Contents of /trunk/spamassassin_config/common/misc_spam

# This seems to catch a lot of spam, but not sure about false positive (from airmax.cf)
# pasc couldn't find any false positives on the lists he's on
header   X_MESSAGE_INFO exists:X-Message-Info
score    X_MESSAGE_INFO 4.0

# Added by pasc 2004/07/08 (sent by abuse@outblaze via karsten)
# host no longer exists according to administrator
header FAKE_OUTBLAZE_RCVD       Received =~ /\.mr\.outblaze\.com/
describe FAKE_OUTBLAZE_RCVD     Received header contains faked 'mr.outblaze.com'
score FAKE_OUTBLAZE_RCVD        3.0

# blarson 2005-01-19 (--pasc 2005-01-30)
header TRACKING         subject =~ /\b(?:tracking|package|shipping|shipment|delivery) number :/i
describe TRACKING       tracking number
score TRACKING          2

# Sent in by blars (20050220) -- applied by pasc
body GUEBDE     /http\:\/\/www\.gueb\.de\//
describe GUEBDE www.geub.de
score GUEBDE    5


# TODO: The rules below seem to be very similar; possibly fix them.

# These might trip up on non-english lists. We'll see.
# They're fucking up on GPG signatures
body MURPHY_WRONG_WORD1 /[bcdfghjklmnpqrstvwxz]{7,}/i
score MURPHY_WRONG_WORD1 0.1

body MURPHY_WRONG_WORD2 /[bcdfghjklmnpqrstvwxz]{6,}/i
score MURPHY_WRONG_WORD2 0.2

#Impronounceable. Need to check this one for accuracy (from airmax.cf)
body IMPRONONCABLE_1                            /([bcdfghjklmnpqrstvwxz]){6,20}/
describe IMPRONONCABLE_1                        Some words aren't easy to pronounce (too much vowels)
body IMPRONONCABLE_2                            /(([abcdefghijklmnopqrstvwxyz]){1,9}\d{1,4}){2,9}/
describe IMPRONONCABLE_2                        Some words aren't easy to pronounce (mixed numbers and lower-case letters)

# From http://www.exit0.us/index.php/FredsRules
# Added by pasc 2004/06/20

body      __FVGT_b_OBFU_J      /j(b|c|f|g|w)/i
body      __FVGT_b_OBFU_OTHER  /(vj|vk|xj|xk|yy|zf|zj)/i
body      __FVGT_b_OBFU_Q0     /(j|k|p|q|t|v|w|z)q/i
body      __FVGT_b_OBFU_Q1     /q(a|f|h|j|k|m|n|s|y)/i
body      __FVGT_b_OBFU_V      /(f|g|q|w)v/i
body      __FVGT_b_OBFU_X      /(c|g|j|k|q|s|v|z)x/i
body      __FVGT_b_OBFU_Z      /(f|j|k|p|q|x)z/i
meta      FVGT_m_MULTI_ODD     ((__FVGT_b_OBFU_J + __FVGT_b_OBFU_OTHER + __FVGT_b_OBFU_Q0 + __FVGT_b_OBFU_Q1 + __FVGT_b_OBFU_V + __FVGT_b_OBFU_X + __FVGT_b_OBFU_Z) > 1)
describe  FVGT_m_MULTI_ODD      FVGT - contains multiple odd letter combinations
score     FVGT_m_MULTI_ODD      0.02

# joy, 2003-07-20
header NEPEYO                   From =~ /nepeyo\@catlover/
describe NEPEYO                 spamvertizers
score NEPEYO                    4

# cjwatson, 2003/07/28
header MP3_PLAYERS              Subject =~ /New mp3 player,usb flash drive/
describe MP3_PLAYERS            Spam from "HY Tech"
score MP3_PLAYERS               4

# joy, 2003-08-15
header UOSJUNK                  Subject =~ /UOS online Degree Programme/i
describe UOSJUNK                Spam from UOS
score UOSJUNK                   4

# cjwatson, 2004-02-27
body GAS_MILEAGE        /This amazing, revolutionary device|www\.mrev\.biz/
describe GAS_MILEAGE    Fuel-saving snake oil
score GAS_MILEAGE       3

# blarson, 2004-03-31
body FUELSAVER          /fuel.?saver/i
describe FUELSAVER      Fuel Saver spam
score FUELSAVER         3

# blarson, 2004-04-03
body CABLEFILTERZ       /cablefilterz/
describe CABLEFILTERZ   cablefilterz spam
score CABLEFILTERZ      4

# blarson 2004-04-15
header PARENNUM         subject =~ /^\(\s*([0-9\/]+\)|\%RND)/
describe PARENNUM       paren number in subject
score PARENNUM          3

# blarson 2004-04-25
# bounces our bounces.... (had negitive score)
header COVADRT          X-RT-Loop-Prevention =~ /^Covad$/
describe COVADRT        Covad request tracker bounces
score COVADRT           8

# blarson 2005-03-02
header ROBERTOJIMENOCA  from =~ /ROBERTOJIMENOCA\@terra\.es/
describe ROBERTOJIMENOCA ROBERTOJIMENOCA sends spammy looking messages
score ROBERTOJIMENOCA   -2

# blarson 2005-07-10
header TURBOPRO         subject =~ /\bturbonet pro\b/i
describe TURBOPRO       dialup accelerator spam
score TURBOPRO          3

# blarson 2006-04-28
header RESUBJECT        subject =~ /\sRe(?:\[\d+\])?:\s*$/i
describe RESUBJECT      re nothing
score RESUBJECT         2

# blarson 2004-10-22 2007-07-18 up score
header NOSUBJECT        subject =~ /^\s*$/
describe NOSUBJECT      No subject
score NOSUBJECT         2.5

# blarson 2006-10-17
full NEXTPART   /\-\=\_NextPart\_000\_/
describe NEXTPART       spammer mime separator
score NEXTPART          2.5

# blarson 2006-10-17
full CT_IMAGE           /Content\-Type\:\s*image/i
describe CT_IMAGE       Picture attached
score CT_IMAGE          1

# blarson 2006-12-01 (score so low since it will also hit CT_IMAGE)
header CT_IMAGE_HEAD    content-type =~ /image/
describe CT_IMAGE_HEAD  entire message is image
score CT_IMAGE_HEAD     2.5


# don 2006-10-25
header THREADINDEX      Thread-Index =~ /A-Z/
describe THREADINDEX    thread-index header on spam
score    THREADINDEX    1.5

# blarson 2006-10-30
header FORDASH          subject =~ /\bFor \- \d+/
describe FORDASH        for dash
score FORDASH           3

# blarson 2006-11-01
header KOREAN           subject =~ /\=\?koi8\-r/
describe KOREAN         Korean Character set spam
score KOREAN            2

# blarson 2006-12-04
header FWDNAME          subject =~ /fwd\: \w+\s*$/
describe FWDNAME        fwd: name spam
score FWDNAME           3

# blarson 2006-12-06
body NUMONLY            /^\s*\d+\s*$/
describe NUMONLY        number only body
score NUMONLY           1

# blarson 2007-04-24
header THUNDERB         User-Agent =~ /^Thunderbird 1\.5\.0\.10/
describe THUNDERB       spam missing content
score THUNDERB          2


# blarson 2007-06-15
header FAILNOTE         subject =~ /Failure notice\:/
describe FAILNOTE       bounced spam
score FAILNOTE          2

# blarson 2007-06-28
rawbody CTINLINE        /^Content\-Disposition\: inline\;\b/
describe CTINLINE       Inline attachment
score CTINLINE          1

# blarson 2007-07-07
body BOXTRAPPER         /^This message is a reply to a boxtrapper verifcation message\./
describe BOXTRAPPER     boxtrapper spam
score BOXTRAPPER        9

# blarson 2007-07-09
body PROMOCODE          /^promo code\:/i
describe PROMOCODE      promo code
score PROMOCODE         3

# blarson 2007-07-11
body XLMAN              /\bwww\.xl\-man\.net\b/
describe XLMAN          xl-man spam
score XLMAN             3

# blarson 2007-07-12
body COSTUMER           /^Dear costumer\b/
describe COSTUMER       paypal scam
score COSTUMER          3

# blarson 2007-07-13
body PRIVATE            /^Your private and confidential message is attached\./
describe PRIVATE        private message
score PRIVATE           4

# don 2007-07-15
header AUTOGENERATE     auto-submitted =~ /auto/i
describe AUTOGENERATE   auto generated crap
score AUTOGENERATE      3

# blarson 2007-07-15
body PRIVPDF            /^All our private messages are in pdf format/
describe PRIVPDF        private pdf
score PRIVPDF           4

# don 2007-07-19
header AUTORESPOND      X-Autorespond =~ /./
describe AUTORESPOND    Automatic response
score   AUTORESPOND     4

header AUTOMAILER       X-Mailer =~ /autors/
describe AUTOMAILER     Auto response mailer
score AUTOMAILER        3       

# blarson 2007-07-22
header OUTOFOFFICE_SUB  subject =~ /Out_of_Office/
describe OUTOFOFFICE_SUB        broken autoresponder
score OUTOFOFFICE_SUB   6

body OUTOFOFFICE        /out of the office/i
describe OUTOFOFFICE    Out of the office
score OUTOFOFFICE       3

# blarson 2007-08-01 \w was too broad 2007-08-12 add dash, at least 3 digits
header SUBENDNUM        subject =~ /[a-zA-Z!]-?\d{3,}$/
describe SUBENDNUM      Subject ends in word989
score SUBENDNUM         2

# blarson 2007-07-27
body PRIVMES            /^You have been sent a private message/
describe PRIVMES        more pdf spam
score PRIVMES           3

# blarson 2007-07-27
header MIXEDBDN         Content-Type =~ /multipart\/mixed\;.*boundary\=\"\-{4,}\d{4,}\"/
describe MIXEDBDN       more pdf spam
score MIXEDBDN          1

# blarson 2007-07-28
header DOTZIP           subject =~ /\d\.zip\b/
describe DOTZIP         zip spam
score DOTZIP            3

# blarson 2007-07-30
header MIXED2           Content-Type =~ /multipart\/mixed\;charset\=iso\-8859\-1\;.*boundary\=\"\-\-\-\-\=\_\d{8,}\_\d{4,}\"/
describe MIXED2         more pdf spam
score MIXED2            2.5

# blarson 2007-07-31
header KEYENCE          From =~ /KEYENCE CORPORATION/
describe KEYENCE        opt out spam
score KEYENCE           10

# blarson 2007-08-02
header NOSUB            subject =~ /\(No Subject\)$/i
describe NOSUB          explicity no subject
score NOSUB             1

# blarson 2007-08-07
header CTPDF            Content-Type =~ /\bapplication\/pdf\;/i
describe CTPDF          more pdf spam
score CTPDF             4

# blarson 2007-06-12
header JAPSUB           subject =~ /\=\?iso\-2022\-jp/i
describe JAPSUB         subject in japanese
score JAPSUB            3

# blarson 2007-08-24
header XMSATT           X-MS-Has-Attach =~ /yes/i
describe XMSATT         more pdf spam
score XMSATT            2

# blarson 2007-10-27
body ICQ                /^icq\:/i
describe ICQ            icq:
score ICQ               2

# blarson 2007-11-02
header XJ2ID            X-J2Id =~ /\d+/
describe XJ2ID          fax bounce
score XJ2ID             4

# blarson 2007-11-15
header LONGWORD         subject =~ /\b[\w\d]{30,}/i
describe LONGWORD       long word in subject
score LONGWORD          2

# blarson 2007-11-23
header TESTIMONIAL      subject =~ /\btestimonial/i
describe TESTIMONIAL    testimonials
score TESTIMONIAL       2

# blarson 2007-12-13
header ITXS             subject =~ /\bit\`s\b/i
describe ITXS           it`s
score ITXS              4

# blarson 2007-12-18
rawbody TINYFONT        /\bFONT-SIZE\:\s+[123]px\;/i
describe TINYFONT       tiny font specified
score TINYFONT          3

# blarson 2008-04-03
rawbody ZIPFILE         /\bfilename\=.*\.zip\b/i
describe ZIPFILE        zipfile attachment
score ZIPFILE           0.5

# blarson 2008-04-19
header SPACESUB         subject =~ /^\s\w/
describe SPACESUB       extra space before subject
score SPACESUB          0.5

# don 2008-05-04
header YAHOOCALENDAR    X-Yahoo-Newman-Property: =~ /calendar-invite/i
describe YAHOOCALENDAR  Calendar invite from yahoo; broken captcha
score YAHOOCALENDAR     4

# blarson 2008-06-03
header BOUNDARYID       content-type =~ /\bboundary\=\"Boundary_\(ID_/
describe BOUNDARYID     spamware boundary
score BOUNDARYID        0.6
1	don	2	# This seems to catch a lot of spam, but not sure about false positive (from airmax.cf)
2			# pasc couldn't find any false positives on the lists he's on
3			header X_MESSAGE_INFO exists:X-Message-Info
4			score X_MESSAGE_INFO 4.0
5
6			# Added by pasc 2004/07/08 (sent by abuse@outblaze via karsten)
7			# host no longer exists according to administrator
8			header FAKE_OUTBLAZE_RCVD Received =~ /\.mr\.outblaze\.com/
9			describe FAKE_OUTBLAZE_RCVD Received header contains faked 'mr.outblaze.com'
10			score FAKE_OUTBLAZE_RCVD 3.0
11
12			# blarson 2005-01-19 (--pasc 2005-01-30)
13			header TRACKING subject =~ /\b(?:tracking\|package\|shipping\|shipment\|delivery) number :/i
14			describe TRACKING tracking number
15			score TRACKING 2
16
17			# Sent in by blars (20050220) -- applied by pasc
18			body GUEBDE /http\:\/\/www\.gueb\.de\//
19			describe GUEBDE www.geub.de
20			score GUEBDE 5
21
22
23			# TODO: The rules below seem to be very similar; possibly fix them.
24
25			# These might trip up on non-english lists. We'll see.
26			# They're fucking up on GPG signatures
27			body MURPHY_WRONG_WORD1 /[bcdfghjklmnpqrstvwxz]{7,}/i
28			score MURPHY_WRONG_WORD1 0.1
29
30			body MURPHY_WRONG_WORD2 /[bcdfghjklmnpqrstvwxz]{6,}/i
31			score MURPHY_WRONG_WORD2 0.2
32
33			#Impronounceable. Need to check this one for accuracy (from airmax.cf)
34	cord	18	body IMPRONONCABLE_1 /([bcdfghjklmnpqrstvwxz]){6,20}/
35	don	2	describe IMPRONONCABLE_1 Some words aren't easy to pronounce (too much vowels)
36			body IMPRONONCABLE_2 /(([abcdefghijklmnopqrstvwxyz]){1,9}\d{1,4}){2,9}/
37			describe IMPRONONCABLE_2 Some words aren't easy to pronounce (mixed numbers and lower-case letters)
38
39			# From http://www.exit0.us/index.php/FredsRules
40			# Added by pasc 2004/06/20
41
42			body __FVGT_b_OBFU_J /j(b\|c\|f\|g\|w)/i
43			body __FVGT_b_OBFU_OTHER /(vj\|vk\|xj\|xk\|yy\|zf\|zj)/i
44			body __FVGT_b_OBFU_Q0 /(j\|k\|p\|q\|t\|v\|w\|z)q/i
45			body __FVGT_b_OBFU_Q1 /q(a\|f\|h\|j\|k\|m\|n\|s\|y)/i
46			body __FVGT_b_OBFU_V /(f\|g\|q\|w)v/i
47			body __FVGT_b_OBFU_X /(c\|g\|j\|k\|q\|s\|v\|z)x/i
48			body __FVGT_b_OBFU_Z /(f\|j\|k\|p\|q\|x)z/i
49			meta FVGT_m_MULTI_ODD ((__FVGT_b_OBFU_J + __FVGT_b_OBFU_OTHER + __FVGT_b_OBFU_Q0 + __FVGT_b_OBFU_Q1 + __FVGT_b_OBFU_V + __FVGT_b_OBFU_X + __FVGT_b_OBFU_Z) > 1)
50			describe FVGT_m_MULTI_ODD FVGT - contains multiple odd letter combinations
51			score FVGT_m_MULTI_ODD 0.02
52
53			# joy, 2003-07-20
54			header NEPEYO From =~ /nepeyo\@catlover/
55			describe NEPEYO spamvertizers
56			score NEPEYO 4
57
58			# cjwatson, 2003/07/28
59			header MP3_PLAYERS Subject =~ /New mp3 player,usb flash drive/
60			describe MP3_PLAYERS Spam from "HY Tech"
61			score MP3_PLAYERS 4
62
63			# joy, 2003-08-15
64			header UOSJUNK Subject =~ /UOS online Degree Programme/i
65			describe UOSJUNK Spam from UOS
66			score UOSJUNK 4
67
68			# cjwatson, 2004-02-27
69			body GAS_MILEAGE /This amazing, revolutionary device\|www\.mrev\.biz/
70			describe GAS_MILEAGE Fuel-saving snake oil
71			score GAS_MILEAGE 3
72
73			# blarson, 2004-03-31
74			body FUELSAVER /fuel.?saver/i
75			describe FUELSAVER Fuel Saver spam
76			score FUELSAVER 3
77
78			# blarson, 2004-04-03
79			body CABLEFILTERZ /cablefilterz/
80			describe CABLEFILTERZ cablefilterz spam
81			score CABLEFILTERZ 4
82
83			# blarson 2004-04-15
84			header PARENNUM subject =~ /^\(\s*([0-9\/]+\)\|\%RND)/
85			describe PARENNUM paren number in subject
86			score PARENNUM 3
87
88			# blarson 2004-04-25
89			# bounces our bounces.... (had negitive score)
90			header COVADRT X-RT-Loop-Prevention =~ /^Covad$/
91			describe COVADRT Covad request tracker bounces
92			score COVADRT 8
93
94			# blarson 2005-03-02
95			header ROBERTOJIMENOCA from =~ /ROBERTOJIMENOCA\@terra\.es/
96			describe ROBERTOJIMENOCA ROBERTOJIMENOCA sends spammy looking messages
97			score ROBERTOJIMENOCA -2
98
99			# blarson 2005-07-10
100			header TURBOPRO subject =~ /\bturbonet pro\b/i
101			describe TURBOPRO dialup accelerator spam
102			score TURBOPRO 3
103
104			# blarson 2006-04-28
105			header RESUBJECT subject =~ /\sRe(?:\[\d+\])?:\s*$/i
106			describe RESUBJECT re nothing
107			score RESUBJECT 2
108
109			# blarson 2004-10-22 2007-07-18 up score
110			header NOSUBJECT subject =~ /^\s*$/
111			describe NOSUBJECT No subject
112			score NOSUBJECT 2.5
113
114			# blarson 2006-10-17
115			full NEXTPART /\-\=\_NextPart\_000\_/
116			describe NEXTPART spammer mime separator
117			score NEXTPART 2.5
118
119			# blarson 2006-10-17
120			full CT_IMAGE /Content\-Type\:\s*image/i
121			describe CT_IMAGE Picture attached
122			score CT_IMAGE 1
123
124			# blarson 2006-12-01 (score so low since it will also hit CT_IMAGE)
125			header CT_IMAGE_HEAD content-type =~ /image/
126			describe CT_IMAGE_HEAD entire message is image
127			score CT_IMAGE_HEAD 2.5
128
129
130			# don 2006-10-25
131			header THREADINDEX Thread-Index =~ /A-Z/
132			describe THREADINDEX thread-index header on spam
133			score THREADINDEX 1.5
134
135			# blarson 2006-10-30
136			header FORDASH subject =~ /\bFor \- \d+/
137			describe FORDASH for dash
138			score FORDASH 3
139
140			# blarson 2006-11-01
141			header KOREAN subject =~ /\=\?koi8\-r/
142			describe KOREAN Korean Character set spam
143			score KOREAN 2
144
145			# blarson 2006-12-04
146			header FWDNAME subject =~ /fwd\: \w+\s*$/
147			describe FWDNAME fwd: name spam
148			score FWDNAME 3
149
150			# blarson 2006-12-06
151			body NUMONLY /^\s\d+\s$/
152			describe NUMONLY number only body
153			score NUMONLY 1
154
155			# blarson 2007-04-24
156			header THUNDERB User-Agent =~ /^Thunderbird 1\.5\.0\.10/
157			describe THUNDERB spam missing content
158			score THUNDERB 2
159
160
161			# blarson 2007-06-15
162			header FAILNOTE subject =~ /Failure notice\:/
163			describe FAILNOTE bounced spam
164			score FAILNOTE 2
165
166			# blarson 2007-06-28
167			rawbody CTINLINE /^Content\-Disposition\: inline\;\b/
168			describe CTINLINE Inline attachment
169			score CTINLINE 1
170
171			# blarson 2007-07-07
172			body BOXTRAPPER /^This message is a reply to a boxtrapper verifcation message\./
173			describe BOXTRAPPER boxtrapper spam
174			score BOXTRAPPER 9
175
176			# blarson 2007-07-09
177			body PROMOCODE /^promo code\:/i
178			describe PROMOCODE promo code
179			score PROMOCODE 3
180
181			# blarson 2007-07-11
182			body XLMAN /\bwww\.xl\-man\.net\b/
183			describe XLMAN xl-man spam
184			score XLMAN 3
185
186			# blarson 2007-07-12
187			body COSTUMER /^Dear costumer\b/
188			describe COSTUMER paypal scam
189			score COSTUMER 3
190
191			# blarson 2007-07-13
192			body PRIVATE /^Your private and confidential message is attached\./
193			describe PRIVATE private message
194			score PRIVATE 4
195
196			# don 2007-07-15
197			header AUTOGENERATE auto-submitted =~ /auto/i
198			describe AUTOGENERATE auto generated crap
199			score AUTOGENERATE 3
200
201			# blarson 2007-07-15
202			body PRIVPDF /^All our private messages are in pdf format/
203			describe PRIVPDF private pdf
204			score PRIVPDF 4
205
206			# don 2007-07-19
207			header AUTORESPOND X-Autorespond =~ /./
208			describe AUTORESPOND Automatic response
209			score AUTORESPOND 4
210
211			header AUTOMAILER X-Mailer =~ /autors/
212			describe AUTOMAILER Auto response mailer
213			score AUTOMAILER 3
214
215			# blarson 2007-07-22
216			header OUTOFOFFICE_SUB subject =~ /Out_of_Office/
217			describe OUTOFOFFICE_SUB broken autoresponder
218			score OUTOFOFFICE_SUB 6
219
220			body OUTOFOFFICE /out of the office/i
221			describe OUTOFOFFICE Out of the office
222			score OUTOFOFFICE 3
223
224			# blarson 2007-08-01 \w was too broad 2007-08-12 add dash, at least 3 digits
225			header SUBENDNUM subject =~ /[a-zA-Z!]-?\d{3,}$/
226			describe SUBENDNUM Subject ends in word989
227			score SUBENDNUM 2
228
229			# blarson 2007-07-27
230			body PRIVMES /^You have been sent a private message/
231			describe PRIVMES more pdf spam
232			score PRIVMES 3
233
234			# blarson 2007-07-27
235			header MIXEDBDN Content-Type =~ /multipart\/mixed\;.*boundary\=\"\-{4,}\d{4,}\"/
236			describe MIXEDBDN more pdf spam
237	cord	19	score MIXEDBDN 1
238	don	2
239			# blarson 2007-07-28
240			header DOTZIP subject =~ /\d\.zip\b/
241			describe DOTZIP zip spam
242			score DOTZIP 3
243
244			# blarson 2007-07-30
245			header MIXED2 Content-Type =~ /multipart\/mixed\;charset\=iso\-8859\-1\;.*boundary\=\"\-\-\-\-\=\_\d{8,}\_\d{4,}\"/
246			describe MIXED2 more pdf spam
247			score MIXED2 2.5
248
249			# blarson 2007-07-31
250			header KEYENCE From =~ /KEYENCE CORPORATION/
251			describe KEYENCE opt out spam
252			score KEYENCE 10
253
254			# blarson 2007-08-02
255			header NOSUB subject =~ /\(No Subject\)$/i
256			describe NOSUB explicity no subject
257			score NOSUB 1
258
259			# blarson 2007-08-07
260			header CTPDF Content-Type =~ /\bapplication\/pdf\;/i
261			describe CTPDF more pdf spam
262			score CTPDF 4
263
264			# blarson 2007-06-12
265			header JAPSUB subject =~ /\=\?iso\-2022\-jp/i
266			describe JAPSUB subject in japanese
267			score JAPSUB 3
268
269			# blarson 2007-08-24
270			header XMSATT X-MS-Has-Attach =~ /yes/i
271			describe XMSATT more pdf spam
272			score XMSATT 2
273
274	don	87	# blarson 2007-10-27
275			body ICQ /^icq\:/i
276			describe ICQ icq:
277			score ICQ 2
278	don	2
279	don	91	# blarson 2007-11-02
280			header XJ2ID X-J2Id =~ /\d+/
281			describe XJ2ID fax bounce
282			score XJ2ID 4
283	don	103
284			# blarson 2007-11-15
285	don	105	header LONGWORD subject =~ /\b[\w\d]{30,}/i
286	don	103	describe LONGWORD long word in subject
287			score LONGWORD 2
288	don	121
289			# blarson 2007-11-23
290			header TESTIMONIAL subject =~ /\btestimonial/i
291			describe TESTIMONIAL testimonials
292			score TESTIMONIAL 2
293
294	don	125	# blarson 2007-12-13
295			header ITXS subject =~ /\bit\`s\b/i
296			describe ITXS it`s
297			score ITXS 4
298
299			# blarson 2007-12-18
300			rawbody TINYFONT /\bFONT-SIZE\:\s+[123]px\;/i
301			describe TINYFONT tiny font specified
302			score TINYFONT 3
303	don	185
304			# blarson 2008-04-03
305			rawbody ZIPFILE /\bfilename\=.*\.zip\b/i
306			describe ZIPFILE zipfile attachment
307			score ZIPFILE 0.5
308	don	194
309			# blarson 2008-04-19
310			header SPACESUB subject =~ /^\s\w/
311			describe SPACESUB extra space before subject
312			score SPACESUB 0.5
313	don	202
314			# don 2008-05-04
315			header YAHOOCALENDAR X-Yahoo-Newman-Property: =~ /calendar-invite/i
316			describe YAHOOCALENDAR Calendar invite from yahoo; broken captcha
317			score YAHOOCALENDAR 4
318	don	217
319			# blarson 2008-06-03
320			header BOUNDARYID content-type =~ /\bboundary\=\"Boundary_\(ID_/
321			describe BOUNDARYID spamware boundary
322			score BOUNDARYID 0.6