######################################################################\ ## Fred's Collection of Rules File 001 #\ ## Version: 0.00.17 #\ ## Created: 10/30/2006 # ## Modified: 12/23/2006 # ## Current Maintainer: Frederic Tarasevicius - tech2@i-is.com # ## Current Home: http://www.rulesemporium.com/rules/00_FVGT_File001.cf # ## 01/2014: Some rules migrated to JHardin sandbox prior to file retirement # ## License: http://www.apache.org/licenses/LICENSE-2.0 # ######################################################################### ## *** PLEASE READ ** PLEASE READ ** PLEASE READ ** PLEASE READ ******* # ## *** Most of these are rules are scored very high, use caution! ***** # ######################################################################### ## # ## -> SOME RULES REQUIRE THAT YOU HAVE TRUSTED_NETWORKS SET PROPERLY <- # ## # ######################################################################### ## v0.00.13 = 11/24/2006 - Spam identified as spam by these rules: 23276 of 33482 69.5% ## v0.00.14 = 11/30/2006 - Spam identified as spam by these rules: 24241 of 34698 69.8% ## v0.00.15 = 12/04/2006 - Spam identified as spam by these rules: 24830 of 34870 71.2% ## v0.00.16 = Minor tweaks to scores for FP reports. ## v0.00.17 = Changed License to Apache v2 ## v0.00.17 = 12/23/2006 - Spam identified as spam by these rules: 27051 of 37183 72.7% ## ## 442 Rules included ## ############################################# ######## START NEWEST RULES / 0 Day ######### ## These rules are the freshest to this set # ## I keep them near the top for observation # ############################################# # # #header FH_MSGID_XXBLAH MESSAGEID =~ /6c822ecf/ #describe FH_MSGID_XXBLAH Common sign in msg-id's 12/21/2006 ###score FH_MSGID_XXBLAH 10.357 ##counts FH_MSGID_XXBLAH 254s/0h of 44365 corpus (34562s/9803h FVGT) 12/21/06 ##counts FH_MSGID_XXBLAH 255s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_LETTERS_21B /-- [a-z]{21}/ #describe FB_LETTERS_21B Special people leave special signs! ###score FB_LETTERS_21B 10.357 ##counts FB_LETTERS_28B 105s/0h of 44365 corpus (34562s/9803h FVGT) 12/21/06 ##counts FB_LETTERS_21B 225s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # # #body __F_LARGE_MONEY /\d\d\d,\d\d\d/ #body __F_LARGE_MONEY_2 /\d\d?\s?(?:thousand|(?:m|b|tr)illion)/i #meta __FM_LARGE_MONEY (__F_LARGE_MONEY || __F_LARGE_MONEY_2) #body __YOU_HAVE_WON /you(?: \w+)? won/i #body __FB_CONGRADS /Congratulations/i #meta __YOU_WON_SOMTIN (__YOU_HAVE_WON || __FB_CONGRADS) ##body __FB_NATIONAL /national/i #body __FB_LOTTERY /lottery/i #meta __FM_NAT_LOTTERY (__FB_NATIONAL && __FB_LOTTERY) # #meta FM_LOTTO_MONEY (__FM_LARGE_MONEY && __FM_NAT_LOTTERY) #describe FM_LOTTO_MONEY Talks about lotto and large money! ###score FM_LOTTO_MONEY 2.011 ##counts FM_LOTTO_MONEY 48s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #meta FM_LOTTO_YOU_WON (__FM_LARGE_MONEY && __FM_NAT_LOTTERY && __YOU_WON_SOMTIN) #describe FM_LOTTO_YOU_WON Talks about lotto and you won! ###score FM_LOTTO_YOU_WON 3.741 ##counts FM_LOTTO_YOU_WON 45s/0h of 46631 corpus (36802s/9829h FVGT) 12/23/06 # # # #body FB_EXP_POWER_OF /Experience the power of/i #describe FB_EXP_POWER_OF Phrase: Experience the power of ###score FB_EXP_POWER_OF 0.991 ##counts FB_EXP_POWER_OF 2s/0h of 46631 corpus (36802s/9829h FVGT) 12/23/06 # # # #body __FB_PPLE_ARE_SEARCH /(?:People|they) are searching/i #body __FB_COULD_NOT_F /could not find you/i #meta FM_PEOPLE_LOOK_4ME (__FB_PPLE_ARE_SEARCH && __FB_COULD_NOT_F) #describe FM_PEOPLE_LOOK_4ME People are looking for me? ###score FM_PEOPLE_LOOK_4ME 2.922 ##counts FM_PEOPLE_LOOK_4ME 1s/0h of 46631 corpus (36802s/9829h FVGT) 12/23/06 # # #header FH_BAD_OEV1441 X-Mailer =~ /^Microsoft Outlook Express 6\.00\.2800\.1441$/ #describe FH_BAD_OEV1441 Bad X-Mailer version ###score FH_BAD_OEV1441 4.555 ##counts FH_BAD_OEV1441 66s/0h of 46631 corpus (36802s/9829h FVGT) 12/23/06 # # # ##Combine SARE RANDOM Active Rules into single rule. #header __ALL_RANDOM ALL =~ /(?:[%\#\[\$]R?A?NDO?M?|\%(?:CUSTOM|FROM|PROXY|X?MESSA|MAKE_TXT|FROM_USER))/i #rawbody __RAW_RANDOM /(?:[%\#\[\$]RA?NDO?M?|\%(?:CUSTOM|FROM|PROXY|X?MESSA|MAKE_TXT))/i #meta FH_RANDOM_SURE (__ALL_RANDOM || __RAW_RANDOM) #describe FH_RANDOM_SURE SARE Random in one rule. ##Setting 0.50 score ceiling on 1/16/2014 due to FPs #score FH_RANDOM_SURE 0.50 ##counts FH_RANDOM_SURE 221s/0h of 46241 corpus (36438s/9803h FVGT) 12/14/06 ##counts FH_RANDOM_SURE 225s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_MSGID_01C67 Message-ID =~ /^<000001c[67]/ #describe FH_MSGID_01C67 Special MSGID ###score FH_MSGID_01C67 1.968 ##counts FH_MSGID_01C67 9212s/3h of 45714 corpus (35935s/9779h FVGT) 12/08/06 ##counts FH_MSGID_01C67 9200s/3h of 46241 corpus (36438s/9803h FVGT) 12/14/06 ##counts FH_MSGID_01C67 9480s/3h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_HAS_X exists:X #describe FH_HAS_X Has X: header ###score FH_HAS_X 10.357 ##counts FH_HAS_X 32s/0h of 46241 corpus (36438s/9803h FVGT) 12/14/06 ##counts FH_HAS_X 32s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_HAS_XAIMC exists:X-AIMC-AUTH #describe FH_HAS_XAIMC Has X-AIMC-AUTH header ###score FH_HAS_XAIMC 10.357 ##counts FH_HAS_XAIMC 3s/0h of 46241 corpus (36438s/9803h FVGT) 12/14/06 ##counts FH_HAS_XAIMC 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_HAS_XCVBN exists:X-CVBN #describe FH_HAS_XCVBN Has X-CVBN header ###score FH_HAS_XCVBN 10.357 ##counts FH_HAS_XCVBN 3s/0h of 46241 corpus (36438s/9803h FVGT) 12/14/06 ##counts FH_HAS_XCVBN 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_BAD_MSOE14 X-Mailer =~ /^Microsoft Outlook Express 6\.00\.1400\.14$/ #describe FH_BAD_MSOE14 Bad OE version ###score FH_BAD_MSOE14 10.357 ##counts FH_BAD_MSOE14 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##X-WBC #header FH_HAS_X_WBC exists:X-WBC #describe FH_HAS_X_WBC Has X-WBC header ###score FH_HAS_X_WBC 2.439 ##counts FH_HAS_X_WBC 4s/0h of 46241 corpus (36438s/9803h FVGT) 12/14/06 ##counts FH_HAS_X_WBC 4s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_MSGID_000000 MESSAGEID =~ /\$00000000\@/ #describe FH_MSGID_000000 Special MSGID ###score FH_MSGID_000000 10 10 10 10 ##counts FH_MSGID_000000 51s/0h of 45714 corpus (35935s/9779h FVGT) 12/08/06 ##counts FH_MSGID_000000 91s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##X-FGHJ: znsvtbnaabivfviwftfwfbsm vbaipfnfmspiafmwt vawsapvwvm #header FH_HAS_XFGHJ exists:X-FGHJ #describe FH_HAS_XFGHJ Has X-FGHJ ###score FH_HAS_XFGHJ 10 5 5 3 ##counts FH_HAS_XFGHJ 12s/0h of 44357 corpus (34582s/9775h FVGT) 12/04/06 ##counts FH_HAS_XFGHJ 19s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_XMAIL_HEX20 X-Mailer =~ /^[A-F0-9]{6,10}\.[A-F0-9]{6,10}\.[a-f0-9]{6,10}/ #describe FH_XMAIL_HEX20 Special HEX X-Mailer ###score FH_XMAIL_HEX20 10 4 4 3 ##counts FH_XMAIL_HEX20 1s/0h of 44357 corpus (34582s/9775h FVGT) 12/04/06 ##counts FH_XMAIL_HEX20 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_HAS_XBBO exists:X-BBounce #describe FH_HAS_XBBO Has X-BBounce ###score FH_HAS_XBBO 10 4 4 3 ##counts FH_HAS_XBBO 61s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 ##counts FH_HAS_XBBO 80s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_REPL_TOKEN Subject =~ /\{Token1\}/i #describe FS_REPL_TOKEN Subject has Replacement Token ###score FS_REPL_TOKEN 10 10 10 10 ##counts FS_REPL_TOKEN 0s/0h of 44357 corpus (34582s/9775h FVGT) 12/04/06 ##counts FS_REPL_TOKEN 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FM_XMAIL_F_OUT X-Mailer =~ /Microsoft Outlook Express V6.00.2900.2180/ #describe FM_XMAIL_F_OUT Looks like Fake Outlook? ###score FM_XMAIL_F_OUT 10 ##counts FM_XMAIL_F_OUT 514s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 ##counts FM_XMAIL_F_OUT 917s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_XCON_HAS_EQ X-Contact =~ /=/ #describe FH_XCON_HAS_EQ X-Contact has = ###score FH_XCON_HAS_EQ 2 1 1 0.5 ##counts FH_XCON_HAS_EQ 10s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 ##counts FH_XCON_HAS_EQ 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_HAS_XOVE exists:X-OVE #describe FH_HAS_XOVE Has X-OVE ###score FH_HAS_XOVE 10 10 10 5 ##counts FH_HAS_XOVE 434s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 ##counts FH_HAS_XOVE 442s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##X-ID: "1167502916049" #header FH_HAS_XID exists:X-ID #describe FH_HAS_XID Has X-ID ###score FH_HAS_XID 10 3.1 3.1 2.5 ##counts FH_HAS_XID 1224s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 ##counts FH_HAS_XID 1232s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##X-UIOP: alovoltujjmvyvmluerjojeo ryjlkrumvuvjylmytrj vrjvytetjy #header FH_HAS_XUIOP exists:X-UIOP #describe FH_HAS_XUIOP Has X-UIOP ###score FH_HAS_XUIOP 10 5 5 3 ##counts FH_HAS_XUIOP 20s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 ##counts FH_HAS_XUIOP 21s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_XMAIL_RND_833 X-Mailer =~ /^[a-z]{3}\sv8\.3\.3\./ #describe FH_XMAIL_RND_833 Special X-Mailer Version ###score FH_XMAIL_RND_833 17 10 10 10 ##counts FH_XMAIL_RND_833 53s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 ##counts FH_XMAIL_RND_833 198s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_RAMROD Subject =~ /ramrod/i #describe FS_RAMROD Subject says Ramrod ###score FS_RAMROD 10 5 5 3 ##counts FS_RAMROD 0s/0h of 44060 corpus (34282s/9778h FVGT) 12/01/06 ##counts FS_RAMROD 3s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 ##counts FS_RAMROD 7s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_WITH_SMALL Subject =~ /with (?:\w+\s)?(?:small|short)/i #describe FS_WITH_SMALL Subject says With ... small ###score FS_WITH_SMALL 3 ##counts FS_WITH_SMALL 6s/0h of 44060 corpus (34282s/9778h FVGT) 12/01/06 ##counts FS_WITH_SMALL 9s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 ##counts FS_WITH_SMALL 12s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_MSGID_REPLACE MESSAGEID =~ /^<%MSGID/ #describe FH_MSGID_REPLACE Broken Replace Template ###score FH_MSGID_REPLACE 10 10 10 10 ##counts FH_MSGID_REPLACE 2s/0h of 44060 corpus (34282s/9778h FVGT) 12/01/06 ##counts FH_MSGID_REPLACE 23s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 ##counts FH_MSGID_REPLACE 23s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_XMAIL_REPLACE X-Mailer =~ /%XMAILER/ #describe FH_XMAIL_REPLACE Broken Replace Template ###score FH_XMAIL_REPLACE 10 10 10 10 ##counts FH_XMAIL_REPLACE 2s/0h of 44060 corpus (34282s/9778h FVGT) 12/01/06 ##counts FH_XMAIL_REPLACE 23s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 ##counts FH_XMAIL_REPLACE 23s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_ADD_INCHES /(?:add|gain) inches/i #describe FB_ADD_INCHES Add / Gain inches ###score FB_ADD_INCHES 4 2.2 2.2 1.8 ##counts FB_ADD_INCHES 22s/0h of 44060 corpus (34282s/9778h FVGT) 12/01/06 ##counts FB_ADD_INCHES 25s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 ##counts FB_ADD_INCHES 27s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # # ##Message-ID: <01c70f9e$adc3acc0$987ba8c0@dabushb> ##Message-ID: <01c70e80$416884c0$6501a8c0@CLIENT3> ##Message-ID: <01c70fc7$5bf945c0$aef1b250@URINAYAD> ##Message-ID: <01c70fc9$e55514f0$9500a8c0@plwn3pt0ufq4raf> ##Message-ID: <01c70f73$c056fb10$de49f952@nomanvmb2qxoqa> ##Message-ID: <01c70f9b$e98036f0$7ac1e455@anderssoe10f8c> #header __FH_MSGID_01C7 MESSAGEID =~ /^<0{1,5}1c7/ ##header __FH_HAS_XMSMAIL exists:X-MSMail-Priority ##header __FH_HAS_XPRIORITY exists:X-Priority ##header __FS_SUBJ_RE Subject =~ /^Re: / #meta FM_RE_HELLO_SPAM (__FH_MSGID_01C7 && __FH_HAS_XMSMAIL && __FH_HAS_XPRIORITY && __FS_SUBJ_RE) #describe FM_RE_HELLO_SPAM Re: Hello / hi ###score FM_RE_HELLO_SPAM 10 10 10 10 ##counts FM_RE_HELLO_SPAM 2s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 ##counts FM_RE_HELLO_SPAM 3181s/0h of 43779 corpus (34015s/9764h FVGT) 11/28/06 ##counts FM_RE_HELLO_SPAM 3456s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FM_RE_HELLO_SPAM 4162s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_DDDD_BUCKS /\d{4} bucks/ #describe FB_DDDD_BUCKS We use comma's and it's dollars not bucks! ###score FB_DDDD_BUCKS 4 ##counts FB_DDDD_BUCKS 16s/0h of 43891 corpus (34132s/9759h FVGT) 11/30/06 ##counts FB_DDDD_BUCKS 19s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FB_DDDD_BUCKS 34s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_HOST_IN_ADDRARPA X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]{0,25}\.in-addr\.arpa / #describe FH_HOST_IN_ADDRARPA HOST dns says "in-addr.arpa" ###score FH_HOST_IN_ADDRARPA 3.9 2 2 1 ##counts FH_HOST_IN_ADDRARPA 20s/0h of 43891 corpus (34132s/9759h FVGT) 11/30/06 ##counts FH_HOST_IN_ADDRARPA 22s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FH_HOST_IN_ADDRARPA 27s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_IMAGIRL /i am a girl/i #describe FB_IMAGIRL Phrae: I am a girl ###score FB_IMAGIRL 10 4 4 2 ##counts FB_IMAGIRL 9s/0h of 42912 corpus (33149s/9763h FVGT) 11/27/06 ##counts FB_IMAGIRL 10s/0h of 43779 corpus (34015s/9764h FVGT) 11/28/06 ##counts FB_IMAGIRL 11s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FB_IMAGIRL 11s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##header __SUBJ_LOWER ALL =~ /subject:\s\S{5}/ ##header __FROM_LOWER ALL =~ /from:\s\S{5}/ ##header __TO___LOWER ALL =~ /to:\s\S{5}/ ##header __DATE_LOWER ALL =~ /date:\s\S{5}/ #meta FM_LOWER_CASE_HEAD (__SUBJ_LOWER && __FROM_LOWER && __TO___LOWER && __DATE_LOWER) #describe FM_LOWER_CASE_HEAD Lots of headers with lower case. ###score FM_LOWER_CASE_HEAD 10 5 5 4 ##counts LOWER_CASE_HEAD 3s/0h of 43763 corpus (34000s/9763h FVGT) 11/28/06 ##counts LOWER_CASE_HEAD 3s/0h of 43891 corpus (34132s/9759h FVGT) 11/30/06 ##counts FM_LOWER_CASE_HEAD 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_REPLIC_CAP /REPLICAS?\b/ #describe FB_REPLIC_CAP Phrase: REPLICA ###score FB_REPLIC_CAP 2.5 2 2 1 ##counts FB_REPLIC_CAP 26s/0h of 211884 corpus (204373s/7511h FT) 12/08/05 ##counts FB_REPLIC_CAP 13s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_REPLIC_CAP 16s/0h of 42912 corpus (33149s/9763h FVGT) 11/27/06 ##counts FB_REPLIC_CAP 16s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FB_REPLIC_CAP 16s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body __F_FUCK /\bfuck\b/i #body __F_ASS /\bass\b/i #body __F_TEEN /teens?\b/i #meta FM_FUCK_ASS_TEEN (__F_FUCK && __F_ASS && __F_TEEN) ###score FM_FUCK_ASS_TEEN 10.357 ##counts FM_FUCK_ASS_TEEN 1s/0h of 42912 corpus (33149s/9763h FVGT) 11/27/06 ##counts FM_FUCK_ASS_TEEN 2s/0h of 43779 corpus (34015s/9764h FVGT) 11/28/06 ##counts FM_FUCK_ASS_TEEN 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body __FB_P_TRUELOVE /true love/i #body __FB_P_ALLNIGHT /all night!/i #meta FM_TRUE_LOV_ALL_N (__FB_P_TRUELOVE && __FB_P_ALLNIGHT) #describe FM_TRUE_LOV_ALL_N True Love all Night! ###score FM_TRUE_LOV_ALL_N 10.357 ##counts FM_TRUE_LOV_ALL_N 0s/0h of 42054 corpus (32293s/9761h FVGT) 11/24/06 ##counts FM_TRUE_LOV_ALL_N 41s/0h of 42912 corpus (33149s/9763h FVGT) 11/27/06 ##counts FM_TRUE_LOV_ALL_N 48s/0h of 43779 corpus (34015s/9764h FVGT) 11/28/06 ##counts FM_TRUE_LOV_ALL_N 57s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #uri FU_ENDS_SG m'/sg$'i #describe FU_ENDS_SG URL ends with /sg ###score FU_ENDS_SG 10.357 ##counts FU_ENDS_SG 4s/0h of 42912 corpus (33149s/9763h FVGT) 11/27/06 ##counts FU_ENDS_SG 5s/0h of 43779 corpus (34015s/9764h FVGT) 11/28/06 ##counts FU_ENDS_SG 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #uri FU_ENDS_RT m'/rt$'i #describe FU_ENDS_RT URL ends with /rt ###score FU_ENDS_RT 10.357 ##counts FU_ENDS_RT 7s/0h of 42912 corpus (33149s/9763h FVGT) 11/27/06 ##counts FU_ENDS_RT 8s/0h of 43779 corpus (34015s/9764h FVGT) 11/28/06 ##counts FU_ENDS_RT 9s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #meta FM_PHN_NODNS (FB_SPACED_PHN_3B && RDNS_NONE) #describe FM_PHN_NODNS Phone spacing + no dns ###score FM_PHN_NODNS 3.755 ##counts FM_PHN_NODNS 31s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FM_PHN_NODNS 40s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##watches http://www.freshbeach.com #rawbody FR_WATCHES_HTTP m'watches\s(?:\w+)?\s?http://'i #describe FR_WATCHES_HTTP Watches http:// ###score FR_WATCHES_HTTP 4.415 ##counts FR_WATCHES_HTTP 1s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 ##counts FR_WATCHES_HTTP 39s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FR_WATCHES_HTTP 56s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #uri FU_END_ET m'/et/$'i #describe FU_END_ET ET Phone Home? ###score FU_END_ET 10.357 ##counts FU_END_ET 304s/0h of 42054 corpus (32293s/9761h FVGT) 11/24/06 ##counts FU_END_ET 342s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 ##counts FU_END_ET 373s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FU_END_ET 399s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_MSGID_01C70XXX MESSAGEID =~ /^<01c70[a-f][a-f0-9]{2}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[a-zA-Z0-9-]+>$/ #describe FH_MSGID_01C70XXX MESSAGE ID seen often!!! ###score FH_MSGID_01C70XXX 10.357 ##counts FH_MSGID_01C70XXX 13s/0h of 42054 corpus (32293s/9761h FVGT) 11/24/06 ##counts FH_MSGID_01C70XXX 15s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 ##counts FH_MSGID_01C70XXX 54s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FH_MSGID_01C70XXX 159s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #uri FU_CLICK_PHP_DDD /click\.php\?\d+\.\d+\.\d+\.\d+\.\d+/i #describe FU_CLICK_PHP_DDD Click.php?ddd.ddd.ddd.ddd.ddd ###score FU_CLICK_PHP_DDD 10 8 8 6 ##counts FU_CLICK_PHP_DDD 41s/0h of 40756 corpus (31065s/9691h FVGT) 11/20/06 ##counts FU_CLICK_PHP_DDD 51s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 ##counts FU_CLICK_PHP_DDD 55s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FU_CLICK_PHP_DDD 68s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_X_REFS_DDD X-References =~ /^\d{1,5}$/ #describe FH_X_REFS_DDD X-Refs with digits. ###score FH_X_REFS_DDD 10.222 ##counts FH_X_REFS_DDD 41s/0h of 40756 corpus (31065s/9691h FVGT) 11/20/06 ##counts FH_X_REFS_DDD 51s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 ##counts FH_X_REFS_DDD 55s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FH_X_REFS_DDD 68s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #meta FM_XREF_CLICKPHP (FU_CLICK_PHP_DDD && FH_X_REFS_DDD) #describe FM_XREF_CLICKPHP Whatever it takes! ###score FM_XREF_CLICKPHP 4.54 ##counts FM_XREF_CLICKPHP 41s/0h of 40756 corpus (31065s/9691h FVGT) 11/20/06 ##counts FM_XREF_CLICKPHP 51s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 ##counts FM_XREF_CLICKPHP 55s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FM_XREF_CLICKPHP 68s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # # #body FB_SPACED_PHN_3B /\d\d\d--\d\d\d--?\d\d\d\d/ #describe FB_SPACED_PHN_3B Phone number with -- spacing. (B) ###score FB_SPACED_PHN_3B 5 2 2 1.563 ##counts FB_SPACED_PHN_3B 2s/0h of 33966 corpus (24401s/9565h FVGT) 11/16/06 ##counts FB_SPACED_PHN_3B 2s/0h of 34882 corpus (25258s/9624h FVGT) 11/16/06 ##counts FB_SPACED_PHN_3B 9s/0h of 40756 corpus (31065s/9691h FVGT) 11/20/06 ##counts FB_SPACED_PHN_3B 27s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 ##counts FB_SPACED_PHN_3B 35s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FB_SPACED_PHN_3B 44s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header __FH_FRM_53 From =~ /\@53\.com/i #header __FH_MSG_53 MESSAGEID =~ /\@53\.com/i #header __FH_RCV_53 Received =~ /\.53\.com/i #meta FM_FAKE_53COM_SPOOF (__FH_FRM_53 && !__FH_MSG_53 && !__FH_RCV_53) #describe FM_FAKE_53COM_SPOOF Spoof mail from 53.com? ###score FM_FAKE_53COM_SPOOF 10.357 ##counts FM_FAKE_53COM_SPOOF 488s/0h of 40784 corpus (31086s/9698h FVGT) 11/20/06 ##counts FM_FAKE_53COM_SPOOF 489s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 ##counts FM_FAKE_53COM_SPOOF 491s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FM_FAKE_53COM_SPOOF 491s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body __FB_HOWMUCH /How Much/i ##body __FB_COST /cost/i #meta __FM_HOW_COST (__FB_HOWMUCH && __FB_COST) #body __FB_IDENTITY /identity/i #meta __FM_HOW_COST_ID (__FM_HOW_COST || __FB_IDENTITY) #body __FB_YOUR_IMAGE /your(?: compan(?:y(?:'s)?|ies)) image/i #body __FB_IMAGE_OF /image of your company/i #meta __FM_YOUR_IMAGE (__FB_YOUR_IMAGE || __FB_IMAGE_OF) #meta FM_HOW_IMG_COST2 (__FM_HOW_COST_ID && __FM_YOUR_IMAGE) #describe FM_HOW_IMG_COST2 How much does your image cost? (2) ###score FM_HOW_IMG_COST2 3.99 2.2 2.2 1.777 ##counts FM_HOW_IMG_COST2 9s/0h of 40784 corpus (31086s/9698h FVGT) 11/20/06 ##counts FM_HOW_IMG_COST2 15s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 ##counts FM_HOW_IMG_COST2 15s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FM_HOW_IMG_COST2 16s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #uri FU_COMMON_SUBS m'/(?:h(?:5r|x1)|1q0|bgh|csy|j6x|n1b|y6g|zox)/?[,.]?$'i #describe FU_COMMON_SUBS Sub-dir seen often in spam. ###score FU_COMMON_SUBS 7 5 5 4 ##counts FU_COMMON_SUBS 2s/0h of 42141 corpus (34216s/7925h FVGT) 04/25/06 ##counts FU_COMMON_SUBS 43s/0h of 144700 corpus (93150s/51550h DOC) 04/25/06 ##counts FU_COMMON_SUBS 5s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FU_COMMON_SUBS 23s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FU_COMMON_SUBS 24s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #ifplugin Mail::SpamAssassin::Plugin::ReplaceTags #body __FRT_GOLD /\b(?!gold)\b/i #replace_rules __FRT_GOLD #body __FRT_SILVER /\b(?!s[il][li]ver)\b/i #replace_rules __FRT_SILVER #meta FRM_SILVER_GOLD (__FRT_SILVER && __FRT_GOLD) #describe FRM_SILVER_GOLD ReplaceTags: Silver & Gold ###score FRM_SILVER_GOLD 1.955 ##counts FRM_SILVER_GOLD 6s/0h of 40784 corpus (31086s/9698h FVGT) 11/20/06 ##counts FRM_SILVER_GOLD 8s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 ##counts FRM_SILVER_GOLD 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 #endif # Mail::SpamAssassin::Plugin::ReplaceTags # # #body __FB_LUX_GIFTS /Luxury (?:\w+\s)?Gifts/i ##body __FB_NUM_PERCNT /\d\s?\%/ #meta FM_LUX_GIFTS_REDUCED (__FB_LUX_GIFTS && __FB_NUM_PERCNT) #describe FM_LUX_GIFTS_REDUCED Luxury Gifts with dd% ###score FM_LUX_GIFTS_REDUCED 10 5 5 2.2 ##counts FM_LUX_GIFTS_REDUCED 19s/0h of 32090 corpus (22848s/9242h FVGT) 11/13/06 ##counts FM_LUX_GIFTS_REDUCED 96s/0h of 41138 corpus (31436s/9702h FVGT) 11/20/06 ##counts FM_LUX_GIFTS_REDUCED 139s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FM_LUX_GIFTS_REDUCED 142s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_MSGID_DIGIT MESSAGEID =~ /\{DIGIT\}/ #describe FH_MSGID_DIGIT Forgot Pattern Replacement? ###score FH_MSGID_DIGIT 10 10 10 10 ##counts FH_MSGID_DIGIT 21s/0h of 41138 corpus (31436s/9702h FVGT) 11/20/06 ##counts FH_MSGID_DIGIT 23s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FH_MSGID_DIGIT 23s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header __FS_HOWMUCH Subject =~ /how much/i #header __FS_IMAGE Subject =~ /your(?: compan(?:y(?:'s)?|ies))? image/i #header __FS_COST Subject =~ /cost/i #meta FM_HOW_IMG_COST (__FS_HOWMUCH && __FS_IMAGE && __FS_COST) #describe FM_HOW_IMG_COST How much does your image cost? ###score FM_HOW_IMG_COST 10 5 5 5 ##counts FM_HOW_IMG_COST 17s/0h of 24480 corpus (15455s/9025h FVGT) 10/30/06 ##counts FM_HOW_IMG_COST 21s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FM_HOW_IMG_COST 24s/0h of 40802 corpus (31109s/9693h FVGT) 11/20/06 ##counts FM_HOW_IMG_COST 25s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##rawbody __FR_SPACING_8 /[a-z0-9]{6}\s{8}[a-z0-9]{5}/i ##rawbody __FR_SPACING_9 /[a-z0-9]{6}\s{9}[a-z0-9]{5}/i ##rawbody __FR_SPACING_15 /[a-z0-9]{6}\s{15}[a-z0-9]{5}/i ##rawbody __FR_SPACING_17 /[a-z0-9]{6}\s{17}[a-z0-9]{5}/i ##rawbody __FR_SPACING_22 /[a-z0-9]{6}\s{22}[a-z0-9]{5}/i #meta FM_ASCII_ART_SPACINGc ((__FR_SPACING_8 + __FR_SPACING_9 + __FR_SPACING_15 + __FR_SPACING_17 + __FR_SPACING_22) > 3) #describe FM_ASCII_ART_SPACINGc Looks like might be ASCII ###score FM_ASCII_ART_SPACINGc 0.833 ##counts FM_ASCII_ART_SPACINGc 23s/0h of 35751 corpus (26053s/9698h FVGT) 11/18/06 ##counts FM_ASCII_ART_SPACINGc 23s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header __FS_S_TRADE Subject =~ /\btrade\b/i #body __FB_S_SYMBOL /Symb?o?l?:\s?[A-Z_,\.-]{4,8}/i ##body __FB_S_PRICE /Pri{1,2}c[a-z]?e/i ##meta __FM_MY_PRICE (__FB_S_PRICE || FRT_PRICE) ##body __FB_S_STOCK /Stock/i #meta FM_DOESNT_SAY_STOCK (__FB_S_SYMBOL && __FM_MY_PRICE && !__FB_S_STOCK && !__FS_S_TRADE) #describe FM_DOESNT_SAY_STOCK It's a stock spam but doesn't say stock ###score FM_DOESNT_SAY_STOCK 10.357 ##counts FM_DOESNT_SAY_STOCK 30s/0h of 35726 corpus (26027s/9699h FVGT) 11/17/06 ##counts FM_DOESNT_SAY_STOCK 30s/0h of 35751 corpus (26053s/9698h FVGT) 11/18/06 ##counts FM_DOESNT_SAY_STOCK 96s/0h of 40802 corpus (31109s/9693h FVGT) 11/20/06 ##counts FM_DOESNT_SAY_STOCK 114s/0h of 41138 corpus (31436s/9702h FVGT) 11/20/06 ##counts FM_DOESNT_SAY_STOCK 142s/0h of 42986 corpus (33212s/9774h FVGT) 11/24/06 ##counts FM_DOESNT_SAY_STOCK 150s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FM_DOESNT_SAY_STOCK 156s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body __FB_HOTTEST /hottest/i #body __FB_PICK /\bpick\b/i #body __FB_PROJECTED /projected/i #meta __FM_STOCK_WORDS (__FB_HOTTEST || __FB_PICK || __FB_PROJECTED) #meta FM_LIKE_STOCKS (__FM_STOCK_WORDS && !__FB_S_STOCK && __FB_S_SYMBOL) #describe FM_LIKE_STOCKS It looks like a duck, it's a duck! ###score FM_LIKE_STOCKS 5.888 ##counts FM_LIKE_STOCKS 6s/0h of 35751 corpus (26053s/9698h FVGT) 11/18/06 ##counts FM_LIKE_STOCKS 41s/0h of 41138 corpus (31436s/9702h FVGT) 11/20/06 ##counts FM_LIKE_STOCKS 56s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_FROM_HOODIA From =~ /Hoodia/i #describe FH_FROM_HOODIA From has Hoodia!!? ###score FH_FROM_HOODIA 6.222 ##counts FH_FROM_HOODIA 7s/0h of 12277 corpus (6604s/5673h CT) 03/21/06 ##counts FH_FROM_HOODIA 1s/0h of 9125 corpus (6891s/2234h AxB) 03/21/06 ##counts FH_FROM_HOODIA 29s/0h of 22944 corpus (17229s/5715h MY) 03/21/06 ##counts FH_FROM_HOODIA 161s/0h of 111414 corpus (73794s/37620h DOC) 03/21/06 ##counts FH_FROM_HOODIA 1094s/0h of 103219 corpus (95719s/7500h FVGT) 03/21/06 ##counts FH_FROM_HOODIA 32s/0h of 41138 corpus (31436s/9702h FVGT) 11/20/06 ##counts FH_FROM_HOODIA 33s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##### START FULL RULES #### ##### THESE WILL RETIRE AFTER 3.2 IS RELEASE #### # # #full FF_COMMENT_ODD /<-\*->/ #describe FF_COMMENT_ODD FULL RULE: Special Comment ###score FF_COMMENT_ODD 10.357 ##counts FF_COMMENT_ODD 2996s/0h of 222798 corpus (214870s/7928h FVGT) 04/25/06 ##counts FF_COMMENT_ODD 486s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FF_COMMENT_ODD 524s/0h of 41138 corpus (31436s/9702h FVGT) 11/20/06 ##counts FF_COMMENT_ODD 539s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #full FF_LEO_FLOAT_RIGHT /FLOAT[\r\n]{1,2}:[\r\n]{1,2}RIGHT/i #describe FF_LEO_FLOAT_RIGHT FULL RULE: Float, Right, Special signs! ###score FF_LEO_FLOAT_RIGHT 10.357 ##counts FF_LEO_FLOAT_RIGHT 26s/0h of 27310 corpus (19422s/7888h FT) 02/28/06 ##counts FF_LEO_FLOAT_RIGHT 1931s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FF_LEO_FLOAT_RIGHT 1932s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #full FF_IHOPE_YOU_SINK /(?:FLOAT.{10,300}){3}/is #describe FF_IHOPE_YOU_SINK Triple Floats, common viagra signs. ###score FF_IHOPE_YOU_SINK 1.699 ##counts IHOPE_YOU_SINK 295s/1h of 41941 corpus (34079s/7862h FVGT) 04/14/06 ##counts IHOPE_YOU_SINK 5224s/1h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FF_IHOPE_YOU_SINK 3338s/1h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FF_IHOPE_YOU_SINK 3361s/3h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FF_IHOPE_YOU_SINK 3364s/3h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##====== BODY RULES BELOW ============= # # #body FB_ACHIEVE_BACH /Achieve your Bachelor/i #describe FB_ACHIEVE_BACH Phrase: Achieve your bachelor ###score FB_ACHIEVE_BACH 3.253 ##counts FB_ACHIEVE_BACH 2s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FB_ACHIEVE_BACH 2s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_ACHIEVE_BACH 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_ALMOST_SEX /\b[b-z]sex+\b/i #describe FB_ALMOST_SEX It's almost sex, but not! ###score FB_ALMOST_SEX 4.114 ##counts FB_ALMOST_SEX 12s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FB_ALMOST_SEX 33s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_ALMOST_SEX 34s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_AN_ERROR_4U /An error has been made in your favor/ #describe FB_AN_ERROR_4U Phrase: an error has been made in your favor ###score FB_AN_ERROR_4U 5.717 ##counts FB_AN_ERROR_4U 2s/0h of 42564 corpus (34322s/8242h FVGT) 05/26/06 ##counts FB_AN_ERROR_4U 2s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_AN_ERROR_4U 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_ANA_TRIM /Ana[^a-z]trim/i #describe FB_ANA_TRIM Broken AnaTrim phrase. ###score FB_ANA_TRIM 10.357 ##counts FB_ANA_TRIM 2s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 ##counts FB_ANA_TRIM 4s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_ANA_TRIM 1383s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_ANA_TRIM 5s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_ANA_TRIM 69s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_ANUI /A[-_\.]U[-_\.]N[-_\.]I/i #describe FB_ANUI Phrase: A_U_N_I ###score FB_ANUI 7.166 ##counts FB_ANUI 14s/0h of 25009 corpus (15987s/9022h FVGT) 11/03/06 ##counts FB_ANUI 21s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 ##counts FB_ANUI 42s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_B0NUS /B0nus/i #describe FB_B0NUS Phrase: B0nus ###score FB_B0NUS 10.357 ##counts FB_B0NUS 6s/0h of 42564 corpus (34322s/8242h FVGT) 05/26/06 ##counts FB_B0NUS 36s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_B0NUS 5s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_B0NUS 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_BAD_ERECT /bad erection/i #describe FB_BAD_ERECT Phrase: Bad Erection ###score FB_BAD_ERECT 10.822 ##counts FB_BAD_ERECT 2s/0h of 25348 corpus (16329s/9019h FVGT) 11/04/06 ##counts FB_BAD_ERECT 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_BE_MILLION /be.{1,5}millionaire/i #describe FB_BE_MILLION Phrase: be millionaire ###score FB_BE_MILLION 1.837 ##counts FB_BE_MILLION 184s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_BE_MILLION 48s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_BE_MILLION 5s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_BE_MILLION 9s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_BEDISCARDED /discarded [a-z\s]{1,14} future deployments/i #describe FB_BEDISCARDED Phrase: discarded ... future deployments ###score FB_BEDISCARDED 2.973 ##counts FB_BEDISCARDED 969s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_BEDISCARDED 0s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_BEDISCARDED 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_BILLI0N /[BM][I1]LL[I1]0N/i ###score FB_BILLI0N 10.357 #describe FB_BILLI0N Phrase: [BM]Illi0n ##counts FB_BILLI0N 669s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_BILLI0N 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_BILLI0N 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_BOOST_CONFIDEN /Boost your confidence/i #describe FB_BOOST_CONFIDEN Phrase: boost your confidence. ###score FB_BOOST_CONFIDEN 2.395 ##counts FB_BOOST_CONFIDEN 31s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_BOOST_CONFIDEN 1s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_BOOST_CONFIDEN 19s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_BOOST_CONFIDEN 21s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##80O.538.6704 #body FB_BROKEN_PHNUM /(?!800)8[0o][0o][-.\s\)]{1,3}\d\d\d[-\.\s]{0,3}\d\d\d\d/i #describe FB_BROKEN_PHNUM weird phone number, with letters! ###score FB_BROKEN_PHNUM 3.84 ##counts FB_BROKEN_PHNUM 10s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 ##counts FB_BROKEN_PHNUM 42s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_BROWSER_ERR /Browser Error: [a-z0-9_]+,/i #describe FB_BROWSER_ERR Phrase: Browser Error: random ###score FB_BROWSER_ERR 10 ##counts FB_BROWSER_ERR 11s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 ##counts FB_BROWSER_ERR 139s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_BROWSER_ERR 413s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_C0MPANY /c0mpany/i #describe FB_C0MPANY Phrase: C0mpany ###score FB_C0MPANY 10 ##counts FB_C0MPANY 21s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 ##counts FB_C0MPANY 9s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_C0MPANY 12s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_CAN_LONGER /can last longer/i #describe FB_CAN_LONGER Phrase: can last longer ###score FB_CAN_LONGER 4.854 ##counts FB_CAN_LONGER 8s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 ##counts FB_CAN_LONGER 26s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_CAN_LONGER 41s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_CASINO /(?!casino)Ca[\$s5][i1\|]n[o0]/i #describe FB_CASINO Phrase: ca$ino ###score FB_CASINO 10 ##counts FB_CASINO 46s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_CASINO 50s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_CASINO 56s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_CASINO_SPELLER /(?:Onliine Casino|Online CCasino)/i #describe FB_CASINO_SPELLER Phrase: Online Casino, spelling mistake. ###score FB_CASINO_SPELLER 10.357 ##counts FB_CASINO_SPELLER 4s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FB_CASINO_SPELLER 4s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_CASINO_SPELLER 4s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_CHOLESTERBLCK /Cholesterblock/i #describe FB_CHOLESTERBLCK Phrase: Cholesterblock ###score FB_CHOLESTERBLCK 10.357 ##counts FB_CHOLESTERBLCK 10s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_CHOLESTERBLCK 29s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_CHOLESTERBLCK 50s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_CIALIS_LEO3 /\bC(?!IALIS|eibal|laim|laritas)\s?[a-z]?\s?[Iitl1\\\/]\s?[a-z]?\s?[Aa]\s?[a-z]?\s?[LIl1\\\/]\s?[a-z]?\s?[ilIt1\\\/]\s?[a-z]?\s?[Ss]\b/ #describe FB_CIALIS_LEO3 Uses a mis-spelled version of cialis. ###score FB_CIALIS_LEO3 4.599 ##counts FB_CIALIS_LEO3 2604s/0h of 41968 corpus (34130s/7838h FVGT) 04/11/06 ##counts FB_CIALIS_LEO3 17145s/12h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_CIALIS_LEO3 674s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_CIALIS_LEO3 686s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_CIALIS_LEO3 826s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_COM_ADR_SIGN /\:\:\s.{0,5}\d{3}\s\w{3,9}\s\w{2,9}\s.{1,20}\d{2}/i #describe FB_COM_ADR_SIGN Common sign used in Addresses ###score FB_COM_ADR_SIGN 10.357 ##counts FB_COM_ADR_SIGN 11s/0h of 43642 corpus (34621s/9021h FVGT) 10/26/06 ##counts FB_COM_ADR_SIGN 63s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_COM_ADR_SIGN 160s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_COM_ADR_SIGN 351s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_CONSOL_YOUR /consolidate your/i #describe FB_CONSOL_YOUR Phrase: Consolidate your ###score FB_CONSOL_YOUR 1.998 ##counts FB_CONSOL_YOUR 204s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_CONSOL_YOUR 4s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_CONSOL_YOUR 6s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_CONSOL_YOUR 12s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_DOUBLE_0WORDS /\b[a-z]{1,5}0[a-z]{3,9}\s[a-z]{1,5}0[a-z]{3,9}\b/i #describe FB_DOUBLE_0WORDS Looks like double 0 words ###score FB_DOUBLE_0WORDS 2.999 ##counts FB_DOUBLE_0WORDS 689s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_DOUBLE_0WORDS 263s/0h of 107818 corpus (99658s/8160h FVGT) 03/11/06 ##counts FB_DOUBLE_0WORDS 11s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 ##counts FB_DOUBLE_0WORDS 12s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_DROWNING_DEBT /drowning in debt/i #describe FB_DROWNING_DEBT Phrase: drowning in debt ###score FB_DROWNING_DEBT 2.375 ##counts FB_DROWNING_DEBT 72s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_DROWNING_DEBT 1s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 ##counts FB_DROWNING_DEBT 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_EARN_UP_TO /earn up to \$?\d?,?\d\d\d.{1,7}(?:day|week|month|year)/i #describe FB_EARN_UP_TO Phrase: Earn up to .... ###score FB_EARN_UP_TO 3.828 ##counts FB_EARN_UP_TO 1s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_EARN_UP_TO 7s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_EMAIL_HIER /email hier/i #describe FB_EMAIL_HIER Phrase: email hier ###score FB_EMAIL_HIER 10.357 ##counts FB_EMAIL_HIER 1583s/0h of 107818 corpus (99658s/8160h FVGT) 03/11/06 ##counts FB_EMAIL_HIER 165s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_EMAIL_HIER 169s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FB_ENHANCED_MALE /Enhanced male power/i #body FB_ENHANCED_MALE /Enhanced male/i #describe FB_ENHANCED_MALE Phrase: Enhanced male ###score FB_ENHANCED_MALE 10.357 ##counts FB_ENHANCED_MALE 17s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_ENHANCED_MALE 19s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_EPHEDRA_IS /Ephedra is back/i #describe FB_EPHEDRA_IS Phrase: Ephedra is back ###score FB_EPHEDRA_IS 10.357 ##counts FB_EPHEDRA_IS 31s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 ##counts FB_EPHEDRA_IS 37s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_EPHEDRA_IS 51s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_EXPLOSIVE /EXPLOSIVE\b/ #describe FB_EXPLOSIVE Phrase: EXPLOSIVE ###score FB_EXPLOSIVE 7.148 ##counts FB_EXPLOSIVE 718s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_EXPLOSIVE 1s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_EXPLOSIVE 1s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_EXPLOSIVE 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_EXTRA_INCHES /extra inches/ #describe FB_EXTRA_INCHES Phrase: extra inches ###score FB_EXTRA_INCHES 3.352 ##counts FB_EXTRA_INCHES 16s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 ##counts FB_EXTRA_INCHES 17s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_EXTRA_INCHES 21s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_FAKE_NUMBERS /\$\d\d?O\s*[MBT]/i #describe FB_FAKE_NUMBERS Looks like numbers with O's insted of 0's ###score FB_FAKE_NUMBERS 3.494 ##counts FB_FAKE_NUMBERS 948s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_FAKE_NUMBERS 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_FAKE_NUMBERS 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_FAKE_NUMS2 /\d,0OO/i #describe FB_FAKE_NUMS2 Looks like fake numbers ###score FB_FAKE_NUMS2 3.834 ##counts FB_FAKE_NUMS2 11s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_FAKE_NUMS2 0s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_FAKE_NUMS2 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_FAKE_NUMS4 /(?:\b|\b\d)\d,?\d,?OO(?:\b|\d\b)/ #describe FB_FAKE_NUMS4 Looks like fake numbers (4) ###score FB_FAKE_NUMS4 3.992 ##counts FB_FAKE_NUMS4 68s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_FAKE_NUMS4 49s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 ##counts FB_FAKE_NUMS4 49s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_FEDERALLY_COMPL /We are federally compliant/i #describe FB_FEDERALLY_COMPL Phrase: we are federally compliant ###score FB_FEDERALLY_COMPL 10.357 ##counts FB_FEDERALLY_COMPL 19s/0h of 104500 corpus (96503s/7997h FVGT) 03/09/06 ##counts FB_FEDERALLY_COMPL 21s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_FEDERALLY_COMPL 594s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_FEDERALLY_COMPL 742s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_FHARMACY /Fharmacy/i #describe FB_FHARMACY Phrase: Farmacy ###score FB_FHARMACY 10.357 ##counts FB_FHARMACY 12s/0h of 33043 corpus (23599s/9444h FVGT) 11/15/06 ##counts FB_FHARMACY 65s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_FHARMACY 204s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_FORWARD_LOOK /(?!forward look)f[o0]rward l[0o][0o]k/i #describe FB_FORWARD_LOOK Phrase: forward look with 0's ###score FB_FORWARD_LOOK 10.357 ##counts FB_FORWARD_LOOK 588s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_FORWARD_LOOK 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_FORWARD_LOOK 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_FREE888 /Free \$888/i #describe FB_FREE888 Claims we can get $888 Free. ###score FB_FREE888 10.357 ##counts FB_FREE888 10s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FB_FREE888 17s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_FREE888 21s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_FUNNY_WEIGHT /(?!weight)we ?i?ght/i #describe FB_FUNNY_WEIGHT Looks like weight but it's not! ###score FB_FUNNY_WEIGHT 5.993 ##counts FB_FUNNY_WEIGHT 10s/0h of 34977 corpus (27086s/7891h FT) 03/01/06 ##counts FB_FUNNY_WEIGHT 13s/0h of 107818 corpus (99658s/8160h FVGT) 03/11/06 ##counts FB_FUNNY_WEIGHT 2s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_FUNNY_WEIGHT 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_GAPPY_ADDRESS /(?:[a-z] ){8}, (?:[a-z0-9] ){4}/i #describe FB_GAPPY_ADDRESS Too much spacing in Address ###score FB_GAPPY_ADDRESS 5.655 ##counts FB_GAPPY_ADDRESS 21s/0h of 43642 corpus (34621s/9021h FVGT) 10/26/06 ##counts FB_GAPPY_ADDRESS 139s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_GAPPY_ADDRESS 425s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_GAPPY_ADDRESS 616s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_GAPPY_SOMETHING /(?:[A-Z,-]\s){8}.{0,5}(?:[0-9]\s){3}/ #describe FB_GAPPY_SOMETHING Looks like something thats g a p p y ###score FB_GAPPY_SOMETHING 0.444 ##counts FB_GAPPY_SOMETHING 1s/0h of 42071 corpus (34145s/7926h FVGT) 04/20/06 ##counts FB_GAPPY_SOMETHING 3s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_GAPPY_SOMETHING 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_GET_LAID /GET LAID/ #describe FB_GET_LAID Phrase: GET LAID ###score FB_GET_LAID 10.357 ##counts FB_GET_LAID 5s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 ##counts FB_GET_LAID 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_GET_MEDS /(?:place f[o0]r|[0o]rder|get\s?(?:y[o0]ur)?|online|quality).{1,7}med[isz][^a]/i #describe FB_GET_MEDS Looks like trying to sell meds ###score FB_GET_MEDS 3.875 ##counts FB_GET_MEDS 30s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 ##counts FB_GET_MEDS 38s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_GET_XXX_CASH /get \d+(?:,?\d+)? (?:[a-z]+ ?)?cash/i #describe FB_GET_XXX_CASH Phrase: Get Cash ###score FB_GET_XXX_CASH 10.357 ##counts FB_GET_XXX_CASH 17s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 ##counts FB_GET_XXX_CASH 55s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_GET_XXX_CASH 107s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_GREAT_BEST_SEX /(?:greater|best|Improved) sex/i #describe FB_GREAT_BEST_SEX Phrase: greater, best, improved sex ###score FB_GREAT_BEST_SEX 5.157 ##counts FB_GREAT_BEST_SEX 51s/0h of 25733 corpus (16658s/9075h FVGT) 11/08/06 ##counts FB_GREAT_BEST_SEX 79s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_GREAT_BEST_SEX 109s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_GVR /(?:pef-rx|vigrex-ds|gsc-100|vp-rx|gv-promax|phentermine|adipex|xenical)/i #describe FB_GVR Looks like generic viagra ###score FB_GVR 4.999 ##counts FB_GVR 79s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_GVR 55s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 ##counts FB_GVR 55s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_HA1R /\bha1r\b/i #describe FB_HA1R Phrase: ha1r ###score FB_HA1R 5.644 ##counts FB_HA1R 128s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_HA1R 0s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_HA1R 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_HEY_BRO_COMMA /Hey bro, / #describe FB_HEY_BRO_COMMA Phrase hey bro, ###score FB_HEY_BRO_COMMA 7.357 ##counts FB_HEY_BRO_COMMA 40s/0h of 103587 corpus (96208s/7379h FVGT) 03/15/06 ##counts FB_HEY_BRO_COMMA 392s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_HEY_BRO_COMMA 10s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_HEY_BRO_COMMA 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_HG_H_CAP /\bHGH\b/ #describe FB_HG_H_CAP Phrase: HGH ###score FB_HG_H_CAP 4.775 ##counts FB_HG_H_CAP 75s/0h of 25733 corpus (16658s/9075h FVGT) 11/08/06 ##counts FB_HG_H_CAP 88s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_HG_H_CAP 131s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_HOMELOAN /\$\d{3},\d{3} home loan/i #describe FB_HOMELOAN Phrase $x home loan ###score FB_HOMELOAN 10.357 ##counts FB_HOMELOAN 333s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_HOMELOAN 4s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_HOMELOAN 1165s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_HOMELOAN 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_IMPRESS_GIRL /\bimpress .{0,5}girl\b/ #describe FB_IMPRESS_GIRL Phrase: impress ... girl ###score FB_IMPRESS_GIRL 4.284 ##counts FB_IMPRESS_GIRL 122s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 ##counts FB_IMPRESS_GIRL 128s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_IMPRESS_GIRL 131s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_IMPROVEJA /Improved Ejaculation/i #describe FB_IMPROVEJA Phrase: Improved Ejaculation ###score FB_IMPROVEJA 10.357 ##counts FB_IMPROVEJA 0s/0h of 25733 corpus (16658s/9075h FVGT) 11/08/06 ##counts FB_IMPROVEJA 1s/0h of 26801 corpus (17723s/9078h FVGT) 11/09/06 ##counts FB_IMPROVEJA 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_INCREASE_VOL /\bincrease.{0,8}volume/ #describe FB_INCREASE_VOL Phrase: increase volume ###score FB_INCREASE_VOL 3.629 ##counts FB_INCREASE_VOL 83s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 ##counts FB_INCREASE_VOL 87s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_INCREASE_VOL 95s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_INCREASE_YOUR /Increase your energy/i #describe FB_INCREASE_YOUR Phrase: Increase your energy ###score FB_INCREASE_YOUR 10.357 ##counts FB_INCREASE_YOUR 58s/0h of 25733 corpus (16658s/9075h FVGT) 11/08/06 ##counts FB_INCREASE_YOUR 83s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_INCREASE_YOUR 142s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_INDEPEND_RWD /independent reward/i #describe FB_INDEPEND_RWD Phrase: independent reward ###score FB_INDEPEND_RWD 10.357 ##counts FB_INDEPEND_RWD 164s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 ##counts FB_INDEPEND_RWD 620s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_INDEPEND_RWD 1386s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_IOW /\bIow\b/ #describe FB_IOW Phrase: mis-spelled low, iow? ###score FB_IOW 10.357 ##counts FB_IOW 3s/0h of 25718 corpus (16644s/9074h FVGT) 11/08/06 ##counts FB_IOW 6s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_IOW 7s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_L0AN /\bl0ans?\b/i #describe FB_L0AN Phrase: L0an ###score FB_L0AN 10.357 ##counts FB_L0AN 34s/0h of 43642 corpus (34621s/9021h FVGT) 10/26/06 ##counts FB_L0AN 7s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_L0AN 18s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_LAON /\blaon\b/i #describe FB_LAON Phrase: laon ###score FB_LAON 2.382 ##counts FB_LAON 30s/0h of 104500 corpus (96503s/7997h FVGT) 03/09/06 ##counts FB_LAON 0s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_LAON 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_LATEST_OEM /latest oem/i #describe FB_LATEST_OEM Phrase: latest oem. ###score FB_LATEST_OEM 10.357 ##counts FB_LATEST_OEM 12s/0h of 17430 corpus (9737s/7693h FT) 01/11/06 ##counts FB_LATEST_OEM 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_LATEST_OEM 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_LIMITED_TIME /limited time promotion/i #describe FB_LIMITED_TIME Phrase: limited time promotion ###score FB_LIMITED_TIME 3.193 ##counts FB_LIMITED_TIME 73s/0h of 9788 corpus (4882s/4906h FT) 12/26/05 ##counts FB_LIMITED_TIME 16s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_LIMITED_TIME 21s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_LOSE_WEIGHT_CAP /LOSE WEIGHT/ #describe FB_LOSE_WEIGHT_CAP Phrase: LOSE WEIGHT ###score FB_LOSE_WEIGHT_CAP 2.522 ##counts FB_LOSE_WEIGHT_CAP 115s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_LOSE_WEIGHT_CAP 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_LOSE_WEIGHT_CAP 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_LOWER_PAYM /lower your monthly payments/i #describe FB_LOWER_PAYM Phrase: lower your monthly payments ###score FB_LOWER_PAYM 3.542 ##counts FB_LOWER_PAYM 187s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_LOWER_PAYM 37s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_LOWER_PAYM 38s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_MAGIC_TAB /\b(?:magic|this) tab\b/ #describe FB_MAGIC_TAB Phrase: this / magic tab. ###score FB_MAGIC_TAB 10.357 ##counts FB_MAGIC_TAB 115s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 ##counts FB_MAGIC_TAB 116s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_MAGIC_TAB 118s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_MAKE_MONEY /generate \$/i #describe FB_MAKE_MONEY Phrase: generate $ ###score FB_MAKE_MONEY 1.755 ##counts FB_MAKE_MONEY 11s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_MAKE_MONEY 0s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_MAKE_MONEY 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_MASCULINE_PERF /Masculine performance/i #describe FB_MASCULINE_PERF Phrase: Masculine performance ###score FB_MASCULINE_PERF 10.357 ##counts FB_MASCULINE_PERF 15s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FB_MASCULINE_PERF 18s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_MASCULINE_PERF 18s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_MED1CAT /\bmed1cat/i #describe FB_MED1CAT Phrase: Med1cat ###score FB_MED1CAT 10.357 ##counts FB_MED1CAT 7s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_MED1CAT 6s/0h of 35267 corpus (25646s/9621h FVGT) 11/17/06 ##counts FB_MED1CAT 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_MEDS_PERCENT /meds .{3,10}\d\s?%/i #describe FB_MEDS_PERCENT Talks about meds and % ###score FB_MEDS_PERCENT 10.357 ##counts FB_MEDS_PERCENT 13s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FB_MEDS_PERCENT 6s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_MEDS_PERCENT 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_MEEDS /\bmeed[zs]\b/i #describe FB_MEEDS Phrase: meed[zs] ###score FB_MEEDS 10.357 ##counts FB_MEEDS 615s/0h of 81916 corpus (65011s/16905h ML) 02/27/06 ##counts FB_MEEDS 0s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_MEEDS 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_MORE_SEMEN /more semen/i #describe FB_MORE_SEMEN Phrase: more semen ###score FB_MORE_SEMEN 10.357 ##counts FB_MORE_SEMEN 4s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FB_MORE_SEMEN 95s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_MORE_SEMEN 5s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_MORE_SEMEN 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_MORE_SIZE /\bmore size\b/ #describe FB_MORE_SIZE Phrase: more size ###score FB_MORE_SIZE 10.357 ##counts FB_MORE_SIZE 11s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_MORE_SIZE 29s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_MORE_SIZE 48s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_MOST_RECOG /most recognized brands/i #describe FB_MOST_RECOG Phrase: most recognized brands. ###score FB_MOST_RECOG 2.772 ##counts FB_MOST_RECOG 12s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FB_MOST_RECOG 12s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_MOST_RECOG 13s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_MOST_QUALITY /Most quality products/i #describe FB_MOST_QUALITY Phrase: Most quality products ###score FB_MOST_QUALITY 10.357 ##counts FB_MOST_QUALITY 16s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FB_MOST_QUALITY 90s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_MOST_QUALITY 26s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_N3W / n3w /i #describe FB_N3W Phrase: n3w ###score FB_N3W 3.362 ##counts FB_N3W 11s/0h of 34977 corpus (27086s/7891h FT) 03/01/06 ##counts FB_N3W 523s/0h of 84470 corpus (67306s/17164h ML) 03/01/06 ##counts FB_N3W 19s/0h of 107818 corpus (99658s/8160h FVGT) 03/11/06 ##counts FB_N3W 0s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_N3W 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_NATIONALSURV /NationalSurveyPanel/i #describe FB_NATIONALSURV Phrase: NationalSurveyPanel ###score FB_NATIONALSURV 3.259 ##counts FB_NATIONALSURV 75s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_NATIONALSURV 2s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 ##counts FB_NATIONALSURV 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_NEW_LOW_RATE /new low rate/i #describe FB_NEW_LOW_RATE Phrase: new low rate ###score FB_NEW_LOW_RATE 1.853 ##counts FB_NEW_LOW_RATE 1s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FB_NEW_LOW_RATE 1s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_NEW_LOW_RATE 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_NO_MORE_ADS /no more ad/i #describe FB_NO_MORE_ADS Phrase: no more ad ###score FB_NO_MORE_ADS 1.174 ##counts FB_NO_MORE_ADS 6s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_NO_MORE_ADS 13s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 ##counts FB_NO_MORE_ADS 13s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_NO_MORE_HTTP /no\s?more.{0,5} http/i #describe FB_NO_MORE_HTTP No more, the http ###score FB_NO_MORE_HTTP 10.357 ##counts FB_NO_MORE_HTTP 1s/0h of 42050 corpus (34123s/7927h FVGT) 04/25/06 ##counts FB_NO_MORE_HTTP 109s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_NO_MORE_HTTP 174s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##No More Mail Please: ##No More Mail: ##No more distribution #body FB_NO_MORE_MAIL /No More (?:Mail|distribution)/i #describe FB_NO_MORE_MAIL Phrase: no more mail, distribution ###score FB_NO_MORE_MAIL 10.529 ##counts FB_NO_MORE_MAIL 25s/0h of 25733 corpus (16658s/9075h FVGT) 11/08/06 ##counts FB_NO_MORE_MAIL 52s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_NO_MORE_MAIL 68s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_NO_MORE_OFFER /No more offer/i #describe FB_NO_MORE_OFFER Phrase: no more offer ###score FB_NO_MORE_OFFER 3.189 ##counts FB_NO_MORE_OFFER 2s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 ##counts FB_NO_MORE_OFFER 1s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_NO_MORE_OFFER 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ## Bug 6448: replaced with NO_PRESCRIPTION ##body FB_NO_SCRIP_NEEDED /No.{1,10}P(?:er|re)scr[i1]pt[i1][o0]n (?:needed|requ[1i]re)/i ##describe FB_NO_SCRIP_NEEDED Phrase: no prescription needed. ###score FB_NO_SCRIP_NEEDED 10.357 ##counts FB_NO_SCRIP_NEEDED 722s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_NO_SCRIP_NEEDED 1042s/0h of 107818 corpus (99658s/8160h FVGT) 03/13/06 ##counts FB_NO_SCRIP_NEEDED 84s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_NO_SCRIP_NEEDED 133s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_NOT_CREDIT /\b(?!credit)cred[^i\s]{1,3}t\b/i #describe FB_NOT_CREDIT Looks like credit but ain't. ###score FB_NOT_CREDIT 3.857 ##counts FB_NOT_CREDIT 40s/0h of 42007 corpus (34077s/7930h FVGT) 04/19/06 ##counts FB_NOT_CREDIT 9s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_NOT_CREDIT 9s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##8oo-xxx-xxxx #body FB_NOT_PHONE_NUM1 /(?!\d{3})8(?:66|77|88|[0o][0o])[-\.\s\)]{1,3}[OIL0-9]{3}[-\.\s]/i #describe FB_NOT_PHONE_NUM1 Looks like a fake phone number (1) ###score FB_NOT_PHONE_NUM1 10.357 ##counts FB_NOT_PHONE_NUM1 3s/0h of 25718 corpus (16644s/9074h FVGT) 11/08/06 ##counts FB_NOT_PHONE_NUM1 24s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_NOT_PHONE_NUM1 109s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##888-xox-xxxx #body FB_NOT_PHONE_NUM2 /8(?:66|77|88|[0o][0o])[-\.\s\)]{1,3}(?!\d{3})[OIL0-9]{3}[-\.\s]/i #describe FB_NOT_PHONE_NUM2 Looks like a fake phone number (2) ###score FB_NOT_PHONE_NUM2 10.357 ##counts FB_NOT_PHONE_NUM2 5s/0h of 25718 corpus (16644s/9074h FVGT) 11/08/06 ##counts FB_NOT_PHONE_NUM2 16s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_NOT_PHONE_NUM2 69s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##888-xxx-xiox #body FB_NOT_PHONE_NUM3 /8(?:66|77|88|[0o][0o])[-\.\s\)]{1,3}[OIL0-9]{3}[-\.\s]{1,3}(?!\d{4})[OIL0-9]{4}/i #describe FB_NOT_PHONE_NUM3 Looks like a fake phone number (3) ###score FB_NOT_PHONE_NUM3 10.357 ##counts FB_NOT_PHONE_NUM3 7s/0h of 25718 corpus (16644s/9074h FVGT) 11/08/06 ##counts FB_NOT_PHONE_NUM3 25s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_NOT_PHONE_NUM3 120s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ## $choolgirl #body FB_NOT_SCHOOL /(?!school)[\$s5]ch[o0][o0][il1\|]/i #describe FB_NOT_SCHOOL Looks like school but it's not! ###score FB_NOT_SCHOOL 10.357 ##counts FB_NOT_SCHOOL 2s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_NOT_SCHOOL 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_NOT_SEXUAL /[^Ss]exual/ #describe FB_NOT_SEXUAL Almost Sexual but not. ###score FB_NOT_SEXUAL 10.357 ##counts FB_NOT_SEXUAL 23s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 ##counts FB_NOT_SEXUAL 27s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_NOW_NOW_NOW /NOW NOW NOW/ #describe FB_NOW_NOW_NOW Phrase: NOW NOW NOW ###score FB_NOW_NOW_NOW 10.357 ##counts FB_NOW_NOW_NOW 23s/0h of 33966 corpus (24401s/9565h FVGT) 11/16/06 ##counts FB_NOW_NOW_NOW 42s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_NOW_NOW_NOW 96s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_NUMYO /1[0-9][\s\.]?y[\s\.]?o[\s\.]?\b/i #describe FB_NUMYO Speaks of teenager. ###score FB_NUMYO 10.357 ##counts FB_NUMYO 160s/0h of 24696 corpus (15673s/9023h FVGT) 11/01/06 ##counts FB_NUMYO 287s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_NUMYO 166s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_NUMYO 181s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_NUMYO2 /2[0-9][\s\.]?y[\s\.]?o[\s\.]?\b/i #describe FB_NUMYO2 Speaks of 20+ year old. ###score FB_NUMYO2 10.357 ##counts FB_NUMYO2 7s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 ##counts FB_NUMYO2 100s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_NUMYO2 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_ODD_SPACED_MONEY /\$\d\s,\s\d\d/ #describe FB_ODD_SPACED_MONEY Looks like money but has odd spacing. ###score FB_ODD_SPACED_MONEY 10.357 ##counts FB_ODD_SPACED_MONEY 1075s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_ODD_SPACED_MONEY 1078s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_ODD_SPACED_MONEY 1076s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_ONIINE /oniine/i #describe FB_ONIINE Mis-spelled online ###score FB_ONIINE 10.357 ##counts FB_ONIINE 2s/0h of 24645 corpus (15618s/9027h FVGT) 10/31/06 ##counts FB_ONIINE 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_P1LL /\bp1ll/i #describe FB_P1LL Phrase: p1ll ###score FB_P1LL 10.357 ##counts FB_P1LL 61s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_P1LL 3s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_P1LL 7s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_P1LL 24s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_PA1N /\bpa1n/i #describe FB_PA1N Phrase: pa1n ###score FB_PA1N 10.658 ##counts FB_PA1N 10s/0h of 40695 corpus (35393s/5302h MY) 12/13/05 ##counts FB_PA1N 12s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_PA1N 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_PA1N 1s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_PA1N 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##paste link in browser #body FB_PASTE_LINK /paste link .{1,8}browser/i #describe FB_PASTE_LINK Phrase: past link into browser ###score FB_PASTE_LINK 10.357 ##counts FB_PASTE_LINK 9s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_PASTE_LINK 94s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_PASTE_LINK 49s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_PC_DOCTOR /PC Doctor/i #describe FB_PC_DOCTOR Phrase: PC Doctor ###score FB_PC_DOCTOR 10.357 ##counts FB_PC_DOCTOR 2s/0h of 43642 corpus (34621s/9021h FVGT) 10/26/06 ##counts FB_PC_DOCTOR 25s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_PC_DOCTOR 90s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_PC_DOCTOR 166s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_PENIS_GROWTH /pen[i1]s grow(?:th)?/i #describe FB_PENIS_GROWTH Phrase: penis growth ###score FB_PENIS_GROWTH 6.999 ##counts FB_PENIS_GROWTH 21s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_PENIS_GROWTH 4s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_PENIS_GROWTH 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_PIPE_ILLION /(?!illion)i[l|][l|][i|][o0]n/i #describe FB_PIPE_ILLION Looks like illion, but it's not ###score FB_PIPE_ILLION 10.357 ##counts FB_PIPE_ILLION 1560s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_PIPE_ILLION 3s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_PIPE_ILLION 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_PIPEDOLLAR /(?!dollar)d[o0][1|li][1|li]ar/i #describe FB_PIPEDOLLAR Phrase: Dollar, with pipes or 0's. ###score FB_PIPEDOLLAR 10.357 ##counts FB_PIPEDOLLAR 40s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_PIPEDOLLAR 2s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_PIPEDOLLAR 331s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_PIPEDOLLAR 262s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 ##counts FB_PIPEDOLLAR 4s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_PIPENEWSLETTER /news\|etter/i #describe FB_PIPENEWSLETTER Phrase news|etter ###score FB_PIPENEWSLETTER 10.357 ##counts FB_PIPENEWSLETTER 1s/0h of 40695 corpus (35393s/5302h MY) 12/13/05 ##counts FB_PIPENEWSLETTER 890s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_PIPENEWSLETTER 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_PIPENEWSLETTER 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_PROLONGED_HARD /(?:prolonged|increased) hardness/i #describe FB_PROLONGED_HARD Talks about prolonged hardness ###score FB_PROLONGED_HARD 10.357 ##counts FB_PROLONGED_HARD 15s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FB_PROLONGED_HARD 22s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_PROLONGED_HARD 175s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_PROLONGED_HARD 21s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # # #body FB_QUALITY_REPLICA /quality replica/i #describe FB_QUALITY_REPLICA Phrase: quality replica ###score FB_QUALITY_REPLICA 10.357 ##counts FB_QUALITY_REPLICA 222s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_QUALITY_REPLICA 1s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_QUALITY_REPLICA 503s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_QUALITY_REPLICA 35s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_RANDOM_SPUR /\{SPUR_\d{1,2}\}/i #describe FB_RANDOM_SPUR Pattern Replacement Failure ###score FB_RANDOM_SPUR 10.357 ##counts FB_RANDOM_SPUR 38s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_RANDOM_SPUR 105s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_RANDOM_SPUR 206s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_RE_FI /\bre[^a-z]fi\b/ #describe FB_RE_FI Looks like refi. ###score FB_RE_FI 10.357 ##counts FB_RE_FI 1s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 ##counts FB_RE_FI 2s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_RE_FI 68s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_RE_FI 16s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_REF_CODE_SPACE /r e f c o d e/i #describe FB_REF_CODE_SPACE Refcode with spacing ###score FB_REF_CODE_SPACE 10.357 ##counts FB_REF_CODE_SPACE 74s/0h of 23261 corpus (14238s/9023h FVGT) 10/30/06 ##counts FB_REF_CODE_SPACE 711s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_REF_CODE_SPACE 1009s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_REFI / Refi /i #describe FB_REFI Phrase: Refi ###score FB_REFI 3.534 ##counts FB_REFI 1088s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_REFI 14s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 ##counts FB_REFI 16s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_REM_PART /remov\W/i #describe FB_REM_PART Looks like remove w/o e. ###score FB_REM_PART 10.357 ##counts FB_REM_PART 48s/0h of 40695 corpus (35393s/5302h MY) 12/13/05 ##counts FB_REM_PART 856s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_REM_PART 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_REPLICA_ROLEX /replica rolex/i #describe FB_REPLICA_ROLEX Phrase: Replica Rolex ###score FB_REPLICA_ROLEX 3.957 ##counts FB_REPLICA_ROLEX 7s/0h of 40695 corpus (35393s/5302h MY) 12/13/05 ##counts FB_REPLICA_ROLEX 16s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_REPLICA_ROLEX 5s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 ##counts FB_REPLICA_ROLEX 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_REWARDS_GATE /Rewards Gateway/i #describe FB_REWARDS_GATE Phrase: Rewards Gateway ###score FB_REWARDS_GATE 10.357 ##counts FB_REWARDS_GATE 30s/0h of 27348 corpus (19456s/7892h FT) 02/27/06 ##counts FB_REWARDS_GATE 148s/0h of 101278 corpus (61900s/39378h DOC) 02/27/06 ##counts FB_REWARDS_GATE 11s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 ##counts FB_REWARDS_GATE 24s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_ROLLER_IS_T /Roller is th/i #describe FB_ROLLER_IS_T Phrase: Roller is th ###score FB_ROLLER_IS_T 1.357 ##counts FB_ROLLER_IS_T 20s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 ##counts FB_ROLLER_IS_T 22s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_ROLLER_IS_T 1s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 ##counts FB_ROLLER_IS_T 28s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_ROLLER_IS_T 28s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_ROLX /\brolx\b/i #describe FB_ROLX Phrase: rolx ###score FB_ROLX 10.357 ##counts FB_ROLX 0s/0h of 40695 corpus (35393s/5302h MY) 12/13/05 ##counts FB_ROLX 163s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_ROLX 0s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_ROLX 1s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_ROLX 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_SAVE_PERSC /sav(?:e|ing).{1,45}p[re][re]scr[i1]pt[i1][o0]n/i #describe FB_SAVE_PERSC Phrase: save ... prescription. ###score FB_SAVE_PERSC 3.199 ##counts FB_SAVE_PERSC 7s/0h of 40695 corpus (35393s/5302h MY) 12/13/05 ##counts FB_SAVE_PERSC 30s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_SAVE_PERSC 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_SAVE_PERSC 19s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_SAVE_PERSC 2s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 ##counts FB_SAVE_PERSC 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_SSEX /\bssex\b/ #describe FB_SSEX Phrase: ssex ###score FB_SSEX 10.357 ##counts FB_SSEX 0s/0h of 5479 corpus (1297s/4182h AxB) 09/25/06 ##counts FB_SSEX 19s/0h of 21635 corpus (15142s/6493h CT) 09/25/06 ##counts FB_SSEX 33s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 ##counts FB_SSEX 34s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_SMALL_PEN /small p+e+n(?!sion)/i #describe FB_SMALL_PEN Phrase: small pen ###score FB_SMALL_PEN 10.357 ##counts FB_SMALL_PEN 105s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FB_SMALL_PEN 24s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_SMALL_PEN 26s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_SOFTTABS /\bsoft\s?t?abs\b/i #describe FB_SOFTTABS Phrase: Softabs ###score FB_SOFTTABS 10.357 ##counts FB_SOFTTABS 31s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_SOFTTABS 0s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_SOFTTABS 95s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_SOFTTABS 97s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_SPACED_CASH /c a s h/i #describe FB_SPACED_CASH Phrase: c a s h ###score FB_SPACED_CASH 4.555 ##counts FB_SPACED_CASH 4s/0h of 42007 corpus (34077s/7930h FVGT) 04/19/06 ##counts FB_SPACED_CASH 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_SPACED_FREE /F R E E/i #describe FB_SPACED_FREE Phrase: F R E E ###score FB_SPACED_FREE 2.157 ##counts FB_SPACED_FREE 68s/0h of 40695 corpus (35393s/5302h MY) 12/13/05 ##counts FB_SPACED_FREE 141s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_SPACED_FREE 60s/0h of 25362 corpus (16336s/9026h FVGT) 11/04/06 ##counts FB_SPACED_FREE 66s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_SPACED_LOWER /L O W E R/i #describe FB_SPACED_LOWER Phrase: l o w e r ###score FB_SPACED_LOWER 10.357 ##counts FB_SPACED_LOWER 4s/0h of 42007 corpus (34077s/7930h FVGT) 04/19/06 ##counts FB_SPACED_LOWER 5s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_SPACED_LOWER 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_SPACEY_ZIP /\s\d\s\d\s\d\s\d\s\d\s-\s\d\s\d\s\d\s\d/ #describe FB_SPACEY_ZIP Looks like a s p a c e d zipcode. ###score FB_SPACEY_ZIP 10.357 ##counts FB_SPACEY_ZIP 121s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FB_SPACEY_ZIP 104s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_SPACEY_ZIP 186s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_SPACEY_ZIP 206s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_SPUR_M /\bSPUR-M\b/i #describe FB_SPUR_M Phrase: SPUR-M ###score FB_SPUR_M 10.357 ##counts FB_SPUR_M 2175s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_SPUR_M 23s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_SPUR_M 23s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_STAMINA_IN_BED /stamina in bed/i #describe FB_STAMINA_IN_BED Phrase: stamina in bed. ###score FB_STAMINA_IN_BED 10.357 ##counts FB_STAMINA_IN_BED 7s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FB_STAMINA_IN_BED 10s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_STAMINA_IN_BED 92s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_STAMINA_IN_BED 11s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_STOCK_EXPLODE /st[0o]ck\b.{4,10}expl[o0]de/i #describe FB_STOCK_EXPLODE Looks like stocks exploding. ###score FB_STOCK_EXPLODE 10.357 ##counts FB_STOCK_EXPLODE 36s/0h of 40695 corpus (35393s/5302h MY) 12/13/05 ##counts FB_STOCK_EXPLODE 105s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_STOCK_EXPLODE 87s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_STOCK_EXPLODE 407s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_STOCK_EXPLODE 87s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_STOP_EMAILING /Stop e-?mailing me/i #describe FB_STOP_EMAILING Phrase stop e-mailing me ###score FB_STOP_EMAILING 4.133 ##counts FB_STOP_EMAILING 15s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 ##counts FB_STOP_EMAILING 28s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 ##counts FB_STOP_EMAILING 202s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_STOP_EMAILING 305s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_STREAM_OF /Watch the stream of (?:potential\s?)? customers/i #describe FB_STREAM_OF Phrase: Watch the stream of customers ###score FB_STREAM_OF 10.357 ##counts FB_STREAM_OF 32s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 ##counts FB_STREAM_OF 36s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_STREAM_OF 43s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_STRONGER_EJ /stronger ejaculation/ #describe FB_STRONGER_EJ Phrase: stronger ejaculation ###score FB_STRONGER_EJ 10.357 ##counts FB_STRONGER_EJ 4s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FB_STRONGER_EJ 185s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_STRONGER_EJ 280s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_STRONGER_EJ 187s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_SUPERBREWARD /\bSuperb\s?Rewards\b/i #describe FB_SUPERBREWARD Phrase: Superb Rewards ###score FB_SUPERBREWARD 10.357 ##counts FB_SUPERBREWARD 216s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_SUPERBREWARD 4s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_SUPERBREWARD 4s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_SYMBLO /\bSymblo\b/i #describe FB_SYMBLO Mis-spelled symbol. ###score FB_SYMBLO 10.357 ##counts FB_SYMBLO 1s/0h of 24696 corpus (15673s/9023h FVGT) 11/01/06 ##counts FB_SYMBLO 1s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 ##counts FB_SYMBLO 3s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 ##counts FB_SYMBLO 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_THIS_ADVERT /this advertiser/i #describe FB_THIS_ADVERT Phrase: this advertiser ###score FB_THIS_ADVERT 5.172 ##counts FB_THIS_ADVERT 138s/1h of 27454 corpus (21820s/5634h MY) 02/28/06 ##counts FB_THIS_ADVERT 204s/0h of 27348 corpus (19451s/7897h FT) 02/28/06 ##counts FB_THIS_ADVERT 477s/0h of 101690 corpus (62275s/39415h DOC) 02/28/06 ##counts FB_THIS_ADVERT 532s/0h of 107818 corpus (99658s/8160h FVGT) 03/11/06 ##counts FB_THIS_ADVERT 84s/0h of 25362 corpus (16336s/9026h FVGT) 11/04/06 ##counts FB_THIS_ADVERT 301s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_THIS_ADVERT 656s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_THOUS_PERSONAL /thousand personal/i #describe FB_THOUS_PERSONAL Phrase: thousand personal ###score FB_THOUS_PERSONAL 10.357 ##counts FB_THOUS_PERSONAL 954s/0h of 34977 corpus (27086s/7891h FT) 03/01/06 ##counts FB_THOUS_PERSONAL 604s/0h of 103116 corpus (63731s/39385h DOC) 03/01/06 ##counts FB_THOUS_PERSONAL 76s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_THOUS_PERSONAL 76s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_TIRED_OF_YOUR /Tired of your/i #describe FB_TIRED_OF_YOUR Phrase: Tired of your ###score FB_TIRED_OF_YOUR 10.357 ##counts FB_TIRED_OF_YOUR 55s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 ##counts FB_TIRED_OF_YOUR 227s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_TIRED_OF_YOUR 188s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 ##counts FB_TIRED_OF_YOUR 71s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_TIRED_OF_YOUR 90s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##To stop further distribution ##To longer get distribution ##To stop receiving announcements ##To stop announcements #body FB_TO_STOP_DISTRO /To (?:(?:stop further|longer get) distribution|stop (?:receiving )?announcements)/i #describe FB_TO_STOP_DISTRO Phrase: to stop further distribution ###score FB_TO_STOP_DISTRO 10.222 ##counts FB_TO_STOP_DISTRO 19s/0h of 25733 corpus (16658s/9075h FVGT) 11/08/06 ##counts FB_TO_STOP_DISTRO 25s/0h of 26801 corpus (17723s/9078h FVGT) 11/09/06 ##counts FB_TO_STOP_DISTRO 75s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_TO_STOP_DISTRO 100s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_UGGS_NOW /Uggs Now/i #describe FB_UGGS_NOW Phrase: uggs now ###score FB_UGGS_NOW 10.357 ##counts FB_UGGS_NOW 2s/0h of 24567 corpus (15543s/9024h FVGT) 10/31/06 ##counts FB_UGGS_NOW 10s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 ##counts FB_UGGS_NOW 28s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_UGGS_NOW 62s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_ULTRA_ALLURE /Ultra Allure/i #describe FB_ULTRA_ALLURE Phrase: Ultra Allure ###score FB_ULTRA_ALLURE 10.357 ##counts FB_ULTRA_ALLURE 39s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 ##counts FB_ULTRA_ALLURE 6s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_ULTRA_ALLURE 33s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_ULTRA_ALLURE 12s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_UNLOCK_YOUR_G /lock ?(?:to ?)? your girlfriend/i #describe FB_UNLOCK_YOUR_G Phrase: lock to your girlfriend ###score FB_UNLOCK_YOUR_G 10.357 ##counts FB_UNLOCK_YOUR_G 9s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 ##counts FB_UNLOCK_YOUR_G 23s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_UNLOCK_YOUR_G 225s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_UNLOCK_YOUR_G 54s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_UNLOCK_YOUR_G 100s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_UNRESOLV_PROV /\{PROV_\d_\d\}/ #describe FB_UNRESOLV_PROV Pattern Replacement PROV_D ###score FB_UNRESOLV_PROV 10.357 ##counts FB_UNRESOLV_PROV 3s/0h of 25733 corpus (16658s/9075h FVGT) 11/08/06 ##counts FB_UNRESOLV_PROV 3s/0h of 26801 corpus (17723s/9078h FVGT) 11/09/06 ##counts FB_UNRESOLV_PROV 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_V_SPACE_GRA m'(?:V|\\/).{2,5} G R A [a-z]' #describe FB_V_SPACE_GRA Looks like Viagra? ###score FB_V_SPACE_GRA 10.357 ##counts FB_V_SPACE_GRA 31s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FB_V_SPACE_GRA 31s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_V_SPACE_GRA 31s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_VERIFY_ZIP /verify your zipcode/i #describe FB_VERIFY_ZIP Phrase: verify your zipcode ###score FB_VERIFY_ZIP 4.897 ##counts FB_VERIFY_ZIP 94s/0h of 22976 corpus (17263s/5713h MY) 03/17/06 ##counts FB_VERIFY_ZIP 65s/0h of 103688 corpus (96287s/7401h FVGT) 03/17/06 ##counts FB_VERIFY_ZIP 18s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_VERIFY_ZIP 35s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_VERIFY_ZIP 58s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_WHILECONNECTED /while connected to the internet/i #describe FB_WHILECONNECTED Phrase: white connected to the internet ###score FB_WHILECONNECTED 10.357 ##counts FB_WHILECONNECTED 1s/0h of 34935 corpus (26998s/7937h FT) 03/02/06 ##counts FB_WHILECONNECTED 6s/0h of 107818 corpus (99658s/8160h FVGT) 03/11/06 ##counts FB_WHILECONNECTED 151s/0h of 102872 corpus (63496s/39376h DOC) 03/02/06 ##counts FB_WHILECONNECTED 1s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_WHILECONNECTED 156s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_WHITEGOLD /white gold sound good/ #describe FB_WHITEGOLD Phrase: white gold sound good ###score FB_WHITEGOLD 10.357 ##counts FB_WHITEGOLD 7s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FB_WHITEGOLD 8s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_WHITEGOLD 344s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_WHITEGOLD 8s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_WITHOUT_INCRE /without increasing your/i #describe FB_WITHOUT_INCRE Phrase: without increasing your ###score FB_WITHOUT_INCRE 1.193 ##counts FB_WITHOUT_INCRE 1s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FB_WITHOUT_INCRE 1s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_WITHOUT_INCRE 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_WITHOUT_PRESC /without a prescript/i #describe FB_WITHOUT_PRESC Phrase: without a prescription. ###score FB_WITHOUT_PRESC 3.498 ##counts FB_WITHOUT_PRESC 2s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 ##counts FB_WITHOUT_PRESC 43s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_WITHOUT_PRESC 8s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_WITHOUT_PRESC 19s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_WORD1_END_DOLLAR / [a-z013]{3,6}\$ /i #describe FB_WORD1_END_DOLLAR Looks like a word ending with a $ ###score FB_WORD1_END_DOLLAR 1.294 #FP Reports ##counts FB_WORD1_END_DOLLAR 1569s/0h of 345244 corpus (337372s/7872h FT) 02/07/06 ##counts FB_WORD1_END_DOLLAR 2820s/0h of 107818 corpus (99658s/8160h FVGT) 03/11/06 ##counts FB_WORD1_END_DOLLAR 16s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FB_WORD1_END_DOLLAR 18s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_WORD2_END_DOLLAR /\b[a-z013]{3,6}\$ /i #describe FB_WORD2_END_DOLLAR Looks like a word ending with a $ (2) ###score FB_WORD2_END_DOLLAR 1.294 #FP Reports ##counts FB_WORD2_END_DOLLAR 1796s/0h of 345244 corpus (337372s/7872h FT) 02/07/06 ##counts FB_WORD2_END_DOLLAR 3082s/0h of 107818 corpus (99658s/8160h FVGT) 03/11/06 ##counts FB_WORD2_END_DOLLAR 21s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 ##counts FB_WORD2_END_DOLLAR 24s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_YOU_CAN_BECOME /you can become/i #describe FB_YOU_CAN_BECOME Phrase: you can become ###score FB_YOU_CAN_BECOME 1.258 ##counts FB_YOU_CAN_BECOME 84s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_YOU_CAN_BECOME 14s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 ##counts FB_YOU_CAN_BECOME 15s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_YOU_LOVE /You love can/i #describe FB_YOU_LOVE Phrase: you love can ###score FB_YOU_LOVE 4.292 ##counts FB_YOU_LOVE 8s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 ##counts FB_YOU_LOVE 14s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 ##counts FB_YOU_LOVE 250s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_YOU_LOVE 26s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_YOU_LOVE 29s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_YOU_LOVE 41s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_YOUR_MED /your med\b/ #describe FB_YOUR_MED Phrase: your med ###score FB_YOUR_MED 10.357 ##counts FB_YOUR_MED 13s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FB_YOUR_MED 1s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_YOUR_MED 10s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FB_YOUR_MED 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_YOUR_REFI /Your refi/i #describe FB_YOUR_REFI Phrase: Your refi ###score FB_YOUR_REFI 0.333 ##counts FB_YOUR_REFI 44s/0h of 35751 corpus (26053s/9698h FVGT) 11/18/06 ##counts FB_YOUR_REFI 51s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_YOUR_MORTGAGE /your mortgage/i #describe FB_YOUR_MORTGAGE Phrase: Your Mortgage ###score FB_YOUR_MORTGAGE 2.128 ##counts FB_YOUR_MORTGAGE 1589s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FB_YOUR_MORTGAGE 67s/0h of 33815 corpus (24249s/9566h FVGT) 11/16/06 ##counts FB_YOUR_MORTGAGE 104s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_YOUR_PC_ERROR /your PC has error/i #describe FB_YOUR_PC_ERROR Phrase: your pc has error ###score FB_YOUR_PC_ERROR 10.357 ##counts FB_YOUR_PC_ERROR 2s/0h of 43642 corpus (34621s/9021h FVGT) 10/26/06 ##counts FB_YOUR_PC_ERROR 25s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_YOUR_PC_ERROR 58s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FB_YOUR_PC_ERROR 166s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_YOUR_REFILL /your refill/i #describe FB_YOUR_REFILL Phrase: your refill ###score FB_YOUR_REFILL 3.157 ##counts FB_YOUR_REFILL 58s/0h of 345244 corpus (337372s/7872h FT) 02/07/06 ##counts FB_YOUR_REFILL 40s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_YOUR_REFILL 139s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_YOUR_REFILL 40s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_YOUR_WEIGHT /about your weight/i #describe FB_YOUR_WEIGHT Phrase: about your weight ###score FB_YOUR_WEIGHT 3.531 ##counts FB_YOUR_WEIGHT 1s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 ##counts FB_YOUR_WEIGHT 15s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 ##counts FB_YOUR_WEIGHT 29s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_YOUR_WEIGHT 48s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_YOUR_WOMAN /your woman will be/ #describe FB_YOUR_WOMAN Phrase: Your woman will be ###score FB_YOUR_WOMAN 10.357 ##counts FB_YOUR_WOMAN 2s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FB_YOUR_WOMAN 36s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FB_YOUR_WOMAN 193s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FB_YOUR_WOMAN 296s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 ##counts FB_YOUR_WOMAN 42s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_YOURSELF_MASTER /yourself master/i #describe FB_YOURSELF_MASTER Phrase: yourself master ###score FB_YOURSELF_MASTER 10.357 ##counts FB_YOURSELF_MASTER 954s/0h of 34977 corpus (27086s/7891h FT) 03/01/06 ##counts FB_YOURSELF_MASTER 3420s/0h of 107818 corpus (99658s/8160h FVGT) 03/11/06 ##counts FB_YOURSELF_MASTER 76s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FB_YOURSELF_MASTER 76s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FB_YOUTH_THIS /YOUTH is BACK!/ #describe FB_YOUTH_THIS Phrase: Youth is Back! ###score FB_YOUTH_THIS 10.357 ##counts FB_YOUTH_THIS 155s/0h of 35267 corpus (25646s/9621h FVGT) 11/17/06 ##counts FB_YOUTH_THIS 157s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##========= Header Rules ============== # # ## Seen 1980 used in current spam. #header FH_DATE_IS_19XX Date =~ /19[789][0-9]/ [if-unset: 2006] #describe FH_DATE_IS_19XX The date is not 19xx. ###score FH_DATE_IS_19XX 10.357 ##counts FH_DATE_IS_19XX 36s/0h of 103219 corpus (95719s/7500h FVGT) 03/21/06 ##counts FH_DATE_IS_19XX 12s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FH_DATE_IS_19XX 172s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FH_DATE_IS_19XX 12s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ## Date: Tue, 19 Jan 2038 11:14:07 +0800 ## This exact date is VERY COMMON! ##header FH_DATE_PAST_20XX Date =~ /20[2-9][0-9]/ [if-unset: 2006] ##describe FH_DATE_PAST_20XX The date is grossly in the future. ###score FH_DATE_PAST_20XX 10.357 ##counts FH_DATE_PAST_20XX 207s/0h of 103219 corpus (95719s/7500h FVGT) 03/21/06 ##counts FH_DATE_PAST_20XX 290s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FH_DATE_PAST_20XX 393s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FH_DATE_PAST_20XX 298s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_FAKE_RCVD_LINE Received =~ /from\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s*by\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3};\s*[SMTWF].{2},\s*\d{1,2}\s*[JFMASOND].{2,5}\s*\d{4}\s*\d{2}:\d{2}:\d{2}\s*[-+]\d{4}/ #describe FH_FAKE_RCVD_LINE RCVD line looks faked (A) ###score FH_FAKE_RCVD_LINE 10.357 ##counts FH_FAKE_RCVD_LINE 428s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FH_FAKE_RCVD_LINE 437s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FH_FAKE_RCVD_LINE 437s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_FAKE_RCVD_LINE_B Received =~ /from\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s*by\s*[a-z0-9.]{4,24}\.[a-z0-9.]{4,36}\.(?:com|net|org|biz);\s*[SMTWF].{2},\s*\d{1,2}\s*[JFMASOND].{2,5}\s*\d{4}\s*\d{2}:\d{2}:\d{2}\s*[-+]\d{4}/i #describe FH_FAKE_RCVD_LINE_B RCVD line looks faked (B) ###score FH_FAKE_RCVD_LINE_B 5.777 ##counts FH_FAKE_RCVD_LINE_B 7s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FH_FAKE_RCVD_LINE_B 28s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FH_FAKE_RCVD_LINE_B 1s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 ##counts FH_FAKE_RCVD_LINE_B 7s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_FROM_CASH From:name =~ /\bcash\b/i #describe FH_FROM_CASH From name has "cash" ###score FH_FROM_CASH 1.882 ##counts FH_FROM_CASH 54s/0h of 27454 corpus (21820s/5634h MY) 02/28/06 ##counts FH_FROM_CASH 4s/0h of 12254 corpus (6582s/5672h CT) 02/28/06 ##counts FH_FROM_CASH 91s/0h of 27348 corpus (19451s/7897h FT) 02/28/06 ##counts FH_FROM_CASH 88s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FH_FROM_CASH 113s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ## Bug 6353 #header FH_FROMEML_NOTLD From:addr !~ /\@[^@]+\.(?:[a-z]{2,}|xn--[a-z0-9]+(?:-[a-z0-9]*)?)$/i [if-unset: foo@bar.com] #describe FH_FROMEML_NOTLD E-mail address doesn't have TLD (.com, etc.) ###score FH_FROMEML_NOTLD 2.268 ##counts FH_FROMEML_NOTLD 104s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 ##counts FH_FROMEML_NOTLD 106s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FH_FROMEML_NOTLD 107s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_FROM_RND_1 From =~ /%(?:from|RND_)/ #describe FH_FROM_RND_1 From has pattern replacement broken. ###score FH_FROM_RND_1 10.357 ##counts FH_FROM_RND_1 255s/0h of 103059 corpus (95661s/7398h FVGT) 03/20/06 ##counts FH_FROM_RND_1 76s/0h of 25009 corpus (15987s/9022h FVGT) 11/03/06 ##counts FH_FROM_RND_1 76s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_FROM_GET_NAME From:name =~ /\bGet\b/i #describe FH_FROM_GET_NAME From name says Get ###score FH_FROM_GET_NAME 2.598 ##counts FH_FROM_GET_NAME 56s/0h of 25009 corpus (15987s/9022h FVGT) 11/03/06 ##counts FH_FROM_GET_NAME 3s/0h of 9077 corpus (4464s/4613h AxB) 11/03/06 ##counts FH_FROM_GET_NAME 110s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FH_FROM_GET_NAME 54s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 ##counts FH_FROM_GET_NAME 93s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_FROM_GIVEAWAY From =~ /Giveaway/i #describe FH_FROM_GIVEAWAY From name is giveaway. ###score FH_FROM_GIVEAWAY 2.269 ##counts FH_FROM_GIVEAWAY 35s/0h of 27348 corpus (19451s/7897h FT) 02/28/06 ##counts FH_FROM_GIVEAWAY 416s/0h of 101690 corpus (62275s/39415h DOC) 02/28/06 ##counts FH_FROM_GIVEAWAY 2s/0h of 25009 corpus (15987s/9022h FVGT) 11/03/06 ##counts FH_FROM_GIVEAWAY 26s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FH_FROM_GIVEAWAY 54s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_FROM_START_YOU From =~ /^You\b/i #describe FH_FROM_START_YOU From starts with you. ###score FH_FROM_START_YOU 0.799 ##counts FH_FROM_START_YOU 19s/0h of 70283 corpus (50296s/19987h ML) 03/20/06 ##counts FH_FROM_START_YOU 1s/0h of 103059 corpus (95661s/7398h FVGT) 03/20/06 ##counts FH_FROM_START_YOU 1s/0h of 25009 corpus (15987s/9022h FVGT) 11/03/06 ##counts FH_FROM_START_YOU 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_HAS_UID exists:UID #describe FH_HAS_UID Header UID found. ###score FH_HAS_UID 0.877 ##counts FH_HAS_UID 31s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 ##counts FH_HAS_UID 129s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_HELO_ALMOST_IP X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+[a-z][-.]\d{1,3}[-.]\d{1,3}[-.]\d{1,3}[-.][a-z][^ ]+ /i #describe FH_HELO_ALMOST_IP Helo is almost an IP addr. ###score FH_HELO_ALMOST_IP 5.417 ##counts FH_HELO_ALMOST_IP 82s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FH_HELO_ALMOST_IP 109s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_HELO_GMAILSMTP Received =~ /HELO gmail-smtp-in/ #describe FH_HELO_GMAILSMTP Faked helo of gmail-smtp-in ###score FH_HELO_GMAILSMTP 10.357 ##counts FH_HELO_GMAILSMTP 294s/0h of 34977 corpus (27086s/7891h FT) 03/01/06 ##counts FH_HELO_GMAILSMTP 159s/0h of 103116 corpus (63731s/39385h DOC) 03/01/06 ##counts FH_HELO_GMAILSMTP 1s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FH_HELO_GMAILSMTP 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_HELO_ENDS_DOT X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+\. by=/ #describe FH_HELO_ENDS_DOT Helo ends with a dot. ###score FH_HELO_ENDS_DOT 10.993 ##counts FH_HELO_ENDS_DOT 211s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FH_HELO_ENDS_DOT 28s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FH_HELO_ENDS_DOT 34s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FH_HELO_ENDS_DOT 57s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_HELO_EQ_610HEX X-Spam-Relays-External =~ /^[^\]]+ helo=-?[A-F0-9]{6,10} / #describe FH_HELO_EQ_610HEX Helo is 6-10 hex chr's. ###score FH_HELO_EQ_610HEX 10.599 ##counts FH_HELO_EQ_610HEX 9235s/0h of 222450 corpus (214521s/7929h FVGT) 04/24/06 ##counts FH_HELO_EQ_610HEX 459s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FH_HELO_EQ_610HEX 473s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FH_HELO_EQ_610HEX 520s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_HELO_EQ_CHARTER X-Spam-Relays-External =~ /^[^\]]+ helo=\d{2,3}-\d{1,3}-\d{1,3}-\d{1,3}.{5,20}\.charter\.com /i #describe FH_HELO_EQ_CHARTER Helo is d-d-d-d charter.com ###score FH_HELO_EQ_CHARTER 2.175 ##counts FH_HELO_EQ_CHARTER 280s/0h of 41722 corpus (34113s/7609h FVGT) 03/27/06 ##counts FH_HELO_EQ_CHARTER 130s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FH_HELO_EQ_CHARTER 174s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ## OBSOLETE / Misfires on too many ham cases ## https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6778 ## ## header FH_HELO_EQ_D_D_D_D X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]{0,15}\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3}/ ## describe FH_HELO_EQ_D_D_D_D Helo is d-d-d-d ###score FH_HELO_EQ_D_D_D_D 1.397 ##counts FH_HELO_EQ_D_D_D_D 2911s/1h of 41684 corpus (34086s/7598h FVGT) 03/27/06 ##counts FH_HELO_EQ_D_D_D_D 1306s/1h of 33966 corpus (24401s/9565h FVGT) 11/16/06 ##counts FH_HELO_EQ_D_D_D_D 1323s/1h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FH_HELO_EQ_D_D_D_D 1338s/1h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FH_HELO_EQ_D_D_D_D 1834s/1h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ## redundant with RDNS_DYNAMIC, causing FPs: bug 5682 # ### header FH_HOST_ALMOST_IP X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+[a-z][-.]\d{1,3}[-.]\d{1,3}[-.]\d{1,3}[-.][a-z][^ ]+ /i ### describe FH_HOST_ALMOST_IP The host almost looks like an IP addr. ### ##score FH_HOST_ALMOST_IP 1.889 ### #counts HOST_ALMOST_IP 117s/2h of 15656 corpus (7711s/7945h FT) 04/20/06 ### #counts HOST_ALMOST_IP 501s/2h of 42071 corpus (34145s/7926h FVGT) 04/20/06 ### #counts FH_HOST_ALMOST_IP 917s/2h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ### #counts FH_HOST_ALMOST_IP 952s/2h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ### #counts FH_HOST_ALMOST_IP 1283s/4h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ## redundant with RDNS_DYNAMIC, causing FPs: bug 5682 ## overlap spam: 90% of RDNS_DYNAMIC hits also hit FH_HOST_EQ_D_D_D_D; 84% of FH_HOST_EQ_D_D_D_D hits also hit RDNS_DYNAMIC # # ### header FH_HOST_EQ_D_D_D_D X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\d{1,3}[^0-9]\d{1,3}[^0-9]\d{1,3}[^0-9]\d{1,3}[^ ]+ / ### describe FH_HOST_EQ_D_D_D_D Host starts with d-d-d-d ### ##score FH_HOST_EQ_D_D_D_D 0.665 ### #counts HOST_EQ_D_D_D_D 10886s/231h of 41745 corpus (34134s/7611h FVGT) 03/29/06 ### #counts FH_HOST_EQ_D_D_D_D 8057s/308h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ### #counts FH_HOST_EQ_D_D_D_D 8340s/308h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ### #counts FH_HOST_EQ_D_D_D_D 11366s/308h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ## now hits nothing in http://ruleqa.spamassassin.org/20071029-r589545-n ### header FH_HOST_EQ_D_D_D_DB X-Spam-Relays-External =~ /^[^\]]+ rdns=\d{1,3}[^0-9]\d{1,3}[^0-9]\d{1,3}[^0-9]\d{1,3}[^ ]+ / ### describe FH_HOST_EQ_D_D_D_DB Host is d-d-d-d ### ##score FH_HOST_EQ_D_D_D_DB 0.688 ### #counts HOST_EQ_D_D_D_DB 4324s/71h of 42070 corpus (34144s/7926h FVGT) 04/19/06 ### #counts FH_HOST_EQ_D_D_D_DB 2893s/107h of 33966 corpus (24401s/9565h FVGT) 11/16/06 ### #counts FH_HOST_EQ_D_D_D_DB 2989s/107h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ### #counts FH_HOST_EQ_D_D_D_DB 3087s/107h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ### #counts FH_HOST_EQ_D_D_D_DB 4217s/107h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_HOST_EQ_DYNAMICIP X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]{0,25}[dD][yY][nN][aA][mM][iI][cC][iI][pP][^ ]{5,25} helo=/ #describe FH_HOST_EQ_DYNAMICIP Host is dynamicip ###score FH_HOST_EQ_DYNAMICIP 2.177 ##counts FH_HOST_EQ_DYNAMICIP 211s/0h of 41665 corpus (34068s/7597h FVGT) 03/25/06 ##counts FH_HOST_EQ_DYNAMICIP 613s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FH_HOST_EQ_DYNAMICIP 639s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FH_HOST_EQ_DYNAMICIP 832s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_HOST_EQ_PACBELL_D X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.dsl\.\w{2,10}\.pacbell\.net / #describe FH_HOST_EQ_PACBELL_D Host is pacbell.net dsl ###score FH_HOST_EQ_PACBELL_D 3.944 ##counts FH_HOST_EQ_PACBELL_D 232s/0h of 41722 corpus (34113s/7609h FVGT) 03/27/06 ##counts FH_HOST_EQ_PACBELL_D 49s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FH_HOST_EQ_PACBELL_D 53s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_HOST_EQ_SPRINT_H X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.dhcp\.sprint-hsd\.net / #describe FH_HOST_EQ_SPRINT_H Host is dhcp sprint-hsd.net ###score FH_HOST_EQ_SPRINT_H 2.293 ##counts FH_HOST_EQ_SPRINT_H 44s/0h of 41789 corpus (34114s/7675h FVGT) 04/06/06 ##counts FH_HOST_EQ_SPRINT_H 1s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FH_HOST_EQ_SPRINT_H 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_HOST_EQ_VERIZON_P X-Spam-Relays-External =~ /^[^\]]+ rdns=pool-\d.{5,30}\.verizon\.net/ #describe FH_HOST_EQ_VERIZON_P Host is pool-.+verizon.net ###score FH_HOST_EQ_VERIZON_P 2.144 ##counts FH_HOST_EQ_VERIZON_P 1393s/0h of 41686 corpus (34078s/7608h FVGT) 03/27/06 ##counts FH_HOST_EQ_VERIZON_P 436s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FH_HOST_EQ_VERIZON_P 441s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FH_HOST_EQ_VERIZON_P 518s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_MSGID_XXX MESSAGEID =~ /\@xxx/i #describe FH_MSGID_XXX Message-Id = @xxx ###score FH_MSGID_XXX 10.357 ##counts FH_MSGID_XXX 10s/0h of 50422 corpus (42421s/8001h FVGT) 03/07/06 ##counts FH_MSGID_XXX 6s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 ##counts FH_MSGID_XXX 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##from barometer baptistery by #header FH_RCVD_FROM_2_WDS Received =~ /from \w+ \w+ by/i #describe FH_RCVD_FROM_2_WDS RCVD line has 2 words after from. ###score FH_RCVD_FROM_2_WDS 10.357 ##counts FH_RCVD_FROM_2_WDS 9s/0h of 24696 corpus (15673s/9023h FVGT) 11/01/06 ##counts FH_RCVD_FROM_2_WDS 141s/0h of 25311 corpus (18683s/6628h CT) 11/03/06 ##counts FH_RCVD_FROM_2_WDS 727s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FH_RCVD_FROM_2_WDS 94s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FH_RCVD_FROM_2_WDS 124s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FH_RCVD_FROM_2_WDS 256s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_RCVD_HELODATE Received =~ /from \[(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)/ #describe FH_RCVD_HELODATE The HELO Looks like a date? ###score FH_RCVD_HELODATE 10.357 ##counts FH_RCVD_HELODATE 10s/0h of 42141 corpus (34216s/7925h FVGT) 04/25/06 ##counts FH_RCVD_HELODATE 1s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FH_RCVD_HELODATE 172s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FH_RCVD_HELODATE 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_RE_NEW_DDD Subject =~ /^Re: new\s?\d{0,3}$/i #describe FH_RE_NEW_DDD Subject is Re: new \d\d\d ###score FH_RE_NEW_DDD 10.357 ##counts FH_RE_NEW_DDD 266s/0h of 26801 corpus (17723s/9078h FVGT) 11/09/06 ##counts FH_RE_NEW_DDD 792s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FH_RE_NEW_DDD 1317s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ## Feb 7 2007 jm: replaced with RDNS_NONE! ## header FH_RELAY_NODNS X-Spam-Relays-External =~ /^[^\]]+rdns= helo=/ ## describe FH_RELAY_NODNS We could not determine your Reverse DNS ###score FH_RELAY_NODNS 1.451 #Prone to FPs. ##counts FH_RELAY_NODNS 12654s/99h of 41713 corpus (34082s/7631h FVGT) 04/03/06 ##counts FH_RELAY_NODNS 85775s/103h of 222960 corpus (215032s/7928h FVGT) 04/22/06 ##counts FH_RELAY_NODNS 6020s/115h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FH_RELAY_NODNS 6293s/116h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FH_RELAY_NODNS 6424s/116h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FH_RELAY_NODNS 8455s/120h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_SPOOF_NAMES ALL =~ /\$names\@/i #describe FH_SPOOF_NAMES Pattern Replacement Failure ###score FH_SPOOF_NAMES 10.357 ##counts FH_SPOOF_NAMES 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FH_SPOOF_NAMES 0s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FH_SPOOF_NAMES 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_USER_MOZILLA_SMAL user-agent =~ /mozilla/ #describe FH_USER_MOZILLA_SMAL Specific signs of ratware ###score FH_USER_MOZILLA_SMAL 10.357 ##counts FH_USER_MOZILLA_SMAL 11s/0h of 26801 corpus (17723s/9078h FVGT) 11/09/06 ##counts FH_USER_MOZILLA_SMAL 90s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FH_USER_MOZILLA_SMAL 221s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_VIRUS_NORTON X-Virus-Status =~ /Scanned by norton/ #describe FH_VIRUS_NORTON Does Norton really not have caps? ###score FH_VIRUS_NORTON 10.357 ##counts FH_VIRUS_NORTON 10s/0h of 50422 corpus (42421s/8001h FVGT) 03/07/06 ##counts FH_VIRUS_NORTON 130s/0h of 89519 corpus (71646s/17873h ML) 03/07/06 ##counts FH_VIRUS_NORTON 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FH_VIRUS_NORTON 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FH_XCOMMENT_GIBBER X-Comment =~ /[a-z]{15}/i #describe FH_XCOMMENT_GIBBER X-Comment is gibberish ###score FH_XCOMMENT_GIBBER 5.382 ##counts FH_XCOMMENT_GIBBER 6s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 ##counts FH_XCOMMENT_GIBBER 8s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FH_XCOMMENT_GIBBER 10s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FH_XCOMMENT_GIBBER 17s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##========= Rawbody Rules ============== # # #rawbody FR_3TAG_3TAG m'<[abcefghijklmnoqstuvwxz]{3}>'i #describe FR_3TAG_3TAG Looks like 3 small tags. ###score FR_3TAG_3TAG 1.758 ##counts FR_3TAG_3TAG 927s/0h of 40929 corpus (31147s/9782h ML) 12/26/05 ##counts FR_3TAG_3TAG 333s/0h of 17415 corpus (9736s/7679h FT) 01/03/06 ##counts FR_3TAG_3TAG 808s/0h of 77837 corpus (38456s/39381h DOC) 01/03/06 ##counts FR_3TAG_3TAG 46s/0h of 25358 corpus (16335s/9023h FVGT) 11/04/06 ##counts FR_3TAG_3TAG 47s/1h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FR_3TAG_3TAG 48s/1h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #rawbody FR_ALMOST_VIAG2 /[^a-z](?!viagra)v?ia.?g.?ra/i #describe FR_ALMOST_VIAG2 Almost looks like viagra. ###score FR_ALMOST_VIAG2 10.357 ##counts FR_ALMOST_VIAG2 23s/0h of 17368 corpus (9729s/7639h FT) 01/02/06 ##counts FR_ALMOST_VIAG2 132s/0h of 77273 corpus (37963s/39310h DOC) 01/02/06 ##counts FR_ALMOST_VIAG2 65s/0h of 25358 corpus (16335s/9023h FVGT) 11/04/06 ##counts FR_ALMOST_VIAG2 96s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FR_ALMOST_VIAG2 151s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #rawbody FR_CANTSEETEXT /class="?cantseetext/i #describe FR_CANTSEETEXT Phrase class=cantseetext ###score FR_CANTSEETEXT 10.357 ##counts FR_CANTSEETEXT 29s/0h of 17368 corpus (9729s/7639h FT) 01/02/06 ##counts FR_CANTSEETEXT 289s/0h of 77837 corpus (38456s/39381h DOC) 01/03/06 ##counts FR_CANTSEETEXT 2s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FR_CANTSEETEXT 86s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FR_CANTSEETEXT 4s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FR_CANTSEETEXT 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #rawbody FR_COMMENT_ODD /<-\*->/ #describe FR_COMMENT_ODD Strange HTML comment. ###score FR_COMMENT_ODD 10.357 ##counts FR_COMMENT_ODD 130s/0h of 22940 corpus (17232s/5708h MY) 04/25/06 ##counts FR_COMMENT_ODD 397s/0h of 42141 corpus (34216s/7925h FVGT) 04/25/06 ##counts FR_COMMENT_ODD 468s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FR_COMMENT_ODD 511s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #rawbody FR_DIV_DRUGS_3 m'(?:]{0,20}> (?: )?[a-z0-9$] (?: )? ){3}'i #describe FR_DIV_DRUGS_3 Looks like many div's in drug spam. ###score FR_DIV_DRUGS_3 3.799 ##counts FR_DIV_DRUGS_3 15s/0h of 34977 corpus (27086s/7891h FT) 03/01/06 ##counts FR_DIV_DRUGS_3 366s/0h of 84470 corpus (67306s/17164h ML) 03/01/06 ##counts FR_DIV_DRUGS_3 5s/0h of 25358 corpus (16335s/9023h FVGT) 11/04/06 ##counts FR_DIV_DRUGS_3 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #rawbody FR_DOT_FEVER_5 /(?:[a-z ']{2,35}\s[.,]\s){5}/ #describe FR_DOT_FEVER_5 Lots of dots inbetween letters. ###score FR_DOT_FEVER_5 3.9 ##counts FR_DOT_FEVER_5 0s/0h of 17415 corpus (9736s/7679h FT) 01/03/06 ##counts FR_DOT_FEVER_5 1s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 ##counts FR_DOT_FEVER_5 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #rawbody FR_IMPORT_CSS /\@import url\(/i #describe FR_IMPORT_CSS Special @import url css ###score FR_IMPORT_CSS 1.889 ##counts FR_IMPORT_CSS 1s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 ##counts FR_IMPORT_CSS 9s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 ##counts FR_IMPORT_CSS 25s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #rawbody FR_M_E_D_S /M E D S/i #describe FR_M_E_D_S Spaced out M E D S ###score FR_M_E_D_S 10.357 ##counts FR_M_E_D_S 182s/0h of 82118 corpus (57948s/24170h ML) 04/03/06 ##counts FR_M_E_D_S 24s/0h of 41810 corpus (34135s/7675h FVGT) 04/03/06 ##counts FR_M_E_D_S 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FR_M_E_D_S 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #rawbody FR_MIDER m'http[^ ]{5,30}/gall?/' #describe FR_MIDER Sign often seen in spams ###score FR_MIDER 10.357 ##counts FR_MIDER 3s/0h of 5479 corpus (1297s/4182h AxB) 09/25/06 ##counts FR_MIDER 366s/0h of 21635 corpus (15142s/6493h CT) 09/25/06 ##counts FR_MIDER 730s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 ##counts FR_MIDER 761s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FR_MIDER 788s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #rawbody FR_P_END_P_MANY10 m'(?:

){10}'i #describe FR_P_END_P_MANY10 Many

(10) ###score FR_P_END_P_MANY10 10.539 ##counts FR_P_END_P_MANY10 3s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 ##counts FR_P_END_P_MANY10 10s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FR_P_END_P_MANY10 66s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FR_P_END_P_MANY10 21s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #rawbody FR_PORN_NOT_URL /\b,(?:hVX|WeQ|VSd|WeQ)\b/ #describe FR_PORN_NOT_URL Looks like a porn url seen before. ###score FR_PORN_NOT_URL 10.357 ##counts FR_PORN_NOT_URL 155s/0h of 34977 corpus (27086s/7891h FT) 03/01/06 ##counts FR_PORN_NOT_URL 174s/0h of 84470 corpus (67306s/17164h ML) 03/01/06 ##counts FR_PORN_NOT_URL 9s/0h of 25358 corpus (16335s/9023h FVGT) 11/04/06 ##counts FR_PORN_NOT_URL 15s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #rawbody FR_TEST_BASE64_BAD /[a-z0-9]{70}
/i #describe FR_TEST_BASE64_BAD Looks like bad BASE64 with
at end. ###score FR_TEST_BASE64_BAD 3.189 ##counts FR_TEST_BASE64_BAD 150s/0h of 27452 corpus (21819s/5633h MY) 03/03/06 ##counts FR_TEST_BASE64_BAD 6s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FR_TEST_BASE64_BAD 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #rawbody FR_TITLE_CONS_6 m'.{0,4}[bcdfgjklmnpqrstvwxyz]{6}.{0,25}'i #describe FR_TITLE_CONS_6 Title Attribute has 6 non-vowels. ###score FR_TITLE_CONS_6 0.865 ##counts FR_TITLE_CONS_6 3s/0h of 103688 corpus (96287s/7401h FVGT) 03/17/06 ##counts FR_TITLE_CONS_6 33s/0h of 108996 corpus (71372s/37624h DOC) 03/17/06 ##counts FR_TITLE_CONS_6 1s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FR_TITLE_CONS_6 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #rawbody FR_TITLE_NUMS m'\d+'i #describe FR_TITLE_NUMS HTML Title is only numbers ###score FR_TITLE_NUMS 10.357 ##counts FR_TITLE_NUMS 23s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 ##counts FR_TITLE_NUMS 19s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FR_TITLE_NUMS 228s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FR_TITLE_NUMS 200s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FR_TITLE_NUMS 263s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##========== Subject Rules ================= # # #header FS_ABIGGER Subject =~ /a bigger/i #describe FS_ABIGGER Subject has "a bigger" ###score FS_ABIGGER 2.399 ##counts FS_ABIGGER 8s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 ##counts FS_ABIGGER 10s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 ##counts FS_ABIGGER 12s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_APPROVE_YOU Subject =~ /approve you/i #describe FS_APPROVE_YOU Subject says approve you ###score FS_APPROVE_YOU 2.973 ##counts FS_APPROVE_YOU 7s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FS_APPROVE_YOU 1s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FS_APPROVE_YOU 66s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FS_APPROVE_YOU 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_AT_NO_COST Subject =~ /\bat no cost/i #describe FS_AT_NO_COST Subject says "At No Cost" ###score FS_AT_NO_COST 2.489 ##counts FS_AT_NO_COST 47s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 ##counts FS_AT_NO_COST 60s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FS_AT_NO_COST 24s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_AT_NO_COST 57s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##attract more customers #header FS_ATTRACT_CUST Subject =~ /Attract (?:\w{2,8}\s)?customer/i #describe FS_ATTRACT_CUST Subject says Attract something customer ###score FS_ATTRACT_CUST 0.889 ##counts FS_ATTRACT_CUST 1s/0h of 50733 corpus (42740s/7993h FVGT) 03/06/06 ##counts FS_ATTRACT_CUST 3s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 ##counts FS_ATTRACT_CUST 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_BROKEN_MEETING Subject =~ /(?!meeting)m.{0,1}e.{0,1}e.{0,1}t.{0,1}i.{0,1}n.{0,1}g/i #describe FS_BROKEN_MEETING Subject looks like meeting but broken. ###score FS_BROKEN_MEETING 10.357 ##counts FS_BROKEN_MEETING 3s/0h of 24999 corpus (15974s/9025h FVGT) 11/02/06 ##counts FS_BROKEN_MEETING 31s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FS_BROKEN_MEETING 6s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_BROKEN_MEETING 8s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_CHEAP_CAP Subject =~ /CHEAP/ #describe FS_CHEAP_CAP Phrase: Cheap in Caps in Subject. ###score FS_CHEAP_CAP 2.522 ##counts FS_CHEAP_CAP 6s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 ##counts FS_CHEAP_CAP 7s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_CHEAP_CAP 8s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_CAILIS Subject =~ /\bcailis\b/i #describe FS_CAILIS Subject says cailis ###score FS_CAILIS 10.357 ##counts FS_CAILIS 13s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 ##counts FS_CAILIS 0s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_CAILIS 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_CLAIM_NOW Subject =~ /Claim Now/i #describe FS_CLAIM_NOW Subject says "Claim now" ###score FS_CLAIM_NOW 1.975 ##counts FS_CLAIM_NOW 11s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 ##counts FS_CLAIM_NOW 1s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FS_CLAIM_NOW 12s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FS_CLAIM_NOW 21s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_COSTARICA Subject =~ /costa rica/i #describe FS_COSTARICA Subject says Costa Rica ###score FS_COSTARICA 2.899 ##counts FS_COSTARICA 11s/0h of 27348 corpus (19456s/7892h FT) 02/27/06 ##counts FS_COSTARICA 64s/0h of 101278 corpus (61900s/39378h DOC) 02/27/06 ##counts FS_COSTARICA 1s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 ##counts FS_COSTARICA 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_CUTE_TEEN Subject =~ /cute teen/i #describe FS_CUTE_TEEN Subject says cute teen ###score FS_CUTE_TEEN 2.964 ##counts FS_CUTE_TEEN 211s/0h of 103219 corpus (95719s/7500h FVGT) 03/21/06 ##counts FS_CUTE_TEEN 1s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FS_CUTE_TEEN 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_DOLLAR_BONUS Subject =~ /\$\d\d\d?\.?\d?\d? bonus/i #describe FS_DOLLAR_BONUS Subject talks about money bonus! ###score FS_DOLLAR_BONUS 10.357 ##counts FS_DOLLAR_BONUS 27s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 ##counts FS_DOLLAR_BONUS 1s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FS_DOLLAR_BONUS 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_EJACULA Subject =~ /ejaculat(?:[io01][o0i1]n|e)/i #describe FS_EJACULA Phrase: ejaculation in subject. ###score FS_EJACULA 10.357 ##counts FS_EJACULA 328s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 ##counts FS_EJACULA 166s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_EJACULA 168s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FS_EJACULA 190s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_END_BILLS Subject =~ /bills\s?$/i #describe FS_END_BILLS Subject ends with bills. ###score FS_END_BILLS 1.555 ##counts FS_END_BILLS 1s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 ##counts FS_END_BILLS 16s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FS_END_BILLS 2s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_END_BILLS 4s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_ERECTION Subject =~ / erection /i #describe FS_ERECTION Phrase: erection in subject. ###score FS_ERECTION 10.579 ##counts FS_ERECTION 90s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 ##counts FS_ERECTION 3s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FS_ERECTION 81s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FS_ERECTION 4s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_GANGBANG Subject =~ /gangbang/i #describe FS_GANGBANG Phrase: subject says gangbang ###score FS_GANGBANG 10.357 ##counts FS_GANGBANG 15s/0h of 17373 corpus (9742s/7631h FT) 12/28/05 ##counts FS_GANGBANG 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FS_GANGBANG 25s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FS_GANGBANG 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_GET_LAID Subject =~ /get la[i1]d/i #describe FS_GET_LAID Phrase: get laid in subj. ###score FS_GET_LAID 10.357 ##counts FS_GET_LAID 5s/0h of 9789 corpus (4888s/4901h FT) 12/26/05 ##counts FS_GET_LAID 3s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 ##counts FS_GET_LAID 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_GIFT_CARD_OFF Subject =~ /Gift\s?Card\s?Offer/i #describe FS_GIFT_CARD_OFF Subject says Gift card offer ###score FS_GIFT_CARD_OFF 3.374 ##counts FS_GIFT_CARD_OFF 5s/0h of 15656 corpus (7711s/7945h FT) 04/20/06 ##counts FS_GIFT_CARD_OFF 43s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_GIFT_CARD_OFF 102s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_HOT_TEEN Subject =~ /hot teen/i #describe FS_HOT_TEEN Phrase: subject says "hot teen" ###score FS_HOT_TEEN 10.357 ##counts FS_HOT_TEEN 138s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 ##counts FS_HOT_TEEN 2s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 ##counts FS_HOT_TEEN 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_HUGECOCK Subject =~ /(?:huge|tiny|small) (?:c[o0]ck|d[i1]ck|p[e3]n[1i]s)/i #describe FS_HUGECOCK Phrase: Huge Cock ###score FS_HUGECOCK 10.357 ##counts FS_HUGECOCK 36s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 ##counts FS_HUGECOCK 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FS_HUGECOCK 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_LARGE_PERCENT2 Subject =~ /(?!100%)\d[0-9oi][0-9oi]%/i #describe FS_LARGE_PERCENT2 Larger than 100% in subj. ###score FS_LARGE_PERCENT2 3.357 ##counts FS_LARGE_PERCENT2 52s/0h of 33776 corpus (24217s/9559h FVGT) 11/15/06 ##counts FS_LARGE_PERCENT2 52s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_LARGE_PERCENT2 64s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_LITTLE_PILL Subject =~ /little \w+ pill/i #describe FS_LITTLE_PILL Phrase: little somthing pill. ###score FS_LITTLE_PILL 10.357 ##counts FS_LITTLE_PILL 21s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 ##counts FS_LITTLE_PILL 0s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 ##counts FS_LITTLE_PILL 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_LOW_INTMOR Subject =~ /low.{1,6}(?:interest|mortgage)/i #describe FS_LOW_INTMOR Subject says low interest or mortgage ###score FS_LOW_INTMOR 10.357 ##counts FS_LOW_INTMOR 43s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 ##counts FS_LOW_INTMOR 2s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FS_LOW_INTMOR 17s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FS_LOW_INTMOR 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_LOW_RATES Subject =~ / low rates/i #describe FS_LOW_RATES Subject says low rates ###score FS_LOW_RATES 1.556 ##counts FS_LOW_RATES 42s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 ##counts FS_LOW_RATES 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FS_LOW_RATES 39s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FS_LOW_RATES 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_LOWER_YOUR Subject =~ /lower your/i #describe FS_LOWER_YOUR Phrase: lower your ###score FS_LOWER_YOUR 1.366 ##counts FS_LOWER_YOUR 74s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 ##counts FS_LOWER_YOUR 1s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 ##counts FS_LOWER_YOUR 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_MAKE_MONEY Subject =~ /make money/i #describe FS_MAKE_MONEY Subject says "make money" ###score FS_MAKE_MONEY 1.771 ##counts FS_MAKE_MONEY 178s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 ##counts FS_MAKE_MONEY 35s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 ##counts FS_MAKE_MONEY 38s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FS_MAKE_MONEY 57s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_MORE_CONFIDENT Subject =~ /more confident/i #describe FS_MORE_CONFIDENT Subject says More Confident ###score FS_MORE_CONFIDENT 2.594 ##counts FS_MORE_CONFIDENT 9s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 ##counts FS_MORE_CONFIDENT 160s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FS_MORE_CONFIDENT 569s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 ##counts FS_MORE_CONFIDENT 25s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_NEED_MONEY Subject =~ /Need (?:\$|Cash)/i #describe FS_NEED_MONEY Subject talks about needing cash. ###score FS_NEED_MONEY 3.887 ##counts FS_NEED_MONEY 138s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 ##counts FS_NEED_MONEY 1s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FS_NEED_MONEY 3s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FS_NEED_MONEY 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_NEW_SOFT_UPLOAD Subject =~ /^New software uploaded by/ #describe FS_NEW_SOFT_UPLOAD Subj starts with New software uploaded ###score FS_NEW_SOFT_UPLOAD 10.357 ##counts FS_NEW_SOFT_UPLOAD 14s/0h of 33043 corpus (23599s/9444h FVGT) 11/15/06 ##counts FS_NEW_SOFT_UPLOAD 19s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_NEW_SOFT_UPLOAD 22s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FS_NEW_SOFT_UPLOAD 26s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_NEW_XXX Subject =~ /^Re: news? [a-z]{1,5}$/ #describe FS_NEW_XXX Subject looks like Fharmacy spams. ###score FS_NEW_XXX 10.357 ##counts FS_NEW_XXX 16s/0h of 33043 corpus (23599s/9444h FVGT) 11/15/06 ##counts FS_NEW_XXX 69s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_NEW_XXX 208s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_NO_SCRIP Subject =~ /n[o0O] p[reRE][erER]scr[i1I]pt[i1I][o0O]n/i #describe FS_NO_SCRIP Subject almost says No prescription ###score FS_NO_SCRIP 10.357 ##counts FS_NO_SCRIP 107s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 ##counts FS_NO_SCRIP 19s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FS_NO_SCRIP 19s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_NUDE Subject =~ /\bnude\b/i #describe FS_NUDE Subject says Nude ###score FS_NUDE 1.869 ##counts FS_NUDE 296s/0h of 345244 corpus (337372s/7872h FT) 02/07/06 ##counts FS_NUDE 1s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 ##counts FS_NUDE 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_NUMYO Subject =~ /1[0-9][\s\.]?y[\s\.]?o[\s\.]?\b/i #describe FS_NUMYO Speaks of teenager in subject. ###score FS_NUMYO 3.999 ##counts FS_NUMYO 1s/0h of 24567 corpus (15543s/9024h FVGT) 10/31/06 ##counts FS_NUMYO 44s/0h of 9077 corpus (4464s/4613h AxB) 11/03/06 ##counts FS_NUMYO 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_OBFU_PRMCY Subject =~ /\b(?!(?:pharmacy|primacy))p[ph]{0,4}\S{1,3}r\S{0,2}m\S{0,3}c\S{0,2}y\b/i #describe FS_OBFU_PRMCY what could this word be? ###score FS_OBFU_PRMCY 10.357 ##counts FS_OBFU_PRMCY 1057s/0h of 35267 corpus (25646s/9621h FVGT) 11/17/06 ##counts FS_OBFU_PRMCY 1101s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_PAYINGTOOM Subject =~ /paying too much for/i #describe FS_PAYINGTOOM Subject says Paying too much for ###score FS_PAYINGTOOM 3.993 ##counts FS_PAYINGTOOM 87s/0h of 115331 corpus (75904s/39427h DOC) 03/24/06 ##counts FS_PAYINGTOOM 84s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 ##counts FS_PAYINGTOOM 1s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 ##counts FS_PAYINGTOOM 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_PERSCRIPTION Subject =~ /perscr[i1]pt[i1][o0]n/i #describe FS_PERSCRIPTION Subject mis-spelled prescription ###score FS_PERSCRIPTION 10.357 ##counts FS_PERSCRIPTION 26s/0h of 32949 corpus (24998s/7951h ML) 12/13/05 ##counts FS_PERSCRIPTION 22s/0h of 70341 corpus (31030s/39311h DOC) 12/13/05 ##counts FS_PERSCRIPTION 4s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 ##counts FS_PERSCRIPTION 0s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FS_PERSCRIPTION 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_PHARMASUB2 Subject =~ /PH[A-Za-z]{2,7}MA/ #describe FS_PHARMASUB2 Looks like Phramacy subject. ###score FS_PHARMASUB2 10.357 ##counts FS_PHARMASUB2 2771s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FS_PHARMASUB2 585s/0h of 25311 corpus (18683s/6628h CT) 11/03/06 ##counts FS_PHARMASUB2 8163s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FS_PHARMASUB2 2823s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_PHARMASUB2 2819s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_PORN_STAR Subject =~ /Porn Star/i #describe FS_PORN_STAR Subject says Porn Star ###score FS_PORN_STAR 10.357 ##counts FS_PORN_STAR 1s/0h of 70341 corpus (31030s/39311h DOC) 12/13/05 ##counts FS_PORN_STAR 2s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 ##counts FS_PORN_STAR 13s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 ##counts FS_PORN_STAR 16s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_PRE_SUBJ Subject =~ /\{PRE_SUBJ\}/ #describe FS_PRE_SUBJ Subject says PRE_SUBJ ###score FS_PRE_SUBJ 10.357 ##counts FS_PRE_SUBJ 1s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FS_PRE_SUBJ 276s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FS_PRE_SUBJ 169s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 ##counts FS_PRE_SUBJ 276s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_PRE_SUBJ 276s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_RE_APPROV Subject =~ /re approved/i #describe FS_RE_APPROV Phrase: re approved ###score FS_RE_APPROV 10.357 ##counts FS_RE_APPROV 51s/0h of 115331 corpus (75904s/39427h DOC) 03/24/06 ##counts FS_RE_APPROV 45s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 ##counts FS_RE_APPROV 1s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FS_RE_APPROV 37s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FS_RE_APPROV 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_REFI Subject =~ /\brefi\b/i #describe FS_REFI Subject says "refi" ###score FS_REFI 7.388 ##counts FS_REFI 21s/0h of 9808 corpus (4903s/4905h FT) 12/14/05 ##counts FS_REFI 53s/0h of 40636 corpus (35345s/5291h MY) 12/14/05 ##counts FS_REFI 8s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_REFI 8s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##header __FS_REPLICA Subject =~ /\breplica\b/i ##meta FS_REPLICA __FS_REPLICA && !FS_REPLICAWATCH ##describe FS_REPLICA Subject says "replica" ###score FS_REPLICA 0.994 ##counts FS_REPLICA 335s/0h of 70341 corpus (31030s/39311h DOC) 12/13/05 ##counts FS_REPLICA 716s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 ##counts FS_REPLICA 34s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 ##counts FS_REPLICA 39s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_REPLICA 92s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ## header FS_REPLICAWATCH Subject =~ /replica watch\b/i ## describe FS_REPLICAWATCH Subject says Replica watch ###score FS_REPLICAWATCH 10.357 ##counts FS_REPLICAWATCH 110s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 ##counts FS_REPLICAWATCH 19s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FS_REPLICAWATCH 1429s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FS_REPLICAWATCH 54s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_RESULTS_BED Subject =~ /results in bed/i #describe FS_RESULTS_BED Subject says results in bed ###score FS_RESULTS_BED 10.357 ##counts FS_RESULTS_BED 3s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FS_RESULTS_BED 6s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FS_RESULTS_BED 33s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FS_RESULTS_BED 7s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_SILDENAFIL Subject =~ /Sildenafil Citrate/i #describe FS_SILDENAFIL Subject says "Sildenafil Citrate" ###score FS_SILDENAFIL 10.357 ##counts FS_SILDENAFIL 11s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 ##counts FS_SILDENAFIL 1s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 ##counts FS_SILDENAFIL 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_SINGLE_LETTER_H Subject =~ /\sh\s/i #describe FS_SINGLE_LETTER_H Subject has a bare H ###score FS_SINGLE_LETTER_H 0.672 ##counts FS_SINGLE_LETTER_H 8s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 ##counts FS_SINGLE_LETTER_H 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_SINGLE_LETTER_J Subject =~ /\sj\s/i #describe FS_SINGLE_LETTER_J Subject has a bare J ###score FS_SINGLE_LETTER_J 0.672 ##counts FS_SINGLE_LETTER_J 10s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 ##counts FS_SINGLE_LETTER_J 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_SPERMAX Subject =~ /Spermamax/i #describe FS_SPERMAX Subject contains Spermamax ###score FS_SPERMAX 10.357 ##counts FS_SPERMAX 30s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 ##counts FS_SPERMAX 13s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FS_SPERMAX 20s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_SPLASH Subject =~ / splash(?:ed|ing)? /i #describe FS_SPLASH Subject says splash or splashed ###score FS_SPLASH 0.868 ##counts FS_SPLASH 1s/0h of 6866 corpus (4638s/2228h AxB) 02/07/06 ##counts FS_SPLASH 10s/0h of 345244 corpus (337372s/7872h FT) 02/07/06 ##counts FS_SPLASH 0s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 ##counts FS_SPLASH 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_START_DOYOU2 Subject =~ /^Do you (?:dream|have|want|love|like|wanna)/i #describe FS_START_DOYOU2 Subject starts with Do you dream,have,want,love, etc. ###score FS_START_DOYOU2 1.633 ##counts FS_START_DOYOU2 957s/0h of 103219 corpus (95719s/7500h FVGT) 03/21/06 ##counts FS_START_DOYOU2 124s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 ##counts FS_START_DOYOU2 10s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_START_DOYOU2 22s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_START_LOSE Subject =~ /^Lose /i #describe FS_START_LOSE Subject starts with Lose ###score FS_START_LOSE 1.493 ##counts FS_START_LOSE 466s/0h of 103219 corpus (95719s/7500h FVGT) 03/21/06 ##counts FS_START_LOSE 4s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FS_START_LOSE 10s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_START_LOSE 13s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_START_TEEN Subject =~ /^Teen /i #describe FS_START_TEEN Subject starts with Teen ###score FS_START_TEEN 1.399 ##counts FS_START_TEEN 816s/0h of 103219 corpus (95719s/7500h FVGT) 03/21/06 ##counts FS_START_TEEN 5s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FS_START_TEEN 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_TEEN_BAD Subject =~ /teen.{1,15}(?:pussy|sex|slut|ass|fuck|rape)/i #describe FS_TEEN_BAD Subject says something bad about teens ###score FS_TEEN_BAD 10.357 ##counts FS_TEEN_BAD 675s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 ##counts FS_TEEN_BAD 15s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_TEEN_BAD 15s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_TIGHT_TEEN Subject =~ /tight (?:teen|pussy|ass)/i #describe FS_TIGHT_TEEN Phrase: tight teen, etc. ###score FS_TIGHT_TEEN 10.357 ##counts FS_TIGHT_TEEN 80s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 ##counts FS_TIGHT_TEEN 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_TIP_DDD Subject =~ /(?:tip|good) \d\d\d?\d?/i #describe FS_TIP_DDD Phrase: subject = tip ddd ###score FS_TIP_DDD 10.357 ##counts FS_TIP_DDD 53s/0h of 25733 corpus (16658s/9075h FVGT) 11/08/06 ##counts FS_TIP_DDD 741s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_TIP_DDD 854s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FS_TIP_DDD 1664s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_VIEWPHOTOS Subject =~ /view photos of singles in your area/i #describe FS_VIEWPHOTOS Phrase: View photos of singles... ###score FS_VIEWPHOTOS 10.357 ##counts FS_VIEWPHOTOS 115s/0h of 55252 corpus (47682s/7570h FVGT) 03/24/06 ##counts FS_VIEWPHOTOS 5s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 ##counts FS_VIEWPHOTOS 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_WE_WANT Subject =~ /^We want/i #describe FS_WE_WANT Subject starts with We Want. ###score FS_WE_WANT 1.629 ##counts FS_WE_WANT 20s/0h of 43642 corpus (34621s/9021h FVGT) 10/26/06 ##counts FS_WE_WANT 51s/0h of 257465 corpus (187155s/70310h DOC) 10/26/06 ##counts FS_WE_WANT 1s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FS_WE_WANT 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_WEIGHT_LOSS Subject =~ /weight loss/i #describe FS_WEIGHT_LOSS Subject says Weight Loss ###score FS_WEIGHT_LOSS 2.134 ##counts FS_WEIGHT_LOSS 149s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 ##counts FS_WEIGHT_LOSS 42s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 ##counts FS_WEIGHT_LOSS 44s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_WEIGHT_LOSS 44s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_WILL_HELP Subject =~ /will help/ #describe FS_WILL_HELP Subject says will help ###score FS_WILL_HELP 2.749 ##counts FS_WILL_HELP 35s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FS_WILL_HELP 19s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FS_WILL_HELP 692s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FS_WILL_HELP 357s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 ##counts FS_WILL_HELP 29s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_YOUR_COMPUTER Subject =~ /^Your computer/i #describe FS_YOUR_COMPUTER Phrase: Your Computer in Subject. ###score FS_YOUR_COMPUTER 3.645 ##counts FS_YOUR_COMPUTER 2s/0h of 43642 corpus (34621s/9021h FVGT) 10/26/06 ##counts FS_YOUR_COMPUTER 34s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_YOUR_COMPUTER 90s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_YOUR_PRESCRIP Subject =~ /Your(?: rx)? Prescription/i #describe FS_YOUR_PRESCRIP Subject talks about your prescription ###score FS_YOUR_PRESCRIP 2.575 ##counts FS_YOUR_PRESCRIP 27s/0h of 206859 corpus (199363s/7496h FT) 12/13/05 ##counts FS_YOUR_PRESCRIP 0s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FS_YOUR_PRESCRIP 11s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FS_YOUR_PRESCRIP 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header FS_YOUR_REFILL Subject =~ /your refill/i #describe FS_YOUR_REFILL Subject Phrase: your refill ###score FS_YOUR_REFILL 1.952 ##counts FS_YOUR_REFILL 2s/0h of 9808 corpus (4903s/4905h FT) 12/14/05 ##counts FS_YOUR_REFILL 40s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FS_YOUR_REFILL 40s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##====== URI RULES BELOW ============= # # #uri FU_16R m'/16r'i #describe FU_16R Often seen in spam /16r ###score FU_16R 10.357 ##counts FU_16R 68s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 ##counts FU_16R 74s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 ##counts FU_16R 166s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FU_16R 490s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #uri FU_COMMON_SUBS2 m'/(?:[2w]m|7d|b|ee|lj|j|o|u)/[,.]?$' #describe FU_COMMON_SUBS2 Sub-dir seen often in spam (2). ###score FU_COMMON_SUBS2 4.999 ##counts FU_COMMON_SUBS2 26s/0h of 42141 corpus (34216s/7925h FVGT) 04/25/06 ##counts FU_COMMON_SUBS2 137s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FU_COMMON_SUBS2 24s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FU_COMMON_SUBS2 22s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #uri FU_ENDS_NUMS_DOTS_CLK m'(?:clk|uns)/\d+\.\d+\.\d+'i #describe FU_ENDS_NUMS_DOTS_CLK Ends with clk/d+.d+.d+ ###score FU_ENDS_NUMS_DOTS_CLK 10.357 ##counts FU_ENDS_NUMS_DOTS_CLK 15s/0h of 15656 corpus (7711s/7945h FT) 04/20/06 ##counts FU_ENDS_NUMS_DOTS_CLK 19s/0h of 42071 corpus (34145s/7926h FVGT) 04/20/06 ##counts FU_ENDS_NUMS_DOTS_CLK 455s/0h of 93047 corpus (65257s/27790h ML) 04/20/06 ##counts FU_ENDS_NUMS_DOTS_CLK 8s/0h of 21937 corpus (16638s/5299h FVGT) 11/08/06 ##counts FU_ENDS_NUMS_DOTS_CLK 13s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FU_ENDS_NUMS_DOTS_CLK 19s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #uri FU_HG_PATH m'/hgh/'i #describe FU_HG_PATH URL has /hgh/ in path. ###score FU_HG_PATH 10.357 ##counts FU_HG_PATH 13s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FU_HG_PATH 391s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FU_HG_PATH 14s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #uri FU_HOODIA /hoodia/i #describe FU_HOODIA URL has hoodia in it. ###score FU_HOODIA 10.357 ##counts FU_HOODIA 601s/0h of 103688 corpus (96287s/7401h FVGT) 03/17/06 ##counts FU_HOODIA 10s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FU_HOODIA 17s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #uri FU_LONG_HTML /[a-z]{50}\.html/i #describe FU_LONG_HTML URL has long file name with .html extension. ###score FU_LONG_HTML 10.357 ##counts FU_LONG_HTML 27s/0h of 42564 corpus (34322s/8242h FVGT) 05/26/06 ##counts FU_LONG_HTML 28s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FU_LONG_HTML 28s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #uri FU_LOTSOFCOLONS m'/\w{5,25}:\w{5,25}:\w{5,25}\b'i #describe FU_LOTSOFCOLONS word:word:word in URL. ###score FU_LOTSOFCOLONS 4.999 ##counts FU_LOTSOFCOLONS 1s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 ##counts FU_LOTSOFCOLONS 95s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 ##counts FU_LOTSOFCOLONS 123s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FU_LOTSOFCOLONS 175s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #uri FU_LONG_QUERY3 m'[A-F0-9]{30}\.aspx' #describe FU_LONG_QUERY3 URL has a long file name with .aspx extension. ###score FU_LONG_QUERY3 4.799 ##counts FU_LONG_QUERY3 274s/0h of 82118 corpus (57948s/24170h ML) 04/03/06 ##counts FU_LONG_QUERY3 36s/0h of 41810 corpus (34135s/7675h FVGT) 04/03/06 ##counts FU_LONG_QUERY3 21s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FU_LONG_QUERY3 27s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #uri FU_MIDER m'/gall?/' #describe FU_MIDER URL has /gal/ ###score FU_MIDER 10.357 ##counts FU_MIDER 730s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FU_MIDER 5954s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FU_MIDER 759s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FU_MIDER 760s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FU_MIDER 787s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #uri FU_RX_DIR m'/rx/'i #describe FU_RX_DIR /rx/ ###score FU_RX_DIR 1.999 ##counts FU_RX_DIR 1s/0h of 41941 corpus (34079s/7862h FVGT) 04/14/06 ##counts FU_RX_DIR 1s/0h of 21937 corpus (16638s/5299h FVGT) 11/08/06 ##counts FU_RX_DIR 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #uri FU_SUB_D_WEIRD /3a2kf\./ #describe FU_SUB_D_WEIRD Sub-domain seen often in spam. ###score FU_SUB_D_WEIRD 10.357 ##counts FU_SUB_D_WEIRD 31s/0h of 24480 corpus (15455s/9025h FVGT) 10/30/06 ##counts FU_SUB_D_WEIRD 45s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FU_SUB_D_WEIRD 45s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FU_SUB_D_WEIRD 45s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # # #uri FU_UKGEOCITIES /\b[a-z]{2}\.geocities\.com/i #describe FU_UKGEOCITIES URL with [a-z]{2}.geocities.com ###score FU_UKGEOCITIES 5.697 ##counts FU_UKGEOCITIES 121s/0h of 21937 corpus (16638s/5299h FVGT) 11/08/06 ##counts FU_UKGEOCITIES 121s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FU_UKGEOCITIES 124s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #uri FU_URI_TRACKER_T m'/[yi]/(?:sp|et|vm|xl2)/'i #describe FU_URI_TRACKER_T URI style tracker (T) ###score FU_URI_TRACKER_T 10.357 ##counts FU_URI_TRACKER_T 9s/0h of 25009 corpus (15987s/9022h FVGT) 11/03/06 ##counts FU_URI_TRACKER_T 203s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FU_URI_TRACKER_T 221s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FU_URI_TRACKER_T 487s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##====== META RULES BELOW ============= # # ##msg A #body __BEEN_APPROVED /been approved/ ##body __CAN_HELP /can help/ #body __COMPLETE_REVIEW /complete review/ #meta FM_APPROVE_COMPLETE (__BEEN_APPROVED && __CAN_HELP && __COMPLETE_REVIEW) #describe FM_APPROVE_COMPLETE Meta approved complete review ###score FM_APPROVE_COMPLETE 4.885 ##counts FM_APPROVE_COMPLETE 1s/0h of 43642 corpus (34621s/9021h FVGT) 10/26/06 ##counts FM_APPROVE_COMPLETE 1s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FM_APPROVE_COMPLETE 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body __FB_BIG /BIG/ #body __FB_REASON /REASON/ #body __FB_BEST /BEST/ #meta FM_BIG_REASON ((__FB_BIG + __FB_REASON + __FB_BEST) > 1) #describe FM_BIG_REASON Lot's of CAP words, BIG, REASON, BEST ###score FM_BIG_REASON 10.357 ##counts FM_BIG_REASON 20s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FM_BIG_REASON 22s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FM_BIG_REASON 203s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FM_BIG_REASON 29s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FM_BIG_REASON 56s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header __FS_CLAIM_YOUR Subject =~ /claim your/i #header __FS_FREE Subject =~ /\bfree\b/i #header __FS_IPODXBOX Subject =~ /(?:ipod|xbox)/i #header __FS_MP3PLAY Subject =~ /mp3 player/i #meta FM_CLAIM_IPOD ((__FS_CLAIM_YOUR || __FS_FREE) && (__FS_IPODXBOX || __FS_MP3PLAY)) #describe FM_CLAIM_IPOD Looks like u should claim your ipod. ###score FM_CLAIM_IPOD 1.771 ##counts FM_CLAIM_IPOD 18s/0h of 27495 corpus (21848s/5647h MY) 03/01/06 ##counts FM_CLAIM_IPOD 2s/0h of 34977 corpus (27086s/7891h FT) 03/01/06 ##counts FM_CLAIM_IPOD 8s/0h of 84470 corpus (67306s/17164h ML) 03/01/06 ##counts FM_CLAIM_IPOD 75s/0h of 103116 corpus (63731s/39385h DOC) 03/01/06 ##counts FM_CLAIM_IPOD 7s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 ##counts FM_CLAIM_IPOD 8s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header __FS_COKE Subject =~ /\bcoke\b/i #header __FS_PEPSI Subject =~ /\bpepsi\b/i #meta FM_COKE_PEPSI (__FS_COKE && __FS_PEPSI) #describe FM_COKE_PEPSI Subject has both Coke and Pepsi ###score FM_COKE_PEPSI 10.357 ##counts FM_COKE_PEPSI 94s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 ##counts FM_COKE_PEPSI 110s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FM_COKE_PEPSI 134s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header __GETYOUR subject =~ /get your/i #header __CONGRADULAT Subject =~ /congra[dt]ulation/i #header __GIFTCERT Subject =~ /(?:gift|gas) (?:cert|card)/i #meta FM_CONG_GIFTCARD ((__CONGRADULAT || __GETYOUR) && __GIFTCERT) #describe FM_CONG_GIFTCARD Talks about gift cards and congrads. ###score FM_CONG_GIFTCARD 3.321 ##counts FM_CONG_GIFTCARD 19s/0h of 34977 corpus (27086s/7891h FT) 03/01/06 ##counts FM_CONG_GIFTCARD 22s/0h of 103116 corpus (63731s/39385h DOC) 03/01/06 ##counts FM_CONG_GIFTCARD 4s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 ##counts FM_CONG_GIFTCARD 27s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body __OWN_LAND /\bland\b/i #body __OWN_PROP /propert/i #body __COSTA_RI /Costa Rica/i ##body __FB_TOUR /\btour/i #meta FM_COSTA_RICA ((__OWN_LAND || __OWN_PROP) && __COSTA_RI && __FB_TOUR) #describe FM_COSTA_RICA Looks like Costa Rica spams. ###score FM_COSTA_RICA 10.357 ##counts FM_COSTA_RICA 96s/0h of 40658 corpus (35364s/5294h MY) 12/12/05 ##counts FM_COSTA_RICA 9s/0h of 9809 corpus (4905s/4904h FT) 12/12/05 ##counts FM_COSTA_RICA 27s/0h of 207630 corpus (200121s/7509h FT) 12/13/05 ##counts FM_COSTA_RICA 0s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 ##counts FM_COSTA_RICA 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body __FB_CUSTOM_LOGO /(?:custom|unique) logo/i #body __FB_LOGO_DESIGN /Logo Design/i #body __FB_CUSTOM_RECOG /customer recognition/i #body __FB_TARGET_AUDIEN /target audience/i #meta FM_CUSTOMLOGODSGNc (__FB_CUSTOM_LOGO && (__FB_LOGO_DESIGN || __FB_CUSTOM_RECOG || __FB_TARGET_AUDIEN)) #describe FM_CUSTOMLOGODSGNc Custom Designed Logos ###score FM_CUSTOMLOGODSGNc 10.357 ##counts FM_CUSTOMLOGODSGNc 22s/0h of 104500 corpus (96503s/7997h FVGT) 03/09/06 ##counts FM_CUSTOMLOGODSGNc 195s/0h of 90227 corpus (72176s/18051h ML) 03/08/06 ##counts FM_CUSTOMLOGODSGNc 18s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 ##counts FM_CUSTOMLOGODSGNc 24s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ### meta FM_DDDD_TIMES_2 (FH_HELO_EQ_D_D_D_D && FH_HOST_EQ_D_D_D_D) ### describe FM_DDDD_TIMES_2 Dual helo + host eq d_d_d_d ###score FM_DDDD_TIMES_2 1.999 ##counts FM_DDDD_TIMES_2 2923s/1h of 41800 corpus (34198s/7602h FVGT) 03/25/06 ##counts FM_DDDD_TIMES_2 3486s/1h of 41949 corpus (34112s/7837h FVGT) 04/11/06 ##counts FM_DDDD_TIMES_2 1304s/1h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FM_DDDD_TIMES_2 1776s/1h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header __FS_DEBT Subject =~ /debt/i #header __FS_HELP Subject =~ /help/i #meta FM_DEBT_HELP (__FS_DEBT && __FS_HELP) #describe FM_DEBT_HELP Subject says debt and help. ###score FM_DEBT_HELP 3.222 ##counts FM_DEBT_HELP 1s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 ##counts FM_DEBT_HELP 53s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FM_DEBT_HELP 4s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FM_DEBT_HELP 7s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header __HOTMAILCOM X-Spam-Relays-External =~ /^[^\]]+ helo=hotmail\.com /i #header __HOST_HOTMAIL X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.hotmail\.com / #meta FM_FAKE_HELO_HOTMAIL (__HOTMAILCOM && !__HOST_HOTMAIL) #describe FM_FAKE_HELO_HOTMAIL Looks like a fake hotmail.com helo. ###score FM_FAKE_HELO_HOTMAIL 2.353 ##counts FM_FAKE_HELO_HOTMAIL 0s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FM_FAKE_HELO_HOTMAIL 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header __FHELO_VERIZON X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+verizon\.net /i #header __FHOST_VERIZON X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+verizon\.net /i #meta FM_FAKE_HELO_VERIZON (__FHELO_VERIZON && !__FHOST_VERIZON) #describe FM_FAKE_HELO_VERIZON Looks like a fake verizon.net helo. ###score FM_FAKE_HELO_VERIZON 1.229 ##counts FM_FAKE_HELO_VERIZON 26s/0h of 42070 corpus (34144s/7926h FVGT) 04/19/06 ##counts FM_FAKE_HELO_VERIZON 71s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FM_FAKE_HELO_VERIZON 90s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header __MSGID_GMAIL MESSAGEID =~ /gmail\.com/i #header __FROM_GMAIL From =~ /gmail\.com/ #meta FM_FORGED_GMAIL (__MSGID_GMAIL && !__FROM_GMAIL) #describe FM_FORGED_GMAIL Looks like a forged gmail msg? ###score FM_FORGED_GMAIL 0.622 ##counts FORGED_GMAIL 10s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 ##counts FM_FORGED_GMAIL 10s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FM_FORGED_GMAIL 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header __FROM_LEFT_BRACK From:name =~ // #header __FROM_ISO_2022_JP From:raw =~ /=\?ISO-2022-JP\?/ #meta FM_FRM_RN_L_BRACK (__FROM_RIGH_BRACK && !__FROM_LEFT_BRACK && !__FROM_ISO_2022_JP) #describe FM_FRM_RN_L_BRACK From name has > but not < ###score FM_FRM_RN_L_BRACK 0.545 ##counts FRM_RN_L_BRACK 7s/0h of 103219 corpus (95719s/7500h FVGT) 03/21/06 ##counts FRM_RN_L_BRACK 9s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 ##counts FM_FRM_RN_L_BRACK 11s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body __SURVEY /\bsurvey\b/i #meta FM_GET_CASH_SURVEY (FB_GET_XXX_CASH && __SURVEY) #describe FM_GET_CASH_SURVEY Meta Get Cash + Survey ###score FM_GET_CASH_SURVEY 10.357 ##counts FM_GET_CASH_SURVEY 17s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 ##counts FM_GET_CASH_SURVEY 55s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FM_GET_CASH_SURVEY 107s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body __YOUR_CREDIT /your credit/ #body __GOOD_ENOUGH /good enough/ #meta FM_GOOD_ENF_CREDIT (__YOUR_CREDIT && __GOOD_ENOUGH) #describe FM_GOOD_ENF_CREDIT Meta Good enough credit ###score FM_GOOD_ENF_CREDIT 10.357 ##counts FM_GOOD_ENF_CREDIT 12s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 ##counts FM_GOOD_ENF_CREDIT 40s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FM_GOOD_ENF_CREDIT 98s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body __YOUR_ACCOUNT /your account/i #header __MANY_RECIPS ToCc =~ /(?:\@[^@]{5,100}){3}/ #meta FM_IS_IT_OUR_ACCOUNT (__YOUR_ACCOUNT && __MANY_RECIPS) #describe FM_IS_IT_OUR_ACCOUNT Is it our account? ###score FM_IS_IT_OUR_ACCOUNT 4.20 ##counts FM_IS_IT_OUR_ACCOUNT 2s/0h of 9808 corpus (4903s/4905h FT) 12/14/05 ##counts FM_IS_IT_OUR_ACCOUNT 7s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 ##counts FM_IS_IT_OUR_ACCOUNT 11s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##header __NUMBERS_IN_SUBJ Subject =~ /\d{3}/ #header __FS_LEND Subject =~ /\blend\b/i #meta FM_LEND_MONEY (__NUMBERS_IN_SUBJ && __FS_LEND) #describe FM_LEND_MONEY Subject has ddd + lend! ###score FM_LEND_MONEY 2.668 ##counts FS_LEND_MONEY 2s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 ##counts FS_LEND_MONEY 7s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 ##counts FM_LEND_MONEY 13s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##http://www18.homeloanstore456.com #uri __FU_LOAN /[a-pr-z0-9]+loan[a-z0-9]+\.com/i #uri __DOMAIN_WITH_NUMS /www[^.]+\.[^.]+\d[^.]+\./i #meta FM_LOAN_NUM_DOMAIN (__FU_LOAN && __DOMAIN_WITH_NUMS) #describe FM_LOAN_NUM_DOMAIN Loan and numbers in .com ###score FM_LOAN_NUM_DOMAIN 3.524 ##counts FM_LOAN_NUM_DOMAIN 2s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 ##counts FM_LOAN_NUM_DOMAIN 13s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FM_LOAN_NUM_DOMAIN 19s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body __FB_GENERATE /generate/i #body __FB_FIND_OUT /find out how/i #body __FB_FROM_YOUR /from your/i #body __FB_HOME_HOUSE /ho(?:use|me)/i #meta FM_MAKE_MONEY_HOME (__FB_GENERATE && __FB_FIND_OUT && __FB_FROM_YOUR && __FB_HOME_HOUSE) #describe FM_MAKE_MONEY_HOME Making money from home. ###score FM_MAKE_MONEY_HOME 10.357 ##counts FM_MAKE_MONEY_HOME 1s/0h of 25733 corpus (16658s/9075h FVGT) 11/08/06 ##counts FM_MAKE_MONEY_HOME 77s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body __VA_WORD /\bV[A-Za-z]{2,4}RA\b/ #body __CS_WORD /\bC[A-Za-z]{2,4}IS\b/ #body __VM_WORD /\bV[A-Za-z]{2,5}UM\b/ #meta FM_MANY_DRUG_WORDS (__VA_WORD && __CS_WORD && __VM_WORD) #describe FM_MANY_DRUG_WORDS Lot's of almost drug words ###score FM_MANY_DRUG_WORDS 10.357 ##counts MANY_DRUG_WORDS 228s/0h of 21635 corpus (15142s/6493h CT) 09/25/06 ##counts FM_MANY_DRUG_WORDS 1169s/0h of 25499 corpus (16409s/9090h FVGT) 11/04/06 ##counts FM_MANY_DRUG_WORDS 1199s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body __FB_YOUR_MEDS /your meds/i #header __FS_RE_TWO_WORDS Subject =~ /^Re: (?:[a-z']{2,5}\s+){2}$/ #meta FM_MEDS_SUBJ_2WDS ((__FB_YOUR_MEDS || FB_MEDS_PERCENT) && __FS_RE_TWO_WORDS) #describe FM_MEDS_SUBJ_2WDS Talks about Meds, Re: two words. ###score FM_MEDS_SUBJ_2WDS 10.357 ##counts __FB_YOUR_MEDS 10s/1h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts __FS_RE_TWO_WORDS 271s/9h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FM_MEDS_SUBJ_2WDS 6s/0h of 42742 corpus (34169s/8573h FVGT) 07/06/06 ##counts FM_MEDS_SUBJ_2WDS 6s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FM_MEDS_SUBJ_2WDS 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body __PREAPPROVEDFVGT /pre-approved/i #body __FIXED_RATEFVGT /fixed rate/i #body __YOUR_CREDITFVGT /your credit/i #body __HOMELOANFVGT /home loan/i #body __APPROVALFVGT /approval/i #body __BIGDOLLARSFVGT /\$\d{2,3},\d{3}/ #uri __LOANURIFVGT /\bloa.?ns?\b/i #uri __MORTURIFVGT /\bmor.?t\b/i #meta __FM_MORTGAGE3PLUS ((__PREAPPROVEDFVGT + __FIXED_RATEFVGT + __YOUR_CREDITFVGT + __HOMELOANFVGT + __APPROVALFVGT + __BIGDOLLARSFVGT + __LOANURIFVGT + __MORTURIFVGT) > 2) #meta __FM_MORTGAGE4PLUS ((__PREAPPROVEDFVGT + __FIXED_RATEFVGT + __YOUR_CREDITFVGT + __HOMELOANFVGT + __APPROVALFVGT + __BIGDOLLARSFVGT + __LOANURIFVGT + __MORTURIFVGT) > 3) #meta __FM_MORTGAGE5PLUS ((__PREAPPROVEDFVGT + __FIXED_RATEFVGT + __YOUR_CREDITFVGT + __HOMELOANFVGT + __APPROVALFVGT + __BIGDOLLARSFVGT + __LOANURIFVGT + __MORTURIFVGT) > 4) #meta __FM_MORTGAGE6PLUS ((__PREAPPROVEDFVGT + __FIXED_RATEFVGT + __YOUR_CREDITFVGT + __HOMELOANFVGT + __APPROVALFVGT + __BIGDOLLARSFVGT + __LOANURIFVGT + __MORTURIFVGT) > 5) # #meta FM_MORTGAGE3PLUS (__FM_MORTGAGE3PLUS && !__FM_MORTGAGE4PLUS && !__FM_MORTGAGE5PLUS && !__FM_MORTGAGE6PLUS) #describe FM_MORTGAGE3PLUS Looks like a mortgage spam (3+) ###score FM_MORTGAGE3PLUS 0.602 ##counts FM_MORTGAGE3PLUS 46s/1h of 32518 corpus (23261s/9257h FVGT) 11/14/06 ##counts FM_MORTGAGE3PLUS 46s/1h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FM_MORTGAGE3PLUS 49s/1h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FM_MORTGAGE3PLUS 57s/1h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # #meta FM_MORTGAGE4PLUS (__FM_MORTGAGE4PLUS && !__FM_MORTGAGE5PLUS && !__FM_MORTGAGE6PLUS) #describe FM_MORTGAGE4PLUS Looks like a mortgage spam (4+) ###score FM_MORTGAGE4PLUS 0.166 ##counts FM_MORTGAGE4PLUS 1s/1h of 32518 corpus (23261s/9257h FVGT) 11/14/06 ##counts FM_MORTGAGE4PLUS 1s/1h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FM_MORTGAGE4PLUS 1s/1h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FM_MORTGAGE4PLUS 3s/1h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # #meta FM_MORTGAGE5PLUS (__FM_MORTGAGE5PLUS && !__FM_MORTGAGE6PLUS) #describe FM_MORTGAGE5PLUS Looks like a mortgage spam (5+) ###score FM_MORTGAGE5PLUS 3.222 ##counts FM_MORTGAGE5PLUS 39s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 ##counts FM_MORTGAGE5PLUS 46s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # #meta FM_MORTGAGE6PLUS (__FM_MORTGAGE6PLUS) #describe FM_MORTGAGE6PLUS Looks like a mortgage spam (6+) ###score FM_MORTGAGE6PLUS 2.500 ##counts FM_MORTGAGE6PLUS 3s/0h of 32518 corpus (23261s/9257h FVGT) 11/14/06 ##counts FM_MORTGAGE6PLUS 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body __FB_BRAND_NAME /brand name/i #body __FB_TIMEPIECE /timepiece/i #body __FB_WALLETS /wallets/i #body __FB_HANDBAGS /handbags/i #body __FB_DESIGNER /designer/i #body __FB_INK_PEN /ink pen/i #meta FM_MULTI_LUX_GIFTS ((__FB_BRAND_NAME + __FB_TIMEPIECE + __FB_WALLETS + __FB_HANDBAGS + __FB_DESIGNER + __FB_LUX_GIFTS + __FB_NUM_PERCNT + __FB_INK_PEN) > 3) #describe FM_MULTI_LUX_GIFTS Talks about variety of luxury gifts ###score FM_MULTI_LUX_GIFTS 10.357 ##counts FM_MULTI_LUX_GIFTS 35s/0h of 32090 corpus (22848s/9242h FVGT) 11/13/06 ##counts FM_MULTI_LUX_GIFTS 42s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FM_MULTI_LUX_GIFTS 156s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ## Brand comparisons as of late... #header __FS_ADIDAS Subject =~ /\badidas\b/i #header __FS_NIKE Subject =~ /\bnike\b/i #meta FM_NIKE_ADIDAS (__FS_ADIDAS && __FS_NIKE) #describe FM_NIKE_ADIDAS Meta Nike & Adidas ###score FM_NIKE_ADIDAS 4.555 ##counts FM_NIKE_ADIDAS 1s/0h of 43642 corpus (34621s/9021h FVGT) 10/26/06 ##counts FM_NIKE_ADIDAS 3s/0h of 257465 corpus (187155s/70310h DOC) 10/26/06 ##counts FM_NIKE_ADIDAS 1s/0h of 25019 corpus (15994s/9025h FVGT) 11/01/06 ##counts FM_NIKE_ADIDAS 1s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body __FB_YOU_ARE_PAYING /you are paying/i ##counts FB_YOU_ARE_PAYING 155s/26h of 207630 corpus (200121s/7509h FT) 12/13/05 #meta FM_PAYING_LOWER (FB_LOWER_PAYM && __FB_YOU_ARE_PAYING) #describe FM_PAYING_LOWER Meta You are paying too much... ###score FM_PAYING_LOWER 1.35 ##counts FM_PAYING_LOWER 0s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FM_PAYING_LOWER 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #meta FM_PC_ERROR_DBL (FB_YOUR_PC_ERROR && (FS_YOUR_COMPUTER || FB_PC_DOCTOR)) #describe FM_PC_ERROR_DBL Combo Meta of multiple rules. ###score FM_PC_ERROR_DBL 10.357 ##counts FM_PC_ERROR_DBL 2s/0h of 43642 corpus (34621s/9021h FVGT) 10/26/06 ##counts FM_PC_ERROR_DBL 25s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FM_PC_ERROR_DBL 58s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FM_PC_ERROR_DBL 166s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header __MSGID_VGA Message-ID =~ /^<000001c[67]/ #header __DATE_700 Date =~ /-0700/ #meta FM_RATSIGN_1106 (__MSGID_VGA && __DATE_700) #describe FM_RATSIGN_1106 Fingerprint seen in lots of spam. 11/2006 ###score FM_RATSIGN_1106 17.422 ##counts GOODBYE_VJJAGGRRAA 3781s/0h of 43750 corpus (34719s/9031h FVGT) 10/27/06 ##counts FM_RATSIGN_1106 3862s/0h of 32547 corpus (23290s/9257h FVGT) 11/14/06 ##counts FM_RATSIGN_1106 3895s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FM_RATSIGN_1106 3937s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body __FB_DO_NOT_REPLY /Do not reply to this address/i #body __FB_EMAIL_ME_BAC /Email me baca?k at/i #meta FM_REPLY_OR_NOT (__FB_DO_NOT_REPLY && __FB_EMAIL_ME_BAC) #describe FM_REPLY_OR_NOT Meta do they want a reply or not? ###score FM_REPLY_OR_NOT 10.357 ##counts FM_REPLY_OR_NOT 2s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 ##counts FM_REPLY_OR_NOT 14s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FM_REPLY_OR_NOT 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body __FB_ROLEX_MEN /Rolex Men/i #body __FB_ROLEX_WMEN /Rolex Lady/i #body __FB_OMEGA /Omega/i #body __FB_GLASHUTE /Glashute/ #meta FM_ROLEX_ADS (__FB_ROLEX_MEN && __FB_ROLEX_WMEN && __FB_OMEGA && __FB_GLASHUTE) #describe FM_ROLEX_ADS Looks like Rolex spams. ###score FM_ROLEX_ADS 6.999 ##counts FM_ROLEX_ADS 0s/0h of 5479 corpus (1297s/4182h AxB) 09/25/06 ##counts FM_ROLEX_ADS 0s/0h of 21635 corpus (15142s/6493h CT) 09/25/06 ##counts FM_ROLEX_ADS 60s/0h of 25381 corpus (16358s/9023h FVGT) 11/04/06 ##counts FM_ROLEX_ADS 85s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body __FB_BA /\bBA\b/ #body __FB_BCs /\bBSc\b/ #body __FB_MA /\bMA\b/ #body __FB_MBA /\bMBA\b/ #meta FM_SCHOOL_TYPES (__FB_BA && __FB_BCs && __FB_MA && __FB_MBA) #describe FM_SCHOOL_TYPES Meta Combo Phrase for Schooling ###score FM_SCHOOL_TYPES 5.599 ##counts FM_SCHOOL_TYPES 4s/0h of 24480 corpus (15455s/9025h FVGT) 10/30/06 ##counts FM_SCHOOL_TYPES 4s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 ##counts FM_SCHOOL_TYPES 4s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FM_SCHOOL_TYPES 6s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FM_SCHOOL_TYPES 28s/0h of 125199 corpus (120083s/5116h AxB2) 11/03/06 ##counts FM_SCHOOL_TYPES 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ## We don't need no schooling ;) #body __BACHELORS /Bachelor/i #body __MASTERS /Masters/i #body __MBA /MBA/i #body __PHD /PhD/i #body __DIPLOMA /diploma/i #meta FM_SCHOOLING ((__BACHELORS + __MASTERS + __MBA + __PHD) > 2) #describe FM_SCHOOLING Meta Combo Phrase for Schooling (2) ###score FM_SCHOOLING 5.657 ##counts FM_SCHOOLING 15s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FM_SCHOOLING 88s/0h of 25311 corpus (18683s/6628h CT) 11/03/06 ##counts FM_SCHOOLING 20s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #meta FM_SCHOOL_DIPLOMA (FM_SCHOOLING && __DIPLOMA) #describe FM_SCHOOL_DIPLOMA Meta for Schooling + Diploma. ###score FM_SCHOOL_DIPLOMA 10.357 ##counts FM_SCHOOL_DIPLOMA 10s/0h of 25369 corpus (16344s/9025h FVGT) 11/03/06 ##counts FM_SCHOOL_DIPLOMA 61s/0h of 25311 corpus (18683s/6628h CT) 11/03/06 ##counts FM_SCHOOL_DIPLOMA 477s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FM_SCHOOL_DIPLOMA 15s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body __WORD_SEX /\bsex(?:iest|y)?\b/i ##body __WORD_CUM /\bcum\b/i ##body __WORD_SPERM /\bsperm\b/i ##body __WORD_SLUTS /\bsluts?\b/i ##body __WORD_RAPED /\braped?\b/i ##meta __SEX_WRDS (__WORD_SEX || __WORD_CUM || __WORD_SPERM || __WORD_SLUTS || __WORD_RAPED) ##meta FM_SEX_HELODDDD (__SEX_WRDS && FH_HELO_EQ_D_D_D_D) ##describe FM_SEX_HELODDDD Sex words + helo = dddd ###score FM_SEX_HELODDDD 10.357 ##counts FM_SEX_HELODDDD 105s/0h of 33966 corpus (24401s/9565h FVGT) 11/16/06 ##counts FM_SEX_HELODDDD 108s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FM_SEX_HELODDDD 258s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ###meta FM_SEX_HOSTDDDD (__SEX_WRDS && FH_HOST_EQ_D_D_D_D) ###describe FM_SEX_HOSTDDDD Sex words + host = dddd ###score FM_SEX_HOSTDDDD 10.357 ##counts FM_SEX_HOSTDDDD 289s/0h of 33966 corpus (24401s/9565h FVGT) 11/16/06 ##counts FM_SEX_HOSTDDDD 303s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FM_SEX_HOSTDDDD 529s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header __FS_TEEN Subject =~ /\bteen\b/i #meta FM_SUB_TEEN_NUDE (FS_NUDE && __FS_TEEN) #describe FM_SUB_TEEN_NUDE Subject says teen and nude ###score FM_SUB_TEEN_NUDE 5.981 ##counts FM_SUB_TEEN_NUDE 48s/0h of 345244 corpus (337372s/7872h FT) 02/07/06 ##counts FM_SUB_TEEN_NUDE 0s/0h of 32300 corpus (23045s/9255h FVGT) 11/14/06 ##counts FM_SUB_TEEN_NUDE 0s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header __EXCLAIM_SUBJ Subject =~ /\!/ #header __SUBJ_APPROVE Subject =~ /Approve/i #meta FM_SUBJ_APPROVE (__EXCLAIM_SUBJ && __SUBJ_APPROVE) #describe FM_SUBJ_APPROVE Subject has Approve and ! ###score FM_SUBJ_APPROVE 3.877 ##counts FM_SUBJ_APPROVE 9s/0h of 24573 corpus (15551s/9022h FVGT) 10/31/06 ##counts FM_SUBJ_APPROVE 13s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FM_SUBJ_APPROVE 20s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header __FS_PROFIT Subject =~ /profit/i #header __FS_YOU Subject =~ /you\b/i #meta FM_SUBJ_YOU_PROFIT (__FS_PROFIT && __FS_YOU) #describe FM_SUBJ_YOU_PROFIT Subject says you profit ###score FM_SUBJ_YOU_PROFIT 3.788 ##counts FM_SUBJ_YOU_PROFIT 26s/0h of 103688 corpus (96287s/7401h FVGT) 03/17/06 ##counts FM_SUBJ_YOU_PROFIT 3s/0h of 25005 corpus (15981s/9024h FVGT) 11/03/06 ##counts FM_SUBJ_YOU_PROFIT 26s/0h of 293382 corpus (226480s/66902h ML) 11/03/06 ##counts FM_SUBJ_YOU_PROFIT 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #header __FROM_VEGAS From =~ /Vegas/i #header __SUBJ_3DIGIT Subject =~ /\b\d{3}[^0-9]/ #header __SUBJ_VEGAS Subject =~ /(?:Vegas|Casino)/i #body __FB_GAME /game/i #meta FM_VEGAS_CASINO ((__FROM_VEGAS + __SUBJ_3DIGIT + __SUBJ_VEGAS + __FB_GAME) > 2) #describe FM_VEGAS_CASINO Looks like vega casino spam ###score FM_VEGAS_CASINO 10.357 ##counts FM_VEGAS_CASINO 119s/0h of 132996 corpus (95808s/37188h ML) 06/12/06 ##counts FM_VEGAS_CASINO 110s/0h of 168016 corpus (116196s/51820h DOC) 06/12/06 ##counts FM_VEGAS_CASINO 22s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FM_VEGAS_CASINO 22s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body __SEEN_ON_ABC /\bA[^a-z]{0,1}B[^a-z]{0,1}C\b/i #body __SEEN_ON_CNN /\bC[^a-z]{0,1}N[^a-z]{0,1}N\b/i #body __SEEN_ON_NBC /\bN[^a-z]{0,1}B[^a-z]{0,1}C\b/i #body __SEEN_ON_CBS /\bC[^a-z]{0,1}B[^a-z]{0,1}S\b/i #body __SEEN_ON_OPRAH /\boprah\b/i #body __LOSE_WEIGHT /l.{0,1}o.{0,1}s.{0,1}e.{0,4}w.{0,1}e.{0,1}[i1].{0,1}g.{0,1}h.{0,1}t/i #meta FM_WEIGHT_LOSS ((__SEEN_ON_ABC + __SEEN_ON_CNN + __SEEN_ON_NBC + __SEEN_ON_CBS + __LOSE_WEIGHT + __SEEN_ON_OPRAH) > 3) #describe FM_WEIGHT_LOSS Looks like oprah weight loss spam. ###score FM_WEIGHT_LOSS 10.357 ##counts FM_WEIGHT_LOSS 18s/0h of 32090 corpus (22848s/9242h FVGT) 11/13/06 ##counts FM_WEIGHT_LOSS 18s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##====== REPLACE TAG RULES BELOW ============= # #ifplugin Mail::SpamAssassin::Plugin::ReplaceTags #replace_inter W0 \w? #replace_inter SP2 [\s\d_*\$\%(),.:;?!}{\[\]|\/?^\#~\xa1`'+-]? #replace_tag GX [gk6] #replace_tag IX [ilt|!1y?\xcc\xcd\xce\xcf\xec\xed\xee\xef] #replace_tag SX [sz5\xa6\xa7] #replace_tag TX [t|] #replace_tag UX [u\xb5\xd9\xda\xdb\xdc\xfc\xfb\xfa\xf9\xfd] #replace_tag WX (?:[wv]|vv) # # #body FRT_ABSOLUT /\b(?!absolutely)/i #describe FRT_ABSOLUT ReplaceTags: Absolutely ###score FRT_ABSOLUT 0.285 #replace_rules FRT_ABSOLUT ##counts FRT_ABSOLUT 4s/0h of 46241 corpus (36438s/9803h FVGT) 12/14/06 ##counts FRT_ABSOLUT 4s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_ADOBE2 /\b(?!adobe)\b/i #describe FRT_ADOBE2 ReplaceTags: Adobe ###score FRT_ADOBE2 2.455 #replace_rules FRT_ADOBE2 ##counts FRT_ADOBE2 2s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_ADOBE2 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_ADULT2 /\b(?!adult)/i #describe FRT_ADULT2 ReplaceTags: Adult ###score FRT_ADULT2 1.479 #replace_rules FRT_ADULT2 ##counts FRT_ADULT2 12s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_ADULT2 16s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_APPROV /\b(?!approu?v)

/i #describe FRT_APPROV ReplaceTags: Approve ###score FRT_APPROV 1.645 #replace_rules FRT_APPROV ##counts FRT_APPROV 2s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_APPROV 3s/0h of 32386 corpus (23130s/9256h FVGT) 11/14/06 ##counts FRT_APPROV 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_BEFORE /\b(?!before)\b/i #describe FRT_BEFORE ReplaceTags: Before ###score FRT_BEFORE 1.279 #replace_rules FRT_BEFORE ##counts FRT_BEFORE 3s/0h of 32386 corpus (23130s/9256h FVGT) 11/14/06 ##counts FRT_BEFORE 6s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_BELOW2 /\b(?!below)\b/i #describe FRT_BELOW2 ReplaceTags: Below (2) ###score FRT_BELOW2 2.154 #replace_rules FRT_BELOW2 ##counts FRT_BELOW2 26s/0h of 32300 corpus (23052s/9248h FVGT) 11/14/06 ##counts FRT_BELOW2 28s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_BIGGERMEM1 /(?:|).{1,8}(?:

||)/i #describe FRT_BIGGERMEM1 ReplaceTags: Bigger / Larger, Penis / Member ###score FRT_BIGGERMEM1 2.555 #replace_rules FRT_BIGGERMEM1 ##counts FRT_BIGGERMEM1 17s/0h of 32300 corpus (23052s/9248h FVGT) 11/14/06 ##counts FRT_BIGGERMEM1 52s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_CANSPAM /\b(?!CANSPAM)

/i #describe FRT_CANSPAM ReplaceTags: Can Spam ###score FRT_CANSPAM 2.232 #replace_rules FRT_CANSPAM ##counts FRT_CANSPAM 7s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_CANSPAM 26s/0h of 32386 corpus (23130s/9256h FVGT) 11/14/06 ##counts FRT_CANSPAM 51s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_CLICK /\b(?!click)\b/i #describe FRT_CLICK ReplaceTags: Click ###score FRT_CLICK 1.993 #replace_rules FRT_CLICK ##counts FRT_CLICK 67s/0h of 32300 corpus (23052s/9248h FVGT) 11/14/06 ##counts FRT_CLICK 116s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_COCK /\b(?![cs]ock)/i #describe FRT_COCK ReplaceTags: Cock ###score FRT_COCK 1.594 #replace_rules FRT_COCK ##counts FRT_COCK 18s/0h of 32300 corpus (23052s/9248h FVGT) 11/14/06 ##counts FRT_COCK 55s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_CONTACT /\b(?!contr?act)/i #describe FRT_CONTACT ReplaceTags: Contact ###score FRT_CONTACT 1.594 #replace_rules FRT_CONTACT ##counts FRT_CONTACT 10s/0h of 46631 corpus (36802s/9829h FVGT) 12/23/06 ##counts FRT_CONTACT 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_DIPLOMA /\b(?!d[iy]pl[o\xe2\xc2]m)

/i ##describe FRT_DIPLOMA ReplaceTags: Diploma ###score FRT_DIPLOMA 1.499 ##replace_rules FRT_DIPLOMA ##counts FRT_DIPLOMA 2s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_DIPLOMA 2s/0h of 32386 corpus (23130s/9256h FVGT) 11/14/06 ##counts FRT_DIPLOMA 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_DISCOUNT /\b(?!discount)/i ##describe FRT_DISCOUNT ReplaceTags: Discount ###score FRT_DISCOUNT 4.495 #replace_rules FRT_DISCOUNT ##counts FRT_DISCOUNT 24s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_DISCOUNT 32s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_DOLLAR /\b(?!dollar)/i ##describe FRT_DOLLAR ReplaceTags: Dollar ###score FRT_DOLLAR 2.410 ##replace_rules FRT_DOLLAR ##counts FRT_DOLLAR 8s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_DOLLAR 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_ERECTION /(?!erection)/i #describe FRT_ERECTION ReplaceTags: Erection ###score FRT_ERECTION 3.649 #replace_rules FRT_ERECTION ##counts FRT_ERECTION 25s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_ERECTION 28s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_ESTABLISH /\b(?!estabi?lish)/i #describe FRT_ESTABLISH ReplaceTags: Establish ###score FRT_ESTABLISH 2.492 #replace_rules FRT_ESTABLISH ##counts FRT_ESTABLISH 2s/0h of 40802 corpus (31109s/9693h FVGT) 11/20/06 ##counts FRT_ESTABLISH 7s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_ESTABLISH2 /\b(?!estabi?lish)/i ##describe FRT_ESTABLISH2 ReplaceTags: Establish (2) ###score FRT_ESTABLISH2 2.492 ##replace_rules FRT_ESTABLISH2 ##counts FRT_ESTABLISH2 2s/0h of 40802 corpus (31109s/9693h FVGT) 11/20/06 ##counts FRT_ESTABLISH2 7s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_EXPERIENCE /\b(?!exp[e\xe9\xc9]rience)

\b/i #describe FRT_EXPERIENCE ReplaceTags: Experience ###score FRT_EXPERIENCE 2.333 #replace_rules FRT_EXPERIENCE ##counts FRT_EXPERIENCE 3s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_EXPERIENCE 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_FOLLOW1 /\b(?!follow)/i #describe FRT_FOLLOW1 ReplaceTags: Follow ###score FRT_FOLLOW1 1.432 #replace_rules FRT_FOLLOW1 ##counts FRT_FOLLOW1 16s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_FOLLOW1 17s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_FOLLOW2 /\b(?!follow)/i #describe FRT_FOLLOW2 ReplaceTags: Follow (2) ###score FRT_FOLLOW2 0.422 #replace_rules FRT_FOLLOW2 ##counts FRT_FOLLOW2 14s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_FOLLOW2 14s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_FREE /\b(?!free)\b/i #describe FRT_FREE ReplaceTags: Free ###score FRT_FREE 3.433 #replace_rules FRT_FREE ##counts FRT_FREE 72s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_FREE 99s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_FRIEND /\b(?!friend)/i #describe FRT_FRIEND ReplaceTags: Friend ###score FRT_FRIEND 2.522 #replace_rules FRT_FRIEND ##counts FRT_FRIEND 6s/0h of 34882 corpus (25258s/9624h FVGT) 11/16/06 ##counts FRT_FRIEND 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_FUCK1 /\b(?!fuck)/i #describe FRT_FUCK1 ReplaceTags: Fuck (1) ###score FRT_FUCK1 2.534 #replace_rules FRT_FUCK1 ##counts FRT_FUCK1 3s/0h of 32300 corpus (23052s/9248h FVGT) 11/14/06 ##counts FRT_FUCK1 14s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_FUCK2 /\b(?!fuck)/i ##describe FRT_FUCK2 ReplaceTags: Fuck (2) ###score FRT_FUCK2 3.434 ##replace_rules FRT_FUCK2 ##counts FRT_FUCK2 6s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_FUCK2 15s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_GUARANTEE1 /(?!guarantee)/i ##describe FRT_GUARANTEE1 ReplaceTags: Guarantee (1) ###score FRT_GUARANTEE1 4.599 ##replace_rules FRT_GUARANTEE1 ##counts FRT_GUARANTEE1 80s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_GUARANTEE1 89s/0h of 35048 corpus (25413s/9635h FVGT) 11/16/06 ##counts FRT_GUARANTEE1 126s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_HEALTH /\b(?!health)\b/i #describe FRT_HEALTH ReplaceTags: Health ###score FRT_HEALTH 2.655 #replace_rules FRT_HEALTH ##counts FRT_HEALTH 1s/0h of 44060 corpus (34282s/9778h FVGT) 12/01/06 ##counts FRT_HEALTH 5s/0h of 44368 corpus (34592s/9776h FVGT) 12/02/06 ##counts FRT_HEALTH 11s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_HOUR /\b(?!hour)\b/i #describe FRT_HOUR ReplaceTags: Hour ###score FRT_HOUR 1.655 #replace_rules FRT_HOUR ##counts FRT_HOUR 41s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_HOUR 62s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_INCOME /\b(?!income)\b/i #describe FRT_INCOME ReplaceTags: Income ###score FRT_INCOME 3.579 #replace_rules FRT_INCOME ##counts FRT_INCOME 6s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_INCOME 17s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_INTEREST /\b(?!interest)\b/i #describe FRT_INTEREST ReplaceTags: Interest ###score FRT_INTEREST 3.579 #replace_rules FRT_INTEREST ##counts FRT_INTEREST 8s/0h of 35267 corpus (25646s/9621h FVGT) 11/17/06 ##counts FRT_INTEREST 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_INVESTOR /\b(?!investor)/i ##describe FRT_INVESTOR ReplaceTags: Investor ###score FRT_INVESTOR 1.832 ##replace_rules FRT_INVESTOR ##counts FRT_INVESTOR 13s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_INVESTOR 32s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_LEVITRA /(?!levitra)/i ##describe FRT_LEVITRA ReplaceTags: Levitra ###score FRT_LEVITRA 1.812 ##replace_rules FRT_LEVITRA ##counts FRT_LEVITRA 2s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_LEVITRA 3s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_LITTLE /\b(?!little)/i #describe FRT_LITTLE ReplaceTags: Little ###score FRT_LITTLE 1.555 #replace_rules FRT_LITTLE ##counts FRT_LITTLE 1s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_LITTLE 5s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_LOLITA1 /\b(?!lolita)/i #describe FRT_LOLITA1 ReplaceTags: Lolita (1) ###score FRT_LOLITA1 1.865 #replace_rules FRT_LOLITA1 ##counts FRT_LOLITA1 11s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_LOLITA1 11s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_MEETING /\b(?!meeting)\b/i ##describe FRT_MEETING ReplaceTags: Meeting ###score FRT_MEETING 2.697 ##replace_rules FRT_MEETING ##counts FRT_MEETING 5s/0h of 34882 corpus (25258s/9624h FVGT) 11/16/06 ##counts FRT_MEETING 8s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_OFFER2 /\b(?!offer)/i #describe FRT_OFFER2 ReplaceTags: Offer (2) ###score FRT_OFFER2 2.545 #replace_rules FRT_OFFER2 ##counts FRT_OFFER2 35s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_OFFER2 42s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_OPPORTUN1 /(?!opportun)

/i #describe FRT_OPPORTUN1 ReplaceTags: Oppertun (1) ###score FRT_OPPORTUN1 1.893 #replace_rules FRT_OPPORTUN1 ##counts FRT_OPPORTUN1 12s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_OPPORTUN1 18s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_OPPORTUN2 /(?!opportun)

/i ##describe FRT_OPPORTUN2 ReplaceTags: Oppertun (2) ###score FRT_OPPORTUN2 1.397 ##replace_rules FRT_OPPORTUN2 ##counts FRT_OPPORTUN2 12s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_OPPORTUN2 15s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_PACKAGE /\b(?!package)

/i #describe FRT_PACKAGE ReplaceTags: Package ###score FRT_PACKAGE 1.967 #replace_rules FRT_PACKAGE ##counts FRT_PACKAGE 6s/0h of 40802 corpus (31109s/9693h FVGT) 11/20/06 ##counts FRT_PACKAGE 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_PAYMENT /\b(?!payment)

/i #describe FRT_PAYMENT ReplaceTags: Payment ###score FRT_PAYMENT 2.292 #replace_rules FRT_PAYMENT ##counts FRT_PAYMENT 3s/0h of 32300 corpus (23052s/9248h FVGT) 11/14/06 ##counts FRT_PAYMENT 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_PENIS1 /\b(?!pen\s?(?:ie?s|ny[ ']?s))

\b/i #describe FRT_PENIS1 ReplaceTags: Penis ###score FRT_PENIS1 3.592 #replace_rules FRT_PENIS1 ##counts FRT_PENIS1 86s/0h of 32300 corpus (23052s/9248h FVGT) 11/14/06 ##counts FRT_PENIS1 147s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_PHARMAC /(?!pharma[c\@])

/i #describe FRT_PHARMAC ReplaceTags: Pharmac ###score FRT_PHARMAC 3.193 #replace_rules FRT_PHARMAC ##counts FRT_PHARMAC 324s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_PHARMAC 619s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_POSSIBLE /\b(?!possible)

\b/i #describe FRT_POSSIBLE ReplaceTags: Possible ###score FRT_POSSIBLE 5.697 #replace_rules FRT_POSSIBLE ##counts FRT_POSSIBLE 6s/0h of 34882 corpus (25258s/9624h FVGT) 11/16/06 ##counts FRT_POSSIBLE 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_PRICE /\b(?!price)

\b/i #describe FRT_PRICE ReplaceTags: Price ###score FRT_PRICE 3.897 #replace_rules FRT_PRICE ##counts FRT_PRICE 71s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_PRICE 86s/0h of 33966 corpus (24401s/9565h FVGT) 11/16/06 ##counts FRT_PRICE 128s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_PROFILE1 /\b(?!profile)

/i #describe FRT_PROFILE1 ReplaceTags: Profile (1) ###score FRT_PROFILE1 2.555 #replace_rules FRT_PROFILE1 ##counts FRT_PROFILE1 9s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_PROFILE1 9s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_PROFILE2 /\b(?!profile)

/i #describe FRT_PROFILE2 ReplaceTags: Profile (2) ###score FRT_PROFILE2 2.111 #replace_rules FRT_PROFILE2 ##counts FRT_PROFILE2 8s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_PROFILE2 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_PROFIT1 /\b(?!profit)

/i #describe FRT_PROFIT1 ReplaceTags: Profit (1) ###score FRT_PROFIT1 3.858 #replace_rules FRT_PROFIT1 ##counts FRT_PROFIT1 37s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_PROFIT1 41s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_PROFIT2 /\b(?!profit)

/i #describe FRT_PROFIT2 ReplaceTags: Profit (2) ###score FRT_PROFIT2 10.357 #replace_rules FRT_PROFIT2 ##counts FRT_PROFIT2 3s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_PROFIT2 56s/0h of 33966 corpus (24401s/9565h FVGT) 11/16/06 ##counts FRT_PROFIT2 57s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_PUSSY /\b(?!pussy)

/i #describe FRT_PUSSY ReplaceTags: Pussy ###score FRT_PUSSY 0.285 #replace_rules FRT_PUSSY ##counts FRT_PUSSY 2s/0h of 46241 corpus (36438s/9803h FVGT) 12/14/06 ##counts FRT_PUSSY 2s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_REFINANCE1 /\b(?!refinanc)/i ##describe FRT_REFINANCE1 ReplaceTags: Refinance (1) ###score FRT_REFINANCE1 2.934 ##replace_rules FRT_REFINANCE1 ##counts FRT_REFINANCE1 18s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_REFINANCE1 24s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_ROLEX /\b(?!rolex)/i #describe FRT_ROLEX ReplaceTags: Rolex ###score FRT_ROLEX 3.878 #replace_rules FRT_ROLEX ##counts FRT_ROLEX 5s/0h of 32300 corpus (23052s/9248h FVGT) 11/14/06 ##counts FRT_ROLEX 15s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_SEXUAL /\b(?!sexual)/i ##describe FRT_SEXUAL ReplaceTags: Sexual ###score FRT_SEXUAL 3.777 ##replace_rules FRT_SEXUAL ##counts FRT_SEXUAL 93s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_SEXUAL 95s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FRT_SEXUAL 102s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_SLUT /\b(?!slut)/ #describe FRT_SLUT ReplaceTags: Slut ###score FRT_SLUT 2.522 #replace_rules FRT_SLUT ##counts FRT_SLUT 1s/0h of 34882 corpus (25258s/9624h FVGT) 11/16/06 ##counts FRT_SLUT 11s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FRT_SLUT 11s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_SOMA /\b(?!soma|sommar|500mg)\b/i ##describe FRT_SOMA ReplaceTags: Soma ###score FRT_SOMA 2.264 ##replace_rules FRT_SOMA ##counts FRT_SOMA 54s/0h of 32386 corpus (23130s/9256h FVGT) 11/14/06 ##counts FRT_SOMA 141s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FRT_SOMA 234s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_SOMA2 /\b(?!soma|som[m\s]\xE4|sommar|500? ?mg)\b/i ##describe FRT_SOMA2 ReplaceTags: Soma (2) ###score FRT_SOMA2 2.199 ##replace_rules FRT_SOMA2 ##counts FRT_SOMA2 96s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FRT_SOMA2 107s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_STOCK1 /\b(?!stock)/i #describe FRT_STOCK1 ReplaceTags: Stock (1) ###score FRT_STOCK1 2.988 #replace_rules FRT_STOCK1 ##counts FRT_STOCK1 156s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_STOCK1 161s/0h of 33966 corpus (24401s/9565h FVGT) 11/16/06 ##counts FRT_STOCK1 167s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_STOCK2 /\b(?!stor?ck)/i #describe FRT_STOCK2 ReplaceTags: Stock (2) ###score FRT_STOCK2 2.988 #replace_rules FRT_STOCK2 ##counts FRT_STOCK2 135s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_STOCK2 136s/0h of 33966 corpus (24401s/9565h FVGT) 11/16/06 ##counts FRT_STOCK2 141s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_STRONG1 /\b(?!stro\s?ng)\b/i ##describe FRT_STRONG1 ReplaceTags: Strong (1) ###score FRT_STRONG1 2.352 ##replace_rules FRT_STRONG1 ##counts FRT_STRONG1 96s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_STRONG1 98s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_STRONG2 /\b(?!strong)\b/i ##describe FRT_STRONG2 ReplaceTags: Strong (2) ###score FRT_STRONG2 1.535 ##replace_rules FRT_STRONG2 ##counts FRT_STRONG2 3s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_STRONG2 9s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_SYMBOL /\b(?!symbol)/i ##describe FRT_SYMBOL ReplaceTags: Symbol ###score FRT_SYMBOL 2.932 ##replace_rules FRT_SYMBOL ##counts FRT_SYMBOL 15s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_SYMBOL 21s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_TODAY2 /\b(?!today)/i ##describe FRT_TODAY2 ReplaceTags: Today (2) ###score FRT_TODAY2 2.648 ##replace_rules FRT_TODAY2 ##counts FRT_TODAY2 16s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_TODAY2 16s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # # ##body FRT_VALIUM1 /\b(?!valium|verifiquem|volturno|vollum)\b/i ##describe FRT_VALIUM1 ReplaceTags: Valium ###score FRT_VALIUM1 10.357 ##replace_rules FRT_VALIUM1 ##counts FRT_VALIUM1 159s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_VALIUM1 183s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FRT_VALIUM1 183s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_VALIUM2 /\b(?!valium|verifiquem|volturno|vollum)\b/i ##describe FRT_VALIUM2 ReplaceTags: Valium (2) ###score FRT_VALIUM2 2.843 ##replace_rules FRT_VALIUM2 ##counts FRT_VALIUM2 112s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_VALIUM2 112s/0h of 36007 corpus (26307s/9700h FVGT) 11/17/06 ##counts FRT_VALIUM2 108s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #body FRT_VIRGIN1 /(?!virgin)?\b/i #describe FRT_VIRGIN1 ReplaceTags: Virgin (1) ###score FRT_VIRGIN1 2.887 #replace_rules FRT_VIRGIN1 ##counts FRT_VIRGIN1 10s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_VIRGIN1 10s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_WEIGHT2 /\b(?!weight)/i ##describe FRT_WEIGHT2 ReplaceTags: Weight (2) ###score FRT_WEIGHT2 2.442 ##replace_rules FRT_WEIGHT2 ##counts FRT_WEIGHT2 6s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_WEIGHT2 13s/0h of 44480 corpus (34698s/9782h FVGT) 11/30/06 ##counts FRT_WEIGHT2 12s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_XANAX1 /\b(?!xanax)\b/i ##describe FRT_XANAX1 ReplaceTags: Xanax (1) ###score FRT_XANAX1 2.775 ##replace_rules FRT_XANAX1 ##counts FRT_XANAX1 24s/0h of 32300 corpus (23052s/9248h FVGT) 11/14/06 ##counts FRT_XANAX1 29s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # ##body FRT_XANAX2 /\b(?!xanax)\b/i ##describe FRT_XANAX2 ReplaceTags: Xanax (2) ###score FRT_XANAX2 2.892 ##replace_rules FRT_XANAX2 ##counts FRT_XANAX2 69s/0h of 27206 corpus (18125s/9081h FVGT) 11/10/06 ##counts FRT_XANAX2 72s/0h of 47019 corpus (37183s/9836h FVGT) 12/23/06 # # #endif # Mail::SpamAssassin::Plugin::ReplaceTags # ## EOF #