#####################################################################\ # Fred's Collection of Rules File 001 #\ # Version: 0.00.17 #\ # Created: 10/30/2006 # # Modified: 12/23/2006 # # Current Maintainer: Frederic Tarasevicius - tech2@i-is.com # # Current Home: http://www.rulesemporium.com/rules/00_FVGT_File001.cf # # License: http://www.apache.org/licenses/LICENSE-2.0 # ######################################################################## # *** PLEASE READ ** PLEASE READ ** PLEASE READ ** PLEASE READ ******* # # *** Most of these are rules are scored very high, use caution! ***** # ######################################################################## # # # -> SOME RULES REQUIRE THAT YOU HAVE TRUSTED_NETWORKS SET PROPERLY <- # # # ######################################################################## # v0.00.13 = 11/24/2006 - Spam identified as spam by these rules: 23276 of 33482 69.5% # v0.00.14 = 11/30/2006 - Spam identified as spam by these rules: 24241 of 34698 69.8% # v0.00.15 = 12/04/2006 - Spam identified as spam by these rules: 24830 of 34870 71.2% # v0.00.16 = Minor tweaks to scores for FP reports. # v0.00.17 = Changed License to Apache v2 # v0.00.17 = 12/23/2006 - Spam identified as spam by these rules: 27051 of 37183 72.7% # # 442 Rules included # ############################################ ####### START NEWEST RULES / 0 Day ######### # These rules are the freshest to this set # # I keep them near the top for observation # ############################################ header FH_MSGID_XXBLAH MESSAGEID =~ /6c822ecf/ describe FH_MSGID_XXBLAH Common sign in msg-id's 12/21/2006 ##score FH_MSGID_XXBLAH 10.357 #counts FH_MSGID_XXBLAH 254s/0h of 44365 corpus (34562s/9803h FVGT) 12/21/06 #counts FH_MSGID_XXBLAH 255s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_LETTERS_21B /-- [a-z]{21}/ describe FB_LETTERS_21B Special people leave special signs! ##score FB_LETTERS_21B 10.357 #counts FB_LETTERS_28B 105s/0h of 44365 corpus (34562s/9803h FVGT) 12/21/06 #counts FB_LETTERS_21B 225s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __F_LARGE_MONEY /\d\d\d,\d\d\d/ body __F_LARGE_MONEY_2 /\d\d?\s?(?:thousand|(?:m|b|tr)illion)/i meta __FM_LARGE_MONEY (__F_LARGE_MONEY || __F_LARGE_MONEY_2) body __YOU_HAVE_WON /you(?: \w+)? won/i body __FB_CONGRADS /Congratulations/i meta __YOU_WON_SOMTIN (__YOU_HAVE_WON || __FB_CONGRADS) body __FB_NATIONAL /national/i body __FB_LOTTERY /lottery/i meta __FM_NAT_LOTTERY (__FB_NATIONAL && __FB_LOTTERY) meta FM_LOTTO_MONEY (__FM_LARGE_MONEY && __FM_NAT_LOTTERY) describe FM_LOTTO_MONEY Talks about lotto and large money! ##score FM_LOTTO_MONEY 2.011 #counts FM_LOTTO_MONEY 48s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 meta FM_LOTTO_YOU_WON (__FM_LARGE_MONEY && __FM_NAT_LOTTERY && __YOU_WON_SOMTIN) describe FM_LOTTO_YOU_WON Talks about lotto and you won! ##score FM_LOTTO_YOU_WON 3.741 #counts FM_LOTTO_YOU_WON 45s/0h of 46631 corpus (36802s/9829h FVGT) 12/23/06 body FB_EXP_POWER_OF /Experience the power of/i describe FB_EXP_POWER_OF Phrase: Experience the power of ##score FB_EXP_POWER_OF 0.991 #counts FB_EXP_POWER_OF 2s/0h of 46631 corpus (36802s/9829h FVGT) 12/23/06 body __FB_PPLE_ARE_SEARCH /(?:People|they) are searching/i body __FB_COULD_NOT_F /could not find you/i meta FM_PEOPLE_LOOK_4ME (__FB_PPLE_ARE_SEARCH && __FB_COULD_NOT_F) describe FM_PEOPLE_LOOK_4ME People are looking for me? ##score FM_PEOPLE_LOOK_4ME 2.922 #counts FM_PEOPLE_LOOK_4ME 1s/0h of 46631 corpus (36802s/9829h FVGT) 12/23/06 header FH_BAD_OEV1441 X-Mailer =~ /^Microsoft Outlook Express 6\.00\.2800\.1441$/ describe FH_BAD_OEV1441 Bad X-Mailer version ##score FH_BAD_OEV1441 4.555 #counts FH_BAD_OEV1441 66s/0h of 46631 corpus (36802s/9829h FVGT) 12/23/06 #Combine SARE RANDOM Active Rules into single rule. header __ALL_RANDOM ALL =~ /(?:[%\#\[\$]R?A?NDO?M?|\%(?:CUSTOM|FROM|PROXY|X?MESSA|MAKE_TXT|FROM_USER))/i rawbody __RAW_RANDOM /(?:[%\#\[\$]RA?NDO?M?|\%(?:CUSTOM|FROM|PROXY|X?MESSA|MAKE_TXT))/i meta FH_RANDOM_SURE (__ALL_RANDOM || __RAW_RANDOM) describe FH_RANDOM_SURE SARE Random in one rule. ##score FH_RANDOM_SURE 10.333 #counts FH_RANDOM_SURE 221s/0h of 46241 corpus (36438s/9803h FVGT) 12/14/06 #counts FH_RANDOM_SURE 225s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_MSGID_01C67 Message-ID =~ /^<000001c[67]/ describe FH_MSGID_01C67 Special MSGID ##score FH_MSGID_01C67 1.968 #counts FH_MSGID_01C67 9212s/3h of 45714 corpus (35935s/9779h FVGT) 12/08/06 #counts FH_MSGID_01C67 9200s/3h of 46241 corpus (36438s/9803h FVGT) 12/14/06 #counts FH_MSGID_01C67 9480s/3h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_HAS_X exists:X describe FH_HAS_X Has X: header ##score FH_HAS_X 10.357 #counts FH_HAS_X 32s/0h of 46241 corpus (36438s/9803h FVGT) 12/14/06 #counts FH_HAS_X 32s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_HAS_XAIMC exists:X-AIMC-AUTH describe FH_HAS_XAIMC Has X-AIMC-AUTH header ##score FH_HAS_XAIMC 10.357 #counts FH_HAS_XAIMC 3s/0h of 46241 corpus (36438s/9803h FVGT) 12/14/06 #counts FH_HAS_XAIMC 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_HAS_XCVBN exists:X-CVBN describe FH_HAS_XCVBN Has X-CVBN header ##score FH_HAS_XCVBN 10.357 #counts FH_HAS_XCVBN 3s/0h of 46241 corpus (36438s/9803h FVGT) 12/14/06 #counts FH_HAS_XCVBN 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_BAD_MSOE14 X-Mailer =~ /^Microsoft Outlook Express 6\.00\.1400\.14$/ describe FH_BAD_MSOE14 Bad OE version ##score FH_BAD_MSOE14 10.357 #counts FH_BAD_MSOE14 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #X-WBC header FH_HAS_X_WBC exists:X-WBC describe FH_HAS_X_WBC Has X-WBC header ##score FH_HAS_X_WBC 2.439 #counts FH_HAS_X_WBC 4s/0h of 46241 corpus (36438s/9803h FVGT) 12/14/06 #counts FH_HAS_X_WBC 4s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_MSGID_000000 MESSAGEID =~ /\$00000000\@/ describe FH_MSGID_000000 Special MSGID ##score FH_MSGID_000000 10 10 10 10 #counts FH_MSGID_000000 51s/0h of 45714 corpus (35935s/9779h FVGT) 12/08/06 #counts FH_MSGID_000000 91s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #X-FGHJ: znsvtbnaabivfviwftfwfbsm vbaipfnfmspiafmwt vawsapvwvm header FH_HAS_XFGHJ exists:X-FGHJ describe FH_HAS_XFGHJ Has X-FGHJ ##score FH_HAS_XFGHJ 10 5 5 3 #counts FH_HAS_XFGHJ 12s/0h of 44357 corpus (34582s/9775h FVGT) 12/04/06 #counts FH_HAS_XFGHJ 19s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_XMAIL_HEX20 X-Mailer =~ /^[A-F0-9]{6,10}\.[A-F0-9]{6,10}\.[a-f0-9]{6,10}/ describe FH_XMAIL_HEX20 Special HEX X-Mailer ##score FH_XMAIL_HEX20 10 4 4 3 #counts FH_XMAIL_HEX20 1s/0h of 44357 corpus (34582s/9775h FVGT) 12/04/06 #counts FH_XMAIL_HEX20 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_HAS_XBBO exists:X-BBounce describe FH_HAS_XBBO Has X-BBounce ##score FH_HAS_XBBO 10 4 4 3 #counts FH_HAS_XBBO 61s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 #counts FH_HAS_XBBO 80s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_REPL_TOKEN Subject =~ /\{Token1\}/i describe FS_REPL_TOKEN Subject has Replacement Token ##score FS_REPL_TOKEN 10 10 10 10 #counts FS_REPL_TOKEN 0s/0h of 44357 corpus (34582s/9775h FVGT) 12/04/06 #counts FS_REPL_TOKEN 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FM_XMAIL_F_OUT X-Mailer =~ /Microsoft Outlook Express V6.00.2900.2180/ describe FM_XMAIL_F_OUT Looks like Fake Outlook? ##score FM_XMAIL_F_OUT 10 #counts FM_XMAIL_F_OUT 514s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 #counts FM_XMAIL_F_OUT 917s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_XCON_HAS_EQ X-Contact =~ /=/ describe FH_XCON_HAS_EQ X-Contact has = ##score FH_XCON_HAS_EQ 2 1 1 0.5 #counts FH_XCON_HAS_EQ 10s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 #counts FH_XCON_HAS_EQ 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_HAS_XOVE exists:X-OVE describe FH_HAS_XOVE Has X-OVE ##score FH_HAS_XOVE 10 10 10 5 #counts FH_HAS_XOVE 434s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 #counts FH_HAS_XOVE 442s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #X-ID: "1167502916049" header FH_HAS_XID exists:X-ID describe FH_HAS_XID Has X-ID ##score FH_HAS_XID 10 3.1 3.1 2.5 #counts FH_HAS_XID 1224s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 #counts FH_HAS_XID 1232s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #X-UIOP: alovoltujjmvyvmluerjojeo ryjlkrumvuvjylmytrj vrjvytetjy header FH_HAS_XUIOP exists:X-UIOP describe FH_HAS_XUIOP Has X-UIOP ##score FH_HAS_XUIOP 10 5 5 3 #counts FH_HAS_XUIOP 20s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 #counts FH_HAS_XUIOP 21s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_XMAIL_RND_833 X-Mailer =~ /^[a-z]{3}\sv8\.3\.3\./ describe FH_XMAIL_RND_833 Special X-Mailer Version ##score FH_XMAIL_RND_833 17 10 10 10 #counts FH_XMAIL_RND_833 53s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 #counts FH_XMAIL_RND_833 198s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_RAMROD Subject =~ /ramrod/i describe FS_RAMROD Subject says Ramrod ##score FS_RAMROD 10 5 5 3 #counts FS_RAMROD 0s/0h of 44060 corpus (34282s/9778h FVGT) 12/01/06 #counts FS_RAMROD 3s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 #counts FS_RAMROD 7s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_WITH_SMALL Subject =~ /with (?:\w+\s)?(?:small|short)/i describe FS_WITH_SMALL Subject says With ... small ##score FS_WITH_SMALL 3 #counts FS_WITH_SMALL 6s/0h of 44060 corpus (34282s/9778h FVGT) 12/01/06 #counts FS_WITH_SMALL 9s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 #counts FS_WITH_SMALL 12s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_MSGID_REPLACE MESSAGEID =~ /^<%MSGID/ describe FH_MSGID_REPLACE Broken Replace Template ##score FH_MSGID_REPLACE 10 10 10 10 #counts FH_MSGID_REPLACE 2s/0h of 44060 corpus (34282s/9778h FVGT) 12/01/06 #counts FH_MSGID_REPLACE 23s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 #counts FH_MSGID_REPLACE 23s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_XMAIL_REPLACE X-Mailer =~ /%XMAILER/ describe FH_XMAIL_REPLACE Broken Replace Template ##score FH_XMAIL_REPLACE 10 10 10 10 #counts FH_XMAIL_REPLACE 2s/0h of 44060 corpus (34282s/9778h FVGT) 12/01/06 #counts FH_XMAIL_REPLACE 23s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 #counts FH_XMAIL_REPLACE 23s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_ADD_INCHES /(?:add|gain) inches/i describe FB_ADD_INCHES Add / Gain inches ##score FB_ADD_INCHES 4 2.2 2.2 1.8 #counts FB_ADD_INCHES 22s/0h of 44060 corpus (34282s/9778h FVGT) 12/01/06 #counts FB_ADD_INCHES 25s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 #counts FB_ADD_INCHES 27s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #Message-ID: <01c70f9e$adc3acc0$987ba8c0@dabushb> #Message-ID: <01c70e80$416884c0$6501a8c0@CLIENT3> #Message-ID: <01c70fc7$5bf945c0$aef1b250@URINAYAD> #Message-ID: <01c70fc9$e55514f0$9500a8c0@plwn3pt0ufq4raf> #Message-ID: <01c70f73$c056fb10$de49f952@nomanvmb2qxoqa> #Message-ID: <01c70f9b$e98036f0$7ac1e455@anderssoe10f8c> header __FH_MSGID_01C7 MESSAGEID =~ /^<0{1,5}1c7/ header __FH_HAS_XMSMAIL exists:X-MSMail-Priority header __FH_HAS_XPRIORITY exists:X-Priority header __FS_SUBJ_RE Subject =~ /^Re: / meta FM_RE_HELLO_SPAM (__FH_MSGID_01C7 && __FH_HAS_XMSMAIL && __FH_HAS_XPRIORITY && __FS_SUBJ_RE) describe FM_RE_HELLO_SPAM Re: Hello / hi ##score FM_RE_HELLO_SPAM 10 10 10 10 #counts FM_RE_HELLO_SPAM 2s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 #counts FM_RE_HELLO_SPAM 3181s/0h of 43779 corpus (34015s/9764h FVGT) 11/28/06 #counts FM_RE_HELLO_SPAM 3456s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FM_RE_HELLO_SPAM 4162s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_DDDD_BUCKS /\d{4} bucks/ describe FB_DDDD_BUCKS We use comma's and it's dollars not bucks! ##score FB_DDDD_BUCKS 4 #counts FB_DDDD_BUCKS 16s/0h of 43891 corpus (34132s/9759h FVGT) 11/30/06 #counts FB_DDDD_BUCKS 19s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FB_DDDD_BUCKS 34s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_HOST_IN_ADDRARPA X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]{0,25}\.in-addr\.arpa / describe FH_HOST_IN_ADDRARPA HOST dns says "in-addr.arpa" ##score FH_HOST_IN_ADDRARPA 3.9 2 2 1 #counts FH_HOST_IN_ADDRARPA 20s/0h of 43891 corpus (34132s/9759h FVGT) 11/30/06 #counts FH_HOST_IN_ADDRARPA 22s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FH_HOST_IN_ADDRARPA 27s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_IMAGIRL /i am a girl/i describe FB_IMAGIRL Phrae: I am a girl ##score FB_IMAGIRL 10 4 4 2 #counts FB_IMAGIRL 9s/0h of 42912 corpus (33149s/9763h FVGT) 11/27/06 #counts FB_IMAGIRL 10s/0h of 43779 corpus (34015s/9764h FVGT) 11/28/06 #counts FB_IMAGIRL 11s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FB_IMAGIRL 11s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header __SUBJ_LOWER ALL =~ /subject:\s\S{5}/ header __FROM_LOWER ALL =~ /from:\s\S{5}/ header __TO___LOWER ALL =~ /to:\s\S{5}/ header __DATE_LOWER ALL =~ /date:\s\S{5}/ meta FM_LOWER_CASE_HEAD (__SUBJ_LOWER && __FROM_LOWER && __TO___LOWER && __DATE_LOWER) describe FM_LOWER_CASE_HEAD Lots of headers with lower case. ##score FM_LOWER_CASE_HEAD 10 5 5 4 #counts LOWER_CASE_HEAD 3s/0h of 43763 corpus (34000s/9763h FVGT) 11/28/06 #counts LOWER_CASE_HEAD 3s/0h of 43891 corpus (34132s/9759h FVGT) 11/30/06 #counts FM_LOWER_CASE_HEAD 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_REPLIC_CAP /REPLICAS?\b/ describe FB_REPLIC_CAP Phrase: REPLICA ##score FB_REPLIC_CAP 2.5 2 2 1 #counts FB_REPLIC_CAP 26s/0h of 211884 corpus (204373s/7511h FT) 12/08/05 #counts FB_REPLIC_CAP 13s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_REPLIC_CAP 16s/0h of 42912 corpus (33149s/9763h FVGT) 11/27/06 #counts FB_REPLIC_CAP 16s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FB_REPLIC_CAP 16s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __F_FUCK /\bfuck\b/i body __F_ASS /\bass\b/i body __F_TEEN /teens?\b/i meta FM_FUCK_ASS_TEEN (__F_FUCK && __F_ASS && __F_TEEN) ##score FM_FUCK_ASS_TEEN 10.357 #counts FM_FUCK_ASS_TEEN 1s/0h of 42912 corpus (33149s/9763h FVGT) 11/27/06 #counts FM_FUCK_ASS_TEEN 2s/0h of 43779 corpus (34015s/9764h FVGT) 11/28/06 #counts FM_FUCK_ASS_TEEN 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __FB_P_TRUELOVE /true love/i body __FB_P_ALLNIGHT /all night!/i meta FM_TRUE_LOV_ALL_N (__FB_P_TRUELOVE && __FB_P_ALLNIGHT) describe FM_TRUE_LOV_ALL_N True Love all Night! ##score FM_TRUE_LOV_ALL_N 10.357 #counts FM_TRUE_LOV_ALL_N 0s/0h of 42054 corpus (32293s/9761h FVGT) 11/24/06 #counts FM_TRUE_LOV_ALL_N 41s/0h of 42912 corpus (33149s/9763h FVGT) 11/27/06 #counts FM_TRUE_LOV_ALL_N 48s/0h of 43779 corpus (34015s/9764h FVGT) 11/28/06 #counts FM_TRUE_LOV_ALL_N 57s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 uri FU_ENDS_SG m'/sg$'i describe FU_ENDS_SG URL ends with /sg ##score FU_ENDS_SG 10.357 #counts FU_ENDS_SG 4s/0h of 42912 corpus (33149s/9763h FVGT) 11/27/06 #counts FU_ENDS_SG 5s/0h of 43779 corpus (34015s/9764h FVGT) 11/28/06 #counts FU_ENDS_SG 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 uri FU_ENDS_RT m'/rt$'i describe FU_ENDS_RT URL ends with /rt ##score FU_ENDS_RT 10.357 #counts FU_ENDS_RT 7s/0h of 42912 corpus (33149s/9763h FVGT) 11/27/06 #counts FU_ENDS_RT 8s/0h of 43779 corpus (34015s/9764h FVGT) 11/28/06 #counts FU_ENDS_RT 9s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 meta FM_PHN_NODNS (FB_SPACED_PHN_3B && RDNS_NONE) describe FM_PHN_NODNS Phone spacing + no dns ##score FM_PHN_NODNS 3.755 #counts FM_PHN_NODNS 31s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FM_PHN_NODNS 40s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #watches http://www.freshbeach.com rawbody FR_WATCHES_HTTP m'watches\s(?:\w+)?\s?http://'i describe FR_WATCHES_HTTP Watches http:// ##score FR_WATCHES_HTTP 4.415 #counts FR_WATCHES_HTTP 1s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 #counts FR_WATCHES_HTTP 39s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FR_WATCHES_HTTP 56s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 uri FU_END_ET m'/et/$'i describe FU_END_ET ET Phone Home? ##score FU_END_ET 10.357 #counts FU_END_ET 304s/0h of 42054 corpus (32293s/9761h FVGT) 11/24/06 #counts FU_END_ET 342s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 #counts FU_END_ET 373s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FU_END_ET 399s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_MSGID_01C70XXX MESSAGEID =~ /^<01c70[a-f][a-f0-9]{2}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[a-zA-Z0-9-]+>$/ describe FH_MSGID_01C70XXX MESSAGE ID seen often!!! ##score FH_MSGID_01C70XXX 10.357 #counts FH_MSGID_01C70XXX 13s/0h of 42054 corpus (32293s/9761h FVGT) 11/24/06 #counts FH_MSGID_01C70XXX 15s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 #counts FH_MSGID_01C70XXX 54s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FH_MSGID_01C70XXX 159s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 uri FU_CLICK_PHP_DDD /click\.php\?\d+\.\d+\.\d+\.\d+\.\d+/i describe FU_CLICK_PHP_DDD Click.php?ddd.ddd.ddd.ddd.ddd ##score FU_CLICK_PHP_DDD 10 8 8 6 #counts FU_CLICK_PHP_DDD 41s/0h of 40756 corpus (31065s/9691h FVGT) 11/20/06 #counts FU_CLICK_PHP_DDD 51s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 #counts FU_CLICK_PHP_DDD 55s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FU_CLICK_PHP_DDD 68s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_X_REFS_DDD X-References =~ /^\d{1,5}$/ describe FH_X_REFS_DDD X-Refs with digits. ##score FH_X_REFS_DDD 10.222 #counts FH_X_REFS_DDD 41s/0h of 40756 corpus (31065s/9691h FVGT) 11/20/06 #counts FH_X_REFS_DDD 51s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 #counts FH_X_REFS_DDD 55s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FH_X_REFS_DDD 68s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 meta FM_XREF_CLICKPHP (FU_CLICK_PHP_DDD && FH_X_REFS_DDD) describe FM_XREF_CLICKPHP Whatever it takes! ##score FM_XREF_CLICKPHP 4.54 #counts FM_XREF_CLICKPHP 41s/0h of 40756 corpus (31065s/9691h FVGT) 11/20/06 #counts FM_XREF_CLICKPHP 51s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 #counts FM_XREF_CLICKPHP 55s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FM_XREF_CLICKPHP 68s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_SPACED_PHN_3B /\d\d\d--\d\d\d--?\d\d\d\d/ describe FB_SPACED_PHN_3B Phone number with -- spacing. (B) ##score FB_SPACED_PHN_3B 5 2 2 1.563 #counts FB_SPACED_PHN_3B 2s/0h of 33966 corpus (24401s/9565h FVGT) 11/16/06 #counts FB_SPACED_PHN_3B 2s/0h of 34882 corpus (25258s/9624h FVGT) 11/16/06 #counts FB_SPACED_PHN_3B 9s/0h of 40756 corpus (31065s/9691h FVGT) 11/20/06 #counts FB_SPACED_PHN_3B 27s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 #counts FB_SPACED_PHN_3B 35s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FB_SPACED_PHN_3B 44s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header __FH_FRM_53 From =~ /\@53\.com/i header __FH_MSG_53 MESSAGEID =~ /\@53\.com/i header __FH_RCV_53 Received =~ /\.53\.com/i meta FM_FAKE_53COM_SPOOF (__FH_FRM_53 && !__FH_MSG_53 && !__FH_RCV_53) describe FM_FAKE_53COM_SPOOF Spoof mail from 53.com? ##score FM_FAKE_53COM_SPOOF 10.357 #counts FM_FAKE_53COM_SPOOF 488s/0h of 40784 corpus (31086s/9698h FVGT) 11/20/06 #counts FM_FAKE_53COM_SPOOF 489s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 #counts FM_FAKE_53COM_SPOOF 491s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FM_FAKE_53COM_SPOOF 491s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __FB_HOWMUCH /How Much/i body __FB_COST /cost/i meta __FM_HOW_COST (__FB_HOWMUCH && __FB_COST) body __FB_IDENTITY /identity/i meta __FM_HOW_COST_ID (__FM_HOW_COST || __FB_IDENTITY) body __FB_YOUR_IMAGE /your(?: compan(?:y(?:'s)?|ies)) image/i body __FB_IMAGE_OF /image of your company/i meta __FM_YOUR_IMAGE (__FB_YOUR_IMAGE || __FB_IMAGE_OF) meta FM_HOW_IMG_COST2 (__FM_HOW_COST_ID && __FM_YOUR_IMAGE) describe FM_HOW_IMG_COST2 How much does your image cost? (2) ##score FM_HOW_IMG_COST2 3.99 2.2 2.2 1.777 #counts FM_HOW_IMG_COST2 9s/0h of 40784 corpus (31086s/9698h FVGT) 11/20/06 #counts FM_HOW_IMG_COST2 15s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 #counts FM_HOW_IMG_COST2 15s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FM_HOW_IMG_COST2 16s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 uri FU_COMMON_SUBS m'/(?:h(?:5r|x1)|1q0|bgh|csy|j6x|n1b|y6g|zox)/?[,.]?$'i describe FU_COMMON_SUBS Sub-dir seen often in spam. ##score FU_COMMON_SUBS 7 5 5 4 #counts FU_COMMON_SUBS 2s/0h of 42141 corpus (34216s/7925h FVGT) 04/25/06 #counts FU_COMMON_SUBS 43s/0h of 144700 corpus (93150s/51550h DOC) 04/25/06 #counts FU_COMMON_SUBS 5s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FU_COMMON_SUBS 23s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FU_COMMON_SUBS 24s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __FRT_GOLD /\b(?!gold)\b/i replace_rules __FRT_GOLD body __FRT_SILVER /\b(?!s[il][li]ver)\b/i replace_rules __FRT_SILVER meta FRM_SILVER_GOLD (__FRT_SILVER && __FRT_GOLD) describe FRM_SILVER_GOLD ReplaceTags: Silver & Gold ##score FRM_SILVER_GOLD 1.955 #counts FRM_SILVER_GOLD 6s/0h of 40784 corpus (31086s/9698h FVGT) 11/20/06 #counts FRM_SILVER_GOLD 8s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 #counts FRM_SILVER_GOLD 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 endif # Mail::SpamAssassin::Plugin::ReplaceTags body __FB_LUX_GIFTS /Luxury (?:\w+\s)?Gifts/i body __FB_NUM_PERCNT /\d\s?\%/ meta FM_LUX_GIFTS_REDUCED (__FB_LUX_GIFTS && __FB_NUM_PERCNT) describe FM_LUX_GIFTS_REDUCED Luxury Gifts with dd% ##score FM_LUX_GIFTS_REDUCED 10 5 5 2.2 #counts FM_LUX_GIFTS_REDUCED 19s/0h of 32090 corpus (22848s/9242h FVGT) 11/13/06 #counts FM_LUX_GIFTS_REDUCED 96s/0h of 41138 corpus (31436s/9702h FVGT) 11/20/06 #counts FM_LUX_GIFTS_REDUCED 139s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FM_LUX_GIFTS_REDUCED 142s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_MSGID_DIGIT MESSAGEID =~ /\{DIGIT\}/ describe FH_MSGID_DIGIT Forgot Pattern Replacement? ##score FH_MSGID_DIGIT 10 10 10 10 #counts FH_MSGID_DIGIT 21s/0h of 41138 corpus (31436s/9702h FVGT) 11/20/06 #counts FH_MSGID_DIGIT 23s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FH_MSGID_DIGIT 23s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header __FS_HOWMUCH Subject =~ /how much/i header __FS_IMAGE Subject =~ /your(?: compan(?:y(?:'s)?|ies))? image/i header __FS_COST Subject =~ /cost/i meta FM_HOW_IMG_COST (__FS_HOWMUCH && __FS_IMAGE && __FS_COST) describe FM_HOW_IMG_COST How much does your image cost? ##score FM_HOW_IMG_COST 10 5 5 5 #counts FM_HOW_IMG_COST 17s/0h of 24480 corpus (15455s/9025h FVGT) 10/30/06 #counts FM_HOW_IMG_COST 21s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FM_HOW_IMG_COST 24s/0h of 40802 corpus (31109s/9693h FVGT) 11/20/06 #counts FM_HOW_IMG_COST 25s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 rawbody __FR_SPACING_8 /[a-z0-9]{6}\s{8}[a-z0-9]{5}/i rawbody __FR_SPACING_9 /[a-z0-9]{6}\s{9}[a-z0-9]{5}/i rawbody __FR_SPACING_15 /[a-z0-9]{6}\s{15}[a-z0-9]{5}/i rawbody __FR_SPACING_17 /[a-z0-9]{6}\s{17}[a-z0-9]{5}/i rawbody __FR_SPACING_22 /[a-z0-9]{6}\s{22}[a-z0-9]{5}/i meta FM_ASCII_ART_SPACINGc ((__FR_SPACING_8 + __FR_SPACING_9 + __FR_SPACING_15 + __FR_SPACING_17 + __FR_SPACING_22) > 3) describe FM_ASCII_ART_SPACINGc Looks like might be ASCII ##score FM_ASCII_ART_SPACINGc 0.833 #counts FM_ASCII_ART_SPACINGc 23s/0h of 35751 corpus (26053s/9698h FVGT) 11/18/06 #counts FM_ASCII_ART_SPACINGc 23s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header __FS_S_TRADE Subject =~ /\btrade\b/i body __FB_S_SYMBOL /Symb?o?l?:\s?[A-Z_,\.-]{4,8}/i body __FB_S_PRICE /Pri{1,2}c[a-z]?e/i meta __FM_MY_PRICE (__FB_S_PRICE || FRT_PRICE) body __FB_S_STOCK /Stock/i meta FM_DOESNT_SAY_STOCK (__FB_S_SYMBOL && __FM_MY_PRICE && !__FB_S_STOCK && !__FS_S_TRADE) describe FM_DOESNT_SAY_STOCK It's a stock spam but doesn't say stock ##score FM_DOESNT_SAY_STOCK 10.357 #counts FM_DOESNT_SAY_STOCK 30s/0h of 35726 corpus (26027s/9699h FVGT) 11/17/06 #counts FM_DOESNT_SAY_STOCK 30s/0h of 35751 corpus (26053s/9698h FVGT) 11/18/06 #counts FM_DOESNT_SAY_STOCK 96s/0h of 40802 corpus (31109s/9693h FVGT) 11/20/06 #counts FM_DOESNT_SAY_STOCK 114s/0h of 41138 corpus (31436s/9702h FVGT) 11/20/06 #counts FM_DOESNT_SAY_STOCK 142s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 #counts FM_DOESNT_SAY_STOCK 150s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FM_DOESNT_SAY_STOCK 156s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __FB_HOTTEST /hottest/i body __FB_PICK /\bpick\b/i body __FB_PROJECTED /projected/i meta __FM_STOCK_WORDS (__FB_HOTTEST || __FB_PICK || __FB_PROJECTED) meta FM_LIKE_STOCKS (__FM_STOCK_WORDS && !__FB_S_STOCK && __FB_S_SYMBOL) describe FM_LIKE_STOCKS It looks like a duck, it's a duck! ##score FM_LIKE_STOCKS 5.888 #counts FM_LIKE_STOCKS 6s/0h of 35751 corpus (26053s/9698h FVGT) 11/18/06 #counts FM_LIKE_STOCKS 41s/0h of 41138 corpus (31436s/9702h FVGT) 11/20/06 #counts FM_LIKE_STOCKS 56s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_FROM_HOODIA From =~ /Hoodia/i describe FH_FROM_HOODIA From has Hoodia!!? ##score FH_FROM_HOODIA 6.222 #counts FH_FROM_HOODIA 7s/0h of 12277 corpus (6604s/5673h CT) 03/21/06 #counts FH_FROM_HOODIA 1s/0h of 9125 corpus (6891s/2234h AxB) 03/21/06 #counts FH_FROM_HOODIA 29s/0h of 22944 corpus (17229s/5715h MY) 03/21/06 #counts FH_FROM_HOODIA 161s/0h of 111414 corpus (73794s/37620h DOC) 03/21/06 #counts FH_FROM_HOODIA 1094s/0h of 103219 corpus (95719s/7500h FVGT) 03/21/06 #counts FH_FROM_HOODIA 32s/0h of 41138 corpus (31436s/9702h FVGT) 11/20/06 #counts FH_FROM_HOODIA 33s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #### START FULL RULES #### #### THESE WILL RETIRE AFTER 3.2 IS RELEASE #### full FF_COMMENT_ODD /<-\*->/ describe FF_COMMENT_ODD FULL RULE: Special Comment ##score FF_COMMENT_ODD 10.357 #counts FF_COMMENT_ODD 2996s/0h of 222798 corpus (214870s/7928h FVGT) 04/25/06 #counts FF_COMMENT_ODD 486s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FF_COMMENT_ODD 524s/0h of 41138 corpus (31436s/9702h FVGT) 11/20/06 #counts FF_COMMENT_ODD 539s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 full FF_LEO_FLOAT_RIGHT /FLOAT[\r\n]{1,2}:[\r\n]{1,2}RIGHT/i describe FF_LEO_FLOAT_RIGHT FULL RULE: Float, Right, Special signs! ##score FF_LEO_FLOAT_RIGHT 10.357 #counts FF_LEO_FLOAT_RIGHT 26s/0h of 27310 corpus (19422s/7888h FT) 02/28/06 #counts FF_LEO_FLOAT_RIGHT 1931s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FF_LEO_FLOAT_RIGHT 1932s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 full FF_IHOPE_YOU_SINK /(?:FLOAT.{10,300}){3}/is describe FF_IHOPE_YOU_SINK Triple Floats, common viagra signs. ##score FF_IHOPE_YOU_SINK 1.699 #counts IHOPE_YOU_SINK 295s/1h of 41941 corpus (34079s/7862h FVGT) 04/14/06 #counts IHOPE_YOU_SINK 5224s/1h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FF_IHOPE_YOU_SINK 3338s/1h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FF_IHOPE_YOU_SINK 3361s/3h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FF_IHOPE_YOU_SINK 3364s/3h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #====== BODY RULES BELOW ============= body FB_ACHIEVE_BACH /Achieve your Bachelor/i describe FB_ACHIEVE_BACH Phrase: Achieve your bachelor ##score FB_ACHIEVE_BACH 3.253 #counts FB_ACHIEVE_BACH 2s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FB_ACHIEVE_BACH 2s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_ACHIEVE_BACH 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_ALMOST_SEX /\b[b-z]sex+\b/i describe FB_ALMOST_SEX It's almost sex, but not! ##score FB_ALMOST_SEX 4.114 #counts FB_ALMOST_SEX 12s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FB_ALMOST_SEX 33s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_ALMOST_SEX 34s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_AN_ERROR_4U /An error has been made in your favor/ describe FB_AN_ERROR_4U Phrase: an error has been made in your favor ##score FB_AN_ERROR_4U 5.717 #counts FB_AN_ERROR_4U 2s/0h of 42564 corpus (34322s/8242h FVGT) 05/26/06 #counts FB_AN_ERROR_4U 2s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_AN_ERROR_4U 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_ANA_TRIM /Ana[^a-z]trim/i describe FB_ANA_TRIM Broken AnaTrim phrase. ##score FB_ANA_TRIM 10.357 #counts FB_ANA_TRIM 2s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 #counts FB_ANA_TRIM 4s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_ANA_TRIM 1383s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_ANA_TRIM 5s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_ANA_TRIM 69s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_ANUI /A[-_\.]U[-_\.]N[-_\.]I/i describe FB_ANUI Phrase: A_U_N_I ##score FB_ANUI 7.166 #counts FB_ANUI 14s/0h of 25009 corpus (15987s/9022h FVGT) 11/03/06 #counts FB_ANUI 21s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 #counts FB_ANUI 42s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_B0NUS /B0nus/i describe FB_B0NUS Phrase: B0nus ##score FB_B0NUS 10.357 #counts FB_B0NUS 6s/0h of 42564 corpus (34322s/8242h FVGT) 05/26/06 #counts FB_B0NUS 36s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_B0NUS 5s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_B0NUS 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_BAD_ERECT /bad erection/i describe FB_BAD_ERECT Phrase: Bad Erection ##score FB_BAD_ERECT 10.822 #counts FB_BAD_ERECT 2s/0h of 25348 corpus (16329s/9019h FVGT) 11/04/06 #counts FB_BAD_ERECT 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_BE_MILLION /be.{1,5}millionaire/i describe FB_BE_MILLION Phrase: be millionaire ##score FB_BE_MILLION 1.837 #counts FB_BE_MILLION 184s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_BE_MILLION 48s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_BE_MILLION 5s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_BE_MILLION 9s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_BEDISCARDED /discarded [a-z\s]{1,14} future deployments/i describe FB_BEDISCARDED Phrase: discarded ... future deployments ##score FB_BEDISCARDED 2.973 #counts FB_BEDISCARDED 969s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_BEDISCARDED 0s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_BEDISCARDED 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_BILLI0N /[BM][I1]LL[I1]0N/i ##score FB_BILLI0N 10.357 describe FB_BILLI0N Phrase: [BM]Illi0n #counts FB_BILLI0N 669s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_BILLI0N 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_BILLI0N 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_BOOST_CONFIDEN /Boost your confidence/i describe FB_BOOST_CONFIDEN Phrase: boost your confidence. ##score FB_BOOST_CONFIDEN 2.395 #counts FB_BOOST_CONFIDEN 31s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_BOOST_CONFIDEN 1s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_BOOST_CONFIDEN 19s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_BOOST_CONFIDEN 21s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #80O.538.6704 body FB_BROKEN_PHNUM /(?!800)8[0o][0o][-.\s\)]{1,3}\d\d\d[-\.\s]{0,3}\d\d\d\d/i describe FB_BROKEN_PHNUM weird phone number, with letters! ##score FB_BROKEN_PHNUM 3.84 #counts FB_BROKEN_PHNUM 10s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 #counts FB_BROKEN_PHNUM 42s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_BROWSER_ERR /Browser Error: [a-z0-9_]+,/i describe FB_BROWSER_ERR Phrase: Browser Error: random ##score FB_BROWSER_ERR 10 #counts FB_BROWSER_ERR 11s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 #counts FB_BROWSER_ERR 139s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_BROWSER_ERR 413s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_C0MPANY /c0mpany/i describe FB_C0MPANY Phrase: C0mpany ##score FB_C0MPANY 10 #counts FB_C0MPANY 21s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 #counts FB_C0MPANY 9s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_C0MPANY 12s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_CAN_LONGER /can last longer/i describe FB_CAN_LONGER Phrase: can last longer ##score FB_CAN_LONGER 4.854 #counts FB_CAN_LONGER 8s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 #counts FB_CAN_LONGER 26s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_CAN_LONGER 41s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_CASINO /(?!casino)Ca[\$s5][i1\|]n[o0]/i describe FB_CASINO Phrase: ca$ino ##score FB_CASINO 10 #counts FB_CASINO 46s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_CASINO 50s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_CASINO 56s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_CASINO_SPELLER /(?:Onliine Casino|Online CCasino)/i describe FB_CASINO_SPELLER Phrase: Online Casino, spelling mistake. ##score FB_CASINO_SPELLER 10.357 #counts FB_CASINO_SPELLER 4s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FB_CASINO_SPELLER 4s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_CASINO_SPELLER 4s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_CHOLESTERBLCK /Cholesterblock/i describe FB_CHOLESTERBLCK Phrase: Cholesterblock ##score FB_CHOLESTERBLCK 10.357 #counts FB_CHOLESTERBLCK 10s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_CHOLESTERBLCK 29s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_CHOLESTERBLCK 50s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_CIALIS_LEO3 /(?!CIALIS)\bC\s?[a-z]?\s?[Iitl1\\\/]\s?[a-z]?\s?[Aa]\s?[a-z]?\s?[LIl1\\\/]\s?[a-z]?\s?[ilIt1\\\/]\s?[a-z]?\s?[Ss]\b/ describe FB_CIALIS_LEO3 Uses a mis-spelled version of cialis. ##score FB_CIALIS_LEO3 4.599 #counts FB_CIALIS_LEO3 2604s/0h of 41968 corpus (34130s/7838h FVGT) 04/11/06 #counts FB_CIALIS_LEO3 17145s/12h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_CIALIS_LEO3 674s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_CIALIS_LEO3 686s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_CIALIS_LEO3 826s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_COM_ADR_SIGN /\:\:\s.{0,5}\d{3}\s\w{3,9}\s\w{2,9}\s.{1,20}\d{2}/i describe FB_COM_ADR_SIGN Common sign used in Addresses ##score FB_COM_ADR_SIGN 10.357 #counts FB_COM_ADR_SIGN 11s/0h of 43642 corpus (34621s/9021h FVGT) 10/26/06 #counts FB_COM_ADR_SIGN 63s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_COM_ADR_SIGN 160s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_COM_ADR_SIGN 351s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_CONSOL_YOUR /consolidate your/i describe FB_CONSOL_YOUR Phrase: Consolidate your ##score FB_CONSOL_YOUR 1.998 #counts FB_CONSOL_YOUR 204s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_CONSOL_YOUR 4s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_CONSOL_YOUR 6s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_CONSOL_YOUR 12s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_DOUBLE_0WORDS /\b[a-z]{1,5}0[a-z]{3,9}\s[a-z]{1,5}0[a-z]{3,9}\b/i describe FB_DOUBLE_0WORDS Looks like double 0 words ##score FB_DOUBLE_0WORDS 2.999 #counts FB_DOUBLE_0WORDS 689s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_DOUBLE_0WORDS 263s/0h of 107818 corpus (99658s/8160h FVGT) 03/11/06 #counts FB_DOUBLE_0WORDS 11s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 #counts FB_DOUBLE_0WORDS 12s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_DROWNING_DEBT /drowning in debt/i describe FB_DROWNING_DEBT Phrase: drowning in debt ##score FB_DROWNING_DEBT 2.375 #counts FB_DROWNING_DEBT 72s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_DROWNING_DEBT 1s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 #counts FB_DROWNING_DEBT 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_EARN_UP_TO /earn up to \$?\d?,?\d\d\d.{1,7}(?:day|week|month|year)/i describe FB_EARN_UP_TO Phrase: Earn up to .... ##score FB_EARN_UP_TO 3.828 #counts FB_EARN_UP_TO 1s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_EARN_UP_TO 7s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_EMAIL_HIER /email hier/i describe FB_EMAIL_HIER Phrase: email hier ##score FB_EMAIL_HIER 10.357 #counts FB_EMAIL_HIER 1583s/0h of 107818 corpus (99658s/8160h FVGT) 03/11/06 #counts FB_EMAIL_HIER 165s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_EMAIL_HIER 169s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #body FB_ENHANCED_MALE /Enhanced male power/i body FB_ENHANCED_MALE /Enhanced male/i describe FB_ENHANCED_MALE Phrase: Enhanced male ##score FB_ENHANCED_MALE 10.357 #counts FB_ENHANCED_MALE 17s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_ENHANCED_MALE 19s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_EPHEDRA_IS /Ephedra is back/i describe FB_EPHEDRA_IS Phrase: Ephedra is back ##score FB_EPHEDRA_IS 10.357 #counts FB_EPHEDRA_IS 31s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 #counts FB_EPHEDRA_IS 37s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_EPHEDRA_IS 51s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_EXPLOSIVE /EXPLOSIVE\b/ describe FB_EXPLOSIVE Phrase: EXPLOSIVE ##score FB_EXPLOSIVE 7.148 #counts FB_EXPLOSIVE 718s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_EXPLOSIVE 1s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_EXPLOSIVE 1s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_EXPLOSIVE 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_EXTRA_INCHES /extra inches/ describe FB_EXTRA_INCHES Phrase: extra inches ##score FB_EXTRA_INCHES 3.352 #counts FB_EXTRA_INCHES 16s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 #counts FB_EXTRA_INCHES 17s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_EXTRA_INCHES 21s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_FAKE_NUMBERS /\$\d\d?O\s*[MBT]/i describe FB_FAKE_NUMBERS Looks like numbers with O's insted of 0's ##score FB_FAKE_NUMBERS 3.494 #counts FB_FAKE_NUMBERS 948s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_FAKE_NUMBERS 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_FAKE_NUMBERS 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_FAKE_NUMS2 /\d,0OO/i describe FB_FAKE_NUMS2 Looks like fake numbers ##score FB_FAKE_NUMS2 3.834 #counts FB_FAKE_NUMS2 11s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_FAKE_NUMS2 0s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_FAKE_NUMS2 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_FAKE_NUMS4 /(?:\b|\b\d)\d,?\d,?OO(?:\b|\d\b)/ describe FB_FAKE_NUMS4 Looks like fake numbers (4) ##score FB_FAKE_NUMS4 3.992 #counts FB_FAKE_NUMS4 68s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_FAKE_NUMS4 49s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 #counts FB_FAKE_NUMS4 49s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_FEDERALLY_COMPL /We are federally compliant/i describe FB_FEDERALLY_COMPL Phrase: we are federally compliant ##score FB_FEDERALLY_COMPL 10.357 #counts FB_FEDERALLY_COMPL 19s/0h of 104500 corpus (96503s/7997h FVGT) 03/09/06 #counts FB_FEDERALLY_COMPL 21s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_FEDERALLY_COMPL 594s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_FEDERALLY_COMPL 742s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_FHARMACY /Fharmacy/i describe FB_FHARMACY Phrase: Farmacy ##score FB_FHARMACY 10.357 #counts FB_FHARMACY 12s/0h of 33043 corpus (23599s/9444h FVGT) 11/15/06 #counts FB_FHARMACY 65s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_FHARMACY 204s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_FORWARD_LOOK /(?!forward look)f[o0]rward l[0o][0o]k/i describe FB_FORWARD_LOOK Phrase: forward look with 0's ##score FB_FORWARD_LOOK 10.357 #counts FB_FORWARD_LOOK 588s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_FORWARD_LOOK 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_FORWARD_LOOK 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_FREE888 /Free \$888/i describe FB_FREE888 Claims we can get $888 Free. ##score FB_FREE888 10.357 #counts FB_FREE888 10s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FB_FREE888 17s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_FREE888 21s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_FUNNY_WEIGHT /(?!weight)we ?i?ght/i describe FB_FUNNY_WEIGHT Looks like weight but it's not! ##score FB_FUNNY_WEIGHT 5.993 #counts FB_FUNNY_WEIGHT 10s/0h of 34977 corpus (27086s/7891h FT) 03/01/06 #counts FB_FUNNY_WEIGHT 13s/0h of 107818 corpus (99658s/8160h FVGT) 03/11/06 #counts FB_FUNNY_WEIGHT 2s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_FUNNY_WEIGHT 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_GAPPY_ADDRESS /(?:[a-z] ){8}, (?:[a-z0-9] ){4}/i describe FB_GAPPY_ADDRESS Too much spacing in Address ##score FB_GAPPY_ADDRESS 5.655 #counts FB_GAPPY_ADDRESS 21s/0h of 43642 corpus (34621s/9021h FVGT) 10/26/06 #counts FB_GAPPY_ADDRESS 139s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_GAPPY_ADDRESS 425s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_GAPPY_ADDRESS 616s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_GAPPY_SOMETHING /(?:[A-Z,-]\s){8}.{0,5}(?:[0-9]\s){3}/ describe FB_GAPPY_SOMETHING Looks like something thats g a p p y ##score FB_GAPPY_SOMETHING 0.444 #counts FB_GAPPY_SOMETHING 1s/0h of 42071 corpus (34145s/7926h FVGT) 04/20/06 #counts FB_GAPPY_SOMETHING 3s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_GAPPY_SOMETHING 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_GET_LAID /GET LAID/ describe FB_GET_LAID Phrase: GET LAID ##score FB_GET_LAID 10.357 #counts FB_GET_LAID 5s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 #counts FB_GET_LAID 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_GET_MEDS /(?:place f[o0]r|[0o]rder|get\s?(?:y[o0]ur)?|online|quality).{1,7}med[isz][^a]/i describe FB_GET_MEDS Looks like trying to sell meds ##score FB_GET_MEDS 3.875 #counts FB_GET_MEDS 30s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 #counts FB_GET_MEDS 38s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_GET_XXX_CASH /get \d+(?:,?\d+)? (?:[a-z]+ ?)?cash/i describe FB_GET_XXX_CASH Phrase: Get Cash ##score FB_GET_XXX_CASH 10.357 #counts FB_GET_XXX_CASH 17s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 #counts FB_GET_XXX_CASH 55s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_GET_XXX_CASH 107s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_GREAT_BEST_SEX /(?:greater|best|Improved) sex/i describe FB_GREAT_BEST_SEX Phrase: greater, best, improved sex ##score FB_GREAT_BEST_SEX 5.157 #counts FB_GREAT_BEST_SEX 51s/0h of 25733 corpus (16658s/9075h FVGT) 11/08/06 #counts FB_GREAT_BEST_SEX 79s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_GREAT_BEST_SEX 109s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_GVR /(?:pef-rx|vigrex-ds|gsc-100|vp-rx|gv-promax|phentermine|adipex|xenical)/i describe FB_GVR Looks like generic viagra ##score FB_GVR 4.999 #counts FB_GVR 79s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_GVR 55s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 #counts FB_GVR 55s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_HA1R /\bha1r\b/i describe FB_HA1R Phrase: ha1r ##score FB_HA1R 5.644 #counts FB_HA1R 128s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_HA1R 0s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_HA1R 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_HEY_BRO_COMMA /Hey bro, / describe FB_HEY_BRO_COMMA Phrase hey bro, ##score FB_HEY_BRO_COMMA 7.357 #counts FB_HEY_BRO_COMMA 40s/0h of 103587 corpus (96208s/7379h FVGT) 03/15/06 #counts FB_HEY_BRO_COMMA 392s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_HEY_BRO_COMMA 10s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_HEY_BRO_COMMA 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_HG_H_CAP /\bHGH\b/ describe FB_HG_H_CAP Phrase: HGH ##score FB_HG_H_CAP 4.775 #counts FB_HG_H_CAP 75s/0h of 25733 corpus (16658s/9075h FVGT) 11/08/06 #counts FB_HG_H_CAP 88s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_HG_H_CAP 131s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_HOMELOAN /\$\d{3},\d{3} home loan/i describe FB_HOMELOAN Phrase $x home loan ##score FB_HOMELOAN 10.357 #counts FB_HOMELOAN 333s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_HOMELOAN 4s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_HOMELOAN 1165s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_HOMELOAN 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_IMPRESS_GIRL /\bimpress .{0,5}girl\b/ describe FB_IMPRESS_GIRL Phrase: impress ... girl ##score FB_IMPRESS_GIRL 4.284 #counts FB_IMPRESS_GIRL 122s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 #counts FB_IMPRESS_GIRL 128s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_IMPRESS_GIRL 131s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_IMPROVEJA /Improved Ejaculation/i describe FB_IMPROVEJA Phrase: Improved Ejaculation ##score FB_IMPROVEJA 10.357 #counts FB_IMPROVEJA 0s/0h of 25733 corpus (16658s/9075h FVGT) 11/08/06 #counts FB_IMPROVEJA 1s/0h of 26801 corpus (17723s/9078h FVGT) 11/09/06 #counts FB_IMPROVEJA 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_INCREASE_VOL /\bincrease.{0,8}volume/ describe FB_INCREASE_VOL Phrase: increase volume ##score FB_INCREASE_VOL 3.629 #counts FB_INCREASE_VOL 83s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 #counts FB_INCREASE_VOL 87s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_INCREASE_VOL 95s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_INCREASE_YOUR /Increase your energy/i describe FB_INCREASE_YOUR Phrase: Increase your energy ##score FB_INCREASE_YOUR 10.357 #counts FB_INCREASE_YOUR 58s/0h of 25733 corpus (16658s/9075h FVGT) 11/08/06 #counts FB_INCREASE_YOUR 83s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_INCREASE_YOUR 142s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_INDEPEND_RWD /independent reward/i describe FB_INDEPEND_RWD Phrase: independent reward ##score FB_INDEPEND_RWD 10.357 #counts FB_INDEPEND_RWD 164s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 #counts FB_INDEPEND_RWD 620s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_INDEPEND_RWD 1386s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_IOW /\bIow\b/ describe FB_IOW Phrase: mis-spelled low, iow? ##score FB_IOW 10.357 #counts FB_IOW 3s/0h of 25718 corpus (16644s/9074h FVGT) 11/08/06 #counts FB_IOW 6s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_IOW 7s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_L0AN /\bl0ans?\b/i describe FB_L0AN Phrase: L0an ##score FB_L0AN 10.357 #counts FB_L0AN 34s/0h of 43642 corpus (34621s/9021h FVGT) 10/26/06 #counts FB_L0AN 7s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_L0AN 18s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_LAON /\blaon\b/i describe FB_LAON Phrase: laon ##score FB_LAON 2.382 #counts FB_LAON 30s/0h of 104500 corpus (96503s/7997h FVGT) 03/09/06 #counts FB_LAON 0s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_LAON 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_LATEST_OEM /latest oem/i describe FB_LATEST_OEM Phrase: latest oem. ##score FB_LATEST_OEM 10.357 #counts FB_LATEST_OEM 12s/0h of 17430 corpus (9737s/7693h FT) 01/11/06 #counts FB_LATEST_OEM 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_LATEST_OEM 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_LIMITED_TIME /limited time promotion/i describe FB_LIMITED_TIME Phrase: limited time promotion ##score FB_LIMITED_TIME 3.193 #counts FB_LIMITED_TIME 73s/0h of 9788 corpus (4882s/4906h FT) 12/26/05 #counts FB_LIMITED_TIME 16s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_LIMITED_TIME 21s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_LOSE_WEIGHT_CAP /LOSE WEIGHT/ describe FB_LOSE_WEIGHT_CAP Phrase: LOSE WEIGHT ##score FB_LOSE_WEIGHT_CAP 2.522 #counts FB_LOSE_WEIGHT_CAP 115s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_LOSE_WEIGHT_CAP 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_LOSE_WEIGHT_CAP 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_LOWER_PAYM /lower your monthly payments/i describe FB_LOWER_PAYM Phrase: lower your monthly payments ##score FB_LOWER_PAYM 3.542 #counts FB_LOWER_PAYM 187s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_LOWER_PAYM 37s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_LOWER_PAYM 38s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_MAGIC_TAB /\b(?:magic|this) tab\b/ describe FB_MAGIC_TAB Phrase: this / magic tab. ##score FB_MAGIC_TAB 10.357 #counts FB_MAGIC_TAB 115s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 #counts FB_MAGIC_TAB 116s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_MAGIC_TAB 118s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_MAKE_MONEY /generate \$/i describe FB_MAKE_MONEY Phrase: generate $ ##score FB_MAKE_MONEY 1.755 #counts FB_MAKE_MONEY 11s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_MAKE_MONEY 0s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_MAKE_MONEY 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_MASCULINE_PERF /Masculine performance/i describe FB_MASCULINE_PERF Phrase: Masculine performance ##score FB_MASCULINE_PERF 10.357 #counts FB_MASCULINE_PERF 15s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FB_MASCULINE_PERF 18s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_MASCULINE_PERF 18s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_MED1CAT /\bmed1cat/i describe FB_MED1CAT Phrase: Med1cat ##score FB_MED1CAT 10.357 #counts FB_MED1CAT 7s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_MED1CAT 6s/0h of 35267 corpus (25646s/9621h FVGT) 11/17/06 #counts FB_MED1CAT 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_MEDS_PERCENT /meds .{3,10}\d\s?%/i describe FB_MEDS_PERCENT Talks about meds and % ##score FB_MEDS_PERCENT 10.357 #counts FB_MEDS_PERCENT 13s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FB_MEDS_PERCENT 6s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_MEDS_PERCENT 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_MEEDS /\bmeed[zs]\b/i describe FB_MEEDS Phrase: meed[zs] ##score FB_MEEDS 10.357 #counts FB_MEEDS 615s/0h of 81916 corpus (65011s/16905h ML) 02/27/06 #counts FB_MEEDS 0s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_MEEDS 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_MORE_SEMEN /more semen/i describe FB_MORE_SEMEN Phrase: more semen ##score FB_MORE_SEMEN 10.357 #counts FB_MORE_SEMEN 4s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FB_MORE_SEMEN 95s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_MORE_SEMEN 5s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_MORE_SEMEN 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_MORE_SIZE /\bmore size\b/ describe FB_MORE_SIZE Phrase: more size ##score FB_MORE_SIZE 10.357 #counts FB_MORE_SIZE 11s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_MORE_SIZE 29s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_MORE_SIZE 48s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_MOST_RECOG /most recognized brands/i describe FB_MOST_RECOG Phrase: most recognized brands. ##score FB_MOST_RECOG 2.772 #counts FB_MOST_RECOG 12s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FB_MOST_RECOG 12s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_MOST_RECOG 13s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_MOST_QUALITY /Most quality products/i describe FB_MOST_QUALITY Phrase: Most quality products ##score FB_MOST_QUALITY 10.357 #counts FB_MOST_QUALITY 16s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FB_MOST_QUALITY 90s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_MOST_QUALITY 26s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_N3W / n3w /i describe FB_N3W Phrase: n3w ##score FB_N3W 3.362 #counts FB_N3W 11s/0h of 34977 corpus (27086s/7891h FT) 03/01/06 #counts FB_N3W 523s/0h of 84470 corpus (67306s/17164h ML) 03/01/06 #counts FB_N3W 19s/0h of 107818 corpus (99658s/8160h FVGT) 03/11/06 #counts FB_N3W 0s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_N3W 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_NATIONALSURV /NationalSurveyPanel/i describe FB_NATIONALSURV Phrase: NationalSurveyPanel ##score FB_NATIONALSURV 3.259 #counts FB_NATIONALSURV 75s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_NATIONALSURV 2s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 #counts FB_NATIONALSURV 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_NEW_LOW_RATE /new low rate/i describe FB_NEW_LOW_RATE Phrase: new low rate ##score FB_NEW_LOW_RATE 1.853 #counts FB_NEW_LOW_RATE 1s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FB_NEW_LOW_RATE 1s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_NEW_LOW_RATE 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_NO_MORE_ADS /no more ad/i describe FB_NO_MORE_ADS Phrase: no more ad ##score FB_NO_MORE_ADS 1.174 #counts FB_NO_MORE_ADS 6s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_NO_MORE_ADS 13s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 #counts FB_NO_MORE_ADS 13s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_NO_MORE_HTTP /no\s?more.{0,5} http/i describe FB_NO_MORE_HTTP No more, the http ##score FB_NO_MORE_HTTP 10.357 #counts FB_NO_MORE_HTTP 1s/0h of 42050 corpus (34123s/7927h FVGT) 04/25/06 #counts FB_NO_MORE_HTTP 109s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_NO_MORE_HTTP 174s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #No More Mail Please: #No More Mail: #No more distribution body FB_NO_MORE_MAIL /No More (?:Mail|distribution)/i describe FB_NO_MORE_MAIL Phrase: no more mail, distribution ##score FB_NO_MORE_MAIL 10.529 #counts FB_NO_MORE_MAIL 25s/0h of 25733 corpus (16658s/9075h FVGT) 11/08/06 #counts FB_NO_MORE_MAIL 52s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_NO_MORE_MAIL 68s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_NO_MORE_OFFER /No more offer/i describe FB_NO_MORE_OFFER Phrase: no more offer ##score FB_NO_MORE_OFFER 3.189 #counts FB_NO_MORE_OFFER 2s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 #counts FB_NO_MORE_OFFER 1s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_NO_MORE_OFFER 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_NO_SCRIP_NEEDED /No.{1,10}P(?:er|re)scr[i1]pt[i1][o0]n (?:needed|requ[1i]re)/i describe FB_NO_SCRIP_NEEDED Phrase: no prescription needed. ##score FB_NO_SCRIP_NEEDED 10.357 #counts FB_NO_SCRIP_NEEDED 722s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_NO_SCRIP_NEEDED 1042s/0h of 107818 corpus (99658s/8160h FVGT) 03/13/06 #counts FB_NO_SCRIP_NEEDED 84s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_NO_SCRIP_NEEDED 133s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_NOT_CREDIT /\b(?!credit)cred[^i\s]{1,3}t\b/i describe FB_NOT_CREDIT Looks like credit but ain't. ##score FB_NOT_CREDIT 3.857 #counts FB_NOT_CREDIT 40s/0h of 42007 corpus (34077s/7930h FVGT) 04/19/06 #counts FB_NOT_CREDIT 9s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_NOT_CREDIT 9s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #8oo-xxx-xxxx body FB_NOT_PHONE_NUM1 /(?!\d{3})8(?:66|77|88|[0o][0o])[-\.\s\)]{1,3}[OIL0-9]{3}[-\.\s]/i describe FB_NOT_PHONE_NUM1 Looks like a fake phone number (1) ##score FB_NOT_PHONE_NUM1 10.357 #counts FB_NOT_PHONE_NUM1 3s/0h of 25718 corpus (16644s/9074h FVGT) 11/08/06 #counts FB_NOT_PHONE_NUM1 24s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_NOT_PHONE_NUM1 109s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #888-xox-xxxx body FB_NOT_PHONE_NUM2 /8(?:66|77|88|[0o][0o])[-\.\s\)]{1,3}(?!\d{3})[OIL0-9]{3}[-\.\s]/i describe FB_NOT_PHONE_NUM2 Looks like a fake phone number (2) ##score FB_NOT_PHONE_NUM2 10.357 #counts FB_NOT_PHONE_NUM2 5s/0h of 25718 corpus (16644s/9074h FVGT) 11/08/06 #counts FB_NOT_PHONE_NUM2 16s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_NOT_PHONE_NUM2 69s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #888-xxx-xiox body FB_NOT_PHONE_NUM3 /8(?:66|77|88|[0o][0o])[-\.\s\)]{1,3}[OIL0-9]{3}[-\.\s]{1,3}(?!\d{4})[OIL0-9]{4}/i describe FB_NOT_PHONE_NUM3 Looks like a fake phone number (3) ##score FB_NOT_PHONE_NUM3 10.357 #counts FB_NOT_PHONE_NUM3 7s/0h of 25718 corpus (16644s/9074h FVGT) 11/08/06 #counts FB_NOT_PHONE_NUM3 25s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_NOT_PHONE_NUM3 120s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # $choolgirl body FB_NOT_SCHOOL /(?!school)[\$s5]ch[o0][o0][il1\|]/i describe FB_NOT_SCHOOL Looks like school but it's not! ##score FB_NOT_SCHOOL 10.357 #counts FB_NOT_SCHOOL 2s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_NOT_SCHOOL 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_NOT_SEXUAL /[^Ss]exual/ describe FB_NOT_SEXUAL Almost Sexual but not. ##score FB_NOT_SEXUAL 10.357 #counts FB_NOT_SEXUAL 23s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 #counts FB_NOT_SEXUAL 27s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_NOW_NOW_NOW /NOW NOW NOW/ describe FB_NOW_NOW_NOW Phrase: NOW NOW NOW ##score FB_NOW_NOW_NOW 10.357 #counts FB_NOW_NOW_NOW 23s/0h of 33966 corpus (24401s/9565h FVGT) 11/16/06 #counts FB_NOW_NOW_NOW 42s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_NOW_NOW_NOW 96s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_NUMYO /1[0-9][\s\.]?y[\s\.]?o[\s\.]?\b/i describe FB_NUMYO Speaks of teenager. ##score FB_NUMYO 10.357 #counts FB_NUMYO 160s/0h of 24696 corpus (15673s/9023h FVGT) 11/01/06 #counts FB_NUMYO 287s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_NUMYO 166s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_NUMYO 181s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_NUMYO2 /2[0-9][\s\.]?y[\s\.]?o[\s\.]?\b/i describe FB_NUMYO2 Speaks of 20+ year old. ##score FB_NUMYO2 10.357 #counts FB_NUMYO2 7s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 #counts FB_NUMYO2 100s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_NUMYO2 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_ODD_SPACED_MONEY /\$\d\s,\s\d\d/ describe FB_ODD_SPACED_MONEY Looks like money but has odd spacing. ##score FB_ODD_SPACED_MONEY 10.357 #counts FB_ODD_SPACED_MONEY 1075s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_ODD_SPACED_MONEY 1078s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_ODD_SPACED_MONEY 1076s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_ONIINE /oniine/i describe FB_ONIINE Mis-spelled online ##score FB_ONIINE 10.357 #counts FB_ONIINE 2s/0h of 24645 corpus (15618s/9027h FVGT) 10/31/06 #counts FB_ONIINE 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_P1LL /\bp1ll/i describe FB_P1LL Phrase: p1ll ##score FB_P1LL 10.357 #counts FB_P1LL 61s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_P1LL 3s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_P1LL 7s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_P1LL 24s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_PA1N /\bpa1n/i describe FB_PA1N Phrase: pa1n ##score FB_PA1N 10.658 #counts FB_PA1N 10s/0h of 40695 corpus (35393s/5302h MY) 12/13/05 #counts FB_PA1N 12s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_PA1N 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_PA1N 1s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_PA1N 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #paste link in browser body FB_PASTE_LINK /paste link .{1,8}browser/i describe FB_PASTE_LINK Phrase: past link into browser ##score FB_PASTE_LINK 10.357 #counts FB_PASTE_LINK 9s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_PASTE_LINK 94s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_PASTE_LINK 49s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_PC_DOCTOR /PC Doctor/i describe FB_PC_DOCTOR Phrase: PC Doctor ##score FB_PC_DOCTOR 10.357 #counts FB_PC_DOCTOR 2s/0h of 43642 corpus (34621s/9021h FVGT) 10/26/06 #counts FB_PC_DOCTOR 25s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_PC_DOCTOR 90s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_PC_DOCTOR 166s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_PENIS_GROWTH /pen[i1]s grow(?:th)?/i describe FB_PENIS_GROWTH Phrase: penis growth ##score FB_PENIS_GROWTH 6.999 #counts FB_PENIS_GROWTH 21s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_PENIS_GROWTH 4s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_PENIS_GROWTH 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_PIPE_ILLION /(?!illion)i[l|][l|][i|][o0]n/i describe FB_PIPE_ILLION Looks like illion, but it's not ##score FB_PIPE_ILLION 10.357 #counts FB_PIPE_ILLION 1560s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_PIPE_ILLION 3s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_PIPE_ILLION 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_PIPEDOLLAR /(?!dollar)d[o0][1|li][1|li]ar/i describe FB_PIPEDOLLAR Phrase: Dollar, with pipes or 0's. ##score FB_PIPEDOLLAR 10.357 #counts FB_PIPEDOLLAR 40s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_PIPEDOLLAR 2s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_PIPEDOLLAR 331s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_PIPEDOLLAR 262s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 #counts FB_PIPEDOLLAR 4s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_PIPENEWSLETTER /news\|etter/i describe FB_PIPENEWSLETTER Phrase news|etter ##score FB_PIPENEWSLETTER 10.357 #counts FB_PIPENEWSLETTER 1s/0h of 40695 corpus (35393s/5302h MY) 12/13/05 #counts FB_PIPENEWSLETTER 890s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_PIPENEWSLETTER 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_PIPENEWSLETTER 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_PROLONGED_HARD /(?:prolonged|increased) hardness/i describe FB_PROLONGED_HARD Talks about prolonged hardness ##score FB_PROLONGED_HARD 10.357 #counts FB_PROLONGED_HARD 15s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FB_PROLONGED_HARD 22s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_PROLONGED_HARD 175s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_PROLONGED_HARD 21s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_QUALITY_REPLICA /quality replica/i describe FB_QUALITY_REPLICA Phrase: quality replica ##score FB_QUALITY_REPLICA 10.357 #counts FB_QUALITY_REPLICA 222s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_QUALITY_REPLICA 1s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_QUALITY_REPLICA 503s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_QUALITY_REPLICA 35s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_RANDOM_SPUR /\{SPUR_\d{1,2}\}/i describe FB_RANDOM_SPUR Pattern Replacement Failure ##score FB_RANDOM_SPUR 10.357 #counts FB_RANDOM_SPUR 38s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_RANDOM_SPUR 105s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_RANDOM_SPUR 206s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_RE_FI /\bre[^a-z]fi\b/ describe FB_RE_FI Looks like refi. ##score FB_RE_FI 10.357 #counts FB_RE_FI 1s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 #counts FB_RE_FI 2s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_RE_FI 68s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_RE_FI 16s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_REF_CODE_SPACE /r e f c o d e/i describe FB_REF_CODE_SPACE Refcode with spacing ##score FB_REF_CODE_SPACE 10.357 #counts FB_REF_CODE_SPACE 74s/0h of 23261 corpus (14238s/9023h FVGT) 10/30/06 #counts FB_REF_CODE_SPACE 711s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_REF_CODE_SPACE 1009s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_REFI / Refi /i describe FB_REFI Phrase: Refi ##score FB_REFI 3.534 #counts FB_REFI 1088s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_REFI 14s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 #counts FB_REFI 16s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_REM_PART /remov\W/i describe FB_REM_PART Looks like remove w/o e. ##score FB_REM_PART 10.357 #counts FB_REM_PART 48s/0h of 40695 corpus (35393s/5302h MY) 12/13/05 #counts FB_REM_PART 856s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_REM_PART 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_REPLICA_ROLEX /replica rolex/i describe FB_REPLICA_ROLEX Phrase: Replica Rolex ##score FB_REPLICA_ROLEX 3.957 #counts FB_REPLICA_ROLEX 7s/0h of 40695 corpus (35393s/5302h MY) 12/13/05 #counts FB_REPLICA_ROLEX 16s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_REPLICA_ROLEX 5s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 #counts FB_REPLICA_ROLEX 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_REWARDS_GATE /Rewards Gateway/i describe FB_REWARDS_GATE Phrase: Rewards Gateway ##score FB_REWARDS_GATE 10.357 #counts FB_REWARDS_GATE 30s/0h of 27348 corpus (19456s/7892h FT) 02/27/06 #counts FB_REWARDS_GATE 148s/0h of 101278 corpus (61900s/39378h DOC) 02/27/06 #counts FB_REWARDS_GATE 11s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 #counts FB_REWARDS_GATE 24s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_ROLLER_IS_T /Roller is th/i describe FB_ROLLER_IS_T Phrase: Roller is th ##score FB_ROLLER_IS_T 1.357 #counts FB_ROLLER_IS_T 20s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 #counts FB_ROLLER_IS_T 22s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_ROLLER_IS_T 1s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 #counts FB_ROLLER_IS_T 28s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_ROLLER_IS_T 28s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_ROLX /\brolx\b/i describe FB_ROLX Phrase: rolx ##score FB_ROLX 10.357 #counts FB_ROLX 0s/0h of 40695 corpus (35393s/5302h MY) 12/13/05 #counts FB_ROLX 163s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_ROLX 0s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_ROLX 1s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_ROLX 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_SAVE_PERSC /sav(?:e|ing).{1,45}p[re][re]scr[i1]pt[i1][o0]n/i describe FB_SAVE_PERSC Phrase: save ... prescription. ##score FB_SAVE_PERSC 3.199 #counts FB_SAVE_PERSC 7s/0h of 40695 corpus (35393s/5302h MY) 12/13/05 #counts FB_SAVE_PERSC 30s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_SAVE_PERSC 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_SAVE_PERSC 19s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_SAVE_PERSC 2s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 #counts FB_SAVE_PERSC 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_SSEX /\bssex\b/ describe FB_SSEX Phrase: ssex ##score FB_SSEX 10.357 #counts FB_SSEX 0s/0h of 5479 corpus (1297s/4182h AxB) 09/25/06 #counts FB_SSEX 19s/0h of 21635 corpus (15142s/6493h CT) 09/25/06 #counts FB_SSEX 33s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 #counts FB_SSEX 34s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_SMALL_PEN /small p+e+n(?!sion)/i describe FB_SMALL_PEN Phrase: small pen ##score FB_SMALL_PEN 10.357 #counts FB_SMALL_PEN 105s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FB_SMALL_PEN 24s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_SMALL_PEN 26s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_SOFTTABS /\bsoft\s?t?abs\b/i describe FB_SOFTTABS Phrase: Softabs ##score FB_SOFTTABS 10.357 #counts FB_SOFTTABS 31s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_SOFTTABS 0s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_SOFTTABS 95s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_SOFTTABS 97s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_SPACED_CASH /c a s h/i describe FB_SPACED_CASH Phrase: c a s h ##score FB_SPACED_CASH 4.555 #counts FB_SPACED_CASH 4s/0h of 42007 corpus (34077s/7930h FVGT) 04/19/06 #counts FB_SPACED_CASH 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_SPACED_FREE /F R E E/i describe FB_SPACED_FREE Phrase: F R E E ##score FB_SPACED_FREE 2.157 #counts FB_SPACED_FREE 68s/0h of 40695 corpus (35393s/5302h MY) 12/13/05 #counts FB_SPACED_FREE 141s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_SPACED_FREE 60s/0h of 25362 corpus (16336s/9026h FVGT) 11/04/06 #counts FB_SPACED_FREE 66s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_SPACED_LOWER /L O W E R/i describe FB_SPACED_LOWER Phrase: l o w e r ##score FB_SPACED_LOWER 10.357 #counts FB_SPACED_LOWER 4s/0h of 42007 corpus (34077s/7930h FVGT) 04/19/06 #counts FB_SPACED_LOWER 5s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_SPACED_LOWER 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_SPACEY_ZIP /\s\d\s\d\s\d\s\d\s\d\s-\s\d\s\d\s\d\s\d/ describe FB_SPACEY_ZIP Looks like a s p a c e d zipcode. ##score FB_SPACEY_ZIP 10.357 #counts FB_SPACEY_ZIP 121s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FB_SPACEY_ZIP 104s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_SPACEY_ZIP 186s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_SPACEY_ZIP 206s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_SPUR_M /\bSPUR-M\b/i describe FB_SPUR_M Phrase: SPUR-M ##score FB_SPUR_M 10.357 #counts FB_SPUR_M 2175s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_SPUR_M 23s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_SPUR_M 23s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_STAMINA_IN_BED /stamina in bed/i describe FB_STAMINA_IN_BED Phrase: stamina in bed. ##score FB_STAMINA_IN_BED 10.357 #counts FB_STAMINA_IN_BED 7s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FB_STAMINA_IN_BED 10s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_STAMINA_IN_BED 92s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_STAMINA_IN_BED 11s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_STOCK_EXPLODE /st[0o]ck\b.{4,10}expl[o0]de/i describe FB_STOCK_EXPLODE Looks like stocks exploding. ##score FB_STOCK_EXPLODE 10.357 #counts FB_STOCK_EXPLODE 36s/0h of 40695 corpus (35393s/5302h MY) 12/13/05 #counts FB_STOCK_EXPLODE 105s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_STOCK_EXPLODE 87s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_STOCK_EXPLODE 407s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_STOCK_EXPLODE 87s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_STOP_EMAILING /Stop e-?mailing me/i describe FB_STOP_EMAILING Phrase stop e-mailing me ##score FB_STOP_EMAILING 4.133 #counts FB_STOP_EMAILING 15s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 #counts FB_STOP_EMAILING 28s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 #counts FB_STOP_EMAILING 202s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_STOP_EMAILING 305s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_STREAM_OF /Watch the stream of (?:potential\s?)? customers/i describe FB_STREAM_OF Phrase: Watch the stream of customers ##score FB_STREAM_OF 10.357 #counts FB_STREAM_OF 32s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 #counts FB_STREAM_OF 36s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_STREAM_OF 43s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_STRONGER_EJ /stronger ejaculation/ describe FB_STRONGER_EJ Phrase: stronger ejaculation ##score FB_STRONGER_EJ 10.357 #counts FB_STRONGER_EJ 4s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FB_STRONGER_EJ 185s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_STRONGER_EJ 280s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_STRONGER_EJ 187s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_SUPERBREWARD /\bSuperb\s?Rewards\b/i describe FB_SUPERBREWARD Phrase: Superb Rewards ##score FB_SUPERBREWARD 10.357 #counts FB_SUPERBREWARD 216s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_SUPERBREWARD 4s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_SUPERBREWARD 4s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_SYMBLO /\bSymblo\b/i describe FB_SYMBLO Mis-spelled symbol. ##score FB_SYMBLO 10.357 #counts FB_SYMBLO 1s/0h of 24696 corpus (15673s/9023h FVGT) 11/01/06 #counts FB_SYMBLO 1s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 #counts FB_SYMBLO 3s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 #counts FB_SYMBLO 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_THIS_ADVERT /this advertiser/i describe FB_THIS_ADVERT Phrase: this advertiser ##score FB_THIS_ADVERT 5.172 #counts FB_THIS_ADVERT 138s/1h of 27454 corpus (21820s/5634h MY) 02/28/06 #counts FB_THIS_ADVERT 204s/0h of 27348 corpus (19451s/7897h FT) 02/28/06 #counts FB_THIS_ADVERT 477s/0h of 101690 corpus (62275s/39415h DOC) 02/28/06 #counts FB_THIS_ADVERT 532s/0h of 107818 corpus (99658s/8160h FVGT) 03/11/06 #counts FB_THIS_ADVERT 84s/0h of 25362 corpus (16336s/9026h FVGT) 11/04/06 #counts FB_THIS_ADVERT 301s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_THIS_ADVERT 656s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_THOUS_PERSONAL /thousand personal/i describe FB_THOUS_PERSONAL Phrase: thousand personal ##score FB_THOUS_PERSONAL 10.357 #counts FB_THOUS_PERSONAL 954s/0h of 34977 corpus (27086s/7891h FT) 03/01/06 #counts FB_THOUS_PERSONAL 604s/0h of 103116 corpus (63731s/39385h DOC) 03/01/06 #counts FB_THOUS_PERSONAL 76s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_THOUS_PERSONAL 76s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_TIRED_OF_YOUR /Tired of your/i describe FB_TIRED_OF_YOUR Phrase: Tired of your ##score FB_TIRED_OF_YOUR 10.357 #counts FB_TIRED_OF_YOUR 55s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 #counts FB_TIRED_OF_YOUR 227s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_TIRED_OF_YOUR 188s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 #counts FB_TIRED_OF_YOUR 71s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_TIRED_OF_YOUR 90s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #To stop further distribution #To longer get distribution #To stop receiving announcements #To stop announcements body FB_TO_STOP_DISTRO /To (?:(?:stop further|longer get) distribution|stop (?:receiving )?announcements)/i describe FB_TO_STOP_DISTRO Phrase: to stop further distribution ##score FB_TO_STOP_DISTRO 10.222 #counts FB_TO_STOP_DISTRO 19s/0h of 25733 corpus (16658s/9075h FVGT) 11/08/06 #counts FB_TO_STOP_DISTRO 25s/0h of 26801 corpus (17723s/9078h FVGT) 11/09/06 #counts FB_TO_STOP_DISTRO 75s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_TO_STOP_DISTRO 100s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_UGGS_NOW /Uggs Now/i describe FB_UGGS_NOW Phrase: uggs now ##score FB_UGGS_NOW 10.357 #counts FB_UGGS_NOW 2s/0h of 24567 corpus (15543s/9024h FVGT) 10/31/06 #counts FB_UGGS_NOW 10s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 #counts FB_UGGS_NOW 28s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_UGGS_NOW 62s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_ULTRA_ALLURE /Ultra Allure/i describe FB_ULTRA_ALLURE Phrase: Ultra Allure ##score FB_ULTRA_ALLURE 10.357 #counts FB_ULTRA_ALLURE 39s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 #counts FB_ULTRA_ALLURE 6s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_ULTRA_ALLURE 33s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_ULTRA_ALLURE 12s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_UNLOCK_YOUR_G /lock ?(?:to ?)? your girlfriend/i describe FB_UNLOCK_YOUR_G Phrase: lock to your girlfriend ##score FB_UNLOCK_YOUR_G 10.357 #counts FB_UNLOCK_YOUR_G 9s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 #counts FB_UNLOCK_YOUR_G 23s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_UNLOCK_YOUR_G 225s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_UNLOCK_YOUR_G 54s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_UNLOCK_YOUR_G 100s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_UNRESOLV_PROV /\{PROV_\d_\d\}/ describe FB_UNRESOLV_PROV Pattern Replacement PROV_D ##score FB_UNRESOLV_PROV 10.357 #counts FB_UNRESOLV_PROV 3s/0h of 25733 corpus (16658s/9075h FVGT) 11/08/06 #counts FB_UNRESOLV_PROV 3s/0h of 26801 corpus (17723s/9078h FVGT) 11/09/06 #counts FB_UNRESOLV_PROV 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_V_SPACE_GRA m'(?:V|\\/).{2,5} G R A [a-z]' describe FB_V_SPACE_GRA Looks like Viagra? ##score FB_V_SPACE_GRA 10.357 #counts FB_V_SPACE_GRA 31s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FB_V_SPACE_GRA 31s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_V_SPACE_GRA 31s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_VERIFY_ZIP /verify your zipcode/i describe FB_VERIFY_ZIP Phrase: verify your zipcode ##score FB_VERIFY_ZIP 4.897 #counts FB_VERIFY_ZIP 94s/0h of 22976 corpus (17263s/5713h MY) 03/17/06 #counts FB_VERIFY_ZIP 65s/0h of 103688 corpus (96287s/7401h FVGT) 03/17/06 #counts FB_VERIFY_ZIP 18s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_VERIFY_ZIP 35s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_VERIFY_ZIP 58s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_WHILECONNECTED /while connected to the internet/i describe FB_WHILECONNECTED Phrase: white connected to the internet ##score FB_WHILECONNECTED 10.357 #counts FB_WHILECONNECTED 1s/0h of 34935 corpus (26998s/7937h FT) 03/02/06 #counts FB_WHILECONNECTED 6s/0h of 107818 corpus (99658s/8160h FVGT) 03/11/06 #counts FB_WHILECONNECTED 151s/0h of 102872 corpus (63496s/39376h DOC) 03/02/06 #counts FB_WHILECONNECTED 1s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_WHILECONNECTED 156s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_WHITEGOLD /white gold sound good/ describe FB_WHITEGOLD Phrase: white gold sound good ##score FB_WHITEGOLD 10.357 #counts FB_WHITEGOLD 7s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FB_WHITEGOLD 8s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_WHITEGOLD 344s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_WHITEGOLD 8s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_WITHOUT_INCRE /without increasing your/i describe FB_WITHOUT_INCRE Phrase: without increasing your ##score FB_WITHOUT_INCRE 1.193 #counts FB_WITHOUT_INCRE 1s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FB_WITHOUT_INCRE 1s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_WITHOUT_INCRE 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_WITHOUT_PRESC /without a prescript/i describe FB_WITHOUT_PRESC Phrase: without a prescription. ##score FB_WITHOUT_PRESC 3.498 #counts FB_WITHOUT_PRESC 2s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 #counts FB_WITHOUT_PRESC 43s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_WITHOUT_PRESC 8s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_WITHOUT_PRESC 19s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_WORD1_END_DOLLAR / [a-z013]{3,6}\$ /i describe FB_WORD1_END_DOLLAR Looks like a word ending with a $ ##score FB_WORD1_END_DOLLAR 1.294 #FP Reports #counts FB_WORD1_END_DOLLAR 1569s/0h of 345244 corpus (337372s/7872h FT) 02/07/06 #counts FB_WORD1_END_DOLLAR 2820s/0h of 107818 corpus (99658s/8160h FVGT) 03/11/06 #counts FB_WORD1_END_DOLLAR 16s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FB_WORD1_END_DOLLAR 18s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_WORD2_END_DOLLAR /\b[a-z013]{3,6}\$ /i describe FB_WORD2_END_DOLLAR Looks like a word ending with a $ (2) ##score FB_WORD2_END_DOLLAR 1.294 #FP Reports #counts FB_WORD2_END_DOLLAR 1796s/0h of 345244 corpus (337372s/7872h FT) 02/07/06 #counts FB_WORD2_END_DOLLAR 3082s/0h of 107818 corpus (99658s/8160h FVGT) 03/11/06 #counts FB_WORD2_END_DOLLAR 21s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 #counts FB_WORD2_END_DOLLAR 24s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_YOU_CAN_BECOME /you can become/i describe FB_YOU_CAN_BECOME Phrase: you can become ##score FB_YOU_CAN_BECOME 1.258 #counts FB_YOU_CAN_BECOME 84s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_YOU_CAN_BECOME 14s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 #counts FB_YOU_CAN_BECOME 15s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_YOU_LOVE /You love can/i describe FB_YOU_LOVE Phrase: you love can ##score FB_YOU_LOVE 4.292 #counts FB_YOU_LOVE 8s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 #counts FB_YOU_LOVE 14s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 #counts FB_YOU_LOVE 250s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_YOU_LOVE 26s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_YOU_LOVE 29s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_YOU_LOVE 41s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_YOUR_MED /your med\b/ describe FB_YOUR_MED Phrase: your med ##score FB_YOUR_MED 10.357 #counts FB_YOUR_MED 13s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FB_YOUR_MED 1s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_YOUR_MED 10s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FB_YOUR_MED 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_YOUR_REFI /Your refi/i describe FB_YOUR_REFI Phrase: Your refi ##score FB_YOUR_REFI 0.333 #counts FB_YOUR_REFI 44s/0h of 35751 corpus (26053s/9698h FVGT) 11/18/06 #counts FB_YOUR_REFI 51s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_YOUR_MORTGAGE /your mortgage/i describe FB_YOUR_MORTGAGE Phrase: Your Mortgage ##score FB_YOUR_MORTGAGE 2.128 #counts FB_YOUR_MORTGAGE 1589s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FB_YOUR_MORTGAGE 67s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 #counts FB_YOUR_MORTGAGE 104s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_YOUR_PC_ERROR /your PC has error/i describe FB_YOUR_PC_ERROR Phrase: your pc has error ##score FB_YOUR_PC_ERROR 10.357 #counts FB_YOUR_PC_ERROR 2s/0h of 43642 corpus (34621s/9021h FVGT) 10/26/06 #counts FB_YOUR_PC_ERROR 25s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_YOUR_PC_ERROR 58s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FB_YOUR_PC_ERROR 166s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_YOUR_REFILL /your refill/i describe FB_YOUR_REFILL Phrase: your refill ##score FB_YOUR_REFILL 3.157 #counts FB_YOUR_REFILL 58s/0h of 345244 corpus (337372s/7872h FT) 02/07/06 #counts FB_YOUR_REFILL 40s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_YOUR_REFILL 139s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_YOUR_REFILL 40s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_YOUR_WEIGHT /about your weight/i describe FB_YOUR_WEIGHT Phrase: about your weight ##score FB_YOUR_WEIGHT 3.531 #counts FB_YOUR_WEIGHT 1s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 #counts FB_YOUR_WEIGHT 15s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 #counts FB_YOUR_WEIGHT 29s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_YOUR_WEIGHT 48s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_YOUR_WOMAN /your woman will be/ describe FB_YOUR_WOMAN Phrase: Your woman will be ##score FB_YOUR_WOMAN 10.357 #counts FB_YOUR_WOMAN 2s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FB_YOUR_WOMAN 36s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FB_YOUR_WOMAN 193s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FB_YOUR_WOMAN 296s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 #counts FB_YOUR_WOMAN 42s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_YOURSELF_MASTER /yourself master/i describe FB_YOURSELF_MASTER Phrase: yourself master ##score FB_YOURSELF_MASTER 10.357 #counts FB_YOURSELF_MASTER 954s/0h of 34977 corpus (27086s/7891h FT) 03/01/06 #counts FB_YOURSELF_MASTER 3420s/0h of 107818 corpus (99658s/8160h FVGT) 03/11/06 #counts FB_YOURSELF_MASTER 76s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FB_YOURSELF_MASTER 76s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FB_YOUTH_THIS /YOUTH is BACK!/ describe FB_YOUTH_THIS Phrase: Youth is Back! ##score FB_YOUTH_THIS 10.357 #counts FB_YOUTH_THIS 155s/0h of 35267 corpus (25646s/9621h FVGT) 11/17/06 #counts FB_YOUTH_THIS 157s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #========= Header Rules ============== # Seen 1980 used in current spam. header FH_DATE_IS_19XX Date =~ /19[789][0-9]/ [if-unset: 2006] describe FH_DATE_IS_19XX The date is not 19xx. ##score FH_DATE_IS_19XX 10.357 #counts FH_DATE_IS_19XX 36s/0h of 103219 corpus (95719s/7500h FVGT) 03/21/06 #counts FH_DATE_IS_19XX 12s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FH_DATE_IS_19XX 172s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FH_DATE_IS_19XX 12s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # Date: Tue, 19 Jan 2038 11:14:07 +0800 # This exact date is VERY COMMON! #header FH_DATE_PAST_20XX Date =~ /20[2-9][0-9]/ [if-unset: 2006] #describe FH_DATE_PAST_20XX The date is grossly in the future. ##score FH_DATE_PAST_20XX 10.357 #counts FH_DATE_PAST_20XX 207s/0h of 103219 corpus (95719s/7500h FVGT) 03/21/06 #counts FH_DATE_PAST_20XX 290s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FH_DATE_PAST_20XX 393s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FH_DATE_PAST_20XX 298s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_FAKE_RCVD_LINE Received =~ /from\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s*by\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3};\s*[SMTWF].{2},\s*\d{1,2}\s*[JFMASOND].{2,5}\s*\d{4}\s*\d{2}:\d{2}:\d{2}\s*[-+]\d{4}/ describe FH_FAKE_RCVD_LINE RCVD line looks faked (A) ##score FH_FAKE_RCVD_LINE 10.357 #counts FH_FAKE_RCVD_LINE 428s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FH_FAKE_RCVD_LINE 437s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FH_FAKE_RCVD_LINE 437s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_FAKE_RCVD_LINE_B Received =~ /from\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s*by\s*[a-z0-9.]{4,24}\.[a-z0-9.]{4,36}\.(?:com|net|org|biz);\s*[SMTWF].{2},\s*\d{1,2}\s*[JFMASOND].{2,5}\s*\d{4}\s*\d{2}:\d{2}:\d{2}\s*[-+]\d{4}/i describe FH_FAKE_RCVD_LINE_B RCVD line looks faked (B) ##score FH_FAKE_RCVD_LINE_B 5.777 #counts FH_FAKE_RCVD_LINE_B 7s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FH_FAKE_RCVD_LINE_B 28s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FH_FAKE_RCVD_LINE_B 1s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 #counts FH_FAKE_RCVD_LINE_B 7s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_FROM_CASH From:name =~ /\bcash\b/i describe FH_FROM_CASH From name has "cash" ##score FH_FROM_CASH 1.882 #counts FH_FROM_CASH 54s/0h of 27454 corpus (21820s/5634h MY) 02/28/06 #counts FH_FROM_CASH 4s/0h of 12254 corpus (6582s/5672h CT) 02/28/06 #counts FH_FROM_CASH 91s/0h of 27348 corpus (19451s/7897h FT) 02/28/06 #counts FH_FROM_CASH 88s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FH_FROM_CASH 113s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_FROMEML_NOTLD From:addr !~ /\./ [if-unset: foo@bar.com] describe FH_FROMEML_NOTLD E-mail address doesn't have TLD (.com, etc.) ##score FH_FROMEML_NOTLD 2.268 #counts FH_FROMEML_NOTLD 104s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 #counts FH_FROMEML_NOTLD 106s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FH_FROMEML_NOTLD 107s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_FROM_RND_1 From =~ /%(?:from|RND_)/ describe FH_FROM_RND_1 From has pattern replacement broken. ##score FH_FROM_RND_1 10.357 #counts FH_FROM_RND_1 255s/0h of 103059 corpus (95661s/7398h FVGT) 03/20/06 #counts FH_FROM_RND_1 76s/0h of 25009 corpus (15987s/9022h FVGT) 11/03/06 #counts FH_FROM_RND_1 76s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_FROM_GET_NAME From:name =~ /\bGet\b/i describe FH_FROM_GET_NAME From name says Get ##score FH_FROM_GET_NAME 2.598 #counts FH_FROM_GET_NAME 56s/0h of 25009 corpus (15987s/9022h FVGT) 11/03/06 #counts FH_FROM_GET_NAME 3s/0h of 9077 corpus (4464s/4613h AxB) 11/03/06 #counts FH_FROM_GET_NAME 110s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FH_FROM_GET_NAME 54s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 #counts FH_FROM_GET_NAME 93s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_FROM_GIVEAWAY From =~ /Giveaway/i describe FH_FROM_GIVEAWAY From name is giveaway. ##score FH_FROM_GIVEAWAY 2.269 #counts FH_FROM_GIVEAWAY 35s/0h of 27348 corpus (19451s/7897h FT) 02/28/06 #counts FH_FROM_GIVEAWAY 416s/0h of 101690 corpus (62275s/39415h DOC) 02/28/06 #counts FH_FROM_GIVEAWAY 2s/0h of 25009 corpus (15987s/9022h FVGT) 11/03/06 #counts FH_FROM_GIVEAWAY 26s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FH_FROM_GIVEAWAY 54s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_FROM_START_YOU From =~ /^You\b/i describe FH_FROM_START_YOU From starts with you. ##score FH_FROM_START_YOU 0.799 #counts FH_FROM_START_YOU 19s/0h of 70283 corpus (50296s/19987h ML) 03/20/06 #counts FH_FROM_START_YOU 1s/0h of 103059 corpus (95661s/7398h FVGT) 03/20/06 #counts FH_FROM_START_YOU 1s/0h of 25009 corpus (15987s/9022h FVGT) 11/03/06 #counts FH_FROM_START_YOU 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_HAS_UID exists:UID describe FH_HAS_UID Header UID found. ##score FH_HAS_UID 0.877 #counts FH_HAS_UID 31s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 #counts FH_HAS_UID 129s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_HELO_ALMOST_IP X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+[a-z][-.]\d{1,3}[-.]\d{1,3}[-.]\d{1,3}[-.][a-z][^ ]+ /i describe FH_HELO_ALMOST_IP Helo is almost an IP addr. ##score FH_HELO_ALMOST_IP 5.417 #counts FH_HELO_ALMOST_IP 82s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FH_HELO_ALMOST_IP 109s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_HELO_GMAILSMTP Received =~ /HELO gmail-smtp-in/ describe FH_HELO_GMAILSMTP Faked helo of gmail-smtp-in ##score FH_HELO_GMAILSMTP 10.357 #counts FH_HELO_GMAILSMTP 294s/0h of 34977 corpus (27086s/7891h FT) 03/01/06 #counts FH_HELO_GMAILSMTP 159s/0h of 103116 corpus (63731s/39385h DOC) 03/01/06 #counts FH_HELO_GMAILSMTP 1s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FH_HELO_GMAILSMTP 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_HELO_ENDS_DOT X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+\. by=/ describe FH_HELO_ENDS_DOT Helo ends with a dot. ##score FH_HELO_ENDS_DOT 10.993 #counts FH_HELO_ENDS_DOT 211s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FH_HELO_ENDS_DOT 28s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FH_HELO_ENDS_DOT 34s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FH_HELO_ENDS_DOT 57s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_HELO_EQ_610HEX X-Spam-Relays-External =~ /^[^\]]+ helo=-?[A-F0-9]{6,10} / describe FH_HELO_EQ_610HEX Helo is 6-10 hex chr's. ##score FH_HELO_EQ_610HEX 10.599 #counts FH_HELO_EQ_610HEX 9235s/0h of 222450 corpus (214521s/7929h FVGT) 04/24/06 #counts FH_HELO_EQ_610HEX 459s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FH_HELO_EQ_610HEX 473s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FH_HELO_EQ_610HEX 520s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_HELO_EQ_CHARTER X-Spam-Relays-External =~ /^[^\]]+ helo=\d{2,3}-\d{1,3}-\d{1,3}-\d{1,3}.{5,20}\.charter\.com /i describe FH_HELO_EQ_CHARTER Helo is d-d-d-d charter.com ##score FH_HELO_EQ_CHARTER 2.175 #counts FH_HELO_EQ_CHARTER 280s/0h of 41722 corpus (34113s/7609h FVGT) 03/27/06 #counts FH_HELO_EQ_CHARTER 130s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FH_HELO_EQ_CHARTER 174s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_HELO_EQ_D_D_D_D X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]{0,15}\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3}/ describe FH_HELO_EQ_D_D_D_D Helo is d-d-d-d ##score FH_HELO_EQ_D_D_D_D 1.397 #counts FH_HELO_EQ_D_D_D_D 2911s/1h of 41684 corpus (34086s/7598h FVGT) 03/27/06 #counts FH_HELO_EQ_D_D_D_D 1306s/1h of 33966 corpus (24401s/9565h FVGT) 11/16/06 #counts FH_HELO_EQ_D_D_D_D 1323s/1h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FH_HELO_EQ_D_D_D_D 1338s/1h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FH_HELO_EQ_D_D_D_D 1834s/1h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # redundant with RDNS_DYNAMIC, causing FPs: bug 5682 ## header FH_HOST_ALMOST_IP X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+[a-z][-.]\d{1,3}[-.]\d{1,3}[-.]\d{1,3}[-.][a-z][^ ]+ /i ## describe FH_HOST_ALMOST_IP The host almost looks like an IP addr. ## ##score FH_HOST_ALMOST_IP 1.889 ## #counts HOST_ALMOST_IP 117s/2h of 15656 corpus (7711s/7945h FT) 04/20/06 ## #counts HOST_ALMOST_IP 501s/2h of 42071 corpus (34145s/7926h FVGT) 04/20/06 ## #counts FH_HOST_ALMOST_IP 917s/2h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ## #counts FH_HOST_ALMOST_IP 952s/2h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ## #counts FH_HOST_ALMOST_IP 1283s/4h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # redundant with RDNS_DYNAMIC, causing FPs: bug 5682 # overlap spam: 90% of RDNS_DYNAMIC hits also hit FH_HOST_EQ_D_D_D_D; 84% of FH_HOST_EQ_D_D_D_D hits also hit RDNS_DYNAMIC ## header FH_HOST_EQ_D_D_D_D X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\d{1,3}[^0-9]\d{1,3}[^0-9]\d{1,3}[^0-9]\d{1,3}[^ ]+ / ## describe FH_HOST_EQ_D_D_D_D Host starts with d-d-d-d ## ##score FH_HOST_EQ_D_D_D_D 0.665 ## #counts HOST_EQ_D_D_D_D 10886s/231h of 41745 corpus (34134s/7611h FVGT) 03/29/06 ## #counts FH_HOST_EQ_D_D_D_D 8057s/308h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ## #counts FH_HOST_EQ_D_D_D_D 8340s/308h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ## #counts FH_HOST_EQ_D_D_D_D 11366s/308h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # now hits nothing in http://ruleqa.spamassassin.org/20071029-r589545-n ## header FH_HOST_EQ_D_D_D_DB X-Spam-Relays-External =~ /^[^\]]+ rdns=\d{1,3}[^0-9]\d{1,3}[^0-9]\d{1,3}[^0-9]\d{1,3}[^ ]+ / ## describe FH_HOST_EQ_D_D_D_DB Host is d-d-d-d ## ##score FH_HOST_EQ_D_D_D_DB 0.688 ## #counts HOST_EQ_D_D_D_DB 4324s/71h of 42070 corpus (34144s/7926h FVGT) 04/19/06 ## #counts FH_HOST_EQ_D_D_D_DB 2893s/107h of 33966 corpus (24401s/9565h FVGT) 11/16/06 ## #counts FH_HOST_EQ_D_D_D_DB 2989s/107h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ## #counts FH_HOST_EQ_D_D_D_DB 3087s/107h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ## #counts FH_HOST_EQ_D_D_D_DB 4217s/107h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_HOST_EQ_DYNAMICIP X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]{0,25}[dD][yY][nN][aA][mM][iI][cC][iI][pP][^ ]{5,25} helo=/ describe FH_HOST_EQ_DYNAMICIP Host is dynamicip ##score FH_HOST_EQ_DYNAMICIP 2.177 #counts FH_HOST_EQ_DYNAMICIP 211s/0h of 41665 corpus (34068s/7597h FVGT) 03/25/06 #counts FH_HOST_EQ_DYNAMICIP 613s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FH_HOST_EQ_DYNAMICIP 639s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FH_HOST_EQ_DYNAMICIP 832s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_HOST_EQ_PACBELL_D X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.dsl\.\w{2,10}\.pacbell\.net / describe FH_HOST_EQ_PACBELL_D Host is pacbell.net dsl ##score FH_HOST_EQ_PACBELL_D 3.944 #counts FH_HOST_EQ_PACBELL_D 232s/0h of 41722 corpus (34113s/7609h FVGT) 03/27/06 #counts FH_HOST_EQ_PACBELL_D 49s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FH_HOST_EQ_PACBELL_D 53s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_HOST_EQ_SPRINT_H X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.dhcp\.sprint-hsd\.net / describe FH_HOST_EQ_SPRINT_H Host is dhcp sprint-hsd.net ##score FH_HOST_EQ_SPRINT_H 2.293 #counts FH_HOST_EQ_SPRINT_H 44s/0h of 41789 corpus (34114s/7675h FVGT) 04/06/06 #counts FH_HOST_EQ_SPRINT_H 1s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FH_HOST_EQ_SPRINT_H 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_HOST_EQ_VERIZON_P X-Spam-Relays-External =~ /^[^\]]+ rdns=pool-\d.{5,30}\.verizon\.net/ describe FH_HOST_EQ_VERIZON_P Host is pool-.+verizon.net ##score FH_HOST_EQ_VERIZON_P 2.144 #counts FH_HOST_EQ_VERIZON_P 1393s/0h of 41686 corpus (34078s/7608h FVGT) 03/27/06 #counts FH_HOST_EQ_VERIZON_P 436s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FH_HOST_EQ_VERIZON_P 441s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FH_HOST_EQ_VERIZON_P 518s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_MSGID_XXX MESSAGEID =~ /\@xxx/i describe FH_MSGID_XXX Message-Id = @xxx ##score FH_MSGID_XXX 10.357 #counts FH_MSGID_XXX 10s/0h of 50422 corpus (42421s/8001h FVGT) 03/07/06 #counts FH_MSGID_XXX 6s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 #counts FH_MSGID_XXX 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #from barometer baptistery by header FH_RCVD_FROM_2_WDS Received =~ /from \w+ \w+ by/i describe FH_RCVD_FROM_2_WDS RCVD line has 2 words after from. ##score FH_RCVD_FROM_2_WDS 10.357 #counts FH_RCVD_FROM_2_WDS 9s/0h of 24696 corpus (15673s/9023h FVGT) 11/01/06 #counts FH_RCVD_FROM_2_WDS 141s/0h of 25311 corpus (18683s/6628h CT) 11/03/06 #counts FH_RCVD_FROM_2_WDS 727s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FH_RCVD_FROM_2_WDS 94s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FH_RCVD_FROM_2_WDS 124s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FH_RCVD_FROM_2_WDS 256s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_RCVD_HELODATE Received =~ /from \[(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)/ describe FH_RCVD_HELODATE The HELO Looks like a date? ##score FH_RCVD_HELODATE 10.357 #counts FH_RCVD_HELODATE 10s/0h of 42141 corpus (34216s/7925h FVGT) 04/25/06 #counts FH_RCVD_HELODATE 1s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FH_RCVD_HELODATE 172s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FH_RCVD_HELODATE 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_RE_NEW_DDD Subject =~ /^Re: new\s?\d{0,3}$/i describe FH_RE_NEW_DDD Subject is Re: new \d\d\d ##score FH_RE_NEW_DDD 10.357 #counts FH_RE_NEW_DDD 266s/0h of 26801 corpus (17723s/9078h FVGT) 11/09/06 #counts FH_RE_NEW_DDD 792s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FH_RE_NEW_DDD 1317s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # Feb 7 2007 jm: replaced with RDNS_NONE! # header FH_RELAY_NODNS X-Spam-Relays-External =~ /^[^\]]+rdns= helo=/ # describe FH_RELAY_NODNS We could not determine your Reverse DNS ##score FH_RELAY_NODNS 1.451 #Prone to FPs. #counts FH_RELAY_NODNS 12654s/99h of 41713 corpus (34082s/7631h FVGT) 04/03/06 #counts FH_RELAY_NODNS 85775s/103h of 222960 corpus (215032s/7928h FVGT) 04/22/06 #counts FH_RELAY_NODNS 6020s/115h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FH_RELAY_NODNS 6293s/116h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FH_RELAY_NODNS 6424s/116h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FH_RELAY_NODNS 8455s/120h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_SPOOF_NAMES ALL =~ /\$names\@/i describe FH_SPOOF_NAMES Pattern Replacement Failure ##score FH_SPOOF_NAMES 10.357 #counts FH_SPOOF_NAMES 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FH_SPOOF_NAMES 0s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FH_SPOOF_NAMES 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_USER_MOZILLA_SMAL user-agent =~ /mozilla/ describe FH_USER_MOZILLA_SMAL Specific signs of ratware ##score FH_USER_MOZILLA_SMAL 10.357 #counts FH_USER_MOZILLA_SMAL 11s/0h of 26801 corpus (17723s/9078h FVGT) 11/09/06 #counts FH_USER_MOZILLA_SMAL 90s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FH_USER_MOZILLA_SMAL 221s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_VIRUS_NORTON X-Virus-Status =~ /Scanned by norton/ describe FH_VIRUS_NORTON Does Norton really not have caps? ##score FH_VIRUS_NORTON 10.357 #counts FH_VIRUS_NORTON 10s/0h of 50422 corpus (42421s/8001h FVGT) 03/07/06 #counts FH_VIRUS_NORTON 130s/0h of 89519 corpus (71646s/17873h ML) 03/07/06 #counts FH_VIRUS_NORTON 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FH_VIRUS_NORTON 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FH_XCOMMENT_GIBBER X-Comment =~ /[a-z]{15}/i describe FH_XCOMMENT_GIBBER X-Comment is gibberish ##score FH_XCOMMENT_GIBBER 5.382 #counts FH_XCOMMENT_GIBBER 6s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 #counts FH_XCOMMENT_GIBBER 8s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FH_XCOMMENT_GIBBER 10s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FH_XCOMMENT_GIBBER 17s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #========= Rawbody Rules ============== rawbody FR_3TAG_3TAG m'<[abcefghijklmnoqstuvwxz]{3}>'i describe FR_3TAG_3TAG Looks like 3 small tags. ##score FR_3TAG_3TAG 1.758 #counts FR_3TAG_3TAG 927s/0h of 40929 corpus (31147s/9782h ML) 12/26/05 #counts FR_3TAG_3TAG 333s/0h of 17415 corpus (9736s/7679h FT) 01/03/06 #counts FR_3TAG_3TAG 808s/0h of 77837 corpus (38456s/39381h DOC) 01/03/06 #counts FR_3TAG_3TAG 46s/0h of 25358 corpus (16335s/9023h FVGT) 11/04/06 #counts FR_3TAG_3TAG 47s/1h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FR_3TAG_3TAG 48s/1h of 47019 corpus (37183s/9836h FVGT) 12/23/06 rawbody FR_ALMOST_VIAG2 /[^a-z](?!viagra)v?ia.?g.?ra/i describe FR_ALMOST_VIAG2 Almost looks like viagra. ##score FR_ALMOST_VIAG2 10.357 #counts FR_ALMOST_VIAG2 23s/0h of 17368 corpus (9729s/7639h FT) 01/02/06 #counts FR_ALMOST_VIAG2 132s/0h of 77273 corpus (37963s/39310h DOC) 01/02/06 #counts FR_ALMOST_VIAG2 65s/0h of 25358 corpus (16335s/9023h FVGT) 11/04/06 #counts FR_ALMOST_VIAG2 96s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FR_ALMOST_VIAG2 151s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 rawbody FR_CANTSEETEXT /class="?cantseetext/i describe FR_CANTSEETEXT Phrase class=cantseetext ##score FR_CANTSEETEXT 10.357 #counts FR_CANTSEETEXT 29s/0h of 17368 corpus (9729s/7639h FT) 01/02/06 #counts FR_CANTSEETEXT 289s/0h of 77837 corpus (38456s/39381h DOC) 01/03/06 #counts FR_CANTSEETEXT 2s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FR_CANTSEETEXT 86s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FR_CANTSEETEXT 4s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FR_CANTSEETEXT 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 rawbody FR_COMMENT_ODD /<-\*->/ describe FR_COMMENT_ODD Strange HTML comment. ##score FR_COMMENT_ODD 10.357 #counts FR_COMMENT_ODD 130s/0h of 22940 corpus (17232s/5708h MY) 04/25/06 #counts FR_COMMENT_ODD 397s/0h of 42141 corpus (34216s/7925h FVGT) 04/25/06 #counts FR_COMMENT_ODD 468s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FR_COMMENT_ODD 511s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 rawbody FR_DIV_DRUGS_3 m'(?:]{0,20}> (?: )?[a-z0-9$] (?: )? ){3}'i describe FR_DIV_DRUGS_3 Looks like many div's in drug spam. ##score FR_DIV_DRUGS_3 3.799 #counts FR_DIV_DRUGS_3 15s/0h of 34977 corpus (27086s/7891h FT) 03/01/06 #counts FR_DIV_DRUGS_3 366s/0h of 84470 corpus (67306s/17164h ML) 03/01/06 #counts FR_DIV_DRUGS_3 5s/0h of 25358 corpus (16335s/9023h FVGT) 11/04/06 #counts FR_DIV_DRUGS_3 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 rawbody FR_DOT_FEVER_5 /(?:[a-z ']{2,35}\s[.,]\s){5}/ describe FR_DOT_FEVER_5 Lots of dots inbetween letters. ##score FR_DOT_FEVER_5 3.9 #counts FR_DOT_FEVER_5 0s/0h of 17415 corpus (9736s/7679h FT) 01/03/06 #counts FR_DOT_FEVER_5 1s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 #counts FR_DOT_FEVER_5 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 rawbody FR_IMPORT_CSS /\@import url\(/i describe FR_IMPORT_CSS Special @import url css ##score FR_IMPORT_CSS 1.889 #counts FR_IMPORT_CSS 1s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 #counts FR_IMPORT_CSS 9s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 #counts FR_IMPORT_CSS 25s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 rawbody FR_M_E_D_S /M E D S/i describe FR_M_E_D_S Spaced out M E D S ##score FR_M_E_D_S 10.357 #counts FR_M_E_D_S 182s/0h of 82118 corpus (57948s/24170h ML) 04/03/06 #counts FR_M_E_D_S 24s/0h of 41810 corpus (34135s/7675h FVGT) 04/03/06 #counts FR_M_E_D_S 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FR_M_E_D_S 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 rawbody FR_MIDER m'http[^ ]{5,30}/gall?/' describe FR_MIDER Sign often seen in spams ##score FR_MIDER 10.357 #counts FR_MIDER 3s/0h of 5479 corpus (1297s/4182h AxB) 09/25/06 #counts FR_MIDER 366s/0h of 21635 corpus (15142s/6493h CT) 09/25/06 #counts FR_MIDER 730s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 #counts FR_MIDER 761s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FR_MIDER 788s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 rawbody FR_P_END_P_MANY10 m'(?:

){10}'i describe FR_P_END_P_MANY10 Many

(10) ##score FR_P_END_P_MANY10 10.539 #counts FR_P_END_P_MANY10 3s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 #counts FR_P_END_P_MANY10 10s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FR_P_END_P_MANY10 66s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FR_P_END_P_MANY10 21s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 rawbody FR_PORN_NOT_URL /\b,(?:hVX|WeQ|VSd|WeQ)\b/ describe FR_PORN_NOT_URL Looks like a porn url seen before. ##score FR_PORN_NOT_URL 10.357 #counts FR_PORN_NOT_URL 155s/0h of 34977 corpus (27086s/7891h FT) 03/01/06 #counts FR_PORN_NOT_URL 174s/0h of 84470 corpus (67306s/17164h ML) 03/01/06 #counts FR_PORN_NOT_URL 9s/0h of 25358 corpus (16335s/9023h FVGT) 11/04/06 #counts FR_PORN_NOT_URL 15s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 rawbody FR_TEST_BASE64_BAD /[a-z0-9]{70}
/i describe FR_TEST_BASE64_BAD Looks like bad BASE64 with
at end. ##score FR_TEST_BASE64_BAD 3.189 #counts FR_TEST_BASE64_BAD 150s/0h of 27452 corpus (21819s/5633h MY) 03/03/06 #counts FR_TEST_BASE64_BAD 6s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FR_TEST_BASE64_BAD 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 rawbody FR_TITLE_CONS_6 m'.{0,4}[bcdfgjklmnpqrstvwxyz]{6}.{0,25}'i describe FR_TITLE_CONS_6 Title Attribute has 6 non-vowels. ##score FR_TITLE_CONS_6 0.865 #counts FR_TITLE_CONS_6 3s/0h of 103688 corpus (96287s/7401h FVGT) 03/17/06 #counts FR_TITLE_CONS_6 33s/0h of 108996 corpus (71372s/37624h DOC) 03/17/06 #counts FR_TITLE_CONS_6 1s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FR_TITLE_CONS_6 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 rawbody FR_TITLE_NUMS m'\d+'i describe FR_TITLE_NUMS HTML Title is only numbers ##score FR_TITLE_NUMS 10.357 #counts FR_TITLE_NUMS 23s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 #counts FR_TITLE_NUMS 19s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FR_TITLE_NUMS 228s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FR_TITLE_NUMS 200s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FR_TITLE_NUMS 263s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #========== Subject Rules ================= header FS_ABIGGER Subject =~ /a bigger/i describe FS_ABIGGER Subject has "a bigger" ##score FS_ABIGGER 2.399 #counts FS_ABIGGER 8s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 #counts FS_ABIGGER 10s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 #counts FS_ABIGGER 12s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_APPROVE_YOU Subject =~ /approve you/i describe FS_APPROVE_YOU Subject says approve you ##score FS_APPROVE_YOU 2.973 #counts FS_APPROVE_YOU 7s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FS_APPROVE_YOU 1s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FS_APPROVE_YOU 66s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FS_APPROVE_YOU 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_AT_NO_COST Subject =~ /\bat no cost/i describe FS_AT_NO_COST Subject says "At No Cost" ##score FS_AT_NO_COST 2.489 #counts FS_AT_NO_COST 47s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 #counts FS_AT_NO_COST 60s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FS_AT_NO_COST 24s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_AT_NO_COST 57s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #attract more customers header FS_ATTRACT_CUST Subject =~ /Attract (?:\w{2,8}\s)?customer/i describe FS_ATTRACT_CUST Subject says Attract something customer ##score FS_ATTRACT_CUST 0.889 #counts FS_ATTRACT_CUST 1s/0h of 50733 corpus (42740s/7993h FVGT) 03/06/06 #counts FS_ATTRACT_CUST 3s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 #counts FS_ATTRACT_CUST 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_BROKEN_MEETING Subject =~ /(?!meeting)m.{0,1}e.{0,1}e.{0,1}t.{0,1}i.{0,1}n.{0,1}g/i describe FS_BROKEN_MEETING Subject looks like meeting but broken. ##score FS_BROKEN_MEETING 10.357 #counts FS_BROKEN_MEETING 3s/0h of 24999 corpus (15974s/9025h FVGT) 11/02/06 #counts FS_BROKEN_MEETING 31s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FS_BROKEN_MEETING 6s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_BROKEN_MEETING 8s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_CHEAP_CAP Subject =~ /CHEAP/ describe FS_CHEAP_CAP Phrase: Cheap in Caps in Subject. ##score FS_CHEAP_CAP 2.522 #counts FS_CHEAP_CAP 6s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 #counts FS_CHEAP_CAP 7s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_CHEAP_CAP 8s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_CAILIS Subject =~ /cailis/i describe FS_CAILIS Subject says cailis ##score FS_CAILIS 10.357 #counts FS_CAILIS 13s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 #counts FS_CAILIS 0s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_CAILIS 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_CLAIM_NOW Subject =~ /Claim Now/i describe FS_CLAIM_NOW Subject says "Claim now" ##score FS_CLAIM_NOW 1.975 #counts FS_CLAIM_NOW 11s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 #counts FS_CLAIM_NOW 1s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FS_CLAIM_NOW 12s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FS_CLAIM_NOW 21s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_COSTARICA Subject =~ /costa rica/i describe FS_COSTARICA Subject says Costa Rica ##score FS_COSTARICA 2.899 #counts FS_COSTARICA 11s/0h of 27348 corpus (19456s/7892h FT) 02/27/06 #counts FS_COSTARICA 64s/0h of 101278 corpus (61900s/39378h DOC) 02/27/06 #counts FS_COSTARICA 1s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 #counts FS_COSTARICA 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_CUTE_TEEN Subject =~ /cute teen/i describe FS_CUTE_TEEN Subject says cute teen ##score FS_CUTE_TEEN 2.964 #counts FS_CUTE_TEEN 211s/0h of 103219 corpus (95719s/7500h FVGT) 03/21/06 #counts FS_CUTE_TEEN 1s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FS_CUTE_TEEN 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_DOLLAR_BONUS Subject =~ /\$\d\d\d?\.?\d?\d? bonus/i describe FS_DOLLAR_BONUS Subject talks about money bonus! ##score FS_DOLLAR_BONUS 10.357 #counts FS_DOLLAR_BONUS 27s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 #counts FS_DOLLAR_BONUS 1s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FS_DOLLAR_BONUS 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_EJACULA Subject =~ /ejaculat(?:[io01][o0i1]n|e)/i describe FS_EJACULA Phrase: ejaculation in subject. ##score FS_EJACULA 10.357 #counts FS_EJACULA 328s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 #counts FS_EJACULA 166s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_EJACULA 168s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FS_EJACULA 190s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_END_BILLS Subject =~ /bills\s?$/i describe FS_END_BILLS Subject ends with bills. ##score FS_END_BILLS 1.555 #counts FS_END_BILLS 1s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 #counts FS_END_BILLS 16s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FS_END_BILLS 2s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_END_BILLS 4s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_ERECTION Subject =~ / erection /i describe FS_ERECTION Phrase: erection in subject. ##score FS_ERECTION 10.579 #counts FS_ERECTION 90s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 #counts FS_ERECTION 3s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FS_ERECTION 81s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FS_ERECTION 4s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_GANGBANG Subject =~ /gangbang/i describe FS_GANGBANG Phrase: subject says gangbang ##score FS_GANGBANG 10.357 #counts FS_GANGBANG 15s/0h of 17373 corpus (9742s/7631h FT) 12/28/05 #counts FS_GANGBANG 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FS_GANGBANG 25s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FS_GANGBANG 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_GET_LAID Subject =~ /get la[i1]d/i describe FS_GET_LAID Phrase: get laid in subj. ##score FS_GET_LAID 10.357 #counts FS_GET_LAID 5s/0h of 9789 corpus (4888s/4901h FT) 12/26/05 #counts FS_GET_LAID 3s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 #counts FS_GET_LAID 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_GIFT_CARD_OFF Subject =~ /Gift\s?Card\s?Offer/i describe FS_GIFT_CARD_OFF Subject says Gift card offer ##score FS_GIFT_CARD_OFF 3.374 #counts FS_GIFT_CARD_OFF 5s/0h of 15656 corpus (7711s/7945h FT) 04/20/06 #counts FS_GIFT_CARD_OFF 43s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_GIFT_CARD_OFF 102s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_HOT_TEEN Subject =~ /hot teen/i describe FS_HOT_TEEN Phrase: subject says "hot teen" ##score FS_HOT_TEEN 10.357 #counts FS_HOT_TEEN 138s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 #counts FS_HOT_TEEN 2s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 #counts FS_HOT_TEEN 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_HUGECOCK Subject =~ /(?:huge|tiny|small) (?:c[o0]ck|d[i1]ck|p[e3]n[1i]s)/i describe FS_HUGECOCK Phrase: Huge Cock ##score FS_HUGECOCK 10.357 #counts FS_HUGECOCK 36s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 #counts FS_HUGECOCK 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FS_HUGECOCK 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_LARGE_PERCENT2 Subject =~ /(?!100%)\d[0-9oi][0-9oi]%/i describe FS_LARGE_PERCENT2 Larger than 100% in subj. ##score FS_LARGE_PERCENT2 3.357 #counts FS_LARGE_PERCENT2 52s/0h of 33776 corpus (24217s/9559h FVGT) 11/15/06 #counts FS_LARGE_PERCENT2 52s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_LARGE_PERCENT2 64s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_LITTLE_PILL Subject =~ /little \w+ pill/i describe FS_LITTLE_PILL Phrase: little somthing pill. ##score FS_LITTLE_PILL 10.357 #counts FS_LITTLE_PILL 21s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 #counts FS_LITTLE_PILL 0s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 #counts FS_LITTLE_PILL 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_LOW_INTMOR Subject =~ /low.{1,6}(?:interest|mortgage)/i describe FS_LOW_INTMOR Subject says low interest or mortgage ##score FS_LOW_INTMOR 10.357 #counts FS_LOW_INTMOR 43s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 #counts FS_LOW_INTMOR 2s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FS_LOW_INTMOR 17s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FS_LOW_INTMOR 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_LOW_RATES Subject =~ / low rates/i describe FS_LOW_RATES Subject says low rates ##score FS_LOW_RATES 1.556 #counts FS_LOW_RATES 42s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 #counts FS_LOW_RATES 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FS_LOW_RATES 39s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FS_LOW_RATES 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_LOWER_YOUR Subject =~ /lower your/i describe FS_LOWER_YOUR Phrase: lower your ##score FS_LOWER_YOUR 1.366 #counts FS_LOWER_YOUR 74s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 #counts FS_LOWER_YOUR 1s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 #counts FS_LOWER_YOUR 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_MAKE_MONEY Subject =~ /make money/i describe FS_MAKE_MONEY Subject says "make money" ##score FS_MAKE_MONEY 1.771 #counts FS_MAKE_MONEY 178s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 #counts FS_MAKE_MONEY 35s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 #counts FS_MAKE_MONEY 38s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FS_MAKE_MONEY 57s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_MORE_CONFIDENT Subject =~ /more confident/i describe FS_MORE_CONFIDENT Subject says More Confident ##score FS_MORE_CONFIDENT 2.594 #counts FS_MORE_CONFIDENT 9s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 #counts FS_MORE_CONFIDENT 160s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FS_MORE_CONFIDENT 569s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 #counts FS_MORE_CONFIDENT 25s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_NEED_MONEY Subject =~ /Need (?:\$|Cash)/i describe FS_NEED_MONEY Subject talks about needing cash. ##score FS_NEED_MONEY 3.887 #counts FS_NEED_MONEY 138s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 #counts FS_NEED_MONEY 1s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FS_NEED_MONEY 3s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FS_NEED_MONEY 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_NEW_SOFT_UPLOAD Subject =~ /^New software uploaded by/ describe FS_NEW_SOFT_UPLOAD Subj starts with New software uploaded ##score FS_NEW_SOFT_UPLOAD 10.357 #counts FS_NEW_SOFT_UPLOAD 14s/0h of 33043 corpus (23599s/9444h FVGT) 11/15/06 #counts FS_NEW_SOFT_UPLOAD 19s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_NEW_SOFT_UPLOAD 22s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FS_NEW_SOFT_UPLOAD 26s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_NEW_XXX Subject =~ /^Re: news? [a-z]{1,5}$/ describe FS_NEW_XXX Subject looks like Fharmacy spams. ##score FS_NEW_XXX 10.357 #counts FS_NEW_XXX 16s/0h of 33043 corpus (23599s/9444h FVGT) 11/15/06 #counts FS_NEW_XXX 69s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_NEW_XXX 208s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_NO_SCRIP Subject =~ /n[o0O] p[reRE][erER]scr[i1I]pt[i1I][o0O]n/i describe FS_NO_SCRIP Subject almost says No prescription ##score FS_NO_SCRIP 10.357 #counts FS_NO_SCRIP 107s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 #counts FS_NO_SCRIP 19s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FS_NO_SCRIP 19s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_NUDE Subject =~ /\bnude\b/i describe FS_NUDE Subject says Nude ##score FS_NUDE 1.869 #counts FS_NUDE 296s/0h of 345244 corpus (337372s/7872h FT) 02/07/06 #counts FS_NUDE 1s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 #counts FS_NUDE 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_NUMYO Subject =~ /1[0-9][\s\.]?y[\s\.]?o[\s\.]?\b/i describe FS_NUMYO Speaks of teenager in subject. ##score FS_NUMYO 3.999 #counts FS_NUMYO 1s/0h of 24567 corpus (15543s/9024h FVGT) 10/31/06 #counts FS_NUMYO 44s/0h of 9077 corpus (4464s/4613h AxB) 11/03/06 #counts FS_NUMYO 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_OBFU_PRMCY Subject =~ /\b(?!(?:pharmacy|primacy))p[ph]{0,4}\S{1,3}r\S{0,2}m\S{0,3}c\S{0,2}y\b/i describe FS_OBFU_PRMCY what could this word be? ##score FS_OBFU_PRMCY 10.357 #counts FS_OBFU_PRMCY 1057s/0h of 35267 corpus (25646s/9621h FVGT) 11/17/06 #counts FS_OBFU_PRMCY 1101s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_PAYINGTOOM Subject =~ /paying too much for/i describe FS_PAYINGTOOM Subject says Paying too much for ##score FS_PAYINGTOOM 3.993 #counts FS_PAYINGTOOM 87s/0h of 115331 corpus (75904s/39427h DOC) 03/24/06 #counts FS_PAYINGTOOM 84s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 #counts FS_PAYINGTOOM 1s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 #counts FS_PAYINGTOOM 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_PERSCRIPTION Subject =~ /perscr[i1]pt[i1][o0]n/i describe FS_PERSCRIPTION Subject mis-spelled prescription ##score FS_PERSCRIPTION 10.357 #counts FS_PERSCRIPTION 26s/0h of 32949 corpus (24998s/7951h ML) 12/13/05 #counts FS_PERSCRIPTION 22s/0h of 70341 corpus (31030s/39311h DOC) 12/13/05 #counts FS_PERSCRIPTION 4s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 #counts FS_PERSCRIPTION 0s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FS_PERSCRIPTION 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_PHARMASUB2 Subject =~ /PH[A-Za-z]{2,7}MA/ describe FS_PHARMASUB2 Looks like Phramacy subject. ##score FS_PHARMASUB2 10.357 #counts FS_PHARMASUB2 2771s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FS_PHARMASUB2 585s/0h of 25311 corpus (18683s/6628h CT) 11/03/06 #counts FS_PHARMASUB2 8163s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FS_PHARMASUB2 2823s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_PHARMASUB2 2819s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_PORN_STAR Subject =~ /Porn Star/i describe FS_PORN_STAR Subject says Porn Star ##score FS_PORN_STAR 10.357 #counts FS_PORN_STAR 1s/0h of 70341 corpus (31030s/39311h DOC) 12/13/05 #counts FS_PORN_STAR 2s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 #counts FS_PORN_STAR 13s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 #counts FS_PORN_STAR 16s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_PRE_SUBJ Subject =~ /\{PRE_SUBJ\}/ describe FS_PRE_SUBJ Subject says PRE_SUBJ ##score FS_PRE_SUBJ 10.357 #counts FS_PRE_SUBJ 1s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FS_PRE_SUBJ 276s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FS_PRE_SUBJ 169s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 #counts FS_PRE_SUBJ 276s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_PRE_SUBJ 276s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_RE_APPROV Subject =~ /re approved/i describe FS_RE_APPROV Phrase: re approved ##score FS_RE_APPROV 10.357 #counts FS_RE_APPROV 51s/0h of 115331 corpus (75904s/39427h DOC) 03/24/06 #counts FS_RE_APPROV 45s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 #counts FS_RE_APPROV 1s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FS_RE_APPROV 37s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FS_RE_APPROV 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_REFI Subject =~ /\brefi\b/i describe FS_REFI Subject says "refi" ##score FS_REFI 7.388 #counts FS_REFI 21s/0h of 9808 corpus (4903s/4905h FT) 12/14/05 #counts FS_REFI 53s/0h of 40636 corpus (35345s/5291h MY) 12/14/05 #counts FS_REFI 8s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_REFI 8s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_REPLICA Subject =~ /replica/i describe FS_REPLICA Subject says "replica" ##score FS_REPLICA 0.994 #counts FS_REPLICA 335s/0h of 70341 corpus (31030s/39311h DOC) 12/13/05 #counts FS_REPLICA 716s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 #counts FS_REPLICA 34s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 #counts FS_REPLICA 39s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_REPLICA 92s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_REPLICAWATCH Subject =~ /replica watch/i describe FS_REPLICAWATCH Subject says Replica watch ##score FS_REPLICAWATCH 10.357 #counts FS_REPLICAWATCH 110s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 #counts FS_REPLICAWATCH 19s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FS_REPLICAWATCH 1429s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FS_REPLICAWATCH 54s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_RESULTS_BED Subject =~ /results in bed/i describe FS_RESULTS_BED Subject says results in bed ##score FS_RESULTS_BED 10.357 #counts FS_RESULTS_BED 3s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FS_RESULTS_BED 6s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FS_RESULTS_BED 33s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FS_RESULTS_BED 7s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_SILDENAFIL Subject =~ /Sildenafil Citrate/i describe FS_SILDENAFIL Subject says "Sildenafil Citrate" ##score FS_SILDENAFIL 10.357 #counts FS_SILDENAFIL 11s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 #counts FS_SILDENAFIL 1s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 #counts FS_SILDENAFIL 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_SINGLE_LETTER_H Subject =~ /\sh\s/i describe FS_SINGLE_LETTER_H Subject has a bare H ##score FS_SINGLE_LETTER_H 0.672 #counts FS_SINGLE_LETTER_H 8s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 #counts FS_SINGLE_LETTER_H 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_SINGLE_LETTER_J Subject =~ /\sj\s/i describe FS_SINGLE_LETTER_J Subject has a bare J ##score FS_SINGLE_LETTER_J 0.672 #counts FS_SINGLE_LETTER_J 10s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 #counts FS_SINGLE_LETTER_J 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_SPERMAX Subject =~ /Spermamax/i describe FS_SPERMAX Subject contains Spermamax ##score FS_SPERMAX 10.357 #counts FS_SPERMAX 30s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 #counts FS_SPERMAX 13s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FS_SPERMAX 20s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_SPLASH Subject =~ / splash(?:ed|ing)? /i describe FS_SPLASH Subject says splash or splashed ##score FS_SPLASH 0.868 #counts FS_SPLASH 1s/0h of 6866 corpus (4638s/2228h AxB) 02/07/06 #counts FS_SPLASH 10s/0h of 345244 corpus (337372s/7872h FT) 02/07/06 #counts FS_SPLASH 0s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 #counts FS_SPLASH 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_START_DOYOU2 Subject =~ /^Do you (?:dream|have|want|love|like|wanna)/i describe FS_START_DOYOU2 Subject starts with Do you dream,have,want,love, etc. ##score FS_START_DOYOU2 1.633 #counts FS_START_DOYOU2 957s/0h of 103219 corpus (95719s/7500h FVGT) 03/21/06 #counts FS_START_DOYOU2 124s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 #counts FS_START_DOYOU2 10s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_START_DOYOU2 22s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_START_LOSE Subject =~ /^Lose /i describe FS_START_LOSE Subject starts with Lose ##score FS_START_LOSE 1.493 #counts FS_START_LOSE 466s/0h of 103219 corpus (95719s/7500h FVGT) 03/21/06 #counts FS_START_LOSE 4s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FS_START_LOSE 10s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_START_LOSE 13s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_START_TEEN Subject =~ /^Teen /i describe FS_START_TEEN Subject starts with Teen ##score FS_START_TEEN 1.399 #counts FS_START_TEEN 816s/0h of 103219 corpus (95719s/7500h FVGT) 03/21/06 #counts FS_START_TEEN 5s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FS_START_TEEN 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_TEEN_BAD Subject =~ /teen.{1,15}(?:pussy|sex|slut|ass|fuck|rape)/i describe FS_TEEN_BAD Subject says something bad about teens ##score FS_TEEN_BAD 10.357 #counts FS_TEEN_BAD 675s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 #counts FS_TEEN_BAD 15s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_TEEN_BAD 15s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_TIGHT_TEEN Subject =~ /tight (?:teen|pussy|ass)/i describe FS_TIGHT_TEEN Phrase: tight teen, etc. ##score FS_TIGHT_TEEN 10.357 #counts FS_TIGHT_TEEN 80s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 #counts FS_TIGHT_TEEN 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_TIP_DDD Subject =~ /(?:tip|good) \d\d\d?\d?/i describe FS_TIP_DDD Phrase: subject = tip ddd ##score FS_TIP_DDD 10.357 #counts FS_TIP_DDD 53s/0h of 25733 corpus (16658s/9075h FVGT) 11/08/06 #counts FS_TIP_DDD 741s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_TIP_DDD 854s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FS_TIP_DDD 1664s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_VIEWPHOTOS Subject =~ /view photos of singles in your area/i describe FS_VIEWPHOTOS Phrase: View photos of singles... ##score FS_VIEWPHOTOS 10.357 #counts FS_VIEWPHOTOS 115s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 #counts FS_VIEWPHOTOS 5s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 #counts FS_VIEWPHOTOS 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_WE_WANT Subject =~ /^We want/i describe FS_WE_WANT Subject starts with We Want. ##score FS_WE_WANT 1.629 #counts FS_WE_WANT 20s/0h of 43642 corpus (34621s/9021h FVGT) 10/26/06 #counts FS_WE_WANT 51s/0h of 257465 corpus (187155s/70310h DOC) 10/26/06 #counts FS_WE_WANT 1s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FS_WE_WANT 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_WEIGHT_LOSS Subject =~ /weight loss/i describe FS_WEIGHT_LOSS Subject says Weight Loss ##score FS_WEIGHT_LOSS 2.134 #counts FS_WEIGHT_LOSS 149s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 #counts FS_WEIGHT_LOSS 42s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 #counts FS_WEIGHT_LOSS 44s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_WEIGHT_LOSS 44s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_WILL_HELP Subject =~ /will help/ describe FS_WILL_HELP Subject says will help ##score FS_WILL_HELP 2.749 #counts FS_WILL_HELP 35s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FS_WILL_HELP 19s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FS_WILL_HELP 692s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FS_WILL_HELP 357s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 #counts FS_WILL_HELP 29s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_YOUR_COMPUTER Subject =~ /^Your computer/i describe FS_YOUR_COMPUTER Phrase: Your Computer in Subject. ##score FS_YOUR_COMPUTER 3.645 #counts FS_YOUR_COMPUTER 2s/0h of 43642 corpus (34621s/9021h FVGT) 10/26/06 #counts FS_YOUR_COMPUTER 34s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_YOUR_COMPUTER 90s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_YOUR_PRESCRIP Subject =~ /Your(?: rx)? Prescription/i describe FS_YOUR_PRESCRIP Subject talks about your prescription ##score FS_YOUR_PRESCRIP 2.575 #counts FS_YOUR_PRESCRIP 27s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 #counts FS_YOUR_PRESCRIP 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FS_YOUR_PRESCRIP 11s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FS_YOUR_PRESCRIP 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header FS_YOUR_REFILL Subject =~ /your refill/i describe FS_YOUR_REFILL Subject Phrase: your refill ##score FS_YOUR_REFILL 1.952 #counts FS_YOUR_REFILL 2s/0h of 9808 corpus (4903s/4905h FT) 12/14/05 #counts FS_YOUR_REFILL 40s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FS_YOUR_REFILL 40s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #====== URI RULES BELOW ============= uri FU_16R m'/16r'i describe FU_16R Often seen in spam /16r ##score FU_16R 10.357 #counts FU_16R 68s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 #counts FU_16R 74s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 #counts FU_16R 166s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FU_16R 490s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 uri FU_COMMON_SUBS2 m'/(?:[2w]m|7d|b|ee|lj|j|o|u)/[,.]?$' describe FU_COMMON_SUBS2 Sub-dir seen often in spam (2). ##score FU_COMMON_SUBS2 4.999 #counts FU_COMMON_SUBS2 26s/0h of 42141 corpus (34216s/7925h FVGT) 04/25/06 #counts FU_COMMON_SUBS2 137s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FU_COMMON_SUBS2 24s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FU_COMMON_SUBS2 22s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 uri FU_ENDS_NUMS_DOTS_CLK m'(?:clk|uns)/\d+\.\d+\.\d+'i describe FU_ENDS_NUMS_DOTS_CLK Ends with clk/d+.d+.d+ ##score FU_ENDS_NUMS_DOTS_CLK 10.357 #counts FU_ENDS_NUMS_DOTS_CLK 15s/0h of 15656 corpus (7711s/7945h FT) 04/20/06 #counts FU_ENDS_NUMS_DOTS_CLK 19s/0h of 42071 corpus (34145s/7926h FVGT) 04/20/06 #counts FU_ENDS_NUMS_DOTS_CLK 455s/0h of 93047 corpus (65257s/27790h ML) 04/20/06 #counts FU_ENDS_NUMS_DOTS_CLK 8s/0h of 21937 corpus (16638s/5299h FVGT) 11/08/06 #counts FU_ENDS_NUMS_DOTS_CLK 13s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FU_ENDS_NUMS_DOTS_CLK 19s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 uri FU_HG_PATH m'/hgh/'i describe FU_HG_PATH URL has /hgh/ in path. ##score FU_HG_PATH 10.357 #counts FU_HG_PATH 13s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FU_HG_PATH 391s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FU_HG_PATH 14s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 uri FU_HOODIA /hoodia/i describe FU_HOODIA URL has hoodia in it. ##score FU_HOODIA 10.357 #counts FU_HOODIA 601s/0h of 103688 corpus (96287s/7401h FVGT) 03/17/06 #counts FU_HOODIA 10s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FU_HOODIA 17s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 uri FU_LONG_HTML /[a-z]{50}\.html/i describe FU_LONG_HTML URL has long file name with .html extension. ##score FU_LONG_HTML 10.357 #counts FU_LONG_HTML 27s/0h of 42564 corpus (34322s/8242h FVGT) 05/26/06 #counts FU_LONG_HTML 28s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FU_LONG_HTML 28s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 uri FU_LOTSOFCOLONS m'/\w{5,25}:\w{5,25}:\w{5,25}\b'i describe FU_LOTSOFCOLONS word:word:word in URL. ##score FU_LOTSOFCOLONS 4.999 #counts FU_LOTSOFCOLONS 1s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 #counts FU_LOTSOFCOLONS 95s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 #counts FU_LOTSOFCOLONS 123s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FU_LOTSOFCOLONS 175s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 uri FU_LONG_QUERY3 m'[A-F0-9]{30}\.aspx' describe FU_LONG_QUERY3 URL has a long file name with .aspx extension. ##score FU_LONG_QUERY3 4.799 #counts FU_LONG_QUERY3 274s/0h of 82118 corpus (57948s/24170h ML) 04/03/06 #counts FU_LONG_QUERY3 36s/0h of 41810 corpus (34135s/7675h FVGT) 04/03/06 #counts FU_LONG_QUERY3 21s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FU_LONG_QUERY3 27s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 uri FU_MIDER m'/gall?/' describe FU_MIDER URL has /gal/ ##score FU_MIDER 10.357 #counts FU_MIDER 730s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FU_MIDER 5954s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FU_MIDER 759s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FU_MIDER 760s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FU_MIDER 787s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 uri FU_RX_DIR m'/rx/'i describe FU_RX_DIR /rx/ ##score FU_RX_DIR 1.999 #counts FU_RX_DIR 1s/0h of 41941 corpus (34079s/7862h FVGT) 04/14/06 #counts FU_RX_DIR 1s/0h of 21937 corpus (16638s/5299h FVGT) 11/08/06 #counts FU_RX_DIR 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 uri FU_SUB_D_WEIRD /3a2kf\./ describe FU_SUB_D_WEIRD Sub-domain seen often in spam. ##score FU_SUB_D_WEIRD 10.357 #counts FU_SUB_D_WEIRD 31s/0h of 24480 corpus (15455s/9025h FVGT) 10/30/06 #counts FU_SUB_D_WEIRD 45s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FU_SUB_D_WEIRD 45s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FU_SUB_D_WEIRD 45s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 uri FU_UKGEOCITIES /\b[a-z]{2}\.geocities\.com/i describe FU_UKGEOCITIES URL with [a-z]{2}.geocities.com ##score FU_UKGEOCITIES 5.697 #counts FU_UKGEOCITIES 121s/0h of 21937 corpus (16638s/5299h FVGT) 11/08/06 #counts FU_UKGEOCITIES 121s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FU_UKGEOCITIES 124s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 uri FU_URI_TRACKER_T m'/[yi]/(?:sp|et|vm|xl2)/'i describe FU_URI_TRACKER_T URI style tracker (T) ##score FU_URI_TRACKER_T 10.357 #counts FU_URI_TRACKER_T 9s/0h of 25009 corpus (15987s/9022h FVGT) 11/03/06 #counts FU_URI_TRACKER_T 203s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FU_URI_TRACKER_T 221s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FU_URI_TRACKER_T 487s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #====== META RULES BELOW ============= #msg A body __BEEN_APPROVED /been approved/ body __CAN_HELP /can help/ body __COMPLETE_REVIEW /complete review/ meta FM_APPROVE_COMPLETE (__BEEN_APPROVED && __CAN_HELP && __COMPLETE_REVIEW) describe FM_APPROVE_COMPLETE Meta approved complete review ##score FM_APPROVE_COMPLETE 4.885 #counts FM_APPROVE_COMPLETE 1s/0h of 43642 corpus (34621s/9021h FVGT) 10/26/06 #counts FM_APPROVE_COMPLETE 1s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FM_APPROVE_COMPLETE 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __FB_BIG /BIG/ body __FB_REASON /REASON/ body __FB_BEST /BEST/ meta FM_BIG_REASON ((__FB_BIG + __FB_REASON + __FB_BEST) > 1) describe FM_BIG_REASON Lot's of CAP words, BIG, REASON, BEST ##score FM_BIG_REASON 10.357 #counts FM_BIG_REASON 20s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FM_BIG_REASON 22s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FM_BIG_REASON 203s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FM_BIG_REASON 29s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FM_BIG_REASON 56s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header __FS_CLAIM_YOUR Subject =~ /claim your/i header __FS_FREE Subject =~ /\bfree\b/i header __FS_IPODXBOX Subject =~ /(?:ipod|xbox)/i header __FS_MP3PLAY Subject =~ /mp3 player/i meta FM_CLAIM_IPOD ((__FS_CLAIM_YOUR || __FS_FREE) && (__FS_IPODXBOX || __FS_MP3PLAY)) describe FM_CLAIM_IPOD Looks like u should claim your ipod. ##score FM_CLAIM_IPOD 1.771 #counts FM_CLAIM_IPOD 18s/0h of 27495 corpus (21848s/5647h MY) 03/01/06 #counts FM_CLAIM_IPOD 2s/0h of 34977 corpus (27086s/7891h FT) 03/01/06 #counts FM_CLAIM_IPOD 8s/0h of 84470 corpus (67306s/17164h ML) 03/01/06 #counts FM_CLAIM_IPOD 75s/0h of 103116 corpus (63731s/39385h DOC) 03/01/06 #counts FM_CLAIM_IPOD 7s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 #counts FM_CLAIM_IPOD 8s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header __FS_COKE Subject =~ /\bcoke\b/i header __FS_PEPSI Subject =~ /\bpepsi\b/i meta FM_COKE_PEPSI (__FS_COKE && __FS_PEPSI) describe FM_COKE_PEPSI Subject has both Coke and Pepsi ##score FM_COKE_PEPSI 10.357 #counts FM_COKE_PEPSI 94s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 #counts FM_COKE_PEPSI 110s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FM_COKE_PEPSI 134s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header __GETYOUR subject =~ /get your/i header __CONGRADULAT Subject =~ /congra[dt]ulation/i header __GIFTCERT Subject =~ /(?:gift|gas) (?:cert|card)/i meta FM_CONG_GIFTCARD ((__CONGRADULAT || __GETYOUR) && __GIFTCERT) describe FM_CONG_GIFTCARD Talks about gift cards and congrads. ##score FM_CONG_GIFTCARD 3.321 #counts FM_CONG_GIFTCARD 19s/0h of 34977 corpus (27086s/7891h FT) 03/01/06 #counts FM_CONG_GIFTCARD 22s/0h of 103116 corpus (63731s/39385h DOC) 03/01/06 #counts FM_CONG_GIFTCARD 4s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 #counts FM_CONG_GIFTCARD 27s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __OWN_LAND /\bland\b/i body __OWN_PROP /propert/i body __COSTA_RI /Costa Rica/i body __FB_TOUR /\btour/i meta FM_COSTA_RICA ((__OWN_LAND || __OWN_PROP) && __COSTA_RI && __FB_TOUR) describe FM_COSTA_RICA Looks like Costa Rica spams. ##score FM_COSTA_RICA 10.357 #counts FM_COSTA_RICA 96s/0h of 40658 corpus (35364s/5294h MY) 12/12/05 #counts FM_COSTA_RICA 9s/0h of 9809 corpus (4905s/4904h FT) 12/12/05 #counts FM_COSTA_RICA 27s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 #counts FM_COSTA_RICA 0s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 #counts FM_COSTA_RICA 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __FB_CUSTOM_LOGO /(?:custom|unique) logo/i body __FB_LOGO_DESIGN /Logo Design/i body __FB_CUSTOM_RECOG /customer recognition/i body __FB_TARGET_AUDIEN /target audience/i meta FM_CUSTOMLOGODSGNc (__FB_CUSTOM_LOGO && (__FB_LOGO_DESIGN || __FB_CUSTOM_RECOG || __FB_TARGET_AUDIEN)) describe FM_CUSTOMLOGODSGNc Custom Designed Logos ##score FM_CUSTOMLOGODSGNc 10.357 #counts FM_CUSTOMLOGODSGNc 22s/0h of 104500 corpus (96503s/7997h FVGT) 03/09/06 #counts FM_CUSTOMLOGODSGNc 195s/0h of 90227 corpus (72176s/18051h ML) 03/08/06 #counts FM_CUSTOMLOGODSGNc 18s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 #counts FM_CUSTOMLOGODSGNc 24s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 ## meta FM_DDDD_TIMES_2 (FH_HELO_EQ_D_D_D_D && FH_HOST_EQ_D_D_D_D) ## describe FM_DDDD_TIMES_2 Dual helo + host eq d_d_d_d ##score FM_DDDD_TIMES_2 1.999 #counts FM_DDDD_TIMES_2 2923s/1h of 41800 corpus (34198s/7602h FVGT) 03/25/06 #counts FM_DDDD_TIMES_2 3486s/1h of 41949 corpus (34112s/7837h FVGT) 04/11/06 #counts FM_DDDD_TIMES_2 1304s/1h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FM_DDDD_TIMES_2 1776s/1h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header __FS_DEBT Subject =~ /debt/i header __FS_HELP Subject =~ /help/i meta FM_DEBT_HELP (__FS_DEBT && __FS_HELP) describe FM_DEBT_HELP Subject says debt and help. ##score FM_DEBT_HELP 3.222 #counts FM_DEBT_HELP 1s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 #counts FM_DEBT_HELP 53s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FM_DEBT_HELP 4s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FM_DEBT_HELP 7s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header __HOTMAILCOM X-Spam-Relays-External =~ /^[^\]]+ helo=hotmail\.com /i header __HOST_HOTMAIL X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.hotmail\.com / meta FM_FAKE_HELO_HOTMAIL (__HOTMAILCOM && !__HOST_HOTMAIL) describe FM_FAKE_HELO_HOTMAIL Looks like a fake hotmail.com helo. ##score FM_FAKE_HELO_HOTMAIL 2.353 #counts FM_FAKE_HELO_HOTMAIL 0s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FM_FAKE_HELO_HOTMAIL 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header __FHELO_VERIZON X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+verizon\.net /i header __FHOST_VERIZON X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+verizon\.net /i meta FM_FAKE_HELO_VERIZON (__FHELO_VERIZON && !__FHOST_VERIZON) describe FM_FAKE_HELO_VERIZON Looks like a fake verizon.net helo. ##score FM_FAKE_HELO_VERIZON 1.229 #counts FM_FAKE_HELO_VERIZON 26s/0h of 42070 corpus (34144s/7926h FVGT) 04/19/06 #counts FM_FAKE_HELO_VERIZON 71s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FM_FAKE_HELO_VERIZON 90s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header __MSGID_GMAIL MESSAGEID =~ /gmail\.com/i header __FROM_GMAIL From =~ /gmail\.com/ meta FM_FORGED_GMAIL (__MSGID_GMAIL && !__FROM_GMAIL) describe FM_FORGED_GMAIL Looks like a forged gmail msg? ##score FM_FORGED_GMAIL 0.622 #counts FORGED_GMAIL 10s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 #counts FM_FORGED_GMAIL 10s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FM_FORGED_GMAIL 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header __FROM_LEFT_BRACK From:name =~ // header __FROM_ISO_2022_JP From:raw =~ /=\?ISO-2022-JP\?/ meta FM_FRM_RN_L_BRACK (__FROM_RIGH_BRACK && !__FROM_LEFT_BRACK && !__FROM_ISO_2022_JP) describe FM_FRM_RN_L_BRACK From name has > but not < ##score FM_FRM_RN_L_BRACK 0.545 #counts FRM_RN_L_BRACK 7s/0h of 103219 corpus (95719s/7500h FVGT) 03/21/06 #counts FRM_RN_L_BRACK 9s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 #counts FM_FRM_RN_L_BRACK 11s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __SURVEY /\bsurvey\b/i meta FM_GET_CASH_SURVEY (FB_GET_XXX_CASH && __SURVEY) describe FM_GET_CASH_SURVEY Meta Get Cash + Survey ##score FM_GET_CASH_SURVEY 10.357 #counts FM_GET_CASH_SURVEY 17s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 #counts FM_GET_CASH_SURVEY 55s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FM_GET_CASH_SURVEY 107s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __YOUR_CREDIT /your credit/ body __GOOD_ENOUGH /good enough/ meta FM_GOOD_ENF_CREDIT (__YOUR_CREDIT && __GOOD_ENOUGH) describe FM_GOOD_ENF_CREDIT Meta Good enough credit ##score FM_GOOD_ENF_CREDIT 10.357 #counts FM_GOOD_ENF_CREDIT 12s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 #counts FM_GOOD_ENF_CREDIT 40s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FM_GOOD_ENF_CREDIT 98s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __YOUR_ACCOUNT /your account/i header __MANY_RECIPS ToCc =~ /(?:\@[^@]{5,30}){3}/ meta FM_IS_IT_OUR_ACCOUNT (__YOUR_ACCOUNT && __MANY_RECIPS) describe FM_IS_IT_OUR_ACCOUNT Is it our account? ##score FM_IS_IT_OUR_ACCOUNT 4.20 #counts FM_IS_IT_OUR_ACCOUNT 2s/0h of 9808 corpus (4903s/4905h FT) 12/14/05 #counts FM_IS_IT_OUR_ACCOUNT 7s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 #counts FM_IS_IT_OUR_ACCOUNT 11s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header __NUMBERS_IN_SUBJ Subject =~ /\d{3}/ header __FS_LEND Subject =~ /\blend\b/i meta FM_LEND_MONEY (__NUMBERS_IN_SUBJ && __FS_LEND) describe FM_LEND_MONEY Subject has ddd + lend! ##score FM_LEND_MONEY 2.668 #counts FS_LEND_MONEY 2s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 #counts FS_LEND_MONEY 7s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 #counts FM_LEND_MONEY 13s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #http://www18.homeloanstore456.com uri __FU_LOAN /[a-pr-z0-9]+loan[a-z0-9]+\.com/i uri __DOMAIN_WITH_NUMS /www[^.]+\.[^.]+\d[^.]+\./i meta FM_LOAN_NUM_DOMAIN (__FU_LOAN && __DOMAIN_WITH_NUMS) describe FM_LOAN_NUM_DOMAIN Loan and numbers in .com ##score FM_LOAN_NUM_DOMAIN 3.524 #counts FM_LOAN_NUM_DOMAIN 2s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 #counts FM_LOAN_NUM_DOMAIN 13s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FM_LOAN_NUM_DOMAIN 19s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __FB_GENERATE /generate/i body __FB_FIND_OUT /find out how/i body __FB_FROM_YOUR /from your/i body __FB_HOME_HOUSE /ho(?:use|me)/i meta FM_MAKE_MONEY_HOME (__FB_GENERATE && __FB_FIND_OUT && __FB_FROM_YOUR && __FB_HOME_HOUSE) describe FM_MAKE_MONEY_HOME Making money from home. ##score FM_MAKE_MONEY_HOME 10.357 #counts FM_MAKE_MONEY_HOME 1s/0h of 25733 corpus (16658s/9075h FVGT) 11/08/06 #counts FM_MAKE_MONEY_HOME 77s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __VA_WORD /\bV[A-Za-z]{2,4}RA\b/ body __CS_WORD /\bC[A-Za-z]{2,4}IS\b/ body __VM_WORD /\bV[A-Za-z]{2,5}UM\b/ meta FM_MANY_DRUG_WORDS (__VA_WORD && __CS_WORD && __VM_WORD) describe FM_MANY_DRUG_WORDS Lot's of almost drug words ##score FM_MANY_DRUG_WORDS 10.357 #counts MANY_DRUG_WORDS 228s/0h of 21635 corpus (15142s/6493h CT) 09/25/06 #counts FM_MANY_DRUG_WORDS 1169s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 #counts FM_MANY_DRUG_WORDS 1199s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __FB_YOUR_MEDS /your meds/i header __FS_RE_TWO_WORDS Subject =~ /^Re: (?:[a-z']{2,5}\s+){2}$/ meta FM_MEDS_SUBJ_2WDS ((__FB_YOUR_MEDS || FB_MEDS_PERCENT) && __FS_RE_TWO_WORDS) describe FM_MEDS_SUBJ_2WDS Talks about Meds, Re: two words. ##score FM_MEDS_SUBJ_2WDS 10.357 #counts __FB_YOUR_MEDS 10s/1h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts __FS_RE_TWO_WORDS 271s/9h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FM_MEDS_SUBJ_2WDS 6s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 #counts FM_MEDS_SUBJ_2WDS 6s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FM_MEDS_SUBJ_2WDS 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __PREAPPROVEDFVGT /pre-approved/i body __FIXED_RATEFVGT /fixed rate/i body __YOUR_CREDITFVGT /your credit/i body __HOMELOANFVGT /home loan/i body __APPROVALFVGT /approval/i body __BIGDOLLARSFVGT /\$\d{2,3},\d{3}/ uri __LOANURIFVGT /\bloa.?ns?\b/i uri __MORTURIFVGT /\bmor.?t\b/i meta __FM_MORTGAGE3PLUS ((__PREAPPROVEDFVGT + __FIXED_RATEFVGT + __YOUR_CREDITFVGT + __HOMELOANFVGT + __APPROVALFVGT + __BIGDOLLARSFVGT + __LOANURIFVGT + __MORTURIFVGT) > 2) meta __FM_MORTGAGE4PLUS ((__PREAPPROVEDFVGT + __FIXED_RATEFVGT + __YOUR_CREDITFVGT + __HOMELOANFVGT + __APPROVALFVGT + __BIGDOLLARSFVGT + __LOANURIFVGT + __MORTURIFVGT) > 3) meta __FM_MORTGAGE5PLUS ((__PREAPPROVEDFVGT + __FIXED_RATEFVGT + __YOUR_CREDITFVGT + __HOMELOANFVGT + __APPROVALFVGT + __BIGDOLLARSFVGT + __LOANURIFVGT + __MORTURIFVGT) > 4) meta __FM_MORTGAGE6PLUS ((__PREAPPROVEDFVGT + __FIXED_RATEFVGT + __YOUR_CREDITFVGT + __HOMELOANFVGT + __APPROVALFVGT + __BIGDOLLARSFVGT + __LOANURIFVGT + __MORTURIFVGT) > 5) meta FM_MORTGAGE3PLUS (__FM_MORTGAGE3PLUS && !__FM_MORTGAGE4PLUS && !__FM_MORTGAGE5PLUS && !__FM_MORTGAGE6PLUS) describe FM_MORTGAGE3PLUS Looks like a mortgage spam (3+) ##score FM_MORTGAGE3PLUS 0.602 #counts FM_MORTGAGE3PLUS 46s/1h of 32518 corpus (23261s/9257h FVGT) 11/14/06 #counts FM_MORTGAGE3PLUS 46s/1h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FM_MORTGAGE3PLUS 49s/1h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FM_MORTGAGE3PLUS 57s/1h of 47019 corpus (37183s/9836h FVGT) 12/23/06 meta FM_MORTGAGE4PLUS (__FM_MORTGAGE4PLUS && !__FM_MORTGAGE5PLUS && !__FM_MORTGAGE6PLUS) describe FM_MORTGAGE4PLUS Looks like a mortgage spam (4+) ##score FM_MORTGAGE4PLUS 0.166 #counts FM_MORTGAGE4PLUS 1s/1h of 32518 corpus (23261s/9257h FVGT) 11/14/06 #counts FM_MORTGAGE4PLUS 1s/1h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FM_MORTGAGE4PLUS 1s/1h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FM_MORTGAGE4PLUS 3s/1h of 47019 corpus (37183s/9836h FVGT) 12/23/06 meta FM_MORTGAGE5PLUS (__FM_MORTGAGE5PLUS && !__FM_MORTGAGE6PLUS) describe FM_MORTGAGE5PLUS Looks like a mortgage spam (5+) ##score FM_MORTGAGE5PLUS 3.222 #counts FM_MORTGAGE5PLUS 39s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 #counts FM_MORTGAGE5PLUS 46s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 meta FM_MORTGAGE6PLUS (__FM_MORTGAGE6PLUS) describe FM_MORTGAGE6PLUS Looks like a mortgage spam (6+) ##score FM_MORTGAGE6PLUS 2.500 #counts FM_MORTGAGE6PLUS 3s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 #counts FM_MORTGAGE6PLUS 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __FB_BRAND_NAME /brand name/i body __FB_TIMEPIECE /timepiece/i body __FB_WALLETS /wallets/i body __FB_HANDBAGS /handbags/i body __FB_DESIGNER /designer/i body __FB_INK_PEN /ink pen/i meta FM_MULTI_LUX_GIFTS ((__FB_BRAND_NAME + __FB_TIMEPIECE + __FB_WALLETS + __FB_HANDBAGS + __FB_DESIGNER + __FB_LUX_GIFTS + __FB_NUM_PERCNT + __FB_INK_PEN) > 3) describe FM_MULTI_LUX_GIFTS Talks about variety of luxury gifts ##score FM_MULTI_LUX_GIFTS 10.357 #counts FM_MULTI_LUX_GIFTS 35s/0h of 32090 corpus (22848s/9242h FVGT) 11/13/06 #counts FM_MULTI_LUX_GIFTS 42s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FM_MULTI_LUX_GIFTS 156s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # Brand comparisons as of late... header __FS_ADIDAS Subject =~ /\badidas\b/i header __FS_NIKE Subject =~ /\bnike\b/i meta FM_NIKE_ADIDAS (__FS_ADIDAS && __FS_NIKE) describe FM_NIKE_ADIDAS Meta Nike & Adidas ##score FM_NIKE_ADIDAS 4.555 #counts FM_NIKE_ADIDAS 1s/0h of 43642 corpus (34621s/9021h FVGT) 10/26/06 #counts FM_NIKE_ADIDAS 3s/0h of 257465 corpus (187155s/70310h DOC) 10/26/06 #counts FM_NIKE_ADIDAS 1s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 #counts FM_NIKE_ADIDAS 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __FB_YOU_ARE_PAYING /you are paying/i #counts FB_YOU_ARE_PAYING 155s/26h of 207630 corpus (200121s/7509h FT) 12/13/05 meta FM_PAYING_LOWER (FB_LOWER_PAYM && __FB_YOU_ARE_PAYING) describe FM_PAYING_LOWER Meta You are paying too much... ##score FM_PAYING_LOWER 1.35 #counts FM_PAYING_LOWER 0s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FM_PAYING_LOWER 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 meta FM_PC_ERROR_DBL (FB_YOUR_PC_ERROR && (FS_YOUR_COMPUTER || FB_PC_DOCTOR)) describe FM_PC_ERROR_DBL Combo Meta of multiple rules. ##score FM_PC_ERROR_DBL 10.357 #counts FM_PC_ERROR_DBL 2s/0h of 43642 corpus (34621s/9021h FVGT) 10/26/06 #counts FM_PC_ERROR_DBL 25s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FM_PC_ERROR_DBL 58s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FM_PC_ERROR_DBL 166s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header __MSGID_VGA Message-ID =~ /^<000001c[67]/ header __DATE_700 Date =~ /-0700/ meta FM_RATSIGN_1106 (__MSGID_VGA && __DATE_700) describe FM_RATSIGN_1106 Fingerprint seen in lots of spam. 11/2006 ##score FM_RATSIGN_1106 17.422 #counts GOODBYE_VJJAGGRRAA 3781s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 #counts FM_RATSIGN_1106 3862s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 #counts FM_RATSIGN_1106 3895s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FM_RATSIGN_1106 3937s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __FB_DO_NOT_REPLY /Do not reply to this address/i body __FB_EMAIL_ME_BAC /Email me baca?k at/i meta FM_REPLY_OR_NOT (__FB_DO_NOT_REPLY && __FB_EMAIL_ME_BAC) describe FM_REPLY_OR_NOT Meta do they want a reply or not? ##score FM_REPLY_OR_NOT 10.357 #counts FM_REPLY_OR_NOT 2s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 #counts FM_REPLY_OR_NOT 14s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FM_REPLY_OR_NOT 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __FB_ROLEX_MEN /Rolex Men/i body __FB_ROLEX_WMEN /Rolex Lady/i body __FB_OMEGA /Omega/i body __FB_GLASHUTE /Glashute/ meta FM_ROLEX_ADS (__FB_ROLEX_MEN && __FB_ROLEX_WMEN && __FB_OMEGA && __FB_GLASHUTE) describe FM_ROLEX_ADS Looks like Rolex spams. ##score FM_ROLEX_ADS 6.999 #counts FM_ROLEX_ADS 0s/0h of 5479 corpus (1297s/4182h AxB) 09/25/06 #counts FM_ROLEX_ADS 0s/0h of 21635 corpus (15142s/6493h CT) 09/25/06 #counts FM_ROLEX_ADS 60s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 #counts FM_ROLEX_ADS 85s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __FB_BA /\bBA\b/ body __FB_BCs /\bBSc\b/ body __FB_MA /\bMA\b/ body __FB_MBA /\bMBA\b/ meta FM_SCHOOL_TYPES (__FB_BA && __FB_BCs && __FB_MA && __FB_MBA) describe FM_SCHOOL_TYPES Meta Combo Phrase for Schooling ##score FM_SCHOOL_TYPES 5.599 #counts FM_SCHOOL_TYPES 4s/0h of 24480 corpus (15455s/9025h FVGT) 10/30/06 #counts FM_SCHOOL_TYPES 4s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 #counts FM_SCHOOL_TYPES 4s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FM_SCHOOL_TYPES 6s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FM_SCHOOL_TYPES 28s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 #counts FM_SCHOOL_TYPES 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # We don't need no schooling ;) body __BACHELORS /Bachelor/i body __MASTERS /Masters/i body __MBA /MBA/i body __PHD /PhD/i body __DIPLOMA /diploma/i meta FM_SCHOOLING ((__BACHELORS + __MASTERS + __MBA + __PHD) > 2) describe FM_SCHOOLING Meta Combo Phrase for Schooling (2) ##score FM_SCHOOLING 5.657 #counts FM_SCHOOLING 15s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FM_SCHOOLING 88s/0h of 25311 corpus (18683s/6628h CT) 11/03/06 #counts FM_SCHOOLING 20s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 meta FM_SCHOOL_DIPLOMA (FM_SCHOOLING && __DIPLOMA) describe FM_SCHOOL_DIPLOMA Meta for Schooling + Diploma. ##score FM_SCHOOL_DIPLOMA 10.357 #counts FM_SCHOOL_DIPLOMA 10s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 #counts FM_SCHOOL_DIPLOMA 61s/0h of 25311 corpus (18683s/6628h CT) 11/03/06 #counts FM_SCHOOL_DIPLOMA 477s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FM_SCHOOL_DIPLOMA 15s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __WORD_SEX /\bsex(?:iest|y)?\b/i body __WORD_CUM /\bcum\b/i body __WORD_SPERM /\bsperm\b/i body __WORD_SLUTS /\bsluts?\b/i body __WORD_RAPED /\braped?\b/i meta __SEX_WRDS (__WORD_SEX || __WORD_CUM || __WORD_SPERM || __WORD_SLUTS || __WORD_RAPED) meta FM_SEX_HELODDDD (__SEX_WRDS && FH_HELO_EQ_D_D_D_D) describe FM_SEX_HELODDDD Sex words + helo = dddd ##score FM_SEX_HELODDDD 10.357 #counts FM_SEX_HELODDDD 105s/0h of 33966 corpus (24401s/9565h FVGT) 11/16/06 #counts FM_SEX_HELODDDD 108s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FM_SEX_HELODDDD 258s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 ##meta FM_SEX_HOSTDDDD (__SEX_WRDS && FH_HOST_EQ_D_D_D_D) ##describe FM_SEX_HOSTDDDD Sex words + host = dddd ##score FM_SEX_HOSTDDDD 10.357 #counts FM_SEX_HOSTDDDD 289s/0h of 33966 corpus (24401s/9565h FVGT) 11/16/06 #counts FM_SEX_HOSTDDDD 303s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FM_SEX_HOSTDDDD 529s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header __FS_TEEN Subject =~ /\bteen\b/i meta FM_SUB_TEEN_NUDE (FS_NUDE && __FS_TEEN) describe FM_SUB_TEEN_NUDE Subject says teen and nude ##score FM_SUB_TEEN_NUDE 5.981 #counts FM_SUB_TEEN_NUDE 48s/0h of 345244 corpus (337372s/7872h FT) 02/07/06 #counts FM_SUB_TEEN_NUDE 0s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 #counts FM_SUB_TEEN_NUDE 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header __EXCLAIM_SUBJ Subject =~ /\!/ header __SUBJ_APPROVE Subject =~ /Approve/i meta FM_SUBJ_APPROVE (__EXCLAIM_SUBJ && __SUBJ_APPROVE) describe FM_SUBJ_APPROVE Subject has Approve and ! ##score FM_SUBJ_APPROVE 3.877 #counts FM_SUBJ_APPROVE 9s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 #counts FM_SUBJ_APPROVE 13s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FM_SUBJ_APPROVE 20s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header __FS_PROFIT Subject =~ /profit/i header __FS_YOU Subject =~ /you\b/i meta FM_SUBJ_YOU_PROFIT (__FS_PROFIT && __FS_YOU) describe FM_SUBJ_YOU_PROFIT Subject says you profit ##score FM_SUBJ_YOU_PROFIT 3.788 #counts FM_SUBJ_YOU_PROFIT 26s/0h of 103688 corpus (96287s/7401h FVGT) 03/17/06 #counts FM_SUBJ_YOU_PROFIT 3s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 #counts FM_SUBJ_YOU_PROFIT 26s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 #counts FM_SUBJ_YOU_PROFIT 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 header __FROM_VEGAS From =~ /Vegas/i header __SUBJ_3DIGIT Subject =~ /\b\d{3}[^0-9]/ header __SUBJ_VEGAS Subject =~ /(?:Vegas|Casino)/i body __FB_GAME /game/i meta FM_VEGAS_CASINO ((__FROM_VEGAS + __SUBJ_3DIGIT + __SUBJ_VEGAS + __FB_GAME) > 2) describe FM_VEGAS_CASINO Looks like vega casino spam ##score FM_VEGAS_CASINO 10.357 #counts FM_VEGAS_CASINO 119s/0h of 132996 corpus (95808s/37188h ML) 06/12/06 #counts FM_VEGAS_CASINO 110s/0h of 168016 corpus (116196s/51820h DOC) 06/12/06 #counts FM_VEGAS_CASINO 22s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FM_VEGAS_CASINO 22s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body __SEEN_ON_ABC /\bA[^a-z]{0,1}B[^a-z]{0,1}C\b/i body __SEEN_ON_CNN /\bC[^a-z]{0,1}N[^a-z]{0,1}N\b/i body __SEEN_ON_NBC /\bN[^a-z]{0,1}B[^a-z]{0,1}C\b/i body __SEEN_ON_CBS /\bC[^a-z]{0,1}B[^a-z]{0,1}S\b/i body __SEEN_ON_OPRAH /\boprah\b/i body __LOSE_WEIGHT /l.{0,1}o.{0,1}s.{0,1}e.{0,4}w.{0,1}e.{0,1}[i1].{0,1}g.{0,1}h.{0,1}t/i meta FM_WEIGHT_LOSS ((__SEEN_ON_ABC + __SEEN_ON_CNN + __SEEN_ON_NBC + __SEEN_ON_CBS + __LOSE_WEIGHT + __SEEN_ON_OPRAH) > 3) describe FM_WEIGHT_LOSS Looks like oprah weight loss spam. ##score FM_WEIGHT_LOSS 10.357 #counts FM_WEIGHT_LOSS 18s/0h of 32090 corpus (22848s/9242h FVGT) 11/13/06 #counts FM_WEIGHT_LOSS 18s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #====== REPLACE TAG RULES BELOW ============= ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_inter W0 \w? replace_inter SP2 [\s\d_*\$\%(),.:;?!}{\[\]|\/?^\#~\xa1`'+-]? replace_tag GX [gk6] replace_tag IX [ilt|!1y?\xcc\xcd\xce\xcf\xec\xed\xee\xef] replace_tag SX [sz5\xa6\xa7] replace_tag TX [t|] replace_tag UX [u\xb5\xd9\xda\xdb\xdc\xfc\xfb\xfa\xf9\xfd] replace_tag WX (?:[wv]|vv) body FRT_ABSOLUT /\b(?!absolutely)/i describe FRT_ABSOLUT ReplaceTags: Absolutely ##score FRT_ABSOLUT 0.285 replace_rules FRT_ABSOLUT #counts FRT_ABSOLUT 4s/0h of 46241 corpus (36438s/9803h FVGT) 12/14/06 #counts FRT_ABSOLUT 4s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_ADOBE2 /\b(?!adobe)\b/i describe FRT_ADOBE2 ReplaceTags: Adobe ##score FRT_ADOBE2 2.455 replace_rules FRT_ADOBE2 #counts FRT_ADOBE2 2s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_ADOBE2 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_ADULT2 /\b(?!adult)/i describe FRT_ADULT2 ReplaceTags: Adult ##score FRT_ADULT2 1.479 replace_rules FRT_ADULT2 #counts FRT_ADULT2 12s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_ADULT2 16s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_APPROV /\b(?!approv)

/i describe FRT_APPROV ReplaceTags: Approve ##score FRT_APPROV 1.645 replace_rules FRT_APPROV #counts FRT_APPROV 2s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_APPROV 3s/0h of 32386 corpus (23130s/9256h FVGT) 11/14/06 #counts FRT_APPROV 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_BEFORE /\b(?!before)\b/i describe FRT_BEFORE ReplaceTags: Before ##score FRT_BEFORE 1.279 replace_rules FRT_BEFORE #counts FRT_BEFORE 3s/0h of 32386 corpus (23130s/9256h FVGT) 11/14/06 #counts FRT_BEFORE 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_BELOW2 /\b(?!below)\b/i describe FRT_BELOW2 ReplaceTags: Below (2) ##score FRT_BELOW2 2.154 replace_rules FRT_BELOW2 #counts FRT_BELOW2 26s/0h of 32300 corpus (23052s/9248h FVGT) 11/14/06 #counts FRT_BELOW2 28s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_BIGGERMEM1 /(?:|).{1,8}(?:

||)/i describe FRT_BIGGERMEM1 ReplaceTags: Bigger / Larger, Penis / Member ##score FRT_BIGGERMEM1 2.555 replace_rules FRT_BIGGERMEM1 #counts FRT_BIGGERMEM1 17s/0h of 32300 corpus (23052s/9248h FVGT) 11/14/06 #counts FRT_BIGGERMEM1 52s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_CANSPAM /\b(?!CANSPAM)

/i describe FRT_CANSPAM ReplaceTags: Can Spam ##score FRT_CANSPAM 2.232 replace_rules FRT_CANSPAM #counts FRT_CANSPAM 7s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_CANSPAM 26s/0h of 32386 corpus (23130s/9256h FVGT) 11/14/06 #counts FRT_CANSPAM 51s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_CLICK /\b(?!click)\b/i describe FRT_CLICK ReplaceTags: Click ##score FRT_CLICK 1.993 replace_rules FRT_CLICK #counts FRT_CLICK 67s/0h of 32300 corpus (23052s/9248h FVGT) 11/14/06 #counts FRT_CLICK 116s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_COCK /\b(?![cs]ock)/i describe FRT_COCK ReplaceTags: Cock ##score FRT_COCK 1.594 replace_rules FRT_COCK #counts FRT_COCK 18s/0h of 32300 corpus (23052s/9248h FVGT) 11/14/06 #counts FRT_COCK 55s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_CONTACT /\b(?!contr?act)/i describe FRT_CONTACT ReplaceTags: Contact ##score FRT_CONTACT 1.594 replace_rules FRT_CONTACT #counts FRT_CONTACT 10s/0h of 46631 corpus (36802s/9829h FVGT) 12/23/06 #counts FRT_CONTACT 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_DIPLOMA /\b(?!diploma)

/i describe FRT_DIPLOMA ReplaceTags: Diploma ##score FRT_DIPLOMA 1.499 replace_rules FRT_DIPLOMA #counts FRT_DIPLOMA 2s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_DIPLOMA 2s/0h of 32386 corpus (23130s/9256h FVGT) 11/14/06 #counts FRT_DIPLOMA 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_DISCOUNT /\b(?!discount)/i describe FRT_DISCOUNT ReplaceTags: Discount ##score FRT_DISCOUNT 4.495 replace_rules FRT_DISCOUNT #counts FRT_DISCOUNT 24s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_DISCOUNT 32s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_DOLLAR /\b(?!dollar)/i describe FRT_DOLLAR ReplaceTags: Dollar ##score FRT_DOLLAR 2.410 replace_rules FRT_DOLLAR #counts FRT_DOLLAR 8s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_DOLLAR 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_ERECTION /(?!erection)/i describe FRT_ERECTION ReplaceTags: Erection ##score FRT_ERECTION 3.649 replace_rules FRT_ERECTION #counts FRT_ERECTION 25s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_ERECTION 28s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_ESTABLISH /\b(?!estabi?lish)/i describe FRT_ESTABLISH ReplaceTags: Establish ##score FRT_ESTABLISH 2.492 replace_rules FRT_ESTABLISH #counts FRT_ESTABLISH 2s/0h of 40802 corpus (31109s/9693h FVGT) 11/20/06 #counts FRT_ESTABLISH 7s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_ESTABLISH2 /\b(?!estabi?lish)/i describe FRT_ESTABLISH2 ReplaceTags: Establish (2) ##score FRT_ESTABLISH2 2.492 replace_rules FRT_ESTABLISH2 #counts FRT_ESTABLISH2 2s/0h of 40802 corpus (31109s/9693h FVGT) 11/20/06 #counts FRT_ESTABLISH2 7s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_EXPERIENCE /\b(?!experience)

\b/i describe FRT_EXPERIENCE ReplaceTags: Experience ##score FRT_EXPERIENCE 2.333 replace_rules FRT_EXPERIENCE #counts FRT_EXPERIENCE 3s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_EXPERIENCE 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_FOLLOW1 /\b(?!follow)/i describe FRT_FOLLOW1 ReplaceTags: Follow ##score FRT_FOLLOW1 1.432 replace_rules FRT_FOLLOW1 #counts FRT_FOLLOW1 16s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_FOLLOW1 17s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_FOLLOW2 /\b(?!follow)/i describe FRT_FOLLOW2 ReplaceTags: Follow (2) ##score FRT_FOLLOW2 0.422 replace_rules FRT_FOLLOW2 #counts FRT_FOLLOW2 14s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_FOLLOW2 14s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_FREE /\b(?!free)\b/i describe FRT_FREE ReplaceTags: Free ##score FRT_FREE 3.433 replace_rules FRT_FREE #counts FRT_FREE 72s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_FREE 99s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_FRIEND /\b(?!friend)/i describe FRT_FRIEND ReplaceTags: Friend ##score FRT_FRIEND 2.522 replace_rules FRT_FRIEND #counts FRT_FRIEND 6s/0h of 34882 corpus (25258s/9624h FVGT) 11/16/06 #counts FRT_FRIEND 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_FUCK1 /\b(?!fuck)/i describe FRT_FUCK1 ReplaceTags: Fuck (1) ##score FRT_FUCK1 2.534 replace_rules FRT_FUCK1 #counts FRT_FUCK1 3s/0h of 32300 corpus (23052s/9248h FVGT) 11/14/06 #counts FRT_FUCK1 14s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_FUCK2 /\b(?!fuck)/i describe FRT_FUCK2 ReplaceTags: Fuck (2) ##score FRT_FUCK2 3.434 replace_rules FRT_FUCK2 #counts FRT_FUCK2 6s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_FUCK2 15s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_GUARANTEE1 /(?!guarantee)/i describe FRT_GUARANTEE1 ReplaceTags: Guarantee (1) ##score FRT_GUARANTEE1 4.599 replace_rules FRT_GUARANTEE1 #counts FRT_GUARANTEE1 80s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_GUARANTEE1 89s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 #counts FRT_GUARANTEE1 126s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_HEALTH /\b(?!health)\b/i describe FRT_HEALTH ReplaceTags: Health ##score FRT_HEALTH 2.655 replace_rules FRT_HEALTH #counts FRT_HEALTH 1s/0h of 44060 corpus (34282s/9778h FVGT) 12/01/06 #counts FRT_HEALTH 5s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 #counts FRT_HEALTH 11s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_HOUR /\b(?!hour)\b/i describe FRT_HOUR ReplaceTags: Hour ##score FRT_HOUR 1.655 replace_rules FRT_HOUR #counts FRT_HOUR 41s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_HOUR 62s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_INCOME /\b(?!income)\b/i describe FRT_INCOME ReplaceTags: Income ##score FRT_INCOME 3.579 replace_rules FRT_INCOME #counts FRT_INCOME 6s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_INCOME 17s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_INTEREST /\b(?!interest)\b/i describe FRT_INTEREST ReplaceTags: Interest ##score FRT_INTEREST 3.579 replace_rules FRT_INTEREST #counts FRT_INTEREST 8s/0h of 35267 corpus (25646s/9621h FVGT) 11/17/06 #counts FRT_INTEREST 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_INVESTOR /\b(?!investor)/i describe FRT_INVESTOR ReplaceTags: Investor ##score FRT_INVESTOR 1.832 replace_rules FRT_INVESTOR #counts FRT_INVESTOR 13s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_INVESTOR 32s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_LEVITRA /(?!levitra)/i describe FRT_LEVITRA ReplaceTags: Levitra ##score FRT_LEVITRA 1.812 replace_rules FRT_LEVITRA #counts FRT_LEVITRA 2s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_LEVITRA 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_LITTLE /\b(?!little)/i describe FRT_LITTLE ReplaceTags: Little ##score FRT_LITTLE 1.555 replace_rules FRT_LITTLE #counts FRT_LITTLE 1s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_LITTLE 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_LOLITA1 /\b(?!lolita)/i describe FRT_LOLITA1 ReplaceTags: Lolita (1) ##score FRT_LOLITA1 1.865 replace_rules FRT_LOLITA1 #counts FRT_LOLITA1 11s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_LOLITA1 11s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_MEETING /\b(?!meeting)\b/i describe FRT_MEETING ReplaceTags: Meeting ##score FRT_MEETING 2.697 replace_rules FRT_MEETING #counts FRT_MEETING 5s/0h of 34882 corpus (25258s/9624h FVGT) 11/16/06 #counts FRT_MEETING 8s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_OFFER2 /\b(?!offer)/i describe FRT_OFFER2 ReplaceTags: Offer (2) ##score FRT_OFFER2 2.545 replace_rules FRT_OFFER2 #counts FRT_OFFER2 35s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_OFFER2 42s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_OPPORTUN1 /(?!opportun)

/i describe FRT_OPPORTUN1 ReplaceTags: Oppertun (1) ##score FRT_OPPORTUN1 1.893 replace_rules FRT_OPPORTUN1 #counts FRT_OPPORTUN1 12s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_OPPORTUN1 18s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_OPPORTUN2 /(?!opportun)

/i describe FRT_OPPORTUN2 ReplaceTags: Oppertun (2) ##score FRT_OPPORTUN2 1.397 replace_rules FRT_OPPORTUN2 #counts FRT_OPPORTUN2 12s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_OPPORTUN2 15s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_PACKAGE /\b(?!package)

/i describe FRT_PACKAGE ReplaceTags: Package ##score FRT_PACKAGE 1.967 replace_rules FRT_PACKAGE #counts FRT_PACKAGE 6s/0h of 40802 corpus (31109s/9693h FVGT) 11/20/06 #counts FRT_PACKAGE 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_PAYMENT /\b(?!payment)

/i describe FRT_PAYMENT ReplaceTags: Payment ##score FRT_PAYMENT 2.292 replace_rules FRT_PAYMENT #counts FRT_PAYMENT 3s/0h of 32300 corpus (23052s/9248h FVGT) 11/14/06 #counts FRT_PAYMENT 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_PENIS1 /\b(?!pen\s?is)(?!penny[ ']?s)

\b/i describe FRT_PENIS1 ReplaceTags: Penis ##score FRT_PENIS1 3.592 replace_rules FRT_PENIS1 #counts FRT_PENIS1 86s/0h of 32300 corpus (23052s/9248h FVGT) 11/14/06 #counts FRT_PENIS1 147s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_PHARMAC /(?!pharma[c\@])

/i describe FRT_PHARMAC ReplaceTags: Pharmac ##score FRT_PHARMAC 3.193 replace_rules FRT_PHARMAC #counts FRT_PHARMAC 324s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_PHARMAC 619s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_POSSIBLE /\b(?!possible)

\b/i describe FRT_POSSIBLE ReplaceTags: Possible ##score FRT_POSSIBLE 5.697 replace_rules FRT_POSSIBLE #counts FRT_POSSIBLE 6s/0h of 34882 corpus (25258s/9624h FVGT) 11/16/06 #counts FRT_POSSIBLE 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_PRICE /\b(?!price)

\b/i describe FRT_PRICE ReplaceTags: Price ##score FRT_PRICE 3.897 replace_rules FRT_PRICE #counts FRT_PRICE 71s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_PRICE 86s/0h of 33966 corpus (24401s/9565h FVGT) 11/16/06 #counts FRT_PRICE 128s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_PROFILE1 /\b(?!profile)

/i describe FRT_PROFILE1 ReplaceTags: Profile (1) ##score FRT_PROFILE1 2.555 replace_rules FRT_PROFILE1 #counts FRT_PROFILE1 9s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_PROFILE1 9s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_PROFILE2 /\b(?!profile)

/i describe FRT_PROFILE2 ReplaceTags: Profile (2) ##score FRT_PROFILE2 2.111 replace_rules FRT_PROFILE2 #counts FRT_PROFILE2 8s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_PROFILE2 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_PROFIT1 /\b(?!profit)

/i describe FRT_PROFIT1 ReplaceTags: Profit (1) ##score FRT_PROFIT1 3.858 replace_rules FRT_PROFIT1 #counts FRT_PROFIT1 37s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_PROFIT1 41s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_PROFIT2 /\b(?!profit)

/i describe FRT_PROFIT2 ReplaceTags: Profit (2) ##score FRT_PROFIT2 10.357 replace_rules FRT_PROFIT2 #counts FRT_PROFIT2 3s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_PROFIT2 56s/0h of 33966 corpus (24401s/9565h FVGT) 11/16/06 #counts FRT_PROFIT2 57s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_PUSSY /\b(?!pussy)

/i describe FRT_PUSSY ReplaceTags: Pussy ##score FRT_PUSSY 0.285 replace_rules FRT_PUSSY #counts FRT_PUSSY 2s/0h of 46241 corpus (36438s/9803h FVGT) 12/14/06 #counts FRT_PUSSY 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_REFINANCE1 /\b(?!refinanc)/i describe FRT_REFINANCE1 ReplaceTags: Refinance (1) ##score FRT_REFINANCE1 2.934 replace_rules FRT_REFINANCE1 #counts FRT_REFINANCE1 18s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_REFINANCE1 24s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_ROLEX /\b(?!rolex)/i describe FRT_ROLEX ReplaceTags: Rolex ##score FRT_ROLEX 3.878 replace_rules FRT_ROLEX #counts FRT_ROLEX 5s/0h of 32300 corpus (23052s/9248h FVGT) 11/14/06 #counts FRT_ROLEX 15s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_SEXUAL /\b(?!sexual)/i describe FRT_SEXUAL ReplaceTags: Sexual ##score FRT_SEXUAL 3.777 replace_rules FRT_SEXUAL #counts FRT_SEXUAL 93s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_SEXUAL 95s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FRT_SEXUAL 102s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_SLUT /\b(?!slut)/ describe FRT_SLUT ReplaceTags: Slut ##score FRT_SLUT 2.522 replace_rules FRT_SLUT #counts FRT_SLUT 1s/0h of 34882 corpus (25258s/9624h FVGT) 11/16/06 #counts FRT_SLUT 11s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FRT_SLUT 11s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_SOMA /\b(?!soma|500mg)\b/i describe FRT_SOMA ReplaceTags: Soma ##score FRT_SOMA 2.264 replace_rules FRT_SOMA #counts FRT_SOMA 54s/0h of 32386 corpus (23130s/9256h FVGT) 11/14/06 #counts FRT_SOMA 141s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FRT_SOMA 234s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_SOMA2 /\b(?!soma|500? ?mg)\b/i describe FRT_SOMA2 ReplaceTags: Soma (2) ##score FRT_SOMA2 2.199 replace_rules FRT_SOMA2 #counts FRT_SOMA2 96s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FRT_SOMA2 107s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_STOCK1 /\b(?!stock)/i describe FRT_STOCK1 ReplaceTags: Stock (1) ##score FRT_STOCK1 2.988 replace_rules FRT_STOCK1 #counts FRT_STOCK1 156s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_STOCK1 161s/0h of 33966 corpus (24401s/9565h FVGT) 11/16/06 #counts FRT_STOCK1 167s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_STOCK2 /\b(?!stor?ck)/i describe FRT_STOCK2 ReplaceTags: Stock (2) ##score FRT_STOCK2 2.988 replace_rules FRT_STOCK2 #counts FRT_STOCK2 135s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_STOCK2 136s/0h of 33966 corpus (24401s/9565h FVGT) 11/16/06 #counts FRT_STOCK2 141s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_STRONG1 /\b(?!stro\s?ng)\b/i describe FRT_STRONG1 ReplaceTags: Strong (1) ##score FRT_STRONG1 2.352 replace_rules FRT_STRONG1 #counts FRT_STRONG1 96s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_STRONG1 98s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_STRONG2 /\b(?!strong)\b/i describe FRT_STRONG2 ReplaceTags: Strong (2) ##score FRT_STRONG2 1.535 replace_rules FRT_STRONG2 #counts FRT_STRONG2 3s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_STRONG2 9s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_SYMBOL /\b(?!symbol)/i describe FRT_SYMBOL ReplaceTags: Symbol ##score FRT_SYMBOL 2.932 replace_rules FRT_SYMBOL #counts FRT_SYMBOL 15s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_SYMBOL 21s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_TODAY2 /\b(?!today)/i describe FRT_TODAY2 ReplaceTags: Today (2) ##score FRT_TODAY2 2.648 replace_rules FRT_TODAY2 #counts FRT_TODAY2 16s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_TODAY2 16s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_VALIUM1 /\b(?!valium|verifiquem)\b/i describe FRT_VALIUM1 ReplaceTags: Valium ##score FRT_VALIUM1 10.357 replace_rules FRT_VALIUM1 #counts FRT_VALIUM1 159s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_VALIUM1 183s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FRT_VALIUM1 183s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_VALIUM2 /\b(?!valium)\b/i describe FRT_VALIUM2 ReplaceTags: Valium (2) ##score FRT_VALIUM2 2.843 replace_rules FRT_VALIUM2 #counts FRT_VALIUM2 112s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_VALIUM2 112s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 #counts FRT_VALIUM2 108s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_VIRGIN1 /(?!virgin)?\b/i describe FRT_VIRGIN1 ReplaceTags: Virgin (1) ##score FRT_VIRGIN1 2.887 replace_rules FRT_VIRGIN1 #counts FRT_VIRGIN1 10s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_VIRGIN1 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_WEIGHT2 /\b(?!weight)/i describe FRT_WEIGHT2 ReplaceTags: Weight (2) ##score FRT_WEIGHT2 2.442 replace_rules FRT_WEIGHT2 #counts FRT_WEIGHT2 6s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_WEIGHT2 13s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 #counts FRT_WEIGHT2 12s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_XANAX1 /\b(?!xanax)\b/i describe FRT_XANAX1 ReplaceTags: Xanax (1) ##score FRT_XANAX1 2.775 replace_rules FRT_XANAX1 #counts FRT_XANAX1 24s/0h of 32300 corpus (23052s/9248h FVGT) 11/14/06 #counts FRT_XANAX1 29s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 body FRT_XANAX2 /\b(?!xanax)\b/i describe FRT_XANAX2 ReplaceTags: Xanax (2) ##score FRT_XANAX2 2.892 replace_rules FRT_XANAX2 #counts FRT_XANAX2 69s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 #counts FRT_XANAX2 72s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 endif # Mail::SpamAssassin::Plugin::ReplaceTags # EOF