# SpamAssassin rules file. # # The format is easy to grok: # # report line-of-spam-report-text # (some template items supported are:) # _HITS_: the number of hits the message triggered # _REQD_: the required hits to be considered spam # _SUMMARY_: the full details of what hits were triggered # _VER_: SpamAssassin version # _HOME_: SpamAssassin home URL # # header SYMBOLIC_TEST_NAME header op pattern # (The operations allowed (so far) are: =~ and: !~) # (header can be 'ALL', which returns the text of all headers) # (note that non-appearing headers are returned as the string 'undef') # # header SYMBOLIC_TEST_NAME eval:name_of_eval_method([args]) # # body SYMBOLIC_TEST_NAME /pattern/modifiers # (Evaluated for each text or HTML line in the message body. # If you plan to use the default weight (1), you can omit the # SYMBOLIC_TEST_NAME and just use "." instead. # # body SYMBOLIC_TEST_NAME eval:name_of_eval_method([args]) # (this is evaluated for the entire message body, not for each line) # # full SYMBOLIC_TEST_NAME /pattern/modifiers # (Evaluated for the entire message body as one string. # If you plan to use the default weight (1), you can omit the # SYMBOLIC_TEST_NAME and just use "." instead. # # full SYMBOLIC_TEST_NAME eval:name_of_eval_method([args]) # (this is evaluated for the entire message, headers and all) # # describe SYMBOLIC_TEST_NAME Textual description of test # (body pattern tests don't require a description.) # # # starts a comment, whitespace is not significant. # ########################################################################### # Default template. Try to keep it under 76 columns (inside the the dots below). # Bear in mind that EVERY line will be prefixed with "SPAM: " in order to make # it clear what's been added, and allow other filters to *remove* spamfilter # modifications, so you lose 6 columns right there. # # ...................................................................... clear-report-template report -------------------- Start SpamAssassin results ---------------------- report This mail is probably spam. The original message has been altered report so you can recognise or block similar unwanted mail in future, using report the built-in mail filtering support in your mail reader. report report Content analysis details: (_HITS_ hits, _REQD_ required) report _SUMMARY_ report -------------------- End of SpamAssassin results --------------------- # ...................................................................... ########################################################################### # and now, a template for spam-trap responses. If the first few lines # begin with "Xxxxxx: " where Xxxxxx is a header, they'll be used as # headers. clear-spamtrap-template spamtrap Subject: this address is no longer available spamtrap [this message has been automatically generated] spamtrap spamtrap Please note that this address is no longer in use, and nowadays spamtrap receives nothing but unsolicited commercial mail. Accordingly, spamtrap any mail sent to it is added to several spam-tracking databases, spamtrap then automatically deleted. spamtrap spamtrap If you genuinely want to contact the owner of the address, please spamtrap re-check your contact lists, or search the web, to find their spamtrap current e-mail address. spamtrap spamtrap The mail you sent is reproduced in full below, for resending to spamtrap the correct address. Sorry for the inconvenience! spamtrap spamtrap [-- Signed: the SpamAssassin mail filter] spamtrap ########################################################################### # Terse report template. # # ...................................................................... clear-terse-report-template terse-report ---- Start SpamAssassin results terse-report _HITS_ hits, _REQD_ required; terse-report _SUMMARY_ terse-report ---- End of SpamAssassin results # ...................................................................... ########################################################################### header NO_REAL_NAME From =~ /^\s*\?\s*$/ describe NO_REAL_NAME From: does not include a real name header FROM_ENDS_IN_NUMS From =~ /\d+\@/ describe FROM_ENDS_IN_NUMS From: ends in numbers # (contrib: David Hull) header FROM_NO_USER From =~ /(?:^\@|<\@| \@|<>)/ describe FROM_NO_USER From: has no local-part before @ sign header TO_NO_USER To =~ /(?:^\@|<\@| \@|<>)/ describe TO_NO_USER To: has no local-part before @ sign header PLING Subject =~ /\!/ describe PLING Subject has an exclamation mark header PLING_PLING Subject =~ /\!\!+/ describe PLING_PLING Subject has lots of exclamation marks header SUBJ_HAS_UNIQ_ID eval:check_for_unique_subject_id() describe SUBJ_HAS_UNIQ_ID Subject contains a unique ID number header UNDISC_RECIPS To =~ /^undisclosed-recipients?:\s*;$/ describe UNDISC_RECIPS Valid-looking To "undisclosed-recipients" header FAKED_UNDISC_RECIPS To =~ /Undisclosed.*Recipient\S*@/i describe FAKED_UNDISC_RECIPS Faked To "Undisclosed-Recipients" header SUBJ_ALL_CAPS Subject =~ /^[A-Z0-9\W]{6,}[^a-z]+$/ describe SUBJ_ALL_CAPS Subject is all capitals # (allow this test to pass if there's no Message-Id header) header MSGID_HAS_NO_AT Message-Id !~ /\@/ [if-unset: NO@MSGID] describe MSGID_HAS_NO_AT Message-Id has no @ sign header MSGID_SPAMSIGN_1 Message-Id =~ /^<[0-9a-f]{12,12}\$[0-9a-f]{8,8}\$[0-9a-f]{8,8}\@>$/ describe MSGID_SPAMSIGN_1 Message-Id generated by a spam tool header INVALID_MSGID Message-Id !~ /^<(?:\".+\"|[^\s]+)\@(?:\[.+\]|[^\s]+)>$/ describe INVALID_MSGID Message-Id is not valid, according to RFC-2822 header INVALID_DATE Date =~ / AM| PM/i describe INVALID_DATE Invalid Date: header (has AM/PM) header INVALID_DATE_NO_TZ Date =~ /^..., \d+ ... .... ..:..:..$/ describe INVALID_DATE_NO_TZ Invalid Date: header (no timezone) header SUBJ_HAS_Q_MARK Subject =~ /\?.{2,}$/ describe SUBJ_HAS_Q_MARK Subject: contains a question mark header SUBJ_ENDS_IN_Q_MARK Subject =~ /\?+\s*$/ describe SUBJ_ENDS_IN_Q_MARK Subject: ends in a question mark header ADVERT_CODE Subject =~ /(^\s*|\s+)ADV:/i describe ADVERT_CODE Subject: contains advertising tag header FRIEND_AT_PUBLIC To =~ /(yourdomain|you|your|public).(com|org|net)/i describe FRIEND_AT_PUBLIC sent to you@you.com or similar header TO_EMPTY To =~ /^(?:\@|\s*$)/ [if-unset: UNSET] describe TO_EMPTY To: is empty header REPLY_TO_EMPTY Reply-To =~ /^(?:\@|\s*$)/ [if-unset: UNSET] describe REPLY_TO_EMPTY Reply-To: is empty header ALL_CAPS_SUBJECT ALL =~ /\nSUBJECT: /s describe ALL_CAPS_SUBJECT SUBJECT: header found header X_EM_VER_PRESENT X-Em-Version =~ /\S/ describe X_EM_VER_PRESENT Found an X-Em-Version: header header NO_MX_FOR_FROM eval:check_for_from_mx() describe NO_MX_FOR_FROM No MX records for the From: domain header KNOWN_BAD_DIALUPS eval:check_for_bad_dialup_ips() describe KNOWN_BAD_DIALUPS Received via known spam-harbouring dialups header FROM_AND_TO_SAME eval:check_for_from_to_equivalence() describe FROM_AND_TO_SAME From and To the same address header BAD_HELO_WARNING eval:check_for_bad_helo() describe BAD_HELO_WARNING Fake name used in SMTP HELO command header SUBJ_FULL_OF_8BITS eval:check_subject_for_lotsa_8bit_chars() describe SUBJ_FULL_OF_8BITS Subject is full of 8-bit characters header MDAEMON_2_7_4 Received =~ /with SMTP .MDaemon.v2.7.SP4.R./ describe MDAEMON_2_7_4 Received via buggy SMTP server (MDaemon 2.7.4SP4R) header SMTPD_IN_RCVD Received =~ /\(SMTPD32-\d+\..+\)/ describe SMTPD_IN_RCVD Received via SMTPD32 server (SMTPD32-n.n) header POST_IN_RCVD Received =~ / Post\.(?:sk|cz)/ describe POST_IN_RCVD Received contains fake 'Post.cz' hostname # the new first arg for check_rbl() indicates what type of check it is; # each type of check is stored in a separate set, and if an IP has already # been hit in that set, it will not be checked with any other zone in # that set. header RCVD_IN_RELAYS_ORDB_ORG eval:check_rbl('relay', 'relays.ordb.org.') describe RCVD_IN_RELAYS_ORDB_ORG Received via a relay in relays.ordb.org header RCVD_IN_OSIRUSOFT_COM eval:check_rbl('relay', 'relays.osirusoft.com.') describe RCVD_IN_OSIRUSOFT_COM Received via a relay in relays.osirusoft.com # X prefix is so that these are run after RCVD_IN_OSIRUSOFT_COM. tests # are run in alphanumerically-sorted order. header X_OSIRU_SPAM_SRC eval:check_rbl_results_for('relay', '127.0.0.4') describe X_OSIRU_SPAM_SRC Osirusoft.com: sender is Confirmed Spam Source header X_OSIRU_SPAMWARE_SITE eval:check_rbl_results_for('relay', '127.0.0.6') describe X_OSIRU_SPAMWARE_SITE Osirusoft.com: sender is a Spamware site or vendor # NOTE: commercial tests, see README file for details header RCVD_IN_RBL eval:check_rbl('rbl', 'blackholes.mail-abuse.org.') describe RCVD_IN_RBL Received via RBLed relay, see http://www.mail-abuse.org/rbl/ header RCVD_IN_RSS eval:check_rbl('relay', 'relays.mail-abuse.org.') describe RCVD_IN_RSS Received via RSSed relay, see http://www.mail-abuse.org/rss/ header RCVD_IN_DUL eval:check_rbl('dialup', 'dialups.mail-abuse.org.') describe RCVD_IN_DUL Received from dialup, see http://www.mail-abuse.org/dul/ # NOTE: commercial test, see README file for details header RCVD_IN_BL_SPAMCOP_NET eval:check_rbl('spamcop', 'bl.spamcop.net.') describe RCVD_IN_BL_SPAMCOP_NET Received via a relay in bl.spamcop.net # don't include From:! Many UNIX MTA's get false positives otherwise # ditto for Reply-To:, some list software inserts Received and Reply-To hdrs header FORGED_RCVD_FOUND ALL =~ /\nSubject:.*\nReceived: /s describe FORGED_RCVD_FOUND Possibly-forged 'Received:' header found header YR_MEMBERSHIP_EXCH Subject =~ /Your Membership Exchange/ describe YR_MEMBERSHIP_EXCH Subject contains 'Your Membership Exchange' header FROM_FORGED_HOTMAIL From =~ /^[^"]+\S+\@hotmail\.com/i describe FROM_FORGED_HOTMAIL Forged From: line claiming to be from hotmail.com header DIFFERENT_REPLY_TO eval:check_for_spam_reply_to() describe DIFFERENT_REPLY_TO Reply-To: massively different from From: or To: header LOTS_OF_CC_LINES eval:check_lots_of_cc_lines() describe LOTS_OF_CC_LINES Lots and lots of Cc: headers header FROM_NAME_EQ_FROM_ADDR eval:check_from_name_eq_from_address() describe FROM_NAME_EQ_FROM_ADDR 'From:' address also used as sender's real name header FORGED_HOTMAIL_RCVD eval:check_for_forged_hotmail_received_headers() describe FORGED_HOTMAIL_RCVD Forged hotmail.com 'Received:' header found header FORGED_GW05_RCVD eval:check_for_forged_gw05_received_headers() describe FORGED_GW05_RCVD Forged 'by gw05' 'Received:' header found header CHARSET_FARAWAY eval:check_for_faraway_charset() describe CHARSET_FARAWAY Character set indicates a foreign language header NONEXISTENT_CHARSET Content-Type =~ /charset="DEFAULT/ describe NONEXISTENT_CHARSET Character set doesn't exist header X_MAILER_GIBBERISH X-Mailer =~ /^[A-Fa-f0-9\.]{48,}$/ describe X_MAILER_GIBBERISH 'X-Mailer' line contains gibberish header X_PRIORITY_HIGH X-Priority =~ /^1/ describe X_PRIORITY_HIGH Sent with 'X-Priority' set to high header X_MSMAIL_PRIORITY_HIGH X-Msmail-Priority =~ /^High/ describe X_MSMAIL_PRIORITY_HIGH Sent with 'X-Msmail-Priority' set to high header MAY_BE_FORGED Received =~ /\(may be forged\)/i describe MAY_BE_FORGED 'Received:' has 'may be forged' warning header SHORT_RECEIVED_LINE Received =~ /\S{120,}/s describe SHORT_RECEIVED_LINE 'Received:' contains huge hostname header CORRUPT_MSGID Message-Id =~ /\@Received: / describe CORRUPT_MSGID 'Message-Id' contains bits of Received header header MSG_ID_ADDED_BY_MTA Message-Id =~ / \(added by / describe MSG_ID_ADDED_BY_MTA 'Message-Id' was added by a relay header MANY_FROMS From =~ /^[^\"\<\(]+, [^\"\<\(]+$/ describe MANY_FROMS 'From' contains more than one address # *so* many spams come from here. header FROM_BTAMAIL From =~ /\@btamail.net.cn/i describe FROM_BTAMAIL From an address @btamail.net.cn header USER_IN_BLACKLIST eval:check_from_in_blacklist() describe USER_IN_BLACKLIST From: address is in the user's black-list header MISSING_HEADERS eval:check_for_missing_headers() describe MISSING_HEADERS Missing one of From:, To: or Date: headers # (contrib: skod) # modified by jm to remove bulk_mailer, matches on a mailing list I'm on header RATWARE ALL =~ /(?:4\.\.72\.1712\.3|ACE Contact Manager|Aristotle Mail|Avalanche|Calypso|clansoft|Cognigen|Cold Fusion|Cyber-Bomber|Crescent|DiffondiCool|Dynamic Mail Server|CTMailer|E-Broadcaster|E-mail Magnet|Ellipse Bulk Emailer|EmailBlaster|Emailer.Platinum|eMerge|Extractor|Floodgate|FlashSend|Goldrush|Group Mail|Internet Marketing|Mailcast|MailKing|MassE-Mail|massmail\.pl|Matchmaker|NetMailer|News Breaker|pop3.report|RamoMail|Ready Aim|Shopping.Planet|Stalker.s|TBBS\/TIGER|TOO BAD|TotalMailTURBO Mail|V3,1,6,1|V3,1,2,0|V3,2,2,0|V.null.\.1712\.3|WindoZ|WinNT.s.Blat|WorldMerge|YMR)/ describe RATWARE Bulk email software fingerprints found in headers score RATWARE 2.0 # contrib: Craig (total regexp wizardry here ;) header SUSPICIOUS_RECIPS To =~ /(@[-a-z0-9_.]+).*(?:\1.*){9,}/is describe SUSPICIOUS_RECIPS To: contains same domain at least 10 times header SUSPICIOUS_CC_RECIPS Cc =~ /(@[-a-z0-9_.]+).*(?:\1.*){9,}/is describe SUSPICIOUS_CC_RECIPS Cc: contains same domain at least 10 times header VERY_SUSP_RECIPS To =~ /(..)[^@]*(@[-a-z0-9_.]+).*(?:\1[^@]*\2.*){9,}/is describe VERY_SUSP_RECIPS To: contains very similar addresses 10 times header VERY_SUSP_CC_RECIPS Cc =~ /(..)[^@]*(@[-a-z0-9_.]+).*(?:\1[^@]*\2.*){9,}/is describe VERY_SUSP_CC_RECIPS Cc: contains very similar addresses 10 times ########################################################################### full RAZOR_CHECK eval:check_razor() describe RAZOR_CHECK Listed in Razor, see http://razor.sourceforge.net/ ########################################################################### body REMOVE_SUBJ /remove.*subject/i body SUBJ_REMOVE /subject.*remove/i body REPLY_REMOVE_SUBJECT /reply.*remove.*subject/i body REMOVE_IN_QUOTES /\"remove\"/i body JAVASCRIPT //i body BUGGY_CGI /Below is the result of your feedback form/ body BUGGY_CGI_DE /Neue Mail aus dem Fitzshop Briefkasten./ body BUGGY_CGI_DE_2 /Diese Mail wurde übertragen von/ # these are now full tests instead of body tests, to catch QP-encoded # split lines full SENT_IN_COMPLIANCE /message .{0,10}sen(?:d|t) in compliance (?:of|with)/ full PARA_A_2_C_OF_1618 /Paragraph .a.{0,10}2.{0,10}C. of S. 1618/i full BILL_1618 /Bill.{0,10}1618.{0,10}TITLE.{0,10}III/i full S_1618 /S..{0,10}1618.{0,10}-.{0,10}SECTION.{0,10}301/i full SECTION_301 /SECTION.{0,10}301/ body POPLAUNCH /StealthLaunch PopLaunch.\s/ body CHECK_OR_MONEY_ORDER /check or money order/i body NUMERIC_HTTP_ADDR /http\:\/\/\d+\//is body NORMAL_HTTP_TO_IP /http\:\/\/\d+\.\d+\.\d+\.\d+\//is body LONG_NUMERIC_HTTP_ADDR /http\:\/\/000\d+/is body HTTP_USERNAME_USED /http\:\/\/[^\s\/]+\@/is body SUPERLONG_LINE /^[^<]{199,}$/m body ASCII_FORM_ENTRY /[A-Za-z][A-Za-z]+.*\s+_{30,}/ body AMAZING /AMAZING/ body GUARANTEE /GUARANTEE/ body PROFITS /PROFITS/ body NO_QS_ASKED /NO QUESTIONS ASKED/ body FULL_REFUND /FULL REFUND/ body FOR_FREE /for FREE/ body MONEY_MAKING /money making/i body BULK_EMAIL /bulk e-*mail/i body DEAR_FRIEND /Dear Friend/ body CASHCASHCASH /\${3,}/ body CALL_NOW /CALL NOW/ body CALL_888 /(?:call|dial).*888-[\dA-Z]+-?[\dA-Z]+/i body CALL_1_800 /(?:call|dial).*1-800-[\dA-Z]+-?[\dA-Z]+/i body ONLINE_BIZ_OPS /online business opportunities/i body REMOVAL_INSTRUCTIONS /Removal instructions/i body BILLION_DOLLARS /[BM]ILLION DOLLAR/ body OPT_IN /opt-in/i body DIRECT_EMAIL /direct e-*mail/i body MASS_EMAIL /mass e-*mail/i body EMAIL_MARKETING /e-*mail marketing/i body PRODUCED_AND_SENT_OUT /This a.?d is produced and sent out by/ body INCREASE_TRAFFIC /increase.* traffic/i # this one gets a few false positives body SOCIAL_SEC_NUMBER /social security (?:number|record)/i # but this one almost never does, and catches *lots* of spam ;) body TRACE_BY_SSN /Trace anyone by social security number/i body INTL_EXEC_GUILD /International Executive Guild/ body ANOTHER_NET_AD /Another Internet Ad campaign produced/ body LASER_PRINTER /LASER PRINTER SUPPLIES/ body DIGITAL_FX1 /Digital FX1/ body OFFICE_OF_MD /The Office of *The Managing Director/ body BRAND_NEW_PAGER /BRAND NEW Pager FREE/ body ADDRESSES_ON_CD /addresses on cd/i body SHOES_GUY /(?:(?:Lingui|Guilin).*){2,}/i # almost all print-out spammer forms have this. You see, it makes # credit card processing a lot cheaper, and cuts down fees -- so it # will always be there ;) body PRINT_FORM_SIGNATURE /Signature:.*_________________/i body EXCUSE_1 /You (?:were sent|have received) this message because/i body EXCUSE_2 /If you did not opt.in/i body EXCUSE_3 /to (?:be removed|be deleted|no longer receive th(?:is|ese) messages?) (?:from|send|reply|[e-]*mail)/i body EXCUSE_4 /To Be Removed,? Please/i body EXCUSE_5 /that your email address is removed/i # strange pattern because otherwise it matches the std. majordomo line body EXCUSE_6 /(?:wish to|click to|To) remove yourself/ body EXCUSE_7 /you (?:wish|want|would like|desire) to be removed/i body EXCUSE_8 /requests to be taken off our mailing list/ body EXCUSE_9 /If you do.*n.*t (?:want|wish|care) to receive emails (?:on this subject|in the future)/i body EXCUSE_10 /if you (?:(?:want|wish|care|prefer) not to |(?:don't|do not) (?:want|wish|care) to )(?:be contacted again|receive (any)?\s*(?:more|future|further) (?:e?-?mail|messages?|offers|solicitations))/i describe EXCUSE_10 "if you do not wish to receive any more" body EXCUSE_11 /you.*(?:name|mail).*(?:was|were).*list/i body EXCUSE_12 /this (?:e?-?mail|message) (?:has reached|was sent to) you in error/i body EXCUSE_13 /mail was sent to you because /i body EXCUSE_14 /you do not wish to receive further /i body EXCUSE_15 /this is not (?:spam|unsolicited)/i body EXCUSE_16 /have received this (?:e?-?mail|message) in error[, ]* or/ body EXCUSE_17 /received .* by mistake/i body EXCUSE_18 /we do not (?:spam|send unsolicited)/i body GREEN_EXCUSE_1 /using email instead can significantly reduce this/i body GREEN_EXCUSE_2 /the trees, save the planet, use email!/i body VIAGRA /VIAGRA/ body FREE_PRIORITY_MAIL /FREE PRIORITY MAIL SHIPPING/i body LIMITED_TIME_ONLY /LIMITED TIME ONLY/i body STRONG_BUY /strong buy/i body WE_HONOR_ALL /we (?:honou?r|respect)(?: all|) remov[eal] requests/i body FILTERED_BY_WORLDREMOVE /filtered by WorldRemove/ body COMMUNIGATE /transferred with a trial version of CommuniGate/ # contrib: skod body AUTO_EMAIL_REMOVAL /Auto Email Removal/ body PORN_1 /\bbarely\b.*\blegal\b/i body PORN_2 /\bwild\b.*\bhardcore\b/i # updated by: skod & Craig & jm body PORN_3 /(?:(?:\bcum|\borg[iy]|\bwild|fuck|\bteen|\baction\b|spunk|\bpussy\b|\bpussies\b|suck\b|sucking\b|\bhot\b|\bhottest\b|\bvoyeur|\ble[sz]b(?:ian|o)|\banal\b|\binterracial|\basian\b|\bamateur|\bsex+\b|\bslut|explicit|xxx[^x]|\blive\b|celebrity|\blick|\bsuck|webcam|\bass\b|\bschoolgirl\b|\bstrip|\bhorny\b|\bhorniest\b|\berotic|\boral\b|\bhardcore\b|\bblow[ -]*job|\bnast(?:y|iest)\b).*){3,}/i describe PORN_3 Mind your language! body PORN_4 /http:\/\/[\w\.]*(?:xxx|sex|anal|slut|pussy|cum|nympho|suck|porn|hardcore|taboo|whore|voyeur|lesbian|gurlpages|naughty|lolita|teen|schoolgirl|fetish|kooloffer|erotic)\w*\./ describe PORN_4 Suspected porn URL # (contrib: skod) body PORN_5 /SEX STARVED NYMPHOMANIAC/i describe PORN_5 Nymphomaniacs? Indeed! # (contrib: skod) body PORN_6 /(?:\d+\+? xxx pictures|xxx photos?)/i describe PORN_6 XXX pictures mentioned body PORN_7 /Free XXX/i body TRACKER_ID /^\W{4,6} (?:[a-z]{10,}|[A-Z]{10,}) \W{4,6}\s*$/ body OPPORTUNITY /OPPORTUNITY/ body PURE_PROFIT /PURE PROFIT/ body STOCK_PICK /STOCK PICK/ body STOCK_ALERT /stock alert/i # some frequently-advertised URLs body E_WEBHOSTCENTRAL_URL /http:\/\/.*e-webhostcentral\.com/i body FREEWEBHOSTINGCENTRAL /http:\/\/.*freewebhostingcentral/i body FREEWEBCO_NET_URL /http:\/\/.*freewebco\.net/i body 25FREEMEGS_URL /http:\/\/.*25freemegs\.com/i body WEB4PORNO_URL /http:\/\/.*web4porno\.com/i body CLICKSFORMONEY_NET /http:\/\/.*clicksformoney\.net/i body WWW_REMOVEYOU_COM /http:\/\/.*removeyou\.com/i body WWW_DIRECTFORCEMARKETING_COM /http:\/\/.*directforcemarketing\.com/i body WWW_NETSITESFORFREE_NET /http:\/\/.*netsitesforfree\.net/i body FREE_CONSULTATION /FREE CONSULTATION/i body INCREASE_SALES /INCREASE SALES/i # (contrib: Matt Sergeant) body LARGE_HEX /^\s*[0-9a-fA-F]{40,}/ score LARGE_HEX 2 # somehow "/name.*\bcredit.?card\b/is" won't match, even if # it's there. *boggle* (contrib: WW) body WANTS_CREDIT_CARD /\bcredit.?card\s+order/i describe WANTS_CREDIT_CARD Asks for credit card details # (contrib: WW) body ASKS_BILLING_ADDRESS /\bbilling address\b/i describe ASKS_BILLING_ADDRESS Asks for a billing address # (contrib: WW) body CYBER_FIRE_POWER /(?:by|for) Cyber FirePower\!/ describe CYBER_FIRE_POWER mentions Cyber FirePower!, a spam-tool # (contrib: WW) # modified by jm to stop it matching on all-space lines body LINE_OF_YELLING /^[A-Z0-9\$\.,\'\!\?\s]{20,}[A-Z0-9\$\.,\'\!\?][A-Z0-9\$\.,\'\!\?\s]{20,}$/ describe LINE_OF_YELLING A WHOLE LINE OF YELLING DETECTED ########################################################################### # some full-text matches; note the [3D=\s"']* bits of the patterns, which # match some gibberish produced by quoted-printable encoding of HTML, often # in the middle of a HTML "attribute=value" pair. full JUST_MAILED_PAGE /\n\n.{0,160}