| 87 |
# blarson 2007-07-13 |
# blarson 2007-07-13 |
| 88 |
header REFWD subject =~ /\b(?:RE|FWD)\:\s*$/i |
header REFWD subject =~ /\b(?:RE|FWD)\:\s*$/i |
| 89 |
describe REFWD re or fwd nothing |
describe REFWD re or fwd nothing |
| 90 |
score REFWD 3 |
score REFWD 3.5 |
| 91 |
|
|
| 92 |
# blarson 2005-11-11 |
# blarson 2005-11-11 |
| 93 |
header ONEWORD subject =~ /^(?:Fw:|re:)?\s*\w+\s*$/i |
header ONEWORD subject =~ /^(?:Fw:|re:)?\s*\w+\s*$/i |
| 188 |
describe MESSAGESUB really descriptive subject |
describe MESSAGESUB really descriptive subject |
| 189 |
score MESSAGESUB 3 |
score MESSAGESUB 3 |
| 190 |
|
|
| 191 |
# blarson 2006-03-16 2007-08-28 |
# don 2007-09-20 |
| 192 |
body DEARDIGIT /^(?:well\s+)?(?:Dear|Hey|H[ea]y?ll?.?o|To|Attention|Hi+|Hey+a?|Bonjorno|Yo|(?:g[o0]+d\s*)?(?:d?ay|morning|evening?|afternoon)|what.?i?s\s+up|greetings|Salutations|(Mail|News)\s+to|how.?s?\s*(?:(?:it)?\s*going|have\s+you\s+been|are you).?\s*(?:there|to\s+you)?)\,?\s+(?:Account\s+\#?|\=?3d|)\d{3,}/i |
header SENTMESSAGE subject =~ /(sent you a( personal|) message|would like to chat)/i |
| 193 |
|
describe SENTMESSAGE Sent you a message (like duh?) |
| 194 |
|
score SENTMESSAGE 2 |
| 195 |
|
|
| 196 |
|
# blarson 2006-03-16 2007-09-18 |
| 197 |
|
body DEARDIGIT /^(?:well\s+)?(?:Dear|Hey|H[ea]y?ll?.?o|To|Attention|Hi+|Hey+a?|Bonjorno|(?:Yo\s*)+|(?:g[o0]+d\s*)?(?:d?ay|morning|evening?|afternoon|night)|what.?i?s\s+up|wa(?:s|z)+up|greetings?|Salutations|(Mail|News)\s+to|how(?:.?s|\s+is)?\s*(?:(?:it)?(?:\s+is)??\s*going|have\s+you\s+been|are you).?\s*(?:there|to\s+you)?|compliments|Regards|Adieu)\,?\s+(?:Account\s+\#?|\=?3d|)(?:bro|there|sir|Mr\.?)\s*?\d{3,}/i |
| 198 |
describe DEARDIGIT Dear number |
describe DEARDIGIT Dear number |
| 199 |
score DEARDIGIT 3.9 |
score DEARDIGIT 3.9 |
| 200 |
|
|
| 231 |
# blarson 2005-04-17 |
# blarson 2005-04-17 |
| 232 |
body RNDWORD /^RND_WORD\s*$/ |
body RNDWORD /^RND_WORD\s*$/ |
| 233 |
describe RNDWORD RND_WORD |
describe RNDWORD RND_WORD |
| 234 |
score RND_WORD 3 |
score RNDWORD 3 |
| 235 |
|
|
| 236 |
# blarson 2005-08-18 |
# blarson 2005-08-18 |
| 237 |
header D3GREE subject =~ /\bd(?:3gres?|esgre|eerge|eeerg|reege|egres)e?s?\b/i |
header D3GREE subject =~ /\bd(?:3gres?|esgre|eerge|eeerg|reege|egres)e?s?\b/i |
| 347 |
describe ACRO8PR0 sales spam |
describe ACRO8PR0 sales spam |
| 348 |
score ACRO8PR0 4 |
score ACRO8PR0 4 |
| 349 |
|
|
| 350 |
# blarson 2007-08-31 |
# blarson 2007-10-05 |
| 351 |
body WBRS /\b(WBRS|FPMC|ADYN|AFML|MISJ|HXPN|WHKA|CBFE|HSBC|PCAI|MPRG|HPRS|AUNI|TGVI|MHII|TAMG|GDKI|ACEN|CDYV|G7Q\.F|mbwc|CHFR|CDPN|DSDI|UTEV|P-S-U-D|GPSI|SGXI|CAON|SREA|ERMX|VPSN|SZSN|PAYI\.OB|LTDI|C\W\W?Y\W\W?T\W\W?V|E\WX\WM\WT|CYTV|VGPM|V\s?G\s?P\s?M(\.PK)?)\b/ |
body WBRS /\b(WBRS|FPMC|ADYN|AFML|MISJ|HXPN|WHKA|CBFE|HSBC|PCAI|MPRG|HPRS|AUNI|TGVI|MHII|TAMG|GDKI|ACEN|CDYV|G7Q\.F|mbwc|CHFR|CDPN|DSDI|UTEV|P-S-U-D|GPSI|SGXI|CAON|SREA|ERMX|VPSN|SZSN|PAYI\.OB|LTDI|C\W\W?Y\W\W?T\W\W?V|E\WX\WM\WT|CYTV|VGPM|V\s?G\s?P\s?M(\.PK)?|wwng|WWNG|F\WD\WE\WG|FDEG|UTYW|M\s*I\s*H\s*I|O\W?N\W?C\W?O|P\W?P\W?Y\W?H|S\W?R\W?E\W?A|A\W?C\W?G\W?U|S\W?C\W?Y\W?F|C\W?H\W?V\W?C|D\W?M\W?X\W?C|F\W?R\W?L\W?E|M\W?A\W?K\W?U|C\W?W\W?T\W?E|F\W?R\W?L\W?E|M\W?X\W?X\W?R|P\W?R\W?T\W?H|A\W?L\W?L\W?U|C\W?W\W?T\W?D|T\W?A\W?D\W?F|D\W?M\W?H\W?N|C\W?A\W?O\W?N|Cwtd)\b/ |
| 352 |
describe WBRS stock spam |
describe WBRS stock spam |
| 353 |
score BRS 4 |
score WBRS 4 |
| 354 |
|
|
| 355 |
|
body FOURLA /\b([A-Z]\s?){4}\b/ |
| 356 |
|
describe FOURLA Four letter acronym (stock spam?) |
| 357 |
|
score FOURLA 0.1 |
| 358 |
|
|
| 359 |
|
meta STOCKLIKE (FOURLA && (MONEY || SUBJMONEY)) |
| 360 |
|
describe STOCKLIKE Four letter acronyms with money; stock scam |
| 361 |
|
score STOCKLIKE 2 |
| 362 |
|
|
| 363 |
# blarson 2007-01-26 |
# blarson 2007-01-26 |
| 364 |
header ACROBAT8 subject =~ /\badobe acr[o0]bat 8\b/i |
header ACROBAT8 subject =~ /\badobe acr[o0]bat 8\b/i |
| 425 |
describe DELAFT more pdf spam |
describe DELAFT more pdf spam |
| 426 |
score DELAFT 3 |
score DELAFT 3 |
| 427 |
|
|
| 428 |
|
# blarson 2007-09-13 |
| 429 |
|
header OFF1CE subject =~ /\b[O0Q]f+[1i7l|]ce\s*\W?2[O0Qk]+7\b/i |
| 430 |
|
describe OFF1CE off1ce spam |
| 431 |
|
score OFF1CE 4 |
| 432 |
|
|
| 433 |
|
# blarson 2007-09-13 |
| 434 |
|
header SOFTSALE subject =~ /\bsoftware sales\b/i |
| 435 |
|
describe SOFTSALE software spam |
| 436 |
|
score SOFTSALE 3 |
| 437 |
|
|
| 438 |
|
# blarson 2007-09-18 |
| 439 |
|
body SUPERMACHO /\bBe a supermacho/i |
| 440 |
|
describe SUPERMACHO supermacho |
| 441 |
|
score SUPERMACHO 4 |
| 442 |
|
|
| 443 |
|
# blarson 2007-09-19 |
| 444 |
|
body BIGINTER /\bBig international commercial organization\b/i |
| 445 |
|
describe BIGINTER job spam |
| 446 |
|
score BIGINTER 4 |
| 447 |
|
|
| 448 |
|
# blarson 2007-09-20 |
| 449 |
|
header HASSENT subject =~ /\b(?:sent you a (?:personal|confidential)?\s*(?:message|note)|would like to chat)\b/i |
| 450 |
|
describe HASSENT sent a message |
| 451 |
|
score HASSENT 4 |
| 452 |
|
|
| 453 |
|
# blarson 2007-09-20 |
| 454 |
|
header ORDERNUM subject =~ /\b(?:Order|Recipet)\s*.?\d{3,}/i |
| 455 |
|
describe ORDERNUM order number |
| 456 |
|
score ORDERNUM 3 |
| 457 |
|
|
| 458 |
|
# don 2007-09-20 |
| 459 |
|
header DICTIONARYSEQ subject =~ /\b(\w{3})\w*(?:\s+\1\w*){2}/i |
| 460 |
|
describe DICTIONARYSEQ Ventricular Vents Venting Ventures |
| 461 |
|
score DICTIONARYSEQ 3.5 |
| 462 |
|
|
| 463 |
|
# blarson 2007-09-21 |
| 464 |
|
header NOLET subject =~ /^\W{4,}$/ |
| 465 |
|
describe NOLET swearing subject |
| 466 |
|
score NOLET 2 |
| 467 |
|
|
| 468 |
|
# blarson 2007-09-21 |
| 469 |
|
body SSIST /^ssistant Manager/ |
| 470 |
|
describe SSIST ssistant Manager |
| 471 |
|
score SSIST 4 |
| 472 |
|
|
| 473 |
|
# blarson 2007-09-21 |
| 474 |
|
body GRADUATEUNDER /\bgraduate in under\b/i |
| 475 |
|
describe GRADUATEUNDER graduate in under |
| 476 |
|
score GRADUATEUNDER 3 |
| 477 |
|
|
| 478 |
|
# blarson 2007-09-24 |
| 479 |
|
header NOINVEST subject =~ /\b(?:no investment|high.paid)\b/i |
| 480 |
|
describe NOINVEST no investment |
| 481 |
|
score NOINVEST 4 |
| 482 |
|
|
| 483 |
|
# blarson 2007-09-25 |
| 484 |
|
header INTEXP subject =~ /\b[I|]nternet Exp[l|]orer\b/i |
| 485 |
|
describe INTEXP |nternet Exp|orer |
| 486 |
|
score INTEXP 2 |
| 487 |
|
|
| 488 |
|
# don 2007-09-29 |
| 489 |
|
header WORKATHOME subject =~ /work\Wat\Whome/i |
| 490 |
|
describe WORKATHOME Work at home |
| 491 |
|
score WORKATHOME 4 |
| 492 |
|
|
| 493 |
|
# don 2007-10-01 |
| 494 |
|
body PHONENUMBER /\b1[\-\.\s]?8[07]+[\-\.\s]?\d+/ |
| 495 |
|
describe PHONENUMBER Toll free phone number |
| 496 |
|
score PHONENUMBER 1.5 |
| 497 |
|
|
| 498 |
|
# don 2007-10-02 |
| 499 |
|
body GERMANSPAM /Zerix Intern/i |
| 500 |
|
describe GERMANSPAM Um... no clue what that is. |
| 501 |
|
score GERMANSPAM 3 |
| 502 |
|
|
| 503 |
|
body URBANNEWS /UrbaNNews\.ro/ |
| 504 |
|
describe URBANNEWS URBANNEWS Newsletter |
| 505 |
|
score URBANNEWS 3 |
| 506 |
|
|
| 507 |
|
# blarson 2007-10-05 |
| 508 |
|
header JOBS subject =~ /\b(?:job|Employ(?:ers|ment|ee))s?\b/i |
| 509 |
|
describe JOBS job spam |
| 510 |
|
score JOBS 1 |
| 511 |
|
|
| 512 |
|
# don 2007-10-09 |
| 513 |
|
header FREEPASSWORD subject =~ /your\s*free\s*password/i |
| 514 |
|
describe FREEPASSWORD We don't need free password |
| 515 |
|
score FREEPASSWORD 3 |
| 516 |
|
|
| 517 |
|
# don 2007-10-11 |
| 518 |
|
header AFRICABYBIKE subject =~ /africa\s*by\s*bike/i |
| 519 |
|
describe AFRICABYBIKE We don't care about africa by bike or car or bus or train |
| 520 |
|
score AFRICABYBIKE 4 |
| 521 |
|
|
| 522 |
|
# blarson 2007-10-14 |
| 523 |
|
header BRAKETDIGIT subject =~ /\[\d+\]\:\s*$/ |
| 524 |
|
describe BRAKETDIGIT braketed digit colon last in subject |
| 525 |
|
score BRAKETDIGIT 2 |
| 526 |
|
|
| 527 |
|
# blarson 2007-10-14 |
| 528 |
|
full WHATISOEM /\bWhat\s*is\s*OEM\b/i |
| 529 |
|
describe WHATISOEM What is OEM |
| 530 |
|
score WHATISOEM 4 |
| 531 |
|
|
| 532 |
|
# blarson 2007-10-15 |
| 533 |
|
body WORKEXP /\bwork\s+experience\s+degree\b/i |
| 534 |
|
describe WORKEXP work experience degree |
| 535 |
|
score WORKEXP 3 |
| 536 |
|
|
| 537 |
|
# blarson 2007-10-24 |
| 538 |
|
body NICEGIRL /\b(?:nice|young|lonley|unmarried)\s+(?:girl|woman|female)\b/i |
| 539 |
|
describe NICEGIRL nice girl |
| 540 |
|
score NICEGIRL 2 |
| 541 |
|
|
| 542 |
|
# blarson 2007-10-16 |
| 543 |
|
header FEALCHAT subject =~ /\bFeel Like Chatting\b/i |
| 544 |
|
describe FEALCHAT Feel Like Chatting |
| 545 |
|
score FEALCHAT 3 |
| 546 |
|
|
| 547 |
|
# blarson 2007-10-18 |
| 548 |
|
header DFF1CE subject =~ /UmU6INDSydfF1CE/i |
| 549 |
|
describe DFF1CE korean spam |
| 550 |
|
score DFF1CE 4 |
| 551 |
|
|
| 552 |
|
# blarson 2007-10-23 |
| 553 |
|
header FAILNOTE subject =~ /\bFailure notice\:/i |
| 554 |
|
describe FAILNOTE bounced spam |
| 555 |
|
score FAILNOTE 4 |
| 556 |
|
|
| 557 |
|
# blarson 2007-10-25 |
| 558 |
|
full STILLSINGLE /\bstill\s+single\b/i |
| 559 |
|
describe STILLSINGLE still single |
| 560 |
|
score STILLSINGLE 2 |
| 561 |
|
|
| 562 |
|
# blarson 2007-10-26 |
| 563 |
|
header PERSONALCRED subject =~ /\bPersonal\s+Credit/i |
| 564 |
|
describe PERSONALCRED Personal Credit |
| 565 |
|
score PERSONALCRED 2 |
| 566 |
|
|
| 567 |
|
# blarson 2007-10-26 |
| 568 |
|
body XMASGIFT /\b(?:christ|x)mas gift\b/ |
| 569 |
|
describe XMASGIFT christmas gift |
| 570 |
|
score XMASGIFT 2 |
| 571 |
|
|
| 572 |
|
# blarson 2007-10-26 |
| 573 |
|
body RONPAUL /\bRon Paul\b/ |
| 574 |
|
describe RONPAUL Ron Paul |
| 575 |
|
score RONPAUL 3 |
| 576 |
|
|
| 577 |
|
# blarson 2007-10-27 |
| 578 |
|
body YOURJOB /your Job Verification Number/ |
| 579 |
|
describe YOURJOB your Job Verification Number |
| 580 |
|
score YOURJOB 3 |
| 581 |
|
|
| 582 |
|
# blason 2007-10-28 |
| 583 |
|
body PASTERESUME /\bPASTE your resume\b/i |
| 584 |
|
describe PASTERESUME PASTE your resume |
| 585 |
|
score PASTERESUME 3 |
| 586 |
|
|
| 587 |
|
body LETHIHELO /\{Let\:HI,Hi,Hello,hEllo,heLlo,helLo,hellO,HEllo\} how are you/ |
| 588 |
|
describe LETHIHELO Hello, how are you |
| 589 |
|
score LETHIHELO 4 |
| 590 |
|
|
| 591 |
|
# blarson 2007-10-29 |
| 592 |
|
body DIREKTOR /Direktor of Softline/i |
| 593 |
|
describe DIREKTOR Direktor of Softline |
| 594 |
|
score DIREKTOR 3 |
| 595 |
|
|
| 596 |
|
# blarson 2007-10-29 |
| 597 |
|
body THEDEG /\bthe_degree\b/ |
| 598 |
|
describe THEDEG the_degree |
| 599 |
|
score THEDEG 3 |
| 600 |
|
|
| 601 |
|
# blason 2007-10-29 |
| 602 |
|
body DYNMH /D Y N A M I C M EDIA HOLDIN/ |
| 603 |
|
describe DYNMH D Y N A M I C M EDIA HOLDIN |
| 604 |
|
score DYNMH 4 |
| 605 |
|
|
| 606 |
|
# blarson 2007-10-30 |
| 607 |
|
header LEGBUD subject =~ /\b(?:Legal|smoking) Bud/i |
| 608 |
|
describe LEGBUD Legal Bud |
| 609 |
|
score LEGBUD 4 |
| 610 |
|
|
| 611 |
|
# blarson 2007-10-30 |
| 612 |
|
full LEGBUD2 /\b(?:Legal|smoking) Bud/i |
| 613 |
|
describe LEGBUD2 Legal Bud |
| 614 |
|
score LEGBUD2 4 |
| 615 |
|
|
| 616 |
|
# blarson 2007-10-31 |
| 617 |
|
body SMOKING /\b(?:beat|stop|quit|without)\s+(?:nicotine|smoking|cigarettes)\b/i |
| 618 |
|
describe SMOKING stop smoking |
| 619 |
|
score SMOKING 3 |