*">\s*[a-zA-Z]+\s*\b(?!degree)\b/i endif ##} TVD_FUZZY_DEGREE ##{ TVD_FUZZY_FINANCE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body TVD_FUZZY_FINANCE /(?!finance)/i endif ##} TVD_FUZZY_FINANCE ##{ TVD_FUZZY_FIXED_RATE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body TVD_FUZZY_FIXED_RATE /(?!fixed rate)\s+/i endif ##} TVD_FUZZY_FIXED_RATE ##{ TVD_FUZZY_MICROCAP ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body TVD_FUZZY_MICROCAP /(?!microcap)(?!micro-cap)-?

/i endif ##} TVD_FUZZY_MICROCAP ##{ TVD_FUZZY_PHARMACEUTICAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body TVD_FUZZY_PHARMACEUTICAL /(?!pharmaceutical)

/i endif ##} TVD_FUZZY_PHARMACEUTICAL ##{ TVD_FUZZY_SYMBOL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body TVD_FUZZY_SYMBOL /(?!symbol)/i endif ##} TVD_FUZZY_SYMBOL ##{ TVD_FW_GRAPHIC_NAME_LONG ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader TVD_FW_GRAPHIC_NAME_LONG Content-Type =~ /\bname="[a-z]{8,}\.gif/ endif ##} TVD_FW_GRAPHIC_NAME_LONG ##{ TVD_FW_GRAPHIC_NAME_MID ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader TVD_FW_GRAPHIC_NAME_MID Content-Type =~ /\bname="[a-z]{6,7}\.gif/ endif ##} TVD_FW_GRAPHIC_NAME_MID ##{ TVD_INCREASE_SIZE body TVD_INCREASE_SIZE /\bsize of .{1,20}(?:penis|dick|manhood)/i ##} TVD_INCREASE_SIZE ##{ TVD_LINK_SAVE body TVD_LINK_SAVE /\blink to save\b/i ##} TVD_LINK_SAVE ##{ TVD_PCT_OFF header TVD_PCT_OFF Subject =~ /(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\S* \d+% OFF/ ##} TVD_PCT_OFF ##{ TVD_PH_BODY_ACCOUNTS_PRE body TVD_PH_BODY_ACCOUNTS_PRE /\baccounts? (?:[a-z_,-]+ )+?(?:record[a-z]*|suspen[a-z]+|notif(?:y|ication)|updated|verifications?|credited)\b/i ##} TVD_PH_BODY_ACCOUNTS_PRE ##{ TVD_PH_REC body TVD_PH_REC /\byour .{0,40}account .{0,40}record/i describe TVD_PH_REC Message has a phrase standard for phishing mails ##} TVD_PH_REC ##{ TVD_PH_SEC body TVD_PH_SEC /\byour .{0,40}account .{0,40}security/i describe TVD_PH_SEC Message has a phrase standard for phishing mails ##} TVD_PH_SEC ##{ TVD_PH_SUBJ_ACCOUNTS_POST header TVD_PH_SUBJ_ACCOUNTS_POST Subject =~ /\b(?:(?:re-?)?activat[a-z]*|secure|verify|restore|flagged|limited|unusual|update|report|notif(?:y|ication)|suspen(?:d|ded|sion)|co(?:n|m)firm[a-z]*) (?:[a-z_,-]+ )*?accounts?\b/i ##} TVD_PH_SUBJ_ACCOUNTS_POST ##{ TVD_PH_SUBJ_SEC_MEASURES header TVD_PH_SUBJ_SEC_MEASURES Subject =~ /\bsecurity (?:[a-z_,-]+ )*?measures?\b/i ##} TVD_PH_SUBJ_SEC_MEASURES ##{ TVD_PH_SUBJ_URGENT header TVD_PH_SUBJ_URGENT Subject =~ /^urgent(?:[\s\W]*$|.{1,40}(?:alert|response|assistance|proposal|reply|warning|noti(?:ce|fication)|greeting|matter))/i ##} TVD_PH_SUBJ_URGENT ##{ TVD_PP_PHISH meta TVD_PP_PHISH __FROM_PAYPAL && NORMAL_HTTP_TO_IP ##} TVD_PP_PHISH ##{ TVD_QUAL_MEDS body TVD_QUAL_MEDS /\bquality med(?:ication)?s\b/i ##} TVD_QUAL_MEDS ##{ TVD_RATWARE_CB header TVD_RATWARE_CB Content-Type =~ /\bboundary\b.{1,40}qzsoft_directmail_seperator/i ##} TVD_RATWARE_CB ##{ TVD_RATWARE_CB_2 header TVD_RATWARE_CB_2 Content-Type =~ /\bboundary\s*=\s*"?-+\d+=+\.MRA/ ##} TVD_RATWARE_CB_2 ##{ TVD_RATWARE_MSGID_02 header TVD_RATWARE_MSGID_02 Message-ID =~ /^[^<]*<[a-z]+\@/ ##} TVD_RATWARE_MSGID_02 ##{ TVD_RCVD_IP header TVD_RCVD_IP Received =~ /^from\s+(?:\d+[^0-9a-zA-Z\s]){3}\d+[.\s]/ ##} TVD_RCVD_IP ##{ TVD_RCVD_IP4 header TVD_RCVD_IP4 Received =~ /^from\s+(?:\d+\.){3}\d+\s/ ##} TVD_RCVD_IP4 ##{ TVD_RCVD_SINGLE header TVD_RCVD_SINGLE Received =~ /^from\s+(?!localhost)[^\s.a-z0-9-]+\s/ ##} TVD_RCVD_SINGLE ##{ TVD_RCVD_SPACE_BRACKET header TVD_RCVD_SPACE_BRACKET Received =~ /\(\[(?!UNIX:)[^\[\]]*\s/ ##} TVD_RCVD_SPACE_BRACKET ##{ TVD_SECTION body TVD_SECTION /\bSection (?:27A|21B)/i ##} TVD_SECTION ##{ TVD_SILLY_URI_OBFU body TVD_SILLY_URI_OBFU m!https?://[a-z0-9-]+\.[a-z0-9-]*\.?[^a-z0-9.:/\s"'\@?\)>-]+[a-z0-9.-]*[a-z]{3}(?:\s|$)!i ##} TVD_SILLY_URI_OBFU ##{ TVD_SPACED_SUBJECT_WORD3 header TVD_SPACED_SUBJECT_WORD3 Subject =~ /^(?:(?:Re|Fw)[^:]{0,5}: )?[A-Z]+[a-z]+[A-Z]+$/ ##} TVD_SPACED_SUBJECT_WORD3 ##{ TVD_STOCK1 ifplugin Mail::SpamAssassin::Plugin::BodyEval body TVD_STOCK1 eval:check_stock_info('2') endif ##} TVD_STOCK1 ##{ TVD_SUBJ_ACC_NUM header TVD_SUBJ_ACC_NUM Subject =~ /\b[a-zA-Z]+ [\#\s]{1,4}\d+[A-Z]+/ describe TVD_SUBJ_ACC_NUM Subject has spammy looking monetary reference ##} TVD_SUBJ_ACC_NUM ##{ TVD_SUBJ_FINGER_03 header TVD_SUBJ_FINGER_03 Subject =~ /^\s*\*\s+(?:\w+\W+)+\*\s*$/ ##} TVD_SUBJ_FINGER_03 ##{ TVD_SUBJ_OWE header TVD_SUBJ_OWE Subject =~ /^\s*(?:\w+\s+)+you\s+(?:\w+\s+)*(?:owe|indebted)\s+(?:\w+\s+)+an\s*other/i ##} TVD_SUBJ_OWE ##{ TVD_SUBJ_WIPE_DEBT header TVD_SUBJ_WIPE_DEBT Subject =~ /(?:wipe out|remove|get (?:rid|out) of|eradicate) .{0,20}(?:owe|debt|obligation)/i ##} TVD_SUBJ_WIPE_DEBT ##{ TVD_VISIT_PHARMA body TVD_VISIT_PHARMA /Online Ph.rmacy/i ##} TVD_VISIT_PHARMA ##{ TVD_VIS_HIDDEN rawbody TVD_VIS_HIDDEN /]+style\s*=\s*"visibility:\s*hidden\b/i ##} TVD_VIS_HIDDEN ##{ TWO_IPS_RCVD meta TWO_IPS_RCVD __TWO_IPS_RCVD && !ALL_TRUSTED describe TWO_IPS_RCVD Received: Relay identifies itself as wrong IP ##} TWO_IPS_RCVD ##{ T_DOS_OUTLOOK_TO_MX_IMAGE meta T_DOS_OUTLOOK_TO_MX_IMAGE __ANY_OUTLOOK_MUA && !__OE_MUA && __DOS_DIRECT_TO_MX && __ANY_IMAGE_ATTACH describe T_DOS_OUTLOOK_TO_MX_IMAGE Direct to MX with Outlook headers and an image ##} T_DOS_OUTLOOK_TO_MX_IMAGE ##{ T_FILL_THIS_FORM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta T_FILL_THIS_FORM (FILL_THIS_FORM_LONG || __FILL_THIS_FORM_PARTIAL > 4 || __FILL_THIS_FORM_PARTIAL_RAW > 4) describe T_FILL_THIS_FORM Fill in a form with personal information # score T_FILL_THIS_FORM 1.00 endif ##} T_FILL_THIS_FORM ##{ T_FILL_THIS_FORM_SHORT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta T_FILL_THIS_FORM_SHORT !T_FILL_THIS_FORM && (__FILL_THIS_FORM_SHORT || __FILL_THIS_FORM_PARTIAL > 2 || __FILL_THIS_FORM_PARTIAL_RAW > 2) describe T_FILL_THIS_FORM_SHORT Fill in a short form with personal information # score T_FILL_THIS_FORM_SHORT 0.25 endif ##} T_FILL_THIS_FORM_SHORT ##{ T_FROM_MISSPACED header T_FROM_MISSPACED From =~ /^\s*"[^"]*"+[^[:alnum:]]{1,3})?[[:alnum:]][-\w]{1,20}[[:alnum:]](?!\.[[:alnum:]])[^[:alnum:]]{1,3}(?:+[^[:alnum:]]{1,3})?(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g|b\s?i\s?z|i\s?n\s?f\s?o)_*\b/i describe URI_OBFU_WWW Obfuscated URI endif ##} URI_OBFU_WWW ##{ VANITY meta VANITY (__KNOWN_VANITY && (__NO_COST + __INFORM_YOU + __INNERCIRCLE + __SHMUCK + __EXECS_PROS + __PUB_DEADLINE + __REGISTRY + __NOMINATION + __BIOGRAPHY + __ACCOLADES + __RECOGNITION + __DISTINGUISHED + __EXCELLENCE + __ACHIEVEMENT + __CBNVANITY > 3)) || (__BESTOFAWARD && (__SBCAVANITY || __USCAVANITY)) describe VANITY Vanity or fake awards #score VANITY 2.3 ##} VANITY ##{ XMAILER_MIMEOLE_OL_015D5 meta XMAILER_MIMEOLE_OL_015D5 (__XM_OL_015D5 && __MO_OL_015D5) ##} XMAILER_MIMEOLE_OL_015D5 ##{ XMAILER_MIMEOLE_OL_07794 meta XMAILER_MIMEOLE_OL_07794 (__XM_OL_07794 && __MO_OL_07794) ##} XMAILER_MIMEOLE_OL_07794 ##{ XMAILER_MIMEOLE_OL_09BB4 meta XMAILER_MIMEOLE_OL_09BB4 (__XM_OL_09BB4 && __MO_OL_09BB4) ##} XMAILER_MIMEOLE_OL_09BB4 ##{ XMAILER_MIMEOLE_OL_1ECD5 meta XMAILER_MIMEOLE_OL_1ECD5 (__XM_OL_1ECD5 && __MO_OL_1ECD5) ##} XMAILER_MIMEOLE_OL_1ECD5 ##{ XMAILER_MIMEOLE_OL_20C99 meta XMAILER_MIMEOLE_OL_20C99 (__XM_OL_20C99 && __MO_OL_20C99) ##} XMAILER_MIMEOLE_OL_20C99 ##{ XMAILER_MIMEOLE_OL_22B61 meta XMAILER_MIMEOLE_OL_22B61 (__XM_OL_22B61 && __MO_OL_22B61) ##} XMAILER_MIMEOLE_OL_22B61 ##{ XMAILER_MIMEOLE_OL_25340 meta XMAILER_MIMEOLE_OL_25340 (__XM_OL_25340 && __MO_OL_25340) ##} XMAILER_MIMEOLE_OL_25340 ##{ XMAILER_MIMEOLE_OL_32D97 meta XMAILER_MIMEOLE_OL_32D97 (__XM_OL_32D97 && __MO_OL_32D97) ##} XMAILER_MIMEOLE_OL_32D97 ##{ XMAILER_MIMEOLE_OL_3857F meta XMAILER_MIMEOLE_OL_3857F (__XM_OL_3857F && __MO_OL_3857F) ##} XMAILER_MIMEOLE_OL_3857F ##{ XMAILER_MIMEOLE_OL_3AC1D meta XMAILER_MIMEOLE_OL_3AC1D (__XM_OL_3AC1D && __MO_OL_3AC1D) ##} XMAILER_MIMEOLE_OL_3AC1D ##{ XMAILER_MIMEOLE_OL_3D61D meta XMAILER_MIMEOLE_OL_3D61D (__XM_OL_3D61D && __MO_OL_3D61D) ##} XMAILER_MIMEOLE_OL_3D61D ##{ XMAILER_MIMEOLE_OL_465CD meta XMAILER_MIMEOLE_OL_465CD (__XM_OL_465CD && __MO_OL_465CD) ##} XMAILER_MIMEOLE_OL_465CD ##{ XMAILER_MIMEOLE_OL_4B815 meta XMAILER_MIMEOLE_OL_4B815 (__XM_OL_4B815 && __MO_OL_4B815) ##} XMAILER_MIMEOLE_OL_4B815 ##{ XMAILER_MIMEOLE_OL_4BF4C meta XMAILER_MIMEOLE_OL_4BF4C (__XM_OL_4BF4C && __MO_OL_4BF4C) ##} XMAILER_MIMEOLE_OL_4BF4C ##{ XMAILER_MIMEOLE_OL_4EEDB meta XMAILER_MIMEOLE_OL_4EEDB (__XM_OL_4EEDB && __MO_OL_4EEDB) ##} XMAILER_MIMEOLE_OL_4EEDB ##{ XMAILER_MIMEOLE_OL_4F240 meta XMAILER_MIMEOLE_OL_4F240 (__XM_OL_4F240 && __MO_OL_4F240) ##} XMAILER_MIMEOLE_OL_4F240 ##{ XMAILER_MIMEOLE_OL_58CB5 meta XMAILER_MIMEOLE_OL_58CB5 (__XM_OL_58CB5 && __MO_OL_58CB5) ##} XMAILER_MIMEOLE_OL_58CB5 ##{ XMAILER_MIMEOLE_OL_5B79A meta XMAILER_MIMEOLE_OL_5B79A (__XM_OL_5B79A && __MO_OL_5B79A) ##} XMAILER_MIMEOLE_OL_5B79A ##{ XMAILER_MIMEOLE_OL_6554A meta XMAILER_MIMEOLE_OL_6554A (__XM_OL_6554A && __MO_OL_6554A) ##} XMAILER_MIMEOLE_OL_6554A ##{ XMAILER_MIMEOLE_OL_72641 meta XMAILER_MIMEOLE_OL_72641 (__XM_OL_72641 && __MO_OL_72641) ##} XMAILER_MIMEOLE_OL_72641 ##{ XMAILER_MIMEOLE_OL_7533E meta XMAILER_MIMEOLE_OL_7533E (__XM_OL_7533E && __MO_OL_7533E) ##} XMAILER_MIMEOLE_OL_7533E ##{ XMAILER_MIMEOLE_OL_812FF meta XMAILER_MIMEOLE_OL_812FF (__XM_OL_812FF && __MO_OL_812FF) ##} XMAILER_MIMEOLE_OL_812FF ##{ XMAILER_MIMEOLE_OL_83BF7 meta XMAILER_MIMEOLE_OL_83BF7 (__XM_OL_83BF7 && __MO_OL_83BF7) ##} XMAILER_MIMEOLE_OL_83BF7 ##{ XMAILER_MIMEOLE_OL_8627E meta XMAILER_MIMEOLE_OL_8627E (__XM_OL_8627E && __MO_OL_8627E) ##} XMAILER_MIMEOLE_OL_8627E ##{ XMAILER_MIMEOLE_OL_8E893 meta XMAILER_MIMEOLE_OL_8E893 (__XM_OL_8E893 && __MO_OL_8E893) ##} XMAILER_MIMEOLE_OL_8E893 ##{ XMAILER_MIMEOLE_OL_91287 meta XMAILER_MIMEOLE_OL_91287 (__XM_OL_91287 && __MO_OL_91287) ##} XMAILER_MIMEOLE_OL_91287 ##{ XMAILER_MIMEOLE_OL_9B90B meta XMAILER_MIMEOLE_OL_9B90B (__XM_OL_9B90B && __MO_OL_9B90B) ##} XMAILER_MIMEOLE_OL_9B90B ##{ XMAILER_MIMEOLE_OL_A50F8 meta XMAILER_MIMEOLE_OL_A50F8 (__XM_OL_A50F8 && __MO_OL_A50F8) ##} XMAILER_MIMEOLE_OL_A50F8 ##{ XMAILER_MIMEOLE_OL_A842E meta XMAILER_MIMEOLE_OL_A842E (__XM_OL_A842E && __MO_OL_A842E) ##} XMAILER_MIMEOLE_OL_A842E ##{ XMAILER_MIMEOLE_OL_ADFF7 meta XMAILER_MIMEOLE_OL_ADFF7 (__XM_OL_ADFF7 && __MO_OL_ADFF7) ##} XMAILER_MIMEOLE_OL_ADFF7 ##{ XMAILER_MIMEOLE_OL_B30D1 meta XMAILER_MIMEOLE_OL_B30D1 (__XM_OL_B30D1 && __MO_OL_B30D1) ##} XMAILER_MIMEOLE_OL_B30D1 ##{ XMAILER_MIMEOLE_OL_B4B40 meta XMAILER_MIMEOLE_OL_B4B40 (__XM_OL_B4B40 && __MO_OL_B4B40) ##} XMAILER_MIMEOLE_OL_B4B40 ##{ XMAILER_MIMEOLE_OL_B9B11 meta XMAILER_MIMEOLE_OL_B9B11 (__XM_OL_B9B11 && __MO_OL_B9B11) ##} XMAILER_MIMEOLE_OL_B9B11 ##{ XMAILER_MIMEOLE_OL_BC7E6 meta XMAILER_MIMEOLE_OL_BC7E6 (__XM_OL_BC7E6 && __MO_OL_BC7E6) ##} XMAILER_MIMEOLE_OL_BC7E6 ##{ XMAILER_MIMEOLE_OL_C65FA meta XMAILER_MIMEOLE_OL_C65FA (__XM_OL_C65FA && __MO_OL_C65FA) ##} XMAILER_MIMEOLE_OL_C65FA ##{ XMAILER_MIMEOLE_OL_CAC8F meta XMAILER_MIMEOLE_OL_CAC8F (__XM_OL_CAC8F && __MO_OL_CAC8F) ##} XMAILER_MIMEOLE_OL_CAC8F ##{ XMAILER_MIMEOLE_OL_CF0C0 meta XMAILER_MIMEOLE_OL_CF0C0 (__XM_OL_CF0C0 && __MO_OL_CF0C0) ##} XMAILER_MIMEOLE_OL_CF0C0 ##{ XMAILER_MIMEOLE_OL_EF20B meta XMAILER_MIMEOLE_OL_EF20B (__XM_OL_EF20B && __MO_OL_EF20B) ##} XMAILER_MIMEOLE_OL_EF20B ##{ XMAILER_MIMEOLE_OL_EF222 meta XMAILER_MIMEOLE_OL_EF222 (__XM_OL_EF222 && __MO_OL_EF222) ##} XMAILER_MIMEOLE_OL_EF222 ##{ XMAILER_MIMEOLE_OL_F3B05 meta XMAILER_MIMEOLE_OL_F3B05 (__XM_OL_F3B05 && __MO_OL_F3B05) ##} XMAILER_MIMEOLE_OL_F3B05 ##{ XMAILER_MIMEOLE_OL_F475E meta XMAILER_MIMEOLE_OL_F475E (__XM_OL_F475E && __MO_OL_F475E) ##} XMAILER_MIMEOLE_OL_F475E ##{ XMAILER_MIMEOLE_OL_F6D01 meta XMAILER_MIMEOLE_OL_F6D01 (__XM_OL_F6D01 && __MO_OL_F6D01) ##} XMAILER_MIMEOLE_OL_F6D01 ##{ XMAILER_MIMEOLE_OL_FF5C8 meta XMAILER_MIMEOLE_OL_FF5C8 (__XM_OL_FF5C8 && __MO_OL_FF5C8) ##} XMAILER_MIMEOLE_OL_FF5C8 ##{ X_MAILER_CME_6543_MSN header X_MAILER_CME_6543_MSN X-Mailer =~ /^CME-V6\.5\.4\.3; MSN\s*$/ ##} X_MAILER_CME_6543_MSN ##{ ifplugin Mail::SpamAssassin::Plugin::ReplaceTags _sandbox ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_rules __FRT_GOLD replace_rules __FRT_SILVER replace_inter W0 \w? replace_inter SP2 [\s\d_*\$\%(),.:;?!}{\[\]|\/?^\#~\xa1`'+-]? replace_tag GX [gk6] replace_tag IX [ilt|!1y?\xcc\xcd\xce\xcf\xec\xed\xee\xef] replace_tag SX [sz5\xa6\xa7] replace_tag TX [t|] replace_tag UX [u\xb5\xd9\xda\xdb\xdc\xfc\xfb\xfa\xf9\xfd] replace_tag WX (?:[wv]|vv) replace_rules T_FRT_ABSOLUT replace_rules FRT_ADOBE2 replace_rules T_FRT_ADULT2 replace_rules FRT_APPROV replace_rules T_FRT_BEFORE replace_rules T_FRT_BELOW2 replace_rules FRT_BIGGERMEM1 replace_rules T_FRT_CANSPAM replace_rules T_FRT_CLICK replace_rules T_FRT_COCK replace_rules T_FRT_CONTACT replace_rules FRT_DIPLOMA replace_rules FRT_DISCOUNT replace_rules FRT_DOLLAR replace_rules T_FRT_ERECTION replace_rules T_FRT_ESTABLISH replace_rules FRT_ESTABLISH2 replace_rules T_FRT_EXPERIENCE replace_rules T_FRT_FOLLOW1 replace_rules T_FRT_FOLLOW2 replace_rules T_FRT_FREE replace_rules T_FRT_FRIEND replace_rules T_FRT_FUCK1 replace_rules FRT_FUCK2 replace_rules FRT_GUARANTEE1 replace_rules T_FRT_HEALTH replace_rules T_FRT_HOUR replace_rules T_FRT_INCOME replace_rules T_FRT_INTEREST replace_rules FRT_INVESTOR replace_rules FRT_LEVITRA replace_rules T_FRT_LITTLE replace_rules T_FRT_LOLITA1 replace_rules FRT_MEETING replace_rules FRT_OFFER2 replace_rules T_FRT_OPPORTUN1 replace_rules FRT_OPPORTUN2 replace_rules T_FRT_PACKAGE replace_rules T_FRT_PAYMENT replace_rules FRT_PENIS1 replace_rules FRT_PHARMAC replace_rules T_FRT_POSSIBLE replace_rules FRT_PRICE replace_rules T_FRT_PROFILE1 replace_rules T_FRT_PROFILE2 replace_rules T_FRT_PROFIT1 replace_rules T_FRT_PROFIT2 replace_rules T_FRT_PUSSY replace_rules FRT_REFINANCE1 replace_rules FRT_ROLEX replace_rules FRT_SEXUAL replace_rules T_FRT_SLUT replace_rules FRT_SOMA replace_rules FRT_SOMA2 replace_rules T_FRT_STOCK1 replace_rules T_FRT_STOCK2 replace_rules FRT_STRONG1 replace_rules FRT_STRONG2 replace_rules FRT_SYMBOL replace_rules FRT_TODAY2 replace_rules FRT_VALIUM1 replace_rules FRT_VALIUM2 replace_rules T_FRT_VIRGIN1 replace_rules FRT_WEIGHT2 replace_rules FRT_XANAX1 replace_rules FRT_XANAX2 replace_rules T_FUZZY_SPRM replace_rules FUZZY_MERIDIA replace_rules TVD_FUZZY_PHARMACEUTICAL replace_rules TVD_FUZZY_SYMBOL replace_rules T_TVD_FUZZY_SECURITIES replace_rules TVD_FUZZY_FINANCE replace_rules TVD_FUZZY_FIXED_RATE replace_rules TVD_FUZZY_MICROCAP replace_rules T_TVD_FUZZY_SECTOR replace_rules TVD_FUZZY_DEGREE replace_tag FF_LNNO (?:(?:\d+[)}\]:.,]+|\W?\(\d+\)|\W?\{\d+\}|\[\d+\]|\*{1,5}|\#{1,5}|[A-K][)}\]:.,])\s?) replace_tag FF_YOUR (?:a?\s?copy\sof\s)?(?:your[\s,:]{1,5})?(?:present\s|c[uo]rrent\s|full\s?|complete\s|direct\s|private\s|valid\s|personal\s){0,3} replace_tag ANDOR (?:\s?[\/&+,]\s?|\sor\s|\sand\s) replace_tag NUMBER (?:num(?:ber)?s?|nos?\.|no\b|\#s?|nbrs?\.?) replace_tag FF_SUFFIX (?:\sin\s(?:full|words))?:?(?:\s?[({][^)}]{1,30}[)}])? replace_tag FF_BLANK1 (?:[\s:;]{0,4}(?:(?:[-=_.,:;*]|&\#\d+;){3,80}\s?){1,}) replace_tag FF_BLANK2 (?:[\s\W]{0,3}(?:[-=_.,:;*]|&\#\d+;){1,80}\s?) replace_tag FF_A1 (?:(?:ad+res+e?|countr?y|st?ates?|city|province|ter+itory|(?:zip|postal)(?:\s?code)?)?){1,3}(?:\sof\s(?:residence|birth|employment|citizenship|origin))? replace_tag FF_A2 (?:(?:contact|e-?mail|full|house|home|resident[ia]+l|business|mailing|work|office|delivery|ship+ing|post(?:al)?)?){0,3}\s?(?:ad+res+(?:es)?|location)(?:\sline)?(?:\s[0-9])? replace_tag FF_N1 (?:company|first|last|all|business|legal|ben[ei]ficiary)?\s?names?(?:ad+res+)? replace_tag FF_P1 (?:(?:(?:business|contact|fax|voice|cel+(?:ular)?|house|home|mobile|office|tel+e?(?:\s?phone)?|phone)(?:\sphone)??){1,3}(?:\s)??){1,3} replace_tag FF_M1 (?:(?:age|marital\s?statu[se]|sex|gender|male\sor\sfemale|(?:date\sof\s)?birth|religion|nationality|email|next\sof\skin)?){1,3} replace_tag FF_L1 (?:(?:previous\s)?work(?:ing)\s?experience|employment|position|profession|occup[ae]tion(?:\/position)?|(?:monthly|annual)?\s?income|annual\sturn\s?over|purpose\sof\sl(?:oa|ao)n|l(?:oa|ao)n\sduration|(?:l(?:oa|ao)n\s|the\s)?amount(?:\sneed(ed)?|\sdesired)?(?:\s(?:as|of)\sloan)?) replace_tag FF_F1 (?:(?:bank|beneficiary|billing|acc(?:oun)?t|a\/c|rout(?:ing)?|swift|receiver|user)?){1,3}\s(?:(?:name|ad+res+(?:es)?|location|code|details|)?){1,3} replace_tag FF_F2 (?:(?:(?:international\s)?driver'?s?\sli[sc]+(:?en[sc]e)?|pass\s?port|[ia]d(?:entification|entity)(?:\s(?:card||papers?))?|id\scard)?){1,3}(?:\s)? replace_tag FF_F3 (?:picture|(?:e-?mail\s)?password|e-?mai?l\sid|test\squestion|answer|amount\swon|(?:inheritance\s)?funds?\svalue|amount\s[\w\s]{0,30}lost[\w\s]{0,15}) replace_tag FF_F4 (?:log[-\s]?in|(?:e-?mail\s)?user)\s?names? replace_tag FF_F5 (?:reference|batch|winning)\s? replace_tag FF_ALL (?:||||||||||) replace_rules FILL_THIS_FORM_LONG replace_rules __FILL_THIS_FORM_PARTIAL replace_rules __FILL_THIS_FORM_PARTIAL_RAW replace_rules __FILL_THIS_FORM_SHORT replace_rules __FILL_THIS_FORM_LOAN replace_rules __FILL_THIS_FORM_FRAUD_PHISH replace_tag CURRENCY [\(\[]?(?:\bUS[D\$]{0,2}|\$(?:US)?|GBP|=[Aa][34]|\xa3|&\#16[34];|(?i:pounds\ssterling)|\xa4|EUR|[Ee]uros?|(?i:eur)\sde|CHF)[\]\)]? replace_tag GB_UK \b(?:U\.?K\.?|(?:Great\s)?Brit(?:ain|ish)|G\.?B\.?)\b replace_rules __LOTSA_MONEY_00 __LOTSA_MONEY_01 __LOTSA_MONEY_02 __LOTSA_MONEY_03 __LOTSA_MONEY_04 replace_tag PERCENT \b(?:\d\d|ten|[a-z]+teen|(?:twen|thir|fou?r)ty(?:-?[a-z]+)?)\s?(?:%|percent) replace_rules __PCT_FOR_YOU_1 __PCT_FOR_YOU_2 __PCT_FOR_YOU_3 __PCT_OF_PMTS replace_rules URI_OBFU_WWW replace_rules T_LFUZ_PWRMALE endif ##} ifplugin Mail::SpamAssassin::Plugin::ReplaceTags _sandbox ##{ ifplugin Mail::SpamAssassin::Plugin::URIDetail _sandbox ifplugin Mail::SpamAssassin::Plugin::URIDetail uri_detail T_KHOP_FOREIGN_CLICK text =~ /\b(?:cliquez\Wici\b|clic aqu[^<.,a ])/i else endif ##} ifplugin Mail::SpamAssassin::Plugin::URIDetail _sandbox ##{ ifplugin Mail::SpamAssassin::Plugin::WLBLEval _sandbox ifplugin Mail::SpamAssassin::Plugin::WLBLEval def_whitelist_from_rcvd abuse@yahoo.com yahoo.com def_whitelist_from_rcvd MAILER-DAEMON@yahoo.com yahoo.com endif ##} ifplugin Mail::SpamAssassin::Plugin::WLBLEval _sandbox ##{ redirector_pattern_sandbox redirector_pattern /^http\:\/\/sun\.com\/cgi\-bin\/go\.cgi\?dest\=(.*)$/i redirector_pattern /^http\:\/\/www\.att\.net\/s\/context\.dll\?redirecturl\=(.*)$/i redirector_pattern m'/(?:index.php)?\?.*(?<=[?&])URL=(.*?)(?:$|[&\#])'i redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/url\?.*?(?<=[?&])q=(.*?)(?:$|[&\#])'i redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/search\?.*?(?<=[?&])q=[^&]*?(?<=%20|..[=+\s])(?:site|inurl):(.*?)(?:$|%20|[\s+&\#])'i redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/search\?.*?(?<=[?&])q=[^&]*?(?<=%20|..[=+\s])(?:"|%22)(.*?)(?:$|%22|["\s+&\#])'i redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/translate\?.*?(?<=[?&])u=(.*?)(?:$|[&\#])'i redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/pagead/iclk\?.*?(?<=[?&])adurl=(.*?)(?:$|[&\#])'i redirector_pattern m'^http:/*(?:\w+\.)?aol\.com/redir\.adp\?.*(?<=[?&])_url=(.*?)(?:$|[&\#])'i redirector_pattern m'^https?/*(?:\w+\.)?facebook\.com/l/;(.*)'i ##} redirector_pattern_sandbox body __ACCOLADES /\baccolades?\b/i body __ACHIEVEMENT /\bbenchmark of achievement\b/i body __AFF_004470_NUMBER /(?:\+|00|011)\W{0,3}44\W{0,3}0?\W{0,3}70/ body __AFF_LOTTERY /(?:lottery|winner)/i ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __ANY_IMAGE_ATTACH Content-Type =~ /image\/(?:gif|jpeg|png)/ endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __ANY_TEXT_ATTACH Content-Type =~ /text\/\w+/i endif body __APPROVALFVGT /approval/i body __BACHELORS /Bachelor/i body __BESTOFAWARD /\bBest of \w+ Award/ body __BIGDOLLARSFVGT /\$\d{2,3},\d{3}/ body __BIOGRAPHY /\b(?:biography|biographies|biographical)\b/i body __BODY_STARTS_WITH_FROM_LINE /^From \S+ \S\S\S \S\S\S .. ..:..:.. \S+\s+\S+\: /s body __CASHPRZ /cash prize of/ body __CBNVANITY /\bContinental Broadcasting Network\b/ body __CS_WORD /\bC[A-Za-z]{2,4}IS\b/ header __CTYPE_MULTIPART_ANY Content-Type =~ /multipart\/\w+/i ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __CTYPE_ONETAB_GIF Content-Type:raw =~ /^image\/gif;\n\tname=\".+?\"$/s endif header __DATE_700 Date =~ /-0700/ body __DBLCLAIM /avoid double claiming/ body __DIPLOMA /diploma/i body __DISTINGUISHED /\bdistinguished\b/i body __DOS_BODY_FRI /\bfri(?:day)?\b/i body __DOS_BODY_MON /\bmon(?:day)?\b/i body __DOS_BODY_SAT /\bsat(?:day)?\b/i body __DOS_BODY_STOCK /\bstock\b/i body __DOS_BODY_SUN /\bsun(?:day)?\b/i body __DOS_BODY_THU /\bthu(?:r(?:s(?:day)?)?)?\b/i body __DOS_BODY_TICKER /\b[A-Z]{4}\.(?:OB|PK)\b/ body __DOS_BODY_TUE /\btue(?:s(?:day)?)?\b/i body __DOS_BODY_WED /\bwed(?:nesday)?\b/i body __DOS_COMING_TO_YOUR_PLACE /I (?:am|might(?: be)?) c[a-z]?o[a-z]?m[a-z]?(?:i[a-z]?n[a-z]?g[a-z]{0,2}|e down) to y[!a-z]{2,4}r (?:city|place[a-z]{0,2}|co[a-z]?u[a-z]?n[a-z]?t[a-z]?ry) in (?:f[a-z]?e[a-z]?w|\d{1,2}) (?:day|week)s/ body __DOS_CORRESPOND_EMAIL /correspond with me using my email/ meta __DOS_DIRECT_TO_MX __DOS_SINGLE_EXT_RELAY && !__DOS_HAS_LIST_ID && !__DOS_HAS_LIST_UNSUB && !__DOS_HAS_MAILING_LIST && !__DOS_RELAYED_EXT body __DOS_DROP_ME_A_LINE /Drop me a line at/ body __DOS_EMAIL_DIRECTLY /(?:Email m[a-z]?e|address) direc(?:tl|lt)y at/ body __DOS_FIN_ADVANTAGE /\bfinancial advantage/i uri __DOS_HAS_ANY_URI /./ header __DOS_HAS_LIST_ID exists:List-ID header __DOS_HAS_LIST_UNSUB exists:List-Unsubscribe header __DOS_HAS_MAILING_LIST exists:Mailing-List body __DOS_HI /^Hi,$/ body __DOS_I_AM_25 /I a.?m 25/ body __DOS_I_DRIVE_A /I drive a/ body __DOS_LET_GO_JOB /I was (?:let go|fired|layed off|dismissed) from a job I h(?:el|a)d for (?:2\d years|\d{3} months)/ body __DOS_LINK /\blink\b/ body __DOS_MEET_EACH_OTHER /(?:meet each other|[Mm]ay ?be we can meet)/ body __DOS_MY_OLD_JOB /my old job/ body __DOS_PERSONAL_EMAIL /personal email at/ header __DOS_RCVD_FRI Received =~ / Fri, / header __DOS_RCVD_MON Received =~ / Mon, / header __DOS_RCVD_SAT Received =~ / Sat, / header __DOS_RCVD_SUN Received =~ / Sun, / header __DOS_RCVD_THU Received =~ / Thu, / header __DOS_RCVD_TUE Received =~ / Tue, / header __DOS_RCVD_WED Received =~ / Wed, / meta __DOS_REF_2_WK_DAYS (__DOS_RCVD_MON && __DOS_BODY_WED) || (__DOS_RCVD_TUE && __DOS_BODY_THU) || (__DOS_RCVD_WED && __DOS_BODY_FRI) || (__DOS_RCVD_THU && __DOS_BODY_MON) || (__DOS_RCVD_FRI && __DOS_BODY_TUE) || (__DOS_RCVD_SAT && __DOS_BODY_TUE) || (__DOS_RCVD_SUN && __DOS_BODY_TUE) meta __DOS_REF_NEXT_WK_DAY (__DOS_RCVD_MON && __DOS_BODY_TUE) || (__DOS_RCVD_TUE && __DOS_BODY_WED) || (__DOS_RCVD_WED && __DOS_BODY_THU) || (__DOS_RCVD_THU && __DOS_BODY_FRI) || (__DOS_RCVD_FRI && __DOS_BODY_MON) || (__DOS_RCVD_SAT && __DOS_BODY_MON) || (__DOS_RCVD_SUN && __DOS_BODY_MON) meta __DOS_REF_TODAY (__DOS_RCVD_MON && __DOS_BODY_MON) || (__DOS_RCVD_TUE && __DOS_BODY_TUE) || (__DOS_RCVD_WED && __DOS_BODY_WED) || (__DOS_RCVD_THU && __DOS_BODY_THU) || (__DOS_RCVD_FRI && __DOS_BODY_FRI) || (__DOS_RCVD_SAT && __DOS_BODY_SAT) || (__DOS_RCVD_SUN && __DOS_BODY_SUN) header __DOS_RELAYED_EXT ALL-EXTERNAL =~ /(?:^|\n)[Rr][eE][cC][eE][iI][vV][eE][dD]:\s.+\n[Rr][eE][cC][eE][iI][vV][eE][dD]:\s/s header __DOS_SINGLE_EXT_RELAY X-Spam-Relays-External =~ /^\[ [^\]]+ \]$/ body __DOS_STEADY_COURSE /\bsteady (?:and increasing )?course\b/i body __DOS_STRONG_CF /\bstrong cash flow/i body __DOS_TAKING_HOME /Taking home \d (?:digit level|figures) in \d{1,2} months/ body __DOS_WRITE_ME_AT /[Ww].?r.?i.?t.?e me at/ body __DPHPVANITY /\bDistinguished Professionals Hardcover Publication\b/ body __EXCELLENCE /\b(?:demonstrated|commitment to) excellence\b/i header __EXCLAIM_SUBJ Subject =~ /\!/ body __EXECS_PROS /\bexecutives? (?:and|&) professionals?\b/i body __FB_BA /\bBA\b/ body __FB_BCs /\bBSc\b/ body __FB_BRAND_NAME /brand name/i body __FB_CONGRADS /Congratulations/i body __FB_DESIGNER /designer/i body __FB_GAME /game/i body __FB_GLASHUTE /Glashute/ body __FB_HANDBAGS /handbags/i body __FB_HOTTEST /hottest/i body __FB_INK_PEN /ink pen/i body __FB_LOTTERY /lottery/i body __FB_LUX_GIFTS /Luxury (?:\w+\s)?Gifts/i body __FB_MA /\bMA\b/ body __FB_MBA /\bMBA\b/ body __FB_NATIONAL /national/i body __FB_NUM_PERCNT /\d\s?\%/ body __FB_OMEGA /Omega/i body __FB_PICK /\bpick\b/i body __FB_PROJECTED /projected/i body __FB_P_ALLNIGHT /all night!/i body __FB_P_TRUELOVE /true love/i body __FB_ROLEX_MEN /Rolex Men/i body __FB_ROLEX_WMEN /Rolex Lady/i body __FB_S_PRICE /Pri{1,2}c[a-z]?e/i body __FB_S_STOCK /Stock/i body __FB_S_SYMBOL /Symb?o?l?:\s?[A-Z_,\.-]{4,8}/i body __FB_TIMEPIECE /timepiece/i body __FB_WALLETS /wallets/i rawbody __FEEDPROXY m;http://feedproxy\.google\.com/; tflags __FEEDPROXY multiple header __FHELO_VERIZON X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+verizon\.net /i header __FHOST_VERIZON X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+verizon\.net /i header __FH_FRM_53 From =~ /\@53\.com/i header __FH_HAS_XMSMAIL exists:X-MSMail-Priority header __FH_HAS_XPRIORITY exists:X-Priority header __FH_MSGID_01C7 MESSAGEID =~ /^<0{1,5}1c7/ header __FH_MSG_53 MESSAGEID =~ /\@53\.com/i header __FH_RCV_53 Received =~ /\.53\.com/i ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __FILL_THIS_FORM_FRAUD_PHISH /(?:||||)(?:|$)/i endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __FILL_THIS_FORM_LOAN /(?:|$)/i endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __FILL_THIS_FORM_PARTIAL /^\s*?(?:?){1,3}(?:|(?:[-=_.,:;*\s]|=20){1,4}$)/im tflags __FILL_THIS_FORM_PARTIAL multiple endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags rawbody __FILL_THIS_FORM_PARTIAL_RAW /^\s*?(?:?){1,3}(?:|(?:[-=_.,:;*\s]|=20| |<\/\w+>){0,4}$)/im tflags __FILL_THIS_FORM_PARTIAL_RAW multiple endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __FILL_THIS_FORM_SHORT /(?:?(?:|)){3,}/i endif body __FIXED_RATEFVGT /fixed rate/i meta __FM_LARGE_MONEY (__F_LARGE_MONEY || __F_LARGE_MONEY_2) meta __FM_MORTGAGE5PLUS ((__PREAPPROVEDFVGT + __FIXED_RATEFVGT + __YOUR_CREDITFVGT + __HOMELOANFVGT + __APPROVALFVGT + __BIGDOLLARSFVGT + __LOANURIFVGT + __MORTURIFVGT) > 4) meta __FM_MORTGAGE6PLUS ((__PREAPPROVEDFVGT + __FIXED_RATEFVGT + __YOUR_CREDITFVGT + __HOMELOANFVGT + __APPROVALFVGT + __BIGDOLLARSFVGT + __LOANURIFVGT + __MORTURIFVGT) > 5) meta __FM_MY_PRICE (__FB_S_PRICE || FRT_PRICE) meta __FM_NAT_LOTTERY (__FB_NATIONAL && __FB_LOTTERY) meta __FM_STOCK_WORDS (__FB_HOTTEST || __FB_PICK || __FB_PROJECTED) meta __FORGED_TBIRD_IMG __MUA_TBIRD && __JPEG_ATTACH && __MIME_BDRY_0D0D describe __FORGED_TBIRD_IMG Possibly forged Thunderbird image spam header __FROM_EBAY From:addr =~ /\@ebay\.com$/i header __FROM_ISO_2022_JP From:raw =~ /=\?ISO-2022-JP\?/ header __FROM_LEFT_BRACK From:name =~ // header __FROM_RUNON From =~ /\S+<\w+/ header __FROM_VEGAS From =~ /Vegas/i header __FS_SUBJ_RE Subject =~ /^Re: / header __FS_S_TRADE Subject =~ /\btrade\b/i body __F_LARGE_MONEY /\d\d\d,\d\d\d/ body __F_LARGE_MONEY_2 /\d\d?\s?(?:thousand|(?:m|b|tr)illion)/i ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __GIF_ATTACH Content-Type =~ /^image\/gif\b/i endif header __GREYLISTED ALL =~ /(?:^|\n)X-(?:Scam-Grey|Greylist(?:ing)?):\s+delay(?:ed)? (?:for )?\d+(?: ?s(?:ec(?:ond)?s?)?|:\d\d)/im body __HAS_ANY_EMAIL /\w@\S+\.\w/ uri __HAS_ANY_URI /./ header __HDR_ORDER_FTSDMCXXXX ALL =~ /\nFrom: .{1,80}?\nTo: .{1,80}?\nSubject: .{1,200}?\nDate: .{1,40}?\nMIME-Version: .{1,40}?\nContent-Type: .{1,120}?\nX-Priority: .{1,40}?\nX-MSMail-Priority: .{1,40}?\nX-Mailer: .{1,80}?\nX-MimeOLE:/s header __HELO_NO_DOMAIN X-Spam-Relays-External =~ /^[^\]]+ helo=[^\.]+ / header __HK_HELO_EBAY X-Spam-Relays-External =~ / helo=[^ ]+\.(?:ebay|emarsys)\b/ body __HK_LOTTO_1 /\b(?:(?:inter)?national|foundation|mercato|univers|euro ?million|e-?mail|euro-pw|bill ?gates|swiss|prestige|cristal|am.ricaine|coca.?cola|fiduciary|department) ?lot(?:eri[ej]|t(?:ery|o))/i body __HK_LOTTO_2 /\blot(?:eri[ej]|t(?:ery|o)) ?(?:(?:inter)?national|foundation|mercato|univers|euro ?million|e-?mail|euro-pw|bill ?gates|swiss|prestige|cristal|am.ricaine|coca.?cola|fiduciary|department)/i body __HK_LOTTO_BALLOT /\b(?:promotional|on.?line|computer|internet|e-?mail|fran.aise) (?:ballot|draw|sweepstake)/i body __HK_LOTTO_JACKPOT /\bmega jackpot\b/i body __HK_LOTTO_STAATS /\bstaatsloteri/i header __HK_NAME_EBAY From:name =~ /\bebay\b/i body __HOMELOANFVGT /home loan/i header __HOST_HOTMAIL X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.hotmail\.com / header __HOTMAILCOM X-Spam-Relays-External =~ /^[^\]]+ helo=hotmail\.com /i rawbody __HS_QUOTE /^> / header __HS_SUBJ_RE_FW Subject =~ /^(?i:re|fw):/ header __HS_SUBJ_UC_FW Subject =~ /^FW:/ ifplugin Mail::SpamAssassin::Plugin::ImageInfo body __IMG_LE_300K eval:pixel_coverage('all',62500,300000) endif body __INFORM_YOU /\b(?:pleased?|pleasure) to inform you\b/ body __INNERCIRCLE /\bInner Circle\b/ ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __JPEG_ATTACH Content-Type =~ /image\/jpeg/i endif body __KAM_LOTTO1 /(e-?mail address (have emerged a winner|has won|attached to (ticket|reference)|was one of the ten winners)|random selection in our computerized email selection system)/is body __KAM_LOTTO2 /((ticket|serial|lucky) number|secret pin ?code|batch number|reference number|promotion date)/is body __KAM_LOTTO3 /(won|claim|cash prize|pounds? sterling)/is body __KAM_LOTTO4 /(claims (officer|agent)|lottery coordinator|fiduciary (officer|agent)|fiduaciary claims)/is body __KAM_LOTTO5 /(freelotto group|Royal Heritage Lottery|UK National (Online)? Lottery|U\.?K\.? Grand Promotions|Lottery Department UK|Euromillion Loteria|Luckyday International Lottery|International Lottery)/is body __KAM_LOTTO6 /(Dear Lucky Winner|Winning Notification|Attention:Winner|Dear Winner)/is header __KAM_LOTTO7 Subject =~ /(Your Lucky Day|(Attention:|ONLINE) WINNER)/i header __KB_MSGID_OUTLOOK_888 Message-Id =~ /^<[0-9a-f]{8}(?:\$[0-9a-f]{8}){2}\@/ meta __KNOWN_VANITY __PRINCETONPRE || __WHOSWHO || __DPHPVANITY uri __LOANURIFVGT /\bloa.?ns?\b/i ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __LOTSA_MONEY_00 /\s?\d[\dO][,\.][\dO]{3}(?:(?!\d)|\b)/ endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __LOTSA_MONEY_01 /(?:(?i:sum\sof\s)[\(\[]?|\s?)\s?\d[\d.,\sO]{5,20}[\dO]/ endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __LOTSA_MONEY_02 /\d[\d.,\sO]{5,20}[\dO][\)\]]?\s?(?:|Pounds|(?i:dollars?))\b/ endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __LOTSA_MONEY_03 /(?:(?i:sum\sof\s)[\(\[]?|\s?)\d(?:[\d.,\sO]{0,5})?[\)\]]?\s?(?i:M(?i:il)?\b|mil+(?i:io|)n|hund?[re]+a?[dt]|thousand|tausend)/ endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __LOTSA_MONEY_04 /(?:\d[\d\.]{0,4}M|million(?!s)|milln|hund?rea?d(?!s)[^\.]{1,25}thousand(?!s)|cents?[^\.]{1,25}mille|hundert[^\.]{1,30}tausend|ientos?[^\.]{1,20}mil)[^\.\$]{0,50}(?:(?:U\.?\s?S\.?\s?(?:A\.?\s?)?|united\s?states?|canad(?:ian|a)\s)?dollars?|USD|GBP|\spounds?|(?:\s)?pounds?\ssterling|pounds(?!\sof)|(?:d'\s?)?euros?|francs?)\b/i endif header __MAILER_OL_5510 X-Mailer =~ /^Microsoft Office Outlook, Build 11.0.5510$/ header __MAILER_OL_6626 X-Mailer =~ /^Microsoft Outlook, Build 10\.0\.6626$/ header __MANY_RECIPS ToCc =~ /(?:\@[^@]{5,30}){3}/ body __MASTERS /Masters/i body __MBA /MBA/i header __MID_START_001C Message-ID =~ /^<000001c/ header __MIMEOLE_1106 X-MimeOLE =~ /^Produced By Microsoft MimeOLE V6.00.2800.1106$/ header __MIME_BDRY_0D0D Content-Type =~ /boundary="-{12}(?:0[1-9]){12}/ header __MISSING_REF References =~ /^UNSET$/ [if-unset: UNSET] header __MOLE_2962 X-MimeOLE =~ /^Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2962$/ uri __MORTURIFVGT /\bmor.?t\b/i header __MO_OL_015D5 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2905/ header __MO_OL_07794 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1437/ header __MO_OL_09BB4 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.72\.3155\.0/ header __MO_OL_1ECD5 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1081/ header __MO_OL_20C99 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.72\.3338\.1/ header __MO_OL_22B61 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1158/ header __MO_OL_25340 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4963\.1700/ header __MO_OL_32D97 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V9\.0\.2416/ header __MO_OL_3857F X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1409/ header __MO_OL_3AC1D X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.00\.2919\.6700/ header __MO_OL_3D61D X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.71\.2244\.8/ header __MO_OL_465CD X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1506/ header __MO_OL_4B815 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.71\.2730\.2/ header __MO_OL_4BF4C X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4522\.1200/ header __MO_OL_4EEDB X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4963\.1700/ header __MO_OL_4F240 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1158/ header __MO_OL_58CB5 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4133\.2400/ header __MO_OL_5B79A X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.3790\.1830/ header __MO_OL_6554A X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2905/ header __MO_OL_72641 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1441/ header __MO_OL_7533E X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4963\.1700/ header __MO_OL_812FF X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4927\.1200/ header __MO_OL_83BF7 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.72\.3110\.3/ header __MO_OL_8627E X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1437/ header __MO_OL_8E893 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V10\.0\.2616/ header __MO_OL_91287 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.2300/ header __MO_OL_9B90B X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.1700/ header __MO_OL_A50F8 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4922\.1500/ header __MO_OL_A842E X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1441/ header __MO_OL_ADFF7 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1158/ header __MO_OL_B30D1 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.2300/ header __MO_OL_B4B40 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4133\.2400/ header __MO_OL_B9B11 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2462\.0000/ header __MO_OL_BC7E6 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4927\.1200/ header __MO_OL_C65FA X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.1700/ header __MO_OL_CAC8F X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.71\.1712\.3/ header __MO_OL_CF0C0 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.2300/ header __MO_OL_EF20B X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2180/ header __MO_OL_EF222 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2873/ header __MO_OL_F3B05 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1437/ header __MO_OL_F475E X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2741\.2600/ header __MO_OL_F6D01 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4522\.1200/ header __MO_OL_FF5C8 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2741\.2600/ header __MSGID_VGA Message-ID =~ /^<000001c[67]/ header __MSOE_MID_WRONG_CASE ALL =~ /\nMessage-Id: / header __MUA_TBIRD User-Agent =~ /Thunderbird/ header __NAKED_TO To =~ /^[^\s<>]+\@[^\s<>]+$/ body __NOMINATION /\b(?:nominated|nomination)\b/i meta __NOT_SPOOFED ALL_TRUSTED || SPF_PASS || DKIM_VALID tflags __NOT_SPOOFED nice body __NO_COST /\b(?:no costs?|cost-? *free|free of costs?|no fees?|neither cost nor obligation)\b/i meta __NO_INR_YES_REF (__XM_GNUS || __XM_MSOE5 || __XM_MSOE6 || __XM_MOZ4 || __XM_SKYRI || __XM_WWWMAIL || __UA_GNUS || __UA_KNODE || __UA_MUTT || __UA_PAN || __UA_XNEWS) ifplugin Mail::SpamAssassin::Plugin::ImageInfo body __ONE_IMG eval:image_count('all',1,1) endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __PART_CID_STOCK_LESS Content-ID =~ /^<00[a-f0-9]{10}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[A-Za-z]+>$/ endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __PART_STOCK_CD_F Content-Disposition =~ /filename/ endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __PART_STOCK_CID Content-ID =~ /^<[a-f0-9]{12}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[^\s\.]+>$/ endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __PART_STOCK_CL Content-Location =~ /./ endif body __PHD /PhD/i body __PREAPPROVEDFVGT /pre-approved/i body __PRINCETONPRE /\bPrinceton Premier/ body __PUB_DEADLINE /\bpublication deadlines?\b/i header __RATWARE_BOUND_A ALL =~ /^Message-Id: <....([0-9a-f]{8})\$[0-9a-f]{8}\$.{10,400}boundary="----=_NextPart_000_...._\1\./msi # " header __RATWARE_BOUND_B ALL =~ /boundary="----=_NextPart_000_...._([0-9a-f]{8})\..{10,400}^Message-Id: <....\1\$[0-9a-f]{8}\$/msi # " ifplugin Mail::SpamAssassin::Plugin::DNSEval header __RCVD_IN_BRBL eval:check_rbl('brbl','bb.barracudacentral.org') tflags __RCVD_IN_BRBL net endif ifplugin Mail::SpamAssassin::Plugin::DNSEval header __RCVD_IN_DNSWL eval:check_rbl('dnswl-firsttrusted', 'list.dnswl.org.') tflags __RCVD_IN_DNSWL nice net endif body __RECOGNITION /\brecognition\b/i body __REGISTRY /\bregistry\b/i header __REPLYTO_EXISTS exists:Reply-To header __S25R_1 X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\d[^0-9. ]+\d\S*\./ header __S25R_2 X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\d{5}/ header __S25R_3 X-Spam-Relays-External =~ /^[^\]]+ rdns=(?:[^. ]+\.)?\d[^. ]*\.[^. ]+\.\S+\.[a-z]/ header __S25R_4 X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\d\.[^. ]*\d-\d/ header __S25R_5 X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\d\.[^. ]*\d\.[^. ]+\.\S+\./ header __S25R_6 X-Spam-Relays-External =~ /^[^\]]+ rdns=(?:dhcp|dialup|ppp|[achrsvx]?dsl)[^. ]*\d/ body __SBCAVANITY /\bSmall Business Commerce Association/ body __SEEK_FRAUD_00CSUL / field of your choice\. Your experience can get you the degree you deserve\! Call Now\!\! 24-hours a day, 7-Days a Week waiting For your call \+1-646-537-1732/ body __SEEK_FRAUD_05MSDR / and people that have had an unfinished transaction or international / body __SEEK_FRAUD_07NUWC / assets to my immediate and .xtended family / body __SEEK_FRAUD_0BHYFO /Please be informed that your won fund of the sum of US\$/ body __SEEK_FRAUD_0CUBFG / banking law and guidelines here stipulates that / body __SEEK_FRAUD_0ENSZN / within the next ten official working days/ body __SEEK_FRAUD_0EY1BH / United Kingdom\. I got your contact through / body __SEEK_FRAUD_0LP0QC /I have reasoned very professionally and I / body __SEEK_FRAUD_0MX8JO /like you to accept this token with .ood .aith as this is / body __SEEK_FRAUD_0Q_1PX /ever really cared for anyone not even myself but / body __SEEK_FRAUD_0WHPB1 /we have resolved in finding a solution to / body __SEEK_FRAUD_0WTPZI /We are here serving you with these programs\.:-/ body __SEEK_FRAUD_0YEXVQ /He took me to the paying bank for the claim of my Compensation payment\. Right now I/ body __SEEK_FRAUD_1CSABX / you to assist in distributing the money left behind by my client before it is / body __SEEK_FRAUD_1L3YC8 / to locate any of my clients extended relative/ body __SEEK_FRAUD_1LS8UW /I want you to know that I have had everything planned out so that we / body __SEEK_FRAUD_1M9C5T /anking law and guideline here stipulates that if such money .emain/ body __SEEK_FRAUD_1OMKY9 / to be merciful to me and accept my soul/ body __SEEK_FRAUD_1QSMCG /nline Winning emails in the .{0,3} category and therefore attracted a/ body __SEEK_FRAUD_1SZQH_ / by the board of trustees as one of the final recipients / body __SEEK_FRAUD_1UPTM9 /I have since lost my ability to talk and my .octors have told me that I have only / body __SEEK_FRAUD_1ZPDPI / TO THEM TO ENABLE THEM REVENUE THE CHEQUE AND START SENDING IT / body __SEEK_FRAUD_215XVW / part of our security protocol to avoid / body __SEEK_FRAUD_238_G_ / If you are familiar with private banking affairs, those who patronize our services usually prefer anonymity/ body __SEEK_FRAUD_28G2B2 /TILL YOU RECEIVE THE TOTAL AMOUNT OF YOUR \$..500.000/ body __SEEK_FRAUD_2BERS9 /\. I will also issue a .etter .f .uthori/ body __SEEK_FRAUD_2LI5N4 / all his supposed next of kin or relation died along.{0,40} crash leaving nobody behind .o/ body __SEEK_FRAUD_2ODBT6 /Though I know that a transaction of this magnitude will make any/ body __SEEK_FRAUD_2PBFIF /Bachelors, Masters or even a Doctorate\./ body __SEEK_FRAUD_2T5MRE /as they seem not to be .{0,20} with what I have left for them/ body __SEEK_FRAUD_2TMRP1 / secured way of getting the package out of Iraq .o/ body __SEEK_FRAUD_37UB9O /lessed is the hand that giveth\. I took this decision because I/ body __SEEK_FRAUD_38GETZ / he must have been in contact with you in the past or simply you were / body __SEEK_FRAUD_39_UGR / Please leave us your: 1\) Your Name 2\) Your Country 3\) Phone No\. with countrycode if outside USA/ body __SEEK_FRAUD_3BWYGW / accomplished family man, who made enough fortune before his untimely death\. / body __SEEK_FRAUD_3HKWCI / and all attempts to trace his next of kin w/ body __SEEK_FRAUD_3K585T / endeavor to get back to me as soon as possible to enable me conclude my job\. I hope to hear from you in no distant / body __SEEK_FRAUD_3OPYSM /remium and Clearance Certificate Fee of the / body __SEEK_FRAUD_3TU436 / half of the victims are from the United States/ body __SEEK_FRAUD_3UF3BG /I believe when God gives me a .econd chance to come to this world I / body __SEEK_FRAUD_3WFXLT /yet to receive their payments and I saw you/ body __SEEK_FRAUD_3XHS33 / I discovered that you bear the same surname with my late client and coincidentally/ body __SEEK_FRAUD_3Y2BZT /Sector Information\. There is a possibility that you may be related to my late client, a national/ body __SEEK_FRAUD_3ZGAWE / telephone communication in this regard / body __SEEK_FRAUD_3_8NUB /Tel\+34-658-654-308, Fax:\+34911414351 E-mail:/ body __SEEK_FRAUD_49FI4O /ants to serve the Lord must serve him in / body __SEEK_FRAUD_4HH4OS / by anybody to pay any other money except / body __SEEK_FRAUD_4IGE4U /or security reasons, you are advised to keep your / body __SEEK_FRAUD_4IQVP5 /Your email address has subsequently won you one of the two Jackpot prizes in the 5th category\? You have therefore been approved to claim a total sum of \$1, 068, 000\. 00\. \(ONE MILLION AND SIXTY EIGHT THOUSAND US DOLLARS\)Only\./ body __SEEK_FRAUD_4JAYKU /Congratulations once more from all members / body __SEEK_FRAUD_4L1CUF / health and because of the presence of my husband/ body __SEEK_FRAUD_4ONVKC / internet E-mail draw is held periodically and is organized to encourage the use of the Internet / body __SEEK_FRAUD_4VQT79 / with the help of a British contact working / body __SEEK_FRAUD_4YVO5B /ed by an advanced automated random computer / body __SEEK_FRAUD_4ZJ4MM / returned undelivered\. I hereby attempt to reach you again by .his .ame email address / body __SEEK_FRAUD_4ZVC1C /s a result of your visiting various websites we/ body __SEEK_FRAUD_556GEJ /\. This will result in the money entering / body __SEEK_FRAUD_55WLGY /dvantage of you and they will dry you up until you have nothing\./ body __SEEK_FRAUD_59Y9WZ / is still lying in my bank and no one will ever come forward to claim it\. What bothers me most is that/ body __SEEK_FRAUD_5AOJ6M / heart-related condition on March 12th 200/ body __SEEK_FRAUD_5L07LP /s\. By virtue of my closeness to the deceased and his immediate family, I am very much aware of my client/ body __SEEK_FRAUD_5MCR_O / provide you with more details and relevant documents/ body __SEEK_FRAUD_5U1LX_ /hat they will re-insure your winning fund under your full names\. / body __SEEK_FRAUD_5Y6ILV /ARRANGE YOUR PAYMENT TO BE AVAILABLE BY WESTERN UNION DUE TO / body __SEEK_FRAUD_5_1_MB /orward to us your contact information as it is stated below:/ body __SEEK_FRAUD_6B2FK_ /We will get your self a verifiable degree of:/ body __SEEK_FRAUD_6EGJH6 / the way I am going to instruct herein\./ body __SEEK_FRAUD_6HUWEQ /he needed to make an urgent investment requiring cash payments / body __SEEK_FRAUD_6LGTFG / your assistance to receive this .oney into your bank/ body __SEEK_FRAUD_6LMXWQ /We write to Congratulate you as regards your Email Address success in our Online Computer Balloting Sweepstakes Programme from the Thai Internet Lottery online draws of / body __SEEK_FRAUD_6OYTMK / to enable us open up communication with you regarding the release of your fund immediately\./ body __SEEK_FRAUD_6VUONK /to avoid any further delay and remember to pay the/ body __SEEK_FRAUD_6X9KKX /gger made you a beneficiary to his WILL\. He left the sum of Thirty Million, One Hundred Thousand Dollars \(USD\$30,..0..00..0/ body __SEEK_FRAUD_6ZE0ZK / for the paper works, take note of that\./ body __SEEK_FRAUD_72_V0Y /e sickness\. Having known my condition I decided to donate this .und to / body __SEEK_FRAUD_77PGQK / is occasioned by the fact that the customer was a foreigner and / body __SEEK_FRAUD_7A8HJM / to your postal Address in your country / body __SEEK_FRAUD_7E9IDU / acknowledge receipt of this message in acceptance of / body __SEEK_FRAUD_7H66PN /, making a loss for both the double claimer and the real ..n/ body __SEEK_FRAUD_7HMGZ1 /THANKS FOR YOUR COOPERATION\. YOURS FAITHFU.L.. MR/ body __SEEK_FRAUD_7ICRYZ / and if this proposal is not acceptable by you, kindly delete this email and do not pass it to a third party as I vehemently risk my job to send you this email\. I am presently on a foreign committee appointment in Europe through the United Nations Christian charity project fund of Uganda/ body __SEEK_FRAUD_7MXFV8 /REF NO: THAINETORG00-69803\. Contact the Coordinator for your claim: Mr\. TOAL ACHAN Email: thailotterycordinator1\@yahoo\.com\.hk Phone Number: \+\(66\)824470719/ body __SEEK_FRAUD_7NCZI_ /DETAILS YOU NEED TO PICK YOUR A DAY PAYMENT OVER THERE\. THE WESTERN UNION OFFICE IS / body __SEEK_FRAUD_7OGMRE / years the funds will revert to the ownership of the / body __SEEK_FRAUD_7QHU_W /ercentage\. All legal documents to back up your claim as my client\'s next-of-kin will be provided\. / body __SEEK_FRAUD_7UXDY2 /our Winnings Certificate and all other relevant .ocuments\/.aperwork / body __SEEK_FRAUD_7XOY_V / papers will be processed in your acceptance\./ body __SEEK_FRAUD_7_3VAV / category\? You have therefore been approved to claim a total sum of .1,/ body __SEEK_FRAUD_82HMFF /came to our bank to engage in business discussions/ body __SEEK_FRAUD_84RQ6W /Let me repeat again, try to contact them / body __SEEK_FRAUD_8A1Q6M /You may not understand why this mail came to you\./ body __SEEK_FRAUD_8D5ZCH /Full names: Address: Telephone and fax numbers: Age: Marital Status: Occupation: A copy of your identity:/ body __SEEK_FRAUD_8DEPUJ / another notification was sent.{0,20} no response came from him/ body __SEEK_FRAUD_8DOXAD /I once again try to notify you as my earlier .etter / body __SEEK_FRAUD_8FAPXC / 2 suicide bomb attacks by Pure Divine intervention\./ body __SEEK_FRAUD_8FHHRV / foreign partner in a country of my choice where . will transfer this money/ body __SEEK_FRAUD_8FSJKQ /marry or get a child outside my matrimonial home/ body __SEEK_FRAUD_8G4MVH /00,000 unions, associations, and corporate bodies that are listed online\./ body __SEEK_FRAUD_8GOL16 / a notice to contact the next of kin, or the / body __SEEK_FRAUD_8HKOPI /t you keep the contents of this mail confidential and respect/ body __SEEK_FRAUD_8N4OLG /Your Winnings Certificate and all other relevant Documents\/Paperwork would be prepared\./ body __SEEK_FRAUD_8WXZC4 /from your country whom i owe a legal obligation\./ body __SEEK_FRAUD_9ACOLT / a long way to determine my future and continued existence\./ body __SEEK_FRAUD_9EM_BD /pronounce you as the legal beneficiary and process change of ownership status to enable the/ body __SEEK_FRAUD_9KCDA8 / will mention later .as prompted me to reach out for help/ body __SEEK_FRAUD_9OLSG2 /THAILAND INTERNET LOTTERY ORGANIZATION 68C Phetchamnork Avenue, Bangkok Thailand\./ body __SEEK_FRAUD_9UX63H /I once asked members of my family to close one of my accounts and d/ body __SEEK_FRAUD_9_SYQR / request that you kindly forward to .. your / body __SEEK_FRAUD_A1ARCI / pass every custom checkpoint all over the world without / body __SEEK_FRAUD_A4QUVB /rusted me to hand over the package to his / body __SEEK_FRAUD_A5PM6O / the necessary document that will back you up/ body __SEEK_FRAUD_AB6ELR / before they get confiscated or declared / body __SEEK_FRAUD_AHTDME / trusting in you and believing in God .hat you will .ever let me down either now or in / body __SEEK_FRAUD_AKSAOK / am inviting you for a business deal where .his ..n/ body __SEEK_FRAUD_AKYCPN /t want them to know about this development\./ body __SEEK_FRAUD_AN3GQI / of unlucky people be given to the government/ body __SEEK_FRAUD_AQLP4X /ecree of 1996 to confiscate the funds after the expiration of the period given to me/ body __SEEK_FRAUD_AR89UY /I know this will come to you as a surprise b/ body __SEEK_FRAUD_ATTT9H /He also explained to me that it was because of this wealth that he was poisoned by his business .s/ body __SEEK_FRAUD_AWGSAH /this money has been kept somewhere outside Baghdad for some/ body __SEEK_FRAUD_AZLPG8 / won you the lottery in the 2nd category i\.e/ body __SEEK_FRAUD_B0BTNE /mail because your package .{0,40}n a Special Order\./ body __SEEK_FRAUD_B2MWEQ /t me because I am putting my career and the life of my family at stake with this venture\./ body __SEEK_FRAUD_BGO5Z1 / activities and to help the poor and the needy/ body __SEEK_FRAUD_BLDS9E / am delighted to inform you that the contract panel/ body __SEEK_FRAUD_BOG4XB /I hereby attempt to reach you again by this .ame email address / body __SEEK_FRAUD_BOVAPH / remember to pay them their Security Keeping fee of / body __SEEK_FRAUD_BPL3YK /ddresses of individuals and companies from all / body __SEEK_FRAUD_BQVFV6 /around me always\. I don.t want them to know about this development/ body __SEEK_FRAUD_BRNKW7 /f this business proposition offends your moral / body __SEEK_FRAUD_BRP46Y / from my private banking clients. .o not betray my confidence\./ body __SEEK_FRAUD_BSHI01 / and we have agreed to find a reliable foreign partner to deal with/ body __SEEK_FRAUD_BSJPWO / cancer problem\. Though what disturbs me most is my / body __SEEK_FRAUD_BT6SO9 / you do not need to buy ticket to enter for / body __SEEK_FRAUD_BT7WE_ /identity\. All the legal papers will be processed / body __SEEK_FRAUD_BVXMQB / unpaid contractor while auditing was going on\. Your contract file was forwarded to my office by the auditors as unclaimed fund, we wish to use this medium to inform you that for the time being Federal Government / body __SEEK_FRAUD_BXYWIK /On behalf of the Trustees and Executor of the .state of / body __SEEK_FRAUD_BY5FQK / World Fund Discovery Management And Payment Bureau / body __SEEK_FRAUD_C17QX1 /: 4\. Age: 5\. Sex: 6\. Nationality: 7\. Country of Residence: 8\. / body __SEEK_FRAUD_C1B0QK /ot trust them anymore, as they seem not to be .onten/ body __SEEK_FRAUD_C4LA4T /This and other reasons put into consideration have prompted me to reach out for help\. If it might be of interest to you then .ndeavo/ body __SEEK_FRAUD_C4M8O6 /\. I want you and the church to always pray for me bec/ body __SEEK_FRAUD_C7BE4W /It is understandable that you might be a/ body __SEEK_FRAUD_CHLODJ / to enable us seeing this deal through\. I guarantee / body __SEEK_FRAUD_CIDHJP /YOU ARE NOW ADVISED TO CONTACT WESTERN UNION OFFICE IMMEDIATELY AND SEND THEM YOUR / body __SEEK_FRAUD_CKPXGA /rovide either an existing bank account or / body __SEEK_FRAUD_CMBNY9 / that will allow anyone with sufficient / body __SEEK_FRAUD_CPG3SG / and i have been shot, wounded and survived two .{0,20}omb attacks by the special grace of .od/ body __SEEK_FRAUD_CQN7_5 / your country\'s airport\. I hope you understand me\./ body __SEEK_FRAUD_CTKQAR / as soon as our Delivery Team confirms your/ body __SEEK_FRAUD_CTSHG_ / your letter of acceptance; your current / body __SEEK_FRAUD_CZSHS_ /Many people share the same frustration, they are doing the work of the person that has the deg/ body __SEEK_FRAUD_C_HP37 / like you to acknowledge the receipt of this e-mail as soon as possible / body __SEEK_FRAUD_D7_SRO /s, that is why I decided to email you to stop dealing with those people, they are / body __SEEK_FRAUD_DCYEFP / you are nationals of the same country\. / body __SEEK_FRAUD_DI4MKD /Though I am very rich, I was never generous, I was always hostile to people and only focus/ body __SEEK_FRAUD_DI5SMP /maintained\. The Bible made us to understand that / body __SEEK_FRAUD_DI9349 /I am the only one who knows of this situation/ body __SEEK_FRAUD_DJ79KN /I await your prompt response\. Yours in Service/ body __SEEK_FRAUD_DJQ9TI /How are you today\? Hope all is well with you and / body __SEEK_FRAUD_DNFIPA /What you have to do now, is to contact .{0,20} Delivery Department for / body __SEEK_FRAUD_DNXWDS / has discovered a huge number of double claims due to ..n/ body __SEEK_FRAUD_DPW8DR /DETAILS WHERE THEY CAN START SENDING YOUR PAYMENT TO YOU AS WE BOOKED WITH WESTERN / body __SEEK_FRAUD_DVQ_OH /business endeavour by furnishing me with the following/ body __SEEK_FRAUD_DWEVNF /ou for being part of our promotional lottery program/ body __SEEK_FRAUD_E0LMNE / to enable us seeing this .eal through\./ body __SEEK_FRAUD_E2ESY7 / contacted him and he explained everything to me\./ body __SEEK_FRAUD_E2US_V /t is therefore upon this discovery that I / body __SEEK_FRAUD_E3FWEB / an illegal thing to do.{0,40}o compensation can make up .or the risk/ body __SEEK_FRAUD_E3KTBE / confidential business proposition for you/ body __SEEK_FRAUD_EAL6NF /it is not a Drug Money or meant to sponsor Terrorist a.t/ body __SEEK_FRAUD_EAL_DT / we shall share in ratio of ..\% for you and ..\% for me/ body __SEEK_FRAUD_EBEFON /, as you know we are being attacked by insurgents everyday and car bombs\./ body __SEEK_FRAUD_EBGSSZ /you the contact of the Finance\/Security Company in / body __SEEK_FRAUD_EG28P6 / hard earned money to be misused by unbelievers\. I don\'t want a situation where this money will be used in / body __SEEK_FRAUD_EGCOZC /\. I have a business proposal in the tune of / body __SEEK_FRAUD_EGRZ5T /trying to get my payment all to no avail\./ body __SEEK_FRAUD_EH1G11 / until his death was a member of the Helicopter Society and the Institute of Electronic \& Electrical Engineers\./ body __SEEK_FRAUD_EJ6AJR /the integrity of the information you come by as a result of this / body __SEEK_FRAUD_ELURRJ / as one of their victims of the operations,/ body __SEEK_FRAUD_ENAUAY /decision, while I await your prompt response\./ body __SEEK_FRAUD_EONOG2 / my branch in which I am the manager made / body __SEEK_FRAUD_ESXXFQ /If you find yourself able to work with me, contact me/ body __SEEK_FRAUD_ESYOL3 / through my search for a relatively unknown person who will assist me in securing a large sum of amount/ body __SEEK_FRAUD_EV4LPC /\.com and make sure you call me on this telephone number \+44-762-413-2116 immediately you forward your information so that even if am not on seat,i can go and check my email for immediate action\./ body __SEEK_FRAUD_EVB_T3 /\. It will be interesting to talk with you and learn you closer\. I build their communication with the main goal - the creation of serious relations\. Relations without deception, without any games\. I want to find a real man who can love and respect me\. I hope that you also would like to find love\? I .e/ body __SEEK_FRAUD_EWZZ2M /mbassy in Ivory Coast for nine years before he died .n the / body __SEEK_FRAUD_EXFYTU /ynthetic nylon seal and padded with machine/ body __SEEK_FRAUD_EZFEDE /: Telephone\/Fax number: Nationality: Age: Occupation:/ body __SEEK_FRAUD_E_N5XO /Now you can get verifiable degree in 4-5 weeks / body __SEEK_FRAUD_F2DKBP / in various currencies were discovered in barrels at a .arm/ body __SEEK_FRAUD_F41XLX / will make to you is not to discuss this matter with anybody, should .ou have reasons to / body __SEEK_FRAUD_F5EASW / Joseph Owor Dean of Faculty of Business Administration Uganda Christian University Mukono Town , Uganda\. Confidential Message: I hope this message will meet you in good faith, please pardon me for reaching you in this manner because you do not know me,/ body __SEEK_FRAUD_F6LCUO /e are ready to compensate you with good percentage of the funds, No strings attached, / body __SEEK_FRAUD_F6XEM3 / earlier letter was returned undelivered/ body __SEEK_FRAUD_F6ZEVO / is not mandatory nor will I in any manner compel you to hono/ body __SEEK_FRAUD_F9PTJZ /t profile is still reflecting in our central computer as / body __SEEK_FRAUD_F9YLOI / necessary documents at our .igh court probate division/ body __SEEK_FRAUD_FDHM4O /\(1\)Full name: \(2\)private phone number: \(3\)current residential address:/ body __SEEK_FRAUD_FFM0SF / considering the fact that I sourced your / body __SEEK_FRAUD_FHCU_P / you could receive these funds as you are qualified .. / body __SEEK_FRAUD_FKMQSA /claims due to .{0,20}s informing close friends relatives/ body __SEEK_FRAUD_FKRVOS /they refused and kept the money to themselves\./ body __SEEK_FRAUD_FLKBRE / all prize ..n.. must be claimed not later than / body __SEEK_FRAUD_FLVC7O /mail address emerged as one of the online Winning emails in the / body __SEEK_FRAUD_FMGOAT /beneficiary so all heredity may be in your favor\. If you can stand as beneficiary, I will.p/ body __SEEK_FRAUD_FMTQVG /Your email address attached to ticket number 286067-09-805 with Serial Number 9-3088 that drew the Lucky Numbers of 4864116\./ body __SEEK_FRAUD_FOSRJQ / due to the death of all the members of his .amily / body __SEEK_FRAUD_FOT6IF / effort to our unfinished transfer of fund into your account/ body __SEEK_FRAUD_FSYFC_ / selected among the lucky recipients to / body __SEEK_FRAUD_FTFQJK /I am Joseph Owor , The Dean.{0,3}Head of Faculty of Business Administration of the Uganda Christian University\. I will need you to assist .. in executing a confidential / body __SEEK_FRAUD_FTO6II / all arrangements and I .ill give you more information on / body __SEEK_FRAUD_FYI5WN /with those liars that will be turning you around asking for different kind of money to / body __SEEK_FRAUD_FYILNB / if you are qualified but are lacking that p.e/ body __SEEK_FRAUD_F_KZOZ / we have taken with our lives in this hell/ body __SEEK_FRAUD_G0IS4D / will revert to the ownership of the Hong Kong Government if nobody applies to claim the fund/ body __SEEK_FRAUD_G2JDK8 /Your particulars was mentioned by one of the .yndicates who was arrested .. / body __SEEK_FRAUD_G4RKKF / I want to inform you that I have successfully transferred the / body __SEEK_FRAUD_G7TLJZ /The Microsoft Internet E-mail lottery Awards is sponsored by ..r/ body __SEEK_FRAUD_G8JW6K / your full house address and your identity such as, international .assport or driver/ body __SEEK_FRAUD_GA5IFR /hich I have there to charity organization/ body __SEEK_FRAUD_GI_LXG / DRAFT CHEQUE ISSUED IN YOUR FAVOUR WITH CASH AMOUNT / body __SEEK_FRAUD_GKVMSG /r will not get into the hands of some corrupt / body __SEEK_FRAUD_GLBFPT /funds and estates be transferred to your name; In this case, I will have to come into a direct arrangement and split the funds when released to you on a fifty-fifty basis\./ body __SEEK_FRAUD_GM86W_ / was able to get the package out to a safe location ..t/ body __SEEK_FRAUD_GMLT7O /COMMITTEE ON FOREIGN PAYMENT \(RESOLUTION PANEL ON CONTRACT.PAYMENT\) / body __SEEK_FRAUD_GN2203 /Hope all is well with you and your family\?/ body __SEEK_FRAUD_GOB8DP /\. Any claim not made by this date will be returned to the Treasury of the Thailand Internet Lottery Organization as Unclaimed Fund\./ body __SEEK_FRAUD_GOYZPG /ome money in various currencies was discovered .n/ body __SEEK_FRAUD_GO_RAY /If you are looking for a fast and effective / body __SEEK_FRAUD_GPAQI8 /he money is coming .n 2 security proof boxes\. / body __SEEK_FRAUD_GQ_III / you as the Next of Kin to the Deceased since / body __SEEK_FRAUD_GRFNHQ /This email is to all the people that have been scammed .. / body __SEEK_FRAUD_GRI_IZ /You have therefore been approved of a lump sum payment of US\$1,068\.00 Dollars \(One Million and Sixty Eight Thousand US Dollars\) in cash credited/ body __SEEK_FRAUD_GS5NT6 / I want this to be one of the last good deeds I do on earth\./ body __SEEK_FRAUD_GSYHFX /We shall be expecting to receive your information/ body __SEEK_FRAUD_GTSAAF / while in the US, trying to get my payment / body __SEEK_FRAUD_GVP80_ /Please you must know that the united nation want you to pay 50\% of this total amount \(\$10\.1 million dollars\) to any motherless babies home there in your country\./ body __SEEK_FRAUD_GXGKLM / as long as you will remain honest to me till the end / body __SEEK_FRAUD_GY4RJE /I would like to intimate you with certain facts that I believe would .e/ body __SEEK_FRAUD_GYU7SL /GET YOUR DIPLOMA TODAY\!If you are looking for a fast and / body __SEEK_FRAUD_GYYTYT / banks on wrong payment and diversion of ..n/ body __SEEK_FRAUD_H2OMNV / Million dollars in cash, mostly 100 dollar bills/ body __SEEK_FRAUD_H6IXQ5 /After the death of my client his bankers contacted me/ body __SEEK_FRAUD_HA1KZT / announcement made today, .ou are among the winners of .h/ body __SEEK_FRAUD_HCCWXL / the history or nature of the deposit.{0,20}waiting instructions to release the deposit to any party that come/ body __SEEK_FRAUD_HDZKRN / in any ATM machine in any part of the world/ body __SEEK_FRAUD_HFSJ50 /Do accept my sincere apologies if my mail does not meet your personal .thics/ body __SEEK_FRAUD_HHEBIG /s numerous petitions to United Nations against / body __SEEK_FRAUD_HHL9OS /r immunity agent there in your country to stand and receive this total amount of \$10\.1 million dollars by cash immunity delivery to your country which you are to meet with the diplomats on their arrival there in your country international airport to enable them take the clearance on face to face clearing with the customs at the airport to enable them move it to your doorstep without any inspection by the government agent as it has been directed by the united nation and .ritish government\./ body __SEEK_FRAUD_HIQMMW /lose one of my accounts and donate the ..n/ body __SEEK_FRAUD_HLTNBY /Against this backdrop, my suggestion .. .o/ body __SEEK_FRAUD_HPCAW3 / sent a routine notification to his forwarding address but / body __SEEK_FRAUD_HPKGEO /reject this offer, please and please destroy this message as any .eakage of this information will be too bad / body __SEEK_FRAUD_HS90OD / will be safe in your care .ntil . complete my service here/ body __SEEK_FRAUD_HTRHIY / successfully transferred into your account, we / body __SEEK_FRAUD_HW7ENB /ssue a letter of authorization to somebody to receive it on my behalf / body __SEEK_FRAUD_HWGAFY /it will be legally proper to present you as the next of kin of my deceased client/ body __SEEK_FRAUD_HWMBYB / that failed due to Government problems / body __SEEK_FRAUD_HX12Z9 /John Wood LLP Will \& Probate Solicitors 61 Gray.s Road London WC1X 8TH Fax: \+44-700-596-1494/ body __SEEK_FRAUD_HXZ_XC /Please quote your Reference number in all correspondence with the claim/ body __SEEK_FRAUD_HYB6XM /As soon as I receive your reply I shall / body __SEEK_FRAUD_H_JSIS / I will let you know how far I have gone with the arrangement\. I will secure the .iplomatic immunity/ body __SEEK_FRAUD_I2R70M /According to the number of applicants at hand,/ body __SEEK_FRAUD_I3HLDY /m one of those that took part in the Compensation in / body __SEEK_FRAUD_I6RD6K / experience to obtain a fully .erifiable / body __SEEK_FRAUD_ID2SB5 /Please note that your lucky winning number/ body __SEEK_FRAUD_IEV_CE /ositive response and once I am convinced that you are capable and .ill/ body __SEEK_FRAUD_IGL8BZ / part of our precautionary measure to avoid / body __SEEK_FRAUD_IGWSWV / need your urgent assistance in transferring the sum of / body __SEEK_FRAUD_IHV47A /\. He informed us that he had a financial portfolio of/ body __SEEK_FRAUD_IILB8R /I hereby inform you that the united nation and British government has choosing you as their immunity agent there in your country to stand and receive this total amount of \$10\.1 million dollars by cash immunity delivery to your country which you are to meet with the diplomats on their arrival there in your country international airport to enable them take the clearance on face to face clearing with the customs at the airport to enable them move it to your doorstep without any inspection by the government agent as it has been directed by the united nation and British government\./ body __SEEK_FRAUD_IOGCLT /octor told me that I would not last for the next / body __SEEK_FRAUD_IOVTJB / MACHINE in .ny part of the world, but the maximum / body __SEEK_FRAUD_IQFKX9 / was a very dedicated Christian who loved to / body __SEEK_FRAUD_IUQ6A9 /r to quote these numbers below for verification by the company\. R..: / body __SEEK_FRAUD_IY4ZBV / monetary related parcel with EMS COURIER SERVICES waiting to be delivered to you/ body __SEEK_FRAUD_IYEOHL /e advantage of the trust I have bestowed .n you/ body __SEEK_FRAUD_IYJGAG /details\. I expect you to indicate your interest in going further\./ body __SEEK_FRAUD_J1WFB_ / the Head of Operations in Mevas Bank, Hong Kong. I have / body __SEEK_FRAUD_J2YHWJ /f this proposal is acceptable by you, do not/ body __SEEK_FRAUD_J8PIFZ /usiness as that was the only thing I cared for\. But .ow I regret all th.s/ body __SEEK_FRAUD_JAORYH /FULL NAME: DELIVERY ADDRESS: PHONE NUMBER/ body __SEEK_FRAUD_JGKWCZ /anel was primarily delegated to investigate / body __SEEK_FRAUD_JIUMW4 /I intend to give 30\% of the total funds as compensation for your assistance/ body __SEEK_FRAUD_JJ2QOC /, and the money can only be approved into a foreign / body __SEEK_FRAUD_JK6E_X /Everything concerning this transaction shall be / body __SEEK_FRAUD_JLSUKM / funds belonging to Saddam Hussein\'s family / body __SEEK_FRAUD_JOSDVP / an American soldier, I am serving in the military / body __SEEK_FRAUD_JRCNZ0 / who was capable of assisting me in this great venture/ body __SEEK_FRAUD_JU0DNT /\. Though, I do not know to what extent you are familiar with events\./ body __SEEK_FRAUD_JVIQUO /so that the proceeds of this account valued at / body __SEEK_FRAUD_JVQE1K /Our winners are assured of the utmost standards of confidentiality,/ body __SEEK_FRAUD_JVSA_I /Please call me on \+447035978131 so that we can get this done immediately\./ body __SEEK_FRAUD_JW7I0T /are hereby strongly advised once more to keep your winnings strictly/ body __SEEK_FRAUD_J_8IHB /hat they will re-insure your .{0,20} under your full names\./ body __SEEK_FRAUD_KBGNWU /My name is Maria\. I am looking for a new friend\. Write me at : / body __SEEK_FRAUD_KCB1NC / adopted a resolution and I was mandated to provide his next of kin for the payment of this money within / body __SEEK_FRAUD_KCVY4L / will secure the Diplomatic .mmunity .learance .ertificate/ body __SEEK_FRAUD_KDGYCE / apology\. I must use this opportunity to / body __SEEK_FRAUD_KFEOGR / that the proceeds of this Bank Account valued at / body __SEEK_FRAUD_KGXNR0 / be discovered hence we want to move this money to you for safe.?keeping pending the completion of our assignment here\./ body __SEEK_FRAUD_KJQY5E /e a second chance to come to this world I w..l/ body __SEEK_FRAUD_KLGHT2 / and a consortium of software promotion companies\. The Intel Group, Toshiba,/ body __SEEK_FRAUD_KR9WGG /o not betray my confidence\. If we can be of one accord/ body __SEEK_FRAUD_KS6HHB /not with your fund, they are only making money o.. / body __SEEK_FRAUD_KTN2PE /ing the money and property left behind by my client/ body __SEEK_FRAUD_KT_TR7 / of that particular winning, making a loss for both/ body __SEEK_FRAUD_KY9RF_ / because the cancer stage has gotten to a / body __SEEK_FRAUD_L4OF4_ /o obtain the necessary documents and letter of probate.administration in your favo/ body __SEEK_FRAUD_L5CHVT / to inform you that you have won a prize money of / body __SEEK_FRAUD_L6ICNJ /, in conjunction with the foundation for the promotion of software products, \(F\.P\.S\.\) held / body __SEEK_FRAUD_LC7TDH /man on earth because I have received my / body __SEEK_FRAUD_LGPUCE / fixed deposit for 1.? calendar months, with a value of / body __SEEK_FRAUD_LIQ9CK / the sum of \$2\.8 Million US dollars has been / body __SEEK_FRAUD_LKZGK5 /Please answer only to my personal e-mail: / body __SEEK_FRAUD_LMWIWP / who will accompany the boxes to your house / body __SEEK_FRAUD_LN_G0D /, who is the member of COMPENSATION AWARD / body __SEEK_FRAUD_LPT60S / your Embassy to locate any of my client/ body __SEEK_FRAUD_LP_GQ9 /The above figure was given to me as my share/ body __SEEK_FRAUD_LQGQPO / to you because of the expiring date\. For your/ body __SEEK_FRAUD_LQICIN /last testament of the deceased\.\(Name now withheld/ body __SEEK_FRAUD_LQKNLO /We were married for eleven years without a child/ body __SEEK_FRAUD_LX2RCD / and a forwarding address to enable .. file / body __SEEK_FRAUD_LX42QL /I have an obscured business suggestion for you\./ body __SEEK_FRAUD_LYNJ8F / was conducted from an exclusive list of / body __SEEK_FRAUD_M03WB9 / discovered from his contract employers, / body __SEEK_FRAUD_M1S8EA /For further Information about your Winnings..ontact your Lottery Claims / body __SEEK_FRAUD_M3W0LK / USD\) to the States or any safe country/ body __SEEK_FRAUD_MA7TQS / for the collection of this international certified bank / body __SEEK_FRAUD_MB4NHA / from my private banking clients\. Do not betray my confidence\./ body __SEEK_FRAUD_MBOSRB / is Sensitive Photographic Film Material.{0,40} did not declare money to them/ body __SEEK_FRAUD_MBZLTR /I know that this mail will come to you as a surprise, Please accept the content in good faith\. I do not intend to cause any grief to you and your family\. The / body __SEEK_FRAUD_MC1YAI /This is to notify you that this e-mail address was entered during the Paypal European selection Draw and has won the sum of / body __SEEK_FRAUD_MCEI6K / from public notice until your claim has been / body __SEEK_FRAUD_MEMBMQ /r to quote these numbers below for verification by the company\. REF: P.{0,40} you should include Your Name, Address, Sex, Age, Occupation, Nationality, Phone Number/ body __SEEK_FRAUD_MFD6AB /o avoid unnecessary delays and complications/ body __SEEK_FRAUD_MKLICT /After these several unsuccessful attempts,/ body __SEEK_FRAUD_MNSFWO /o obtain the necessary documents and letter of probate\/administration in your favo/ body __SEEK_FRAUD_MQOXUR / the account has no other beneficiary\. / body __SEEK_FRAUD_MRKTQJ / as I now know that there is more to life than just wanting to have or make all the .oney in the world\./ body __SEEK_FRAUD_MTD5KL / under listed information as soon as possible/ body __SEEK_FRAUD_MUZG_5 /ence the reason for taking this bold decision\./ body __SEEK_FRAUD_MVBG8Z / about his death, we have been expecting .is / body __SEEK_FRAUD_MWUIJQ / confidential till your claims is processed and your / body __SEEK_FRAUD_MY06YR /the lord will fight my case and I shall hold my peace/ body __SEEK_FRAUD_MZXYFH /This is no stolen money and there are no dangers involved\./ body __SEEK_FRAUD_M_U4VI / I found your contact particulars in an address journal\. I am seeking your / body __SEEK_FRAUD_M_UYU5 / and no one is informed of this communication/ body __SEEK_FRAUD_N1QADF /I have distributed ..n.. to some charity .rgani.ations/ body __SEEK_FRAUD_N21EJ1 / was poisoned to death by his business associates / body __SEEK_FRAUD_N2TUPL / including the paper work of his bank deposit/ body __SEEK_FRAUD_N4IAWN /According to him this money is to support / body __SEEK_FRAUD_N87C1L /nd also please do update me with any new development\./ body __SEEK_FRAUD_NABBSF /so that the proceeds of this account can be paid to you/ body __SEEK_FRAUD_NAWNBX / part of our International Promotions .rogram/ body __SEEK_FRAUD_NAXE2Z / in accordance with the enabling act of Parliament/ body __SEEK_FRAUD_NCXX2C / to the laws of my country at the expiration / body __SEEK_FRAUD_NH1RHX /winners are assured of the utmost standards of confidentiality,.?and press anonymity until the end of / body __SEEK_FRAUD_NH9TNM / the Internet, to locate any member of his family/ body __SEEK_FRAUD_NICJUW / which the Bible is against\. When my late husband was alive he deposited the sum of / body __SEEK_FRAUD_NJRW4J / in Bulgaria and Pakistan, they .efused and kept the money .o/ body __SEEK_FRAUD_NM1G_Z / you because you bear the surname identity / body __SEEK_FRAUD_NMDNZN / and since then my father took me so special/ body __SEEK_FRAUD_NMFPFW /lease call our claim agent or send email immediately to/ body __SEEK_FRAUD_NNFYWE /you are advised to keep your winning information confidential till your / body __SEEK_FRAUD_NPIVP9 /som of the Lord\. Exodus 14 VS 14 says that .{0,40}se and I shall hold my peace/ body __SEEK_FRAUD_NPQMIG / in all his official documents, including his Bank/ body __SEEK_FRAUD_NV1CZX / stopped further payment through bank to bank transfer / body __SEEK_FRAUD_NVFQGO /your package over there and know when it will get to your / body __SEEK_FRAUD_NXGM0O /I will prefer you reach me on my private email address/ body __SEEK_FRAUD_N_W2ZS /et me know through email as soon as you receive your / body __SEEK_FRAUD_O8HLCQ /You are to contact me on my secure email address below for further details if this proposal is accepted by you:/ body __SEEK_FRAUD_OBTMVR / have been transferred to your nominated bank account we shall / body __SEEK_FRAUD_OB_SPK /implore you to exercise the utmost indulgence to keep this matter .{0,20}y confidential, whatever your / body __SEEK_FRAUD_OFB_9X / WORLD BANK FACT-FINDING \& SPECIAL DUTIES OFFICE / body __SEEK_FRAUD_OL815K / declared to them as the contents is Sensitive Photographic Film Materials for security reasons\./ body __SEEK_FRAUD_OP4FZV / details and more information about myself and the funds/ body __SEEK_FRAUD_OPAU37 /d over-invoiced payment as the effect has eaten deep into the economy of our / body __SEEK_FRAUD_OPXSIA / As part of our expansion and promotional package for the fiscal year 2009, .e are pleased to inform you that / body __SEEK_FRAUD_ORCHU5 /Now you will easily get legal degree in only 4-5 weeks / body __SEEK_FRAUD_ORHOZJ /Due to your effort, sincerity, courage and trust/ body __SEEK_FRAUD_OSTMZF /the claims arrangement\. I want to insist that I transact with you directly, so do provide your/ body __SEEK_FRAUD_OUSGU0 /in the tsunami disaster on the 26th December/ body __SEEK_FRAUD_OWE2LK /BARRISTER TEDDY WILLIAMS ESQ\.PRINCIPAL PARTNERS: Barrister Aidan Walsh\.Esq Markus Wolfgang,Smith Esq / body __SEEK_FRAUD_P8AQ1J / in distributing the money left behind by my client before it is confiscated .. / body __SEEK_FRAUD_P8JJBS / category and therefore attracted a cash award of / body __SEEK_FRAUD_PADMFK / the presence of my husband\x{92}s relatives around me always/ body __SEEK_FRAUD_PA_EWE /John Wood LLP Will \& Probate Solicitors 61 Gray\x{92}s Road London WC1X 8TH Fax: \+44-700-596-1494/ body __SEEK_FRAUD_PBDQ4T / \/GMSA and consequently you won in the / body __SEEK_FRAUD_PFBAPT /I don\'t want you to feel sorry for me, because, I .elieve everyone will / body __SEEK_FRAUD_PKVKI1 /I send you this mail not without a measure of fear as to / body __SEEK_FRAUD_PLG_K_ / dollars\) in an account that belongs to one of/ body __SEEK_FRAUD_PNYKVG / I therefore seek your consent to present you as the Next.of..in .. the .eceased / body __SEEK_FRAUD_POCEH_ /rawn from 2,500,000 .mail .ddresses of individuals and companies from / body __SEEK_FRAUD_PQTBKM / random selection in our .omputerized .mail .election / body __SEEK_FRAUD_PRKDOF /\) in his domiciliary bank account in a commercial bank here in London\./ body __SEEK_FRAUD_PSPGBR /\) and send me the following information for documentation purpose:/ body __SEEK_FRAUD_PUSLFS /Can I trust you\? When you receive this letter, kindly send .. / body __SEEK_FRAUD_PWR5MZ /e selection process was carried ou. through / body __SEEK_FRAUD_PYPH_Q / will be executed under legitimate arrangement that will protect .o/ body __SEEK_FRAUD_PZEJXH / with absolute confidentiality and sincerity\./ body __SEEK_FRAUD_PZKR_K /ever is contacting us through emails are fake/ body __SEEK_FRAUD_P_7YRN /I shall assemble all the necessary Legal Documents that will be used to back up our claim\. / body __SEEK_FRAUD_Q1JQ6T /Please you don\'t have to worry for anything/ body __SEEK_FRAUD_Q3BSST / my involvement in claiming the deposit\./ body __SEEK_FRAUD_QEGOBV /raq during a rescue operation, and it was agreed by / body __SEEK_FRAUD_QFLIUL / right move and receive your due benefits/ body __SEEK_FRAUD_QHAHKB / and to conceal this kind of money became a .roblem for me/ body __SEEK_FRAUD_QHHJOT / I have an obscure proposal of mutual interest to share with you\. I got your email address from the Internet / body __SEEK_FRAUD_QIOHEI /e, because, I believe everyone will die someday\. My name is / body __SEEK_FRAUD_QJ58__ /Forward you next response to this email address: / body __SEEK_FRAUD_QJAXD2 / a promotional program aimed at encouraging internet users; / body __SEEK_FRAUD_QK7QNG /I have already submitted an approved .nd.of.the..ear report .o/ body __SEEK_FRAUD_QKKKMG /Think of it, within four to six weeks, you too could be a c/ body __SEEK_FRAUD_QKMOJL / have secured from the probate an order of mandamus to/ body __SEEK_FRAUD_QLJWTR /e congratulate you over your success in the following official publication of results of the E-mail electronic online / body __SEEK_FRAUD_QLR0BH / contacted me, as his .ttorney to provide his next of kin who should inherit his f/ body __SEEK_FRAUD_QLUR_M /I did not declare money to them please\. If they call you and ask you the contents please tell them the same/ body __SEEK_FRAUD_QMDFLB /fter going through some old files in the records/ body __SEEK_FRAUD_QSWUVB / computer draw system and extracted from over .0..00/ body __SEEK_FRAUD_QT5OWK / CONTACT THE DIRECTOR OF WESTERN UNION OFFICE/ body __SEEK_FRAUD_QVAQMZ /With God all things are possible\. As soon as I receive your reply / body __SEEK_FRAUD_QWYVZJ /Now you can get real degree just in 4-5 weeks / body __SEEK_FRAUD_R2DFPW /CONTACT THEM AS TODAY: THE AMOUNT THEY WILL SEND YOU EVERY DAY IS \$5000\.00 / body __SEEK_FRAUD_R9RCJX / all the paperwork for this transaction / body __SEEK_FRAUD_RAQSMO /about their winning and also sharing their pin numbers\./ body __SEEK_FRAUD_RBSKB2 /Congratulations once more from our members of staff/ body __SEEK_FRAUD_RC7YZH /e are going to send your contract part payment of / body __SEEK_FRAUD_RCLBZD / \"Just leave your NAME \& PHONE NO\. \(with CountryCode\)\" in the voicemail\./ body __SEEK_FRAUD_RDZY_Z / know this letter will definitely come to you as a huge surprise, but I implore you to take the time to go through it carefully as the decision you make will go / body __SEEK_FRAUD_RGFON2 /Leave your msg, with your full name and number / body __SEEK_FRAUD_RGLRBD /, we sent a reminder and finally we discovered from his contract empl/ body __SEEK_FRAUD_RG_9_1 / this deposit and dispatched it to charity organization/ body __SEEK_FRAUD_RIVPNL / I am seeking your kind .ssistance to move the sum of / body __SEEK_FRAUD_RIZ_7T / met all statutory requirements in respect of your/ body __SEEK_FRAUD_RK7ST3 / Uganda\. Once the transaction I am proposing to you have been successfully completed if accepted by you and the fund in question is in your possession, we shall be offering to you a ratio to be agreed upon/ body __SEEK_FRAUD_RL7Z6K /e have arranged your payment through our SWIFT CARD PAYMENT CENTRE in Europe,/ body __SEEK_FRAUD_RLKX_U /Please contact me at once to indicate your interest\./ body __SEEK_FRAUD_RO2TAX /n his bio-data form, he listed no next of kin\./ body __SEEK_FRAUD_RODZKF / you showed at the course of the transaction I / body __SEEK_FRAUD_RON849 /If you are not, I may still be able to work out modalities for transferring his estates still/ body __SEEK_FRAUD_RQIFJU /gent and give them your full names so .hat they will re-insure your / body __SEEK_FRAUD_RS8OQV / as indicated in your play coupon\. In .iew of this, / body __SEEK_FRAUD_RUAEP8 / I lead a healthy lifestyle\. I do not smoke or drink alcohol\. / body __SEEK_FRAUD_RWS7HA /r to quote these numbers below for verification by the company\. REF: PP-21180-ES and BATCH: PP-245-44 you should include Your Name, Address, Sex, Age, Occupation, Nationality, Phone Number/ body __SEEK_FRAUD_RZIRDL /You have to contact him directly on this / body __SEEK_FRAUD_RZZRJV / apprehensive because you do not know me/ body __SEEK_FRAUD_R_EW6F /ou have reasons to reject this offer, please / body __SEEK_FRAUD_S8TD6S /ame now withheld since this is our second letter to you/ body __SEEK_FRAUD_S9BKX_ /Though what disturbs me most is my stroke\. Having known my condition I decided to donate this fund to c/ body __SEEK_FRAUD_SBFKHU /n this regards, do not hesitate to contact me for more details and direction,/ body __SEEK_FRAUD_SBLZOX /o you via our accredited shipping company / body __SEEK_FRAUD_SCUVYQ /declared unserviceable by the bank where this deposit valued at Eighteen million dollars / body __SEEK_FRAUD_SEBSU_ / be a bank-to-bank transfer\. All I need from you/ body __SEEK_FRAUD_SESJTR / that will utilize this money the way I am going to instruct here in\./ body __SEEK_FRAUD_SEXGXK /\. You are to contact me on my secure email address below for further details if this proposal is accepted / body __SEEK_FRAUD_SGFSMN / msg, with your full name and contact number so we can call you back\./ body __SEEK_FRAUD_SGH_BE / a different way from how I have lived it\./ body __SEEK_FRAUD_SH1EZL / as one of the final recipients of a cash Grant\/Donation / body __SEEK_FRAUD_SIYSH8 / to always pray for me because the lord is my / body __SEEK_FRAUD_SJUAFZ / this transaction would be most profitable for both of us/ body __SEEK_FRAUD_SLSYFP / by virtue of its nature as being utterly / body __SEEK_FRAUD_SRCLWP / does not know the original contents of the box/ body __SEEK_FRAUD_SRZ_KN /I know within me that nothing ventured is nothing gained and that success and riches never come easy or on a platter of gold/ body __SEEK_FRAUD_STNPOT / business associates on one of their .u.in/ body __SEEK_FRAUD_SUOVUP / this business with utmost .onfidentiality/ body __SEEK_FRAUD_SV6SWN /I am revealing this to you with believe in God that you will never let .e down in this business, you are the first and the only person that I .m contacting for this business,/ body __SEEK_FRAUD_SVVXNA / you will be given your donation pin number/ body __SEEK_FRAUD_SZOTOL / you are a highly respected personality, considering the fact .hat I .o/ body __SEEK_FRAUD_S_M1GN /So I decided to travel down to Nigeria with all my .o/ body __SEEK_FRAUD_T2PQH_ /Please kindly accept my apology for sending / body __SEEK_FRAUD_T3QROW /I will need you to assist me in executing / body __SEEK_FRAUD_T5JBS7 /I am desperately in need of assistance and I have summoned up courage to contact you\./ body __SEEK_FRAUD_T6QSEI /I need your full co-operation to make this / body __SEEK_FRAUD_TATA_B /Congratulations once again from all the members and staff\'s of / body __SEEK_FRAUD_TCYHCF /I therefore made further investigation and discovered that / body __SEEK_FRAUD_TELOJY /These requirements will enable us file letter of claim to the appropriate/ body __SEEK_FRAUD_TFGP0H / you have not received your payment due to your lack of co-operation and not fulfilling the / body __SEEK_FRAUD_TH3PHS /The world of private banking especially is fraught with huge rewards for th/ body __SEEK_FRAUD_TIWDAE / fund\. Please assure me that you will act accordingly as / body __SEEK_FRAUD_TKRYFP /For privacy and confidentiality reply using my fax: \+44-700-596-1494 or email:/ body __SEEK_FRAUD_TLPAKX /very attempt to trace any member of his / body __SEEK_FRAUD_TMBKSM /I have decided to give alms to charity organi.ations,/ body __SEEK_FRAUD_TSWC8H / recorded\. My late client was an influential wealthy businessman, an oil m/ body __SEEK_FRAUD_TTAUPG /You are also to immediately pay the delivery charge.{0,40} to ensure prompt delivery\. We look forward to hearing from you soon\. Copyright/ body __SEEK_FRAUD_TUOYBL / the funds be released to me, but that w..l/ body __SEEK_FRAUD_TWEN6R / benefit from the diplomatic immunity payment\. This panel was primarily delegated .. / body __SEEK_FRAUD_TWJR_E / to them again to avoid any mistake on the Delivery and / body __SEEK_FRAUD_TXS4Z8 /eason for sending this mail is very fundamental to the doctrine of human privileges and right\. My name is Barrister John Wood a legal practitioner based in .?ondon and the personal Attorney to late Mr\. Adams, a national of your country who died along with his wife and two sons who died in the Tube explosion between King\'s Cross-and Russell Square in London\./ body __SEEK_FRAUD_TZQSNN /Once again congratulations\. Your email ad/ body __SEEK_FRAUD_TZVEWH / iKobo Visa card\. We have concluded plans to deliver this / body __SEEK_FRAUD_U0YN9X / as I am hopeful, endeavor to get back to me as soon as possible to enable me conclude my job/ body __SEEK_FRAUD_U1T7IN / you to assist in repatriating the money / body __SEEK_FRAUD_UCSJVN / from his account unless someone applies for/ body __SEEK_FRAUD_UDENCE /winner was the informer to the double claimer about the lottery\. So you/ body __SEEK_FRAUD_UGUIOV / up\. I do not know for how long I will remain here/ body __SEEK_FRAUD_UHGEL7 /after a brief illness that lasted for only / body __SEEK_FRAUD_UHLUPC /, that shares the same last name as your/ body __SEEK_FRAUD_UJSOEL / online version were selected .andomly from / body __SEEK_FRAUD_UJZKNM /I will like you to provide immediately your full .ame/ body __SEEK_FRAUD_UKFOFG /t have any child that will inherit .his ..n/ body __SEEK_FRAUD_UQ94CD /\. I am seeking your assistance to evacuate the sum of / body __SEEK_FRAUD_US_OFW /hilanthropy earned him numerous awards during his life/ body __SEEK_FRAUD_UVV3P5 / I have never been married and have no children. / body __SEEK_FRAUD_UWS9PO / this business, so please reply urgently / body __SEEK_FRAUD_V4GLSO /provide a more direct means of communicating by either fax or phone so we can be sure to go into/ body __SEEK_FRAUD_V4_LC8 /buse of this program by some unscrupulous elements\./ body __SEEK_FRAUD_V6WK7U /account that belongs to one of our foreign .ustomer/ body __SEEK_FRAUD_V86CVT /I have an obscured .usiness suggestion for you\./ body __SEEK_FRAUD_VBQ9JO /this, these friends try to claim the lottery on behalf of the real/ body __SEEK_FRAUD_VD8CIS /amily to close one of my accounts and distribute the money/ body __SEEK_FRAUD_VDWAJV / be released to you by any of our payment offices in / body __SEEK_FRAUD_VEGVH5 /ash Grant\/Donation for your own personal, education/ body __SEEK_FRAUD_VGW1Y2 /t you think that it is time you were paid fair compensation for the level of work you are already doing\?/ body __SEEK_FRAUD_VKUVK9 / stop any further communication with anybody or office/ body __SEEK_FRAUD_VMKU09 / has called me, I have willed and given .ost of my propert/ body __SEEK_FRAUD_VN55YN / with all my compensation documents, .nd I was / body __SEEK_FRAUD_VNIWHY / occupy certain offices and oversee certain portfolios. / body __SEEK_FRAUD_VQ2UGD / the history or nature of the deposit\. They are simply a/ body __SEEK_FRAUD_VSMRB_ /http:\/\/news\.bbc\.co\.uk\/2\/hi\/middle_east\/2988455\.stm/ body __SEEK_FRAUD_VSTK_A /ould live my life a different way from how I have .ived it\./ body __SEEK_FRAUD_VTLF_0 / to contact me for your Confirmable Bank Draft of / body __SEEK_FRAUD_VUPAEQ / will be paid into your account for us to share in the ratio of / body __SEEK_FRAUD_VXEHN_ /As soon as i receive the requested information and confirm your readiness to handle this matter, i will process your immunity cash funds proof of ownership certificate and your cash funds delivery approvals form \"D\" and forward them to you for your own view and record, then i will advise you with the date and time the diplomats will arrive your country\./ body __SEEK_FRAUD_VXUYZK / at the age of 80 years, and his WILL is now ready for execution\...c/ body __SEEK_FRAUD_VYVEY7 / will be transferred into banking treasury as unclaimed/ body __SEEK_FRAUD_W0MUAO / driver\'s license or international passport/ body __SEEK_FRAUD_W2UMWG / to be transferred to an offshore account with your assista/ body __SEEK_FRAUD_W7O0I7 / 4-5 weeks on base of your professional experience/ body __SEEK_FRAUD_WBUWZR / few months to live, according to medical experts/ body __SEEK_FRAUD_WEX7TC /oth of us before informing anybody about it since both of us saw the money first/ body __SEEK_FRAUD_WI_PXU /have been waiting for you since to contact me for your ..n/ body __SEEK_FRAUD_WJGJCF / 4-5 weeks with the help of your professional career / body __SEEK_FRAUD_WKB0PH / your profile from a human resource.{0,40} your country\. Though, I do not know to what exten. you are familiar with / body __SEEK_FRAUD_WKGUZG /ttorney at law\. A deceased client of mine/ body __SEEK_FRAUD_WMI_AD / several unsuccessful attempts, I decided to / body __SEEK_FRAUD_WN6DGZ /THAILAND INTERNET LOTTERY ORGANIZATION \!\!\!/ body __SEEK_FRAUD_WQ2NTM / for my health\. It has defiled all form/ body __SEEK_FRAUD_WTLSNH /will make any one apprehensive and worried, but I/ body __SEEK_FRAUD_WTOIOJ /If you are interested I will send you the full details, my job is to find a good partner that we can trust and that will assist us/ body __SEEK_FRAUD_WTP_AR / had planned to invoke the abandoned property .ecree of / body __SEEK_FRAUD_WU7H4Y / honourably seeking your assistance in the following ways/ body __SEEK_FRAUD_WYNEG6 /Bachelor Degree, Master, MBA, Even PhD \(non accredited\) available in the / body __SEEK_FRAUD_WZCXWN /CALL US TODAY AND GIVE YOUR WORK EXPERIENCE THE CHANCE TO EARN YOU THE HIGHER COMPENSATION YOU DESERVE\!/ body __SEEK_FRAUD_WZIO9H /I have evaluated the risks and the only risk I have here is / body __SEEK_FRAUD_X73ESB /kindly reach me back at this juncture to get your opinion first/ body __SEEK_FRAUD_X7EJQN / as the next-of-kin and beneficiary of my / body __SEEK_FRAUD_XABL7X /I am not afraid of death hence I know .h/ body __SEEK_FRAUD_XADCD3 / are only taking advantage of you and they will dry you up until you have / body __SEEK_FRAUD_XBAISM / the world as part of our .lectronic .usiness Promotions Program/ body __SEEK_FRAUD_XBF8EX / and promote computer literacy worldwide/ body __SEEK_FRAUD_XD3U8U / disbursement according to .he percentage/ body __SEEK_FRAUD_XD5HNK / so that the attorney can commence his job/ body __SEEK_FRAUD_XDHW_C / so that you can be paid the funds left in his bank account/ body __SEEK_FRAUD_XFMQVE / the presence of my husband\'s relatives around me/ body __SEEK_FRAUD_XG7DBD / foreign partner that made me to contact you / body __SEEK_FRAUD_XNIO3Q / required arrangements have been made for the / body __SEEK_FRAUD_XUO6FU /Our European agent will immediately commence / body __SEEK_FRAUD_XVOXCD /during the course of our auditing I discovered a .loating fund .. / body __SEEK_FRAUD_XWTJ0S /, while I await your prompt response\. Please contact me at once / body __SEEK_FRAUD_XZHQ8G / from all members and staffs of this pro/ body __SEEK_FRAUD_Y1JN21 /ou are hereby warned not to communicate or duplicate this message to / body __SEEK_FRAUD_Y1JTCA /hat my health has deteriorated so badly,/ body __SEEK_FRAUD_Y6P5MJ / contacting us through emails are fake\./ body __SEEK_FRAUD_YA_RGO /Please get in touch with me by email with the information below to enable us discuss further\./ body __SEEK_FRAUD_YCIKWZ / reached a decision from headquarters that any double claim discovered by the / body __SEEK_FRAUD_YFJVJR / Economic and Financial Crimes Commission / body __SEEK_FRAUD_YGHQXE /ed to him by one of his numerous friends abroad who wished you good/ body __SEEK_FRAUD_YGIICU / in the Codicil and last testament to his WILL\./ body __SEEK_FRAUD_YGSXRP /NOW WAITING FOR YOUR DETAILS WHERE THEY CAN START SENDING YOUR A .AY/ body __SEEK_FRAUD_YKTGTU /Please always be prayerful all through your life\./ body __SEEK_FRAUD_YM7Q1U /Our staff will get back to you in next few days\!/ body __SEEK_FRAUD_YNMXUS / guarantees the successful execution of this transaction/ body __SEEK_FRAUD_YSIB2_ /http:\/\/en\.wikipedia\.org\/wiki\/2004_Indian_Ocean_earthquake\./ body __SEEK_FRAUD_YSQL2G /I am desperately in need of a.{0,20} summoned up courage to contact you\./ body __SEEK_FRAUD_YSRIAC /his message might meet you in utmost surprise/ body __SEEK_FRAUD_YTHL2Y / abroad\. I will want you to help me collect/ body __SEEK_FRAUD_YVZE_1 / remitted to you in whatever manner you .e/ body __SEEK_FRAUD_YXMY7P / we plan on using diplomatic means .{0,20} the money out as military cargo / body __SEEK_FRAUD_Z93JKO / bank official we can transfer .his money to any / body __SEEK_FRAUD_Z9MGXL /under my custody and funds still deposited in a financial institution in your name as/ body __SEEK_FRAUD_ZA0FLG /Do Not Reply to this Email\. We do not reply to text inquiries, and our server will reject all response traffic\. We apologize for any inconvenience this may have caused you\./ body __SEEK_FRAUD_ZBR4PG /I have packaged a financial transaction that will benefit .o/ body __SEEK_FRAUD_ZC2ZFP / pray that you are discreet about this mutually benefiting relationship\./ body __SEEK_FRAUD_ZIXFEC / have agreed to compensate them with the sum of US\$/ body __SEEK_FRAUD_ZLALWU / per transaction\. So, if you like to receive your fund this way,/ body __SEEK_FRAUD_ZMFYMV /Furthermore, should there be any change .. / body __SEEK_FRAUD_ZN9EIN /andomly from World Wide Web sites through .omputer / body __SEEK_FRAUD_ZO4YVB / your acceptance of this deal, we request that you kindly / body __SEEK_FRAUD_ZPZ5UU / but are lacking that prestigious piece of paper known as a dip.{0,40} the passport to success\./ body __SEEK_FRAUD_ZR4ER1 /r to observe utmost discretion in all matters concerning this ..s/ body __SEEK_FRAUD_ZRUAWA / my office that no one except me knew of his / body __SEEK_FRAUD_ZSK9XC /from what I have inherited from my late / body __SEEK_FRAUD_ZSQUMG /eposit for twelve calendar months, .alued at / body __SEEK_FRAUD_ZUGTOV /The detailed total amount in deposit and estates cannot be stated in this mail until you will.p/ body __SEEK_FRAUD_ZXQJ3E /the double claimer and the real winner, as it is taken that the real/ body __SEEK_FRAUD__2H_ZF /I have not particularly lived my life so well,/ body __SEEK_FRAUD__2TQ2_ /UNION OFFICE TO START REMITTING YOUR PAYMENT RIGHT FROM TOMORROW IF POSSIBLE YOU / body __SEEK_FRAUD__50GYI /iKobo is a.{0,40}ompany that specializes in money transfers. / body __SEEK_FRAUD__6TXBR /It will interest you to know that we have discovered an outstanding unpaid\/unclaimed sum of money in favo/ body __SEEK_FRAUD__9MFA7 / funds belonging to Saddam Hussein.s family/ body __SEEK_FRAUD__BXKBH /church or better still a .hristian individual that will utilize this money the way I am going to instruct h/ body __SEEK_FRAUD__CHQMV / that any double claim discovered by the Lottery Board will/ body __SEEK_FRAUD__ERENB /Confirm the receipt of this message and send the requirements to me immediately / body __SEEK_FRAUD__EVXD7 / will put you in place as the next of .in/ body __SEEK_FRAUD__GI7UC /assport or drivers license and your mobile phone and telephone number, The Diplomatic A/ body __SEEK_FRAUD__GKS7V /We can help you get BBA, MBA, phD degrees\./ body __SEEK_FRAUD__HJ2Y5 /\% to you, while 5\% should be for .xpenses or / body __SEEK_FRAUD__IA9KC /his may sound strange and unbelievable to you, but / body __SEEK_FRAUD__K6QXJ /To make arrangement for me to come over to your country .. / body __SEEK_FRAUD__KZVBM /further advised to maintain the strictest level of confidentiality until the end of proceedings to circumvent problems associated with fraudulent claims\./ body __SEEK_FRAUD__LDOW2 / and the interest is being rolled over with the principal sum at the end of each year\. No one will / body __SEEK_FRAUD__MMCUC /nybody under the age of 18 is automatically disqualified\./ body __SEEK_FRAUD__O3CDN /sentative office in Europe as indicated in your play / body __SEEK_FRAUD__O41EP /ince then nobody has done anything as regards the claiming / body __SEEK_FRAUD__OXXSN / to stop dealing with some non-officials in the bank as this is an illegal act and will have to stop if you so wish to receive your payment immediately\./ body __SEEK_FRAUD__Q0H7E / have summed up courage to contact you\./ body __SEEK_FRAUD__RO8LU /igh court probate division for the release of th/ body __SEEK_FRAUD__STWOQ / years ago and they refused to pay me, I had paid over / body __SEEK_FRAUD__UEMNA /\. I am writing following an opp.rtunity in my office that will be of immense benefit to both of us\. / body __SEEK_FRAUD__UWBXC /, I was never generous, I was always hostile to people and only focused on my business as that was the only thing I cared for\./ body __SEEK_FRAUD___VYVJ /You really have to stop dealing with those people that are contacting you and telling you that your fund is with them/ meta __SEX_WRDS (__WORD_SEX || __WORD_CUM || __WORD_SPERM || __WORD_SLUTS || __WORD_RAPED) body __SHMUCK /\b(?:accomplished|distinguished|exceptional|talented|calibre of) +(?:professionals?|individuals?)\b/i rawbody __SPAN_BEG_TEXT /[a-z]{2}<(?i:span)\s/ tflags __SPAN_BEG_TEXT multiple rawbody __SPAN_END_TEXT /[^;>]<\/(?i:span)>[a-z]{3}/ tflags __SPAN_END_TEXT multiple header __SUBJ_3DIGIT Subject =~ /\b\d{3}[^0-9]/ header __SUBJ_APPROVE Subject =~ /Approve/i header __SUBJ_RE Subject =~ /^R[eE]:/ header __SUBJ_VEGAS Subject =~ /(?:Vegas|Casino)/i header __TB_MIME_BDRY_NO_Z Content-Type =~ /boundary="-{8,}(?:[1-9]){16}/ rawbody __TINY_FLOAT /\bstyle\s*=\s*"[^"]{0,40}?(?:(?:FONT-SIZE\s*:\s+\dpx|FLOAT\s*:\s+(?:right|left))(?:;\s+)?(?:(?!(?:FONT-SIZE|FLOAT))\w+:\s+\w+;?\s*)*){2}/i tflags __TINY_FLOAT multiple header __TO_NO_ARROWS_R To !~ />$/ header __TO_UNDISCLOSED To =~ /undisclosed-recipients:/i header __TT_BROKEN_VALIUM Subject =~ /V[:^."%()*\[\\]?A[:^."%()*\[\\]?L[:^."%()*\[\\]?I[:^."%()*\[\\]?U[:^."%()*\[\\]?M/i header __TT_BROKEN_VIAGRA Subject =~ /V[:^."%()*\[\\]?I[:^."%()*\[\\]?A[:^."%()*\[\\]?G[:^."%()*\[\\]?R[:^."%()*\[\\]?A/i header __TT_OBSCURED_VALIUM Subject =~ /(v|V|\\\/)(a|A|\(a\)|4|@)(l|L|\|)(i|I|1|\xef|\|)(u|U|\(u\))(m|M)/ header __TT_OBSCURED_VIAGRA Subject =~ /(v|V|\\\/)(i|I|1|\xef|\|)(a|A|\(a\)|4|@)(g|G)(r|R)(a|A|\(a\)|4|@)/ header __TT_VALIUM Subject =~ /VALIUM/i header __TT_VIAGRA Subject =~ /VIAGRA/i ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __TVD_FW_GRAPHIC_ID1 Content-Id =~ /<[0-9a-f]{12}(?:\$[0-9a-f]{8}){2}\@/ endif header __TWO_IPS_RCVD Received =~ /[\[\(\s]((?!(?:10|127|169\.254|172\.(?:1[6-9]|2[0-9]|3[01])|192\.168)\.)(?:[12]?\d\d?\.){3}[12]?\d\d?)[\[\(\s][^\[\n;,]{0,99}\[(?!\1)\d/ header __UA_GNUS User-Agent =~ /^Gnus/ header __UA_KNODE User-Agent =~ /^KNode/ header __UA_MUTT User-Agent =~ /^Mutt/ header __UA_PAN User-Agent =~ /^Pan/ header __UA_XNEWS User-Agent =~ /^Xnews/ body __USCAVANITY /\bUS Commerce Association/ body __VA_WORD /\bV[A-Za-z]{2,4}RA\b/ body __VM_WORD /\bV[A-Za-z]{2,5}UM\b/ body __WHOSWHO /\bWho.s Who\b/ body __WORD_CUM /\bcum\b/i body __WORD_RAPED /\braped?\b/i body __WORD_SEX /\bsex(?:iest|y)?\b/i body __WORD_SLUTS /\bsluts?\b/i body __WORD_SPERM /\bsperm\b/i header __XM_GNUS X-Mailer =~ /^Gnus v/ header __XM_MOZ4 X-Mailer =~ /^Mozilla 4/ header __XM_MSOE5 X-Mailer =~ /^Microsoft Outlook Express 5/ header __XM_MSOE6 X-Mailer =~ /^Microsoft Outlook Express 6/ header __XM_MS_IN_GENERAL X-Mailer =~ /\bMSCRM\b|Microsoft (?:CDO|Outlook|Office Outlook)\b/ header __XM_OL_015D5 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/ header __XM_OL_07794 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/ header __XM_OL_09BB4 X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.72\.3155\.0/ header __XM_OL_10_0_4115 X-Mailer =~ /^Microsoft Outlook, Build 10.0.4115$/ header __XM_OL_1ECD5 X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1081/ header __XM_OL_20C99 X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.72\.3338\.1/ header __XM_OL_22B61 X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1158/ header __XM_OL_25340 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/ header __XM_OL_28001441 X-Mailer =~ /^Microsoft Outlook Express 6.00.2800.1441$/ header __XM_OL_28004682 X-Mailer =~ /^Microsoft Outlook Express 6.00.2800.4682$/ header __XM_OL_32D97 X-Mailer =~ /Microsoft\ Outlook\ IMO\,\ Build\ 9\.0\.2416\ \(9\.0\.2910\.0\)/ header __XM_OL_3857F X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/ header __XM_OL_3AC1D X-Mailer =~ /Microsoft\ Outlook\ Express\ 5\.00\.2919\.6700/ header __XM_OL_3D61D X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.71\.2244\.8/ header __XM_OL_465CD X-Mailer =~ /Microsoft\ Outlook\,\ Build\ 10\.0\.3416/ header __XM_OL_48072300 X-Mailer =~ /^Microsoft Outlook Express 5.50.4807.2300$/ header __XM_OL_4B815 X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.71\.2730\.2/ header __XM_OL_4BF4C X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/ header __XM_OL_4EEDB X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/ header __XM_OL_4F240 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/ header __XM_OL_4_72_2106_4 X-Mailer =~ /^Microsoft Outlook Express 4.72.2106.4$/ header __XM_OL_58CB5 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/ header __XM_OL_5B79A X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/ header __XM_OL_6554A X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/ header __XM_OL_72641 X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1441/ header __XM_OL_7533E X-Mailer =~ /Microsoft\ Outlook\ Express\ 5\.50\.4963\.1700/ header __XM_OL_812FF X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/ header __XM_OL_83BF7 X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.72\.3110\.3/ header __XM_OL_8627E X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1437/ header __XM_OL_8E893 X-Mailer =~ /Microsoft\ Outlook\,\ Build\ 10\.0\.2616/ header __XM_OL_91287 X-Mailer =~ /Microsoft\ Outlook\ Express\ 5\.50\.4807\.2300/ header __XM_OL_9B90B X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/ header __XM_OL_A50F8 X-Mailer =~ /Microsoft\ Outlook\ Express\ 5\.50\.4922\.1500/ header __XM_OL_A842E X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1158/ header __XM_OL_ADFF7 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/ header __XM_OL_B30D1 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/ header __XM_OL_B4B40 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/ header __XM_OL_B9B11 X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2462\.0000/ header __XM_OL_BC7E6 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/ header __XM_OL_C65FA X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/ header __XM_OL_CAC8F X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.71\.1712\.3/ header __XM_OL_CF0C0 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/ header __XM_OL_EF20B X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1478/ header __XM_OL_EF222 X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2900\.2873/ header __XM_OL_F3B05 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/ header __XM_OL_F475E X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/ header __XM_OL_F6D01 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/ header __XM_OL_FF5C8 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/ header __XM_OUTLOOK_EXPRESS X-Mailer =~ /^Microsoft Outlook Express \d/ header __XM_PHP X-Mailer =~ /^PHP\s?v?\/?\d\./ header __XM_SKYRI X-Mailer =~ /^SKYRiXgreen/ header __XM_WWWMAIL X-Mailer =~ /^WWW-Mail \d/ body __YOUR_ACCOUNT /your account/i body __YOUR_CREDITFVGT /your credit/i body __YOU_HAVE_WON /you(?: \w+)? won/i meta __YOU_WON_SOMTIN (__YOU_HAVE_WON || __FB_CONGRADS)