| 87 |
# blarson 2007-07-13 |
# blarson 2007-07-13 |
| 88 |
header REFWD subject =~ /\b(?:RE|FWD)\:\s*$/i |
header REFWD subject =~ /\b(?:RE|FWD)\:\s*$/i |
| 89 |
describe REFWD re or fwd nothing |
describe REFWD re or fwd nothing |
| 90 |
score REFWD 3 |
score REFWD 3.5 |
| 91 |
|
|
| 92 |
# blarson 2005-11-11 |
# blarson 2005-11-11 |
| 93 |
header ONEWORD subject =~ /^(?:Fw:|re:)?\s*\w+\s*$/i |
header ONEWORD subject =~ /^(?:Fw:|re:)?\s*\w+\s*$/i |
| 347 |
describe ACRO8PR0 sales spam |
describe ACRO8PR0 sales spam |
| 348 |
score ACRO8PR0 4 |
score ACRO8PR0 4 |
| 349 |
|
|
| 350 |
# blarson 2007-09-15 |
# blarson 2007-10-05 |
| 351 |
body WBRS /\b(WBRS|FPMC|ADYN|AFML|MISJ|HXPN|WHKA|CBFE|HSBC|PCAI|MPRG|HPRS|AUNI|TGVI|MHII|TAMG|GDKI|ACEN|CDYV|G7Q\.F|mbwc|CHFR|CDPN|DSDI|UTEV|P-S-U-D|GPSI|SGXI|CAON|SREA|ERMX|VPSN|SZSN|PAYI\.OB|LTDI|C\W\W?Y\W\W?T\W\W?V|E\WX\WM\WT|CYTV|VGPM|V\s?G\s?P\s?M(\.PK)?|wwng|WWNG|F\WD\WE\WG|FDEG|UTYW|M\s*I\s*H\s*I|O\W?N\W?C\W?O|P\W?P\W?Y\W?H|S\W?R\W?E\W?A|A\W?C\W?G\W?U|S\W?C\W?Y\W?F|C\W?H\W?V\W?C|D\W?M\W?X\W?C|F\W?R\W?L\W?E|M\W?A\W?K\W?U|MAKU|CWTE|FRLE)\b/ |
body WBRS /\b(WBRS|FPMC|ADYN|AFML|MISJ|HXPN|WHKA|CBFE|HSBC|PCAI|MPRG|HPRS|AUNI|TGVI|MHII|TAMG|GDKI|ACEN|CDYV|G7Q\.F|mbwc|CHFR|CDPN|DSDI|UTEV|P-S-U-D|GPSI|SGXI|CAON|SREA|ERMX|VPSN|SZSN|PAYI\.OB|LTDI|C\W\W?Y\W\W?T\W\W?V|E\WX\WM\WT|CYTV|VGPM|V\s?G\s?P\s?M(\.PK)?|wwng|WWNG|F\WD\WE\WG|FDEG|UTYW|M\s*I\s*H\s*I|O\W?N\W?C\W?O|P\W?P\W?Y\W?H|S\W?R\W?E\W?A|A\W?C\W?G\W?U|S\W?C\W?Y\W?F|C\W?H\W?V\W?C|D\W?M\W?X\W?C|F\W?R\W?L\W?E|M\W?A\W?K\W?U|C\W?W\W?T\W?E|F\W?R\W?L\W?E|M\W?X\W?X\W?R|P\W?R\W?T\W?H|A\W?L\W?L\W?U|C\W?W\W?T\W?D|T\W?A\W?D\W?F|D\W?M\W?H\W?N|C\W?A\W?O\W?N)\b/ |
| 352 |
describe WBRS stock spam |
describe WBRS stock spam |
| 353 |
score WBRS 4 |
score WBRS 4 |
| 354 |
|
|
| 355 |
body FOURLA /\b([A-Z]\s?){4}\b/ |
body FOURLA /\b([A-Z]\s?){4}\b/ |
| 356 |
describe FOURLA Four letter acronym (stock spam?) |
describe FOURLA Four letter acronym (stock spam?) |
| 357 |
score FOURLA 1 |
score FOURLA 0.1 |
| 358 |
|
|
| 359 |
body WORDMONEY /^\w+\s*:\s*(?:\$\s*[\d\.]+|[\d\.]+\s*USD)/mi |
meta STOCKLIKE (FOURLA && (MONEY || SUBJMONEY)) |
|
describe WORDMONEY Word Colon Money |
|
|
score WORDMONEY 1 |
|
|
|
|
|
meta STOCKLIKE (FOURLA && WORDMONEY) |
|
| 360 |
describe STOCKLIKE Four letter acronyms with money; stock scam |
describe STOCKLIKE Four letter acronyms with money; stock scam |
| 361 |
score STOCKLIKE 2 |
score STOCKLIKE 2 |
| 362 |
|
|
| 426 |
score DELAFT 3 |
score DELAFT 3 |
| 427 |
|
|
| 428 |
# blarson 2007-09-13 |
# blarson 2007-09-13 |
| 429 |
header OFF1CE subject =~ /\b[O0]ff[1i7l|]ce\s*\W?2[O0Qk]+7\b/i |
header OFF1CE subject =~ /\b[O0Q]f+[1i7l|]ce\s*\W?2[O0Qk]+7\b/i |
| 430 |
describe OFF1CE off1ce spam |
describe OFF1CE off1ce spam |
| 431 |
score OFF1CE 4 |
score OFF1CE 4 |
| 432 |
|
|
| 494 |
body PHONENUMBER /\b1[\-\.\s]?8[07]+[\-\.\s]?\d+/ |
body PHONENUMBER /\b1[\-\.\s]?8[07]+[\-\.\s]?\d+/ |
| 495 |
describe PHONENUMBER Toll free phone number |
describe PHONENUMBER Toll free phone number |
| 496 |
score PHONENUMBER 1.5 |
score PHONENUMBER 1.5 |
| 497 |
|
|
| 498 |
|
# don 2007-10-02 |
| 499 |
|
body GERMANSPAM /Zerix Intern/i |
| 500 |
|
describe GERMANSPAM Um... no clue what that is. |
| 501 |
|
score GERMANSPAM 3 |
| 502 |
|
|
| 503 |
|
body URBANNEWS /UrbaNNews\.ro/ |
| 504 |
|
describe URBANNEWS URBANNEWS Newsletter |
| 505 |
|
score URBANNEWS 3 |
| 506 |
|
|
| 507 |
|
# blarson 2007-10-05 |
| 508 |
|
header JOBS subject =~ /\b(?:job|Employ(?:ers|ment|ee))s?\b/i |
| 509 |
|
describe JOBS job spam |
| 510 |
|
score JOBS 1 |
| 511 |
|
|
| 512 |
|
# don 2007-10-09 |
| 513 |
|
header FREEPASSWORD subject =~ /your\s*free\s*password/i |
| 514 |
|
describe FREEPASSWORD We don't need free password |
| 515 |
|
score FREEPASSWORD 3 |
| 516 |
|
|
| 517 |
|
# don 2007-10-11 |
| 518 |
|
header AFRICABYBIKE subject =~ /africa\s*by\s*bike/i |
| 519 |
|
describe AFRICABYBIKE We don't care about africa by bike or car or bus or train |
| 520 |
|
score AFRICABYBIKE 4 |
| 521 |
|
|
| 522 |
|
# blarson 2007-10-14 |
| 523 |
|
header BRAKETDIGIT subject =~ /\[\d+\]\:\s*$/ |
| 524 |
|
describe BRAKETDIGIT braketed digit colon last in subject |
| 525 |
|
score BRAKETDIGIT 2 |
| 526 |
|
|
| 527 |
|
# blarson 2007-10-14 |
| 528 |
|
full WHATISOEM /\bWhat\s*is\s*OEM\b/i |
| 529 |
|
describe WHATISOEM What is OEM |
| 530 |
|
score WHATISOEM 4 |
| 531 |
|
|
| 532 |
|
# blarson 2007-10-15 |
| 533 |
|
body WORKEXP /\bwork\s+experience\s+degree\b/i |
| 534 |
|
describe WORKEXP work experience degree |
| 535 |
|
score WORKEXP 3 |
| 536 |
|
|
| 537 |
|
# blarson 2007-10-24 |
| 538 |
|
body NICEGIRL /\b(?:nice|young|lonley|unmarried)\s+(?:girl|woman|female)\b/i |
| 539 |
|
describe NICEGIRL nice girl |
| 540 |
|
score NICEGIRL 2 |
| 541 |
|
|
| 542 |
|
# blarson 2007-10-16 |
| 543 |
|
header FEALCHAT subject =~ /\bFeel Like Chatting\b/i |
| 544 |
|
describe FEALCHAT Feel Like Chatting |
| 545 |
|
score FEALCHAT 3 |
| 546 |
|
|
| 547 |
|
# blarson 2007-10-18 |
| 548 |
|
header DFF1CE subject =~ /UmU6INDSydfF1CE/i |
| 549 |
|
describe DFF1CE korean spam |
| 550 |
|
score DFF1CE 4 |
| 551 |
|
|
| 552 |
|
# blarson 2007-10-23 |
| 553 |
|
header FAILNOTE subject =~ /\bFailure notice\:/i |
| 554 |
|
describe FAILNOTE bounced spam |
| 555 |
|
score FAILNOTE 4 |