# SpamAssassin rules file
#
# Please don't modify this file as your changes will be overwritten with
# the next update. Use @@LOCAL_RULES_DIR@@/local.cf instead.
# See 'perldoc Mail::SpamAssassin::Conf' for details.
#
# <@LICENSE>
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to you under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at:
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# </@LICENSE>
#
###########################################################################
require_version @@VERSION@@
##{ APOSTROPHE_FROM
header APOSTROPHE_FROM From:addr =~ /'/
describe APOSTROPHE_FROM From address contains an apostrophe
##} APOSTROPHE_FROM
##{ AXB_HELO_HOME_UN
header AXB_HELO_HOME_UN X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\w+\.(lan|home) /i
describe AXB_HELO_HOME_UN HELO from home - untrusted
##} AXB_HELO_HOME_UN
##{ AXB_XMID_1212
header AXB_XMID_1212 Message-Id =~ /^<[0-9]{12}\.[0-9]{12}\@/
describe AXB_XMID_1212 Barbera Fingerprint
##} AXB_XMID_1212
##{ AXB_XMID_1510
header AXB_XMID_1510 Message-Id =~ /<[0-9A-F]{15}\.[0-9A-F]{10}\@/
describe AXB_XMID_1510 Brunello Fingerprint
##} AXB_XMID_1510
##{ AXB_XMID_OEGOESNULL
header AXB_XMID_OEGOESNULL Message-ID =~ /^<[0-9-a-f]{12}\$[0-9-a-f]{8}\$[0]{8}\@/
describe AXB_XMID_OEGOESNULL Amarone Fingerprint
##} AXB_XMID_OEGOESNULL
##{ AXB_XM_SENDMAIL_NOT
header AXB_XM_SENDMAIL_NOT Received =~ /\([123456790]{1,2}\.[0-9]{1,2}\.[0-9]{1}\/[0-9]{1,2}\.[0-9]{2}\.[0-9]{1}\)/
describe AXB_XM_SENDMAIL_NOT Nebbiolo fingerprint
##} AXB_XM_SENDMAIL_NOT
##{ AXB_XR_STULDAP
header AXB_XR_STULDAP Received =~ /\(8\.12\.3 da nor stuldap\/8\.12\.3\)/
##} AXB_XR_STULDAP
##{ BANKING_LAWS
body BANKING_LAWS /banking laws/i
describe BANKING_LAWS Talks about banking laws
##} BANKING_LAWS
##{ BASE64_LENGTH_78_79 ifplugin Mail::SpamAssassin::Plugin::MIMEEval
ifplugin Mail::SpamAssassin::Plugin::MIMEEval
body BASE64_LENGTH_78_79 eval:check_base64_length('78','79')
endif
##} BASE64_LENGTH_78_79 ifplugin Mail::SpamAssassin::Plugin::MIMEEval
##{ BASE64_LENGTH_79_INF ifplugin Mail::SpamAssassin::Plugin::MIMEEval
ifplugin Mail::SpamAssassin::Plugin::MIMEEval
body BASE64_LENGTH_79_INF eval:check_base64_length('79')
endif
##} BASE64_LENGTH_79_INF ifplugin Mail::SpamAssassin::Plugin::MIMEEval
##{ BUG6152_INVALID_DATE_TZ_ABSURD
header BUG6152_INVALID_DATE_TZ_ABSURD Date =~ /[-+](?!(?:0\d|1[0-4])(?:[03]0|[14]5))\d{4}/
##} BUG6152_INVALID_DATE_TZ_ABSURD
##{ CORRUPT_FROM_LINE_IN_HDRS
meta CORRUPT_FROM_LINE_IN_HDRS (MISSING_HEADERS && __BODY_STARTS_WITH_FROM_LINE && MISSING_DATE && NO_RELAYS)
describe CORRUPT_FROM_LINE_IN_HDRS Informational: message is corrupt, with a From line in its headers
tflags CORRUPT_FROM_LINE_IN_HDRS userconf publish
#score CORRUPT_FROM_LINE_IN_HDRS 0.001
##} CORRUPT_FROM_LINE_IN_HDRS
##{ CTYPE_001C_A
meta CTYPE_001C_A (0) # obsolete
##} CTYPE_001C_A
##{ CTYPE_001C_B
header CTYPE_001C_B Content-Type =~ /multipart.{0,200}boundary=\"----=_NextPart_000_0000_01C[0-9A-F]{5}\.[0-9A-F]{7}0\"/
##} CTYPE_001C_B
##{ CTYPE_8SPACE_GIF ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader CTYPE_8SPACE_GIF Content-Type:raw =~ /^image\/gif;\n {8}name=\".+?\"$/s
describe CTYPE_8SPACE_GIF Stock spam image part 'Content-Type' found (8 spc)
endif
##} CTYPE_8SPACE_GIF ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
##{ CURR_PRICE
body CURR_PRICE /\bCurrent Price:/
##} CURR_PRICE
##{ DATE_DOTS
header DATE_DOTS Date =~ /\d\d\.\d\d\.\d\d/
describe DATE_DOTS Periods in date header
##} DATE_DOTS
##{ DATE_IN_FUTURE_96_Q ifplugin Mail::SpamAssassin::Plugin::HeaderEval
ifplugin Mail::SpamAssassin::Plugin::HeaderEval
header DATE_IN_FUTURE_96_Q eval:check_for_shifted_date('96', '2920')
describe DATE_IN_FUTURE_96_Q Date: is 4 days to 4 months after Received: date
endif
##} DATE_IN_FUTURE_96_Q ifplugin Mail::SpamAssassin::Plugin::HeaderEval
##{ DATE_IN_FUTURE_Q_PLUS ifplugin Mail::SpamAssassin::Plugin::HeaderEval
ifplugin Mail::SpamAssassin::Plugin::HeaderEval
header DATE_IN_FUTURE_Q_PLUS eval:check_for_shifted_date('2920', 'undef')
describe DATE_IN_FUTURE_Q_PLUS Date: is over 4 months after Received: date
endif
##} DATE_IN_FUTURE_Q_PLUS ifplugin Mail::SpamAssassin::Plugin::HeaderEval
##{ DEAR_BENEFICIARY
body DEAR_BENEFICIARY /^\s?(?:Dear\s|At+(?:ention|n):?\s?)Beneficiary\b/i
describe DEAR_BENEFICIARY Dear Beneficiary:
#score DEAR_BENEFICIARY 2.0
##} DEAR_BENEFICIARY
##{ DEAR_EMAIL
body DEAR_EMAIL /^\s*Dear\b.{0,70}\w\@\w/i
describe DEAR_EMAIL Message contains Dear email address
##} DEAR_EMAIL
##{ DEAR_WINNER
body DEAR_WINNER /\bdear.{1,20}winner/i
##} DEAR_WINNER
##{ DOS_ANAL_SPAM_MAILER
header DOS_ANAL_SPAM_MAILER X-mailer =~ /^[A-Z][a-z]{6}e \d\.\d{2}$/
describe DOS_ANAL_SPAM_MAILER X-mailer pattern common to anal porn site spam
tflags DOS_ANAL_SPAM_MAILER publish
##} DOS_ANAL_SPAM_MAILER
##{ DOS_FIX_MY_URI
meta DOS_FIX_MY_URI __MIMEOLE_1106 && __DOS_HAS_ANY_URI && __DOS_SINGLE_EXT_RELAY && __DOS_HI && __DOS_LINK
describe DOS_FIX_MY_URI Looks like a "fix my obfu'd URI please" spam
##} DOS_FIX_MY_URI
##{ DOS_HIGHBIT_HDRS_BODY
meta DOS_HIGHBIT_HDRS_BODY __FROM_NEEDS_MIME && __SUBJECT_ENCODED_B64 && __FROM_ENCODED_B64 && __SUBJECT_NEEDS_MIME && __HIGHBITS
describe DOS_HIGHBIT_HDRS_BODY Headers need encoding and body is highbit
##} DOS_HIGHBIT_HDRS_BODY
##{ DOS_HIGH_BAT_TO_MX
meta DOS_HIGH_BAT_TO_MX __DOS_DIRECT_TO_MX && __HIGHBITS && __LAST_UNTRUSTED_RELAY_NO_AUTH && __THEBAT_MUA
describe DOS_HIGH_BAT_TO_MX The Bat! Direct to MX with High Bits
##} DOS_HIGH_BAT_TO_MX
##{ DOS_LET_GO_JOB
meta DOS_LET_GO_JOB __DOS_LET_GO_JOB && __DOS_MY_OLD_JOB && __DOS_I_DRIVE_A && __DOS_TAKING_HOME
describe DOS_LET_GO_JOB Let go from their job and now makes lots of dough!
##} DOS_LET_GO_JOB
##{ DOS_OE_TO_MX
meta DOS_OE_TO_MX __OE_MUA && __DOS_DIRECT_TO_MX && !DOS_OE_TO_MX_IMAGE
describe DOS_OE_TO_MX Delivered direct to MX with OE headers
##} DOS_OE_TO_MX
##{ DOS_OE_TO_MX_IMAGE
meta DOS_OE_TO_MX_IMAGE __OE_MUA && __DOS_DIRECT_TO_MX && __ANY_IMAGE_ATTACH
describe DOS_OE_TO_MX_IMAGE Direct to MX with OE headers and an image
##} DOS_OE_TO_MX_IMAGE
##{ DOS_OUTLOOK_TO_MX
meta DOS_OUTLOOK_TO_MX __ANY_OUTLOOK_MUA && !__OE_MUA && __DOS_DIRECT_TO_MX && !T_DOS_OUTLOOK_TO_MX_IMAGE
describe DOS_OUTLOOK_TO_MX Delivered direct to MX with Outlook headers
##} DOS_OUTLOOK_TO_MX
##{ DOS_RCVD_IP_TWICE_C
header DOS_RCVD_IP_TWICE_C X-Spam-Relays-External =~ /^\s*\[ ip=(?!127)([\d.]+) [^\[]*\bhelo=(?:![\d.]{7,15}!)? [^\[]*\[ ip=\1 [^\]]*\]\s*$/
describe DOS_RCVD_IP_TWICE_C Received from the same IP twice in a row (only one external relay; empty or IP helo)
##} DOS_RCVD_IP_TWICE_C
##{ DOS_STOCK_BAT
meta DOS_STOCK_BAT __THEBAT_MUA && (__DOS_BODY_STOCK || __DOS_BODY_TICKER) && (__DOS_REF_TODAY || __DOS_REF_NEXT_WK_DAY || __DOS_REF_2_WK_DAYS)
describe DOS_STOCK_BAT Probable pump and dump stock spam
##} DOS_STOCK_BAT
##{ DOS_STOCK_BAT2
meta DOS_STOCK_BAT2 DOS_STOCK_BAT && (__DOS_FIN_ADVANTAGE + __DOS_STRONG_CF + __DOS_STEADY_COURSE > 2)
##} DOS_STOCK_BAT2
##{ DOS_URI_ASTERISK
uri DOS_URI_ASTERISK m{^[Hh][Tt]{2}[Pp][Ss]?://[^/:]+(?:\*[A-Za-z0-9-]*\.|\*)[A-Za-z]{2,3}(?:\.[A-Za-z]{2})?(?:$|:|/)}
describe DOS_URI_ASTERISK Found an asterisk in a URI
##} DOS_URI_ASTERISK
##{ DOS_YOUR_PLACE
meta DOS_YOUR_PLACE (__DOS_COMING_TO_YOUR_PLACE && __DOS_MEET_EACH_OTHER && (__DOS_DROP_ME_A_LINE || __DOS_CORRESPOND_EMAIL || __DOS_EMAIL_DIRECTLY || __DOS_I_AM_25 || __DOS_WRITE_ME_AT || __DOS_PERSONAL_EMAIL))
describe DOS_YOUR_PLACE Russian dating spam
##} DOS_YOUR_PLACE
##{ DRUGS_HDIA
header DRUGS_HDIA Subject =~ /\bhoodia\b/i
##} DRUGS_HDIA
##{ DRUGS_STOCK_MIMEOLE
meta DRUGS_STOCK_MIMEOLE (__MIMEOLE_1106 && __MAILER_OL_5510)
describe DRUGS_STOCK_MIMEOLE Stock-spam forged headers found (5510)
##} DRUGS_STOCK_MIMEOLE
##{ DYN_RDNS_AND_INLINE_IMAGE
meta DYN_RDNS_AND_INLINE_IMAGE (RDNS_DYNAMIC && __ANY_IMAGE_ATTACH)
describe DYN_RDNS_AND_INLINE_IMAGE Contains image, and was sent by dynamic rDNS
##} DYN_RDNS_AND_INLINE_IMAGE
##{ DYN_RDNS_SHORT_HELO_HTML
meta DYN_RDNS_SHORT_HELO_HTML (__HELO_NO_DOMAIN && RDNS_DYNAMIC && HTML_MESSAGE)
describe DYN_RDNS_SHORT_HELO_HTML Sent by dynamic rDNS, short HELO, and HTML
##} DYN_RDNS_SHORT_HELO_HTML
##{ DYN_RDNS_SHORT_HELO_IMAGE
meta DYN_RDNS_SHORT_HELO_IMAGE (__HELO_NO_DOMAIN && RDNS_DYNAMIC && __ANY_IMAGE_ATTACH)
describe DYN_RDNS_SHORT_HELO_IMAGE Short HELO string, dynamic rDNS, inline image
##} DYN_RDNS_SHORT_HELO_IMAGE
##{ FAKE_REPLY_C
meta FAKE_REPLY_C (__SUBJ_RE && __MISSING_REF && __NO_INR_YES_REF)
##} FAKE_REPLY_C
##{ FB_ADD_INCHES
body FB_ADD_INCHES /(?:add|gain) inches/i
describe FB_ADD_INCHES Add / Gain inches
##} FB_ADD_INCHES
##{ FB_ALMOST_SEX
body FB_ALMOST_SEX /\b[b-z]sex+\b/i
describe FB_ALMOST_SEX It's almost sex, but not!
##} FB_ALMOST_SEX
##{ FB_ANA_TRIM
body FB_ANA_TRIM /Ana[^a-z]trim/i
describe FB_ANA_TRIM Broken AnaTrim phrase.
##} FB_ANA_TRIM
##{ FB_ANUI
body FB_ANUI /A[-_\.]U[-_\.]N[-_\.]I/i
describe FB_ANUI Phrase: A_U_N_I
##} FB_ANUI
##{ FB_BILLI0N
body FB_BILLI0N /[BM][I1]LL[I1]0N/i
describe FB_BILLI0N Phrase: [BM]Illi0n
##} FB_BILLI0N
##{ FB_C0MPANY
body FB_C0MPANY /c0mpany/i
describe FB_C0MPANY Phrase: C0mpany
##} FB_C0MPANY
##{ FB_CAN_LONGER
body FB_CAN_LONGER /can last longer/i
describe FB_CAN_LONGER Phrase: can last longer
##} FB_CAN_LONGER
##{ FB_CIALIS_LEO3
body FB_CIALIS_LEO3 /(?!CIALIS)\bC\s?[a-z]?\s?[Iitl1\\\/]\s?[a-z]?\s?[Aa]\s?[a-z]?\s?[LIl1\\\/]\s?[a-z]?\s?[ilIt1\\\/]\s?[a-z]?\s?[Ss]\b/
describe FB_CIALIS_LEO3 Uses a mis-spelled version of cialis.
##} FB_CIALIS_LEO3
##{ FB_DOUBLE_0WORDS
body FB_DOUBLE_0WORDS /\b[a-z]{1,5}0[a-z]{3,9}\s[a-z]{1,5}0[a-z]{3,9}\b/i
describe FB_DOUBLE_0WORDS Looks like double 0 words
##} FB_DOUBLE_0WORDS
##{ FB_EMAIL_HIER
body FB_EMAIL_HIER /email hier/i
describe FB_EMAIL_HIER Phrase: email hier
##} FB_EMAIL_HIER
##{ FB_EXTRA_INCHES
body FB_EXTRA_INCHES /extra inches/
describe FB_EXTRA_INCHES Phrase: extra inches
##} FB_EXTRA_INCHES
##{ FB_FAKE_NUMBERS
body FB_FAKE_NUMBERS /\$\d\d?O\s*[MBT]/i
describe FB_FAKE_NUMBERS Looks like numbers with O's insted of 0's
##} FB_FAKE_NUMBERS
##{ FB_FAKE_NUMS4
body FB_FAKE_NUMS4 /(?:\b|\b\d)\d,?\d,?OO(?:\b|\d\b)/
describe FB_FAKE_NUMS4 Looks like fake numbers (4)
##} FB_FAKE_NUMS4
##{ FB_FHARMACY
body FB_FHARMACY /Fharmacy/i
describe FB_FHARMACY Phrase: Farmacy
##} FB_FHARMACY
##{ FB_FORWARD_LOOK
body FB_FORWARD_LOOK /(?!forward look)f[o0]rward l[0o][0o]k/i
describe FB_FORWARD_LOOK Phrase: forward look with 0's
##} FB_FORWARD_LOOK
##{ FB_GAPPY_ADDRESS
body FB_GAPPY_ADDRESS /(?:[a-z] ){8}, (?:[a-z0-9] ){4}/i
describe FB_GAPPY_ADDRESS Too much spacing in Address
##} FB_GAPPY_ADDRESS
##{ FB_GET_MEDS
body FB_GET_MEDS /(?:place f[o0]r|[0o]rder|get\s?(?:y[o0]ur)?|online|quality).{1,7}med[isz][^a]/i
describe FB_GET_MEDS Looks like trying to sell meds
##} FB_GET_MEDS
##{ FB_GVR
body FB_GVR /(?:pef-rx|vigrex-ds|gsc-100|vp-rx|gv-promax|phentermine|adipex|xenical)/i
describe FB_GVR Looks like generic viagra
##} FB_GVR
##{ FB_HEY_BRO_COMMA
body FB_HEY_BRO_COMMA /Hey bro, /
describe FB_HEY_BRO_COMMA Phrase hey bro,
##} FB_HEY_BRO_COMMA
##{ FB_HG_H_CAP
body FB_HG_H_CAP /\bHGH\b/
describe FB_HG_H_CAP Phrase: HGH
##} FB_HG_H_CAP
##{ FB_HOMELOAN
body FB_HOMELOAN /\$\d{3},\d{3} home loan/i
describe FB_HOMELOAN Phrase $x home loan
##} FB_HOMELOAN
##{ FB_IMPRESS_GIRL
body FB_IMPRESS_GIRL /\bimpress .{0,5}girl\b/
describe FB_IMPRESS_GIRL Phrase: impress ... girl
##} FB_IMPRESS_GIRL
##{ FB_INCREASE_YOUR
body FB_INCREASE_YOUR /Increase your energy/i
describe FB_INCREASE_YOUR Phrase: Increase your energy
##} FB_INCREASE_YOUR
##{ FB_INDEPEND_RWD
body FB_INDEPEND_RWD /independent reward/i
describe FB_INDEPEND_RWD Phrase: independent reward
##} FB_INDEPEND_RWD
##{ FB_L0AN
body FB_L0AN /\bl0ans?\b/i
describe FB_L0AN Phrase: L0an
##} FB_L0AN
##{ FB_LETTERS_21B
body FB_LETTERS_21B /-- [a-z]{21}/
describe FB_LETTERS_21B Special people leave special signs!
##} FB_LETTERS_21B
##{ FB_LOSE_WEIGHT_CAP
body FB_LOSE_WEIGHT_CAP /LOSE WEIGHT/
describe FB_LOSE_WEIGHT_CAP Phrase: LOSE WEIGHT
##} FB_LOSE_WEIGHT_CAP
##{ FB_LOWER_PAYM
body FB_LOWER_PAYM /lower your monthly payments/i
describe FB_LOWER_PAYM Phrase: lower your monthly payments
##} FB_LOWER_PAYM
##{ FB_MORE_SIZE
body FB_MORE_SIZE /\bmore size\b/
describe FB_MORE_SIZE Phrase: more size
##} FB_MORE_SIZE
##{ FB_NOT_PHONE_NUM1
body FB_NOT_PHONE_NUM1 /(?!\d{3})8(?:66|77|88|[0o][0o])[-\.\s\)]{1,3}[OIL0-9]{3}[-\.\s]/i
describe FB_NOT_PHONE_NUM1 Looks like a fake phone number (1)
##} FB_NOT_PHONE_NUM1
##{ FB_NOT_PHONE_NUM3
body FB_NOT_PHONE_NUM3 /8(?:66|77|88|[0o][0o])[-\.\s\)]{1,3}[OIL0-9]{3}[-\.\s]{1,3}(?!\d{4})[OIL0-9]{4}/i
describe FB_NOT_PHONE_NUM3 Looks like a fake phone number (3)
##} FB_NOT_PHONE_NUM3
##{ FB_NOT_SCHOOL
body FB_NOT_SCHOOL /(?!school)[\$s5]ch[o0][o0][il1\|]/i
describe FB_NOT_SCHOOL Looks like school but it's not!
##} FB_NOT_SCHOOL
##{ FB_NO_SCRIP_NEEDED
body FB_NO_SCRIP_NEEDED /No.{1,10}P(?:er|re)scr[i1]pt[i1][o0]n (?:needed|requ[1i]re)/i
describe FB_NO_SCRIP_NEEDED Phrase: no prescription needed.
##} FB_NO_SCRIP_NEEDED
##{ FB_NUMYO
body FB_NUMYO /1[0-9][\s\.]?y[\s\.]?o[\s\.]?\b/i
describe FB_NUMYO Speaks of teenager.
##} FB_NUMYO
##{ FB_NUMYO2
body FB_NUMYO2 /2[0-9][\s\.]?y[\s\.]?o[\s\.]?\b/i
describe FB_NUMYO2 Speaks of 20+ year old.
##} FB_NUMYO2
##{ FB_ODD_SPACED_MONEY
body FB_ODD_SPACED_MONEY /\$\d\s,\s\d\d/
describe FB_ODD_SPACED_MONEY Looks like money but has odd spacing.
##} FB_ODD_SPACED_MONEY
##{ FB_ONIINE
body FB_ONIINE /oniine/i
describe FB_ONIINE Mis-spelled online
##} FB_ONIINE
##{ FB_P1LL
body FB_P1LL /\bp1ll/i
describe FB_P1LL Phrase: p1ll
##} FB_P1LL
##{ FB_PENIS_GROWTH
body FB_PENIS_GROWTH /pen[i1]s grow(?:th)?/i
describe FB_PENIS_GROWTH Phrase: penis growth
##} FB_PENIS_GROWTH
##{ FB_PIPEDOLLAR
body FB_PIPEDOLLAR /(?!dollar)d[o0][1|li][1|li]ar/i
describe FB_PIPEDOLLAR Phrase: Dollar, with pipes or 0's.
##} FB_PIPEDOLLAR
##{ FB_PIPE_ILLION
body FB_PIPE_ILLION /(?!illion)i[l|][l|][i|][o0]n/i
describe FB_PIPE_ILLION Looks like illion, but it's not
##} FB_PIPE_ILLION
##{ FB_PROLONGED_HARD
body FB_PROLONGED_HARD /(?:prolonged|increased) hardness/i
describe FB_PROLONGED_HARD Talks about prolonged hardness
##} FB_PROLONGED_HARD
##{ FB_QUALITY_REPLICA
body FB_QUALITY_REPLICA /quality replica/i
describe FB_QUALITY_REPLICA Phrase: quality replica
##} FB_QUALITY_REPLICA
##{ FB_REF_CODE_SPACE
body FB_REF_CODE_SPACE /r e f c o d e/i
describe FB_REF_CODE_SPACE Refcode with spacing
##} FB_REF_CODE_SPACE
##{ FB_REPLICA_ROLEX
body FB_REPLICA_ROLEX /replica rolex/i
describe FB_REPLICA_ROLEX Phrase: Replica Rolex
##} FB_REPLICA_ROLEX
##{ FB_REPLIC_CAP
body FB_REPLIC_CAP /REPLICAS?\b/
describe FB_REPLIC_CAP Phrase: REPLICA
##} FB_REPLIC_CAP
##{ FB_RE_FI
body FB_RE_FI /\bre[^a-z]fi\b/
describe FB_RE_FI Looks like refi.
##} FB_RE_FI
##{ FB_ROLLER_IS_T
body FB_ROLLER_IS_T /Roller is th/i
describe FB_ROLLER_IS_T Phrase: Roller is th
##} FB_ROLLER_IS_T
##{ FB_ROLX
body FB_ROLX /\brolx\b/i
describe FB_ROLX Phrase: rolx
##} FB_ROLX
##{ FB_SAVE_PERSC
body FB_SAVE_PERSC /sav(?:e|ing).{1,45}p[re][re]scr[i1]pt[i1][o0]n/i
describe FB_SAVE_PERSC Phrase: save ... prescription.
##} FB_SAVE_PERSC
##{ FB_SOFTTABS
body FB_SOFTTABS /\bsoft\s?t?abs\b/i
describe FB_SOFTTABS Phrase: Softabs
##} FB_SOFTTABS
##{ FB_SPACED_FREE
body FB_SPACED_FREE /F R E E/i
describe FB_SPACED_FREE Phrase: F R E E
##} FB_SPACED_FREE
##{ FB_SPACED_PHN_3B
body FB_SPACED_PHN_3B /\d\d\d--\d\d\d--?\d\d\d\d/
describe FB_SPACED_PHN_3B Phone number with -- spacing. (B)
##} FB_SPACED_PHN_3B
##{ FB_SPACEY_ZIP
body FB_SPACEY_ZIP /\s\d\s\d\s\d\s\d\s\d\s-\s\d\s\d\s\d\s\d/
describe FB_SPACEY_ZIP Looks like a s p a c e d zipcode.
##} FB_SPACEY_ZIP
##{ FB_SPUR_M
body FB_SPUR_M /\bSPUR-M\b/i
describe FB_SPUR_M Phrase: SPUR-M
##} FB_SPUR_M
##{ FB_SSEX
body FB_SSEX /\bssex\b/
describe FB_SSEX Phrase: ssex
##} FB_SSEX
##{ FB_STOCK_EXPLODE
body FB_STOCK_EXPLODE /st[0o]ck\b.{4,10}expl[o0]de/i
describe FB_STOCK_EXPLODE Looks like stocks exploding.
##} FB_STOCK_EXPLODE
##{ FB_SYMBLO
body FB_SYMBLO /\bSymblo\b/i
describe FB_SYMBLO Mis-spelled symbol.
##} FB_SYMBLO
##{ FB_THIS_ADVERT
body FB_THIS_ADVERT /this advertiser/i
describe FB_THIS_ADVERT Phrase: this advertiser
##} FB_THIS_ADVERT
##{ FB_THOUS_PERSONAL
body FB_THOUS_PERSONAL /thousand personal/i
describe FB_THOUS_PERSONAL Phrase: thousand personal
##} FB_THOUS_PERSONAL
##{ FB_TO_STOP_DISTRO
body FB_TO_STOP_DISTRO /To (?:(?:stop further|longer get) distribution|stop (?:receiving )?announcements)/i
describe FB_TO_STOP_DISTRO Phrase: to stop further distribution
##} FB_TO_STOP_DISTRO
##{ FB_ULTRA_ALLURE
body FB_ULTRA_ALLURE /Ultra Allure/i
describe FB_ULTRA_ALLURE Phrase: Ultra Allure
##} FB_ULTRA_ALLURE
##{ FB_UNLOCK_YOUR_G
body FB_UNLOCK_YOUR_G /lock ?(?:to ?)? your girlfriend/i
describe FB_UNLOCK_YOUR_G Phrase: lock to your girlfriend
##} FB_UNLOCK_YOUR_G
##{ FB_UNRESOLV_PROV
body FB_UNRESOLV_PROV /\{PROV_\d_\d\}/
describe FB_UNRESOLV_PROV Pattern Replacement PROV_D
##} FB_UNRESOLV_PROV
##{ FB_YOURSELF_MASTER
body FB_YOURSELF_MASTER /yourself master/i
describe FB_YOURSELF_MASTER Phrase: yourself master
##} FB_YOURSELF_MASTER
##{ FB_YOUR_REFI
body FB_YOUR_REFI /Your refi/i
describe FB_YOUR_REFI Phrase: Your refi
##} FB_YOUR_REFI
##{ FH_BAD_OEV1441
header FH_BAD_OEV1441 X-Mailer =~ /^Microsoft Outlook Express 6\.00\.2800\.1441$/
describe FH_BAD_OEV1441 Bad X-Mailer version
##} FH_BAD_OEV1441
##{ FH_DATE_IS_19XX
header FH_DATE_IS_19XX Date =~ /19[789][0-9]/ [if-unset: 2006]
describe FH_DATE_IS_19XX The date is not 19xx.
##} FH_DATE_IS_19XX
##{ FH_FAKE_RCVD_LINE
header FH_FAKE_RCVD_LINE Received =~ /from\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s*by\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3};\s*[SMTWF].{2},\s*\d{1,2}\s*[JFMASOND].{2,5}\s*\d{4}\s*\d{2}:\d{2}:\d{2}\s*[-+]\d{4}/
describe FH_FAKE_RCVD_LINE RCVD line looks faked (A)
##} FH_FAKE_RCVD_LINE
##{ FH_FAKE_RCVD_LINE_B
header FH_FAKE_RCVD_LINE_B Received =~ /from\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s*by\s*[a-z0-9.]{4,24}\.[a-z0-9.]{4,36}\.(?:com|net|org|biz);\s*[SMTWF].{2},\s*\d{1,2}\s*[JFMASOND].{2,5}\s*\d{4}\s*\d{2}:\d{2}:\d{2}\s*[-+]\d{4}/i
describe FH_FAKE_RCVD_LINE_B RCVD line looks faked (B)
##} FH_FAKE_RCVD_LINE_B
##{ FH_FROMEML_NOTLD
header FH_FROMEML_NOTLD From:addr !~ /\./ [if-unset: foo@bar.com]
describe FH_FROMEML_NOTLD E-mail address doesn't have TLD (.com, etc.)
##} FH_FROMEML_NOTLD
##{ FH_FROM_CASH
header FH_FROM_CASH From:name =~ /\bcash\b/i
describe FH_FROM_CASH From name has "cash"
##} FH_FROM_CASH
##{ FH_FROM_GET_NAME
header FH_FROM_GET_NAME From:name =~ /\bGet\b/i
describe FH_FROM_GET_NAME From name says Get
##} FH_FROM_GET_NAME
##{ FH_FROM_GIVEAWAY
header FH_FROM_GIVEAWAY From =~ /Giveaway/i
describe FH_FROM_GIVEAWAY From name is giveaway.
##} FH_FROM_GIVEAWAY
##{ FH_FROM_HOODIA
header FH_FROM_HOODIA From =~ /Hoodia/i
describe FH_FROM_HOODIA From has Hoodia!!?
##} FH_FROM_HOODIA
##{ FH_HAS_XAIMC
header FH_HAS_XAIMC exists:X-AIMC-AUTH
describe FH_HAS_XAIMC Has X-AIMC-AUTH header
##} FH_HAS_XAIMC
##{ FH_HAS_XID
header FH_HAS_XID exists:X-ID
describe FH_HAS_XID Has X-ID
##} FH_HAS_XID
##{ FH_HELO_ALMOST_IP
header FH_HELO_ALMOST_IP X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+[a-z][-.]\d{1,3}[-.]\d{1,3}[-.]\d{1,3}[-.][a-z][^ ]+ /i
describe FH_HELO_ALMOST_IP Helo is almost an IP addr.
##} FH_HELO_ALMOST_IP
##{ FH_HELO_ENDS_DOT
header FH_HELO_ENDS_DOT X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+\. by=/
describe FH_HELO_ENDS_DOT Helo ends with a dot.
##} FH_HELO_ENDS_DOT
##{ FH_HELO_EQ_610HEX
header FH_HELO_EQ_610HEX X-Spam-Relays-External =~ /^[^\]]+ helo=-?[A-F0-9]{6,10} /
describe FH_HELO_EQ_610HEX Helo is 6-10 hex chr's.
##} FH_HELO_EQ_610HEX
##{ FH_HELO_EQ_CHARTER
header FH_HELO_EQ_CHARTER X-Spam-Relays-External =~ /^[^\]]+ helo=\d{2,3}-\d{1,3}-\d{1,3}-\d{1,3}.{5,20}\.charter\.com /i
describe FH_HELO_EQ_CHARTER Helo is d-d-d-d charter.com
##} FH_HELO_EQ_CHARTER
##{ FH_HELO_EQ_D_D_D_D
header FH_HELO_EQ_D_D_D_D X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]{0,15}\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3}/
describe FH_HELO_EQ_D_D_D_D Helo is d-d-d-d
##} FH_HELO_EQ_D_D_D_D
##{ FH_HELO_GMAILSMTP
header FH_HELO_GMAILSMTP Received =~ /HELO gmail-smtp-in/
describe FH_HELO_GMAILSMTP Faked helo of gmail-smtp-in
##} FH_HELO_GMAILSMTP
##{ FH_HOST_EQ_DYNAMICIP
header FH_HOST_EQ_DYNAMICIP X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]{0,25}[dD][yY][nN][aA][mM][iI][cC][iI][pP][^ ]{5,25} helo=/
describe FH_HOST_EQ_DYNAMICIP Host is dynamicip
##} FH_HOST_EQ_DYNAMICIP
##{ FH_HOST_EQ_PACBELL_D
header FH_HOST_EQ_PACBELL_D X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.dsl\.\w{2,10}\.pacbell\.net /
describe FH_HOST_EQ_PACBELL_D Host is pacbell.net dsl
##} FH_HOST_EQ_PACBELL_D
##{ FH_HOST_EQ_VERIZON_P
header FH_HOST_EQ_VERIZON_P X-Spam-Relays-External =~ /^[^\]]+ rdns=pool-\d.{5,30}\.verizon\.net/
describe FH_HOST_EQ_VERIZON_P Host is pool-.+verizon.net
##} FH_HOST_EQ_VERIZON_P
##{ FH_HOST_IN_ADDRARPA
header FH_HOST_IN_ADDRARPA X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]{0,25}\.in-addr\.arpa /
describe FH_HOST_IN_ADDRARPA HOST dns says "in-addr.arpa"
##} FH_HOST_IN_ADDRARPA
##{ FH_MSGID_000000
header FH_MSGID_000000 MESSAGEID =~ /\$00000000\@/
describe FH_MSGID_000000 Special MSGID
##} FH_MSGID_000000
##{ FH_MSGID_01C67
header FH_MSGID_01C67 Message-ID =~ /^<000001c[67]/
describe FH_MSGID_01C67 Special MSGID
##} FH_MSGID_01C67
##{ FH_MSGID_01C70XXX
header FH_MSGID_01C70XXX MESSAGEID =~ /^<01c70[a-f][a-f0-9]{2}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[a-zA-Z0-9-]+>$/
describe FH_MSGID_01C70XXX MESSAGE ID seen often!!!
##} FH_MSGID_01C70XXX
##{ FH_MSGID_REPLACE
header FH_MSGID_REPLACE MESSAGEID =~ /^<%MSGID/
describe FH_MSGID_REPLACE Broken Replace Template
##} FH_MSGID_REPLACE
##{ FH_MSGID_XXBLAH
header FH_MSGID_XXBLAH MESSAGEID =~ /6c822ecf/
describe FH_MSGID_XXBLAH Common sign in msg-id's 12/21/2006
##} FH_MSGID_XXBLAH
##{ FH_MSGID_XXX
header FH_MSGID_XXX MESSAGEID =~ /\@xxx/i
describe FH_MSGID_XXX Message-Id = @xxx
##} FH_MSGID_XXX
##{ FH_RE_NEW_DDD
header FH_RE_NEW_DDD Subject =~ /^Re: new\s?\d{0,3}$/i
describe FH_RE_NEW_DDD Subject is Re: new \d\d\d
##} FH_RE_NEW_DDD
##{ FH_XMAIL_REPLACE
header FH_XMAIL_REPLACE X-Mailer =~ /%XMAILER/
describe FH_XMAIL_REPLACE Broken Replace Template
##} FH_XMAIL_REPLACE
##{ FILL_THIS_FORM_FRAUD_PHISH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
describe FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
meta FILL_THIS_FORM_FRAUD_PHISH (T_FILL_THIS_FORM || T_FILL_THIS_FORM_SHORT) && __FILL_THIS_FORM_FRAUD_PHISH
# score FILL_THIS_FORM_FRAUD_PHISH 1.50
endif
##} FILL_THIS_FORM_FRAUD_PHISH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FILL_THIS_FORM_LOAN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
describe FILL_THIS_FORM_LOAN Answer loan question(s)
meta FILL_THIS_FORM_LOAN T_FILL_THIS_FORM && __FILL_THIS_FORM_LOAN
# score FILL_THIS_FORM_LOAN 0.50
endif
##} FILL_THIS_FORM_LOAN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FILL_THIS_FORM_LONG ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FILL_THIS_FORM_LONG /(?:<FF_LNNO>?<FF_YOUR><FF_ALL><FF_SUFFIX>(?:<FF_BLANK2>|<ANDOR>)){5,}/i
describe FILL_THIS_FORM_LONG Fill in a form with personal information
# score FILL_THIS_FORM_LONG 1.00
endif
##} FILL_THIS_FORM_LONG ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FM_DOESNT_SAY_STOCK
meta FM_DOESNT_SAY_STOCK (__FB_S_SYMBOL && __FM_MY_PRICE && !__FB_S_STOCK && !__FS_S_TRADE)
describe FM_DOESNT_SAY_STOCK It's a stock spam but doesn't say stock
##} FM_DOESNT_SAY_STOCK
##{ FM_FAKE_53COM_SPOOF
meta FM_FAKE_53COM_SPOOF (__FH_FRM_53 && !__FH_MSG_53 && !__FH_RCV_53)
describe FM_FAKE_53COM_SPOOF Spoof mail from 53.com?
##} FM_FAKE_53COM_SPOOF
##{ FM_FAKE_HELO_HOTMAIL
meta FM_FAKE_HELO_HOTMAIL (__HOTMAILCOM && !__HOST_HOTMAIL)
describe FM_FAKE_HELO_HOTMAIL Looks like a fake hotmail.com helo.
##} FM_FAKE_HELO_HOTMAIL
##{ FM_FAKE_HELO_VERIZON
meta FM_FAKE_HELO_VERIZON (__FHELO_VERIZON && !__FHOST_VERIZON)
describe FM_FAKE_HELO_VERIZON Looks like a fake verizon.net helo.
##} FM_FAKE_HELO_VERIZON
##{ FM_FRM_RN_L_BRACK
meta FM_FRM_RN_L_BRACK (__FROM_RIGH_BRACK && !__FROM_LEFT_BRACK && !__FROM_ISO_2022_JP)
describe FM_FRM_RN_L_BRACK From name has > but not <
##} FM_FRM_RN_L_BRACK
##{ FM_IS_IT_OUR_ACCOUNT
meta FM_IS_IT_OUR_ACCOUNT (__YOUR_ACCOUNT && __MANY_RECIPS)
describe FM_IS_IT_OUR_ACCOUNT Is it our account?
##} FM_IS_IT_OUR_ACCOUNT
##{ FM_LIKE_STOCKS
meta FM_LIKE_STOCKS (__FM_STOCK_WORDS && !__FB_S_STOCK && __FB_S_SYMBOL)
describe FM_LIKE_STOCKS It looks like a duck, it's a duck!
##} FM_LIKE_STOCKS
##{ FM_LOTTO_YOU_WON
meta FM_LOTTO_YOU_WON (__FM_LARGE_MONEY && __FM_NAT_LOTTERY && __YOU_WON_SOMTIN)
describe FM_LOTTO_YOU_WON Talks about lotto and you won!
##} FM_LOTTO_YOU_WON
##{ FM_LUX_GIFTS_REDUCED
meta FM_LUX_GIFTS_REDUCED (__FB_LUX_GIFTS && __FB_NUM_PERCNT)
describe FM_LUX_GIFTS_REDUCED Luxury Gifts with dd%
##} FM_LUX_GIFTS_REDUCED
##{ FM_MANY_DRUG_WORDS
meta FM_MANY_DRUG_WORDS (__VA_WORD && __CS_WORD && __VM_WORD)
describe FM_MANY_DRUG_WORDS Lot's of almost drug words
##} FM_MANY_DRUG_WORDS
##{ FM_MORTGAGE5PLUS
meta FM_MORTGAGE5PLUS (__FM_MORTGAGE5PLUS && !__FM_MORTGAGE6PLUS)
describe FM_MORTGAGE5PLUS Looks like a mortgage spam (5+)
##} FM_MORTGAGE5PLUS
##{ FM_MORTGAGE6PLUS
meta FM_MORTGAGE6PLUS (__FM_MORTGAGE6PLUS)
describe FM_MORTGAGE6PLUS Looks like a mortgage spam (6+)
##} FM_MORTGAGE6PLUS
##{ FM_MULTI_LUX_GIFTS
meta FM_MULTI_LUX_GIFTS ((__FB_BRAND_NAME + __FB_TIMEPIECE + __FB_WALLETS + __FB_HANDBAGS + __FB_DESIGNER + __FB_LUX_GIFTS + __FB_NUM_PERCNT + __FB_INK_PEN) > 3)
describe FM_MULTI_LUX_GIFTS Talks about variety of luxury gifts
##} FM_MULTI_LUX_GIFTS
##{ FM_PHN_NODNS
meta FM_PHN_NODNS (FB_SPACED_PHN_3B && RDNS_NONE)
describe FM_PHN_NODNS Phone spacing + no dns
##} FM_PHN_NODNS
##{ FM_RATSIGN_1106
meta FM_RATSIGN_1106 (__MSGID_VGA && __DATE_700)
describe FM_RATSIGN_1106 Fingerprint seen in lots of spam. 11/2006
##} FM_RATSIGN_1106
##{ FM_RE_HELLO_SPAM
meta FM_RE_HELLO_SPAM (__FH_MSGID_01C7 && __FH_HAS_XMSMAIL && __FH_HAS_XPRIORITY && __FS_SUBJ_RE)
describe FM_RE_HELLO_SPAM Re: Hello / hi
##} FM_RE_HELLO_SPAM
##{ FM_ROLEX_ADS
meta FM_ROLEX_ADS (__FB_ROLEX_MEN && __FB_ROLEX_WMEN && __FB_OMEGA && __FB_GLASHUTE)
describe FM_ROLEX_ADS Looks like Rolex spams.
##} FM_ROLEX_ADS
##{ FM_SCHOOLING
meta FM_SCHOOLING ((__BACHELORS + __MASTERS + __MBA + __PHD) > 2)
describe FM_SCHOOLING Meta Combo Phrase for Schooling (2)
##} FM_SCHOOLING
##{ FM_SCHOOL_DIPLOMA
meta FM_SCHOOL_DIPLOMA (FM_SCHOOLING && __DIPLOMA)
describe FM_SCHOOL_DIPLOMA Meta for Schooling + Diploma.
##} FM_SCHOOL_DIPLOMA
##{ FM_SCHOOL_TYPES
meta FM_SCHOOL_TYPES (__FB_BA && __FB_BCs && __FB_MA && __FB_MBA)
describe FM_SCHOOL_TYPES Meta Combo Phrase for Schooling
##} FM_SCHOOL_TYPES
##{ FM_SEX_HELODDDD
meta FM_SEX_HELODDDD (__SEX_WRDS && FH_HELO_EQ_D_D_D_D)
describe FM_SEX_HELODDDD Sex words + helo = dddd
##} FM_SEX_HELODDDD
##{ FM_SUBJ_APPROVE
meta FM_SUBJ_APPROVE (__EXCLAIM_SUBJ && __SUBJ_APPROVE)
describe FM_SUBJ_APPROVE Subject has Approve and !
##} FM_SUBJ_APPROVE
##{ FM_TRUE_LOV_ALL_N
meta FM_TRUE_LOV_ALL_N (__FB_P_TRUELOVE && __FB_P_ALLNIGHT)
describe FM_TRUE_LOV_ALL_N True Love all Night!
##} FM_TRUE_LOV_ALL_N
##{ FM_VEGAS_CASINO
meta FM_VEGAS_CASINO ((__FROM_VEGAS + __SUBJ_3DIGIT + __SUBJ_VEGAS + __FB_GAME) > 2)
describe FM_VEGAS_CASINO Looks like vega casino spam
##} FM_VEGAS_CASINO
##{ FM_XMAIL_F_OUT
header FM_XMAIL_F_OUT X-Mailer =~ /Microsoft Outlook Express V6.00.2900.2180/
describe FM_XMAIL_F_OUT Looks like Fake Outlook?
##} FM_XMAIL_F_OUT
##{ FORGED_TBIRD_IMG_ARROW
meta FORGED_TBIRD_IMG_ARROW __FORGED_TBIRD_IMG && __TO_NO_ARROWS_R && !__TO_UNDISCLOSED
describe FORGED_TBIRD_IMG_ARROW Likely forged Thunderbird image spam
#score FORGED_TBIRD_IMG_ARROW 0.8
##} FORGED_TBIRD_IMG_ARROW
##{ FORGED_TBIRD_IMG_SIZE ifplugin Mail::SpamAssassin::Plugin::ImageInfo
ifplugin Mail::SpamAssassin::Plugin::ImageInfo
meta FORGED_TBIRD_IMG_SIZE __FORGED_TBIRD_IMG && __ONE_IMG && __IMG_LE_300K
describe FORGED_TBIRD_IMG_SIZE Likely forged Thunderbird image spam
# score FORGED_TBIRD_IMG_SIZE 0.8
endif
##} FORGED_TBIRD_IMG_SIZE ifplugin Mail::SpamAssassin::Plugin::ImageInfo
##{ FORGED_TBIRD_IMG_TO_MX
meta FORGED_TBIRD_IMG_TO_MX __FORGED_TBIRD_IMG && __DOS_DIRECT_TO_MX
describe FORGED_TBIRD_IMG_TO_MX Likely forged Thunderbird image spam
#score FORGED_TBIRD_IMG_TO_MX 2.5
##} FORGED_TBIRD_IMG_TO_MX
##{ FORM_FRAUD_3
meta FORM_FRAUD_3 (T_FILL_THIS_FORM || T_FILL_THIS_FORM_SHORT) && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AFR_UNION + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH + __BARRISTER + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER + __FEES + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + T_LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRUNK_BOX + __UN + __UNCLAIMED + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 3)
#score FORM_FRAUD_3 1.00
describe FORM_FRAUD_3 Fill a form and several fraud phrases
##} FORM_FRAUD_3
##{ FORM_FRAUD_5
meta FORM_FRAUD_5 (T_FILL_THIS_FORM || T_FILL_THIS_FORM_SHORT) && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AFR_UNION + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH + __BARRISTER + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER + __FEES + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + T_LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRUNK_BOX + __UN + __UNCLAIMED + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 5)
#score FORM_FRAUD_5 1.00
describe FORM_FRAUD_5 Fill a form and many fraud phrases
##} FORM_FRAUD_5
##{ FROM_41_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail
ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta FROM_41_FREEMAIL (NSL_ORIG_FROM_41 || NSL_RCVD_FROM_41) && (FREEMAIL_FROM || FREEMAIL_REPLYTO)
describe FROM_41_FREEMAIL Sent from Africa + freemail provider
# score FROM_41_FREEMAIL 0.25
endif
##} FROM_41_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail
##{ FROM_MISSP_DYNIP
meta FROM_MISSP_DYNIP __FROM_RUNON && RDNS_DYNAMIC
describe FROM_MISSP_DYNIP From misspaced + dynamic rDNS
#score FROM_MISSP_DYNIP 2.0
##} FROM_MISSP_DYNIP
##{ FROM_MISSP_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail
ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta FROM_MISSP_FREEMAIL __FROM_RUNON && (FREEMAIL_FROM || FREEMAIL_REPLYTO)
describe FROM_MISSP_FREEMAIL From misspaced + freemail provider
# score FROM_MISSP_FREEMAIL 2.0
endif
##} FROM_MISSP_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail
##{ FROM_MISSP_MSFT
meta FROM_MISSP_MSFT __FROM_RUNON && (__ANY_OUTLOOK_MUA || __HAS_MIMEOLE || __MIMEOLE_MS)
describe FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
#score FROM_MISSP_MSFT 3.5
##} FROM_MISSP_MSFT
##{ FRT_ADOBE2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_ADOBE2 /<inter W0><post P2>\b(?!adobe)<A><D><O><B><E>\b/i
describe FRT_ADOBE2 ReplaceTags: Adobe
endif
##} FRT_ADOBE2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_APPROV ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_APPROV /<inter sP2><post P2>\b(?!approv)<A><P><P><R><O><V>/i
describe FRT_APPROV ReplaceTags: Approve
endif
##} FRT_APPROV ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_BIGGERMEM1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_BIGGERMEM1 /<inter SP2><post P2>(?:<B><IX><GX><GX><E><R>|<L><A><R><GX><E><R>).{1,8}(?:<P><E><N><IX><SX>|<B><R><E><A><SX><TX>|<M><E><M><B><E><R>)/i
describe FRT_BIGGERMEM1 ReplaceTags: Bigger / Larger, Penis / Member
endif
##} FRT_BIGGERMEM1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_DIPLOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_DIPLOMA /<inter SP2><post P2>\b(?!diploma)<D><IX><P><L><O><M><A>/i
describe FRT_DIPLOMA ReplaceTags: Diploma
endif
##} FRT_DIPLOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_DISCOUNT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_DISCOUNT /<inter SP2><post P2>\b(?!discount)<D><IX><SX><C><O><U><N><TX>/i
describe FRT_DISCOUNT ReplaceTags: Discount
endif
##} FRT_DISCOUNT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_DOLLAR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_DOLLAR /<inter SP2><post P2>\b(?!dollar)<D><O><L><L><A><R>/i
describe FRT_DOLLAR ReplaceTags: Dollar
endif
##} FRT_DOLLAR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_ESTABLISH2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_ESTABLISH2 /<inter W0><post P2>\b(?!estabi?lish)<E><SX><TX><A><B><L><IX><SX><H>/i
describe FRT_ESTABLISH2 ReplaceTags: Establish (2)
endif
##} FRT_ESTABLISH2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_FUCK2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_FUCK2 /<inter W0><post P2>\b(?!fuck)<F><U><C><K>/i
describe FRT_FUCK2 ReplaceTags: Fuck (2)
endif
##} FRT_FUCK2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_GUARANTEE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_GUARANTEE1 /<inter SP2><post P2>(?!guarantee)<GX><U><A><R><A><N><TX><E><E>/i
describe FRT_GUARANTEE1 ReplaceTags: Guarantee (1)
endif
##} FRT_GUARANTEE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_INVESTOR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_INVESTOR /<inter SP2><post P2>\b(?!investor)<IX><N><V><E><SX><TX><O><R>/i
describe FRT_INVESTOR ReplaceTags: Investor
endif
##} FRT_INVESTOR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_LEVITRA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_LEVITRA /<inter W0><post P2>(?!levitra)<L><E><V><IX><TX><R><A>/i
describe FRT_LEVITRA ReplaceTags: Levitra
endif
##} FRT_LEVITRA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_MEETING ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_MEETING /<inter SP2><post P2>\b(?!meeting)<M><E><E><TX><IX><N><GX>\b/i
describe FRT_MEETING ReplaceTags: Meeting
endif
##} FRT_MEETING ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_OFFER2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_OFFER2 /<inter W0><post P2>\b(?!offer)<O><F><F><E><R>/i
describe FRT_OFFER2 ReplaceTags: Offer (2)
endif
##} FRT_OFFER2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_OPPORTUN2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_OPPORTUN2 /<inter W0><post P2>(?!opportun)<O><P><P><O><R><TX><U><N>/i
describe FRT_OPPORTUN2 ReplaceTags: Oppertun (2)
endif
##} FRT_OPPORTUN2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_PENIS1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_PENIS1 /<inter SP2><post P2>\b(?!pen\s?is)(?!penny[ ']?s)<P><E><N><IX><SX>\b/i
describe FRT_PENIS1 ReplaceTags: Penis
endif
##} FRT_PENIS1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_PRICE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_PRICE /<inter SP2><post P2>\b(?!price)<P><R><IX><C><E>\b/i
describe FRT_PRICE ReplaceTags: Price
endif
##} FRT_PRICE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_REFINANCE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_REFINANCE1 /<inter SP2><post P2>\b(?!refinanc)<R><E><F><IX><N><A><N><C>/i
describe FRT_REFINANCE1 ReplaceTags: Refinance (1)
endif
##} FRT_REFINANCE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_ROLEX ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_ROLEX /<inter SP2><post P2>\b(?!rolex)<R><O><L><E><X>/i
describe FRT_ROLEX ReplaceTags: Rolex
endif
##} FRT_ROLEX ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_SEXUAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_SEXUAL /<inter SP2><post P2>\b(?!sexual)<SX><E><X><U><A><L>/i
describe FRT_SEXUAL ReplaceTags: Sexual
endif
##} FRT_SEXUAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_SOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_SOMA /<post P2>\b(?!soma|500mg)<SX><O><M><A>\b/i
describe FRT_SOMA ReplaceTags: Soma
endif
##} FRT_SOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_SOMA2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_SOMA2 /<inter SP2><post P2>\b(?!soma|500? ?mg)<SX><O><M><A>\b/i
describe FRT_SOMA2 ReplaceTags: Soma (2)
endif
##} FRT_SOMA2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_STRONG1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_STRONG1 /<inter SP2><post P2>\b(?!stro\s?ng)<SX><TX><R><O><N><GX>\b/i
describe FRT_STRONG1 ReplaceTags: Strong (1)
endif
##} FRT_STRONG1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_STRONG2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_STRONG2 /<inter W0><post P2>\b(?!strong)<SX><TX><R><O><N><GX>\b/i
describe FRT_STRONG2 ReplaceTags: Strong (2)
endif
##} FRT_STRONG2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_SYMBOL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_SYMBOL /<inter SP2><post P2>\b(?!symbol)<SX><Y><M><B><O><L>/i
describe FRT_SYMBOL ReplaceTags: Symbol
endif
##} FRT_SYMBOL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_TODAY2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_TODAY2 /<inter W0><post P2>\b(?!today)<TX><O><D><A><Y>/i
describe FRT_TODAY2 ReplaceTags: Today (2)
endif
##} FRT_TODAY2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_VALIUM1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_VALIUM1 /<inter W0><post P2>\b(?!valium|verifiquem)<V><A><L><I><U><M>\b/i
describe FRT_VALIUM1 ReplaceTags: Valium
endif
##} FRT_VALIUM1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_VALIUM2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_VALIUM2 /<inter SP2><post P2>\b(?!valium)<V><A><L><I><U><M>\b/i
describe FRT_VALIUM2 ReplaceTags: Valium (2)
endif
##} FRT_VALIUM2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_WEIGHT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_WEIGHT2 /<inter W0><post P2>\b(?!weight)<WX><E><IX><GX><H><TX>/i
describe FRT_WEIGHT2 ReplaceTags: Weight (2)
endif
##} FRT_WEIGHT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_XANAX1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_XANAX1 /<inter W0><post P2>\b(?!xanax)<X><A><N><A><X>\b/i
describe FRT_XANAX1 ReplaceTags: Xanax (1)
endif
##} FRT_XANAX1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FRT_XANAX2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_XANAX2 /<inter SP2><post P2>\b(?!xanax)<X><A><N><A><X>\b/i
describe FRT_XANAX2 ReplaceTags: Xanax (2)
endif
##} FRT_XANAX2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FR_3TAG_3TAG
rawbody FR_3TAG_3TAG m'<[abcefghijklmnoqstuvwxz]{3}></[abcefghijklmnoqstuvwxz]{3}>'i
describe FR_3TAG_3TAG Looks like 3 <e> small tags.
##} FR_3TAG_3TAG
##{ FR_ALMOST_VIAG2
rawbody FR_ALMOST_VIAG2 /[^a-z](?!viagra)v?ia.?g.?ra/i
describe FR_ALMOST_VIAG2 Almost looks like viagra.
##} FR_ALMOST_VIAG2
##{ FR_CANTSEETEXT
rawbody FR_CANTSEETEXT /class="?cantseetext/i
describe FR_CANTSEETEXT Phrase class=cantseetext
##} FR_CANTSEETEXT
##{ FR_MIDER
rawbody FR_MIDER m'http[^ ]{5,30}/gall?/'
describe FR_MIDER Sign often seen in spams
##} FR_MIDER
##{ FR_TITLE_CONS_6
rawbody FR_TITLE_CONS_6 m'<title>.{0,4}[bcdfgjklmnpqrstvwxyz]{6}.{0,25}</title>'i
describe FR_TITLE_CONS_6 Title Attribute has 6 non-vowels.
##} FR_TITLE_CONS_6
##{ FR_TITLE_NUMS
rawbody FR_TITLE_NUMS m'<title>\d+</title>'i
describe FR_TITLE_NUMS HTML Title is only numbers
##} FR_TITLE_NUMS
##{ FSL_FAKE_GMAIL_RCVD
header FSL_FAKE_GMAIL_RCVD X-Spam-Relays-External =~ /gmail-smtp-in\.l\.google\.com/
#score FSL_FAKE_GMAIL_RCVD 0.001
##} FSL_FAKE_GMAIL_RCVD
##{ FSL_FAKE_HOTMAIL_RVCD
header FSL_FAKE_HOTMAIL_RVCD X-Spam-Relays-External =~ /mx[1234]\.hotmail\.com/
##} FSL_FAKE_HOTMAIL_RVCD
##{ FSL_GEO_ABUSE
uri FSL_GEO_ABUSE /\/geocities\.com\/\S+$/
#score FSL_GEO_ABUSE 3.0
##} FSL_GEO_ABUSE
##{ FSL_HELO_BARE_IP_1
header FSL_HELO_BARE_IP_1 X-Spam-Relays-External =~ /^[^\]]+ helo=\d+\.\d+\.\d+\.\d+ /i
#score FSL_HELO_BARE_IP_1 0.001
##} FSL_HELO_BARE_IP_1
##{ FSL_HELO_DEVICE
header FSL_HELO_DEVICE X-Spam-Relays-External =~ /\bhelo=(?:(?:dsl)?device|speedtouch)\.lan\b/i
#score FSL_HELO_DEVICE 0.001
##} FSL_HELO_DEVICE
##{ FSL_HELO_NON_FQDN_1
header FSL_HELO_NON_FQDN_1 X-Spam-Relays-External =~ /^[^\]]+ helo=[a-zA-Z0-9-_]+ /i
#score FSL_HELO_NON_FQDN_1 0.001
##} FSL_HELO_NON_FQDN_1
##{ FSL_HELO_SETUP
header FSL_HELO_SETUP X-Spam-Relays-External =~ /\bhelo=\S+\.setup\b/i
#score FSL_HELO_SETUP 0.001
##} FSL_HELO_SETUP
##{ FSL_INTERIA_ABUSE
uri FSL_INTERIA_ABUSE /\/\S+\.(?:w|eu|fm)\.interia\.pl/
#score FSL_INTERIA_ABUSE 15.0
##} FSL_INTERIA_ABUSE
##{ FSL_LSPACES_ABUSE
uri FSL_LSPACES_ABUSE /cid\-\S+\.spaces\.live\.com/
#score FSL_LSPACES_ABUSE 15.0
##} FSL_LSPACES_ABUSE
##{ FSL_YG_ABUSE
uri FSL_YG_ABUSE /\/groups\.yahoo\.com\/group\/\S+\/message\/1$/
#score FSL_YG_ABUSE 15.0
##} FSL_YG_ABUSE
##{ FS_ABIGGER
header FS_ABIGGER Subject =~ /a bigger/i
describe FS_ABIGGER Subject has "a bigger"
##} FS_ABIGGER
##{ FS_APPROVE_YOU
header FS_APPROVE_YOU Subject =~ /approve you/i
describe FS_APPROVE_YOU Subject says approve you
##} FS_APPROVE_YOU
##{ FS_AT_NO_COST
header FS_AT_NO_COST Subject =~ /\bat no cost/i
describe FS_AT_NO_COST Subject says "At No Cost"
##} FS_AT_NO_COST
##{ FS_CHEAP_CAP
header FS_CHEAP_CAP Subject =~ /CHEAP/
describe FS_CHEAP_CAP Phrase: Cheap in Caps in Subject.
##} FS_CHEAP_CAP
##{ FS_DOLLAR_BONUS
header FS_DOLLAR_BONUS Subject =~ /\$\d\d\d?\.?\d?\d? bonus/i
describe FS_DOLLAR_BONUS Subject talks about money bonus!
##} FS_DOLLAR_BONUS
##{ FS_EJACULA
header FS_EJACULA Subject =~ /ejaculat(?:[io01][o0i1]n|e)/i
describe FS_EJACULA Phrase: ejaculation in subject.
##} FS_EJACULA
##{ FS_ERECTION
header FS_ERECTION Subject =~ / erection /i
describe FS_ERECTION Phrase: erection in subject.
##} FS_ERECTION
##{ FS_HUGECOCK
header FS_HUGECOCK Subject =~ /(?:huge|tiny|small) (?:c[o0]ck|d[i1]ck|p[e3]n[1i]s)/i
describe FS_HUGECOCK Phrase: Huge Cock
##} FS_HUGECOCK
##{ FS_LARGE_PERCENT2
header FS_LARGE_PERCENT2 Subject =~ /(?!100%)\d[0-9oi][0-9oi]%/i
describe FS_LARGE_PERCENT2 Larger than 100% in subj.
##} FS_LARGE_PERCENT2
##{ FS_LOW_RATES
header FS_LOW_RATES Subject =~ / low rates/i
describe FS_LOW_RATES Subject says low rates
##} FS_LOW_RATES
##{ FS_MORE_CONFIDENT
header FS_MORE_CONFIDENT Subject =~ /more confident/i
describe FS_MORE_CONFIDENT Subject says More Confident
##} FS_MORE_CONFIDENT
##{ FS_NEW_SOFT_UPLOAD
header FS_NEW_SOFT_UPLOAD Subject =~ /^New software uploaded by/
describe FS_NEW_SOFT_UPLOAD Subj starts with New software uploaded
##} FS_NEW_SOFT_UPLOAD
##{ FS_NEW_XXX
header FS_NEW_XXX Subject =~ /^Re: news? [a-z]{1,5}$/
describe FS_NEW_XXX Subject looks like Fharmacy spams.
##} FS_NEW_XXX
##{ FS_NO_SCRIP
header FS_NO_SCRIP Subject =~ /n[o0O] p[reRE][erER]scr[i1I]pt[i1I][o0O]n/i
describe FS_NO_SCRIP Subject almost says No prescription
##} FS_NO_SCRIP
##{ FS_NUDE
header FS_NUDE Subject =~ /\bnude\b/i
describe FS_NUDE Subject says Nude
##} FS_NUDE
##{ FS_OBFU_PRMCY
header FS_OBFU_PRMCY Subject =~ /\b(?!(?:pharmacy|primacy))p[ph]{0,4}\S{1,3}r\S{0,2}m\S{0,3}c\S{0,2}y\b/i
describe FS_OBFU_PRMCY what could this word be?
##} FS_OBFU_PRMCY
##{ FS_PERSCRIPTION
header FS_PERSCRIPTION Subject =~ /perscr[i1]pt[i1][o0]n/i
describe FS_PERSCRIPTION Subject mis-spelled prescription
##} FS_PERSCRIPTION
##{ FS_PHARMASUB2
header FS_PHARMASUB2 Subject =~ /PH[A-Za-z]{2,7}MA/
describe FS_PHARMASUB2 Looks like Phramacy subject.
##} FS_PHARMASUB2
##{ FS_RAMROD
header FS_RAMROD Subject =~ /ramrod/i
describe FS_RAMROD Subject says Ramrod
##} FS_RAMROD
##{ FS_REPLICA
header FS_REPLICA Subject =~ /replica/i
describe FS_REPLICA Subject says "replica"
##} FS_REPLICA
##{ FS_REPLICAWATCH
header FS_REPLICAWATCH Subject =~ /replica watch/i
describe FS_REPLICAWATCH Subject says Replica watch
##} FS_REPLICAWATCH
##{ FS_RE_APPROV
header FS_RE_APPROV Subject =~ /re approved/i
describe FS_RE_APPROV Phrase: re approved
##} FS_RE_APPROV
##{ FS_START_DOYOU2
header FS_START_DOYOU2 Subject =~ /^Do you (?:dream|have|want|love|like|wanna)/i
describe FS_START_DOYOU2 Subject starts with Do you dream,have,want,love, etc.
##} FS_START_DOYOU2
##{ FS_START_LOSE
header FS_START_LOSE Subject =~ /^Lose /i
describe FS_START_LOSE Subject starts with Lose
##} FS_START_LOSE
##{ FS_TEEN_BAD
header FS_TEEN_BAD Subject =~ /teen.{1,15}(?:pussy|sex|slut|ass|fuck|rape)/i
describe FS_TEEN_BAD Subject says something bad about teens
##} FS_TEEN_BAD
##{ FS_TIP_DDD
header FS_TIP_DDD Subject =~ /(?:tip|good) \d\d\d?\d?/i
describe FS_TIP_DDD Phrase: subject = tip ddd
##} FS_TIP_DDD
##{ FS_WEIGHT_LOSS
header FS_WEIGHT_LOSS Subject =~ /weight loss/i
describe FS_WEIGHT_LOSS Subject says Weight Loss
##} FS_WEIGHT_LOSS
##{ FS_WILL_HELP
header FS_WILL_HELP Subject =~ /will help/
describe FS_WILL_HELP Subject says will help
##} FS_WILL_HELP
##{ FS_WITH_SMALL
header FS_WITH_SMALL Subject =~ /with (?:\w+\s)?(?:small|short)/i
describe FS_WITH_SMALL Subject says With ... small
##} FS_WITH_SMALL
##{ FUZZY_MERIDIA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FUZZY_MERIDIA /<inter W3><post P2>\b(?!meridia)<M><E><R><I><D><I><A>\b/i
endif
##} FUZZY_MERIDIA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ FU_COMMON_SUBS2
uri FU_COMMON_SUBS2 m'/(?:[2w]m|7d|b|ee|lj|j|o|u)/[,.]?$'
describe FU_COMMON_SUBS2 Sub-dir seen often in spam (2).
##} FU_COMMON_SUBS2
##{ FU_ENDS_NUMS_DOTS_CLK
uri FU_ENDS_NUMS_DOTS_CLK m'(?:clk|uns)/\d+\.\d+\.\d+'i
describe FU_ENDS_NUMS_DOTS_CLK Ends with clk/d+.d+.d+
##} FU_ENDS_NUMS_DOTS_CLK
##{ FU_END_ET
uri FU_END_ET m'/et/$'i
describe FU_END_ET ET Phone Home?
##} FU_END_ET
##{ FU_HOODIA
uri FU_HOODIA /hoodia/i
describe FU_HOODIA URL has hoodia in it.
##} FU_HOODIA
##{ FU_LONG_QUERY3
uri FU_LONG_QUERY3 m'[A-F0-9]{30}\.aspx'
describe FU_LONG_QUERY3 URL has a long file name with .aspx extension.
##} FU_LONG_QUERY3
##{ FU_MIDER
uri FU_MIDER m'/gall?/'
describe FU_MIDER URL has /gal/
##} FU_MIDER
##{ FU_UKGEOCITIES
uri FU_UKGEOCITIES /\b[a-z]{2}\.geocities\.com/i
describe FU_UKGEOCITIES URL with [a-z]{2}.geocities.com
##} FU_UKGEOCITIES
##{ FU_URI_TRACKER_T
uri FU_URI_TRACKER_T m'/[yi]/(?:sp|et|vm|xl2)/'i
describe FU_URI_TRACKER_T URI style tracker (T)
##} FU_URI_TRACKER_T
##{ GEO_QUERY_STRING
uri GEO_QUERY_STRING /^http:\/\/(?:\w{2,4}\.)?geocities\.com(?::\d*)?\/.+?\/\?/i
##} GEO_QUERY_STRING
##{ HDR_ORDER_FTSDMCXX_001C
meta HDR_ORDER_FTSDMCXX_001C (__HDR_ORDER_FTSDMCXXXX && __MID_START_001C)
describe HDR_ORDER_FTSDMCXX_001C Header order similar to spam (FTSDMCXX/MID variant)
##} HDR_ORDER_FTSDMCXX_001C
##{ HDR_ORDER_FTSDMCXX_BAT
meta HDR_ORDER_FTSDMCXX_BAT (__HDR_ORDER_FTSDMCXXXX && __BAT_BOUNDARY)
describe HDR_ORDER_FTSDMCXX_BAT Header order similar to spam (FTSDMCXX/boundary variant)
##} HDR_ORDER_FTSDMCXX_BAT
##{ HEADER_COUNT_SUBJECT ifplugin Mail::SpamAssassin::Plugin::HeaderEval
ifplugin Mail::SpamAssassin::Plugin::HeaderEval
header HEADER_COUNT_SUBJECT eval:check_header_count_range('Subject','2','999')
describe HEADER_COUNT_SUBJECT Multiple Subject headers found
endif
##} HEADER_COUNT_SUBJECT ifplugin Mail::SpamAssassin::Plugin::HeaderEval
##{ HELO_FRIEND
header HELO_FRIEND X-Spam-Relays-External =~ /^[^\]]+ helo=friend /i
##} HELO_FRIEND
##{ HELO_LH_HOME
header HELO_LH_HOME X-Spam-Relays-External =~ /^[^\]]+ helo=\S+\.(?:home|lan) /i
##} HELO_LH_HOME
##{ HELO_LH_LD
header HELO_LH_LD X-Spam-Relays-External =~ /^[^\]]+ helo=localhost\.localdomain /i
##} HELO_LH_LD
##{ HELO_LOCALHOST
header HELO_LOCALHOST X-Spam-Relays-External =~ /^[^\]]+ helo=localhost /i
##} HELO_LOCALHOST
##{ HELO_NO_DOMAIN
meta HELO_NO_DOMAIN __HELO_NO_DOMAIN && !HELO_LOCALHOST
describe HELO_NO_DOMAIN Relay reports its domain incorrectly
##} HELO_NO_DOMAIN
##{ HELO_OEM
header HELO_OEM X-Spam-Relays-External =~ /^[^\]]+ helo=(?:pc|oem\S*) /i
##} HELO_OEM
##{ HK_FAKENAME_EBAY
meta HK_FAKENAME_EBAY __HK_NAME_EBAY && !__HK_HELO_EBAY
describe HK_FAKENAME_EBAY From name mentions eBay, but not relayed from there
##} HK_FAKENAME_EBAY
##{ HK_FAKENAME_MICROSOFT
meta HK_FAKENAME_MICROSOFT __HK_NAME_MICROSOFT && !__HK_HELO_MICROSOFT
describe HK_FAKENAME_MICROSOFT From name mentions Microsoft, but not relayed from there
##} HK_FAKENAME_MICROSOFT
##{ HK_LOTTO
meta HK_LOTTO __HK_LOTTO_1 || __HK_LOTTO_2 || __HK_LOTTO_JACKPOT || __HK_LOTTO_STAATS || __HK_LOTTO_BALLOT
##} HK_LOTTO
##{ HK_NAME_DRUGS
header HK_NAME_DRUGS From:name =~ /(viagra|cialis)/mi
describe HK_NAME_DRUGS From name contains drugs
##} HK_NAME_DRUGS
##{ HK_NAME_FREE
header HK_NAME_FREE From:name =~ /\b(?:get)?free(?!\.fr)\b/mi
describe HK_NAME_FREE From name mentions free stuff
##} HK_NAME_FREE
##{ HK_RANDOM_ENVFROM
header HK_RANDOM_ENVFROM EnvelopeFrom =~ /^(?!(?:mail|bounce)[_.-]|[^@]*(?:[+=^~\#]|mcgr|kpmg|nlpbr|ndqv|lcgc|cplpr|-mailer@)|[^@]{20})[^@]*(?:[bcdfgjklmnpqrtvwxz]{5}|[aeiouy]{5}|([a-z]{1,2})(?:\1){3})/mi
describe HK_RANDOM_ENVFROM Envelope sender username looks random
##} HK_RANDOM_ENVFROM
##{ HK_RANDOM_FROM
header HK_RANDOM_FROM From:addr =~ /^(?!(?:mail|bounce)[_.-]|[^@]*(?:[+=^~\#]|mcgr|kpmg|nlpbr|ndqv|lcgc|cplpr|-mailer@)|[^@]{26}|.*?@.{0,20}\bcmp-info\.com$)[^@]*(?:[bcdfgjklmnpqrtvwxz]{5}|[aeiouy]{5}|([a-z]{1,2})(?:\1){3})/mi
describe HK_RANDOM_FROM From username looks random
##} HK_RANDOM_FROM
##{ HK_SCAM_N2
body HK_SCAM_N2 /\bnext of kin\b/i
##} HK_SCAM_N2
##{ HS_BOBAX_MID_2
header HS_BOBAX_MID_2 Message-Id =~ /^<\dIX\d{3}EJXVWDA\d{3}\@[a-z\-]+\.[a-z]+>/
describe HS_BOBAX_MID_2 Bobax? Message-Id: <0IX000EJXVWDA000@example.com>
##} HS_BOBAX_MID_2
##{ HS_BODY_UPLOADED_SOFTWARE
body HS_BODY_UPLOADED_SOFTWARE /^\w+ has uploaded some new software/
describe HS_BODY_UPLOADED_SOFTWARE Somebody has uploaded some new software for you
##} HS_BODY_UPLOADED_SOFTWARE
##{ HS_DRUG_DOLLAR_1
body HS_DRUG_DOLLAR_1 m'^[a-z]+[glrt][a-z]?[eir][a-z]?[asx](?: -|:)? \$[\d.]+$'i
describe HS_DRUG_DOLLAR_1 Contains a drug and price-like pattern.
##} HS_DRUG_DOLLAR_1
##{ HS_DRUG_DOLLAR_2
body HS_DRUG_DOLLAR_2 m'^[a-z]+[lmor][a-z]?[aex][a-z]?[mx](?: -|:)? \$[\d.]+$'i
describe HS_DRUG_DOLLAR_2 Contains a drug and price-like pattern.
##} HS_DRUG_DOLLAR_2
##{ HS_DRUG_DOLLAR_3
body HS_DRUG_DOLLAR_3 m'^[a-z]+[dino][a-z]?[aimu][a-z]?[amx](?: -|:)? \$[\d.]+$'i
describe HS_DRUG_DOLLAR_3 Contains a drug and price-like pattern.
##} HS_DRUG_DOLLAR_3
##{ HS_DRUG_DOLLAR_MANY
meta HS_DRUG_DOLLAR_MANY HS_DRUG_DOLLAR_1 + HS_DRUG_DOLLAR_2 + HS_DRUG_DOLLAR_3 >= 2
describe HS_DRUG_DOLLAR_MANY Contains several drug and dollar-like patterns.
##} HS_DRUG_DOLLAR_MANY
##{ HS_FORGED_OE_FW
meta HS_FORGED_OE_FW __HS_SUBJ_UC_FW && __OE_MUA
describe HS_FORGED_OE_FW Outlook does not prefix forwards with "FW:"
##} HS_FORGED_OE_FW
##{ HS_GETMEOFF
uri HS_GETMEOFF m'/get(?:me)?off\.php(?:$|[\#?])'
describe HS_GETMEOFF Links to common unsubscribe script: 'getmeoff.php'
##} HS_GETMEOFF
##{ HS_INDEX_PARAM
uri HS_INDEX_PARAM m'^https?:/*([^/]*/)+(?:index.(?:cgi|html?|php)|default.(?:asp|jsp))?\?(?!(?-i:[A-Z][a-z]{2,}){2,}$)\w+={0,2}$'i
describe HS_INDEX_PARAM Link contains a common tracker pattern.
##} HS_INDEX_PARAM
##{ HS_MEETUP_FOR_SEX
body HS_MEETUP_FOR_SEX m'(?:meet ?up|see eachother|get together) for (?:some )?(?:action|sex)'i
describe HS_MEETUP_FOR_SEX Talks about meeting up for sex.
##} HS_MEETUP_FOR_SEX
##{ HS_SUBJ_NEW_SOFTWARE
header HS_SUBJ_NEW_SOFTWARE Subject =~ /^New software uploaded by/
describe HS_SUBJ_NEW_SOFTWARE Subject starts with 'New software uploaded by'
##} HS_SUBJ_NEW_SOFTWARE
##{ HS_SUBJ_ONLINE_PHARMACEUTICAL
header HS_SUBJ_ONLINE_PHARMACEUTICAL Subject =~ /\bOnline Pharmaceutical/i
describe HS_SUBJ_ONLINE_PHARMACEUTICAL Subject contains the phrase 'Online pharmaceutical'
##} HS_SUBJ_ONLINE_PHARMACEUTICAL
##{ HS_VPXL
body HS_VPXL /\bVPXL\b/i
describe HS_VPXL Contains VPXL, yet the recommended dose is only 2 tablets.
##} HS_VPXL
##{ HTTPS_HTTP_MISMATCH ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch
ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch
body HTTPS_HTTP_MISMATCH eval:check_https_http_mismatch('1','10')
endif
##} HTTPS_HTTP_MISMATCH ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch
##{ IMG_DIRECT_TO_MX
meta IMG_DIRECT_TO_MX __DOS_DIRECT_TO_MX && __JPEG_ATTACH && __ONE_IMG && __IMG_LE_300K
#score IMG_DIRECT_TO_MX 0.20
##} IMG_DIRECT_TO_MX
##{ JM_I_FEEL_LUCKY
uri JM_I_FEEL_LUCKY /(?:\&|\?)btnI=ec(?:$|\&)/
tflags JM_I_FEEL_LUCKY publish # low hitrate, but always a good sign
##} JM_I_FEEL_LUCKY
##{ JM_RCVD_QMAILV1
header JM_RCVD_QMAILV1 Received =~ /by \S+ \(Qmailv1\) with ESMTP/
##} JM_RCVD_QMAILV1
##{ JM_SOUGHT_FRAUD_1
meta JM_SOUGHT_FRAUD_1 (__SEEK_FRAUD_NN_XIN || __SEEK_FRAUD_YM7Q1U || __SEEK_FRAUD_HMVYSR || __SEEK_FRAUD_2811F9)
#score JM_SOUGHT_FRAUD_1 3.0
describe JM_SOUGHT_FRAUD_1 Body contains frequently-spammed text patterns
##} JM_SOUGHT_FRAUD_1
##{ JM_SOUGHT_FRAUD_2
meta JM_SOUGHT_FRAUD_2 (__SEEK_FRAUD_ORMRPQ || __SEEK_FRAUD__70JEL || __SEEK_FRAUD_DKBMSM || __SEEK_FRAUD_LX2RCD || __SEEK_FRAUD_9_SYQR || __SEEK_FRAUD_3ZGAWE || __SEEK_FRAUD_XABL7X || __SEEK_FRAUD_CTSHG_ || __SEEK_FRAUD_JJQFVB || __SEEK_FRAUD_8DOXAD || __SEEK_FRAUD_ZHCQFW || __SEEK_FRAUD_4IGE4U || __SEEK_FRAUD_FREOKD || __SEEK_FRAUD_QZ_MDM || __SEEK_FRAUD_US_OFW || __SEEK_FRAUD_BXYWIK || __SEEK_FRAUD_BGO5Z1 || __SEEK_FRAUD_ZR4ER1 || __SEEK_FRAUD_CHLODJ || __SEEK_FRAUD_F6XEM3 || __SEEK_FRAUD_FOSRJQ || __SEEK_FRAUD_FF96JI || __SEEK_FRAUD_E0LMNE || __SEEK_FRAUD_IGL8BZ || __SEEK_FRAUD_NVO_LV || __SEEK_FRAUD_LTKAUK || __SEEK_FRAUD_V1ULWA || __SEEK_FRAUD_OPAU37 || __SEEK_FRAUD_SBLZOX || __SEEK_FRAUD_RGFON2 || __SEEK_FRAUD_F9YLOI || __SEEK_FRAUD__IA9KC)
#score JM_SOUGHT_FRAUD_2 3.0
describe JM_SOUGHT_FRAUD_2 Body contains frequently-spammed text patterns
##} JM_SOUGHT_FRAUD_2
##{ JM_SOUGHT_FRAUD_3
meta JM_SOUGHT_FRAUD_3 (__SEEK_FRAUD_IQFKX9 || __SEEK_FRAUD_SGFSMN || __SEEK_FRAUD_UCYLRJ || __SEEK_FRAUD_38GETZ || __SEEK_FRAUD_FHIQQL || __SEEK_FRAUD_0LP0QC || __SEEK_FRAUD_YGHQXE || __SEEK_FRAUD_EH1G11 || __SEEK_FRAUD_MY06YR || __SEEK_FRAUD_7XOY_V || __SEEK_FRAUD_LPT60S || __SEEK_FRAUD_AKYCPN || __SEEK_FRAUD_L5CHVT || __SEEK_FRAUD_BLDS9E || __SEEK_FRAUD_POQX46 || __SEEK_FRAUD_VXEHN_ || __SEEK_FRAUD_QJ58__ || __SEEK_FRAUD_GVP80_ || __SEEK_FRAUD_6HPM5A || __SEEK_FRAUD_EV4LPC || __SEEK_FRAUD_5_1_MB || __SEEK_FRAUD_HHL9OS || __SEEK_FRAUD_C0N_NJ || __SEEK_FRAUD_49FI4O || __SEEK_FRAUD_Z1DQSM || __SEEK_FRAUD_AAKMFF || __SEEK_FRAUD_MIIG_C || __SEEK_FRAUD_BRNKW7 || __SEEK_FRAUD_ZMFYMV || __SEEK_FRAUD_KDGYCE || __SEEK_FRAUD_ZHS0WA || __SEEK_FRAUD_TWEN6R || __SEEK_FRAUD_OUQ7_6 || __SEEK_FRAUD_J2YHWJ || __SEEK_FRAUD_LMLJQE || __SEEK_FRAUD_VXUYZK || __SEEK_FRAUD_IILB8R || __SEEK_FRAUD_EZFEDE || __SEEK_FRAUD_5MCR_O || __SEEK_FRAUD__EVXD7 || __SEEK_FRAUD_WQ3MYL || __SEEK_FRAUD_SJNU8J || __SEEK_FRAUD_PUJ_IF || __SEEK_FRAUD_S3AFMN || __SEEK_FRAUD_XADCD3 || __SEEK_FRAUD_E2ESY7 || __SEEK_FRAUD_DSHZQA || __SEEK_FRAUD_9JV2FO || __SEEK_FRAUD_PKVKI1 || __SEEK_FRAUD_HPCAW3 || __SEEK_FRAUD_VKUVK9 || __SEEK_FRAUD_PZKR_K || __SEEK_FRAUD_LC7TDH || __SEEK_FRAUD_VJNKV_ || __SEEK_FRAUD_Y6P5MJ || __SEEK_FRAUD_MGGP27 || __SEEK_FRAUD_NM1G_Z || __SEEK_FRAUD_PNYKVG || __SEEK_FRAUD_SYXC7L || __SEEK_FRAUD_X7EJQN || __SEEK_FRAUD_GZBMOF || __SEEK_FRAUD_OWE2LK || __SEEK_FRAUD_DJ79KN || __SEEK_FRAUD_3_8NUB || __SEEK_FRAUD_MO8JUB || __SEEK_FRAUD_TFGP0H || __SEEK_FRAUD_SJUAFZ || __SEEK_FRAUD_UJZKNM || __SEEK_FRAUD_XD3U8U || __SEEK_FRAUD_EO5_QW || __SEEK_FRAUD_RZZRJV || __SEEK_FRAUD_5NJERT || __SEEK_FRAUD_C7BE4W || __SEEK_FRAUD_L4OF4_ || __SEEK_FRAUD_UYQ1XG || __SEEK_FRAUD_ADBSR1 || __SEEK_FRAUD_5L07LP || __SEEK_FRAUD_NNZJNQ || __SEEK_FRAUD_NH9TNM || __SEEK_FRAUD_C5OQZD || __SEEK_FRAUD_XVM0G_ || __SEEK_FRAUD_G9KM9V || __SEEK_FRAUD_QHM0YN || __SEEK_FRAUD_MNSFWO || __SEEK_FRAUD_C62CWS || __SEEK_FRAUD_JK6E_X || __SEEK_FRAUD_S4QI3T || __SEEK_FRAUD_DLIZ7K || __SEEK_FRAUD_ZKHUET || __SEEK_FRAUD_UCAUVI || __SEEK_FRAUD_DNFIPA || __SEEK_FRAUD__EFA_O || __SEEK_FRAUD_DIIRM8 || __SEEK_FRAUD_N2TUPL || __SEEK_FRAUD_CKPXGA || __SEEK_FRAUD_HLTNBY || __SEEK_FRAUD_SKFND8 || __SEEK_FRAUD_TY7ECD || __SEEK_FRAUD_58TQIN || __SEEK_FRAUD__2H_ZF || __SEEK_FRAUD_H613HT || __SEEK_FRAUD_OXQL3J || __SEEK_FRAUD__4GEGC || __SEEK_FRAUD__HJ2Y5 || __SEEK_FRAUD_OEAWVL || __SEEK_FRAUD_ZLALWU || __SEEK_FRAUD_KS6HHB || __SEEK_FRAUD_QKMOJL || __SEEK_FRAUD_QHAHKB || __SEEK_FRAUD_EWZZ2M || __SEEK_FRAUD_215XVW || __SEEK_FRAUD_4KBBOJ || __SEEK_FRAUD_CRYRVO || __SEEK_FRAUD_JGB6V7 || __SEEK_FRAUD_MQI_VX || __SEEK_FRAUD_GQ_III || __SEEK_FRAUD_JDNTHW || __SEEK_FRAUD__QPNON || __SEEK_FRAUD_52TF6W || __SEEK_FRAUD__K6QXJ || __SEEK_FRAUD_TMN_LY || __SEEK_FRAUD_3BWYGW || __SEEK_FRAUD_TSWC8H || __SEEK_FRAUD_XDHW_C || __SEEK_FRAUD_KFEOGR || __SEEK_FRAUD_DCYEFP || __SEEK_FRAUD_H6IXQ5 || __SEEK_FRAUD_P_7YRN || __SEEK_FRAUD_VEFRJP || __SEEK_FRAUD_XNIO3Q || __SEEK_FRAUD_GTSAAF || __SEEK_FRAUD_L17Y6V || __SEEK_FRAUD_4VSYVD || __SEEK_FRAUD_FCD7Z9 || __SEEK_FRAUD_BZFTQQ || __SEEK_FRAUD_VRGLL3 || __SEEK_FRAUD_0BVEZG || __SEEK_FRAUD_UG4GV7 || __SEEK_FRAUD__OXXSN || __SEEK_FRAUD_LP_GQ9 || __SEEK_FRAUD_55WLGY || __SEEK_FRAUD_WI_PXU || __SEEK_FRAUD_5MEKF1 || __SEEK_FRAUD_E3KTBE || __SEEK_FRAUD_IMVAPT || __SEEK_FRAUD_QMDFLB || __SEEK_FRAUD_TKRYFP || __SEEK_FRAUD_8D5ZCH || __SEEK_FRAUD_YA_RGO || __SEEK_FRAUD_PRKDOF || __SEEK_FRAUD_W1_1AT || __SEEK_FRAUD_A1M2V4 || __SEEK_FRAUD_Q2NVM5 || __SEEK_FRAUD_NPQMIG || __SEEK_FRAUD_W_G8_H || __SEEK_FRAUD_KNJYYF || __SEEK_FRAUD_YKISUY || __SEEK_FRAUD_M_UYU5 || __SEEK_FRAUD_VSMRB_ || __SEEK_FRAUD_QJAXD2 || __SEEK_FRAUD_OIVTUG || __SEEK_FRAUD_7ORNIB || __SEEK_FRAUD_T6QSEI || __SEEK_FRAUD_7CQUW3 || __SEEK_FRAUD_JIUMW4 || __SEEK_FRAUD_B3XJII || __SEEK_FRAUD__ERENB || __SEEK_FRAUD_2BERS9 || __SEEK_FRAUD_XVL5QC || __SEEK_FRAUD_GVTOJY || __SEEK_FRAUD_A0U_YJ || __SEEK_FRAUD_1LS8UW || __SEEK_FRAUD_1OMKY9 || __SEEK_FRAUD_FYI5WN || __SEEK_FRAUD_EGCOZC || __SEEK_FRAUD_BTTJ73 || __SEEK_FRAUD_VEGVH5 || __SEEK_FRAUD_7GJKBJ || __SEEK_FRAUD_QOVRZI || __SEEK_FRAUD_QO85UJ || __SEEK_FRAUD_VTLF_0 || __SEEK_FRAUD_JTNNU1 || __SEEK_FRAUD_80CUEU || __SEEK_FRAUD_CTKQAR || __SEEK_FRAUD_LQICIN || __SEEK_FRAUD_BQVFV6 || __SEEK_FRAUD_VBA2NT || __SEEK_FRAUD_SIYSH8 || __SEEK_FRAUD_WKGUZG || __SEEK_FRAUD_GFJSHQ || __SEEK_FRAUD_0WHPB1 || __SEEK_FRAUD_UZSYRC || __SEEK_FRAUD_JU0DNT || __SEEK_FRAUD_D8N5AK || __SEEK_FRAUD_7A8HJM || __SEEK_FRAUD_CDBI1H || __SEEK_FRAUD_H3ZTPW || __SEEK_FRAUD_IYEOHL || __SEEK_FRAUD_PZEJXH || __SEEK_FRAUD_FG5MFR || __SEEK_FRAUD_ADHMPP || __SEEK_FRAUD_OLAWLX || __SEEK_FRAUD_PBQQJA || __SEEK_FRAUD_DZ9GWP || __SEEK_FRAUD_OXOGET || __SEEK_FRAUD_RGERLR || __SEEK_FRAUD_W5LM6_ || __SEEK_FRAUD_LKDOVS || __SEEK_FRAUD_U6L6T8 || __SEEK_FRAUD_NAWNBX || __SEEK_FRAUD_KBGNWU || __SEEK_FRAUD_JJPKAG || __SEEK_FRAUD_D_Z7NM || __SEEK_FRAUD_EPEJ1_ || __SEEK_FRAUD_IZKPNF || __SEEK_FRAUD_8BDNKT || __SEEK_FRAUD_EWAGO3 || __SEEK_FRAUD_MGLOG8 || __SEEK_FRAUD_6GPS4I || __SEEK_FRAUD_MWUIJQ || __SEEK_FRAUD_DI5SMP || __SEEK_FRAUD_VSTK_A || __SEEK_FRAUD_XY_KVM || __SEEK_FRAUD_0WTPZI || __SEEK_FRAUD_37UB9O || __SEEK_FRAUD_P12VMN || __SEEK_FRAUD__HWY23 || __SEEK_FRAUD_VDWAJV || __SEEK_FRAUD_GXGKLM || __SEEK_FRAUD_ZXHWD2 || __SEEK_FRAUD_JFMEJI || __SEEK_FRAUD_SH1EZL || __SEEK_FRAUD_HDNKBH || __SEEK_FRAUD_EOLLNZ || __SEEK_FRAUD_C0HOHT || __SEEK_FRAUD_ICOZAX || __SEEK_FRAUD_0ENSZN || __SEEK_FRAUD_K1VSVZ || __SEEK_FRAUD_YGYYT6 || __SEEK_FRAUD_T2PQH_ || __SEEK_FRAUD_IQZZGV || __SEEK_FRAUD_UJSOEL || __SEEK_FRAUD_HDZKRN || __SEEK_FRAUD_ID2SB5 || __SEEK_FRAUD_MTD5KL || __SEEK_FRAUD_C4M8O6 || __SEEK_FRAUD_JHK5YJ || __SEEK_FRAUD_J1WFB_ || __SEEK_FRAUD_6B2FK_ || __SEEK_FRAUD_GAPHBK || __SEEK_FRAUD_X1MGO6 || __SEEK_FRAUD_4VJJ1V || __SEEK_FRAUD_HTRHIY || __SEEK_FRAUD_E_N5XO || __SEEK_FRAUD_YRCV_U || __SEEK_FRAUD_KFUGGV || __SEEK_FRAUD_ALY_4Z || __SEEK_FRAUD_AACTU_ || __SEEK_FRAUD_VHSUC0 || __SEEK_FRAUD_NAXE2Z || __SEEK_FRAUD_XDJEQN || __SEEK_FRAUD_IIRQDN || __SEEK_FRAUD_BYTJGW || __SEEK_FRAUD_AAV9Q9 || __SEEK_FRAUD_TJFLBX || __SEEK_FRAUD_UPIS0F || __SEEK_FRAUD_Y7F2UL || __SEEK_FRAUD_ORCHU5 || __SEEK_FRAUD_JJPV6X || __SEEK_FRAUD_SVZDZ7 || __SEEK_FRAUD_IP2GBI || __SEEK_FRAUD_6ZXIA1 || __SEEK_FRAUD_JJXYC_ || __SEEK_FRAUD_NVFQGO || __SEEK_FRAUD_SVVXNA || __SEEK_FRAUD_E2US_V || __SEEK_FRAUD_DI9349 || __SEEK_FRAUD_QC6HVM || __SEEK_FRAUD_5EKBBQ || __SEEK_FRAUD_BKRS5B || __SEEK_FRAUD_FFM0SF || __SEEK_FRAUD_DAZ554 || __SEEK_FRAUD_DVQ_OH || __SEEK_FRAUD_FNYQLN || __SEEK_FRAUD_EONOG2 || __SEEK_FRAUD_B5_Q5F || __SEEK_FRAUD_8SR3L_ || __SEEK_FRAUD_RBAJV0 || __SEEK_FRAUD_DI_QRB || __SEEK_FRAUD_VMIDLD || __SEEK_FRAUD_SGH_BE || __SEEK_FRAUD_7PX0OU || __SEEK_FRAUD_MXYWF1 || __SEEK_FRAUD_EGRZ5T || __SEEK_FRAUD_2TBGCP || __SEEK_FRAUD_NSEQAC || __SEEK_FRAUD_VT5WCB || __SEEK_FRAUD_FSYFC_ || __SEEK_FRAUD_WQPH_R || __SEEK_FRAUD_WZIO9H || __SEEK_FRAUD_FKRVOS || __SEEK_FRAUD_ASW4ZD || __SEEK_FRAUD_SBFKHU || __SEEK_FRAUD_N87C1L || __SEEK_FRAUD_M03WB9 || __SEEK_FRAUD_KS9QN4 || __SEEK_FRAUD_SVSS9Y || __SEEK_FRAUD_TELOJY || __SEEK_FRAUD_GMP0SY || __SEEK_FRAUD_FOYA9K || __SEEK_FRAUD_3UF3BG || __SEEK_FRAUD_UGZFFW || __SEEK_FRAUD_WH7YUM || __SEEK_FRAUD_VD8CIS || __SEEK_FRAUD_WGBS3F || __SEEK_FRAUD_HHX2H4 || __SEEK_FRAUD_W7O0I7 || __SEEK_FRAUD_RC7YZH || __SEEK_FRAUD_5IZEAX || __SEEK_FRAUD_UK1HZY || __SEEK_FRAUD_CJCVEY || __SEEK_FRAUD_X2_BM9 || __SEEK_FRAUD_C80D_M || __SEEK_FRAUD_6GGFLT || __SEEK_FRAUD_F6ZEVO || __SEEK_FRAUD_FLVC7O || __SEEK_FRAUD_GSL5YK || __SEEK_FRAUD_O6PUI_ || __SEEK_FRAUD_BDDXSD || __SEEK_FRAUD_HLICNI || __SEEK_FRAUD_0EY1BH || __SEEK_FRAUD_ZN9EIN || __SEEK_FRAUD_MVBG8Z || __SEEK_FRAUD_DVBIVZ || __SEEK_FRAUD_6ZE0ZK || __SEEK_FRAUD_W1PLKY || __SEEK_FRAUD_SPR5JQ || __SEEK_FRAUD_M1HR35 || __SEEK_FRAUD_RBMZ20 || __SEEK_FRAUD_G4RKKF || __SEEK_FRAUD_FOT6IF || __SEEK_FRAUD_JRCNZ0 || __SEEK_FRAUD_19NM0A || __SEEK_FRAUD_5CTGDY || __SEEK_FRAUD__BXKBH || __SEEK_FRAUD_MCEI6K || __SEEK_FRAUD_KK4QB4 || __SEEK_FRAUD_KJCQBN || __SEEK_FRAUD_6LGTFG || __SEEK_FRAUD__TYKI7 || __SEEK_FRAUD_6EGJH6 || __SEEK_FRAUD_BAO5S3 || __SEEK_FRAUD_C_HP37 || __SEEK_FRAUD_QSWUVB || __SEEK_FRAUD_BS6HNM || __SEEK_FRAUD_IOCGDV || __SEEK_FRAUD_VHRO4H || __SEEK_FRAUD_YOHVL0 || __SEEK_FRAUD_ZM7VH9 || __SEEK_FRAUD_N9N9UF || __SEEK_FRAUD_LLMGBZ || __SEEK_FRAUD_YK2OQP || __SEEK_FRAUD_VEQPGW || __SEEK_FRAUD_0MX8JO || __SEEK_FRAUD_Y2SCUB || __SEEK_FRAUD_JAORYH || __SEEK_FRAUD_IGWSWV || __SEEK_FRAUD_1SKLLZ || __SEEK_FRAUD_PIVB38 || __SEEK_FRAUD_GHC0LN || __SEEK_FRAUD_0_6JSL || __SEEK_FRAUD__STWOQ || __SEEK_FRAUD_UTTB3I || __SEEK_FRAUD_9CQAIU || __SEEK_FRAUD_A62E_H || __SEEK_FRAUD_PLCEL_ || __SEEK_FRAUD_RG_9_1 || __SEEK_FRAUD_YDE9VC || __SEEK_FRAUD_CBZELO || __SEEK_FRAUD_EBEFON || __SEEK_FRAUD_PUSLFS || __SEEK_FRAUD_F6LCUO || __SEEK_FRAUD__NM8A8 || __SEEK_FRAUD_AWGSAH || __SEEK_FRAUD_5GX3N3 || __SEEK_FRAUD_ZR_YCL || __SEEK_FRAUD_PCELPI || __SEEK_FRAUD_KY9RF_ || __SEEK_FRAUD_RS93A_ || __SEEK_FRAUD_C3MJRM || __SEEK_FRAUD_LEF13W || __SEEK_FRAUD_XWTJ0S || __SEEK_FRAUD_BT6SO9 || __SEEK_FRAUD_YLQNKK || __SEEK_FRAUD_YFJVJR || __SEEK_FRAUD_KUYQIU || __SEEK_FRAUD_BAD6QS || __SEEK_FRAUD_KCMQLR || __SEEK_FRAUD_RZ_T71 || __SEEK_FRAUD_BTLJ32 || __SEEK_FRAUD_BFBYW8 || __SEEK_FRAUD_KOZWIB || __SEEK_FRAUD__V554S || __SEEK_FRAUD_HXGV4J || __SEEK_FRAUD_QE_VRV || __SEEK_FRAUD_L7_UPP || __SEEK_FRAUD_U1BBLW || __SEEK_FRAUD_E5T6LD || __SEEK_FRAUD_BY5FQK || __SEEK_FRAUD_OIF5AH || __SEEK_FRAUD_TTO7PC || __SEEK_FRAUD_OWPH93 || __SEEK_FRAUD_GS_B3U || __SEEK_FRAUD_IYSIY2 || __SEEK_FRAUD_YFLVQ4 || __SEEK_FRAUD_PYUIPE || __SEEK_FRAUD_LD1SHS || __SEEK_FRAUD_C5J9EE || __SEEK_FRAUD_VQF_LH || __SEEK_FRAUD__VLBMG || __SEEK_FRAUD_G9OOWK || __SEEK_FRAUD_QQD_PZ || __SEEK_FRAUD_RC8A1P || __SEEK_FRAUD_6VUONK || __SEEK_FRAUD_Y1JN21 || __SEEK_FRAUD_ULTF0J || __SEEK_FRAUD_9Q29S6 || __SEEK_FRAUD_JGKWCZ || __SEEK_FRAUD_AFUQZ_ || __SEEK_FRAUD_WMTNKJ || __SEEK_FRAUD_SYHCNJ || __SEEK_FRAUD_WC53DT || __SEEK_FRAUD_SZOTOL || __SEEK_FRAUD_J8PIFZ || __SEEK_FRAUD_PB4GGX || __SEEK_FRAUD_AEA51B || __SEEK_FRAUD_GY4RJE || __SEEK_FRAUD_TIC3QK || __SEEK_FRAUD__EU_I1 || __SEEK_FRAUD_8A1Q6M || __SEEK_FRAUD__KZVBM || __SEEK_FRAUD_NH1RHX || __SEEK_FRAUD_A5PM6O || __SEEK_FRAUD_F_KZOZ || __SEEK_FRAUD__DBLB0 || __SEEK_FRAUD_2U5_KL || __SEEK_FRAUD_O8ZW84 || __SEEK_FRAUD_XD5HNK || __SEEK_FRAUD_RZIRDL || __SEEK_FRAUD_OBTMVR || __SEEK_FRAUD_XBF8EX || __SEEK_FRAUD_XUO6FU || __SEEK_FRAUD_3HKWCI || __SEEK_FRAUD_HD6XPT || __SEEK_FRAUD_WMBI4K || __SEEK_FRAUD_6M8QNI || __SEEK_FRAUD_3JFT7Y || __SEEK_FRAUD_AUJ56H || __SEEK_FRAUD_EINBZL || __SEEK_FRAUD_NV1HR9 || __SEEK_FRAUD_TWWILQ || __SEEK_FRAUD_SUOVUP || __SEEK_FRAUD_M8D59N || __SEEK_FRAUD_H9SGSE || __SEEK_FRAUD_RF_UQZ || __SEEK_FRAUD_L9OWQX || __SEEK_FRAUD_5DEVYO || __SEEK_FRAUD_9KCDA8 || __SEEK_FRAUD_WJGJCF || __SEEK_FRAUD_LRYT7Y || __SEEK_FRAUD_TGFQKQ || __SEEK_FRAUD_WJXZ7I || __SEEK_FRAUD_8GOL16 || __SEEK_FRAUD_OL815K || __SEEK_FRAUD_BSX___ || __SEEK_FRAUD_S_M1GN || __SEEK_FRAUD_QA6UJG || __SEEK_FRAUD_ZF7LPG || __SEEK_FRAUD_JQSWAX || __SEEK_FRAUD_HPPPJP || __SEEK_FRAUD_NAUNZC || __SEEK_FRAUD_A56GDH || __SEEK_FRAUD_FBIJMC || __SEEK_FRAUD_D_URQY || __SEEK_FRAUD_PUAWHE || __SEEK_FRAUD_S1FKEV || __SEEK_FRAUD_I3HLDY || __SEEK_FRAUD_JW7I0T || __SEEK_FRAUD_N5_IR_ || __SEEK_FRAUD_3NIFMV || __SEEK_FRAUD_VBQ9JO || __SEEK_FRAUD_JOSDVP || __SEEK_FRAUD_4ONVKC || __SEEK_FRAUD_ZPBBGF || __SEEK_FRAUD_JMRRW7 || __SEEK_FRAUD_D4FWIB || __SEEK_FRAUD_UXEWFD || __SEEK_FRAUD_JUZL6H || __SEEK_FRAUD_F4SHTD || __SEEK_FRAUD_CQN7_5 || __SEEK_FRAUD_461FL0 || __SEEK_FRAUD_ZBR4PG || __SEEK_FRAUD_5CUOT8 || __SEEK_FRAUD_VEPGLD || __SEEK_FRAUD_CEUKKB || __SEEK_FRAUD_RIVPNL || __SEEK_FRAUD_HPKGEO || __SEEK_FRAUD_DNXWDS || __SEEK_FRAUD_GWBK_T || __SEEK_FRAUD_J45GYN || __SEEK_FRAUD_0UXRAU || __SEEK_FRAUD_F_FKHM || __SEEK_FRAUD_ZLXKPY || __SEEK_FRAUD_ZEZMCP || __SEEK_FRAUD__XXFBM || __SEEK_FRAUD_ZZ3WKA || __SEEK_FRAUD_BL1D9Y || __SEEK_FRAUD_QLBPGU || __SEEK_FRAUD_HDWVMD || __SEEK_FRAUD_EJM0XB || __SEEK_FRAUD_NQE_UB || __SEEK_FRAUD_7UXDY2 || __SEEK_FRAUD_8P0LT0 || __SEEK_FRAUD_P8Y20W || __SEEK_FRAUD_DZ5V2U || __SEEK_FRAUD_KCVY4L || __SEEK_FRAUD_UFCQVP || __SEEK_FRAUD_TIWDAE || __SEEK_FRAUD_QLUR_M || __SEEK_FRAUD_NMDNZN || __SEEK_FRAUD_3HU72N || __SEEK_FRAUD_D3X77R || __SEEK_FRAUD_FSJX4M || __SEEK_FRAUD_4WFQ9X || __SEEK_FRAUD_VJC0WF || __SEEK_FRAUD_F8IRSJ || __SEEK_FRAUD_0CUBFG || __SEEK_FRAUD_YT4HMB || __SEEK_FRAUD_GKVMSG || __SEEK_FRAUD_RO2TAX || __SEEK_FRAUD_EURZ3M || __SEEK_FRAUD_JYA5BT || __SEEK_FRAUD_VNIWHY || __SEEK_FRAUD_N3QXOP || __SEEK_FRAUD_DWEVNF || __SEEK_FRAUD_BPL3YK || __SEEK_FRAUD_4ZVC1C || __SEEK_FRAUD_F8EW0T || __SEEK_FRAUD_KUGLJT || __SEEK_FRAUD_JLSUKM || __SEEK_FRAUD_AGOTOV || __SEEK_FRAUD_45WI8I || __SEEK_FRAUD_LZEFMN || __SEEK_FRAUD_PR7DT3 || __SEEK_FRAUD_TUOYBL || __SEEK_FRAUD_WVDTCK || __SEEK_FRAUD_IUQ6A9 || __SEEK_FRAUD_YOWELS || __SEEK_FRAUD_VDYTU_ || __SEEK_FRAUD_QLJWTR || __SEEK_FRAUD_LYNJ8F || __SEEK_FRAUD_UVV3P5 || __SEEK_FRAUD_R2403I || __SEEK_FRAUD_RIMLAO || __SEEK_FRAUD_M_NLGB || __SEEK_FRAUD_HWMBYB || __SEEK_FRAUD_RG9CYN || __SEEK_FRAUD_QGS7RU || __SEEK_FRAUD_7ERN1P || __SEEK_FRAUD_OWB6Z2 || __SEEK_FRAUD_X1E2EB || __SEEK_FRAUD_0QGAHF || __SEEK_FRAUD_GVW9EM || __SEEK_FRAUD_K7QFW9 || __SEEK_FRAUD_IX6ZJO || __SEEK_FRAUD_A0GXKY || __SEEK_FRAUD_XKNJTL || __SEEK_FRAUD_K8ZMXX || __SEEK_FRAUD_OLKRDH || __SEEK_FRAUD_L6ICNJ || __SEEK_FRAUD_PSPGBR || __SEEK_FRAUD_EOVKVR || __SEEK_FRAUD_8JIBO6 || __SEEK_FRAUD_AI_1WI || __SEEK_FRAUD__MMCUC || __SEEK_FRAUD_KT_TR7 || __SEEK_FRAUD_RAQSMO || __SEEK_FRAUD_TCYHCF || __SEEK_FRAUD_3GQDHJ || __SEEK_FRAUD_6OYTMK || __SEEK_FRAUD__6TXBR || __SEEK_FRAUD_Q4PFFF || __SEEK_FRAUD_XTT7BO || __SEEK_FRAUD__IYMST || __SEEK_FRAUD_PDDLNK || __SEEK_FRAUD_7H66PN || __SEEK_FRAUD__Q0H7E || __SEEK_FRAUD_V4_LC8 || __SEEK_FRAUD_DUMWEJ || __SEEK_FRAUD_XOG2QH || __SEEK_FRAUD_LGU9SH || __SEEK_FRAUD_1DJSNK)
#score JM_SOUGHT_FRAUD_3 3.0
describe JM_SOUGHT_FRAUD_3 Body contains frequently-spammed text patterns
##} JM_SOUGHT_FRAUD_3
##{ JM_TORA_XM
meta JM_TORA_XM (__MAILER_OL_6626 && __MOLE_2962 && __NAKED_TO)
##} JM_TORA_XM
##{ KAM_LOTTO1
meta KAM_LOTTO1 (__KAM_LOTTO1 + __KAM_LOTTO2 + __KAM_LOTTO3 + __KAM_LOTTO4 + __KAM_LOTTO5 + __KAM_LOTTO6 + __KAM_LOTTO7 >= 3)
describe KAM_LOTTO1 Likely to be a e-Lotto Scam Email
#score KAM_LOTTO1 0.5
##} KAM_LOTTO1
##{ KAM_LOTTO2
meta KAM_LOTTO2 (__KAM_LOTTO1 + __KAM_LOTTO2 + __KAM_LOTTO3 + __KAM_LOTTO4 + __KAM_LOTTO5 + __KAM_LOTTO6 + __KAM_LOTTO7 >= 4)
describe KAM_LOTTO2 Highly Likely to be a e-Lotto Scam Email
#score KAM_LOTTO2 1.0
##} KAM_LOTTO2
##{ KAM_STOCKOTC
meta KAM_STOCKOTC (0)
tflags KAM_STOCKOTC publish
##} KAM_STOCKOTC
##{ KAM_STOCKTIP15
meta KAM_STOCKTIP15 (0)
tflags KAM_STOCKTIP15 publish
##} KAM_STOCKTIP15
##{ KAM_STOCKTIP20
meta KAM_STOCKTIP20 (0)
tflags KAM_STOCKTIP20 publish
##} KAM_STOCKTIP20
##{ KAM_STOCKTIP21
meta KAM_STOCKTIP21 (0)
tflags KAM_STOCKTIP21 publish
##} KAM_STOCKTIP21
##{ KAM_STOCKTIP4
meta KAM_STOCKTIP4 (0)
tflags KAM_STOCKTIP4 publish
##} KAM_STOCKTIP4
##{ KAM_STOCKTIP6
meta KAM_STOCKTIP6 (0)
tflags KAM_STOCKTIP6 publish
##} KAM_STOCKTIP6
##{ KB_DATE_CONTAINS_TAB
header KB_DATE_CONTAINS_TAB Date:raw =~ /^\t/
##} KB_DATE_CONTAINS_TAB
##{ KB_FAKED_THE_BAT
meta KB_FAKED_THE_BAT (__THEBAT_MUA && KB_DATE_CONTAINS_TAB)
##} KB_FAKED_THE_BAT
##{ KB_RATWARE_BOUNDARY
meta KB_RATWARE_BOUNDARY __RATWARE_BOUND_A || __RATWARE_BOUND_B
##} KB_RATWARE_BOUNDARY
##{ KB_RATWARE_MSGID
meta KB_RATWARE_MSGID (__KB_MSGID_OUTLOOK_888 && __ANY_OUTLOOK_MUA)
##} KB_RATWARE_MSGID
##{ KB_RATWARE_OUTLOOK_08
header KB_RATWARE_OUTLOOK_08 ALL =~ /^Message-Id: <....([0-9a-f]{8})\$[0-9a-f]{8}\$.{100,400}boundary="----=_NextPart_000_...._\1\./msi # "
##} KB_RATWARE_OUTLOOK_08
##{ KB_RATWARE_OUTLOOK_12
header KB_RATWARE_OUTLOOK_12 ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{4})[0-9a-f]{4}\$.{100,400}boundary="----=_NextPart_000_...._\1\.\2/msi # "
##} KB_RATWARE_OUTLOOK_12
##{ KB_RATWARE_OUTLOOK_16
header KB_RATWARE_OUTLOOK_16 ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{8})\$.{100,400}boundary="----=_NextPart_000_...._\1\.\2/msi # "
##} KB_RATWARE_OUTLOOK_16
##{ KB_RATWARE_OUTLOOK_MID
header KB_RATWARE_OUTLOOK_MID ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{8})\$[0-9a-f]{8}\@.{100,400}boundary="----=_NextPart_000_...._\1\.\2"/msi
##} KB_RATWARE_OUTLOOK_MID
##{ KHOP_SC_CIDR16
header KHOP_SC_CIDR16 Received =~ /(?-xism:\b(?:1(?:09\.184|78\.93)|59\.9[23]|222\.253|94\.179)(?:\.[012]?[0-9]{1,2}){2}\b)/
describe KHOP_SC_CIDR16 Relay listed in SpamCop top 12 IP/16 CIDRs
#score KHOP_SC_CIDR16 0.6 0.5 0.9 0.75
##} KHOP_SC_CIDR16
##{ KHOP_SC_CIDR16 if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
# score KHOP_SC_CIDR16 (0.8) # RCVD_IN_PBL
endif
##} KHOP_SC_CIDR16 if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
##{ KHOP_SC_CIDR24
header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:1\.60\.219|3\.87\.76)|21\.143\.49)|111\.224\.250|81\.192\.199|93\.91\.196)\.[012]?[0-9]{1,2}\b)/
describe KHOP_SC_CIDR24 Relay listed in SpamCop top 12 IP/24 CIDRs
#score KHOP_SC_CIDR24 0.9 0.8 1.3 1.2
##} KHOP_SC_CIDR24
##{ KHOP_SC_CIDR24 if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
# score KHOP_SC_CIDR24 (0.9) # RCVD_IN_PBL
endif
##} KHOP_SC_CIDR24 if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
##{ KHOP_SC_TOP200
header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:2(?:0(?:2\.(?:1(?:6(?:4\.52\.100|5\.199\.27)|5(?:2\.42|4\.81)\.242|29\.196\.210|42\.153\.21)|4(?:3\.18(?:2\.178|1\.7)|1\.92\.146)|7(?:4\.171\.214|5\.62\.10)|53\.(?:80\.203|79\.74)|62\.122\.118|39\.48\.221|87\.47\.130)|0\.(?:(?:95\.162\.20|54\.72\.3)0|8(?:0\.140\.61|7\.116\.58)|3(?:5\.38\.129|3\.214\.2)|234\.200\.93|49\.183\.202|74\.158\.135|6\.193\.89)|1\.(?:2(?:2(?:0\.232\.61|8\.3\.2)|34\.147\.213|51\.76\.132)|116\.36\.98)|8\.(?:101\.(?:55\.162|61\.60)|46\.105\.195|70\.160\.8)|3\.1(?:76\.142\.137|99\.72\.228)|9\.(?:216\.227\.33|94\.196\.170)|7\.(?:248\.35\.244|57\.90\.161))|1(?:7\.(?:1(?:9(?:8\.160\.218|9\.231\.249)|50\.4(?:1\.16|5\.)5|74\.229\.221|69\.219\.20)|64\.104\.107|76\.2\.129)|1\.(?:2(?:4(?:7\.239\.239|1\.111\.3)|34\.93\.154|02\.2\.97)|(?:105\.37\.5|43\.80\.24)8|60\.219\.183)|2\.(?:1(?:7(?:5\.53\.118|9\.75\.114)|54\.58\.90)|63\.221\.10)|3\.2(?:51\.1(?:34\.138|69\.132)|26\.144\.65)|8\.(?:248\.11\.69|38\.12\.246)|6\.230\.133\.69|9\.95\.129\.206|0\.5\.68\.20)|2(?:2\.(?:124\.198\.131|237\.78\.177)|0\.22(?:7\.154\.244|5\.226\.70)|1\.143\.49\.246))|1(?:9(?:0\.(?:1(?:5(?:6\.232\.132|8\.228\.179|9\.90\.201)|46\.1\.28)|2(?:10\.28\.193|08\.36\.90)|9(?:6\.68\.17|2\.26\.)9|4\.44\.237)|5\.(?:2(?:4\.(?:209\.14|93\.252)|30\.140\.18|2\.107\.1)|1(?:89\.46\.253|28\.56\.20)|95\.223\.25|88\.93\.92)|6\.(?:2(?:20\.57\.60|8\.240\.2)|12\.22(?:6\.220|8\.119))|4\.(?:126\.204\.31|63\.136\.18)|3\.(?:106\.64\.36|227\.98\.4))|2(?:2\.(?:1(?:83\.212\.113|69\.125\.35|55\.1\.174)|252\.234\.74|55\.106\.18)|1\.(?:1\.(?:37\.14[567]|18\.242)|5(?:2\.155\.13|8\.193\.)3)|5\.(?:2(?:35\.128\.246|12\.67\.102)|60\.164\.[25])|3\.(?:237\.123\.193|49\.45\.154)|4\.124\.4(?:3\.32|4\.10)|\.191\.88\.50)|1(?:6\.(?:50\.1(?:54\.130|75\.101)|118\.107\.[34])|0\.(?:139\.148\.109|45\.144\.227)|4\.14(?:3\.230\.162|1\.5\.3)|3\.1(?:62\.70\.74|9\.94\.2)|1\.224\.250\.13[025]|8\.102\.131\.130|5\.133\.151\.85|9\.226\.23\.8)|8(?:6\.2(?:4\.(?:1[6789]|2[0123])\.3|8\.228\.1)|9\.182\.132\.168)|57\.100\.228\.178|40\.111\.153\.4)|6(?:1\.(?:1(?:2\.62\.234|7\.76\.197)|9(?:7\.32\.104|\.6\.245)|4\.104\.38)|2\.(?:14(?:9\.(?:166\.45|226\.69)|2\.11\.3)|77\.221\.54|38\.54\.81)|6\.(?:2(?:3(?:1\.167\.70|5\.160\.11)|42\.21\.64)|46\.179\.10)|0\.25(?:0\.102\.209|4\.104\.18)|4\.76\.123\.98)|8(?:0\.(?:93\.12(?:5\.186|4\.1)|82\.181\.20|237\.31\.1)|5\.(?:11(?:8\.193\.158|3\.203\.82)|235\.164\.166)|3\.1(?:70\.123\.102|3\.218\.106|6\.167\.14)|(?:9\.121\.245\.19|7\.204\.24\.10)0|4\.22\.63\.74)|9(?:1\.121\.1(?:5(?:0\.6|8\.7)|71\.3)0|3\.(?:91\.196\.9[19]|62\.200\.26)|5\.1(?:70\.208\.114|54\.240\.98)|4\.(?:153\.224\.26|23\.37\.55))|7(?:7\.(?:73\.139\.(?:2(?:43)?|3)|246\.179\.13|36\.153\.21)|(?:9\.174\.66\.7|8\.97\.11\.3)5|5\.126\.213\.58)|5(?:8\.(?:6(?:8\.66\.25[012]|9\.225\.234)|248\.4\.67)|9\.163\.26\.211))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
#score KHOP_SC_TOP200 3.4 3.2 3.7 3.5
##} KHOP_SC_TOP200
##{ KHOP_SC_TOP200 if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
# score KHOP_SC_TOP200 4.6 # RCVD_IN_BL_SPAMCOP_NET + RCVD_IN_XBL++
endif
##} KHOP_SC_TOP200 if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
##{ KHOP_SC_TOP_CIDR16
header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:2(?:3\.2[37]|1\.247)|90\.24)|92\.(?:47|80))(?:\.[012]?[0-9]{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay listed in SpamCop top 6 IP/16 CIDRs
#score KHOP_SC_TOP_CIDR16 0.9 0.8 1.3 1.2
##} KHOP_SC_TOP_CIDR16
##{ KHOP_SC_TOP_CIDR16 if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
# score KHOP_SC_TOP_CIDR16 (0.9) # RCVD_IN_PBL
endif
##} KHOP_SC_TOP_CIDR16 if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
##{ KHOP_SC_TOP_CIDR8
header KHOP_SC_TOP_CIDR8 Received =~ /(?-xism:\b(?:9[25]|190|201)(?:\.[012]?[0-9]{1,2}){3}\b)/
describe KHOP_SC_TOP_CIDR8 Relay listed in SpamCop top 4 IP/8 CIDRs
#score KHOP_SC_TOP_CIDR8 0.5 0.4 0.8 0.6
##} KHOP_SC_TOP_CIDR8
##{ KHOP_SC_TOP_CIDR8 if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
# score KHOP_SC_TOP_CIDR8 (0.2) # RCVD_IN_PBL
endif
##} KHOP_SC_TOP_CIDR8 if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
##{ LIVEFILESTORE
uri LIVEFILESTORE m~livefilestore.com/~
##} LIVEFILESTORE
##{ LONG_TERM_PRICE
body LONG_TERM_PRICE /long\W+term\W+(target|projected)(\W+price)?/i
##} LONG_TERM_PRICE
##{ LOOPHOLE_1
body LOOPHOLE_1 /loop-?hole in the banking/i
describe LOOPHOLE_1 A loop hole in the banking laws?
##} LOOPHOLE_1
##{ LOTTERY_1
meta LOTTERY_1 (__DBLCLAIM && __CASHPRZ)
##} LOTTERY_1
##{ LOTTERY_PH_004470
meta LOTTERY_PH_004470 (__AFF_004470_NUMBER && __AFF_LOTTERY)
##} LOTTERY_PH_004470
##{ LOTTO_AGENT
body LOTTO_AGENT /\b(?:claim(?:s|ing)?(?:\sprocessing)?|fiducia\w+|reimbursement|prize\stransfer|(?:international|foreign)\sremittance|payment|immunity|grants?)\s?(?:agent|manager|officer|secretary)/i
describe LOTTO_AGENT Claims Agent
#score LOTTO_AGENT 0.50
##} LOTTO_AGENT
##{ L_SPAM_TOOL_13
header L_SPAM_TOOL_13 Date =~ /\s[+-]\d(?![2358]45)\d[124-9]\d$/
##} L_SPAM_TOOL_13
##{ MANY_GOOG_PROXY
meta MANY_GOOG_PROXY __FEEDPROXY > 4
describe MANY_GOOG_PROXY Many Google feedproxy URIs
##} MANY_GOOG_PROXY
##{ MANY_SPAN_IN_TEXT
meta MANY_SPAN_IN_TEXT (__SPAN_BEG_TEXT > 4) && (__SPAN_END_TEXT > 4)
describe MANY_SPAN_IN_TEXT Many <SPAN> tags embedded within text
##} MANY_SPAN_IN_TEXT
##{ MID_DEGREES
header MID_DEGREES Message-ID =~ /^<\d{14}\.[A-F0-9]{10}\@[A-Z0-9]+>$/
##} MID_DEGREES
##{ MIME_BOUND_EQ_REL
header MIME_BOUND_EQ_REL Content-Type =~ /boundary="=====================_\d+==\.REL"/s
##} MIME_BOUND_EQ_REL
##{ MIME_PHP_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
meta MIME_PHP_NO_TEXT (T_MIME_NO_TEXT && __XM_PHP)
# score MIME_PHP_NO_TEXT 2.00
describe MIME_PHP_NO_TEXT No text body parts, X-Mailer: PHP
endif
##} MIME_PHP_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
##{ MONEY_FRAUD_8
meta MONEY_FRAUD_8 T_LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AFR_UNION + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH + __BARRISTER + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER + __FEES + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + T_LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRUNK_BOX + __UN + __UNCLAIMED + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 8)
#score MONEY_FRAUD_8 1.50
describe MONEY_FRAUD_8 Lots of money and very many fraud phrases
##} MONEY_FRAUD_8
##{ MONEY_FROM_MISSP
meta MONEY_FROM_MISSP T_LOTS_OF_MONEY && T_FROM_MISSPACED
describe MONEY_FROM_MISSP Lots of money and misspaced From
#score MONEY_FROM_MISSP 1.5
##} MONEY_FROM_MISSP
##{ MSOE_MID_WRONG_CASE
meta MSOE_MID_WRONG_CASE (__XM_OUTLOOK_EXPRESS && __MSOE_MID_WRONG_CASE && !__MIMEOLE_1106)
##} MSOE_MID_WRONG_CASE
##{ NSL_ORIG_FROM_41
header NSL_ORIG_FROM_41 X-Originating-IP =~ /^(?:.+\[)?41\./
describe NSL_ORIG_FROM_41 Originates from 41.0.0.0/8
#score NSL_ORIG_FROM_41 0.20
##} NSL_ORIG_FROM_41
##{ NSL_RCVD_FROM_41
header NSL_RCVD_FROM_41 Received =~ /\[41\./
describe NSL_RCVD_FROM_41 Received from 41.0.0.0/8
#score NSL_RCVD_FROM_41 0.10
##} NSL_RCVD_FROM_41
##{ NSL_RCVD_FROM_USER
header NSL_RCVD_FROM_USER Received =~ /from User [\[\(]/
describe NSL_RCVD_FROM_USER Received from User
##} NSL_RCVD_FROM_USER
##{ NSL_RCVD_HELO_USER
header NSL_RCVD_HELO_USER Received =~ /helo[= ]user\)/i
describe NSL_RCVD_HELO_USER Received from HELO User
##} NSL_RCVD_HELO_USER
##{ NULL_IN_BODY
full NULL_IN_BODY /\x00/
describe NULL_IN_BODY Message has NUL (ASCII 0) byte in message
##} NULL_IN_BODY
##{ PART_CID_STOCK ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
meta PART_CID_STOCK (__ANY_IMAGE_ATTACH&&__PART_STOCK_CID&&!__PART_STOCK_CL&&!__PART_STOCK_CD_F)
describe PART_CID_STOCK Has a spammy image attachment (by Content-ID)
endif
##} PART_CID_STOCK ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
##{ PART_CID_STOCK_LESS ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
meta PART_CID_STOCK_LESS (__ANY_IMAGE_ATTACH&&__PART_CID_STOCK_LESS)
describe PART_CID_STOCK_LESS Has a spammy image attachment (by Content-ID, more specific)
endif
##} PART_CID_STOCK_LESS ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
##{ RCVD_BAD_ID
header RCVD_BAD_ID Received =~ /\bid\s+[a-zA-Z0-9_+\/\\,-]+(?:[!"\#\$\%&'()*:<=>?\@\[\]^\`{|}~]|;\S)/
##} RCVD_BAD_ID
##{ RCVD_FORGED_WROTE
header RCVD_FORGED_WROTE Received =~ / by \S+ with esmtp \([^a-z ]{6,} [^a-z ]{3,}\) id/
describe RCVD_FORGED_WROTE Forged 'Received' header found ('wrote:' spam)
##} RCVD_FORGED_WROTE
##{ RCVD_FORGED_WROTE2
header RCVD_FORGED_WROTE2 Received =~ /from [0-9.]+ \(HELO \S+[A-Za-z]+\) by (\S+) with esmtp \(\S+\s\S+\) id \S{6}-\S{6}-\S\S for \S+@\1;/s
##} RCVD_FORGED_WROTE2
##{ RCVD_IN_BRBL_LASTEXT ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_BRBL_LASTEXT eval:check_rbl('brbl-lastexternal','bb.barracudacentral.org')
tflags RCVD_IN_BRBL_LASTEXT net
endif
##} RCVD_IN_BRBL_LASTEXT ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_CSS
header RCVD_IN_CSS eval:check_rbl_sub('zen', '127.0.0.3')
describe RCVD_IN_CSS Received via a relay in Spamhaus CSS
tflags RCVD_IN_CSS net
##} RCVD_IN_CSS
##{ RCVD_IN_DNSWL_HI ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_DNSWL_HI eval:check_rbl_sub('dnswl-firsttrusted', '127.0.\d+.3')
describe RCVD_IN_DNSWL_HI Sender listed at http://www.dnswl.org/, high trust
tflags RCVD_IN_DNSWL_HI nice net
endif
##} RCVD_IN_DNSWL_HI ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_DNSWL_LOW ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_DNSWL_LOW eval:check_rbl_sub('dnswl-firsttrusted', '127.0.\d+.1')
describe RCVD_IN_DNSWL_LOW Sender listed at http://www.dnswl.org/, low trust
tflags RCVD_IN_DNSWL_LOW nice net
endif
##} RCVD_IN_DNSWL_LOW ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_DNSWL_MED ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_DNSWL_MED eval:check_rbl_sub('dnswl-firsttrusted', '127.0.\d+.2')
describe RCVD_IN_DNSWL_MED Sender listed at http://www.dnswl.org/, medium trust
tflags RCVD_IN_DNSWL_MED nice net
endif
##} RCVD_IN_DNSWL_MED ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_DNSWL_NONE ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_DNSWL_NONE eval:check_rbl_sub('dnswl-firsttrusted', '127.0.\d+.0')
describe RCVD_IN_DNSWL_NONE Sender listed at http://www.dnswl.org/, low trust
tflags RCVD_IN_DNSWL_NONE nice net
endif
##} RCVD_IN_DNSWL_NONE ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_DK ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_DK eval:check_rbl_sub('iadb-firsttrusted', '^127.2.255.3$')
describe RCVD_IN_IADB_DK IADB: Sender publishes Domain Keys record
tflags RCVD_IN_IADB_DK net nice
endif
##} RCVD_IN_IADB_DK ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_DOPTIN eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.10$')
describe RCVD_IN_IADB_DOPTIN IADB: All mailing list mail is confirmed opt-in
tflags RCVD_IN_IADB_DOPTIN net nice
endif
##} RCVD_IN_IADB_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_DOPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_DOPTIN_GT50 eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.9$')
describe RCVD_IN_IADB_DOPTIN_GT50 IADB: Confirmed opt-in used more than 50% of the time
tflags RCVD_IN_IADB_DOPTIN_GT50 net nice
endif
##} RCVD_IN_IADB_DOPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_DOPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_DOPTIN_LT50 eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.8$')
describe RCVD_IN_IADB_DOPTIN_LT50 IADB: Confirmed opt-in used less than 50% of the time
tflags RCVD_IN_IADB_DOPTIN_LT50 net nice
endif
##} RCVD_IN_IADB_DOPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_EDDB ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_EDDB eval:check_rbl_sub('iadb-firsttrusted', '^127.0.2.1$')
describe RCVD_IN_IADB_EDDB IADB: Participates in Email Deliverability Database
tflags RCVD_IN_IADB_EDDB net nice
endif
##} RCVD_IN_IADB_EDDB ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_EPIA ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_EPIA eval:check_rbl_sub('iadb-firsttrusted', '^127.0.2.2$')
describe RCVD_IN_IADB_EPIA IADB: Member of Email Processing Industry Alliance
tflags RCVD_IN_IADB_EPIA net nice
endif
##} RCVD_IN_IADB_EPIA ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_GOODMAIL ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_GOODMAIL eval:check_rbl_sub('iadb-firsttrusted', '^127.2.255.103$')
describe RCVD_IN_IADB_GOODMAIL IADB: Sender has been certified by GoodMail
tflags RCVD_IN_IADB_GOODMAIL net nice
endif
##} RCVD_IN_IADB_GOODMAIL ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_LISTED ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_LISTED eval:check_rbl_sub('iadb-firsttrusted', '^127.0.0.[12]$')
describe RCVD_IN_IADB_LISTED Participates in the IADB system
tflags RCVD_IN_IADB_LISTED net nice
endif
##} RCVD_IN_IADB_LISTED ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_LOOSE ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_LOOSE eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.4$')
describe RCVD_IN_IADB_LOOSE IADB: Adds relationship addrs w/out opt-in
tflags RCVD_IN_IADB_LOOSE net nice
endif
##} RCVD_IN_IADB_LOOSE ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_MI_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_MI_CPEAR eval:check_rbl_sub('iadb-firsttrusted', '^127.101.1.10$')
describe RCVD_IN_IADB_MI_CPEAR IADB: Complies with Michigan's CPEAR law
tflags RCVD_IN_IADB_MI_CPEAR net nice
endif
##} RCVD_IN_IADB_MI_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_MI_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_MI_CPR_30 eval:check_rbl_sub('iadb-firsttrusted', '^127.101.101.10$')
describe RCVD_IN_IADB_MI_CPR_30 IADB: Checked lists against Michigan's CPR within 30 days
tflags RCVD_IN_IADB_MI_CPR_30 net nice
endif
##} RCVD_IN_IADB_MI_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_MI_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_MI_CPR_MAT eval:check_rbl_sub('iadb-firsttrusted', '^127.101.201.10$')
describe RCVD_IN_IADB_MI_CPR_MAT IADB: Sends no material under Michigan's CPR
tflags RCVD_IN_IADB_MI_CPR_MAT net nice
endif
##} RCVD_IN_IADB_MI_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_ML_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_ML_DOPTIN eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.100$')
describe RCVD_IN_IADB_ML_DOPTIN IADB: Mailing list email only, confirmed opt-in
tflags RCVD_IN_IADB_ML_DOPTIN net nice
endif
##} RCVD_IN_IADB_ML_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_NOCONTROL ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_NOCONTROL eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.0$')
describe RCVD_IN_IADB_NOCONTROL IADB: Has absolutely no mailing controls in place
tflags RCVD_IN_IADB_NOCONTROL net nice
endif
##} RCVD_IN_IADB_NOCONTROL ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_OOO ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_OOO eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.200$')
describe RCVD_IN_IADB_OOO IADB: One-to-one/transactional email only
tflags RCVD_IN_IADB_OOO net nice
endif
##} RCVD_IN_IADB_OOO ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_OPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_OPTIN eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.7$')
describe RCVD_IN_IADB_OPTIN IADB: All mailing list mail is opt-in
tflags RCVD_IN_IADB_OPTIN net nice
endif
##} RCVD_IN_IADB_OPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_OPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_OPTIN_GT50 eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.6$')
describe RCVD_IN_IADB_OPTIN_GT50 IADB: Opt-in used more than 50% of the time
tflags RCVD_IN_IADB_OPTIN_GT50 net nice
endif
##} RCVD_IN_IADB_OPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_OPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_OPTIN_LT50 eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.5$')
describe RCVD_IN_IADB_OPTIN_LT50 IADB: Opt-in used less than 50% of the time
tflags RCVD_IN_IADB_OPTIN_LT50 net nice
endif
##} RCVD_IN_IADB_OPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_OPTOUTONLY ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_OPTOUTONLY eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.1$')
describe RCVD_IN_IADB_OPTOUTONLY IADB: Scrapes addresses, pure opt-out only
tflags RCVD_IN_IADB_OPTOUTONLY net nice
endif
##} RCVD_IN_IADB_OPTOUTONLY ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_RDNS ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_RDNS eval:check_rbl_sub('iadb-firsttrusted', '^127.2.255.4$')
describe RCVD_IN_IADB_RDNS IADB: Sender has reverse DNS record
tflags RCVD_IN_IADB_RDNS net nice
endif
##} RCVD_IN_IADB_RDNS ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_SENDERID ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_SENDERID eval:check_rbl_sub('iadb-firsttrusted', '^127.2.255.2$')
describe RCVD_IN_IADB_SENDERID IADB: Sender publishes Sender ID record
tflags RCVD_IN_IADB_SENDERID net nice
endif
##} RCVD_IN_IADB_SENDERID ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_SPF ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_SPF eval:check_rbl_sub('iadb-firsttrusted', '^127.2.255.1$')
describe RCVD_IN_IADB_SPF IADB: Sender publishes SPF record
tflags RCVD_IN_IADB_SPF net nice
endif
##} RCVD_IN_IADB_SPF ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_UNVERIFIED_1 ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_UNVERIFIED_1 eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.2$')
describe RCVD_IN_IADB_UNVERIFIED_1 IADB: Accepts unverified sign-ups
tflags RCVD_IN_IADB_UNVERIFIED_1 net nice
endif
##} RCVD_IN_IADB_UNVERIFIED_1 ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_UNVERIFIED_2 ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_UNVERIFIED_2 eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.3$')
describe RCVD_IN_IADB_UNVERIFIED_2 IADB: Accepts unverified sign-ups, gives chance to opt out
tflags RCVD_IN_IADB_UNVERIFIED_2 net nice
endif
##} RCVD_IN_IADB_UNVERIFIED_2 ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_UT_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_UT_CPEAR eval:check_rbl_sub('iadb-firsttrusted', '^127.101.2.10$')
describe RCVD_IN_IADB_UT_CPEAR IADB: Complies with Utah's CPEAR law
tflags RCVD_IN_IADB_UT_CPEAR net nice
endif
##} RCVD_IN_IADB_UT_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_UT_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_UT_CPR_30 eval:check_rbl_sub('iadb-firsttrusted', '^127.101.102.10$')
describe RCVD_IN_IADB_UT_CPR_30 IADB: Checked lists against Utah's CPR within 30 days
tflags RCVD_IN_IADB_UT_CPR_30 net nice
endif
##} RCVD_IN_IADB_UT_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_IADB_UT_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_UT_CPR_MAT eval:check_rbl_sub('iadb-firsttrusted', '^127.101.202.10$')
describe RCVD_IN_IADB_UT_CPR_MAT IADB: Sends no material under Utah's CPR
tflags RCVD_IN_IADB_UT_CPR_MAT net nice
endif
##} RCVD_IN_IADB_UT_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval
##{ RCVD_IN_PSBL
header RCVD_IN_PSBL eval:check_rbl('psbl-lastexternal', 'psbl.surriel.com.')
describe RCVD_IN_PSBL Received via a relay in PSBL
tflags RCVD_IN_PSBL net
##} RCVD_IN_PSBL
##{ RCVD_IN_RP_CERTIFIED
header RCVD_IN_RP_CERTIFIED eval:check_rbl_txt('ssc-firsttrusted', 'sa-trusted.bondedsender.org.')
describe RCVD_IN_RP_CERTIFIED Sender is in Return Path Certified (trusted relay)
tflags RCVD_IN_RP_CERTIFIED net nice
##} RCVD_IN_RP_CERTIFIED
##{ RCVD_IN_RP_RNBL
header RCVD_IN_RP_RNBL eval:check_rbl('rnbl-lastexternal','bl.score.senderscore.com.')
describe RCVD_IN_RP_RNBL Relay in RNBL, https://senderscore.org/blacklistlookup/
tflags RCVD_IN_RP_RNBL net
##} RCVD_IN_RP_RNBL
##{ RCVD_IN_RP_SAFE
header RCVD_IN_RP_SAFE eval:check_rbl_txt('ssc-firsttrusted','sa-accredit.habeas.com.')
describe RCVD_IN_RP_SAFE Sender is in Return Path Safe (trusted relay)
tflags RCVD_IN_RP_SAFE net nice
##} RCVD_IN_RP_SAFE
##{ RCVD_MAIL_COM
header RCVD_MAIL_COM Received =~ /[\s\(\[](?:post|mail)\.com[\s\)\]]/is
describe RCVD_MAIL_COM Forged Received header (contains post.com or mail.com)
##} RCVD_MAIL_COM
##{ RDNS_LOCALHOST
header RDNS_LOCALHOST X-Spam-Relays-External =~ /^\[ ip=(?!127)\d+\.\d+\.\d+\.\d+ rdns=localhost(?:\.localdomain)? /i
describe RDNS_LOCALHOST Sender's public rDNS is "localhost"
##} RDNS_LOCALHOST
##{ REPLYTO_WITHOUT_TO_CC
meta REPLYTO_WITHOUT_TO_CC (__REPLYTO_EXISTS && !__TOCC_EXISTS)
##} REPLYTO_WITHOUT_TO_CC
##{ S25R_1
describe S25R_1 S25R: Bottom of rDNS has num, non-num, num
meta S25R_1 __LAST_EXTERNAL_RELAY_NO_AUTH && __S25R_1 && !(__DOS_RELAYED_EXT||__S25R_2||__S25R_3||__S25R_4||__S25R_5||__S25R_6 || __NOT_SPOOFED || __GREYLISTED)
##} S25R_1
##{ S25R_6
describe S25R_6 S25R: rDNS looks dynamic or customer-facing
meta S25R_6 __LAST_EXTERNAL_RELAY_NO_AUTH && __S25R_6 && !(__S25R_1||__S25R_2||__S25R_3||__S25R_4||__S25R_5 || __NOT_SPOOFED || __GREYLISTED)
##} S25R_6
##{ SANE_04e8bf28eb445199a7f11b943c44d209
body SANE_04e8bf28eb445199a7f11b943c44d209 /replica watches/
describe SANE_04e8bf28eb445199a7f11b943c44d209 Email.Spam.Gen3177.Sanesecurity.08051611
#score SANE_04e8bf28eb445199a7f11b943c44d209 0.01
##} SANE_04e8bf28eb445199a7f11b943c44d209
##{ SANE_1c4f3286fa4aed6424ced88bfaf8b09c
body SANE_1c4f3286fa4aed6424ced88bfaf8b09c /innerhalb von 2\-3 Tagen/
#score SANE_1c4f3286fa4aed6424ced88bfaf8b09c 0.01
describe SANE_1c4f3286fa4aed6424ced88bfaf8b09c Email.Spam.Gen3234.Sanesecurity.08052309
##} SANE_1c4f3286fa4aed6424ced88bfaf8b09c
##{ SANE_2b173a7fb7518c75ac8a2d294d773fd8
body SANE_2b173a7fb7518c75ac8a2d294d773fd8 /High Quality Watches/
#score SANE_2b173a7fb7518c75ac8a2d294d773fd8 0.01
describe SANE_2b173a7fb7518c75ac8a2d294d773fd8 Email.Spam.Sanesecurity.Url_2496
##} SANE_2b173a7fb7518c75ac8a2d294d773fd8
##{ SANE_3b92eda751c992f230f215fb7eb36844
body SANE_3b92eda751c992f230f215fb7eb36844 /Replica Watches/
describe SANE_3b92eda751c992f230f215fb7eb36844 Email.Spam.Gen158.Sanesecurity.07012700
#score SANE_3b92eda751c992f230f215fb7eb36844 0.01
##} SANE_3b92eda751c992f230f215fb7eb36844
##{ SANE_4ef8302546bf270a19baf98508afacc4
body SANE_4ef8302546bf270a19baf98508afacc4 /replica watch/
#score SANE_4ef8302546bf270a19baf98508afacc4 0.01
describe SANE_4ef8302546bf270a19baf98508afacc4 Email.Spam.Gen1941.Sanesecurity.07112519
##} SANE_4ef8302546bf270a19baf98508afacc4
##{ SANE_7429530a7398f43f1f1b795f9420714e
body SANE_7429530a7398f43f1f1b795f9420714e /MSN Featured Offers/
describe SANE_7429530a7398f43f1f1b795f9420714e Email.Spam.Gen2507.Sanesecurity.08021303
#score SANE_7429530a7398f43f1f1b795f9420714e 0.01
##} SANE_7429530a7398f43f1f1b795f9420714e
##{ SANE_75491b468ec2e117e50f9842d32abfab
body SANE_75491b468ec2e117e50f9842d32abfab /Also we have so much soft for MACINTOSH\!\!\!/
#score SANE_75491b468ec2e117e50f9842d32abfab 0.01
describe SANE_75491b468ec2e117e50f9842d32abfab Email.Spam.Gen1361.Sanesecurity.07100500
##} SANE_75491b468ec2e117e50f9842d32abfab
##{ SANE_91eb43f705d25c804374a746d7519660
body SANE_91eb43f705d25c804374a746d7519660 /online casino/
describe SANE_91eb43f705d25c804374a746d7519660 Email.Malware.Sanesecurity.07011300
#score SANE_91eb43f705d25c804374a746d7519660 0.01
##} SANE_91eb43f705d25c804374a746d7519660
##{ SANE_d0d2b0f6373bf91253d66dd74c594b87
body SANE_d0d2b0f6373bf91253d66dd74c594b87 /Luxury Watches/
#score SANE_d0d2b0f6373bf91253d66dd74c594b87 0.01
describe SANE_d0d2b0f6373bf91253d66dd74c594b87 Email.Spam.Sanesecurity.Url_2499
##} SANE_d0d2b0f6373bf91253d66dd74c594b87
##{ SB_GIF_AND_NO_URIS
meta SB_GIF_AND_NO_URIS (__GIF_ATTACH&&!__HAS_ANY_URI&&!__HAS_ANY_EMAIL)
##} SB_GIF_AND_NO_URIS
##{ SHORT_HELO_AND_INLINE_IMAGE
meta SHORT_HELO_AND_INLINE_IMAGE (__HELO_NO_DOMAIN && __ANY_IMAGE_ATTACH)
describe SHORT_HELO_AND_INLINE_IMAGE Short HELO string, with inline image
##} SHORT_HELO_AND_INLINE_IMAGE
##{ SHORT_TERM_PRICE
body SHORT_TERM_PRICE /short\W+term\W+(target|projected)(\W+price)?/i
##} SHORT_TERM_PRICE
##{ SPAMMY_XMAILER
meta SPAMMY_XMAILER (__XM_OL_28001441||__XM_OL_48072300||__XM_OL_28004682||__XM_OL_10_0_4115||__XM_OL_4_72_2106_4)
describe SPAMMY_XMAILER X-Mailer string is common in spam and not in ham
##} SPAMMY_XMAILER
##{ STOCK_IMG_CTYPE
meta STOCK_IMG_CTYPE (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__CTYPE_ONETAB_GIF&&__HTML_IMG_ONLY)
describe STOCK_IMG_CTYPE Stock spam image part, with distinctive Content-Type header
##} STOCK_IMG_CTYPE
##{ STOCK_IMG_HDR_FROM
meta STOCK_IMG_HDR_FROM (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__TVD_FW_GRAPHIC_ID1&&__HTML_IMG_ONLY)
describe STOCK_IMG_HDR_FROM Stock spam image part, with distinctive From line
##} STOCK_IMG_HDR_FROM
##{ STOCK_IMG_HTML
meta STOCK_IMG_HTML (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__PART_STOCK_CID&&__HTML_IMG_ONLY)
describe STOCK_IMG_HTML Stock spam image part, with distinctive HTML
##} STOCK_IMG_HTML
##{ STOCK_IMG_OUTLOOK
meta STOCK_IMG_OUTLOOK (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__XM_MS_IN_GENERAL&&__HTML_LENGTH_1536_2048)
describe STOCK_IMG_OUTLOOK Stock spam image part, with Outlook-like features
##} STOCK_IMG_OUTLOOK
##{ STOCK_PRICES
meta STOCK_PRICES (SHORT_TERM_PRICE && LONG_TERM_PRICE)
##} STOCK_PRICES
##{ STOX_AND_PRICE
meta STOX_AND_PRICE CURR_PRICE && STOX_REPLY_TYPE
##} STOX_AND_PRICE
##{ STOX_REPLY_TYPE
header STOX_REPLY_TYPE Content-Type =~ /text\/plain; .* reply-type=original/
##} STOX_REPLY_TYPE
##{ STOX_REPLY_TYPE_WITHOUT_QUOTES
meta STOX_REPLY_TYPE_WITHOUT_QUOTES (STOX_REPLY_TYPE && !(__HS_SUBJ_RE_FW || __HS_QUOTE))
##} STOX_REPLY_TYPE_WITHOUT_QUOTES
##{ STYLE_GIBBERISH
rawbody STYLE_GIBBERISH /<style[^>]{0,30}>(?:\s{0,80}[^\s:;<]){150}/im
##} STYLE_GIBBERISH
##{ SUBJECT_NEEDS_ENCODING
meta SUBJECT_NEEDS_ENCODING (!__SUBJECT_ENCODED_B64 && !__SUBJECT_ENCODED_QP) && __SUBJECT_NEEDS_MIME
##} SUBJECT_NEEDS_ENCODING
##{ TAB_IN_FROM
header TAB_IN_FROM From:raw =~ /^\t/s
describe TAB_IN_FROM From starts with a tab
##} TAB_IN_FROM
##{ TBIRD_SUSP_MIME_BDRY
meta TBIRD_SUSP_MIME_BDRY __MUA_TBIRD && __TB_MIME_BDRY_NO_Z
describe TBIRD_SUSP_MIME_BDRY Unlikely Thunderbird MIME boundary
##} TBIRD_SUSP_MIME_BDRY
##{ THEBAT_UNREG
header THEBAT_UNREG X-Mailer =~ /^The Bat! .{0,20} UNREG$/
##} THEBAT_UNREG
##{ TINY_FLOAT
rawbody TINY_FLOAT /\bstyle\s*=\s*"[^"]{0,40}?(?:(?:FONT-SIZE\s*:\s+\dpx|FLOAT\s*:\s+(?:right|left))(?:;\s+)?(?:(?!(?:FONT-SIZE|FLOAT))\w+:\s+\w+;?\s*)*){2}/i
describe TINY_FLOAT Has small-font floating HTML elements - text obfuscation?
#score TINY_FLOAT 2.00
##} TINY_FLOAT
##{ TO_NO_BRKTS_DYNIP
meta TO_NO_BRKTS_DYNIP __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && RDNS_DYNAMIC
#score TO_NO_BRKTS_DYNIP 0.20
##} TO_NO_BRKTS_DYNIP
##{ TT_MSGID_TRUNC
header TT_MSGID_TRUNC Message-Id =~ /^\s*<?[^<>\s]+\[\d+$/
describe TT_MSGID_TRUNC Scora: Message-Id ends after left-bracket + digits
##} TT_MSGID_TRUNC
##{ TT_OBSCURED_VALIUM
meta TT_OBSCURED_VALIUM ( __TT_BROKEN_VALIUM || __TT_OBSCURED_VALIUM ) && ! __TT_VALIUM
describe TT_OBSCURED_VALIUM Scora: obscured "VALIUM" in subject
##} TT_OBSCURED_VALIUM
##{ TT_OBSCURED_VIAGRA
meta TT_OBSCURED_VIAGRA ( __TT_BROKEN_VIAGRA || __TT_OBSCURED_VIAGRA ) && ! __TT_VIAGRA
describe TT_OBSCURED_VIAGRA Scora: obscured "VIAGRA" in subject
##} TT_OBSCURED_VIAGRA
##{ TVD_ACT_193
body TVD_ACT_193 /\bact of (?:193|nineteen thirty)/i
##} TVD_ACT_193
##{ TVD_APPROVED
body TVD_APPROVED /you.{1,2}re .{0,20}approved/i
##} TVD_APPROVED
##{ TVD_DEAR_HOMEOWNER
body TVD_DEAR_HOMEOWNER /^dear homeowner/i
##} TVD_DEAR_HOMEOWNER
##{ TVD_EB_PHISH
meta TVD_EB_PHISH __FROM_EBAY && NORMAL_HTTP_TO_IP
##} TVD_EB_PHISH
##{ TVD_ENVFROM_APOST
header TVD_ENVFROM_APOST EnvelopeFrom =~ /\'/
##} TVD_ENVFROM_APOST
##{ TVD_FINGER_02
header TVD_FINGER_02 Content-Type =~ /^text\/plain(?:; (?:format=flowed|charset="Windows-1252"|reply-type=original)){3}/i
##} TVD_FINGER_02
##{ TVD_FLOAT_GENERAL
rawbody TVD_FLOAT_GENERAL /\bstyle\s*=\s*"[^"]*\bfloat\s*:\s*[a-z]+\s*">\s*[a-zA-Z]+\s*</i
##} TVD_FLOAT_GENERAL
##{ TVD_FUZZY_DEGREE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body TVD_FUZZY_DEGREE /<inter W1><post P1>\b(?!degree)<D><E><G><R><E><E>\b/i
endif
##} TVD_FUZZY_DEGREE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ TVD_FUZZY_FINANCE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body TVD_FUZZY_FINANCE /(?!finance)<F><I><N><A><N><C><E>/i
endif
##} TVD_FUZZY_FINANCE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ TVD_FUZZY_FIXED_RATE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body TVD_FUZZY_FIXED_RATE /<inter W2><post P2>(?!fixed rate)<F><I><X><E><D>\s+<R><A><T><E>/i
endif
##} TVD_FUZZY_FIXED_RATE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ TVD_FUZZY_MICROCAP ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body TVD_FUZZY_MICROCAP /<inter W2><post P2>(?!microcap)(?!micro-cap)<M><I><C><R><O>-?<C><A><P>/i
endif
##} TVD_FUZZY_MICROCAP ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ TVD_FUZZY_PHARMACEUTICAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body TVD_FUZZY_PHARMACEUTICAL /<inter W2><post P2>(?!pharmaceutical)<P><H><A><R><M><A><C><E><U><T><I><C><A><L>/i
endif
##} TVD_FUZZY_PHARMACEUTICAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ TVD_FUZZY_SYMBOL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body TVD_FUZZY_SYMBOL /<inter W2><post P2>(?!symbol)<S><Y><M><B><O><L>/i
endif
##} TVD_FUZZY_SYMBOL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ TVD_FW_GRAPHIC_NAME_LONG ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader TVD_FW_GRAPHIC_NAME_LONG Content-Type =~ /\bname="[a-z]{8,}\.gif/
endif
##} TVD_FW_GRAPHIC_NAME_LONG ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
##{ TVD_FW_GRAPHIC_NAME_MID ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader TVD_FW_GRAPHIC_NAME_MID Content-Type =~ /\bname="[a-z]{6,7}\.gif/
endif
##} TVD_FW_GRAPHIC_NAME_MID ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
##{ TVD_INCREASE_SIZE
body TVD_INCREASE_SIZE /\bsize of .{1,20}(?:penis|dick|manhood)/i
##} TVD_INCREASE_SIZE
##{ TVD_LINK_SAVE
body TVD_LINK_SAVE /\blink to save\b/i
##} TVD_LINK_SAVE
##{ TVD_PCT_OFF
header TVD_PCT_OFF Subject =~ /(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\S* \d+% OFF/
##} TVD_PCT_OFF
##{ TVD_PH_BODY_ACCOUNTS_PRE
body TVD_PH_BODY_ACCOUNTS_PRE /\baccounts? (?:[a-z_,-]+ )+?(?:record[a-z]*|suspen[a-z]+|notif(?:y|ication)|updated|verifications?|credited)\b/i
##} TVD_PH_BODY_ACCOUNTS_PRE
##{ TVD_PH_REC
body TVD_PH_REC /\byour .{0,40}account .{0,40}record/i
describe TVD_PH_REC Message has a phrase standard for phishing mails
##} TVD_PH_REC
##{ TVD_PH_SEC
body TVD_PH_SEC /\byour .{0,40}account .{0,40}security/i
describe TVD_PH_SEC Message has a phrase standard for phishing mails
##} TVD_PH_SEC
##{ TVD_PH_SUBJ_ACCOUNTS_POST
header TVD_PH_SUBJ_ACCOUNTS_POST Subject =~ /\b(?:(?:re-?)?activat[a-z]*|secure|verify|restore|flagged|limited|unusual|update|report|notif(?:y|ication)|suspen(?:d|ded|sion)|co(?:n|m)firm[a-z]*) (?:[a-z_,-]+ )*?accounts?\b/i
##} TVD_PH_SUBJ_ACCOUNTS_POST
##{ TVD_PH_SUBJ_SEC_MEASURES
header TVD_PH_SUBJ_SEC_MEASURES Subject =~ /\bsecurity (?:[a-z_,-]+ )*?measures?\b/i
##} TVD_PH_SUBJ_SEC_MEASURES
##{ TVD_PH_SUBJ_URGENT
header TVD_PH_SUBJ_URGENT Subject =~ /^urgent(?:[\s\W]*$|.{1,40}(?:alert|response|assistance|proposal|reply|warning|noti(?:ce|fication)|greeting|matter))/i
##} TVD_PH_SUBJ_URGENT
##{ TVD_PP_PHISH
meta TVD_PP_PHISH __FROM_PAYPAL && NORMAL_HTTP_TO_IP
##} TVD_PP_PHISH
##{ TVD_QUAL_MEDS
body TVD_QUAL_MEDS /\bquality med(?:ication)?s\b/i
##} TVD_QUAL_MEDS
##{ TVD_RATWARE_CB
header TVD_RATWARE_CB Content-Type =~ /\bboundary\b.{1,40}qzsoft_directmail_seperator/i
##} TVD_RATWARE_CB
##{ TVD_RATWARE_CB_2
header TVD_RATWARE_CB_2 Content-Type =~ /\bboundary\s*=\s*"?-+\d+=+\.MRA/
##} TVD_RATWARE_CB_2
##{ TVD_RATWARE_MSGID_02
header TVD_RATWARE_MSGID_02 Message-ID =~ /^[^<]*<[a-z]+\@/
##} TVD_RATWARE_MSGID_02
##{ TVD_RCVD_IP
header TVD_RCVD_IP Received =~ /^from\s+(?:\d+[^0-9a-zA-Z\s]){3}\d+[.\s]/
##} TVD_RCVD_IP
##{ TVD_RCVD_IP4
header TVD_RCVD_IP4 Received =~ /^from\s+(?:\d+\.){3}\d+\s/
##} TVD_RCVD_IP4
##{ TVD_RCVD_SINGLE
header TVD_RCVD_SINGLE Received =~ /^from\s+(?!localhost)[^\s.a-z0-9-]+\s/
##} TVD_RCVD_SINGLE
##{ TVD_RCVD_SPACE_BRACKET
header TVD_RCVD_SPACE_BRACKET Received =~ /\(\[(?!UNIX:)[^\[\]]*\s/
##} TVD_RCVD_SPACE_BRACKET
##{ TVD_SECTION
body TVD_SECTION /\bSection (?:27A|21B)/i
##} TVD_SECTION
##{ TVD_SILLY_URI_OBFU
body TVD_SILLY_URI_OBFU m!https?://[a-z0-9-]+\.[a-z0-9-]*\.?[^a-z0-9.:/\s"'\@?\)>-]+[a-z0-9.-]*[a-z]{3}(?:\s|$)!i
##} TVD_SILLY_URI_OBFU
##{ TVD_SPACED_SUBJECT_WORD3
header TVD_SPACED_SUBJECT_WORD3 Subject =~ /^(?:(?:Re|Fw)[^:]{0,5}: )?[A-Z]+[a-z]+[A-Z]+$/
##} TVD_SPACED_SUBJECT_WORD3
##{ TVD_STOCK1 ifplugin Mail::SpamAssassin::Plugin::BodyEval
ifplugin Mail::SpamAssassin::Plugin::BodyEval
body TVD_STOCK1 eval:check_stock_info('2')
endif
##} TVD_STOCK1 ifplugin Mail::SpamAssassin::Plugin::BodyEval
##{ TVD_SUBJ_ACC_NUM
header TVD_SUBJ_ACC_NUM Subject =~ /\b[a-zA-Z]+ [\#\s]{1,4}\d+[A-Z]+/
describe TVD_SUBJ_ACC_NUM Subject has spammy looking monetary reference
##} TVD_SUBJ_ACC_NUM
##{ TVD_SUBJ_FINGER_03
header TVD_SUBJ_FINGER_03 Subject =~ /^\s*\*\s+(?:\w+\W+)+\*\s*$/
##} TVD_SUBJ_FINGER_03
##{ TVD_SUBJ_OWE
header TVD_SUBJ_OWE Subject =~ /^\s*(?:\w+\s+)+you\s+(?:\w+\s+)*(?:owe|indebted)\s+(?:\w+\s+)+an\s*other/i
##} TVD_SUBJ_OWE
##{ TVD_SUBJ_WIPE_DEBT
header TVD_SUBJ_WIPE_DEBT Subject =~ /(?:wipe out|remove|get (?:rid|out) of|eradicate) .{0,20}(?:owe|debt|obligation)/i
##} TVD_SUBJ_WIPE_DEBT
##{ TVD_VISIT_PHARMA
body TVD_VISIT_PHARMA /Online Ph.rmacy/i
##} TVD_VISIT_PHARMA
##{ TVD_VIS_HIDDEN
rawbody TVD_VIS_HIDDEN /<TEXTAREA[^>]+style\s*=\s*"visibility:\s*hidden\b/i
##} TVD_VIS_HIDDEN
##{ TWO_IPS_RCVD
meta TWO_IPS_RCVD __TWO_IPS_RCVD && !ALL_TRUSTED
describe TWO_IPS_RCVD Received: Relay identifies itself as wrong IP
##} TWO_IPS_RCVD
##{ T_AXB_MIME_IMG830 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader T_AXB_MIME_IMG830 Content-ID =~ /^<[0-9a-f]{30}\@/
describe T_AXB_MIME_IMG830 Valpolicella Fingerprint
endif
##} T_AXB_MIME_IMG830 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
##{ T_AXB_PDF_FUZZY1_OEM1 ifplugin Mail::SpamAssassin::Plugin::PDFInfo
ifplugin Mail::SpamAssassin::Plugin::PDFInfo
body T_AXB_PDF_FUZZY1_OEM1 eval:pdf_match_fuzzy_md5('2BDA96267AD8ED27FD583669CC76C4F7')
describe T_AXB_PDF_FUZZY1_OEM1 Fuzzy MD5 Match 2BDA96267AD8ED27FD583669CC76C4F7
#score T_AXB_PDF_FUZZY1_OEM1 5.0
endif
##} T_AXB_PDF_FUZZY1_OEM1 ifplugin Mail::SpamAssassin::Plugin::PDFInfo
##{ T_AXB_PDF_FUZZY1_OEM2 ifplugin Mail::SpamAssassin::Plugin::PDFInfo
ifplugin Mail::SpamAssassin::Plugin::PDFInfo
body T_AXB_PDF_FUZZY1_OEM2 eval:pdf_match_fuzzy_md5('CE46CE748DD314A742F7AEA05575F379')
describe T_AXB_PDF_FUZZY1_OEM2 Fuzzy MD5 Match CE46CE748DD314A742F7AEA05575F379
#score T_AXB_PDF_FUZZY1_OEM2 5.0
endif
##} T_AXB_PDF_FUZZY1_OEM2 ifplugin Mail::SpamAssassin::Plugin::PDFInfo
##{ T_DKIM_INVALID ifplugin Mail::SpamAssassin::Plugin::DKIM
ifplugin Mail::SpamAssassin::Plugin::DKIM
meta T_DKIM_INVALID __DKIM_EXISTS && !DKIM_VALID
describe T_DKIM_INVALID DKIM-Signature header exists but is not valid
endif
##} T_DKIM_INVALID ifplugin Mail::SpamAssassin::Plugin::DKIM
##{ T_DOS_OUTLOOK_TO_MX_IMAGE
meta T_DOS_OUTLOOK_TO_MX_IMAGE __ANY_OUTLOOK_MUA && !__OE_MUA && __DOS_DIRECT_TO_MX && __ANY_IMAGE_ATTACH
describe T_DOS_OUTLOOK_TO_MX_IMAGE Direct to MX with Outlook headers and an image
##} T_DOS_OUTLOOK_TO_MX_IMAGE
##{ T_DOS_ZIP_HARDCORE ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader T_DOS_ZIP_HARDCORE Content-Type =~ /^application\/zip;\sname="hardcore\.zip"$/
describe T_DOS_ZIP_HARDCORE hardcore.zip file attached; quite certainly a virus
# score T_DOS_ZIP_HARDCORE 2.5
endif
##} T_DOS_ZIP_HARDCORE ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
##{ T_DSCL4_PNG ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
mimeheader T_DSCL4_PNG Content-Type =~ /name\=\"DS[CL]\d{4,5}\.(?:png|PNG)\"/
describe T_DSCL4_PNG Digital camera filename is PNG
# score T_DSCL4_PNG 0.9 # 1.6->0.9 20091019 no recent hits
endif
##} T_DSCL4_PNG ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
##{ T_EMRCP
body T_EMRCP /\bExcess Maximum Return Capital Profit\b/i
describe T_EMRCP "Excess Maximum Return Capital Profit" Fidelity scam
##} T_EMRCP
##{ T_FILL_THIS_FORM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
meta T_FILL_THIS_FORM (FILL_THIS_FORM_LONG || __FILL_THIS_FORM_PARTIAL > 4 || __FILL_THIS_FORM_PARTIAL_RAW > 4)
describe T_FILL_THIS_FORM Fill in a form with personal information
# score T_FILL_THIS_FORM 1.00
endif
##} T_FILL_THIS_FORM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FILL_THIS_FORM_SHORT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
meta T_FILL_THIS_FORM_SHORT !T_FILL_THIS_FORM && (__FILL_THIS_FORM_SHORT || __FILL_THIS_FORM_PARTIAL > 2 || __FILL_THIS_FORM_PARTIAL_RAW > 2)
describe T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
# score T_FILL_THIS_FORM_SHORT 0.25
endif
##} T_FILL_THIS_FORM_SHORT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FREEMAIL_DOC_PDF ifplugin Mail::SpamAssassin::Plugin::FreeMail
ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta T_FREEMAIL_DOC_PDF (__DOC_ATTACH || __PDF_ATTACH) && (FREEMAIL_FROM || FREEMAIL_REPLYTO)
describe T_FREEMAIL_DOC_PDF MS document or PDF attachment, from freemail
# score T_FREEMAIL_DOC_PDF 1.0
endif
##} T_FREEMAIL_DOC_PDF ifplugin Mail::SpamAssassin::Plugin::FreeMail
##{ T_FREEMAIL_RVW_ATTCH ifplugin Mail::SpamAssassin::Plugin::FreeMail
ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta T_FREEMAIL_RVW_ATTCH (__PLS_REVIEW || __DLND_ATTACH) && T_FREEMAIL_DOC_PDF
describe T_FREEMAIL_RVW_ATTCH Please review attached document, from freemail
# score T_FREEMAIL_RVW_ATTCH 1.0
endif
##} T_FREEMAIL_RVW_ATTCH ifplugin Mail::SpamAssassin::Plugin::FreeMail
##{ T_FRM_SILVER_GOLD ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
meta T_FRM_SILVER_GOLD (__FRT_SILVER && __FRT_GOLD)
describe T_FRM_SILVER_GOLD ReplaceTags: Silver & Gold
endif
##} T_FRM_SILVER_GOLD ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FROM_MISSPACED
header T_FROM_MISSPACED From =~ /^\s*"[^"]*"</
describe T_FROM_MISSPACED From: missing whitespace
##} T_FROM_MISSPACED
##{ T_FRT_ABSOLUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_ABSOLUT /<inter SP2><post P2>\b(?!absolutely)<A><B><SX><O><L><U><TX><E><L><Y>/i
describe T_FRT_ABSOLUT ReplaceTags: Absolutely
endif
##} T_FRT_ABSOLUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_ADULT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_ADULT2 /<inter W0><post P2>\b(?!adult)<A><D><UX><L><TX>/i
describe T_FRT_ADULT2 ReplaceTags: Adult
endif
##} T_FRT_ADULT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_BEFORE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_BEFORE /<inter SP2><post P2>\b(?!before)<B><E><F><O><R><E>\b/i
describe T_FRT_BEFORE ReplaceTags: Before
endif
##} T_FRT_BEFORE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_BELOW2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_BELOW2 /<inter W0><post P2>\b(?!below)<B><E><L><O><WX>\b/i
describe T_FRT_BELOW2 ReplaceTags: Below (2)
endif
##} T_FRT_BELOW2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_CANSPAM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_CANSPAM /<inter SP2><post P2>\b(?!CAN<SP>SPAM)<C><A><N><SP><SX><P><A><M>/i
describe T_FRT_CANSPAM ReplaceTags: Can Spam
endif
##} T_FRT_CANSPAM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_CLICK ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_CLICK /<post P2>\b(?!click)<C><L><IX><C><K>\b/i
describe T_FRT_CLICK ReplaceTags: Click
endif
##} T_FRT_CLICK ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_COCK ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_COCK /<inter SP2><post P2>\b(?![cs]ock)<C><O><C><K>/i
describe T_FRT_COCK ReplaceTags: Cock
endif
##} T_FRT_COCK ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_CONTACT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_CONTACT /<inter SP2><post P2>\b(?!contr?act)<C><O><N><TX><A><C><TX>/i
describe T_FRT_CONTACT ReplaceTags: Contact
endif
##} T_FRT_CONTACT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_ERECTION ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_ERECTION /<inter SP2><post P2>(?!erection)<E><R><E><C><TX><IX><O><N>/i
describe T_FRT_ERECTION ReplaceTags: Erection
endif
##} T_FRT_ERECTION ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_ESTABLISH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_ESTABLISH /<inter SP2><post P2>\b(?!estabi?lish)<E><SX><TX><A><B><L><IX><SX><H>/i
describe T_FRT_ESTABLISH ReplaceTags: Establish
endif
##} T_FRT_ESTABLISH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_EXPERIENCE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_EXPERIENCE /<inter SP2><post P2>\b(?!experience)<E><X><P><E><R><IX><E><N><C><E>\b/i
describe T_FRT_EXPERIENCE ReplaceTags: Experience
endif
##} T_FRT_EXPERIENCE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_FOLLOW1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_FOLLOW1 /<inter SP2><post P2>\b(?!follow)<F><O><L><L><O><WX>/i
describe T_FRT_FOLLOW1 ReplaceTags: Follow
endif
##} T_FRT_FOLLOW1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_FOLLOW2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_FOLLOW2 /<inter W0><post P2>\b(?!follow)<F><O><L><L><O><WX>/i
describe T_FRT_FOLLOW2 ReplaceTags: Follow (2)
endif
##} T_FRT_FOLLOW2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_FREE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_FREE /<inter SP2><post P2>\b(?!free)<F><R><E><E>\b/i
describe T_FRT_FREE ReplaceTags: Free
endif
##} T_FRT_FREE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_FRIEND ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_FRIEND /<inter SP2><post P2>\b(?!friend)<F><R><IX><E><N><D>/i
describe T_FRT_FRIEND ReplaceTags: Friend
endif
##} T_FRT_FRIEND ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_FUCK1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_FUCK1 /<inter SP2><post P2>\b(?!fuck)<F><U><C><K>/i
describe T_FRT_FUCK1 ReplaceTags: Fuck (1)
endif
##} T_FRT_FUCK1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_HEALTH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_HEALTH /<inter SP2><post P2>\b(?!health)<H><E><A><L><TX><H>\b/i
describe T_FRT_HEALTH ReplaceTags: Health
endif
##} T_FRT_HEALTH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_HOUR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_HOUR /<inter SP2><post P2>\b(?!hour)<H><O><U><R>\b/i
describe T_FRT_HOUR ReplaceTags: Hour
endif
##} T_FRT_HOUR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_INCOME ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_INCOME /<inter SP2><post P2>\b(?!income)<IX><N><C><O><M><E>\b/i
describe T_FRT_INCOME ReplaceTags: Income
endif
##} T_FRT_INCOME ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_INTEREST ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_INTEREST /<inter SP2><post P2>\b(?!interest)<IX><N><TX><E><R><E><SX><TX>\b/i
describe T_FRT_INTEREST ReplaceTags: Interest
endif
##} T_FRT_INTEREST ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_LITTLE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_LITTLE /<inter SP2><post P2>\b(?!little)<L><IX><TX><TX><L><E>/i
describe T_FRT_LITTLE ReplaceTags: Little
endif
##} T_FRT_LITTLE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_LOLITA1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_LOLITA1 /<inter SP2><post P2>\b(?!lolita)<L><O><L><IX><TX><A>/i
describe T_FRT_LOLITA1 ReplaceTags: Lolita (1)
endif
##} T_FRT_LOLITA1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_OPPORTUN1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_OPPORTUN1 /<inter SP2><post P2>(?!opportun)<O><P><P><O><R><TX><U><N>/i
describe T_FRT_OPPORTUN1 ReplaceTags: Oppertun (1)
endif
##} T_FRT_OPPORTUN1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_PACKAGE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_PACKAGE /<inter SP2><post P2>\b(?!package)<P><A><C><K><A><GX><E>/i
describe T_FRT_PACKAGE ReplaceTags: Package
endif
##} T_FRT_PACKAGE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_PAYMENT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_PAYMENT /<inter W0>\b(?!payment)<P><A><Y><M><E><N><TX>/i
describe T_FRT_PAYMENT ReplaceTags: Payment
endif
##} T_FRT_PAYMENT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_PHARMAC ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_PHARMAC /<inter W0><post P2>(?!pharma[c\@])<P><H><A><R><M><A><C>/i
describe T_FRT_PHARMAC ReplaceTags: Pharmac
endif
##} T_FRT_PHARMAC ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_POSSIBLE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_POSSIBLE /<inter SP2><post P2>\b(?!possible)<P><O><SX><SX><IX><B><L><E>\b/i
describe T_FRT_POSSIBLE ReplaceTags: Possible
endif
##} T_FRT_POSSIBLE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_PROFILE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_PROFILE1 /<inter SP2><post P2>\b(?!profile)<P><R><O><F><IX><L><E>/i
describe T_FRT_PROFILE1 ReplaceTags: Profile (1)
endif
##} T_FRT_PROFILE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_PROFILE2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_PROFILE2 /<inter W0><post P2>\b(?!profile)<P><R><O><F><IX><L><E>/i
describe T_FRT_PROFILE2 ReplaceTags: Profile (2)
endif
##} T_FRT_PROFILE2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_PROFIT1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_PROFIT1 /<inter SP2><post P2>\b(?!profit)<P><R><O><F><IX><TX>/i
describe T_FRT_PROFIT1 ReplaceTags: Profit (1)
endif
##} T_FRT_PROFIT1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_PROFIT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_PROFIT2 /<inter W0><post P2>\b(?!profit)<P><R><O><F><IX><TX>/i
describe T_FRT_PROFIT2 ReplaceTags: Profit (2)
endif
##} T_FRT_PROFIT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_PUSSY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_PUSSY /<inter SP2><post P2>\b(?!pussy)<P><U><SX><SX><Y>/i
describe T_FRT_PUSSY ReplaceTags: Pussy
endif
##} T_FRT_PUSSY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_SLUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_SLUT /<inter SP2><post P2>\b(?!slut)<SX><L><U><TX>/
describe T_FRT_SLUT ReplaceTags: Slut
endif
##} T_FRT_SLUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_STOCK1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_STOCK1 /<inter SP2><post P2>\b(?!stock)<SX><TX><O><C><K>/i
describe T_FRT_STOCK1 ReplaceTags: Stock (1)
endif
##} T_FRT_STOCK1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_STOCK2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_STOCK2 /<inter W0><post P2>\b(?!stor?ck)<SX><TX><O><C><K>/i
describe T_FRT_STOCK2 ReplaceTags: Stock (2)
endif
##} T_FRT_STOCK2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FRT_VIRGIN1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FRT_VIRGIN1 /<inter SP2><post P2>(?!virgin)<V><IX><R><GX><IX><N><SX>?\b/i
describe T_FRT_VIRGIN1 ReplaceTags: Virgin (1)
endif
##} T_FRT_VIRGIN1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FSL_FAKE_HOTMAIL_RCVD
#score T_FSL_FAKE_HOTMAIL_RCVD 0.001
##} T_FSL_FAKE_HOTMAIL_RCVD
##{ T_FUZZY_OPTOUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FUZZY_OPTOUT /\b(?!opt.?out)<O><P><T>.?<O><U><T>\b/i
describe T_FUZZY_OPTOUT Obfuscated opt-out text
endif
##} T_FUZZY_OPTOUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_FUZZY_SPRM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FUZZY_SPRM /<inter W1><post P2><S><P><U><R><M>/i
endif
##} T_FUZZY_SPRM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_HK_NAME_DR ifplugin Mail::SpamAssassin::Plugin::FreeMail
ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta T_HK_NAME_DR __HK_NAME_DR && !FREEMAIL_FROM
endif
##} T_HK_NAME_DR ifplugin Mail::SpamAssassin::Plugin::FreeMail
##{ T_HK_NAME_FM_DR ifplugin Mail::SpamAssassin::Plugin::FreeMail
ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta T_HK_NAME_FM_DR __HK_NAME_DR && FREEMAIL_FROM
endif
##} T_HK_NAME_FM_DR ifplugin Mail::SpamAssassin::Plugin::FreeMail
##{ T_HK_NAME_FM_FROM ifplugin Mail::SpamAssassin::Plugin::FreeMail
ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta T_HK_NAME_FM_FROM __HK_NAME_FROM && FREEMAIL_FROM
endif
##} T_HK_NAME_FM_FROM ifplugin Mail::SpamAssassin::Plugin::FreeMail
##{ T_HK_NAME_FM_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail
ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta T_HK_NAME_FM_MR_MRS __HK_NAME_MR_MRS && FREEMAIL_FROM
endif
##} T_HK_NAME_FM_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail
##{ T_HK_NAME_FROM ifplugin Mail::SpamAssassin::Plugin::FreeMail
ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta T_HK_NAME_FROM __HK_NAME_FROM && !FREEMAIL_FROM
endif
##} T_HK_NAME_FROM ifplugin Mail::SpamAssassin::Plugin::FreeMail
##{ T_HK_NAME_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail
ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta T_HK_NAME_MR_MRS __HK_NAME_MR_MRS && !FREEMAIL_FROM
endif
##} T_HK_NAME_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail
##{ T_HK_SPAMMY_FILENAME ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
meta T_HK_SPAMMY_FILENAME __HK_SPAMMY_CTFN || __HK_SPAMMY_CDFN
endif
##} T_HK_SPAMMY_FILENAME ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
##{ T_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader T_HTML_ATTACH Content-Type =~ m,text/html;.+\.html?\b,i
describe T_HTML_ATTACH HTML attachment to bypass scanning?
endif
##} T_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
##{ T_IMAGE_MISMATCH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # { ifplugin Mail::SpamAssassin::Plugin::ImageInfo
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
ifplugin Mail::SpamAssassin::Plugin::ImageInfo
meta T_IMAGE_MISMATCH (__GIF_ATTACH && !__GIF_EXISTS) || (__PNG_ATTACH && !__PNG_EXISTS) || (__JPEG_ATTACH && !__JPEG_EXISTS)
describe T_IMAGE_MISMATCH Contains wrong image format for MIME header
endif
endif
##} T_IMAGE_MISMATCH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # { ifplugin Mail::SpamAssassin::Plugin::ImageInfo
##{ T_KHOP_FOREIGN_CLICK
describe T_KHOP_FOREIGN_CLICK Click here link in French or Spanish
##} T_KHOP_FOREIGN_CLICK
##{ T_KHOP_FOREIGN_CLICK if !plugin(Mail::SpamAssassin::Plugin::URIDetail)
if !plugin(Mail::SpamAssassin::Plugin::URIDetail)
rawbody T_KHOP_FOREIGN_CLICK m{\bhref=[^>]{9,199}>[^<]{0,80}(?:<(?!/a\b)[^>]{0,299}>[^<]{0,80}){0,9}[^<]{0,80}\b(?:cliquez\Wici\b|clic aqu[^<.,a ])}si
endif
##} T_KHOP_FOREIGN_CLICK if !plugin(Mail::SpamAssassin::Plugin::URIDetail)
##{ T_LFUZ_PWRMALE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_LFUZ_PWRMALE /<inter W1><post P2><P><O><W><E><R><M><A><L><E>/i
endif
##} T_LFUZ_PWRMALE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_LOTS_OF_MONEY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
meta T_LOTS_OF_MONEY (__LOTSA_MONEY_00 || __LOTSA_MONEY_01 || __LOTSA_MONEY_02 || __LOTSA_MONEY_03 || __LOTSA_MONEY_04 || __LOTSA_MONEY_05)
describe T_LOTS_OF_MONEY Huge... sums of money
# score T_LOTS_OF_MONEY 0.01
endif
##} T_LOTS_OF_MONEY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_LOTTO_AGENT_FM
header T_LOTTO_AGENT_FM From =~ /(?:claim(?:s|ing)?(?:\sprocessing)?|fiducia\w+|dispatch|reimbursement|prize\stransfer|(?:international|foreign)\sremittance)[\s_]?(?:agent|manager|officer|secretary)/i
describe T_LOTTO_AGENT_FM Claims Agent
#score T_LOTTO_AGENT_FM 0.50
##} T_LOTTO_AGENT_FM
##{ T_LOTTO_AGENT_RPLY
header T_LOTTO_AGENT_RPLY Reply-To =~ /(?:claim(?:s|ing)?(?:\sprocessing)?|fiducia\w+|dispatch|reimbursement|prize\stransfer|(?:international|foreign)\sremittance)[\s_]?(?:agent|manager|officer|secretary)/i
describe T_LOTTO_AGENT_RPLY Claims Agent
#score T_LOTTO_AGENT_RPLY 0.50
##} T_LOTTO_AGENT_RPLY
##{ T_LOTTO_DEPT
body T_LOTTO_DEPT /\b(?:claim(?:s|ing)?(?:\sprocessing)?|fiducia\w+|reimbursement|(?:international|foreign)\s(?:remittance|settlement)|payment|award)\s?(?:department|dept|unit|group|committee|bureau)/i
describe T_LOTTO_DEPT Claims Department
#score T_LOTTO_DEPT 0.50
##} T_LOTTO_DEPT
##{ T_LOTTO_URI
uri T_LOTTO_URI /(?:claim(?:s|ing)?(?:[-_]?processing)?|fiducia\w+|reimbursement|(?:international|foreign)?[-_]?remittance|award)[-_]?(?:department|dept|unit|group|committee|office|agent|manager|secretary)/i
describe T_LOTTO_URI Claims Department
#score T_LOTTO_URI 0.50
##} T_LOTTO_URI
##{ T_MIME_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
meta T_MIME_NO_TEXT (__CTYPE_MULTIPART_ANY && !__ANY_TEXT_ATTACH)
# score T_MIME_NO_TEXT 1.00
describe T_MIME_NO_TEXT No text body parts
endif
##} T_MIME_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
##{ T_MONEY_PERCENT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
meta T_MONEY_PERCENT T_LOTS_OF_MONEY && (__PCT_FOR_YOU || __PCT_OF_PMTS)
describe T_MONEY_PERCENT X% of a lot of money for you
endif
##} T_MONEY_PERCENT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_OBFU_ATTACH_MISSP ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
meta T_OBFU_ATTACH_MISSP __FROM_RUNON && (T_OBFU_HTML_ATTACH || T_OBFU_TEXT_ATTACH || T_OBFU_DOC_ATTACH || T_OBFU_PDF_ATTACH)
describe T_OBFU_ATTACH_MISSP Obfuscated attachment type and misspaced From
endif
##} T_OBFU_ATTACH_MISSP ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
##{ T_OBFU_DOC_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader T_OBFU_DOC_ATTACH Content-Type =~ m,application/octet-stream;.+\.(?:doc|rtf)\b,i
describe T_OBFU_DOC_ATTACH MS Document attachment with generic MIME type
# score T_OBFU_DOC_ATTACH 0.25
endif
##} T_OBFU_DOC_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
##{ T_OBFU_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader T_OBFU_HTML_ATTACH Content-Type =~ m,application/octet-stream;.+\.html?\b,i
describe T_OBFU_HTML_ATTACH HTML attachment with non-text MIME type
endif
##} T_OBFU_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
##{ T_OBFU_PDF_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader T_OBFU_PDF_ATTACH Content-Type =~ m,application/octet-stream;.+\.pdf\b,i
describe T_OBFU_PDF_ATTACH PDF attachment with generic MIME type
# score T_OBFU_PDF_ATTACH 0.25
endif
##} T_OBFU_PDF_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
##{ T_OBFU_TEXT_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader T_OBFU_TEXT_ATTACH Content-Type =~ m,application/octet-stream;.+\.txt\b,i
describe T_OBFU_TEXT_ATTACH Text attachment with non-text MIME type
endif
##} T_OBFU_TEXT_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
##{ T_RP_MATCHES_RCVD if version >= 3.003000 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
if version >= 3.003000
ifplugin Mail::SpamAssassin::Plugin::WLBLEval
header T_RP_MATCHES_RCVD eval:check_mailfrom_matches_rcvd()
describe T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
tflags T_RP_MATCHES_RCVD nice
endif
endif
##} T_RP_MATCHES_RCVD if version >= 3.003000 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
##{ T_SURBL_MULTI1 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
meta T_SURBL_MULTI1 ((URIBL_JP_SURBL + URIBL_SC_SURBL + URIBL_AB_SURBL + URIBL_OB_SURBL + URIBL_WS_SURBL) > 1)
endif
##} T_SURBL_MULTI1 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
##{ T_SURBL_MULTI2 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
meta T_SURBL_MULTI2 ((URIBL_JP_SURBL + URIBL_SC_SURBL + URIBL_AB_SURBL + URIBL_OB_SURBL + URIBL_WS_SURBL) > 2)
endif
##} T_SURBL_MULTI2 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
##{ T_SURBL_MULTI3 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
meta T_SURBL_MULTI3 ((URIBL_JP_SURBL + URIBL_SC_SURBL + URIBL_AB_SURBL + URIBL_OB_SURBL + URIBL_WS_SURBL) > 3)
endif
##} T_SURBL_MULTI3 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
##{ T_SURBL_MULTI4 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
meta T_SURBL_MULTI4 ((URIBL_JP_SURBL + URIBL_SC_SURBL + URIBL_AB_SURBL + URIBL_OB_SURBL + URIBL_WS_SURBL) > 4)
endif
##} T_SURBL_MULTI4 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
##{ T_TO_NO_BRKTS_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail
ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta T_TO_NO_BRKTS_FREEMAIL __TO_NO_ARROWS_R && (FREEMAIL_FROM || FREEMAIL_REPLYTO)
# score T_TO_NO_BRKTS_FREEMAIL 0.20
endif
##} T_TO_NO_BRKTS_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail
##{ T_TVD_FUZZY_SECTOR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_TVD_FUZZY_SECTOR /(?!sector)<S><E><C><T><O><R>/i
endif
##} T_TVD_FUZZY_SECTOR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_TVD_FUZZY_SECURITIES ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_TVD_FUZZY_SECURITIES /<inter W2><post P2>(?!securities)<S><E><C><U><R><I><T><I><E><S>/i
endif
##} T_TVD_FUZZY_SECURITIES ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ T_TVD_FW_GRAPHIC_ID2 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader T_TVD_FW_GRAPHIC_ID2 Content-Id =~ /<(?:[0-9A-F]{8}\.){3}[0-9A-F]{8}/
endif
##} T_TVD_FW_GRAPHIC_ID2 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
##{ T_TVD_MIME_EPI ifplugin Mail::SpamAssassin::Plugin::MIMEEval
ifplugin Mail::SpamAssassin::Plugin::MIMEEval
body T_TVD_MIME_EPI eval:check_msg_parse_flags('mime_epilogue_exists')
endif
##} T_TVD_MIME_EPI ifplugin Mail::SpamAssassin::Plugin::MIMEEval
##{ T_TVD_MIME_NO_HEADERS ifplugin Mail::SpamAssassin::Plugin::MIMEEval
ifplugin Mail::SpamAssassin::Plugin::MIMEEval
body T_TVD_MIME_NO_HEADERS eval:check_msg_parse_flags('missing_mime_headers')
endif
##} T_TVD_MIME_NO_HEADERS ifplugin Mail::SpamAssassin::Plugin::MIMEEval
##{ T_URIBL_BLACK_OVERLAP ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
meta T_URIBL_BLACK_OVERLAP (URIBL_BLACK && (URIBL_AB_SURBL || URIBL_JP_SURBL || URIBL_OB_SURBL || URIBL_WS_SURBL || URIBL_SC_SURBL))
endif
##} T_URIBL_BLACK_OVERLAP ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
##{ URIBL_RHS_DOB ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
urirhssub URIBL_RHS_DOB dob.sibl.support-intelligence.net A 2
body URIBL_RHS_DOB eval:check_uridnsbl('URIBL_RHS_DOB')
describe URIBL_RHS_DOB Contains an URI of a new domain (Day Old Bread)
tflags URIBL_RHS_DOB net
endif
##} URIBL_RHS_DOB ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
##{ URI_OBFU_WWW ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body URI_OBFU_WWW /(?<!http:\/\/)\b_*w{2,3}(?!\.[-\w]+\.(?:com|net|org|biz|info))[^[:alnum:]]{1,3}(?:<D><O><T>+[^[:alnum:]]{1,3})?[[:alnum:]][-\w]{1,20}[[:alnum:]](?!\.[[:alnum:]])[^[:alnum:]]{1,3}(?:<D><O><T>+[^[:alnum:]]{1,3})?(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g|b\s?i\s?z|i\s?n\s?f\s?o)_*\b/i
describe URI_OBFU_WWW Obfuscated URI
endif
##} URI_OBFU_WWW ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
##{ VANITY
meta VANITY (__KNOWN_VANITY && (__NO_COST + __INFORM_YOU + __INNERCIRCLE + __SHMUCK + __EXECS_PROS + __PUB_DEADLINE + __REGISTRY + __NOMINATION + __BIOGRAPHY + __ACCOLADES + __RECOGNITION + __DISTINGUISHED + __EXCELLENCE + __ACHIEVEMENT + __CBNVANITY > 3)) || (__BESTOFAWARD && (__SBCAVANITY || __USCAVANITY))
describe VANITY Vanity or fake awards
#score VANITY 2.3
##} VANITY
##{ XMAILER_MIMEOLE_OL_015D5
meta XMAILER_MIMEOLE_OL_015D5 (__XM_OL_015D5 && __MO_OL_015D5)
##} XMAILER_MIMEOLE_OL_015D5
##{ XMAILER_MIMEOLE_OL_07794
meta XMAILER_MIMEOLE_OL_07794 (__XM_OL_07794 && __MO_OL_07794)
##} XMAILER_MIMEOLE_OL_07794
##{ XMAILER_MIMEOLE_OL_09BB4
meta XMAILER_MIMEOLE_OL_09BB4 (__XM_OL_09BB4 && __MO_OL_09BB4)
##} XMAILER_MIMEOLE_OL_09BB4
##{ XMAILER_MIMEOLE_OL_1ECD5
meta XMAILER_MIMEOLE_OL_1ECD5 (__XM_OL_1ECD5 && __MO_OL_1ECD5)
##} XMAILER_MIMEOLE_OL_1ECD5
##{ XMAILER_MIMEOLE_OL_20C99
meta XMAILER_MIMEOLE_OL_20C99 (__XM_OL_20C99 && __MO_OL_20C99)
##} XMAILER_MIMEOLE_OL_20C99
##{ XMAILER_MIMEOLE_OL_22B61
meta XMAILER_MIMEOLE_OL_22B61 (__XM_OL_22B61 && __MO_OL_22B61)
##} XMAILER_MIMEOLE_OL_22B61
##{ XMAILER_MIMEOLE_OL_25340
meta XMAILER_MIMEOLE_OL_25340 (__XM_OL_25340 && __MO_OL_25340)
##} XMAILER_MIMEOLE_OL_25340
##{ XMAILER_MIMEOLE_OL_32D97
meta XMAILER_MIMEOLE_OL_32D97 (__XM_OL_32D97 && __MO_OL_32D97)
##} XMAILER_MIMEOLE_OL_32D97
##{ XMAILER_MIMEOLE_OL_3857F
meta XMAILER_MIMEOLE_OL_3857F (__XM_OL_3857F && __MO_OL_3857F)
##} XMAILER_MIMEOLE_OL_3857F
##{ XMAILER_MIMEOLE_OL_3AC1D
meta XMAILER_MIMEOLE_OL_3AC1D (__XM_OL_3AC1D && __MO_OL_3AC1D)
##} XMAILER_MIMEOLE_OL_3AC1D
##{ XMAILER_MIMEOLE_OL_3D61D
meta XMAILER_MIMEOLE_OL_3D61D (__XM_OL_3D61D && __MO_OL_3D61D)
##} XMAILER_MIMEOLE_OL_3D61D
##{ XMAILER_MIMEOLE_OL_465CD
meta XMAILER_MIMEOLE_OL_465CD (__XM_OL_465CD && __MO_OL_465CD)
##} XMAILER_MIMEOLE_OL_465CD
##{ XMAILER_MIMEOLE_OL_4B815
meta XMAILER_MIMEOLE_OL_4B815 (__XM_OL_4B815 && __MO_OL_4B815)
##} XMAILER_MIMEOLE_OL_4B815
##{ XMAILER_MIMEOLE_OL_4BF4C
meta XMAILER_MIMEOLE_OL_4BF4C (__XM_OL_4BF4C && __MO_OL_4BF4C)
##} XMAILER_MIMEOLE_OL_4BF4C
##{ XMAILER_MIMEOLE_OL_4EEDB
meta XMAILER_MIMEOLE_OL_4EEDB (__XM_OL_4EEDB && __MO_OL_4EEDB)
##} XMAILER_MIMEOLE_OL_4EEDB
##{ XMAILER_MIMEOLE_OL_4F240
meta XMAILER_MIMEOLE_OL_4F240 (__XM_OL_4F240 && __MO_OL_4F240)
##} XMAILER_MIMEOLE_OL_4F240
##{ XMAILER_MIMEOLE_OL_58CB5
meta XMAILER_MIMEOLE_OL_58CB5 (__XM_OL_58CB5 && __MO_OL_58CB5)
##} XMAILER_MIMEOLE_OL_58CB5
##{ XMAILER_MIMEOLE_OL_5B79A
meta XMAILER_MIMEOLE_OL_5B79A (__XM_OL_5B79A && __MO_OL_5B79A)
##} XMAILER_MIMEOLE_OL_5B79A
##{ XMAILER_MIMEOLE_OL_6554A
meta XMAILER_MIMEOLE_OL_6554A (__XM_OL_6554A && __MO_OL_6554A)
##} XMAILER_MIMEOLE_OL_6554A
##{ XMAILER_MIMEOLE_OL_72641
meta XMAILER_MIMEOLE_OL_72641 (__XM_OL_72641 && __MO_OL_72641)
##} XMAILER_MIMEOLE_OL_72641
##{ XMAILER_MIMEOLE_OL_7533E
meta XMAILER_MIMEOLE_OL_7533E (__XM_OL_7533E && __MO_OL_7533E)
##} XMAILER_MIMEOLE_OL_7533E
##{ XMAILER_MIMEOLE_OL_812FF
meta XMAILER_MIMEOLE_OL_812FF (__XM_OL_812FF && __MO_OL_812FF)
##} XMAILER_MIMEOLE_OL_812FF
##{ XMAILER_MIMEOLE_OL_83BF7
meta XMAILER_MIMEOLE_OL_83BF7 (__XM_OL_83BF7 && __MO_OL_83BF7)
##} XMAILER_MIMEOLE_OL_83BF7
##{ XMAILER_MIMEOLE_OL_8627E
meta XMAILER_MIMEOLE_OL_8627E (__XM_OL_8627E && __MO_OL_8627E)
##} XMAILER_MIMEOLE_OL_8627E
##{ XMAILER_MIMEOLE_OL_8E893
meta XMAILER_MIMEOLE_OL_8E893 (__XM_OL_8E893 && __MO_OL_8E893)
##} XMAILER_MIMEOLE_OL_8E893
##{ XMAILER_MIMEOLE_OL_91287
meta XMAILER_MIMEOLE_OL_91287 (__XM_OL_91287 && __MO_OL_91287)
##} XMAILER_MIMEOLE_OL_91287
##{ XMAILER_MIMEOLE_OL_9B90B
meta XMAILER_MIMEOLE_OL_9B90B (__XM_OL_9B90B && __MO_OL_9B90B)
##} XMAILER_MIMEOLE_OL_9B90B
##{ XMAILER_MIMEOLE_OL_A50F8
meta XMAILER_MIMEOLE_OL_A50F8 (__XM_OL_A50F8 && __MO_OL_A50F8)
##} XMAILER_MIMEOLE_OL_A50F8
##{ XMAILER_MIMEOLE_OL_A842E
meta XMAILER_MIMEOLE_OL_A842E (__XM_OL_A842E && __MO_OL_A842E)
##} XMAILER_MIMEOLE_OL_A842E
##{ XMAILER_MIMEOLE_OL_ADFF7
meta XMAILER_MIMEOLE_OL_ADFF7 (__XM_OL_ADFF7 && __MO_OL_ADFF7)
##} XMAILER_MIMEOLE_OL_ADFF7
##{ XMAILER_MIMEOLE_OL_B30D1
meta XMAILER_MIMEOLE_OL_B30D1 (__XM_OL_B30D1 && __MO_OL_B30D1)
##} XMAILER_MIMEOLE_OL_B30D1
##{ XMAILER_MIMEOLE_OL_B4B40
meta XMAILER_MIMEOLE_OL_B4B40 (__XM_OL_B4B40 && __MO_OL_B4B40)
##} XMAILER_MIMEOLE_OL_B4B40
##{ XMAILER_MIMEOLE_OL_B9B11
meta XMAILER_MIMEOLE_OL_B9B11 (__XM_OL_B9B11 && __MO_OL_B9B11)
##} XMAILER_MIMEOLE_OL_B9B11
##{ XMAILER_MIMEOLE_OL_BC7E6
meta XMAILER_MIMEOLE_OL_BC7E6 (__XM_OL_BC7E6 && __MO_OL_BC7E6)
##} XMAILER_MIMEOLE_OL_BC7E6
##{ XMAILER_MIMEOLE_OL_C65FA
meta XMAILER_MIMEOLE_OL_C65FA (__XM_OL_C65FA && __MO_OL_C65FA)
##} XMAILER_MIMEOLE_OL_C65FA
##{ XMAILER_MIMEOLE_OL_CAC8F
meta XMAILER_MIMEOLE_OL_CAC8F (__XM_OL_CAC8F && __MO_OL_CAC8F)
##} XMAILER_MIMEOLE_OL_CAC8F
##{ XMAILER_MIMEOLE_OL_CF0C0
meta XMAILER_MIMEOLE_OL_CF0C0 (__XM_OL_CF0C0 && __MO_OL_CF0C0)
##} XMAILER_MIMEOLE_OL_CF0C0
##{ XMAILER_MIMEOLE_OL_EF20B
meta XMAILER_MIMEOLE_OL_EF20B (__XM_OL_EF20B && __MO_OL_EF20B)
##} XMAILER_MIMEOLE_OL_EF20B
##{ XMAILER_MIMEOLE_OL_EF222
meta XMAILER_MIMEOLE_OL_EF222 (__XM_OL_EF222 && __MO_OL_EF222)
##} XMAILER_MIMEOLE_OL_EF222
##{ XMAILER_MIMEOLE_OL_F3B05
meta XMAILER_MIMEOLE_OL_F3B05 (__XM_OL_F3B05 && __MO_OL_F3B05)
##} XMAILER_MIMEOLE_OL_F3B05
##{ XMAILER_MIMEOLE_OL_F475E
meta XMAILER_MIMEOLE_OL_F475E (__XM_OL_F475E && __MO_OL_F475E)
##} XMAILER_MIMEOLE_OL_F475E
##{ XMAILER_MIMEOLE_OL_F6D01
meta XMAILER_MIMEOLE_OL_F6D01 (__XM_OL_F6D01 && __MO_OL_F6D01)
##} XMAILER_MIMEOLE_OL_F6D01
##{ XMAILER_MIMEOLE_OL_FF5C8
meta XMAILER_MIMEOLE_OL_FF5C8 (__XM_OL_FF5C8 && __MO_OL_FF5C8)
##} XMAILER_MIMEOLE_OL_FF5C8
##{ X_MAILER_CME_6543_MSN
header X_MAILER_CME_6543_MSN X-Mailer =~ /^CME-V6\.5\.4\.3; MSN\s*$/
##} X_MAILER_CME_6543_MSN
##{ ifplugin Mail::SpamAssassin::Plugin::ReplaceTags_sandbox
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
replace_rules __FRT_GOLD
replace_rules __FRT_SILVER
replace_inter W0 \w?
replace_inter SP2 [\s\d_*\$\%(),.:;?!}{\[\]|\/?^\#~\xa1`'+-]?
replace_tag GX [gk6]
replace_tag IX [ilt|!1y?\xcc\xcd\xce\xcf\xec\xed\xee\xef]
replace_tag SX [sz5\xa6\xa7]
replace_tag TX [t|]
replace_tag UX [u\xb5\xd9\xda\xdb\xdc\xfc\xfb\xfa\xf9\xfd]
replace_tag WX (?:[wv]|vv)
replace_rules T_FRT_ABSOLUT
replace_rules FRT_ADOBE2
replace_rules T_FRT_ADULT2
replace_rules FRT_APPROV
replace_rules T_FRT_BEFORE
replace_rules T_FRT_BELOW2
replace_rules FRT_BIGGERMEM1
replace_rules T_FRT_CANSPAM
replace_rules T_FRT_CLICK
replace_rules T_FRT_COCK
replace_rules T_FRT_CONTACT
replace_rules FRT_DIPLOMA
replace_rules FRT_DISCOUNT
replace_rules FRT_DOLLAR
replace_rules T_FRT_ERECTION
replace_rules T_FRT_ESTABLISH
replace_rules FRT_ESTABLISH2
replace_rules T_FRT_EXPERIENCE
replace_rules T_FRT_FOLLOW1
replace_rules T_FRT_FOLLOW2
replace_rules T_FRT_FREE
replace_rules T_FRT_FRIEND
replace_rules T_FRT_FUCK1
replace_rules FRT_FUCK2
replace_rules FRT_GUARANTEE1
replace_rules T_FRT_HEALTH
replace_rules T_FRT_HOUR
replace_rules T_FRT_INCOME
replace_rules T_FRT_INTEREST
replace_rules FRT_INVESTOR
replace_rules FRT_LEVITRA
replace_rules T_FRT_LITTLE
replace_rules T_FRT_LOLITA1
replace_rules FRT_MEETING
replace_rules FRT_OFFER2
replace_rules T_FRT_OPPORTUN1
replace_rules FRT_OPPORTUN2
replace_rules T_FRT_PACKAGE
replace_rules T_FRT_PAYMENT
replace_rules FRT_PENIS1
replace_rules T_FRT_PHARMAC
replace_rules T_FRT_POSSIBLE
replace_rules FRT_PRICE
replace_rules T_FRT_PROFILE1
replace_rules T_FRT_PROFILE2
replace_rules T_FRT_PROFIT1
replace_rules T_FRT_PROFIT2
replace_rules T_FRT_PUSSY
replace_rules FRT_REFINANCE1
replace_rules FRT_ROLEX
replace_rules FRT_SEXUAL
replace_rules T_FRT_SLUT
replace_rules FRT_SOMA
replace_rules FRT_SOMA2
replace_rules T_FRT_STOCK1
replace_rules T_FRT_STOCK2
replace_rules FRT_STRONG1
replace_rules FRT_STRONG2
replace_rules FRT_SYMBOL
replace_rules FRT_TODAY2
replace_rules FRT_VALIUM1
replace_rules FRT_VALIUM2
replace_rules T_FRT_VIRGIN1
replace_rules FRT_WEIGHT2
replace_rules FRT_XANAX1
replace_rules FRT_XANAX2
replace_rules T_FUZZY_SPRM
replace_rules FUZZY_MERIDIA
replace_rules TVD_FUZZY_PHARMACEUTICAL
replace_rules TVD_FUZZY_SYMBOL
replace_rules T_TVD_FUZZY_SECURITIES
replace_rules TVD_FUZZY_FINANCE
replace_rules TVD_FUZZY_FIXED_RATE
replace_rules TVD_FUZZY_MICROCAP
replace_rules T_TVD_FUZZY_SECTOR
replace_rules TVD_FUZZY_DEGREE
replace_tag FF_LNNO (?:(?:\d+[)}\]:.,]+|\W?\(\d+\)|\W?\{\d+\}|\[\d+\]|\*{1,5}|\#{1,5}|[A-K][)}\]:.,])\s?)
replace_tag FF_YOUR (?:a?\s?copy\sof\s)?(?:your[\s,:]{1,5})?(?:present\s|c[uo]rrent\s|full\s?|complete\s|direct\s|private\s|valid\s|personal\s){0,3}
replace_tag ANDOR (?:\s?[\/&+,]\s?|\sor\s|\sand\s)
replace_tag NUMBER (?:num(?:ber)?s?|nos?\.|no\b|\#s?|nbrs?\.?)
replace_tag FF_SUFFIX (?:\sin\s(?:full|words))?:?(?:\s?[({][^)}]{1,30}[)}])?
replace_tag FF_BLANK1 (?:[\s:;]{0,4}(?:(?:[-=_.,:;*]|&\#\d+;){3,80}\s?){1,})
replace_tag FF_BLANK2 (?:[\s\W]{0,3}(?:[-=_.,:;*]|&\#\d+;){1,80}\s?)
replace_tag FF_A1 (?:(?:ad+res+e?|countr?y|st?ates?|city|province|ter+itory|(?:zip|postal)(?:\s?code)?)<ANDOR>?){1,3}(?:\sof\s(?:residence|birth|employment|citizenship|origin))?
replace_tag FF_A2 (?:(?:contact|e-?mail|full|house|home|resident[ia]+l|business|mailing|work|office|delivery|ship+ing|post(?:al)?)<ANDOR>?){0,3}\s?(?:ad+res+(?:es)?|location)(?:\sline)?(?:\s[0-9])?
replace_tag FF_N1 (?:company|first|last|all|business|legal|ben[ei]ficiary)?\s?names?(?:<ANDOR>ad+res+)?
replace_tag FF_P1 (?:(?:(?:business|contact|fax|voice|cel+(?:ular)?|house|home|mobile|office|tel+e?(?:\s?phone)?|phone)(?:\sphone)?<ANDOR>?){1,3}(?:\s<NUMBER>)?<ANDOR>?){1,3}
replace_tag FF_M1 (?:(?:age|marital\s?statu[se]|sex|gender|male\sor\sfemale|(?:date\sof\s)?birth|religion|nationality|email|next\sof\skin)<ANDOR>?){1,3}
replace_tag FF_L1 (?:(?:previous\s)?work(?:ing)\s?experience|employment|position|profession|occup[ae]tion(?:\/position)?|(?:monthly|annual)?\s?income|annual\sturn\s?over|purpose\sof\sl(?:oa|ao)n|l(?:oa|ao)n\sduration|(?:l(?:oa|ao)n\s|the\s)?amount(?:\sneed(ed)?|\sdesired)?(?:\s(?:as|of)\sloan)?)
replace_tag FF_F1 (?:(?:bank|beneficiary|billing|acc(?:oun)?t|a\/c|rout(?:ing)?|swift|receiver|user)<ANDOR>?){1,3}\s(?:(?:name|ad+res+(?:es)?|location|code|details|<NUMBER>)<ANDOR>?){1,3}
replace_tag FF_F2 (?:(?:(?:international\s)?driver'?s?\sli[sc]+(:?en[sc]e)?|pass\s?port|[ia]d(?:entification|entity)(?:\s(?:card|<NUMBER>|papers?))?|id\scard)<ANDOR>?){1,3}(?:\s<NUMBER>)?
replace_tag FF_F3 (?:picture|(?:e-?mail\s)?password|e-?mai?l\sid|test\squestion|answer|amount\swon|(?:inheritance\s)?funds?\svalue|amount\s[\w\s]{0,30}lost[\w\s]{0,15})
replace_tag FF_F4 (?:log[-\s]?in|(?:e-?mail\s)?user)\s?names?
replace_tag FF_F5 (?:reference|batch|winning)\s?<NUMBER>
replace_tag FF_ALL (?:<FF_A1>|<FF_A2>|<FF_N1>|<FF_P1>|<FF_M1>|<FF_L1>|<FF_F1>|<FF_F2>|<FF_F3>|<FF_F4>|<FF_F5>)
replace_rules FILL_THIS_FORM_LONG
replace_rules __FILL_THIS_FORM_PARTIAL
replace_rules __FILL_THIS_FORM_PARTIAL_RAW
replace_rules __FILL_THIS_FORM_SHORT
replace_rules __FILL_THIS_FORM_LOAN
replace_rules __FILL_THIS_FORM_FRAUD_PHISH
replace_tag CURRENCY [\(\[]?(?:\bUS[D\$]{0,2}|\$(?:US)?|usd|GBP|=[Aa][34]|\xa3|&\#16[34];|(?i:pounds\ssterling)|\xa4|EUR|[Ee]uros?|(?i:eur)\sde|CHF)[\]\)]?
replace_tag GB_UK \b(?:U\.?K\.?|(?:Great\s)?Brit(?:ain|ish)|G\.?B\.?)\b
replace_rules __LOTSA_MONEY_00 __LOTSA_MONEY_01 __LOTSA_MONEY_02 __LOTSA_MONEY_03 __LOTSA_MONEY_04
replace_tag PERCENT \b(?:\d\d|ten|[a-z]+teen|(?:twen|thir|fou?r)ty(?:-?[a-z]+)?)\s?(?:%|percent)
replace_rules __PCT_FOR_YOU_1 __PCT_FOR_YOU_2 __PCT_FOR_YOU_3 __PCT_OF_PMTS
replace_rules T_FUZZY_OPTOUT
replace_rules URI_OBFU_WWW
replace_rules T_LFUZ_PWRMALE
endif
##} ifplugin Mail::SpamAssassin::Plugin::ReplaceTags_sandbox
##{ ifplugin Mail::SpamAssassin::Plugin::URIDetail_sandbox
ifplugin Mail::SpamAssassin::Plugin::URIDetail
uri_detail T_KHOP_FOREIGN_CLICK text =~ /\b(?:cliquez\Wici\b|clic aqu[^<.,a ])/i
endif
##} ifplugin Mail::SpamAssassin::Plugin::URIDetail_sandbox
##{ redirector_pattern_sandbox
redirector_pattern /^http\:\/\/sun\.com\/cgi\-bin\/go\.cgi\?dest\=(.*)$/i
redirector_pattern /^http\:\/\/www\.att\.net\/s\/context\.dll\?redirecturl\=(.*)$/i
redirector_pattern m'/(?:index.php)?\?.*(?<=[?&])URL=(.*?)(?:$|[&\#])'i
redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/url\?.*?(?<=[?&])q=(.*?)(?:$|[&\#])'i
redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/search\?.*?(?<=[?&])q=[^&]*?(?<=%20|..[=+\s])(?:site|inurl):(.*?)(?:$|%20|[\s+&\#])'i
redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/search\?.*?(?<=[?&])q=[^&]*?(?<=%20|..[=+\s])(?:"|%22)(.*?)(?:$|%22|["\s+&\#])'i
redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/translate\?.*?(?<=[?&])u=(.*?)(?:$|[&\#])'i
redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/pagead/iclk\?.*?(?<=[?&])adurl=(.*?)(?:$|[&\#])'i
redirector_pattern m'^http:/*(?:\w+\.)?aol\.com/redir\.adp\?.*(?<=[?&])_url=(.*?)(?:$|[&\#])'i
redirector_pattern m'^https?/*(?:\w+\.)?facebook\.com/l/;(.*)'i
##} redirector_pattern_sandbox
body __ACCOLADES /\baccolades?\b/i
body __ACHIEVEMENT /\bbenchmark of achievement\b/i
body __AFF_004470_NUMBER /(?:\+|00|011)\W{0,3}44\W{0,3}0?\W{0,3}70/
body __AFF_LOTTERY /(?:lottery|winner)/i
meta __AFRICAN_STATE (__NIGERIA || __IVORY_COAST || __BURKINA_FASO || __GHANA)
body __AFR_UNION /\bafrican\sunion\b/i
body __AGREED_RATIO /\b(?:agreed|sharing)\s(?:ratios?|percent\w+)\b/i
body __AM_DYING /\bam\s(?:\S+\s)?dying\b/i
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __ANY_IMAGE_ATTACH Content-Type =~ /image\/(?:gif|jpeg|png)/
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __ANY_TEXT_ATTACH Content-Type =~ /text\/\w+/i
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __ANY_TEXT_ATTACH_DOC Content-Type =~ /text\/\w+/i
endif
body __APPROVALFVGT /approval/i
body __ATM_CARD /\b(?:your|the|this)\s(?:atm|debit)(?:\smaster|swift)?\scard/i
body __BACHELORS /Bachelor/i
body __BACK_SCRATCH /\bmutual+y?\sbenefi(?:t|cial)\b/i
body __BANK_DRAFT /\bbank\sdraft/i
body __BARRISTER /\b(?:barrister|solicitor at law|barr\.)/i
body __BESTOFAWARD /\bBest of \w+ Award/
body __BIGDOLLARSFVGT /\$\d{2,3},\d{3}/
body __BIOGRAPHY /\b(?:biography|biographies|biographical)\b/i
body __BODY_STARTS_WITH_FROM_LINE /^From \S+ \S\S\S \S\S\S .. ..:..:.. \S+\s+\S+\: /s
body __BURKINA_FASO /\bburkina\s?faso\b/i
body __CASHPRZ /cash prize of/
body __CBNVANITY /\bContinental Broadcasting Network\b/
body __CHARITY /\bcharit(?:y|[ai]ble)\b/i
body __COMPENSATION /\b(?:compensat(?:e|ion)|recompensed?)\b/i
body __CONTACT_ATTY /\bcontact\smy\s(?:barrister|attou?rney)\b/i
body __CONTACT_YOU /\bcontacting\syou\b/i
body __COURIER /\bcourier\s(?:company|service)\b/i
body __CS_WORD /\bC[A-Za-z]{2,4}IS\b/
header __CTYPE_MULTIPART_ANY Content-Type =~ /multipart\/\w+/i
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __CTYPE_ONETAB_GIF Content-Type:raw =~ /^image\/gif;\n\tname=\".+?\"$/s
endif
header __DATE_700 Date =~ /-0700/
body __DBLCLAIM /avoid double claiming/
body __DEAD_PARENT /\bmy\s(?:deceased|dead)\s(?:father|mother)/i
body __DEAL /\b(?:business|financial|this|the|mutual|die(?:se)?|cette)\s(?:deal|transa[ck]tion|proposal|offer|venture|suggestion|partnership)/i
body __DECEASED /\b(?:the|my|der)\s(?:deceased|late|verstorbenen)\b/i
body __DESTROY_ME /\b(?:destroy|hunt)\sm[ey]\b/i
body __DIED_IN /\bdied\sin\b/i
body __DIPLOMA /diploma/i
body __DIPLOMATIC /\bdiplomatic\b/i
body __DISTINGUISHED /\bdistinguished\b/i
header __DKIM_EXISTS exists:DKIM-Signature
if !plugin(Mail::SpamAssassin::Plugin::SPF)
if !plugin(Mail::SpamAssassin::Plugin::DKIM)
header __DKIM_EXISTS exists:DKIM-Signature
endif
endif
body __DLND_ATTACH /\bdownload\sthe\sattach(?:ed|ment)\b/i
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
meta __DOC_ATTACH (__DOC_ATTACH_MT || __DOC_ATTACH_FN1 || __DOC_ATTACH_FN2)
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __DOC_ATTACH_FN1 Content-Type =~ /="[^"]+\.(?:docx?|rtf)"/i
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __DOC_ATTACH_FN2 Content-Disposition =~ /="[^"]+\.(?:docx?|rtf)"/i
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __DOC_ATTACH_MT Content-Type =~ m,\bapplication/(?:msword|rtf|vnd\.ms-word|vnd\.openxmlformats-officedocument\.wordprocessingml\.document)\b,i
endif
body __DORMANT_ACCT /\b(?:dormant|abandoned|left\s?over)\s(?:account|fund|transaction|sum)/i
body __DOS_BODY_FRI /\bfri(?:day)?\b/i
body __DOS_BODY_MON /\bmon(?:day)?\b/i
body __DOS_BODY_SAT /\bsat(?:day)?\b/i
body __DOS_BODY_STOCK /\bstock\b/i
body __DOS_BODY_SUN /\bsun(?:day)?\b/i
body __DOS_BODY_THU /\bthu(?:r(?:s(?:day)?)?)?\b/i
body __DOS_BODY_TICKER /\b[A-Z]{4}\.(?:OB|PK)\b/
body __DOS_BODY_TUE /\btue(?:s(?:day)?)?\b/i
body __DOS_BODY_WED /\bwed(?:nesday)?\b/i
body __DOS_COMING_TO_YOUR_PLACE /I (?:am|might(?: be)?) c[a-z]?o[a-z]?m[a-z]?(?:i[a-z]?n[a-z]?g[a-z]{0,2}|e down) to y[!a-z]{2,4}r (?:city|place[a-z]{0,2}|co[a-z]?u[a-z]?n[a-z]?t[a-z]?ry) in (?:f[a-z]?e[a-z]?w|\d{1,2}) (?:day|week)s/
body __DOS_CORRESPOND_EMAIL /correspond with me using my email/
meta __DOS_DIRECT_TO_MX __DOS_SINGLE_EXT_RELAY && !__DOS_HAS_LIST_ID && !__DOS_HAS_LIST_UNSUB && !__DOS_HAS_MAILING_LIST && !__DOS_RELAYED_EXT
body __DOS_DROP_ME_A_LINE /Drop me a line at/
body __DOS_EMAIL_DIRECTLY /(?:Email m[a-z]?e|address) direc(?:tl|lt)y at/
body __DOS_FIN_ADVANTAGE /\bfinancial advantage/i
uri __DOS_HAS_ANY_URI /./
header __DOS_HAS_LIST_ID exists:List-ID
header __DOS_HAS_LIST_UNSUB exists:List-Unsubscribe
header __DOS_HAS_MAILING_LIST exists:Mailing-List
body __DOS_HI /^Hi,$/
body __DOS_I_AM_25 /I a.?m 25/
body __DOS_I_DRIVE_A /I drive a/
body __DOS_LET_GO_JOB /I was (?:let go|fired|layed off|dismissed) from a job I h(?:el|a)d for (?:2\d years|\d{3} months)/
body __DOS_LINK /\blink\b/
body __DOS_MEET_EACH_OTHER /(?:meet each other|[Mm]ay ?be we can meet)/
body __DOS_MY_OLD_JOB /my old job/
body __DOS_PERSONAL_EMAIL /personal email at/
header __DOS_RCVD_FRI Received =~ / Fri, /
header __DOS_RCVD_MON Received =~ / Mon, /
header __DOS_RCVD_SAT Received =~ / Sat, /
header __DOS_RCVD_SUN Received =~ / Sun, /
header __DOS_RCVD_THU Received =~ / Thu, /
header __DOS_RCVD_TUE Received =~ / Tue, /
header __DOS_RCVD_WED Received =~ / Wed, /
meta __DOS_REF_2_WK_DAYS (__DOS_RCVD_MON && __DOS_BODY_WED) || (__DOS_RCVD_TUE && __DOS_BODY_THU) || (__DOS_RCVD_WED && __DOS_BODY_FRI) || (__DOS_RCVD_THU && __DOS_BODY_MON) || (__DOS_RCVD_FRI && __DOS_BODY_TUE) || (__DOS_RCVD_SAT && __DOS_BODY_TUE) || (__DOS_RCVD_SUN && __DOS_BODY_TUE)
meta __DOS_REF_NEXT_WK_DAY (__DOS_RCVD_MON && __DOS_BODY_TUE) || (__DOS_RCVD_TUE && __DOS_BODY_WED) || (__DOS_RCVD_WED && __DOS_BODY_THU) || (__DOS_RCVD_THU && __DOS_BODY_FRI) || (__DOS_RCVD_FRI && __DOS_BODY_MON) || (__DOS_RCVD_SAT && __DOS_BODY_MON) || (__DOS_RCVD_SUN && __DOS_BODY_MON)
meta __DOS_REF_TODAY (__DOS_RCVD_MON && __DOS_BODY_MON) || (__DOS_RCVD_TUE && __DOS_BODY_TUE) || (__DOS_RCVD_WED && __DOS_BODY_WED) || (__DOS_RCVD_THU && __DOS_BODY_THU) || (__DOS_RCVD_FRI && __DOS_BODY_FRI) || (__DOS_RCVD_SAT && __DOS_BODY_SAT) || (__DOS_RCVD_SUN && __DOS_BODY_SUN)
header __DOS_RELAYED_EXT ALL-EXTERNAL =~ /(?:^|\n)[Rr][eE][cC][eE][iI][vV][eE][dD]:\s.+\n[Rr][eE][cC][eE][iI][vV][eE][dD]:\s/s
header __DOS_SINGLE_EXT_RELAY X-Spam-Relays-External =~ /^\[ [^\]]+ \]$/
body __DOS_STEADY_COURSE /\bsteady (?:and increasing )?course\b/i
body __DOS_STRONG_CF /\bstrong cash flow/i
body __DOS_TAKING_HOME /Taking home \d (?:digit level|figures) in \d{1,2} months/
body __DOS_WRITE_ME_AT /[Ww].?r.?i.?t.?e me at/
body __DPHPVANITY /\bDistinguished Professionals Hardcover Publication\b/
body __EARLY_DEMISE /\buntimely\sdeath\b/i
body __EXCELLENCE /\b(?:demonstrated|commitment to) excellence\b/i
header __EXCLAIM_SUBJ Subject =~ /\!/
body __EXECS_PROS /\bexecutives? (?:and|&) professionals?\b/i
body __EX_CUSTOMER /\b(?:dead|deceased|late|verstorbenen)\s(?:client|customer|account|investor|kunde)/i
body __FB_BA /\bBA\b/
body __FB_BCs /\bBSc\b/
body __FB_BRAND_NAME /brand name/i
body __FB_CONGRADS /Congratulations/i
body __FB_DESIGNER /designer/i
body __FB_GAME /game/i
body __FB_GLASHUTE /Glashute/
body __FB_HANDBAGS /handbags/i
body __FB_HOTTEST /hottest/i
body __FB_INK_PEN /ink pen/i
body __FB_LOTTERY /lottery/i
body __FB_LUX_GIFTS /Luxury (?:\w+\s)?Gifts/i
body __FB_MA /\bMA\b/
body __FB_MBA /\bMBA\b/
body __FB_NATIONAL /national/i
body __FB_NUM_PERCNT /\d\s?\%/
body __FB_OMEGA /Omega/i
body __FB_PICK /\bpick\b/i
body __FB_PROJECTED /projected/i
body __FB_P_ALLNIGHT /all night!/i
body __FB_P_TRUELOVE /true love/i
body __FB_ROLEX_MEN /Rolex Men/i
body __FB_ROLEX_WMEN /Rolex Lady/i
body __FB_S_PRICE /Pri{1,2}c[a-z]?e/i
body __FB_S_STOCK /Stock/i
body __FB_S_SYMBOL /Symb?o?l?:\s?[A-Z_,\.-]{4,8}/i
body __FB_TIMEPIECE /timepiece/i
body __FB_WALLETS /wallets/i
rawbody __FEEDPROXY m;http://feedproxy\.google\.com/;
tflags __FEEDPROXY multiple
body __FEES /\b(?:security|safe\w*|courier|registration|pay|paid|up-?front|processing|delivery|transfer)[\s\w]{1,15}\s(?:fee|charge)s?\b/i
header __FHELO_VERIZON X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+verizon\.net /i
header __FHOST_VERIZON X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+verizon\.net /i
header __FH_FRM_53 From =~ /\@53\.com/i
header __FH_HAS_XMSMAIL exists:X-MSMail-Priority
header __FH_HAS_XPRIORITY exists:X-Priority
header __FH_MSGID_01C7 MESSAGEID =~ /^<0{1,5}1c7/
header __FH_MSG_53 MESSAGEID =~ /\@53\.com/i
header __FH_RCV_53 Received =~ /\.53\.com/i
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body __FILL_THIS_FORM_FRAUD_PHISH /<FF_YOUR>(?:<FF_F1>|<FF_F2>|<FF_F3>|<FF_F4>|<FF_F5>)<FF_SUFFIX>(?:<FF_BLANK1>|<FF_BLANK2>$)/i
endif
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body __FILL_THIS_FORM_LOAN /<FF_YOUR><FF_L1><FF_SUFFIX>(?:<FF_BLANK1>|<FF_BLANK2>$)/i
endif
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body __FILL_THIS_FORM_PARTIAL /^\s*<FF_LNNO>?<FF_YOUR>(?:<FF_ALL><ANDOR>?){1,3}<FF_SUFFIX>(?:<FF_BLANK1>|(?:[-=_.,:;*\s]|=20){1,4}$)/im
tflags __FILL_THIS_FORM_PARTIAL multiple
endif
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
rawbody __FILL_THIS_FORM_PARTIAL_RAW /^\s*<FF_LNNO>?<FF_YOUR>(?:<FF_ALL><ANDOR>?){1,3}<FF_SUFFIX>(?:<FF_BLANK1>|(?:[-=_.,:;*\s]|=20| |<\/\w+>){0,4}$)/im
tflags __FILL_THIS_FORM_PARTIAL_RAW multiple
endif
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body __FILL_THIS_FORM_SHORT /(?:<FF_LNNO>?<FF_YOUR><FF_ALL><FF_SUFFIX>(?:<FF_BLANK2>|<ANDOR>)){3,}/i
endif
body __FIXED_RATEFVGT /fixed rate/i
meta __FM_LARGE_MONEY (__F_LARGE_MONEY || __F_LARGE_MONEY_2)
meta __FM_MORTGAGE5PLUS ((__PREAPPROVEDFVGT + __FIXED_RATEFVGT + __YOUR_CREDITFVGT + __HOMELOANFVGT + __APPROVALFVGT + __BIGDOLLARSFVGT + __LOANURIFVGT + __MORTURIFVGT) > 4)
meta __FM_MORTGAGE6PLUS ((__PREAPPROVEDFVGT + __FIXED_RATEFVGT + __YOUR_CREDITFVGT + __HOMELOANFVGT + __APPROVALFVGT + __BIGDOLLARSFVGT + __LOANURIFVGT + __MORTURIFVGT) > 5)
meta __FM_MY_PRICE (__FB_S_PRICE || FRT_PRICE)
meta __FM_NAT_LOTTERY (__FB_NATIONAL && __FB_LOTTERY)
meta __FM_STOCK_WORDS (__FB_HOTTEST || __FB_PICK || __FB_PROJECTED)
meta __FORGED_TBIRD_IMG __MUA_TBIRD && __JPEG_ATTACH && __MIME_BDRY_0D0D
describe __FORGED_TBIRD_IMG Possibly forged Thunderbird image spam
body __FOUND_YOU /\b(?:I|we)\sfound\syour?\b/i
body __FRAUD /\b(?:de)?fraud/i
body __FRAUD_IOV /\b(?:no risks?|risk-? *free|free of risks?|100% safe|v.llig Risikofrei ist)\b/i
body __FRAUD_PTX /\b(?:ass?ass?inat(?:ed|ion)|murder(?:e?d)?|poison(?:e?d)?|kill(?:ed|ing)\b[^.]{0,99}\b(?:war veterans|rebels?))\b/i
body __FRAUD_XWW /\b(?:honest(?:ly)?\sco(?:-?operat(?:e|ion)|llaborat(?:e|ion))|ehrliche\szusammenarbeit)\b/i
header __FROM_EBAY From:addr =~ /\@ebay\.com$/i
header __FROM_ISO_2022_JP From:raw =~ /=\?ISO-2022-JP\?/
header __FROM_LEFT_BRACK From:name =~ /</
header __FROM_PAYPAL From:addr =~ /\@paypal\.com$/i
header __FROM_RIGH_BRACK From:name =~ />/
header __FROM_RUNON From =~ /\S+<\w+/
header __FROM_VEGAS From =~ /Vegas/i
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body __FRT_GOLD /<inter SP2><post P2>\b(?!gold)<G><O><L><D>\b/i
endif
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body __FRT_SILVER /<inter SP2><post P2>\b(?!s[il][li]ver)<S><I><L><V><E><R>\b/i
endif
header __FS_SUBJ_RE Subject =~ /^Re: /
header __FS_S_TRADE Subject =~ /\btrade\b/i
body __F_LARGE_MONEY /\d\d\d,\d\d\d/
body __F_LARGE_MONEY_2 /\d\d?\s?(?:thousand|(?:m|b|tr)illion)/i
body __GHANA /\bghana\b/i
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __GIF_ATTACH Content-Type =~ /^image\/gif\b/i
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
ifplugin Mail::SpamAssassin::Plugin::ImageInfo
body __GIF_EXISTS eval:image_count('gif',1)
endif
endif
header __GREYLISTED ALL =~ /(?:^|\n)X-(?:Scam-Grey|Greylist(?:ing)?):\s+delay(?:ed)? (?:for )?\d+(?: ?s(?:ec(?:ond)?s?)?|:\d\d)/im
body __HAS_ANY_EMAIL /\w@\S+\.\w/
uri __HAS_ANY_URI /./
header __HDR_ORDER_FTSDMCXXXX ALL =~ /\nFrom: .{1,80}?\nTo: .{1,80}?\nSubject: .{1,200}?\nDate: .{1,40}?\nMIME-Version: .{1,40}?\nContent-Type: .{1,120}?\nX-Priority: .{1,40}?\nX-MSMail-Priority: .{1,40}?\nX-Mailer: .{1,80}?\nX-MimeOLE:/s
header __HELO_NO_DOMAIN X-Spam-Relays-External =~ /^[^\]]+ helo=[^\.]+ /
header __HK_HELO_EBAY X-Spam-Relays-External =~ / helo=[^ ]+\.(?:ebay|emarsys)\b/
header __HK_HELO_MICROSOFT X-Spam-Relays-External =~ / helo=\S+\.(?:microsoft(?:email)?|msn)\.com /
body __HK_LOTTO_1 /\b(?:(?:inter)?national|foundation|mercato|univers|euro ?million|e-?mail|euro-pw|bill ?gates|swiss|prestige|cristal|am.ricaine|coca.?cola|fiduciary|department) ?lot(?:eri[ej]|t(?:ery|o))/i
body __HK_LOTTO_2 /\blot(?:eri[ej]|t(?:ery|o)) ?(?:(?:inter)?national|foundation|mercato|univers|euro ?million|e-?mail|euro-pw|bill ?gates|swiss|prestige|cristal|am.ricaine|coca.?cola|fiduciary|department)/i
body __HK_LOTTO_BALLOT /\b(?:promotional|on.?line|computer|internet|e-?mail|fran.aise) (?:ballot|draw|sweepstake)/i
body __HK_LOTTO_JACKPOT /\bmega jackpot\b/i
body __HK_LOTTO_STAATS /\bstaatsloteri/i
ifplugin Mail::SpamAssassin::Plugin::FreeMail
header __HK_NAME_DR From:name =~ /^DR\b/mi
endif
header __HK_NAME_EBAY From:name =~ /\bebay\b/i
ifplugin Mail::SpamAssassin::Plugin::FreeMail
header __HK_NAME_FROM From:name =~ /^FROM\b/mi
endif
header __HK_NAME_MICROSOFT From:name =~ /(microsoft|\bmsn\b)/i
ifplugin Mail::SpamAssassin::Plugin::FreeMail
header __HK_NAME_MR_MRS From:name =~ /^M(?:RS?|ISS)\b/mi
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __HK_SPAMMY_CDFN Content-Disposition =~ /name=.*?(?:lot(?:eri[ej]|t(?:ery|o))|award|prize|winn(?:er|ing)|microsoft|congrat|urgent)/mi
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __HK_SPAMMY_CTFN Content-Type =~ /name=.*?(?:lot(?:eri[ej]|t(?:ery|o))|award|prize|winn(?:er|ing)|microsoft|congrat|urgent)/mi
endif
body __HOMELOANFVGT /home loan/i
header __HOST_HOTMAIL X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.hotmail\.com /
header __HOTMAILCOM X-Spam-Relays-External =~ /^[^\]]+ helo=hotmail\.com /i
rawbody __HS_QUOTE /^> /
header __HS_SUBJ_RE_FW Subject =~ /^(?i:re|fw):/
header __HS_SUBJ_UC_FW Subject =~ /^FW:/
body __HUSH_HUSH /\b(?:confiden[tc]i[ae]l(?:ity)?|private|secre(?:te?|cy)|sensitive|concealed|obscured|discre(?:et|tion)|vertraulich(?:en)?|geheim)\b/i
ifplugin Mail::SpamAssassin::Plugin::ImageInfo
body __IMG_LE_300K eval:pixel_coverage('all',62500,300000)
endif
body __INFORM_YOU /\b(?:pleased?|pleasure) to inform you\b/
body __INHERIT_PMT /\binheritance\spayment\s/i
body __INNERCIRCLE /\bInner Circle\b/
body __INTL_BANK /\b(?:international\s(?:\w+\s)?bank|banque\sinternationale)\b/i
body __INVEST_MONEY /\binvest\sthis\smoney\b/i
body __IS_LEGAL /\b(?:this\s(?:deal|offer|transaction|proposal|exchange|arrangement)|it)?\sis\s(?:(?:guaranteed|completely|absolutely|perfectly|100%|very)\s)?(?:legal|hitch-free)\b/i
body __IVORY_COAST /\b(?:Cote\s?D.Ivoire|Ivory\s?Coast)\b/i
body __I_INHERIT /\bI\s[a-z\s]{0,30}inherited\b/i
body __I_WILL_YOU /\bwill(?:ed)?\s(?:[a-z\s]{0,20}\s(?:fortune|money)\s)?to\syou\b/i
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __JPEG_ATTACH Content-Type =~ /image\/jpeg/i
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
ifplugin Mail::SpamAssassin::Plugin::ImageInfo
body __JPEG_EXISTS eval:image_count('jpeg',1)
endif
endif
body __KAM_LOTTO1 /(e-?mail address (have emerged a winner|has won|attached to (ticket|reference)|was one of the ten winners)|random selection in our computerized email selection system)/is
body __KAM_LOTTO2 /((ticket|serial|lucky) number|secret pin ?code|batch number|reference number|promotion date)/is
body __KAM_LOTTO3 /(won|claim|cash prize|pounds? sterling)/is
body __KAM_LOTTO4 /(claims (officer|agent)|lottery coordinator|fiduciary (officer|agent)|fiduaciary claims)/is
body __KAM_LOTTO5 /(freelotto group|Royal Heritage Lottery|UK National (Online)? Lottery|U\.?K\.? Grand Promotions|Lottery Department UK|Euromillion Loteria|Luckyday International Lottery|International Lottery)/is
body __KAM_LOTTO6 /(Dear Lucky Winner|Winning Notification|Attention:Winner|Dear Winner)/is
header __KAM_LOTTO7 Subject =~ /(Your Lucky Day|(Attention:|ONLINE) WINNER)/i
header __KB_MSGID_OUTLOOK_888 Message-Id =~ /^<[0-9a-f]{8}(?:\$[0-9a-f]{8}){2}\@/
if ! plugin (Mail::SpamAssassin::Plugin::OpenPGP)
body __KHOP_PGP_I1 /-----BEGIN PGP (?:SIGNATURE|MESSAGE|PUBLIC|PRIVATE)(?:, PART [0-9]{1,4}\/[0-9]{1,4}| KEY BLOCK)?-----/
tflags __KHOP_PGP_I1 nice
endif
if ! plugin (Mail::SpamAssassin::Plugin::OpenPGP)
body __KHOP_PGP_I2 /-----END PGP/
tflags __KHOP_PGP_I2 nice
endif
meta __KNOWN_VANITY __PRINCETONPRE || __WHOSWHO || __DPHPVANITY
uri __LOANURIFVGT /\bloa.?ns?\b/i
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body __LOTSA_MONEY_00 /<CURRENCY>\s?\d[\dO][,\.][\dO]{3}(?:(?!\d)|\b)/
endif
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body __LOTSA_MONEY_01 /(?:(?i:sum\sof\s)[\(\[]?|<CURRENCY>\s?)\s?\d[\d.,\sO]{5,20}[\dO]/
endif
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body __LOTSA_MONEY_02 /\d[\d.,\sO]{5,20}[\dO][\)\]\(]?\s?(?:<CURRENCY>|Pounds|(?i:dollars?|bucks))\b/
endif
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body __LOTSA_MONEY_03 /(?:(?i:sum\sof\s)[\(\[]?|<CURRENCY>\s?)\d(?:[\d.,\sO]{0,5})?[\)\]]?\s?(?i:M(?i:il)?\b|mil+(?i:io|<O>)n|hund?[re]+a?[dt]|thousand|tausend)/
endif
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body __LOTSA_MONEY_04 /(?:\d[\d\.]{0,4}M|million(?!s)|mill<O>n|hund?rea?d(?!s)[^\.]{1,25}thousand(?!s)|cents?[^\.]{1,25}mille|hundert[^\.]{1,30}tausend|ientos?[^\.]{1,20}mil)[^\.\$]{0,50}(?:(?:U\.?\s?S\.?\s?(?:A\.?\s?)?|united\s?states?|canad(?:ian|a)\s)?dollars?|bucks|USD|GBP|<GB_UK>\spounds?|(?:<GB_UK>\s)?pounds?\ssterling|pounds(?!\sof)|(?:d'\s?)?euros?|francs?)\b/i
endif
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body __LOTSA_MONEY_05 /(?:(?:sum|value|amount)\sof\s)\d[\d.,\sO]{7,20}[\dO\.][\)\]\(\s]{0,3}(?:pounds?|dollars?|euros?|bucks)\b/i
endif
meta __LOTTO_ADMITS __LOTTO_ADMITS_1 || __LOTTO_ADMITS_2 || __LOTTO_ADMITS_3
body __LOTTO_ADMITS_1 /\b(?:on-?line|e-?mail|ballot|(?:inter)?national|state|(?:UK|euro)[- ]?(?:mil+ions?|PW)|Canada|Microsoft|MSN|internet|mega|jackpot|Royal Heritage|foundation|mercato|univers|staatsloterij|bill\s?gates|swiss|this)(?:\s\w+)?\s?(?:lot(?:to|tery|eri[ea])|sweepstake)/i
body __LOTTO_ADMITS_2 /\b(?:free)?(?:lot(?:to|tery|erie)|sweepstakes)\s(?:(?:inter)?na[tz]ional|department|bureau|group|award)/i
uri __LOTTO_ADMITS_3 /lottery/i
body __LOTTO_RELATED /\b(?:lott(?:o|ery)|sweepstakes)\s(?:prize|draw(?:s|ing)?|(?:ge)?win(?:n?er|n?ing)?|jackpot|award|fund|com+it+e+|com+is+ion|guild|promotion|program|day|online|company|(?:in)?corporat|agent|co[-,]?ordinator|team)/i
body __LOTTO_WINNINGS /(?:claim|transfert?(?:\s\w+)?|virement|zahlung)\s(?:your|of|the|this|de|ihrer)\s(?:win+ings?|money|(?:cash\s)?prize|award|f[ou]nds?|grant|gewinne)/i
body __LOTTO_WIN_01 /\bwin+ing\s(?:prize|number|notification|draw|check|cheque|details|information)/i
body __LUCKY_WINNER /\b(?:lucky|gl.cklich(?:en)?)\s(?:ge)?win+ers?\b/i
body __LUCRATIVE /\blucrative\b/i
header __MAILER_OL_5510 X-Mailer =~ /^Microsoft Office Outlook, Build 11.0.5510$/
header __MAILER_OL_6626 X-Mailer =~ /^Microsoft Outlook, Build 10\.0\.6626$/
header __MANY_RECIPS ToCc =~ /(?:\@[^@]{5,30}){3}/
body __MASTERS /Masters/i
body __MBA /MBA/i
header __MID_START_001C Message-ID =~ /^<000001c/
body __MILLIONS /\bmillions\sof\s(?:dollar|euro|pound)/i
header __MIMEOLE_1106 X-MimeOLE =~ /^Produced By Microsoft MimeOLE V6.00.2800.1106$/
header __MIME_BDRY_0D0D Content-Type =~ /boundary="-{12}(?:0[1-9]){12}/
header __MISSING_REF References =~ /^UNSET$/ [if-unset: UNSET]
header __MOLE_2962 X-MimeOLE =~ /^Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2962$/
uri __MORTURIFVGT /\bmor.?t\b/i
header __MO_OL_015D5 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2905/
header __MO_OL_07794 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1437/
header __MO_OL_09BB4 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.72\.3155\.0/
header __MO_OL_1ECD5 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1081/
header __MO_OL_20C99 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.72\.3338\.1/
header __MO_OL_22B61 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1158/
header __MO_OL_25340 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4963\.1700/
header __MO_OL_32D97 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V9\.0\.2416/
header __MO_OL_3857F X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1409/
header __MO_OL_3AC1D X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.00\.2919\.6700/
header __MO_OL_3D61D X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.71\.2244\.8/
header __MO_OL_465CD X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1506/
header __MO_OL_4B815 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.71\.2730\.2/
header __MO_OL_4BF4C X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4522\.1200/
header __MO_OL_4EEDB X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4963\.1700/
header __MO_OL_4F240 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1158/
header __MO_OL_58CB5 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4133\.2400/
header __MO_OL_5B79A X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.3790\.1830/
header __MO_OL_6554A X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2905/
header __MO_OL_72641 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1441/
header __MO_OL_7533E X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4963\.1700/
header __MO_OL_812FF X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4927\.1200/
header __MO_OL_83BF7 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.72\.3110\.3/
header __MO_OL_8627E X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1437/
header __MO_OL_8E893 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V10\.0\.2616/
header __MO_OL_91287 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.2300/
header __MO_OL_9B90B X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.1700/
header __MO_OL_A50F8 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4922\.1500/
header __MO_OL_A842E X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1441/
header __MO_OL_ADFF7 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1158/
header __MO_OL_B30D1 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.2300/
header __MO_OL_B4B40 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4133\.2400/
header __MO_OL_B9B11 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2462\.0000/
header __MO_OL_BC7E6 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4927\.1200/
header __MO_OL_C65FA X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.1700/
header __MO_OL_CAC8F X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.71\.1712\.3/
header __MO_OL_CF0C0 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.2300/
header __MO_OL_EF20B X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2180/
header __MO_OL_EF222 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2873/
header __MO_OL_F3B05 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1437/
header __MO_OL_F475E X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2741\.2600/
header __MO_OL_F6D01 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4522\.1200/
header __MO_OL_FF5C8 X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2741\.2600/
header __MSGID_VGA Message-ID =~ /^<000001c[67]/
header __MSOE_MID_WRONG_CASE ALL =~ /\nMessage-Id: /
header __MUA_TBIRD User-Agent =~ /Thunderbird/
body __MY_FORTUNE /\b(?:my|his|her)\s(?:fortune|heritage)\b/i
header __NAKED_TO To =~ /^[^\s<>]+\@[^\s<>]+$/
body __NEXT_OF_KIN /\bnext[-\s]of[-\s]kin\b/i
body __NIGERIA /\bnigeria\b/i
body __NOMINATION /\b(?:nominated|nomination)\b/i
body __NOT_DEAD_YET /\bwill\sinherit\b/i
body __NOT_SCAM /\bnot\sa\sscam\b/i
if !plugin(Mail::SpamAssassin::Plugin::SPF)
if !plugin(Mail::SpamAssassin::Plugin::DKIM)
meta __NOT_SPOOFED ALL_TRUSTED || __DKIM_EXISTS
endif
endif
if !plugin(Mail::SpamAssassin::Plugin::SPF)
ifplugin Mail::SpamAssassin::Plugin::DKIM
meta __NOT_SPOOFED ALL_TRUSTED || DKIM_VALID
endif
endif
ifplugin Mail::SpamAssassin::Plugin::SPF
if !plugin(Mail::SpamAssassin::Plugin::DKIM)
meta __NOT_SPOOFED ALL_TRUSTED || SPF_PASS
endif
endif
ifplugin Mail::SpamAssassin::Plugin::SPF
ifplugin Mail::SpamAssassin::Plugin::DKIM
meta __NOT_SPOOFED ALL_TRUSTED || SPF_PASS || DKIM_VALID
endif
endif
body __NO_COST /\b(?:no costs?|cost-? *free|free of costs?|no fees?|neither cost nor obligation)\b/i
meta __NO_INR_YES_REF (__XM_GNUS || __XM_MSOE5 || __XM_MSOE6 || __XM_MOZ4 || __XM_SKYRI || __XM_WWWMAIL || __UA_GNUS || __UA_KNODE || __UA_MUTT || __UA_PAN || __UA_XNEWS)
ifplugin Mail::SpamAssassin::Plugin::ImageInfo
body __ONE_IMG eval:image_count('all',1,1)
endif
body __OUR_BEHALF /\bon\s(?:my|our)\sbehalf\b/i
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __PART_CID_STOCK_LESS Content-ID =~ /^<00[a-f0-9]{10}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[A-Za-z]+>$/
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __PART_STOCK_CD_F Content-Disposition =~ /filename/
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __PART_STOCK_CID Content-ID =~ /^<[a-f0-9]{12}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[^\s\.]+>$/
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __PART_STOCK_CL Content-Location =~ /./
endif
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
meta __PCT_FOR_YOU __PCT_FOR_YOU_1 || __PCT_FOR_YOU_2 || __PCT_FOR_YOU_3
endif
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body __PCT_FOR_YOU_1 /<PERCENT>[\s)]{0,3}(?:of\s[\w\s]{0,35}?)?(?:for|to|as)\syour?/i
endif
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body __PCT_FOR_YOU_2 /\b(?:give|offer)\syou\s<PERCENT>/i
endif
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body __PCT_FOR_YOU_3 /\byour?\s(?!can)[\w\s]{6,20}?(?:(?:share|entitle|assist|comp[ea]nsate|reward|renumerate|deduct|account|tage)[\w\s]{1,25}?)?\s(?<!by\s)(?<!up\sto\s)<PERCENT>/i
endif
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body __PCT_OF_PMTS /<PERCENT>[\s)]+(?:of\s[\w\s]{0,35}?)?of\s(?:the\s)?(?:payments?|remittances?|chec(?:k|que)s?)/i
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
meta __PDF_ATTACH (__PDF_ATTACH_MT || __PDF_ATTACH_FN1 || __PDF_ATTACH_FN2)
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __PDF_ATTACH_FN1 Content-Type =~ /="[^"]+\.pdf"/i
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __PDF_ATTACH_FN2 Content-Disposition =~ /="[^"]+\.pdf"/i
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __PDF_ATTACH_MT Content-Type =~ m,\bapplication/pdf\b,i
endif
if ! plugin (Mail::SpamAssassin::Plugin::OpenPGP)
meta __PGP_INLINE ( __KHOP_PGP_I1 && __KHOP_PGP_I2 )
tflags __PGP_INLINE nice noautolearn
endif
if ! plugin (Mail::SpamAssassin::Plugin::OpenPGP)
header __PGP_SIGNED Content-Type =~ /multipart\/signed;.*\/pgp-signature/s
tflags __PGP_SIGNED nice noautolearn
endif
body __PHD /PhD/i
body __PLS_REVIEW /\b(?:please|kindly)\s(?:(?:re)?view|see)(?:\s\w+)?\sattach(?:ed|ment)\b/i
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
ifplugin Mail::SpamAssassin::Plugin::ImageInfo
mimeheader __PNG_ATTACH Content-Type =~ /^image\/png\b/i
endif
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
ifplugin Mail::SpamAssassin::Plugin::ImageInfo
body __PNG_EXISTS eval:image_count('png',1)
endif
endif
body __PREAPPROVEDFVGT /pre-approved/i
body __PRINCETONPRE /\bPrinceton Premier/
body __PUB_DEADLINE /\bpublication deadlines?\b/i
body __RANDOM_PICK /\b(?:random(?:ly)?\s(?:\w+\s)?(?:select(?:ion|ed)|pick(?:ed)?|computer)|(?:select|pick)ed\s(?:at\s)?random(?:ly)?)\b/i
header __RATWARE_BOUND_A ALL =~ /^Message-Id: <....([0-9a-f]{8})\$[0-9a-f]{8}\$.{10,400}boundary="----=_NextPart_000_...._\1\./msi # "
header __RATWARE_BOUND_B ALL =~ /boundary="----=_NextPart_000_...._([0-9a-f]{8})\..{10,400}^Message-Id: <....\1\$[0-9a-f]{8}\$/msi # "
ifplugin Mail::SpamAssassin::Plugin::HeaderEval
header __RCVD_IN_2WEEKS eval:received_within_months('0', '0.46')
describe __RCVD_IN_2WEEKS Received: within the past 2 weeks
endif
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header __RCVD_IN_BRBL eval:check_rbl('brbl','bb.barracudacentral.org')
tflags __RCVD_IN_BRBL net
endif
ifplugin Mail::SpamAssassin::Plugin::DNSEval
header __RCVD_IN_DNSWL eval:check_rbl('dnswl-firsttrusted', 'list.dnswl.org.')
tflags __RCVD_IN_DNSWL nice net
endif
body __RECOGNITION /\brecognition\b/i
body __REGISTRY /\bregistry\b/i
header __REPLYTO_EXISTS exists:Reply-To
header __S25R_1 X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\d[^0-9. ]+\d\S*\./
header __S25R_2 X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\d{5}/
header __S25R_3 X-Spam-Relays-External =~ /^[^\]]+ rdns=(?:[^. ]+\.)?\d[^. ]*\.[^. ]+\.\S+\.[a-z]/
header __S25R_4 X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\d\.[^. ]*\d-\d/
header __S25R_5 X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\d\.[^. ]*\d\.[^. ]+\.\S+\./
header __S25R_6 X-Spam-Relays-External =~ /^[^\]]+ rdns=(?:dhcp|dialup|ppp|[achrsvx]?dsl)[^. ]*\d/
body __SBCAVANITY /\bSmall Business Commerce Association/
body __SCAM /\bscam(?:m?e[dr])?s?\b/i
body __SEEK_FRAUD_0BVEZG /You will provide him with the following information/
body __SEEK_FRAUD_0CUBFG / banking law and guidelines here stipulates that /
body __SEEK_FRAUD_0ENSZN / within the next ten official working days/
body __SEEK_FRAUD_0EY1BH / United Kingdom\. I got your contact through /
body __SEEK_FRAUD_0LP0QC /I have reasoned very professionally and I /
body __SEEK_FRAUD_0MX8JO /like you to accept this token with .ood .aith as this is /
body __SEEK_FRAUD_0QGAHF / Address where you want the payment center to send your ATM CARD: /
body __SEEK_FRAUD_0UXRAU /So keep it secret till they are all apprehended\./
body __SEEK_FRAUD_0WHPB1 /we have resolved in finding a solution to /
body __SEEK_FRAUD_0WTPZI /We are here serving you with these programs\.:-/
body __SEEK_FRAUD_0_6JSL / all arrangements and . .ill give you more information on /
body __SEEK_FRAUD_19NM0A /All participants were selected through our Microsoft computer ballot system drawn from /
body __SEEK_FRAUD_1DJSNK /There is no risk at all as all the paperwork for this transaction will be done by /
body __SEEK_FRAUD_1LS8UW /I want you to know that I have had everything planned out so that we /
body __SEEK_FRAUD_1OMKY9 / to be merciful to me and accept my soul/
body __SEEK_FRAUD_1SKLLZ /after the war another notification was sent.and /
body __SEEK_FRAUD_215XVW / part of our security protocol to avoid /
body __SEEK_FRAUD_2811F9 /Provide us with degree you are interested in\./
body __SEEK_FRAUD_2BERS9 /\. I will also issue a .etter .f .uthori/
body __SEEK_FRAUD_2TBGCP /Do not destroy my career because you do not approve of my proposal\./
body __SEEK_FRAUD_2U5_KL /m assuring you that all will be well at the end of the day/
body __SEEK_FRAUD_37UB9O /lessed is the hand that giveth\. I took this decision because I/
body __SEEK_FRAUD_38GETZ / he must have been in contact with you in the past or simply you were /
body __SEEK_FRAUD_3BWYGW / accomplished family man, who made enough fortune before his untimely death\. /
body __SEEK_FRAUD_3GQDHJ /of 8,600,000\.00GBP \(Eight Million, Six Hundred Thousand British Pounds\) in the codicil and /
body __SEEK_FRAUD_3HKWCI / and all attempts to trace his next of kin w/
body __SEEK_FRAUD_3HU72N / adopt a legalized method and the attorney will prepare all the necessary/
body __SEEK_FRAUD_3JFT7Y /9414,Batch Number: 573881545-NL\/2008 and Ticket/
body __SEEK_FRAUD_3NIFMV /confidential until you claim your prize\./
body __SEEK_FRAUD_3UF3BG /I believe when God gives me a .econd chance to come to this world I /
body __SEEK_FRAUD_3ZGAWE / telephone communication in this regard /
body __SEEK_FRAUD_3_8NUB /Tel\+34-658-654-308, Fax:\+34911414351 E-mail:/
body __SEEK_FRAUD_45WI8I / was the informer to the double claimer about the /
body __SEEK_FRAUD_461FL0 /indly accept my apology for sending unsolicited mail to you/
body __SEEK_FRAUD_49FI4O /ants to serve the Lord must serve him in /
body __SEEK_FRAUD_4IGE4U /or security reasons, you are advised to keep your /
body __SEEK_FRAUD_4KBBOJ /ow are you today\? Hope all is well with you and /
body __SEEK_FRAUD_4ONVKC / internet E-mail draw is held periodically and is organized to encourage the use of the Internet /
body __SEEK_FRAUD_4VJJ1V / all his supposed next of kin.{0,5} relation died along/
body __SEEK_FRAUD_4VSYVD / and the management just .rote me as the /
body __SEEK_FRAUD_4WFQ9X /I therefore reckon that you can receive this fund as you are qualified by your name /
body __SEEK_FRAUD_4ZVC1C /s a result of your visiting various websites we/
body __SEEK_FRAUD_52TF6W /o avoid unnecessary delays and complications, please/
body __SEEK_FRAUD_55WLGY /dvantage of you and they will dry you up until you have nothing\./
body __SEEK_FRAUD_58TQIN /Remember, all prize money must be claimed /
body __SEEK_FRAUD_5CTGDY / during a rescue operation, and it was agreed by /
body __SEEK_FRAUD_5CUOT8 / file was forwarded to my office by the auditors as unclaimed fund, we wish to use this medium to inform you that for the time being/
body __SEEK_FRAUD_5DEVYO /here the deceased had an account .alued at /
body __SEEK_FRAUD_5EKBBQ /he needed to make an urgent investment requiring cash payments/
body __SEEK_FRAUD_5GX3N3 / is still lying in my bank and no one will ever/
body __SEEK_FRAUD_5IZEAX / you as the next of kin and have them release the deposit to you/
body __SEEK_FRAUD_5L07LP /s\. By virtue of my closeness to the deceased and his immediate family, I am very much aware of my client/
body __SEEK_FRAUD_5MCR_O / provide you with more details and relevant documents/
body __SEEK_FRAUD_5MEKF1 / and my doctors have told me that I have /
body __SEEK_FRAUD_5NJERT / well and always extend the good work to others\./
body __SEEK_FRAUD_5_1_MB /orward to us your contact information as it is stated below:/
body __SEEK_FRAUD_6B2FK_ /We will get your self a verifiable degree of:/
body __SEEK_FRAUD_6EGJH6 / the way I am going to instruct herein\./
body __SEEK_FRAUD_6GGFLT /Though I know that a transaction of this magnitude will make .n/
body __SEEK_FRAUD_6GPS4I /nd he also confided in me the last time he was .. my..f/
body __SEEK_FRAUD_6HPM5A /You don\'t need to worry for anything because this transaction is 100 risk free, the boxes are coming with a diplomatic agent who will accompany the boxes to your house or office there in your country\./
body __SEEK_FRAUD_6LGTFG / your assistance to receive this .oney into your bank/
body __SEEK_FRAUD_6M8QNI / draws was conducted by a random selection of email addresses/
body __SEEK_FRAUD_6OYTMK / to enable us open up communication with you regarding the release of your fund immediately\./
body __SEEK_FRAUD_6VUONK /to avoid any further delay and remember to pay the/
body __SEEK_FRAUD_6ZE0ZK / for the paper works, take note of that\./
body __SEEK_FRAUD_6ZXIA1 /that will utilize this money the way I am going to instruct here in\./
body __SEEK_FRAUD_7A8HJM / to your postal Address in your country /
body __SEEK_FRAUD_7CQUW3 /som of the Lord\. Exodus 14 VS 14 says that /
body __SEEK_FRAUD_7ERN1P / Remittance Manager Zenith Bank Of Nigeria\./
body __SEEK_FRAUD_7GJKBJ /from what I have inherited from my late husband to /
body __SEEK_FRAUD_7H66PN /, making a loss for both the double claimer and the real ..n/
body __SEEK_FRAUD_7ORNIB /Please, again, note I am a family man. I ha/
body __SEEK_FRAUD_7PX0OU /ome money in various currencies was discovered /
body __SEEK_FRAUD_7UXDY2 /our Winnings Certificate and all other relevant .ocuments\/.aperwork /
body __SEEK_FRAUD_7XOY_V / papers will be processed in your acceptance\./
body __SEEK_FRAUD_80CUEU /hat my health has deteriorated so badly, I can/
body __SEEK_FRAUD_8A1Q6M /You may not understand why this mail came to you\./
body __SEEK_FRAUD_8BDNKT / client\'s next-of-kin will be provided\. /
body __SEEK_FRAUD_8D5ZCH /Full names: Address: Telephone and fax numbers: Age: Marital Status: Occupation: A copy of your identity:/
body __SEEK_FRAUD_8DOXAD /I once again try to notify you as my earlier .etter /
body __SEEK_FRAUD_8GOL16 / a notice to contact the next of kin, or the /
body __SEEK_FRAUD_8JIBO6 /citizens in the communities where they have /
body __SEEK_FRAUD_8P0LT0 /CHUBB INSURANCE COMPANY OF EUROPE S\.A\. 106 FENCHURCH STREET, LONDON EC3M 5NB UK\./
body __SEEK_FRAUD_8SR3L_ / wife and children\. I send you this mail ..t/
body __SEEK_FRAUD_9CQAIU / your country\. Though, I do not know to what exten. you are familiar with /
body __SEEK_FRAUD_9JV2FO / had planned to invoke the abandoned property decree of/
body __SEEK_FRAUD_9KCDA8 / will mention later .as prompted me to reach out for help/
body __SEEK_FRAUD_9Q29S6 / stopped further payment through bank to bank transfer/
body __SEEK_FRAUD_9_SYQR / request that you kindly forward to .. your /
body __SEEK_FRAUD_A0GXKY /UNITED NATIONS COMPENSATION AWARD PROGRAM/
body __SEEK_FRAUD_A0U_YJ / for the collection of this international .ertifi/
body __SEEK_FRAUD_A1M2V4 /s Road London WC1X 8TH Fax: \+44-700-596-1494/
body __SEEK_FRAUD_A56GDH /FORGIVE MY INDIGNATION IF THIS MESSAGE COMES TO YOU AS A SURPRISE AND MAY OFFEND YOUR PERSONALITY FOR CONTACTING YOU WITHOUT YOUR PRIOR CONSENT AND WRITING THROUGH THIS CHANNEL\.I GOT YOUR CONTACT FROM A PROFESSIONAL DATABASE FOUND ON THE INTERNET WHILE SEARCHING FOR A RELIABLE AND HONEST PERSON THAT WILL ASSIST ME TO SAFE GUARDA0 UND INTO AN ACCOUNT OVERSEA\. I WAS DIVINE LYINSPIRED TO PICK YOUR NAME AMONG ALL OTHER NAMES FOUND IN THE DATABASE\./
body __SEEK_FRAUD_A5PM6O / the necessary document that will back you up/
body __SEEK_FRAUD_A62E_H / set up a new Bank .{0,40}, even an empty a.c/
body __SEEK_FRAUD_AACTU_ / the money around various opportunities and made attractive margins for our first /
body __SEEK_FRAUD_AAKMFF /or get a child outside my matrimonial home/
body __SEEK_FRAUD_AAV9Q9 / discovered that the account holder died /
body __SEEK_FRAUD_ADBSR1 /proper to present you as the next of kin of my deceased client/
body __SEEK_FRAUD_ADHMPP / AFTER I WAS CONVINCED IN MY MIND THAT YOUR NAME.{0,20} COULD BE USED AS THE .E/
body __SEEK_FRAUD_AEA51B /This is the one truth I have learned from my private banking clients\. Do not betray my confidence\./
body __SEEK_FRAUD_AFUQZ_ / category and therefore attracted a cash award of/
body __SEEK_FRAUD_AGOTOV /I wish to seek your assistance for the transfer of US\$25M depository made by a foreign investor /
body __SEEK_FRAUD_AI_1WI / branch so that my .ead office can order the transfer .. /
body __SEEK_FRAUD_AKYCPN /t want them to know about this development\./
body __SEEK_FRAUD_ALY_4Z /cil and last testament of the deceased\. \(Name now withheld since this is our second letter to you\)\./
body __SEEK_FRAUD_ASW4ZD / will let you know how far I have gone with the arrangement\. I will secure the .iplomatic immunity/
body __SEEK_FRAUD_AUJ56H / I am writing following an opp.rtunity in /
body __SEEK_FRAUD_AWGSAH /this money has been kept somewhere outside Baghdad for some/
body __SEEK_FRAUD_B3XJII / does not know the original contents of the boxes\. What .{0,3} declared to them as the contents is Sensitive Photographic Film Material. /
body __SEEK_FRAUD_B5_Q5F / and whereby you are not interested; please indicate in your reply so that I can seek for the assistance of someone else\./
body __SEEK_FRAUD_BAD6QS / to locate any of his extended relatives whom shall be claimants\/beneficiaries of his abandoned /
body __SEEK_FRAUD_BAO5S3 /PLEASE NOTE YOU ARE TO SEND THE FOLLOWING INFORMATION TO CLAIM YOUR PRIZE: 1\.Full Name:\.\.\. 2\.Address:\.\.\. 3\.Phone:\.\.\. 4\.Country:\.\.\. 5\.Sex\/Gender:\.\.\./
body __SEEK_FRAUD_BDDXSD /f my offer is of no appeal to you, delete this message and forget I ever contacted you/
body __SEEK_FRAUD_BFBYW8 /from you, call me on my confidential Tel: \+870-764107753/
body __SEEK_FRAUD_BGO5Z1 / activities and to help the poor and the needy/
body __SEEK_FRAUD_BKRS5B / Delivery Department for immediate disp..c/
body __SEEK_FRAUD_BL1D9Y /The Microsoft Internet E-mail lottery Awards is sponsored by .{0,40} and a consortium of software promotion companies\. /
body __SEEK_FRAUD_BLDS9E / am delighted to inform you that the contract panel/
body __SEEK_FRAUD_BPL3YK /ddresses of individuals and companies from all /
body __SEEK_FRAUD_BQVFV6 /around me always\. I don.t want them to know about this development/
body __SEEK_FRAUD_BRNKW7 /f this business proposition offends your moral /
body __SEEK_FRAUD_BS6HNM / Delivery Post\) with the details given below:/
body __SEEK_FRAUD_BSX___ / you at this stage is for you to provide me with your /
body __SEEK_FRAUD_BT6SO9 / you do not need to buy ticket to enter for /
body __SEEK_FRAUD_BTLJ32 /departments and authorities for necessary approvals for the release of/
body __SEEK_FRAUD_BTTJ73 /For further Information about your Winnings.{0,3}ontact your Lottery Claims /
body __SEEK_FRAUD_BXYWIK /On behalf of the Trustees and Executor of the .state of /
body __SEEK_FRAUD_BY5FQK / World Fund Discovery Management And Payment Bureau /
body __SEEK_FRAUD_BYTJGW / from a human resource profile database .. /
body __SEEK_FRAUD_BZFTQQ /I was always hostile to people and only focus/
body __SEEK_FRAUD_C0HOHT / assets to my immediate and extended family /
body __SEEK_FRAUD_C0N_NJ / in the Codicil and last testament to his WILL/
body __SEEK_FRAUD_C3MJRM /confidential from the public until your claim /
body __SEEK_FRAUD_C4M8O6 /\. I want you and the church to always pray for me bec/
body __SEEK_FRAUD_C5J9EE /from you, call me on my confidential .el: \+870-764107753/
body __SEEK_FRAUD_C5OQZD /hough what disturbs me most is my stroke/
body __SEEK_FRAUD_C62CWS /as I want this to be one of the last good deeds I d/
body __SEEK_FRAUD_C7BE4W /It is understandable that you might be a/
body __SEEK_FRAUD_C80D_M / experience to obtain a fully verifiable /
body __SEEK_FRAUD_CBZELO / we plan on using diplomatic means .. ship/
body __SEEK_FRAUD_CDBI1H /e a second chance to come to this world I would live my life/
body __SEEK_FRAUD_CEUKKB /ou are eligible to receive a tax refund of /
body __SEEK_FRAUD_CHLODJ / to enable us seeing this deal through\. I guarantee /
body __SEEK_FRAUD_CJCVEY /electronic balloting System without the winner applying/
body __SEEK_FRAUD_CKPXGA /rovide either an existing bank account or /
body __SEEK_FRAUD_CQN7_5 / your country\'s airport\. I hope you understand me\./
body __SEEK_FRAUD_CRYRVO / hence I know where I am going\. I know /
body __SEEK_FRAUD_CTKQAR / as soon as our Delivery Team confirms your/
body __SEEK_FRAUD_CTSHG_ / your letter of acceptance; your current /
body __SEEK_FRAUD_C_HP37 / like you to acknowledge the receipt of this e-mail as soon as possible /
body __SEEK_FRAUD_D3X77R /due to one reason or the other best known to you\./
body __SEEK_FRAUD_D4FWIB /r to quote your Qualification .umber. \(/
body __SEEK_FRAUD_D8N5AK /This Email is to inform you that you emerged a winner of the sum of \$2,500,000\.00USD with the following numbers attached Ref/
body __SEEK_FRAUD_DAZ554 /after shall be referred to as my client, died /
body __SEEK_FRAUD_DCYEFP / you are nationals of the same country\. /
body __SEEK_FRAUD_DI5SMP /maintained\. The Bible made us to understand that /
body __SEEK_FRAUD_DI9349 /I am the only one who knows of this situation/
body __SEEK_FRAUD_DIIRM8 /With God all things are possible\. As soon as I /
body __SEEK_FRAUD_DI_QRB /If this proposal is acceptable by you, I expect that you will not take undue advantage of the trust I .ill bestow in you/
body __SEEK_FRAUD_DJ79KN /I await your prompt response\. Yours in Service/
body __SEEK_FRAUD_DKBMSM /\. Just leave your NAME \& TEL\. PHONE \# \(with country-code\) on the voicemail and one of our staff members will get back to you promptly\! /
body __SEEK_FRAUD_DLIZ7K /Now that my health has deteriorated so badly,/
body __SEEK_FRAUD_DNFIPA /What you have to do now, is to contact .{0,20} Delivery Department for /
body __SEEK_FRAUD_DNXWDS / has discovered a huge number of double claims due to ..n/
body __SEEK_FRAUD_DSHZQA / will come to you as a surprise, Please /
body __SEEK_FRAUD_DUMWEJ / in for claims on your behalf and secure the necessary /
body __SEEK_FRAUD_DVBIVZ /e spun the money around various opportunities and made /
body __SEEK_FRAUD_DVQ_OH /business endeavour by furnishing me with the following/
body __SEEK_FRAUD_DWEVNF /ou for being part of our promotional lottery program/
body __SEEK_FRAUD_DZ5V2U /fter you have been made the next of kin, the attorney will /
body __SEEK_FRAUD_DZ9GWP / BUT ALL HAS PROVED ABORTIVE AS NO ONE HAS /
body __SEEK_FRAUD_D_URQY /MY HIGHEST CONSIDERATIONS AND REGARDS AS I AWAIT YOUR URGENT RESPONSE\./
body __SEEK_FRAUD_D_Z7NM /Congratulations\! Thank you for being a user of the World/
body __SEEK_FRAUD_E0LMNE / to enable us seeing this .eal through\./
body __SEEK_FRAUD_E2ESY7 / contacted him and he explained everything to me\./
body __SEEK_FRAUD_E2US_V /t is therefore upon this discovery that I /
body __SEEK_FRAUD_E3KTBE / confidential business proposition for you/
body __SEEK_FRAUD_E5T6LD /So I decided to travel down to United Kingdom with all my co/
body __SEEK_FRAUD_EBEFON /, as you know we are being attacked by insurgents everyday and car bombs\./
body __SEEK_FRAUD_EGCOZC /\. I have a business proposal in the tune of /
body __SEEK_FRAUD_EGRZ5T /trying to get my payment all to no avail\./
body __SEEK_FRAUD_EH1G11 / until his death was a member of the Helicopter Society and the Institute of Electronic \& Electrical Engineers\./
body __SEEK_FRAUD_EINBZL / have been agreed upon and have been signed/
body __SEEK_FRAUD_EJM0XB / with him at the plane crash leaving nobody behind .o/
body __SEEK_FRAUD_EO5_QW / that the proceeds of this account valued a/
body __SEEK_FRAUD_EOLLNZ /\(Name now withheld since this is our second letter to you\)\. We contacted you b/
body __SEEK_FRAUD_EONOG2 / my branch in which I am the manager made /
body __SEEK_FRAUD_EOVKVR / a healthy lifestyle\. I do not smoke .{0,20} drink alcohol\. /
body __SEEK_FRAUD_EPEJ1_ /our online draws which was played on the year 20..\./
body __SEEK_FRAUD_EURZ3M /I wish you all the best and may the good Lord bless you abundantly/
body __SEEK_FRAUD_EV4LPC /\.com and make sure you call me on this telephone number \+44-762-413-2116 immediately you forward your information so that even if am not on seat,i can go and check my email for immediate action\./
body __SEEK_FRAUD_EWAGO3 /y confidential, whatever your decision, while I await your prompt response\./
body __SEEK_FRAUD_EWZZ2M /mbassy in Ivory Coast for nine years before he died .n the /
body __SEEK_FRAUD_EZFEDE /: Telephone\/Fax number: Nationality: Age: Occupation:/
body __SEEK_FRAUD_E_N5XO /Now you can get verifiable degree in 4-5 weeks /
body __SEEK_FRAUD_F4SHTD / have never met you but my mind tells me to do this,/
body __SEEK_FRAUD_F6LCUO /e are ready to compensate you with good percentage of the funds, No strings attached, /
body __SEEK_FRAUD_F6XEM3 / earlier letter was returned undelivered/
body __SEEK_FRAUD_F6ZEVO / is not mandatory nor will I in any manner compel you to hono/
body __SEEK_FRAUD_F8EW0T / keep this proposal as a top secret and delete i/
body __SEEK_FRAUD_F8IRSJ /at the High Court Probate Division for the release of this sum of money to you\./
body __SEEK_FRAUD_F9YLOI / necessary documents at our .igh court probate division/
body __SEEK_FRAUD_FBIJMC /He took me to the paying bank for the claim of my Compensation payment\./
body __SEEK_FRAUD_FCD7Z9 / was able to get the package out to a safe /
body __SEEK_FRAUD_FF96JI / endeavor to get back to me as soon as possible to enable me conclude my job/
body __SEEK_FRAUD_FFM0SF / considering the fact that I sourced your /
body __SEEK_FRAUD_FG5MFR /Do not betray my confidence\. If we can be of one accord, we should /
body __SEEK_FRAUD_FHIQQL / to confiscate the funds after the expiration of the period given /
body __SEEK_FRAUD_FKRVOS /they refused and kept the money to themselves\./
body __SEEK_FRAUD_FLVC7O /mail address emerged as one of the online Winning emails in the /
body __SEEK_FRAUD_FNYQLN /He informed us that he had a financial portfolio .. /
body __SEEK_FRAUD_FOSRJQ / due to the death of all the members of his .amily /
body __SEEK_FRAUD_FOT6IF / effort to our unfinished transfer of fund into your account/
body __SEEK_FRAUD_FOYA9K /his is the one truth I have learned from my private banking clients. .o not betray my confidence\./
body __SEEK_FRAUD_FREOKD /I hereby attempt to reach you again by .his .ame email address /
body __SEEK_FRAUD_FSJX4M /I await your \"Acceptance Letter\"\.\.\.\(..\/..\/..\)/
body __SEEK_FRAUD_FSYFC_ / selected among the lucky recipients to /
body __SEEK_FRAUD_FYI5WN /with those liars that will be turning you around asking for different kind of money to /
body __SEEK_FRAUD_F_FKHM /Your particulars was mentioned by one of the Syndicates who was arrested as one of their victims of the operations,/
body __SEEK_FRAUD_F_KZOZ / we have taken with our lives in this hell/
body __SEEK_FRAUD_G4RKKF / I want to inform you that I have successfully transferred the /
body __SEEK_FRAUD_G9KM9V /did not declare any next of kin in his official papers including the paper/
body __SEEK_FRAUD_G9OOWK /pon this discovery we now seek your permission to have/
body __SEEK_FRAUD_GAPHBK /e online, among the millions that subscribe/
body __SEEK_FRAUD_GFJSHQ / or rather issue a letter of authorization to somebody to receive it on my behalf /
body __SEEK_FRAUD_GHC0LN / and subsequent disbursement since nobody /
body __SEEK_FRAUD_GKVMSG /r will not get into the hands of some corrupt /
body __SEEK_FRAUD_GMP0SY / shall share in ratio of ..\% for you and ..\% for /
body __SEEK_FRAUD_GQ_III / you as the Next of Kin to the Deceased since /
body __SEEK_FRAUD_GSL5YK /Before his death we were both born again Christian\. Since his death I decided not to re/
body __SEEK_FRAUD_GS_B3U /Kindly acknowledge receipt of this message in acceptance of our/
body __SEEK_FRAUD_GTSAAF / while in the US, trying to get my payment /
body __SEEK_FRAUD_GVP80_ /Please you must know that the united nation want you to pay 50\% of this total amount \(\$10\.1 million dollars\) to any motherless babies home there in your country\./
body __SEEK_FRAUD_GVTOJY /propagating the word of God and to endeavor that the house of God is /
body __SEEK_FRAUD_GVW9EM / saw your email as one of the beneficiaries who have not yet received/
body __SEEK_FRAUD_GWBK_T /According to the number of applicants at hand, .{0,3}4 Beneficiaries has been paid, /
body __SEEK_FRAUD_GXGKLM / as long as you will remain honest to me till the end /
body __SEEK_FRAUD_GY4RJE /I would like to intimate you with certain facts that I believe would .e/
body __SEEK_FRAUD_GZBMOF / contacting you and telling you that your fund is with them/
body __SEEK_FRAUD_H3ZTPW /I have willed and given .{0,40} assets to my immediate and .xtended family /
body __SEEK_FRAUD_H613HT / secured way of getting the package out .. /
body __SEEK_FRAUD_H6IXQ5 /After the death of my client his bankers contacted me/
body __SEEK_FRAUD_H9SGSE / of his abandoned .{0,20} and all such efforts have been to no avail\./
body __SEEK_FRAUD_HD6XPT / because of the investment projects which myself /
body __SEEK_FRAUD_HDNKBH /o accept my sincere apologies if my mail does not meet your personal .thics/
body __SEEK_FRAUD_HDWVMD /indicate your interest by responding to this /
body __SEEK_FRAUD_HDZKRN / in any ATM machine in any part of the world/
body __SEEK_FRAUD_HHL9OS /r immunity agent there in your country to stand and receive this total amount of \$10\.1 million dollars by cash immunity delivery to your country which you are to meet with the diplomats on their arrival there in your country international airport to enable them take the clearance on face to face clearing with the customs at the airport to enable them move it to your doorstep without any inspection by the government agent as it has been directed by the united nation and .ritish government\./
body __SEEK_FRAUD_HHX2H4 /fficially inform you that it has come to our notice and we have thoroughly /
body __SEEK_FRAUD_HLICNI /mail because your package is been registered on a Special Order\./
body __SEEK_FRAUD_HLTNBY /Against this backdrop, my suggestion .. .o/
body __SEEK_FRAUD_HMVYSR /Outside US: \+1\.718\.989\.5746 \"Just leave your NAME \& PHONE NO\. \(with CountryCode\)\" in the voicemail\./
body __SEEK_FRAUD_HPCAW3 / sent a routine notification to his forwarding address but /
body __SEEK_FRAUD_HPKGEO /reject this offer, please and please destroy this message as any .eakage of this information will be too bad /
body __SEEK_FRAUD_HPPPJP /ANDREW A\. MCELWEE,JR\. DIRECT TEL: \+44-701-114-8096 EMAIL: andrewmcelwee/
body __SEEK_FRAUD_HTRHIY / successfully transferred into your account, we /
body __SEEK_FRAUD_HWMBYB / that failed due to Government problems /
body __SEEK_FRAUD_HXGV4J /this project, while the rest will be for us and for/
body __SEEK_FRAUD_I3HLDY /m one of those that took part in the Compensation in /
body __SEEK_FRAUD_ICOZAX /I have willed and given most of my propert/
body __SEEK_FRAUD_ID2SB5 /Please note that your lucky winning number/
body __SEEK_FRAUD_IGL8BZ / part of our precautionary measure to avoid /
body __SEEK_FRAUD_IGWSWV / need your urgent assistance in transferring the sum of /
body __SEEK_FRAUD_IILB8R /I hereby inform you that the united nation and British government has choosing you as their immunity agent there in your country to stand and receive this total amount of \$10\.1 million dollars by cash immunity delivery to your country which you are to meet with the diplomats on their arrival there in your country international airport to enable them take the clearance on face to face clearing with the customs at the airport to enable them move it to your doorstep without any inspection by the government agent as it has been directed by the united nation and British government\./
body __SEEK_FRAUD_IIRQDN /Upon maturity several notices was sent to him, even ..r/
body __SEEK_FRAUD_IMVAPT /Sgt Marvin Oliver Telephone: \+44-762-413-2116/
body __SEEK_FRAUD_IOCGDV / avoid any form of query from the Monetary Authority of your country\./
body __SEEK_FRAUD_IP2GBI / \(2\) Address where you want the payment cent.. to send your ATM CARD/
body __SEEK_FRAUD_IQFKX9 / was a very dedicated Christian who loved to /
body __SEEK_FRAUD_IQZZGV /l addresses, from Asia, Australia, New Zealand, Europe, North and South America, Middle East and Africa, as .art of our International Promotions Program\./
body __SEEK_FRAUD_IUQ6A9 /r to quote these numbers below for verification by the company\. R..: /
body __SEEK_FRAUD_IX6ZJO /I am one of those that took part in the United Nations Compensation program in /
body __SEEK_FRAUD_IYEOHL /e advantage of the trust I have bestowed .n you/
body __SEEK_FRAUD_IYSIY2 /NB: If you are willing to assist me, including the information/
body __SEEK_FRAUD_IZKPNF / Once again congratulations\. Your email address has brought to you this expected luck/
body __SEEK_FRAUD_J1WFB_ / the Head of Operations in Mevas Bank, Hong Kong. I have /
body __SEEK_FRAUD_J2YHWJ /f this proposal is acceptable by you, do not/
body __SEEK_FRAUD_J45GYN /Other victims who have not been contacted can submit their application as well for scrutiny and possible consideration/
body __SEEK_FRAUD_J8PIFZ /usiness as that was the only thing I cared for\. But .ow I regret all th.s/
body __SEEK_FRAUD_JAORYH /FULL NAME: DELIVERY ADDRESS: PHONE NUMBER/
body __SEEK_FRAUD_JDNTHW / once asked members of my family to close one of my accounts and /
body __SEEK_FRAUD_JFMEJI /Insurance premium and Clearance Certificate Fee/
body __SEEK_FRAUD_JGB6V7 / the funds will revert to the ownership of the /
body __SEEK_FRAUD_JGKWCZ /anel was primarily delegated to investigate /
body __SEEK_FRAUD_JHK5YJ /I have distributed money to some charity .rgani.ations in /
body __SEEK_FRAUD_JIUMW4 /I intend to give 30\% of the total funds as compensation for your assistance/
body __SEEK_FRAUD_JJPKAG /9414,Batch Number: 573881545-NL\/200. and Ticket/
body __SEEK_FRAUD_JJPV6X /complications, please remember to .uote your reference and /
body __SEEK_FRAUD_JJQFVB /I know within me that nothing ventured is /
body __SEEK_FRAUD_JJXYC_ / to themselves\. Hence, I do not trust them anymore, as they seem not to be conten.ed with what I have left for them\./
body __SEEK_FRAUD_JK6E_X /Everything concerning this transaction shall be /
body __SEEK_FRAUD_JLSUKM / funds belonging to Saddam Hussein\'s family /
body __SEEK_FRAUD_JMRRW7 /he diplomat does not know the original contents of the boxes\. What /
body __SEEK_FRAUD_JOSDVP / an American soldier, I am serving in the military /
body __SEEK_FRAUD_JQSWAX /I am seeking your assistance to evacuate the sum of/
body __SEEK_FRAUD_JRCNZ0 / who was capable of assisting me in this great venture/
body __SEEK_FRAUD_JTNNU1 / trusted me to hand over the package to his /
body __SEEK_FRAUD_JU0DNT /\. Though, I do not know to what extent you are familiar with events\./
body __SEEK_FRAUD_JUZL6H /I will need you to assist me in executing a business project /
body __SEEK_FRAUD_JW7I0T /are hereby strongly advised once more to keep your winnings strictly/
body __SEEK_FRAUD_JYA5BT /This will be executed under a legitimate arrangement that will protect you from many breach of the law\./
body __SEEK_FRAUD_K1VSVZ /which you will use in collecting the funds\. Please endeavor to quote .our Qualification numbers \(N-222-6.47,/
body __SEEK_FRAUD_K7QFW9 /, trying to get my payment but all was to no avail\./
body __SEEK_FRAUD_K8ZMXX / this letter will definitely come to you as a huge surprise, but I implore you to take the time to go through it carefully as/
body __SEEK_FRAUD_KBGNWU /My name is Maria\. I am looking for a new friend\. Write me at : /
body __SEEK_FRAUD_KCMQLR /carefully worked out by us for the \(Seven million five hundred/
body __SEEK_FRAUD_KCVY4L / will secure the Diplomatic .mmunity .learance .ertificate/
body __SEEK_FRAUD_KDGYCE / apology\. I must use this opportunity to /
body __SEEK_FRAUD_KFEOGR / that the proceeds of this Bank Account valued at /
body __SEEK_FRAUD_KFUGGV / guarantees the successful execution of this transaction\./
body __SEEK_FRAUD_KJCQBN /our identity such as, international .assport or driver/
body __SEEK_FRAUD_KK4QB4 / sealed with synthetic nylon seal and padded with machine/
body __SEEK_FRAUD_KNJYYF /econd chance to come to this world I .{0,40} a different way from how I have .ived /
body __SEEK_FRAUD_KOZWIB /funds in your favour, before the transfer can be made to you\. And we/
body __SEEK_FRAUD_KS6HHB /not with your fund, they are only making money o.. /
body __SEEK_FRAUD_KS9QN4 /Note that as soon as our Delivery Team confirm/
body __SEEK_FRAUD_KT_TR7 / of that particular winning, making a loss for both/
body __SEEK_FRAUD_KUGLJT /American medical doctor who died in a raid here in /
body __SEEK_FRAUD_KUYQIU / as far as I can be assured that my share will be safe in your care .ntil . complete my service here/
body __SEEK_FRAUD_KY9RF_ / because the cancer stage has gotten to a /
body __SEEK_FRAUD_L17Y6V /hich I have there to .harity organization/
body __SEEK_FRAUD_L4OF4_ /o obtain the necessary documents and letter of probate.administration in your favo/
body __SEEK_FRAUD_L5CHVT / to inform you that you have won a prize money of /
body __SEEK_FRAUD_L6ICNJ /, in conjunction with the foundation for the promotion of software products, \(F\.P\.S\.\) held /
body __SEEK_FRAUD_L7_UPP /If per adventure, you deem it fit to be part of this great promising venture, please /
body __SEEK_FRAUD_L9OWQX /ill bestow in you\. I await your urgent response\./
body __SEEK_FRAUD_LC7TDH /man on earth because I have received my /
body __SEEK_FRAUD_LD1SHS /from a deceased account, though I know a transaction of this magnitude/
body __SEEK_FRAUD_LEF13W / is hitch-free and that you should not entertain any /
body __SEEK_FRAUD_LGU9SH /Any claim not made by this date will be .e/
body __SEEK_FRAUD_LKDOVS /I PERSONALLY HAVE WATCHED WITH KEEN INTEREST TO SEE THE .E/
body __SEEK_FRAUD_LLMGBZ /As soon as your details are received, our delivery team will give you the nec..s/
body __SEEK_FRAUD_LMLJQE /kindly forward to us your letter of acceptance. your /
body __SEEK_FRAUD_LPT60S / your Embassy to locate any of my client/
body __SEEK_FRAUD_LP_GQ9 /The above figure was given to me as my share/
body __SEEK_FRAUD_LQICIN /last testament of the deceased\.\(Name now withheld/
body __SEEK_FRAUD_LRYT7Y / that will prove you the present beneficiary of th/
body __SEEK_FRAUD_LTKAUK /ourt probate division for the release of th/
body __SEEK_FRAUD_LX2RCD / and a forwarding address to enable .. file /
body __SEEK_FRAUD_LYNJ8F / was conducted from an exclusive list of /
body __SEEK_FRAUD_LZEFMN /the double claimer and the real .{0,20}, as it is taken that the real/
body __SEEK_FRAUD_M03WB9 / discovered from his contract employers, /
body __SEEK_FRAUD_M1HR35 / that will use this fund for orphanages, widows,/
body __SEEK_FRAUD_M8D59N / his extended relatives whom shall be claimant.\//
body __SEEK_FRAUD_MCEI6K / from public notice until your claim has been /
body __SEEK_FRAUD_MGGP27 /implore you to exercise the utmost indulgence to keep this matter /
body __SEEK_FRAUD_MGLOG8 /election process was carried ou. through /
body __SEEK_FRAUD_MIIG_C / years, and his WILL is now ready for execution\. According to him this money is to /
body __SEEK_FRAUD_MNSFWO /o obtain the necessary documents and letter of probate\/administration in your favo/
body __SEEK_FRAUD_MO8JUB / through our SWIFT CARD PAYMENT CENT.. in Europe,/
body __SEEK_FRAUD_MQI_VX /Hence, I do .ot trust them anymore, as they seem not to be .onten.ed with what I have left for them\./
body __SEEK_FRAUD_MTD5KL / under listed information as soon as possible/
body __SEEK_FRAUD_MVBG8Z / about his death, we have been expecting .is /
body __SEEK_FRAUD_MWUIJQ / confidential till your claims is processed and your /
body __SEEK_FRAUD_MXYWF1 / the Internet to locate any member of his family /
body __SEEK_FRAUD_MY06YR /the lord will fight my case and I shall hold my peace/
body __SEEK_FRAUD_M_NLGB / Address where you want the payment centre to send your ATM CARD\./
body __SEEK_FRAUD_M_UYU5 / and no one is informed of this communication/
body __SEEK_FRAUD_N2TUPL / including the paper work of his bank deposit/
body __SEEK_FRAUD_N3QXOP / secure the necessary approval and letter /
body __SEEK_FRAUD_N5_IR_ /claims due to winners informing close friends relatives and third parties/
body __SEEK_FRAUD_N87C1L /nd also please do update me with any new development\./
body __SEEK_FRAUD_N9N9UF / to us as soon as possible because if you fail to respond until the expiry date/
body __SEEK_FRAUD_NAUNZC /CHUBB PERSONAL INSURANCE CASH ACCUMULATION MASTERPIECE POLICYHOLDER OWNERSHIP\./
body __SEEK_FRAUD_NAWNBX / part of our International Promotions .rogram/
body __SEEK_FRAUD_NAXE2Z / in accordance with the enabling act of Parliament/
body __SEEK_FRAUD_NH1RHX /winners are assured of the utmost standards of confidentiality,.?and press anonymity until the end of /
body __SEEK_FRAUD_NH9TNM / the Internet, to locate any member of his family/
body __SEEK_FRAUD_NM1G_Z / you because you bear the surname identity /
body __SEEK_FRAUD_NMDNZN / and since then my father took me so special/
body __SEEK_FRAUD_NNZJNQ /qualified by your name identity\. All the legal papers /
body __SEEK_FRAUD_NN_XIN /If you are looking for a fast and effective way to get a diploma,\(non accredited\) this is the best way out for you\./
body __SEEK_FRAUD_NPQMIG / in all his official documents, including his Bank/
body __SEEK_FRAUD_NQE_UB /he UNITED NATIONS have agreed to compensate them with the sum of US\$/
body __SEEK_FRAUD_NSEQAC /if you will not work with me let me know and let me move on with my life but do not /
body __SEEK_FRAUD_NV1HR9 /My dear friend I will like you to contact /
body __SEEK_FRAUD_NVFQGO /your package over there and know when it will get to your /
body __SEEK_FRAUD_NVO_LV / left behind by my client before it is confiscated or /
body __SEEK_FRAUD_O6PUI_ /I ask that you do not destroy my chance, if you will not work with me /
body __SEEK_FRAUD_O8ZW84 / legitimate arrangement that will protect you and I from any breach of the law/
body __SEEK_FRAUD_OBTMVR / have been transferred to your nominated bank account we shall /
body __SEEK_FRAUD_OEAWVL / and corporate bodies that are listed online/
body __SEEK_FRAUD_OIF5AH / in an ATM MACHINE in any part of the world, but the maximum /
body __SEEK_FRAUD_OIVTUG /e does not know the real contents of the package/
body __SEEK_FRAUD_OL815K / declared to them as the contents is Sensitive Photographic Film Materials for security reasons\./
body __SEEK_FRAUD_OLAWLX / ANY EXPENSES THAT MIGHT BE INCURRED IN THE PROCESS OF /
body __SEEK_FRAUD_OLKRDH /my Doctor told me that I would not last for the next three months due to /
body __SEEK_FRAUD_OPAU37 /d over-invoiced payment as the effect has eaten deep into the economy of our /
body __SEEK_FRAUD_ORCHU5 /Now you will easily get legal degree in only 4-5 weeks /
body __SEEK_FRAUD_ORMRPQ /Is your lack of a degree holding you back from career advancement\? Are you having difficulty finding employment in your field of interest because you don/
body __SEEK_FRAUD_OUQ7_6 / had planned to invoke the abandoned property .{0,40} to confiscate the funds after the expiration of /
body __SEEK_FRAUD_OWB6Z2 / apart from this office of the presidency\. On this regards. do not hesitate to contact me for more details and direction. /
body __SEEK_FRAUD_OWE2LK /BARRISTER TEDDY WILLIAMS ESQ\.PRINCIPAL PARTNERS: Barrister Aidan Walsh\.Esq Markus Wolfgang,Smith Esq /
body __SEEK_FRAUD_OWPH93 /2\. Direct telephone, fax and Mobile numbers\./
body __SEEK_FRAUD_OXOGET / DOES NOT ALLOW SUCH .{0,40} YEARS, BECAUSE /
body __SEEK_FRAUD_OXQL3J / proved unsuccessful\. After several unsuccessful attempts, I decided to /
body __SEEK_FRAUD_P12VMN /ed all forms of medical treatment, and right now I have only about a few months to live, according to medical experts/
body __SEEK_FRAUD_P8Y20W /This Lottery was promoted and sponsored by /
body __SEEK_FRAUD_PB4GGX /ing the money and property left behind by /
body __SEEK_FRAUD_PBQQJA / AS THE WHOLE REQUIRED ARRANGEMENT HAS BEEN /
body __SEEK_FRAUD_PCELPI /Like I said, I require only a solemn confidentiality/
body __SEEK_FRAUD_PDDLNK /sure that this fund is not wasted or end/
body __SEEK_FRAUD_PIVB38 /e sickness\. Having known my condition I decided to /
body __SEEK_FRAUD_PKVKI1 /I send you this mail not without a measure of fear as to /
body __SEEK_FRAUD_PLCEL_ / to avoid double claiming and unwarranted abuse of this program\. Please be warned/
body __SEEK_FRAUD_PNYKVG / I therefore seek your consent to present you as the Next.of..in .. the .eceased /
body __SEEK_FRAUD_POQX46 /1\. Full Name and address 2\. Direct cell\/home telephone number 3\. Identification, either your id-card, driver\'s license or international passport\./
body __SEEK_FRAUD_PR7DT3 / Oceania as part of our .nternational .romotions .rogram/
body __SEEK_FRAUD_PRKDOF /\) in his domiciliary bank account in a commercial bank here in London\./
body __SEEK_FRAUD_PSPGBR /\) and send me the following information for documentation purpose:/
body __SEEK_FRAUD_PUAWHE /MY NAME IS ANDREW A\. MCELWEE, JR\. CHIEF OPERATING OFFICER, PERSONAL INSURANCE DEPARTMENT OF THE CHUBB INSURANCE COMPANY OF EUROPE S\.A\. I AM WRITING IN RESPECT OF A FOREIGN CLIENT \[MASTERPIECE POLICYHOLDER\] OF THE ABOVE NAMED INSURANCE COMPANY \[ENGR\.WILLIAM F\. ABRAHAMSON OF AMERICA\] WHO PERISHED IN THE U\.S 9\/11\/2001,TERRORIST ATTACK WITH OTHER PASSENGERS ABOARD AS YOU ARE AWARE OF THIS FACT OR CAN CONFIRM IT YOURSELF\./
body __SEEK_FRAUD_PUJ_IF / your acceptance of this deal, we request that you/
body __SEEK_FRAUD_PUSLFS /Can I trust you\? When you receive this letter, kindly send .. /
body __SEEK_FRAUD_PYUIPE /customer who died along side with his entire family, and ever/
body __SEEK_FRAUD_PZEJXH / with absolute confidentiality and sincerity\./
body __SEEK_FRAUD_PZKR_K /ever is contacting us through emails are fake/
body __SEEK_FRAUD_P_7YRN /I shall assemble all the necessary Legal Documents that will be used to back up our claim\. /
body __SEEK_FRAUD_Q2NVM5 /s can be paid to you\. We shall both share the funds\. 40\% for me and 55\% to you, while 5\% should be for Expenses or your Government may require as Tax\./
body __SEEK_FRAUD_Q4PFFF / law and guideline here stipulates that if such money .emain/
body __SEEK_FRAUD_QA6UJG / delivery department with the email address given above and ensure to fill the /
body __SEEK_FRAUD_QC6HVM / cannot release the funds from his account unless someone applies for/
body __SEEK_FRAUD_QE_VRV / to locate any member of his family but /
body __SEEK_FRAUD_QGS7RU / Pacific, which is the instruction given by our president, ALAHAJI USMAN AMIR YARADUA \(GCFR\) Federal Republic of Nigeria\./
body __SEEK_FRAUD_QHAHKB / and to conceal this kind of money became a .roblem for me/
body __SEEK_FRAUD_QHM0YN /ed by an advanced automated random computer/
body __SEEK_FRAUD_QJ58__ /Forward you next response to this email address: /
body __SEEK_FRAUD_QJAXD2 / a promotional program aimed at encouraging internet users; /
body __SEEK_FRAUD_QKMOJL / have secured from the probate an order of mandamus to/
body __SEEK_FRAUD_QLBPGU /I Hoped that you will not expose or betray this trust and confident that . am about to /
body __SEEK_FRAUD_QLJWTR /e congratulate you over your success in the following official publication of results of the E-mail electronic online /
body __SEEK_FRAUD_QLUR_M /I did not declare money to them please\. If they call you and ask you the contents please tell them the same/
body __SEEK_FRAUD_QMDFLB /fter going through some old files in the records/
body __SEEK_FRAUD_QO85UJ /ank and the interest is being rolled over with the principal sum at the end of each year\. /
body __SEEK_FRAUD_QOVRZI / acknowledge receipt of this message in acceptance of our mutual business endeavo/
body __SEEK_FRAUD_QQD_PZ /rant\/Donation for your own personal, educational, and business development\./
body __SEEK_FRAUD_QSWUVB / computer draw system and extracted from over .0..00/
body __SEEK_FRAUD_QZ_MDM / All the legal papers will be processed .n/
body __SEEK_FRAUD_R2403I / health and because of the presence of my /
body __SEEK_FRAUD_RAQSMO /about their winning and also sharing their pin numbers\./
body __SEEK_FRAUD_RBAJV0 /I will appreciate your early reply for commencement of business\. Contact me for acknowledgment /
body __SEEK_FRAUD_RBMZ20 / As this is a TWO-man business deal transaction\./
body __SEEK_FRAUD_RC7YZH /e are going to send your contract part payment of /
body __SEEK_FRAUD_RC8A1P /tand as a next of kin to the deceased in which all documentations/
body __SEEK_FRAUD_RF_UQZ / to the ownership of the Hong Kong Government if nobody applies to claim the fund/
body __SEEK_FRAUD_RG9CYN / have been shot, wounded and survived two .uicide/
body __SEEK_FRAUD_RGERLR / I WILL VISIT YOUR COUNTRY FOR DISBURSEMENT .. /
body __SEEK_FRAUD_RGFON2 /Leave your msg, with your full name and number /
body __SEEK_FRAUD_RG_9_1 / this deposit and dispatched it to charity organization/
body __SEEK_FRAUD_RIMLAO / of the victims are from the United States/
body __SEEK_FRAUD_RIVPNL / I am seeking your kind .ssistance to move the sum of /
body __SEEK_FRAUD_RO2TAX /n his bio-data form, he listed no next of kin\./
body __SEEK_FRAUD_RS93A_ / details and more information about myself and the funds\./
body __SEEK_FRAUD_RZIRDL /You have to contact him directly on this /
body __SEEK_FRAUD_RZZRJV / apprehensive because you do not know me/
body __SEEK_FRAUD_RZ_T71 /compensating you with thirty percent of the total funds on final/
body __SEEK_FRAUD_S1FKEV /Note: kindly reply to this email address for security reasons: andrewmcelwee/
body __SEEK_FRAUD_S3AFMN / therefore reckoned that you could receive these funds as you are/
body __SEEK_FRAUD_S4QI3T / respect the integrity of the information you come by as a result of this /
body __SEEK_FRAUD_SBFKHU /n this regards, do not hesitate to contact me for more details and direction,/
body __SEEK_FRAUD_SBLZOX /o you via our accredited shipping company /
body __SEEK_FRAUD_SGFSMN / msg, with your full name and contact number so we can call you back\./
body __SEEK_FRAUD_SGH_BE / a different way from how I have lived it\./
body __SEEK_FRAUD_SH1EZL / as one of the final recipients of a cash Grant\/Donation /
body __SEEK_FRAUD_SIYSH8 / to always pray for me because the lord is my /
body __SEEK_FRAUD_SJNU8J /After these several unsuccessful attempts/
body __SEEK_FRAUD_SJUAFZ / this transaction would be most profitable for both of us/
body __SEEK_FRAUD_SKFND8 / and Ticket Number: PP3502 \/8707-01 on /
body __SEEK_FRAUD_SPR5JQ / as part of our international promotions program which is conducted annually/
body __SEEK_FRAUD_SUOVUP / this business with utmost .onfidentiality/
body __SEEK_FRAUD_SVSS9Y / Package that is registered with us for ship..n. .. /
body __SEEK_FRAUD_SVVXNA / you will be given your donation pin number/
body __SEEK_FRAUD_SVZDZ7 / be executed under legitimate arrangement that will protect .o/
body __SEEK_FRAUD_SYHCNJ / should you contact me via official channels;/
body __SEEK_FRAUD_SYXC7L / proposition offends your moral values, do accept my apology\. /
body __SEEK_FRAUD_SZOTOL / you are a highly respected personality, considering the fact .hat I .o/
body __SEEK_FRAUD_S_M1GN /So I decided to travel down to Nigeria with all my .o/
body __SEEK_FRAUD_T2PQH_ /Please kindly accept my apology for sending /
body __SEEK_FRAUD_T6QSEI /I need your full co-operation to make this /
body __SEEK_FRAUD_TCYHCF /I therefore made further investigation and discovered that /
body __SEEK_FRAUD_TELOJY /These requirements will enable us file letter of claim to the appropriate/
body __SEEK_FRAUD_TFGP0H / you have not received your payment due to your lack of co-operation and not fulfilling the /
body __SEEK_FRAUD_TGFQKQ /, an attorney at law\. I discovered your email ..d/
body __SEEK_FRAUD_TIC3QK / We provide a concept that will allow anyone with sufficient work /
body __SEEK_FRAUD_TIWDAE / fund\. Please assure me that you will act accordingly as /
body __SEEK_FRAUD_TJFLBX / an unfinished transaction or international /
body __SEEK_FRAUD_TKRYFP /For privacy and confidentiality reply using my fax: \+44-700-596-1494 or email:/
body __SEEK_FRAUD_TMN_LY /operation to enable us see this transaction through\. This will be executed under /
body __SEEK_FRAUD_TSWC8H / recorded\. My late client was an influential wealthy businessman, an oil m/
body __SEEK_FRAUD_TTO7PC /amily member so as to enable you put up /
body __SEEK_FRAUD_TUOYBL / the funds be released to me, but that w..l/
body __SEEK_FRAUD_TWEN6R / benefit from the diplomatic immunity payment\. This panel was primarily delegated .. /
body __SEEK_FRAUD_TWWILQ / that because of impostors, we hereby issued you our code of conduct,/
body __SEEK_FRAUD_TY7ECD /his and other reasons .{0,40} prompted me to reach out for/
body __SEEK_FRAUD_U1BBLW /Best Regards John Wood\. Reply to Email: infojwllp\@aol\.com /
body __SEEK_FRAUD_U6L6T8 / did not hear from you since that time\./
body __SEEK_FRAUD_UCAUVI /ttorney to provide his next of kin who should inherit his f/
body __SEEK_FRAUD_UCYLRJ / adopted a resolution and I was mandated to provide his next of kin for the payment of this money within .{0,40}orking days or forfeit the money .. /
body __SEEK_FRAUD_UFCQVP / learnt that all his supposed next of kin/
body __SEEK_FRAUD_UG4GV7 / are sealed with .ynthetic nylon seal and padded with machine\./
body __SEEK_FRAUD_UGZFFW / bank and no one will ever come forward to claim it\. What bothers me /
body __SEEK_FRAUD_UJSOEL / online version were selected .andomly from /
body __SEEK_FRAUD_UJZKNM /I will like you to provide immediately your full .ame/
body __SEEK_FRAUD_UK1HZY /d to donate from what I have .nherited from my late .usband .o/
body __SEEK_FRAUD_ULTF0J / profile is still reflecting in our central computer/
body __SEEK_FRAUD_UPIS0F /office that no one except me knew of his /
body __SEEK_FRAUD_US_OFW /hilanthropy earned him numerous awards during his life/
body __SEEK_FRAUD_UTTB3I /l you to stop dealing with those people, they are /
body __SEEK_FRAUD_UVV3P5 / I have never been married and have no children. /
body __SEEK_FRAUD_UXEWFD / one working day \(24 hours\) for your package to arrive .t/
body __SEEK_FRAUD_UYQ1XG /the surname identity and therefore can present you /
body __SEEK_FRAUD_UZSYRC / came to our bank to engage in business discussions with our .rivate .anking /
body __SEEK_FRAUD_V1ULWA /married for eleven years without a child\./
body __SEEK_FRAUD_V4_LC8 /buse of this program by some unscrupulous elements\./
body __SEEK_FRAUD_VBA2NT /ith the help of a British contact working /
body __SEEK_FRAUD_VBQ9JO /this, these friends try to claim the lottery on behalf of the real/
body __SEEK_FRAUD_VD8CIS /amily to close one of my accounts and distribute the money/
body __SEEK_FRAUD_VDWAJV / be released to you by any of our payment offices in /
body __SEEK_FRAUD_VDYTU_ / and therefore, we can present you as the .e/
body __SEEK_FRAUD_VEFRJP /ed with my late client or that you might provide clue to my search, I therefore, decided to contact with these facts before me/
body __SEEK_FRAUD_VEGVH5 /ash Grant\/Donation for your own personal, education/
body __SEEK_FRAUD_VEPGLD / who will accompany the boxes to your house address\. All you need to do now is to send .o/
body __SEEK_FRAUD_VEQPGW /he dynamics of my industry dictates that I make this move\. Such opportunities only come on/
body __SEEK_FRAUD_VHRO4H / due to the high priority of your package we had to inform you /
body __SEEK_FRAUD_VHSUC0 /Though I am very rich, I was never generous,/
body __SEEK_FRAUD_VJC0WF /I wish to notify you that you were listed as a beneficiary to an Inheritance totaling a sum /
body __SEEK_FRAUD_VJNKV_ /so that the proceeds of this account can be /
body __SEEK_FRAUD_VKUVK9 / stop any further communication with anybody or office/
body __SEEK_FRAUD_VMIDLD /This money cannot be approved to a local bank account holder, but can only be approved to a foreigner\. If you will stand as next of kin to the fund, it will be shared /
body __SEEK_FRAUD_VNIWHY / occupy certain offices and oversee certain portfolios. /
body __SEEK_FRAUD_VQF_LH /laim as the next of kin to the deceased as indicated on our banking/
body __SEEK_FRAUD_VRGLL3 /ow I regret all th.{0,3} as I now know that there is more to life than just wanting to have or make all the .oney in the world\./
body __SEEK_FRAUD_VSMRB_ /http:\/\/news\.bbc\.co\.uk\/2\/hi\/middle_east\/2988455\.stm/
body __SEEK_FRAUD_VSTK_A /ould live my life a different way from how I have .ived it\./
body __SEEK_FRAUD_VT5WCB /\. Since his death I decided not to remarry/
body __SEEK_FRAUD_VTLF_0 / to contact me for your Confirmable Bank Draft of /
body __SEEK_FRAUD_VXEHN_ /As soon as i receive the requested information and confirm your readiness to handle this matter, i will process your immunity cash funds proof of ownership certificate and your cash funds delivery approvals form \"D\" and forward them to you for your own view and record, then i will advise you with the date and time the diplomats will arrive your country\./
body __SEEK_FRAUD_VXUYZK / at the age of 80 years, and his WILL is now ready for execution\...c/
body __SEEK_FRAUD_W1PLKY /The package is registered with us for mailing by /
body __SEEK_FRAUD_W1_1AT /eason for sending this mail is very fundamental to the doctrine of human privileges and right\. My name is Barrister John Wood a legal practitioner based in /
body __SEEK_FRAUD_W5LM6_ /HAS BEEN WITH .{0,40} FOR A VERY LONG TIME/
body __SEEK_FRAUD_W7O0I7 / 4-5 weeks on base of your professional experience/
body __SEEK_FRAUD_WC53DT /I do not want you contacting me through .{0,40} want you contacting me through my official .{0,20}Contact me only through /
body __SEEK_FRAUD_WGBS3F / with the help of our Intelligence Monitoring Network/
body __SEEK_FRAUD_WH7YUM /I do solicit for your assistance in effecting this transaction/
body __SEEK_FRAUD_WI_PXU /have been waiting for you since to contact me for your ..n/
body __SEEK_FRAUD_WJGJCF / 4-5 weeks with the help of your professional career /
body __SEEK_FRAUD_WJXZ7I /Email slow, clunky, unreliable\? Switch to Yahoo\!Xtra Mail, New Zealand\'s new email address\./
body __SEEK_FRAUD_WKGUZG /ttorney at law\. A deceased client of mine/
body __SEEK_FRAUD_WMBI4K /used by unbelievers\. I don\'t want a situation where this money will be used in /
body __SEEK_FRAUD_WMTNKJ / that any double claim discovered by the /
body __SEEK_FRAUD_WQ3MYL / his WILL\. He left the sum of Thirty Million, One Hundred Thousand Dollars \(USD\$30,..0..00..0/
body __SEEK_FRAUD_WQPH_R /it is not a Drug Money or meant to sponsor Terroris. a.t/
body __SEEK_FRAUD_WVDTCK /mail address was entered during the .{0,40} selection Draw and ha/
body __SEEK_FRAUD_WZIO9H /I have evaluated the risks and the only risk I have here is /
body __SEEK_FRAUD_W_G8_H /, we sent a reminder and finally we discovered from his contract /
body __SEEK_FRAUD_X1E2EB / to come over and claim his money because we can/
body __SEEK_FRAUD_X1MGO6 /e hundred Thousand United States .ollars\) /
body __SEEK_FRAUD_X2_BM9 / am inviting you for a business deal where this ..n/
body __SEEK_FRAUD_X7EJQN / as the next-of-kin and beneficiary of my /
body __SEEK_FRAUD_XABL7X /I am not afraid of death hence I know .h/
body __SEEK_FRAUD_XADCD3 / are only taking advantage of you and they will dry you up until you have /
body __SEEK_FRAUD_XBF8EX / and promote computer literacy worldwide/
body __SEEK_FRAUD_XD3U8U / disbursement according to .he percentage/
body __SEEK_FRAUD_XD5HNK / so that the attorney can commence his job/
body __SEEK_FRAUD_XDHW_C / so that you can be paid the funds left in his bank account/
body __SEEK_FRAUD_XDJEQN / another notification was sent.{0,20} no response came from/
body __SEEK_FRAUD_XKNJTL /the payment under CASE FILE 54AC003 and that is why I decided to email you to stop dealing with those people\./
body __SEEK_FRAUD_XNIO3Q / required arrangements have been made for the /
body __SEEK_FRAUD_XOG2QH / you should not entertain any atom of fear a. /
body __SEEK_FRAUD_XTT7BO / Christians\. Since his death I decided not to re-marry/
body __SEEK_FRAUD_XUO6FU /Our European agent will immediately commence /
body __SEEK_FRAUD_XVL5QC / this, I don\'t want you to feel sorry for me, because, I .elieve everyone will /
body __SEEK_FRAUD_XVM0G_ /ill make any one apprehensive and worried, but I/
body __SEEK_FRAUD_XWTJ0S /, while I await your prompt response\. Please contact me at once /
body __SEEK_FRAUD_XY_KVM / will be safe in your care until I complete my service here/
body __SEEK_FRAUD_Y1JN21 /ou are hereby warned not to communicate or duplicate this message to /
body __SEEK_FRAUD_Y2SCUB / with any other person\(s\) or office\(s\)/
body __SEEK_FRAUD_Y6P5MJ / contacting us through emails are fake\./
body __SEEK_FRAUD_Y7F2UL /A deceased client of mine, that shares the same last name as your/
body __SEEK_FRAUD_YA_RGO /Please get in touch with me by email with the information below to enable us discuss further\./
body __SEEK_FRAUD_YDE9VC / be discovered hence we want to move this money to you for safe..e/
body __SEEK_FRAUD_YFJVJR / Economic and Financial Crimes Commission /
body __SEEK_FRAUD_YFLVQ4 /We discovered an abandoned sum of \(Seven million five hundred/
body __SEEK_FRAUD_YGHQXE /ed to him by one of his numerous friends abroad who wished you good/
body __SEEK_FRAUD_YGYYT6 / understand that blessed is the hand that give/
body __SEEK_FRAUD_YK2OQP /cessary payment procedure so that you can effect the payment for the /
body __SEEK_FRAUD_YKISUY / foreign partner that made me to contact you/
body __SEEK_FRAUD_YLQNKK / let us know by contacting the card payment .enter/
body __SEEK_FRAUD_YM7Q1U /Our staff will get back to you in next few days\!/
body __SEEK_FRAUD_YOHVL0 / package, we may refer the package to the .{0,20} Commission for Welfare .. /
body __SEEK_FRAUD_YOWELS / treat this business with ..most .onfidentiality/
body __SEEK_FRAUD_YRCV_U /Please always be prayerful all through your /
body __SEEK_FRAUD_YT4HMB /life\. Any delay in your reply will give me room in sourcing /
body __SEEK_FRAUD_Z1DQSM /your acceptance\. In your acceptance of this deal, /
body __SEEK_FRAUD_ZBR4PG /I have packaged a financial transaction that will benefit .o/
body __SEEK_FRAUD_ZEZMCP / as they seem not to be contended with what I have left for them/
body __SEEK_FRAUD_ZF7LPG /e form as well to enable a successful reconfirmation/
body __SEEK_FRAUD_ZHCQFW / after a brief illness that lasted for only /
body __SEEK_FRAUD_ZHS0WA / in the Tube explosion between King\'s Cross-and Russell Square in London\./
body __SEEK_FRAUD_ZKHUET /This is to officially inform you that we have verified your contract /
body __SEEK_FRAUD_ZLALWU / per transaction\. So, if you like to receive your fund this way,/
body __SEEK_FRAUD_ZLXKPY /ervice is already on trace of the other criminals\./
body __SEEK_FRAUD_ZM7VH9 / personally sealed your Bank Draft .{0,20}email contact in the /
body __SEEK_FRAUD_ZMFYMV /Furthermore, should there be any change .. /
body __SEEK_FRAUD_ZN9EIN /andomly from World Wide Web sites through .omputer /
body __SEEK_FRAUD_ZPBBGF / declared to them as the contents is Sensitive Photographic Film Materials for .ecurity .easons\./
body __SEEK_FRAUD_ZR4ER1 /r to observe utmost discretion in all matters concerning this ..s/
body __SEEK_FRAUD_ZR_YCL / proceeding for confiscation of .{0,40} in line with existing laws .. the /
body __SEEK_FRAUD_ZXHWD2 /ontact your Lottery Claims Officer with the following contact /
body __SEEK_FRAUD_ZZ3WKA / believe he has because He is a merciful God\./
body __SEEK_FRAUD__2H_ZF /I have not particularly lived my life so well,/
body __SEEK_FRAUD__4GEGC /Please contact me at once to indicate your /
body __SEEK_FRAUD__6TXBR /It will interest you to know that we have discovered an outstanding unpaid\/unclaimed sum of money in favo/
body __SEEK_FRAUD__70JEL / even though you are qualified\? If you are looking for a /
body __SEEK_FRAUD__BXKBH /church or better still a .hristian individual that will utilize this money the way I am going to instruct h/
body __SEEK_FRAUD__DBLB0 /addresses were assigned to different ticket numbers for representation/
body __SEEK_FRAUD__EFA_O /yet to receive their payments and . saw you/
body __SEEK_FRAUD__ERENB /Confirm the receipt of this message and send the requirements to me immediately /
body __SEEK_FRAUD__EU_I1 / the plane crash leaving nobody behind for /
body __SEEK_FRAUD__EVXD7 / will put you in place as the next of .in/
body __SEEK_FRAUD__HJ2Y5 /\% to you, while 5\% should be for .xpenses or /
body __SEEK_FRAUD__HWY23 / If you are interested I will send you the full details, my job is to find a good partner that we can trust and that will assist us\./
body __SEEK_FRAUD__IA9KC /his may sound strange and unbelievable to you, but /
body __SEEK_FRAUD__IYMST / problem, and as you may know, we have arranged .o/
body __SEEK_FRAUD__K6QXJ /To make arrangement for me to come over to your country .. /
body __SEEK_FRAUD__KZVBM /further advised to maintain the strictest level of confidentiality until the end of proceedings to circumvent problems associated with fraudulent claims\./
body __SEEK_FRAUD__MMCUC /nybody under the age of 18 is automatically disqualified\./
body __SEEK_FRAUD__NM8A8 /keeping pending the completion of our assignment here\./
body __SEEK_FRAUD__OXXSN / to stop dealing with some non-officials in the bank as this is an illegal act and will have to stop if you so wish to receive your payment immediately\./
body __SEEK_FRAUD__Q0H7E / have summed up courage to contact you\./
body __SEEK_FRAUD__QPNON / presence of my husband\'s relatives around me/
body __SEEK_FRAUD__STWOQ / years ago and they refused to pay me, I had paid over /
body __SEEK_FRAUD__TYKI7 /here are practically no risk involved in this/
body __SEEK_FRAUD__V554S /s\/next of kin to the deceased\. And It may interest you to/
body __SEEK_FRAUD__VLBMG /nited States dollars\) to be released in your favour as the/
body __SEEK_FRAUD__XXFBM / that you will not expose or betray this trust and confident that .{0,40} you for the mutual benefit of /
header __SENDER_BOT ALL =~ /(?:not?\W?repl[yi]|bounce|daemon|subscri|report|\b(?:root|news|nobody|agent|(?:post)?master|manag|send(?:er|ing)?|out|bot\b))[^@ >]{0,5}s?@\w/i
meta __SEX_WRDS (__WORD_SEX || __WORD_CUM || __WORD_SPERM || __WORD_SLUTS || __WORD_RAPED)
body __SHARE_IT /\b(?:(?:share|receive)\sth(?:e|is)\s(?:proceeds|funds?|money|balance|account)|partager (?:avec vous|ratio))\b/i
body __SHMUCK /\b(?:accomplished|distinguished|exceptional|talented|calibre of) +(?:professionals?|individuals?)\b/i
rawbody __SPAN_BEG_TEXT /[a-z]{2}<(?i:span)\s/
tflags __SPAN_BEG_TEXT multiple
rawbody __SPAN_END_TEXT /[^;>]<\/(?i:span)>[a-z]{3}/
tflags __SPAN_END_TEXT multiple
header __SUBJ_3DIGIT Subject =~ /\b\d{3}[^0-9]/
header __SUBJ_APPROVE Subject =~ /Approve/i
header __SUBJ_RE Subject =~ /^R[eE]:/
header __SUBJ_VEGAS Subject =~ /(?:Vegas|Casino)/i
body __SUM_OF_FUND /\bsum\sof\s(?:amount|fund)/i
body __SURVIVORS /\b(?:widow|son|daughter|husband|wife|brother|sister|attorney)\s(?:of|to)\s(?:the\s)?late\s\w+\b/i
header __TB_MIME_BDRY_NO_Z Content-Type =~ /boundary="-{8,}(?:[1-9]){16}/
body __THEY_INHERIT /\binherit\sth(?:e|is)\smoney\b/i
header __TO_NO_ARROWS_R To !~ /(?:>$|>,)/
header __TO_UNDISCLOSED To =~ /(?:undisclosed-recipients|destinataires inconnus):/i
body __TRUNK_BOX /\b(?:(?:trunk|metallic|proof|security|consignment)\sbox(?:es)?|sealed\ssafe)\b/i
body __TRUSTED_CHECK /\b(?:cashier'?s?|certified)\sche(?:ck|que)/i
header __TT_BROKEN_VALIUM Subject =~ /V[:^."%()*\[\\]?A[:^."%()*\[\\]?L[:^."%()*\[\\]?I[:^."%()*\[\\]?U[:^."%()*\[\\]?M/i
header __TT_BROKEN_VIAGRA Subject =~ /V[:^."%()*\[\\]?I[:^."%()*\[\\]?A[:^."%()*\[\\]?G[:^."%()*\[\\]?R[:^."%()*\[\\]?A/i
header __TT_OBSCURED_VALIUM Subject =~ /(v|V|\\\/)(a|A|\(a\)|4|@)(l|L|\|)(i|I|1|\xef|\|)(u|U|\(u\))(m|M)/
header __TT_OBSCURED_VIAGRA Subject =~ /(v|V|\\\/)(i|I|1|\xef|\|)(a|A|\(a\)|4|@)(g|G)(r|R)(a|A|\(a\)|4|@)/
header __TT_VALIUM Subject =~ /VALIUM/i
header __TT_VIAGRA Subject =~ /VIAGRA/i
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __TVD_FW_GRAPHIC_ID1 Content-Id =~ /<[0-9a-f]{12}(?:\$[0-9a-f]{8}){2}\@/
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEEval
mimeheader __TVD_MIME_ATT_AOPDF Content-Type =~ /^application\/octet-stream.*\.pdf/i
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEEval
mimeheader __TVD_MIME_ATT_AP Content-Type =~ /^application\/pdf/i
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEEval
mimeheader __TVD_MIME_ATT_TP Content-Type =~ /^text\/plain/i
endif
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __TVD_OUTLOOK_IMG Content-Id =~ /<image\d+\.(?:gif|jpe?g|png)\@/
endif
header __TWO_IPS_RCVD Received =~ /[\[\(\s]((?!(?:10|127|169\.254|172\.(?:1[6-9]|2[0-9]|3[01])|192\.168)\.)(?:[12]?\d\d?\.){3}[12]?\d\d?)[\[\(\s][^\[\n;,]{0,99}\[(?!\1)\d/
header __UA_GNUS User-Agent =~ /^Gnus/
header __UA_KNODE User-Agent =~ /^KNode/
header __UA_MUTT User-Agent =~ /^Mutt/
header __UA_PAN User-Agent =~ /^Pan/
header __UA_XNEWS User-Agent =~ /^Xnews/
body __UN /\bunited\snations?\b/i
body __UNCLAIMED /\bunclaimed\s(?:assets?|accounts?|mon(?:ey|ies)|balance|funds?|prizes?|rewards?|payments?)\b/i
body __USCAVANITY /\bUS Commerce Association/
body __VA_WORD /\bV[A-Za-z]{2,4}RA\b/
body __VM_WORD /\bV[A-Za-z]{2,5}UM\b/
body __WHOSWHO /\bWho.s Who\b/
body __WIDOW /\bwidow(?:e[rd])'?s?\b/i
body __WILL_LEGAL /\b(?:codicil|last\stestament|probate|executor|intestate)\b/i
body __WIRE_XFR /\b(?:wire|telegraph(?:ic)?|bank)\s?transfer/i
body __WORD_CUM /\bcum\b/i
body __WORD_RAPED /\braped?\b/i
body __WORD_SEX /\bsex(?:iest|y)?\b/i
body __WORD_SLUTS /\bsluts?\b/i
body __WORD_SPERM /\bsperm\b/i
meta __XFER_MONEY (__WIRE_XFR || __TRUSTED_CHECK || __BANK_DRAFT)
header __XM_GNUS X-Mailer =~ /^Gnus v/
header __XM_MOZ4 X-Mailer =~ /^Mozilla 4/
header __XM_MSOE5 X-Mailer =~ /^Microsoft Outlook Express 5/
header __XM_MSOE6 X-Mailer =~ /^Microsoft Outlook Express 6/
header __XM_MS_IN_GENERAL X-Mailer =~ /\bMSCRM\b|Microsoft (?:CDO|Outlook|Office Outlook)\b/
header __XM_OL_015D5 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/
header __XM_OL_07794 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/
header __XM_OL_09BB4 X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.72\.3155\.0/
header __XM_OL_10_0_4115 X-Mailer =~ /^Microsoft Outlook, Build 10.0.4115$/
header __XM_OL_1ECD5 X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1081/
header __XM_OL_20C99 X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.72\.3338\.1/
header __XM_OL_22B61 X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1158/
header __XM_OL_25340 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/
header __XM_OL_28001441 X-Mailer =~ /^Microsoft Outlook Express 6.00.2800.1441$/
header __XM_OL_28004682 X-Mailer =~ /^Microsoft Outlook Express 6.00.2800.4682$/
header __XM_OL_32D97 X-Mailer =~ /Microsoft\ Outlook\ IMO\,\ Build\ 9\.0\.2416\ \(9\.0\.2910\.0\)/
header __XM_OL_3857F X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/
header __XM_OL_3AC1D X-Mailer =~ /Microsoft\ Outlook\ Express\ 5\.00\.2919\.6700/
header __XM_OL_3D61D X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.71\.2244\.8/
header __XM_OL_465CD X-Mailer =~ /Microsoft\ Outlook\,\ Build\ 10\.0\.3416/
header __XM_OL_48072300 X-Mailer =~ /^Microsoft Outlook Express 5.50.4807.2300$/
header __XM_OL_4B815 X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.71\.2730\.2/
header __XM_OL_4BF4C X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/
header __XM_OL_4EEDB X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/
header __XM_OL_4F240 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/
header __XM_OL_4_72_2106_4 X-Mailer =~ /^Microsoft Outlook Express 4.72.2106.4$/
header __XM_OL_58CB5 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/
header __XM_OL_5B79A X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/
header __XM_OL_6554A X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/
header __XM_OL_72641 X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1441/
header __XM_OL_7533E X-Mailer =~ /Microsoft\ Outlook\ Express\ 5\.50\.4963\.1700/
header __XM_OL_812FF X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/
header __XM_OL_83BF7 X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.72\.3110\.3/
header __XM_OL_8627E X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1437/
header __XM_OL_8E893 X-Mailer =~ /Microsoft\ Outlook\,\ Build\ 10\.0\.2616/
header __XM_OL_91287 X-Mailer =~ /Microsoft\ Outlook\ Express\ 5\.50\.4807\.2300/
header __XM_OL_9B90B X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/
header __XM_OL_A50F8 X-Mailer =~ /Microsoft\ Outlook\ Express\ 5\.50\.4922\.1500/
header __XM_OL_A842E X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1158/
header __XM_OL_ADFF7 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/
header __XM_OL_B30D1 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/
header __XM_OL_B4B40 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/
header __XM_OL_B9B11 X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2462\.0000/
header __XM_OL_BC7E6 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/
header __XM_OL_C65FA X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/
header __XM_OL_CAC8F X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.71\.1712\.3/
header __XM_OL_CF0C0 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/
header __XM_OL_EF20B X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1478/
header __XM_OL_EF222 X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2900\.2873/
header __XM_OL_F3B05 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/
header __XM_OL_F475E X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/
header __XM_OL_F6D01 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/
header __XM_OL_FF5C8 X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/
header __XM_OUTLOOK_EXPRESS X-Mailer =~ /^Microsoft Outlook Express \d/
header __XM_PHP X-Mailer =~ /^PHP\s?v?\/?\d\./
header __XM_SKYRI X-Mailer =~ /^SKYRiXgreen/
header __XM_WWWMAIL X-Mailer =~ /^WWW-Mail \d/
body __YOUR_ACCOUNT /your account/i
body __YOUR_CREDITFVGT /your credit/i
body __YOUR_FUND /\b(?:your|ihr)\s(?:unpaid\s|nicht\sausbezahlten\s)?(?:fund|geld)\b/i
body __YOUR_PERM /\byour\spermission\b/i
body __YOUR_PROFIT /\byour?\sprofit/i
body __YOU_ASSIST /\byour\sassistance\b/i
body __YOU_HAVE_WON /you(?: \w+)? won/i
body __YOU_INHERIT /\byour\s[a-z\s]{0,30}inherit+ance\b/i
meta __YOU_WON __YOU_WON_01 || __YOU_WON_02 || __YOU_WON_03
body __YOU_WON_01 /\byou(?:r|'re|'ve|'ll|\shave|\sdid)?\s(?:e-?mail\s)?(?:\w+\s){0,2}(?:a\s)?w[io]n+(?:er|ing)?(?!'t)\b/i
body __YOU_WON_02 /\bw[io]n\s(?:(?:for|by)\s)?your?\b/i
body __YOU_WON_03 /\b(?:your?|win+ing|win+ers?|beneficiaries|participants?|individuals?)(?:\s[-a-z\s]{4,30}?)?\s(?:w(?:ere|as)|ha(?:ve|s) be(?:en)?)\s(?:randomly\s(?:selected|cho+sen|cho+sing|picked)|(?:selected|cho+sen|cho+sing|picked)\s(?:[a-z\s]{2,40}?\srandom|randomly|online|lottery|computer\s(?:ballot|wahlgang)))/i
meta __YOU_WON_SOMTIN (__YOU_HAVE_WON || __FB_CONGRADS)
y~or5J ={Eeu磝Qk ᯘG{?+]ן?wM3X^歌>{7پK>on\jy R g/=fOroNVv~Y+ NGuÝHWyw[eQʨSb> >}Gmx[o[<{Ϯ_qF vM IENDB`
