## AXB-2012-09-19 - DISABLED This was bad in 2004 and also a performance killer
##
## rulesrc/sandbox/khopesh/20_chickenpox.cf (10 rules, 9 bad):
##
##   J_CHICKENPOX_12:  bad, avg S/O=0.36 avg Spam%=0.38 avg Ham%=0.61
##   J_CHICKENPOX_13:  bad, avg S/O=0.19 avg Spam%=0.17 avg Ham%=0.88
##   J_CHICKENPOX_14:  bad, avg S/O=0.52 avg Spam%=0.29 avg Ham%=0.26
##   J_CHICKENPOX_22:  bad, avg S/O=0.43 avg Spam%=0.54 avg Ham%=0.73
##   J_CHICKENPOX_23:  bad, avg S/O=0.31 avg Spam%=0.52 avg Ham%=1.17
##   J_CHICKENPOX_24:  bad, avg S/O=0.42 avg Spam%=0.18 avg Ham%=0.21
##   J_CHICKENPOX_26:  bad, avg S/O=0.32 avg Spam%=0.07 avg Ham%=0.14
##   J_CHICKENPOX_33:  bad, avg S/O=0.25 avg Spam%=0.34 avg Ham%=1.04
##   J_CHICKENPOX_65:  bad, avg S/O=0.45 avg Spam%=0.60 avg Ham%=0.72
#
## From chickenpox.cf by Jennifer Wheeler
## http://wiki.apache.org/spamassassin/CustomRulesets#line-63
##
## If these perform well, we can consider testing more of them;
## their performance five years ago wasn't so stellar (these were >1.5% spam),
## http://wiki.apache.org/spamassassin/MasscheckChickenpox (2004-02-06)
## TODO: verify license before removing nopublish
#
#describe J_CHICKENPOX_12  Obfuscated text: 1alpha-pock-2alpha
#body     J_CHICKENPOX_12  m/\s(?![cdjlmnosyx][`'"])[a-zA-Z]{1}[.,\;:?%!+^~`'\$*=\#|013467\(\)\[\]\{\}<>"][a-zA-Z]{2}(?<!\.(?:(?-i:[A-Z][a-z]{1})|a[eiu]|b[ebmrsz]|c[afhnrx]|d[bek]|es|f[ir]|g[uz]|h[knrtu]|i[elnqrst]|j[mops]|k[prwy]|m[cfkpx]|n[loz]|p[lmrsty]|ru|s[eghm]|t[cnv]|u[ksu]|v[gi])|:no|['`"](?:[il]l|ve|on))(?:[,'\?!]|\.?\s)/i
#score    J_CHICKENPOX_12  0.6
#tflags   J_CHICKENPOX_12  nopublish
#
#describe J_CHICKENPOX_13  Obfuscated text: 1alpha-pock-3alpha
#body     J_CHICKENPOX_13  m/\s(?![acdgjlmnosx][`'"])[a-zA-Z]{1}[.,\;:?%!&+^~`'\$*=\#|013467\(\)\[\]\{\}<>"][a-zA-Z]{3}(?<!\.(?:(?-i:[A-Z][a-z]{2})|a(?:sc|sp|ux)|b(?:ak|at|iz|in|ks|mk|mp)|c(?:fg|gi|nf|om|pp|s[s])|d(?:at|ll|mg|oc)|e(?:du|nt|xe|xt)|g(?:if|ov)|htm|i(?:co|di|mg|nc|nf|ni)|jpg|l(?:ib|og)|m(?:ap|bs|il|p[eg])|net|org|p(?:df|fb|hp|i[df]|ng|pt|sd)|raw|s(?:cr|ql|ty|ys)|t(?:ar|ex|ld|mp|tf|xt)|usr|w(?:av|pi)|x(?:ls|ml|sl)|zip)|[`'"]all)(?:[,'\?!]|\.?\s)/i
#score    J_CHICKENPOX_13  0.6
#tflags   J_CHICKENPOX_13  nopublish
#
#describe J_CHICKENPOX_14  Obfuscated text: 1alpha-pock-4alpha
#body     J_CHICKENPOX_14  m/\s(?!(?:[cdgjlmnosx][`'"]|a:))[a-zA-Z]{1}[.,\;:?%!&+^~`'\$*=\#|013467\(\)\[\]\{\}<>"][a-zA-Z]{4}(?<!\.(?:(?-i:[A-Z][a-z]{3})|aero|c(?:onf|oop)|html|in(?:fo|it)|jpeg|m(?:ail|idi|peg)|name|sgml|tiff)|:mail)(?:[,'\?!]|\.?\s)/i
#score    J_CHICKENPOX_14  0.6
#tflags   J_CHICKENPOX_14  nopublish
#
#describe J_CHICKENPOX_22  Obfuscated text: 2alpha-pock-2alpha
#body     J_CHICKENPOX_22  m/\s(?!(?:fn|re):|(?:cc|to)=|(?:ma|qu|un)[`'"]|(?:dr|m[rst]|li|st|td)\.)[a-zA-Z]{2}[.,\;:?%!&+^~`'\$*=\#|013467\(\)\[\]\{\}<>"][a-zA-Z]{2}(?<!\.(?:(?-i:[A-Z][a-z]{1})|a[eiu]|b[ebmrsz]|c[afhnrx]|d[bek]|es|f[ir]|g[uz]|h[knrtu]|i[elnqrst]|j[mops]|k[prwy]|m[cfkpx]|n[loz]|p[lmrsty]|ru|s[eghm]|t[cnv]|u[ksu]|v[gi])|:no|['`"](?:ed|ll|[rv]e))(?:[,'\?!]|\.?\s)/i
#score    J_CHICKENPOX_22  0.6
#tflags   J_CHICKENPOX_22  nopublish
#
#describe J_CHICKENPOX_23  Obfuscated text: 2alpha-pock-3alpha
#body     J_CHICKENPOX_23  m/\s(?!(?:fn|re):|(?:cc|to)=|(?:qu|un)[`'"]|(?:dr|m[rst]|li|st|td)\.)[a-zA-Z]{2}[.,\;:?%!&+^~`'\$*=\#|013467\(\)\[\]\{\}<>"][a-zA-Z]{3}(?<!\.(?:(?-i:[A-Z][a-z]{2})|a(?:sc|sp|ux)|b(?:ak|at|iz|in|ks|mk|mp)|c(?:fg|gi|nf|om|pp|s[s])|d(?:at|ll|mg|oc)|e(?:du|nt|xe|xt)|g(?:if|ov)|htm|i(?:co|di|mg|nc|nf|ni)|jpg|l(?:ib|og)|m(?:ap|bs|il|p[eg])|net|org|p(?:df|fb|hp|i[df]|ng|pt|sd)|raw|s(?:cr|ql|ty|ys)|t(?:ar|ex|ld|mp|tf|xt)|usr|w(?:av|pi)|x(?:ls|ml|sl)|zip)|['`"]tje)(?:[,'\?!]|\.?\s)/i
#score    J_CHICKENPOX_23  0.6
#tflags   J_CHICKENPOX_23  nopublish
#
#describe J_CHICKENPOX_24  Obfuscated text: 2alpha-pock-4alpha
#body     J_CHICKENPOX_24  m/\s(?!(?:fn|re):|(?:cc|to)=|(?:qu|un)[`'"]|(?:dr|m[rst]|li|st|td)\.)[a-zA-Z]{2}[.,\;:?%!&+^~`'\$*=\#|013467\(\)\[\]\{\}<>"][a-zA-Z]{4}(?<!\.(?:(?-i:[A-Z][a-z]{3})|aero|c(?:onf|oop)|html|in(?:fo|it)|jpeg|m(?:ail|idi|peg)|name|sgml|tiff))(?:[,'\?!]|\.?\s)/i
#score    J_CHICKENPOX_24  0.6
#tflags   J_CHICKENPOX_24  nopublish
#
#describe J_CHICKENPOX_26  Obfuscated text: 2alpha-pock-6alpha
#body     J_CHICKENPOX_26  m/\s(?!(?:fn|re):|(?:cc|to)=|(?:qu|un)[`'"]|(?:dr|m[rst]|li|st|td)\.)[a-zA-Z]{2}[.,\;:?%!&+^~`'\$*=\#|013467\(\)\[\]\{\}<>"][a-zA-Z]{6}(?<!\.(?:(?-i:[A-Z][a-z]{5})|museum))(?:[,'\?!]|\.?\s)/i
#score    J_CHICKENPOX_26  0.6
#tflags   J_CHICKENPOX_26  nopublish
#
#describe J_CHICKENPOX_32  Obfuscated text: 3alpha-pock-2alpha
#body     J_CHICKENPOX_32  m/\s(?!(?:alt|biz|mrs|rev|s(?:ci|en|oc))\.|(?:end|fwd|org|reg):|pop3|[cd]os')[a-zA-Z]{3}[.,\;:?%!&+^~`'\$*=\#|013467\(\)\[\]\{\}<>"][a-zA-Z]{2}(?<!\.(?:(?-i:[A-Z][a-z]{1})|a[eiu]|b[ebmrsz]|c[afhnrx]|d[bek]|es|f[ir]|g[uz]|h[knrtu]|i[elnqrst]|j[mops]|k[prwy]|m[cfkpx]|n[loz]|p[lmrsty]|ru|s[eghm]|t[cnv]|u[ksu]|v[gi])|:no|['`"](?:ed|ll|ts|[rv]e))(?:[,'\?!]|\.?\s)/i
#score    J_CHICKENPOX_32  0.6
#tflags   J_CHICKENPOX_32  nopublish
#
#describe J_CHICKENPOX_33  Obfuscated text: 3alpha-pock-3alpha
#body     J_CHICKENPOX_33  m/\s(?!(?:alt|biz|mrs|rev|s(?:ci|en|oc))\.|(?:end|fwd|org|reg):|pop3|cos')[a-zA-Z]{3}[.,\;:?%!&+^~`'\$*=\#|013467\(\)\[\]\{\}<>"][a-zA-Z]{3}(?<!\.(?:(?-i:[A-Z][a-z]{2})|a(?:sc|sp|ux)|b(?:ak|at|iz|in|ks|mk|mp)|c(?:fg|gi|nf|om|pp|s[s])|d(?:at|ll|mg|oc)|e(?:du|nt|xe|xt)|g(?:if|ov)|htm|i(?:co|di|mg|nc|nf|ni)|jpg|l(?:ib|og)|m(?:ap|bs|il|p[eg])|net|org|p(?:df|fb|hp|i[df]|ng|pt|sd)|raw|s(?:cr|ql|ty|ys)|t(?:ar|ex|ld|mp|tf|xt)|usr|w(?:av|pi)|x(?:ls|ml|sl)|zip)|['`"]tje)(?:[,'\?!]|\.?\s)/i
#score    J_CHICKENPOX_33  0.6
#tflags   J_CHICKENPOX_33  nopublish
#
#describe J_CHICKENPOX_65  Obfuscated text: 6alpha-pock-5alpha
#body     J_CHICKENPOX_65  m/\s(?!(?:(?:bord|mail)er|format|target)=)[a-zA-Z]{6}[.,\;:?%!&+^~`'\$*=\#|013467\(\)\[\]\{\}<>"][a-zA-Z]{5}(?<!\.(?:(?-i:[A-Z][a-z]{4})|shtml)|=(?:esmtp|local))(?:[,'\?!]|\.?\s)/i
#score    J_CHICKENPOX_65  0.6
#tflags   J_CHICKENPOX_65  nopublish
#