# # # 0.000 0.000 0.000 0.00 1.00 BACKED_BY #score BACKED_BY 1.0 #body BACKED_BY /\bbacked by [mb]illions\b/i #describe BACKED_BY Backed by Billions # # # # 0.001 0.000 0.001 0.00 1.00 BONUS_PAYMENT #score BONUS_PAYMENT 1.0 #body BONUS_PAYMENT /\bbonus payment/i #describe BONUS_PAYMENT Bonus Payments # # # 0.000 0.000 0.000 0.00 1.00 BRAND_NEW_PAGER #body BRAND_NEW_PAGER /BRAND NEW Pager FREE/ #describe BRAND_NEW_PAGER No such thing as a free lunch # # # 0.000 0.000 0.000 0.00 1.00 BREAKTHROUGH #score BREAKTHROUGH 1.0 #body BREAKTHROUGH /\bbreakthrough price/i #describe BREAKTHROUGH Breakthrough Pricing # # # note: this is from 1 particular shop! not worth keeping at all. #body BUGGY_CGI_DE /Neue Mail aus dem Fitzshop Briefkasten/i # # # 0.000 0.000 0.000 0.00 1.00 BUGGY_CGI_ES #body BUGGY_CGI_ES /Aqui esta el resultado de su formulario/i #describe BUGGY_CGI_ES Broken Spanish CGI script message #lang fr describe BUGGY_CGI_ES Réponse a un formulaire jamais rempli (en espagnol) #score BUGGY_CGI_ES 1.0 # # # 0.000 0.000 0.000 0.00 4.00 BUGGY_CGI_PT #body BUGGY_CGI_PT /Abaixo o resultado do preenchimento do Formulario/ #describe BUGGY_CGI_PT Broken Portuguese CGI script message #lang fr describe BUGGY_CGI_PT Réponse a un formulaire jamais rempli (en portugais) #score BUGGY_CGI_PT 4.0 # # # 0.000 0.000 0.000 0.00 1.00 CLICKSFORMONEY_NET #uri CLICKSFORMONEY_NET /clicksformoney\.net/i #describe CLICKSFORMONEY_NET Frequent SPAM content # # # 0.000 0.000 0.001 0.00 1.00 CLICK_TO_REMOVE_MAILTO #lang de describe CLICK_TO_REMOVE_MAILTO Click-to-remove mit mailto: gefunden #lang es describe CLICK_TO_REMOVE_MAILTO Click-to-remove with mailto: found #lang fr describe CLICK_TO_REMOVE_MAILTO Demande de cliquer sur un lien pour être retiré de la liste #score CLICK_TO_REMOVE_MAILTO 1.0 #body CLICK_TO_REMOVE_MAILTO /\bclick to.{0,30}remove.{0,50}mailto:/is #describe CLICK_TO_REMOVE_MAILTO Click-to-remove with mailto: found # # # 0.000 0.000 0.000 0.00 2.67 CORRUPT_MSGID #header CORRUPT_MSGID Message-Id =~ /\@Received: / #describe CORRUPT_MSGID 'Message-Id' contains bits of Received header #lang de describe CORRUPT_MSGID 'Message-Id' enthaelt Teile des Received Headers #lang es describe CORRUPT_MSGID 'Message-Id' contiene pedazos de la cabecera Received #lang fr describe CORRUPT_MSGID L'entête Message-Id: contient des morceaux de l'entête Received: #score CORRUPT_MSGID 2.665 # # # # 0.000 0.000 0.000 0.00 3.46 FAKED_UNDISC_RECIPS_AT #header FAKED_UNDISC_RECIPS_AT To =~ /undisclosed-recipient: \@[a-z]/i #describe FAKED_UNDISC_RECIPS_AT Faked To "Undisclosed-Recipients" @ some address #score FAKED_UNDISC_RECIPS_AT 3.461 # # # # # 0.000 0.000 0.000 0.00 1.00 IRS #score IRS 1.0 #body IRS /\bIRS .{0,15}secrets\b/i #describe IRS IRS Scams # # # 0.000 0.000 0.000 0.00 1.00 ITS_EFFECTIVE #lang fr describe ITS_EFFECTIVE Le mèl se targue de l'efficacité du service proposé #score ITS_EFFECTIVE 1.0 #body ITS_EFFECTIVE /\bit's effective\b/i #describe ITS_EFFECTIVE Something claims to be effective # # # 0.000 0.000 0.000 0.00 3.90 LASER_PRINTER #lang fr describe LASER_PRINTER Le mèl offre des fornitures pour imprimantes laser #score LASER_PRINTER 3.9 #body LASER_PRINTER /LASER PRINTER SUPPLIES/ #describe LASER_PRINTER Discusses laser printer supplies # # # 0.000 0.000 0.000 0.00 1.00 LIFE_INSURANCE #score LIFE_INSURANCE 1.0 #body LIFE_INSURANCE /\blife insurance.{1,30}no.{1,15}exam/i #describe LIFE_INSURANCE No Examination life Insurance # # # # 0.000 0.000 0.000 0.00 1.00 NO_SPENDING #score NO_SPENDING 1.0 #body NO_SPENDING /\bno spending limits\b/i #describe NO_SPENDING No Spending Limits # # # # 0.315 0.253 0.352 0.42 1.00 PORN_3 #full PORN_3 eval:porn_word_test() #lang de describe PORN_3 Enthaelt pornographische Begriffe und Phrasen (3) #lang es describe PORN_3 Cuida tu idioma! #lang fr describe PORN_3 Utilise des mots ou des phrases à caractère pornographique #lang pl describe PORN_3 U¿yte przynajmniej 3 angielskie wulgaryzmy. #test PORN_3 ok Wild Asian hot peppers #test PORN_3 fail Wild Asian cucumbers #test PORN_3 fail Hot lesbo xxxx #test PORN_3 fail Hot lesbians # # # # 0.000 0.000 0.000 0.00 1.00 PRINT_OUT_AND_FAX #lang fr describe PRINT_OUT_AND_FAX Demande d'imprimer un formulaire avant de le télécopier #score PRINT_OUT_AND_FAX 1.0 #body PRINT_OUT_AND_FAX /print\s+out\s+and\s+fax/i #describe PRINT_OUT_AND_FAX Contains words 'print out and fax' # # # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_00 #header RATWARE_00 ALL =~ /4\.\.72\.1712\.3/ #describe RATWARE_00 Bulk email software fingerprint (00) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_01 #header RATWARE_01 ALL =~ /ACE Contact Manager/ #describe RATWARE_01 Bulk email software fingerprint (01) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_02 #header RATWARE_02 ALL =~ /Aristotle Mail/ #describe RATWARE_02 Bulk email software fingerprint (02) found in headers # # # 0.002 0.000 0.003 0.00 1.00 RATWARE_05 #header RATWARE_05 ALL =~ /clansoft/ #describe RATWARE_05 Bulk email software fingerprint (05) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_07 #header RATWARE_07 ALL =~ /Cyber-Bomber/ #describe RATWARE_07 Bulk email software fingerprint (07) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_10 #header RATWARE_10 ALL =~ /Dynamic Mail Server/ #describe RATWARE_10 Bulk email software fingerprint (10) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_12 #header RATWARE_12 ALL =~ /E-Broadcaster/ #describe RATWARE_12 Bulk email software fingerprint (12) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_13 #header RATWARE_13 ALL =~ /E-mail Magnet/ #describe RATWARE_13 Bulk email software fingerprint (13) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_14 #header RATWARE_14 ALL =~ /Ellipse Bulk Emailer/ #describe RATWARE_14 Bulk email software fingerprint (14) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_15 #header RATWARE_15 ALL =~ /EmailBlaster/ #describe RATWARE_15 Bulk email software fingerprint (15) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_16 #header RATWARE_16 ALL =~ /Emailer.Platinum/ #describe RATWARE_16 Bulk email software fingerprint (16) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_18 #header RATWARE_18 ALL =~ /Extractor/ #describe RATWARE_18 Bulk email software fingerprint (18) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_19 #header RATWARE_19 ALL =~ /Floodgate/ #describe RATWARE_19 Bulk email software fingerprint (19) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_20 #header RATWARE_20 ALL =~ /FlashSend/ #describe RATWARE_20 Bulk email software fingerprint (20) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_21 #header RATWARE_21 ALL =~ /Goldrush/ #describe RATWARE_21 Bulk email software fingerprint (21) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_24 #header RATWARE_24 ALL =~ /Mailcast/ #describe RATWARE_24 Bulk email software fingerprint (24) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_25 #header RATWARE_25 ALL =~ /MailKing/ #describe RATWARE_25 Bulk email software fingerprint (25) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_26 #header RATWARE_26 ALL =~ /MassE-Mail/ #describe RATWARE_26 Bulk email software fingerprint (26) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_27 #header RATWARE_27 ALL =~ /massmail.pl/ #describe RATWARE_27 Bulk email software fingerprint (27) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_30 #header RATWARE_30 ALL =~ /News Breaker/ #describe RATWARE_30 Bulk email software fingerprint (30) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_31 #header RATWARE_31 ALL =~ /pop3.report/ #describe RATWARE_31 Bulk email software fingerprint (31) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_32 #header RATWARE_32 ALL =~ /RamoMail/ #describe RATWARE_32 Bulk email software fingerprint (32) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_33 #header RATWARE_33 ALL =~ /Ready Aim/ #describe RATWARE_33 Bulk email software fingerprint (33) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_34 #header RATWARE_34 ALL =~ /Shopping.Planet/ #describe RATWARE_34 Bulk email software fingerprint (34) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_35 #header RATWARE_35 ALL =~ /Stalker.s/ #describe RATWARE_35 Bulk email software fingerprint (35) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_36 #header RATWARE_36 ALL =~ /TBBS\/TIGER/ #describe RATWARE_36 Bulk email software fingerprint (36) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_37 #header RATWARE_37 ALL =~ /TOO BAD/ #describe RATWARE_37 Bulk email software fingerprint (37) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_38 #header RATWARE_38 ALL =~ /TotalMailTURBO Mail/ #describe RATWARE_38 Bulk email software fingerprint (38) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_41 #header RATWARE_41 ALL =~ /V3,2,2,0/ #describe RATWARE_41 Bulk email software fingerprint (41) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_43 #header RATWARE_43 ALL =~ /WindoZ/ #describe RATWARE_43 Bulk email software fingerprint (43) found in headers # # # 0.000 0.000 0.000 0.00 1.00 RATWARE_45 #header RATWARE_45 ALL =~ /WorldMerge/ #describe RATWARE_45 Bulk email software fingerprint (45) found in headers # # # # 0.000 0.000 0.000 0.00 1.00 SELECTED #body SELECTED /\byou.{0.9} been selected\b/i #describe SELECTED You've been selected! Lucky You! # # # 0.000 0.000 0.000 0.00 1.00 SHOES_GUY #body SHOES_GUY /(?:\b(?:Lingui|Guilin)\b.{1,30}){2,}/i #describe SHOES_GUY Want some shoes? # # # # 0.000 0.000 0.000 0.00 1.00 SPY_ON_FRIENDS #score SPY_ON_FRIENDS 1.0 #body SPY_ON_FRIENDS /\binvestigat.{0.15} (?:friend|employee|neighbor)/i #describe SPY_ON_FRIENDS Investigate your Friends! # # # 0.000 0.000 0.000 0.00 4.00 STAINLESS_STEEL #uri STAINLESS_STEEL /www.BuyStainlessOnline.com/i #describe STAINLESS_STEEL Stainless Steel Network Spam #lang fr describe STAINLESS_STEEL Contient une référence à www.BuyStainlessOnline.com, fréquement trouvée dans du spam #score STAINLESS_STEEL 4.0 # # # # 0.029 0.078 0.000 1.00 -1.00 USER_AGENT_GNUS_XM #score USER_AGENT_GNUS_XM -0.1 #header USER_AGENT_GNUS_XM X-Mailer =~ /^Gnus\/\d\.\d+ / #describe USER_AGENT_GNUS_XM X-Mailer header indicates a non-spam MUA (Gnus) #tflags USER_AGENT_GNUS_XM nice #score USER_AGENT_GNUS_XM -1.0 # # # 0.000 0.000 0.000 0.00 1.00 VIGORA #body VIGORA /\bVigora\b/ #describe VIGORA Some sort of viagra alternative # # # 0.000 0.000 0.000 0.00 1.00 WWW_DIRECTFORCEMARKETING_COM #uri WWW_DIRECTFORCEMARKETING_COM /directforcemarketing\.com/i #describe WWW_DIRECTFORCEMARKETING_COM Frequent SPAM content # # # 0.001 0.002 0.000 1.00 2.00 RATWARE_UPROAR #header RATWARE_UPROAR X-Mailer =~ /Uproar Mass Mailer/ #describe RATWARE_UPROAR Bulk email software fingerprint (Uproar) found in headers # 0.000 0.000 0.000 0.00 1.00 FROM_UGETMORE #header FROM_UGETMORE From =~ /\@ugetmore4less.net/i #describe FROM_UGETMORE From an address @ugetmore4less.net #lang fr describe FROM_UGETMORE Le mèl est orgininaire d'une adresse @ugetmore4less.net # 0.000 0.000 0.000 0.00 1.00 WWW_TRAFFICWOW_NET #20_uri_tests.cf:uri WWW_TRAFFICWOW_NET /trafficwow\.net/i #20_uri_tests.cf:describe WWW_TRAFFICWOW_NET Frequent SPAM content