# SpamAssassin rules file: phrase tests
#
# Please don't modify this file as your changes will be overwritten with
# the next update. Use @@LOCAL_RULES_DIR@@/local.cf instead.
# See 'perldoc Mail::SpamAssassin::Conf' for details.
#
# Note: body tests are run with long lines, so be sure to limit the
# size of searches; use /.{0,30}/ instead of /.*/ to avoid huge
# search times.
#
# <@LICENSE>
# Copyright 2004 Apache Software Foundation
# 
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
# 
#     http://www.apache.org/licenses/LICENSE-2.0
# 
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# </@LICENSE>
#
###########################################################################

require_version @@VERSION@@

###########################################################################

body REMOVE_FROM_LIST		/to be removed from (?:the|my|our) (?:mailing|e.?mail|opt[ -]?in)? ?list/i
describe REMOVE_FROM_LIST	To be removed from list

body MULTI_REMOVAL_1WORD	/remov\S{0,64}remov/i
describe MULTI_REMOVAL_1WORD	List removal information

# bug 1022: MGM_POSTCARD #2 original
body REMOVE_POSTAL		/(?:Send(?:ing)? a (?:postal mail|postcard) to (?:Unsubscribe|Customer ?Service|remove)|unsubscribe by (?:postal mail|postcard))/i
describe REMOVE_POSTAL		Send real mail to be unsubscribed

###########################################################################
# CLICK rules
# note HTML_LINK_CLICK* rules in HTML parser section

body CLICK_BELOW_CAPS		/CLICK\s.{0,30}(?:HERE|BELOW)/s
describe CLICK_BELOW_CAPS	Asks you to click below (in capital letters)

body __CLICK_BELOW		/click\s.{0,30}(?:here|below)/is
meta CLICK_BELOW		(__CLICK_BELOW && !CLICK_BELOW_CAPS)
describe CLICK_BELOW		Asks you to click below

body CLICK_TO_REMOVE_1		/click here to be (?:permanently )?(?:removed|deleted)/i
describe CLICK_TO_REMOVE_1	Click to be removed

body SENT_IN_COMPLIANCE		/(?:e.?mail|message) .{0,10}sen[dt] (?:to you )?in (?:\w{1,10} )?compliance (?:of|with)/i
describe SENT_IN_COMPLIANCE	Claims compliance with spam regulations
body BILL_1618			/\bs\W{0,4}1618\b/i
describe BILL_1618		Possible mention of bill 1618 (anti-spam bill)
body BILL_SECTION		/SECTION.{0,10}301/i
describe BILL_SECTION		Claims compliance with spam regulations
body FURTHER_TRANSMISSIONS	/further transmissions to you by the sender/i
describe FURTHER_TRANSMISSIONS	Claims compliance with spam regulations

body ALL_CAPS_GUAR		/\bGUARANTEE\b/
describe ALL_CAPS_GUAR		Contains word 'guarantee' in all-caps
body NO_QS_ASKED		/\bNO QUESTIONS ASKED\b/i
describe NO_QS_ASKED		Doesn't ask any questions
body FULL_REFUND		/full refund|refunds? your money in full/i
describe FULL_REFUND		Offers a full refund

body FOR_FREE			/\bfor (?-i:FREE)\b/i
describe FOR_FREE		No such thing as a free lunch (1)
body COMPLETELY_FREE		/\b(?:100%|completely|totally|absolutely) (?-i:F)ree/i
describe COMPLETELY_FREE	No such thing as a free lunch (2)

body NO_COST                    /\bno (?:cost|charge)\b/i
describe NO_COST                No such thing as a free lunch (3)
body GUARANTEED_100_PERCENT	/100% GUARANTEED/i
describe GUARANTEED_100_PERCENT	One hundred percent guaranteed
body DEAR_FRIEND		/^\s*Dear Friend\b/i
describe DEAR_FRIEND		Dear Friend? That's not very dear!
body DEAR_SOMETHING		/\bDear (?:IT\W|Internet|candidate|sirs?|madam|investor|travell?er|car shopper|web)\b/i
describe DEAR_SOMETHING		Contains 'Dear (something)'
body BILLION_DOLLARS		/[BM]ILLION DOLLAR/
describe BILLION_DOLLARS	Talks about lots of money
body OPTING_OUT			/\bopt-out\b/
describe OPTING_OUT		Talks about opting out (lowercase version)
body OPTING_OUT_CAPS		/(?-i:O)pt.?(?-i:O)ut/i
describe OPTING_OUT_CAPS	Talks about opting out (capitalized version)
body DIRECT_EMAIL		/direct e-*mail\b/i
describe DIRECT_EMAIL		Talks about direct email

body NEVER_ANOTHER		/never receive another mailing/i
describe NEVER_ANOTHER		"another mailing" will "never" be "received"

# contrib: Duncan
body ONE_TIME_MAILING		/this\b.{0,20}\b(?:one|1).time\b.{0,20}\b(?:(?:e-?)?mail|offer)/i
describe ONE_TIME_MAILING	one time mailing doesn't mean it isn't spam

body MILLION_EMAIL		/million (?:\w+ )?(?:e-?mail )?addresses/i
describe MILLION_EMAIL		Get a million email addresses

body EXCUSE_1			/\b(?:You (?:were sent|have received|are receiving)|You're receiving).{0,15}(?:message|e-?mail)s? because/i
describe EXCUSE_1		Gives a lame excuse about why spam was sent
body EXCUSE_3			/to (?:be removed|be deleted|no longer receive th(?:is|ese) messages?) (?:from|send|reply|[e-]*mail)/i
describe EXCUSE_3		Claims you can be removed from the list
body EXCUSE_4			/To Be Removed,? Please/i
describe EXCUSE_4		Claims you can be removed from the list

# strange pattern because otherwise it matches the std. majordomo line
# pls note the comment above. DO NOT just put "to" in the first group!
body EXCUSE_6			/\b(?:wish to|click to) remove yourself/i
describe EXCUSE_6		Claims you can be removed from the list

body EXCUSE_7			/you (?:wish|want|would like|desire) to be removed/i
describe EXCUSE_7		Claims you can be removed from the list

body EXCUSE_10			/if you (?:(?:want|wish|care|prefer) not to |do ?n[o']t (?:want|wish|care) to )(?:be contacted again|receive (?:any ?)?(?:more|future|further)\b.{1,10}\b(?:e?-?mail|message|offer|solicitation)s?|be included)/i
describe EXCUSE_10		"if you do not wish to receive any more"

body EXCUSE_11			/you.{0,15}(?:name|mail).{0,15}(?:was|were|our).{0,15}list/i
describe EXCUSE_11		Claims you were on a list
body EXCUSE_12			/this (?:e?-?mail|message) (?:(?:has )?reached|was sent to) you in error/i
describe EXCUSE_12		Nobody's perfect
body EXCUSE_15			/this\s*(?:e?-?mail|message)? (?:is|was) (?:not|never) (?:spam|(?:sent )?unsolicited)/i
describe EXCUSE_15		Claims to be legitimate email

body EXCUSE_19			/because (?:you're|you (?:are )?)(?:registered|.{0,20}\bopt.{0,3}in)/i
describe EXCUSE_19		Claims you opted-in or registered
body EXCUSE_21			/your e.?mail address was obtained/i
describe EXCUSE_21		Claims address was obtained legitimately
body EXCUSE_22			/you are receiving this special offer/i
describe EXCUSE_22		You're receiving this offer for a reason
body EXCUSE_23			/you have provided permission/i
describe EXCUSE_23		Claims you have provided permission
body EXCUSE_24			/you(?:'ve|'re| have| are)? receiv(?:e|ed|ing) this (?:advertisement|offer|special|recurring|paid).{0,16}\b(?:by either|because)/i
describe EXCUSE_24		Claims you wanted this ad

body EXCUSE_REMOVE		/to be removed from.{0,20}(?:mailings|offers)/i
describe EXCUSE_REMOVE		Talks about how to be removed from mailings

body TARGETED                   /\btargeted (?:traffic|e-?mail|internet|leads?)\b/i
describe TARGETED               Targeted Traffic / Email Addresses

body LIMITED_TIME_ONLY		/LIMITED TIME (?:ONLY|offer)/i
describe LIMITED_TIME_ONLY	Offers a limited time offer
body STRONG_BUY			/strong buy/i
describe STRONG_BUY		Tells you about a strong buy

body WE_HONOR_ALL		/\b(?:honou?r|respect)(?: all)? remov(?:e|al) requests?\b/i
describe WE_HONOR_ALL		Claims to honor removal requests

body STOCK_PICK			/STOCK PICK/i
describe STOCK_PICK		Offers a picked stock
body STOCK_ALERT		/stock alert/i
describe STOCK_ALERT		Offers a alert about a stock
body MICRO_CAP_WARNING		/Investing in micro-cap securities is highly speculative/i
describe MICRO_CAP_WARNING	SEC-mandated penny-stock warning
body NOT_ADVISOR		/not a registered investment advisor/i
describe NOT_ADVISOR		Not registered investment advisor

body SOME_BREAKTHROUGH		/\b(?:science|medical|major|scientific|fundamental|technology|revolutionary)\s+breakthrough/i
describe SOME_BREAKTHROUGH	Describes some sort of breakthrough

body SELECTED_YOU		/\b(?:you (?:have been|were) selected|\bwe (?:have )?selected you)/i
describe SELECTED_YOU		They have selected you for something

# (contrib: skod)
body MAIL_IN_ORDER_FORM		/\b(?:Mail-in|secure|ez|credit.card|fax this) Order Form\b/i
describe MAIL_IN_ORDER_FORM	Contains mail-in order form

# (contrib: skod)
body UNIVERSITY_DIPLOMAS	/\b(?:college|university)\s+diplomas/i
describe UNIVERSITY_DIPLOMAS	University Diplomas

body PREST_NON_ACCREDITED	/prestigi?ous\b.{0,20}\bnon-accredited\b.{0,20}\buniversities/i
describe PREST_NON_ACCREDITED	'Prestigious Non-Accredited Universities'

body CANNOT_BE_SPAM		/cannot be considered spam/i
describe CANNOT_BE_SPAM		Claims "cannot be considered spam"

body THIS_IS_AN_AD		/this message is an advertisement/i
describe THIS_IS_AN_AD		Says "this is an advertisement" (thanks!)

# Jul 3 2002 jm: modified PENIS_ENLARGE patterns: removed "add", replaced with
# "inches", because that seems to be another typical word in the pattern.
# Feb 11 2003 jm: removed "PP" from pattern, since "pp. 234-237" is std usage
# in academic circles.  I don't think the hit-rate will be affected. ;)
# Feb 18 2004 rap: Changed rule name PENIS_ENLARGE to BODY_ENHANCEMENT. Some found the
# old rule name offensive.
body BODY_ENHANCEMENT		/\b(?:enlarge|increase|grow|lengthen|larger\b|bigger\b|longer\b|thicker\b|\binches\b).{0,50}\b(?:penis|male organ|pee[ -]?pee|dick|sc?hlong|wh?anger|breast)/i
describe BODY_ENHANCEMENT		Information on growing body parts

body BODY_ENHANCEMENT2		/\b(?:penis|male organ|pee[ -]?pee|dick|sc?hlong|wh?anger|breast).{0,50}\b(?:enlarge|increase|grow|lengthen|larger\b|bigger\b|longer\b|thicker\b|\binches\b)/i
describe BODY_ENHANCEMENT2		Information on getting larger body parts

body     IMPOTENCE              /\b(?:impotence (?:problem|cure|solution)|Premature Ejaculation|erectile dysfunction)/i
describe IMPOTENCE              Impotence cure

body WORK_AT_HOME		/\b(?:WORK|(?:MAKE|EARN).{1,10}(?:MONEY|\$+|BUCKS|CASH)).{1,10}(?:AT|FROM) (?:YOUR )?HOME/i
describe WORK_AT_HOME		Information on how to work at home (1)

body     NO_EXPERIENCE          /\bNo EXPERIENCE/i
describe NO_EXPERIENCE          No experience needed!

body MORTGAGE_BEST		/\b(?:low(?:est|er)?|free|second|rate|best|refinanc(?:e|ing)|online|instant) mortgage/i
describe MORTGAGE_BEST		Information on mortgages

body MORTGAGE_PITCH		/mortgage (?:rates?|quotes?|approv(?:al|ed)|payment|interest|loans?|app(?:\b|lication))/i
describe MORTGAGE_PITCH		Looks like mortgage pitch

body MORTGAGE_RATES		/Mortgage rates/i
describe MORTGAGE_RATES		Information on mortgage rates

body MORTGAGE_WAITING           /mortgage companies make you wait/i
describe MORTGAGE_WAITING       Something about waiting for mortgages

body MORTGAGE_NETWORK           /will be transmitted to our network of mortgage specialists/i
describe MORTGAGE_NETWORK       Something about a mortgage network

body ORDER_REPORT               /order report .\s?\d from/i
describe ORDER_REPORT           Order a report from someone
				    
# this works best as rawbody
# do not add "subscribe", "unsubscribe", or "help"
rawbody MAILTO_SUBJ_REMOVE		/mailto:.{0,64}\@.{0,64}\?subject=(?:\"|3D)*(?:remove?|delete|please.?(?:delete|remove|unsubscribe)|abuse|off\b|stop|take.?me.?off)/i
describe MAILTO_SUBJ_REMOVE	mailto URI includes removal text

body AOL_USERS_LINK		/AOL\s+Users\s+Click/is
describe AOL_USERS_LINK		Includes a link for AOL users to click

body NA_DOLLARS			/\b(?:\d{1,3})?Million\b.{0,40}\b(?:Canadian Dollar?s?|US\$|U\.? ?S\.? Dollar)/i
describe NA_DOLLARS		Talks about a million North American dollars

# to still match all test cases
body US_DOLLARS_2               /\s(?:\$|US\$|usd?).?\d{2,3}(?:\.\d)?.?(?:m|millions?)\b/i
describe US_DOLLARS_2           Mentions $$$ ($NNN.N m/USDNNN.N m/US$NN.N m)

body US_DOLLARS_3               /(?:\$|usd).?\d{1,3}[,.]\d{3}[,.]\d{3}(?:[,.]\d\d)?/i
describe US_DOLLARS_3           Mentions millions of $ ($NN,NNN,NNN.NN)

body MILLION_USD              	/Million\b.{0,40}\b(?:United States? Dollars?|USD)/i
describe MILLION_USD 		Talks about millions of dollars

rawbody FRONTPAGE		/FrontPage.Editor/
describe FRONTPAGE		Frontpage used to create the message

body JODY			/\b(?:My wife|Mi esposa), Jody/
describe JODY			Contains "My wife, Jody" testimonial

body YOUR_INCOME		/\byour income\b/i
describe YOUR_INCOME		Doing something with my income

body RESISTANCE_IS_FUTILE	/Replying to this email will not unsubscribe you./i
describe RESISTANCE_IS_FUTILE	Resistance to this spam is futile

body SUBJ_2_CREDIT              /subject to credit approval/i
describe SUBJ_2_CREDIT          Contains 'subject to credit approval'

body URG_BIZ			/urgent.{0,16}(?:assistance|business|buy|confidential|notice|proposal|reply|request|response)/i
describe URG_BIZ		Contains urgent matter

body EARN_PER_WEEK              /\b(?:earn|make).{1,20}\d\d\d+.{1,30}(?:per week|per month|weekly|monthly)/i
describe EARN_PER_WEEK          Contains 'earn $something per week'

# suggestion following Jason Haar
body     READ_TO_END            /read this (?:e-?mail )?to the end/i
describe READ_TO_END            You'd better read all of this spam!

body     ALL_NATURAL            /\b(?:100%|completely|totally|all) natural/i
describe ALL_NATURAL            Spam is 100% natural?!

body     MONEY_BACK             /money back guarantee/i
describe MONEY_BACK             Money back guarantee

body     NO_CATCH               /there is no catch/i
describe NO_CATCH               There is no catch

body     NO_OBLIGATION          /no obligation/i
describe NO_OBLIGATION          There is no obligation

body     NO_DISAPPOINTMENT      /You won'?t be diss?app?ointed/i
describe NO_DISAPPOINTMENT      You won't be "disappointed"

body     SERIOUS_ONLY           /Serious [IE]nquiries Only/i
describe SERIOUS_ONLY           Serious Enquiries Only

body     RISK_FREE              /\b(?:risk[ -]free|no[ -]risk)/i
describe RISK_FREE              Risk free.  Suuurreeee....

# "seen on TV", "seen on ABC/NBC/etc", "seen on XYZ TV", or "seen on:"
body AS_SEEN_ON			/seen on\b\s*(?:T\.?V\.?|ABC|NBC|CBS|CNN|Oprah|USA Today|48 Hours|New York Times|\w+\s+T\.?V\.?|:)/i

describe AS_SEEN_ON		As seen on national TV!

body     NOT_INTENDED           /not intended for residents (?:of|in)\b/i
describe NOT_INTENDED           Not intended for residents of somewhere

# This phrase appears in many pyramid scheme mails in which
# "My Wife Jody" testimonials are absent
body     COPY_ACCURATELY        /copy.{1,10}name.{1,10}address.{1,10}ACCURATELY\b/i
describe COPY_ACCURATELY        Common pyramid scheme phrase (1)

body ORDER_NOW			/\border (?:now|soon|fast|quickly|while|today)\b/i
describe ORDER_NOW		Encourages you to waste no time in ordering

## Contrib: Marc Perkel
body OFFSHORE_SCAM		/\boffshore\b.{0,20}(?:credit card|companies|account|financ|websites?)/i
describe OFFSHORE_SCAM		Off Shore Scams

body WHY_PAY_MORE		/\bwhy pay more\b/i
describe WHY_PAY_MORE		Why Pay More?

body CONGRATULATIONS		/\bcongratulations! you/i
describe CONGRATULATIONS	Congratulations - you've been scammed?

# do not add "new" since there's non-spam about "new cell phone numbers"
# separated into two rules since one seems to have a lot of
# sourceforge list advertisement false positives
body CELL_PHONE_FREE          	/\b(?-i:F)ree\b.{0,24}(?:cell(?:ular)?|mobile).{0,4}phones?/i
describe CELL_PHONE_FREE 	Talks about free mobile phones

body CELL_PHONE_IMPROVE		/\b(?:(?:boost|antenna|reception).{0,16}(?:cell|mobile|phone|cord.?less)|(?:cell|mobile|phone|cord.?less).{0,16}(?:boost|antenna|reception))/i
describe CELL_PHONE_IMPROVE	Talks about cell-phone signal improvement

# similar to OFFER, but fewer FPs
body RECEIVE_OFFER		/receive special offer/i
describe RECEIVE_OFFER		Receive a special offer

body FREE_QUOTE_INSTANT		/free.{0,12}(?:(?:instant|express|online|no.?obligation).{0,4})+.{0,32}\bquote/i
describe FREE_QUOTE_INSTANT	Free express or no-obligation quote

body FREE_INVESTMENT	        /\bfree investment/i
describe FREE_INVESTMENT	Free Investment

body FREE_TRIAL		        /\bfree trial\b/i
describe FREE_TRIAL		Free Trial

body FREE_MEMBERSHIP	        /\bfree membership/i
describe FREE_MEMBERSHIP	Free Membership

body CREDIT_CARD	        /\bcredit card.{1,10}(?:offer|debt|decision)/i
describe CREDIT_CARD		Credit Card Offers

body NO_CREDIT_CHECK	        /\bno credit check\b/i
describe NO_CREDIT_CHECK	Without a credit check

body BANKRUPTCY		        /\b(?:avoid|past) bankruptcy\b/i
describe BANKRUPTCY		Avoiding bankruptcy

body ACCEPT_CREDIT_CARDS	/\b(?:accept\b|are accepting).{1,15}credit cards?\b/i
describe ACCEPT_CREDIT_CARDS	Accepting credit cards

body BAD_CREDIT		        /\b(?:bad|poor|no\b|eliminate|repair|(?:re)?establish|damag).{0,10} (?:credit|debt)\b/i
describe BAD_CREDIT		Eliminate Bad Credit

body NONSECURED_CREDIT	        /\bunsecured.{0,10}(?:master ?card|visa|credit|loans|debt)\b/i
describe NONSECURED_CREDIT	Non-secured Credit/Debt

body LOW_INTEREST	        /\blow.{0,20} interest rates?\b/i
describe LOW_INTEREST		Lower Interest Rates

body SAVE_UP_TO                 /\b(?-i:S)ave up to\b/i
describe SAVE_UP_TO             Save Up To

body LOW_PAYMENT	        /\b(?:reduce|low).{0,12} payment/i
describe LOW_PAYMENT		Lower Monthly Payment

body CONSOLIDATE_DEBT		/(?:consolidate .{0,9} (?:debt|credit|bills)|debt[ -]?(?:consolidation|elimination))/i
describe CONSOLIDATE_DEBT	Consolidate debt, credit, or bills

body CREDITORS_CALLING	        /\bcreditors calling\b/i
describe CREDITORS_CALLING 	Calling Creditors

body REFINANCE_YOUR_HOME	/\brefinance your(?: current)? (?:home|house)\b/i
describe REFINANCE_YOUR_HOME	Home refinancing

body REFINANCE_NOW              /time to refinance|refinanc\w{1,3}\b.{0,16}\bnow\b/i
describe REFINANCE_NOW          Home refinancing

body NO_PURCHASE	        /\bno purchase\b/i
describe NO_PURCHASE		No Purchase Necessary

body NO_FEE		        /\bno .{0,12}fees?\b/i
describe NO_FEE			No Fees

body NO_MEDICAL		        /\bno medical exam/i
describe NO_MEDICAL		No Medical Exams

body NO_FORMS		        /\bno .{0,9}forms\b/i
describe NO_FORMS		No Claim Forms

body NO_GIMMICK		        /\bno gimmick\b/i
describe NO_GIMMICK		No Gimmick

body NO_INVESTMENT	        /\bno investment/i
describe NO_INVESTMENT		No Investment

body INITIAL_INVEST	        /\binitial investment\b/i
describe INITIAL_INVEST		Requires Initial Investment

body NO_INVENTORY	        /\bno inventory\b/i
describe NO_INVENTORY		No Inventory

body BUY_DIRECT		        /\bbuy direct\b/i
describe BUY_DIRECT		Buy Direct

body DO_IT_TODAY		/\b(?:join|register|order|apply) .{0,10}(?-i:T)oday\b/i
describe DO_IT_TODAY		Do it Today

body WHY_WAIT		        /\b(?:why wait|what are you waiting for)\b/i
describe WHY_WAIT		What are you waiting for

body USE_IDENTITY		/someone using your identity/i
describe USE_IDENTITY		Someone using your identity

body YOU_CAN_SEARCH		/you can search for anyone/i
describe YOU_CAN_SEARCH		You can search for anyone

body FIND_ANYTHING	        /\bfind out anything\b/i
describe FIND_ANYTHING		Find out anything

body SEDUCTION		        /\b(?:seduc|attract).{0,8} (?:ebook|opposite sex|women)\b/i
describe SEDUCTION		Score with babes!

body INVALUABLE_MARKETING	/invaluable marketing information/i
describe INVALUABLE_MARKETING	Invaluable marketing information

body SAVE_MONEY		        /\bsave .{0,9}(?:money|thousands|millions|up to)\b/i
describe SAVE_MONEY		Save big money

body GUARANTEED_STUFF	        /\bguarantee.{0,15}(?:income|money|monthly)\b/i
describe GUARANTEED_STUFF	Guaranteed Stuff

body INCOME		        /\badditional income\b/i
describe INCOME			Additional Income

body EARNINGS		        /\b(?:potential (?:earnings|income)|income potential)\b/i
describe EARNINGS		Potential Earnings

body THE_BEST_RATE	        /\bthe best rate/i
describe THE_BEST_RATE		The best Rates

body AMAZING_STUFF	        /\bamazing (?:product|rates)/i
describe AMAZING_STUFF		Amazing Stuff

# seems like we vastly reduce FPs on this one with a small change or two
body DIET_1		/\b(?:(?:without|no) (?:exercis(?:e|ing)|dieting)|weight.?loss|(?:extra|lose|lost|losing).{0,10}(?:pounds|weight|inches|lbs)|burn.{1,10}fat)\b/i
describe DIET_1		Lose Weight Spam

body DIET_2		/\blo+se.{1,10}\d+.{1,3}(?:lb|pound|kg|kilo)/i
describe DIET_2		Describes weight loss

body DIET_3		/(?:Body Fat Loss|Loss of body fat|lose.{1,10}body fat)/i
describe DIET_3		Describes body fat loss

body LONG_DISTANCE	        /\b(?:Unlimited|per minute|free).{1,9}Long Distance/i
describe LONG_DISTANCE		Long Distance Phone Offer

body REVERSE_AGING 		/\breverses? aging\b/i
describe REVERSE_AGING		Reverses Aging

body HAIR_LOSS			/\b(?=[gnrt])(?:thinn?ing|restore|grow|new) hair|\bhair loss/i
describe HAIR_LOSS		Cures Baldness

body CABLE_CONVERTER	        /\bcable (?:converter|descrambler)/i
describe CABLE_CONVERTER	Cable Converter

body WRINKLES		        /\bwrinkle reduction\b/i
describe WRINKLES		Removes Wrinkles

body BUY_JUDGEMENTS	        /\b(?:purchase|collect|divorce)\b.{0,30}\bjudgements\b/i
describe BUY_JUDGEMENTS		Buying judgements

body LYING_EYES		        /\bbelieve your eyes\b/i
describe LYING_EYES		Will not Believe your Eyes!

body WHILE_YOU_SLEEP	        /\bwhile you sleep\b/i
describe WHILE_YOU_SLEEP	While you Sleep

body WHILE_SUPPLIES	        /\bwhile supplies last\b/i
describe WHILE_SUPPLIES		While Supplies Last

body RICH		        /\b(?:make you rich|get rich quick)\b/i
describe RICH			If only it were that easy

body YOU_WON                    /\byou(?:\'ve| have)? won[^\'\w]/i
describe YOU_WON                Who really wins?

body FREE_PASSWORD              /\bfree .{0,9}passwords?\b/i
describe FREE_PASSWORD          Offers Free (often stolen) Passwords

body HIDDEN_CHARGES	        /\bhidden charges\b/i
describe HIDDEN_CHARGES		Talks about Hidden Charges

body GET_STARTED_NOW	        /\bget started (?-i:N)ow\b/i
describe GET_STARTED_NOW	Get Started Now

body FIN_FREE		        /\bfinancial(?:ly)? free/i
describe FIN_FREE 		Freedom of a financial nature

body FORWARD_LOOKING	        /\bcontains forward-looking statements\b/i
describe FORWARD_LOOKING	Stock Disclaimer Statement

body SATIS_GUAR	        	/\bsatisfaction .{0,9}g(?:ua|au)ranteed\b/i
describe SATIS_GUAR		Mail guarantees satisfaction

# Avoid an FP noted by NISHIJIMA Takanori: 'Japanese string sequence:
# "Su" "Ku" "Na"  "I" "Ko" "Su" "To" "De" "Yo" "Ri" ...
# (This string means, "More ...(ex. "productive" or "effective")
# with less cost", and is a popular phrase but have no relations
# with human growth hormone, of course. :-)
# Encoded byte sequence: "$9" "$/" "$J" "$$" "%3" "%9" "%H" "$G" "$h" "$j"'
# note FP:                                              ^^^^^^^^^^^^
body __HG_HORMONE		/\b(?:human growth hormone|(?-i:HGH)|H.G.H)\b/i
meta HG_HORMONE			(!__ISO_2022_JP_DELIM && __HG_HORMONE)
describe HG_HORMONE		Talks about hormones for human growth

body EXTRA_CASH		        /\bextra cash\b/i
describe EXTRA_CASH		Offers Extra Cash

body GET_PAID		        /\bget (?-i:P)aid\b/i
describe GET_PAID		Get Paid

body BEEN_TURNED_DOWN	        /\bbeen turned down\b/i
describe BEEN_TURNED_DOWN	Have you been turned down?

body ONE_TIME			/\bone\W+time (?:charge|investment|offer|promotion)/i
describe ONE_TIME		One Time Rip Off

body COMPETE		        /\bcompete for your business\b/i
describe COMPETE		Compete for your business

body NEW_CUSTOMER	        /\bnew customers only\b/i
describe NEW_CUSTOMER		New Customers Only

body MEET_SINGLES	        /\bmeet .{0,12}singles|thousands of personal/i
describe MEET_SINGLES		Meet Singles

body JOIN_MILLIONS	        /\bjoin (?:millions|thousands)\b/i
describe JOIN_MILLIONS		Join Millions of Americans

body BE_BOSS		        /\byour own boss\b/i
describe BE_BOSS		Be your own boss

body DIG_UP_INFO	        /\bdig up information\b/i
describe DIG_UP_INFO		Dig up Dirt on Friends

body ML_MARKETING	        /\b(?:MLM|multi.level.marketing)\b/i
describe ML_MARKETING		Multi Level Marketing mentioned

body NOT_ML_MARKETING		/\bnot (?:MLM|multi.level.marketing)\b/i
describe NOT_ML_MARKETING	Apparently, NOT Multi Level Marketing

body ITS_LEGAL                  /\b(?:perfectly|absolutely|100%|totally) legal\b/i
describe ITS_LEGAL              Claims to be Legal

body FREE_GRANT                 /\b(?:free|government) (?-i:G)rants?\b/i
describe FREE_GRANT             Free Grant Money

body CONFIDENTIAL_ORDER		/confidential.{0,9} order/i
describe CONFIDENTIAL_ORDER	Confidentiality on all orders

body HIDDEN_ASSETS              /hidden assets/i
describe HIDDEN_ASSETS          'Hidden' assets

body SAVE_THOUSANDS             /\bsave (?:thousands|millions)\b/i
describe SAVE_THOUSANDS         Save big money

body MARKETING_PARTNERS		/\b(?:marketing|network) partner|\bpartner (?:web)?site/i
describe MARKETING_PARTNERS	Claims you registered with a partner

# note the tense used, hopefully it won't hit FPs this way
body PRIORITY_MAIL              /\b[Aa]ll\b.{0,20}\b[Oo]rders\b.{1,20}\bPriority Mail\b/
describe PRIORITY_MAIL          Orders shipped by priority mail

body STOP_SNORING		/\bstop\s+snoring\b/i
describe STOP_SNORING		Contains "Stop Snoring"

body APPLY_FREE			/(?-i:F)ree (?-i:A)pplication|free application.{0,32}(?:today|minute|less than)/i
describe APPLY_FREE		Free Application

body APPLY_ONLINE               /\bapply (?-i:O)nline/i
describe APPLY_ONLINE           Apply online (with capital O)

body FREE_INSTALL               /(?-i:F)ree installation/i
describe FREE_INSTALL           Contains 'free installation' with capitals

body FREE_PREVIEW		/\bfree preview\b/i
describe FREE_PREVIEW		Free Preview

# http://www.hughes-family.org/bugzilla/show_bug.cgi?id=678
body DOMAIN_4U2                 /[\@\.]\S{0,20}(?:[^0-9][42](?:yo)?u|for-*you)(?:[.-]\S{1,20})?\.(?:net|com|org|info)\b/
describe DOMAIN_4U2             Domain name containing a "4u" variant

body FREE_ACCESS                /(?-i:F)ree access/i
describe FREE_ACCESS            Contains 'free access' with capitals

body FREE_SAMPLE                /(?-i:F)ree sample/i
describe FREE_SAMPLE            Contains 'free sample' with capitals

body LOW_PRICE                  /\blow.{0,4} (?-i:P)rice/i
describe LOW_PRICE              Lowest Price

body ONCE_IN_LIFETIME           /once in a lifetime opportunity/i
describe ONCE_IN_LIFETIME       Once in a lifetime, apparently
rawbody SAFEGUARD_NOTICE        /This safeguard is not inserted when using the registered version/s
describe SAFEGUARD_NOTICE       Contains signature of unregistered spam tool
body NO_MIDDLEMAN               /\bno middleman\b/i
describe NO_MIDDLEMAN           No Middleman
body UNCLAIMED_MONEY            /\bunclaimed (?:funds|money|prizes?|rewards?)\b/i
describe UNCLAIMED_MONEY        People just leave money laying around

body CHANGE_TERMS               /\bstrictly based on the following terms and conditions\b/i
describe CHANGE_TERMS           Terms and conditions

body NO_SELLING                 /absolutely NO selling/i
describe NO_SELLING             Claims not to be selling anything

body WEALTH                     /\bachieve .{0,15}wealth\b/i
describe WEALTH                 Achieve Wealth

body EARN_MONEY			/\b(?:earn|make|making|made|received?|discounted)\s+(?:up\s+to|as\s+much\s+as|over|at\s+least|a\s+full)?\s*\$\s*[0-9,]{2}/i
describe EARN_MONEY		Message talks about earning money

body OBSCURED_EMAIL		/\w+\^\S+\(\w{2,4}\b/
describe OBSCURED_EMAIL		Message seems to contain rot13ed address

body OUR_AFFILIATE_PARTNERS     /our affiliate partners/i
describe OUR_AFFILIATE_PARTNERS Mentions their affiliate partners

body OUR_STRICT_ANTI		/our strict anti/i
describe OUR_STRICT_ANTI	Mentions their strict antipathy on something

body BANG_BOSS        		/\bboss!/i
describe BANG_BOSS        	Talks about your boss with an exclamation!
body BANG_EXERCISE    		/\bexercis(?:e|er|es)!/i
describe BANG_EXERCISE    	Talks about exercise with an exclamation!
body BANG_MONEY      		/\bmoney!/i
describe BANG_MONEY      	Talks about money with an exclamation!
body BANG_MORE       		/\b(?-i:M)ore!/i
describe BANG_MORE       	Talks about more with an exclamation!
body BANG_OPRAH      		/\boprah!/i
describe BANG_OPRAH      	Talks about Oprah with an exclamation!
body BANG_QUOTE               	/\b(?-i:Q)uotes?\!/i
describe BANG_QUOTE            	Talks about quotes with an exclamation!

body INTL_DRIVERS_LICENSE	/international driver'?s license/i
describe INTL_DRIVERS_LICENSE	International driving license

body ACT_NOW_CAPS               /A(?i:ct) N(?i:ow)/
describe ACT_NOW_CAPS		Talks about 'acting now' with capitals
body START_NOW_CAPS             /S(?i:tart now)/
describe START_NOW_CAPS 	Talks about 'starting now' with capitals
body MORE_SEX               /increased?.{0,9}(?:sex|stamina)/i
describe MORE_SEX 		Talks about a bigger drive for sex

body BANG_GUAR	         	/\bguaranteed?\!/i
describe BANG_GUAR		Something is emphatically guaranteed

# seems to be inserted with s1618 rules VERY heavily
body WE_HATE_SPAM2		/\banti-spam policy\b/i
describe WE_HATE_SPAM2		Mailer is against spam -- aren't we all?

# similar to SAVE_UP_TO and SAVE_MONEY, but a little more generic
body	UP_TO_OR_MORES		/up to \S+(?: \S+)? or more/i
describe UP_TO_OR_MORES		Has generic 'up to X or more' noise

# Feb 18 2003 jm: another Nigerian scam phrase
body NIGERIAN_SCAM_VIRTUE	/by virtue of its nature as being utterly confidential/i
describe NIGERIAN_SCAM_VIRTUE	Possible Nigerian Scam Text

# Feb 18 2003 jm: try another combo.  I'm not sure __NIGERIAN_HONESTY is req'd.
body __NIGERIAN_CODE_CONDUCT	/\bcode of conduct\b/i
body __NIGERIAN_CIV_SERVICE	/\bcivil service\b/i
body __NIGERIAN_TOP_SECRET	/\btop secret\b/i
body __NIGERIAN_STRICT_CONF	/\b(?:strictest confidence|utmost secrecy)\b/i
body __NIGERIAN_HONESTY		/\btransparent honesty\b/i
body __NIGERIAN_DISBURSE	/\bdisburs/i
meta NIGERIAN_BODY_GOVT_3	((__NIGERIAN_CODE_CONDUCT + __NIGERIAN_CIV_SERVICE + __NIGERIAN_HONESTY + __NIGERIAN_TOP_SECRET + __NIGERIAN_STRICT_CONF + __NIGERIAN_DISBURSE) >= 3)
describe NIGERIAN_BODY_GOVT_3	Message body has many indications of Nigerian scam

# ho ho ho
body WALAA			/instructions and walaa\b/i
describe WALAA			Illiterate spammer cannot spell 'voila'

body SEE_FOR_YOURSELF		/See (?:for|it|it for) yourself\b/i
describe SEE_FOR_YOURSELF       See for yourself 
