Will ensure any email you restore from Recycle Bin will come through marked as good and not marked for delete. False 200 #FF1A19B3 White False False False All Header Contains PlainText Resent-From: MailWasher Pro Recycle Bin Header Contains PlainText Resent-From: "MailWasher Pro recycle bin" Header Contains PlainText Resent-From: MailWasher? Pro recycle bin Looks for messages that are not addressed to you on either the To or CC lines. You need to edit this to include all your own email addresses to use. False -100 #FFCC0098 White False False All To NotContain PlainText bob@test.com To NotContain PlainText bob.builder@test.com To NotContain PlainText bbuilder@test.com Blacklisted True -200 #FFCC0098 White True False All Blacklist Contains SpamToolMatch NACHA Fraud False -200 #FFCC0098 White True False All From Contains PlainText NACHA ACH Fruad True -200 #FFCC0098 White True False All EntireMessage Contains RegEx (?-i)\bACH\b Body Contains PlainText Transaction Body Contains RegEx Cancell?ed|rejected Body Contains RegEx financial\ (body|institution)|bank Body Contains PlainText Report Body Contains RegEx details\ in\ the\ attachment|nacha\.(org|net|us)/reports?/|(?-i)Transaction\ Report:? BBB Fraud False -200 #FFCC0098 White False False All From Contains PlainText ::Better Business Bureau:: From Contains PlainText @bbb.org Subject Contains PlainText BBB Case # Subject Contains PlainText Better Business Bureau Case # Body Contains PlainText The Better Business Bureau has been sent the above mentioned complaint from one of your clients Body Contains PlainText the consumer's concern is included in attached file Body Contains PlainText Business Bureau Council of Better Business Bureaus Body Contains RegEx The\ details\ of\ the\ consumer's\ (concern|complaint)\ are\ (explained|included)\ in\ (the\s)?attached\ file\. Body Contains RegEx Please\ (open|use)\ the\ link\ below\ to\ (re)?view\ the\ contents\ of\ the\ complaint: Wire Transfer Fraud True -200 #FFCC0098 White True False All Subject Contains RegEx Wire\ [tT]ransfer\ Body Contains RegEx Federal\ (Bank|Reserve) Body Contains RegEx Outgoing\ Wire\ transaction|by\ the\ other|Domestic\ Wire\ Transfer Tax Fraud True -200 #FFCC0098 White True False All Subject Contains RegEx ^Your\ Tax\ Payment\ ID\ [a-z0-9]{8}\ (has|is)\ failed Body Contains PlainText Your Federal Tax Payment ID Body Contains PlainText has been rejected Body Contains PlainText Return Reason Code R Body Contains PlainText The identification number used Body Contains PlainText is not valid Body Contains PlainText EFTPS Body Contains RegEx ^In (either|other) way forward information to your accountant adviser.$ Fake IRS Notice True -200 #FFCC0098 White True False All From Contains PlainText @irs.gov Subject Contains PlainText Tax Received NotContain PlainText .irs.gov Body Contains PlainText We are unable to process your tax return Exploit Link False -200 #FFCC0098 White False False All Body Contains RegEx (?-i)http://[a-z0-9-]+\.[a-z]{2,4}/.+\.html?\?[A-Z0-9=&]+= Body Contains RegEx (?-i)http://[a-z0-9-]+\.[a-z]{2,4}(\.[a-z]{2,4})?/.+\.html?\?[A-Z0-9=&]+= Body Contains RegEx (?-i)/[a-z0-9]+\.htm\?[A-Z0-9]{4,6}=[A-z0-9&=]+= Fake Facebook Friend Request True -200 #FFCC0098 White True False All Subject Contains PlainText wants to be friends on Facebook From Contains PlainText @facebookmail.com Header NotContain PlainText Received: from mx-out.facebook.com Body Contains PlainText Confirm Friend Request Body NotContain PlainText http://www.facebook.com/n/?reqs.php Exploit Link False -200 #FFFFCC00 Black True False All Body Contains PlainText /arc/file/"> Body Contains PlainText HELLO!,Is This Your Photo?link Body Contains PlainText some jerk has posted your pictures Body Contains PlainText and sent a link of them to all ur friends Body Contains PlainText Please read the attachment to get the message Body Contains PlainText Please read the attachment.</A> Body Contains PlainText have attached your document.</A> Body Contains PlainText /viewmovie.html Body Contains RegEx .(avi|mpg).exe'> Body Contains RegEx /(ecard|install|msvideoc)\.exe('>)? Body Contains RegEx /(best|index1|up)(\.|=2E)php' Body Contains RegEx (?-s)^Content-Transfer-Encoding:\ quoted-printable\r\n\r\n^.+http://.+/.+\.html$\r\n^------=_NextPart_ Body Contains RegEx http://.+/(begin|checkit|default|first|fresh|index1|gowatch|live(streaming)?|lol|main|news|r|showvideo|start|stream(ing)?|topnews|up|viewmovie|watch|watchit|whatsup|1)\.html(</a> )?(\r\n)? Body Contains RegEx \.pdf\.exe</a> Body Contains PlainText waiting to be downloaded at sendspace Known Spam Subjects False -200 #FFCC0098 White True False All Subject Contains PlainText Product Recommended by Subject Contains PlainText new In town Subject Is PlainText Alone Subject Is PlainText Uniform traffic ticket Subject Contains PlainText FDIC notification Subject Contains PlainText Scan from a Xerox W Known Spam [F] False -200 #FFCC0098 White True False All Header Contains PlainText HOTSINGLESNET.NET Header Contains PlainText From: 'USA Government Center' Header Contains RegEx (^From:\s{1,3}'?(Mr\.?\ Song\ Li|ph[ra]{2}macy|(?-i)E-STORE|\{|\}|'=\?ISO-8859-1\?Q\?)) Header Contains PlainText From: =?UTF-8?Q?=C2= Header Contains RegEx ^(?-i)IME-Version:\ 1\.0$ From Contains RegEx CanadianPharm|Rx\ The\ Best\ Source|SENATOR\ DAVID\ MARK|SexBoosters|hard.{1}on From Contains RegEx MensHealth\.com|Extenze|Try\s?[1i]t\s?4Free|TheDR|Max-?Man|Facebook\ Manager|sexual|iContact|Pharmacy.?Online|Online.?Pharmacy|Medical|Vicodin|Drugs|penile|Potency|Sex|Pharm|Pill.?store|(?-i)ANGEL From Contains PlainText Software Sale From Contains PlainText OEM Software From Contains PlainText Easy-E-Cards-Online From Contains PlainText Rock Cruit Ukrainian spam domain False -200 #FFCC0098 White True False All Body Contains RegEx http://[a-z0-9\._-]{3,}\.com\.ua/ False -200 #FFCC0098 White True False All From Contains RegEx Doctor|Restricted|\bRx|Meds|M3ds|Medd[sz]|Medz|V[i1l|]c[o0]d[i1l|]n|Perc[o0]cet|Phh?aa?rr?mm?a Subject Contains PlainText EMS Delivery Subject Contains PlainText without a prescription Subject Contains PlainText No Prescription required Subject Contains RegEx Adderall?|ADIPEX|Avandia|CODEINE|HYDROCODONE|KLONOPIN|Oxycontin|Phentermine|Perco[cs]e.?t|Rit[ai]lin|Tramadol|Valiu[mn]|Vicodin?|XANAX Body Contains PlainText rxrefill.com Body Contains PlainText No RX required! Body Contains PlainText no prescription needed Body Contains PlainText medications available without a prescr Body Contains PlainText http://health.groups.yahoo.com/group/ Body Contains RegEx (?-i)Codeine|Valium|Vicodin|Percocet|Phentermine|Ritalin Cialis False -200 #FFCC0098 White True False All Subject Contains PlainText Cialis Subject Contains RegEx C[I|i|1|y].?[A|@].?L[i|1]{1,2}.?[S$]|(?-i)Ca[iy]lis|(?-i)Cy[al][al]is Body Contains RegEx \b(?-i)Cialis\W Body Contains RegEx C\\Ialis|C1A.LIS|tadalafil|\bCalis\b Body Contains RegEx C\s(/|1|I)\sA\s(L|I|1)\s(/|I|1)\s(S|\$) Viagra Spam False -200 #FFCC0098 White True False All From Contains PlainText Pfizer From Contains PlainText viagra.com From Contains PlainText Free To Try From Contains PlainText sex remedies From Contains PlainText ® Official Site From Contains RegEx Erectile|Erection|\bP[i1l]lls\b|(Potency|Sex)\s?Tablets|(Anti.?)?(?-i)ED\b|[Aa]nti-ed From Contains RegEx VI[A@]G®A|V[I1|]AGR[A@]|Viag.?ra|Vi.gra|Vigara|viagar|ivagra|v[ia]{2}gra|v[iy]arga|V_I_A_G_R_A|Impotence|sexual\ health From Contains RegEx Cii?aa?lis|Cia1is|C1alis|^i?Ci?a.?li?s\b|Levitra Viagra Spam False -200 #FFCC0098 White False False All Subject Contains PlainText Always be ready. Subject Contains PlainText impotenc Subject Contains PlainText se>.< Subject Contains PlainText dysfunction Subject Contains PlainText $_e'xual Subject Contains RegEx (blue|love).?pills?\b Subject Is PlainText Be ready. Subject Contains RegEx \b(ciali[a-z]|levitra|viagra|VIGARA|Pfizer|^Pending\ delivery)\b|(?-i)C[i1]al[i1]s|Kamagra Subject Contains RegEx (?-i)ED[_\s]dysfunction|\sED\.|[Aa]nti-ED Subject Contains RegEx (?-i)Online\ V[a-z1]{1,4}A\ Store Subject Contains RegEx ^user\ .+brand\ \d\d%\ Off\ Sale Subject Contains PlainText success stories about V Subject Contains RegEx personal\ \d\d%\ dis[cs]ount Viagra Spam False -150 #FFCC0098 White False False All Subject Contains PlainText on Pfizer Subject Contains PlainText Re: Please, placce you order now Subject Contains PlainText Re: Please, conflrm you receipt Subject Contains RegEx Hey,?\ [a-z0-9]+,?\ get\ percent [0O]FF Subject Contains RegEx .+\d\d% (off\s)?only\ for\ you Subject Contains RegEx .+Catch\ \d\d%\ discounts\ [a-z]+ Subject Contains RegEx ^Your\ Order\ Status\ ID:\ [A-Z]{11,} Subject Contains RegEx ^Visitor\ .+'s\ personal\ \d\d%\ OFF$ Subject Contains RegEx ^User\ .+\ save\ \d\d%\ now Subject Contains RegEx ^Hello,\ [a-z0-9]{3,}.?\ \d\d%\ off\ till?\ [A-Z][a-z]{3,8}\ [a-z]{3,} Subject Contains RegEx ^(RE:\ )?(January|February|March|April|May|June|July|August|September|October|November|December)\ \d\d%\ OFF\s?$ Viagra Spam False -200 #FFCC0098 White False False All Body Contains PlainText Viagra! Body Contains PlainText VIAGQRA Body Contains PlainText Viagra Professional Body Contains PlainText Best Price for VIAGRA Body Contains RegEx \b(Erectifix|erectile\ dysfunction|(?-i)anti-ED|(?-i)cure\ ED|(im)?potence|ED\ treatment)\b Body Contains PlainText Taste the V Body Contains PlainText V-letter remedy Body Contains RegEx blue.?pill?|SoftTabs|\$1\.\d\d/pill\b Body Contains RegEx (?-i)Vi?<span\ style='FONT-SIZE:\ 2px;\ FLOAT:\ right;\ COLOR:\ white'> Body Contains RegEx ViaGrow|viiagra|Vagria|Vgaira|Pfizer|Kamagra Body Contains RegEx (Buy|order|original|with)\ .*Viagra Body Contains RegEx Viagra\s{1,3}tabs|Viagra.+\$\d Body Contains RegEx <a\ href=.+>.*viagra.*</a> Body Contains RegEx bring\ back\ fire\ and\ passion|make\ (luv|love)\ all\ night|endless\ climaxes|your\ xxx\ drive|sexual\ health|\bmale problems?\b Viagra Spam False -150 #FFCC0098 White False False All EntireMessage Contains PlainText Viagra Viagra Spam False -200 #FFCC0098 White True False All Subject Contains PlainText VIAG*RA Subject Contains RegEx V\lsAGRA|VIAGQRA|VAIGRA|Vyagra|Vgaira|V\|AGRA|[vw]iag.?row Subject Contains RegEx (?-i)Vlagrxa|Viagr.a|Viagr\d|Vi\dgra Subject Contains RegEx ^V.{4,6}a\s\d\d\s?mg Subject Contains RegEx (V|\\/|/)[i|l!1]agr[a@] Subject Contains RegEx \bv.i.a.g.r.a\b Subject Contains RegEx (?-i)V[iy]a(rga|gar|gra) Header Contains RegEx Subject:.+\bV[i1!l|]AGRA\b.+ Subject Contains RegEx viaq[ij]ra Male Enhancement False -200 #FFCC0098 White True False All From Contains RegEx Penis|Enlarge(r|ment) Male Enhancement False -200 #FFCC0098 White True False All Subject Contains RegEx (?-i)Mega\s?(Dik|size)|E?Xtra\s?size|Manster|MaxGentleman|Max.?[mM]an\b|Sizeable|VPXL Subject Contains RegEx Gains?\ (up\ to\ )?(\d\+?\s)?(inches\ )?in\ (girth|length|size)|Gaining\ inches Subject Contains RegEx (big(ger|gest)?|fuck|hard(er)?|gigantic|love|man)\s(pecker|pole|rod|sausage|stick|tool|weapon) Subject Contains RegEx (get|grow)\ (a\s)?bigger|sc?h[l1][o0]ng|love\ muscle|your\ small\ (di.?k|stick)|your\ little\s Subject Contains RegEx elongate|enhancement|en[l|1]a?rge(d|ment)|Enlarge,\ Widen\ and\ Strengthen|enlarge\ and\ lengthen|enlarge\syour|(Enlarge|Super-Size)\ It|Upsize\ your\ D[il]C?'?K Subject Contains RegEx (bat|bulge|monster|python|rocket|snake)\ in\ your\s{0,3}(pants|pocket|trousers)|trouser\ snake|giant\ bulge Subject Contains RegEx Longer\ Harder\ Thicker|(harder|thicker)\ and\ longer|long(er)?\ and\ thick(er)?|thicker\ shaft|\b(bigger|harder|larger|thicker|your)\ (?-i)(PE)\b Subject Contains RegEx (longest|your)\ device\b|short(er)?\s?Penis|Peni[l1]e|pen.?[i1l!]s\b|p[e3]nis|pen-nis|p\ e\ n\ [i1l]\ s|\bp[aei3]nis\b Subject Contains RegEx add\ (\d\s)?inche?s|\d\ inn?cc?hes|girth,?\s( and\s)?(length|lenght)|(length|lenght)\ and\ (girth|thickness)|thickness\ (a[nd][dn])\ length Subject Contains RegEx Bring\ her\ to\ seventh\ heaven|huge\s?(dic'?k|dignity|package)|problems?\swith\ssize|size\ (really\s)?(does\s)?matters?|I've\ gained\ an\ inch|your\ dic?'?k\ size|rock\ hard|Impress\ .*wom[ae]n Subject Contains RegEx your\s?(male\ p[a@]ck[a@]ge|copulation|lovetoy|manhood|manliness|masculinity|(new|your)\ (tool|rod|size|weener|willy))|Bodypart|(giant|gigantic|male|man|pocket)\ tool|manly|Masculine|lovemaking|penetrate Subject Contains RegEx boner|blue\ balls|c[o0]ck|\bcum\b|\bdong\b|ejaculat(e|ion|ory)|ejauclation|Erectile|Erection|flaccid|foreplay|\bpeckers?\b|phall(i|us)?|prick|sex(ual)?|s'e[^a-z]?x|s'e_xual|\$e><|(?-i)d1ck|dic'?k Male Enhancement False -200 #FFCC0098 White False False All Body Contains PlainText Extra inches gives Body Contains PlainText Natural Male Enhancement Body Contains PlainText enhance your male drive Body Contains PlainText Increase your organ size Body Contains PlainText your manhood Body Contains PlainText PE forum Body Contains PlainText male enhancement products Body Contains RegEx Penis\s?En(hance|large)ment|Flaccid(ity)? Body Contains RegEx en(hanc|larg)ement\s?(formula|method|pills|suppliment) Body Contains RegEx (their|your)\ (enlarged|huge)\ (organ|package|prick|shaft) Body Contains RegEx Magnum.?Pro|ManSter|Man[\s-]XL|Max[gG]ain(\+|Plus)|MaxGentleman|maxx?.?man|Megadik|PowerEnlarge|VPXL|Xtrasize\s?(\+|Plus) Watches False -200 #FFCC0098 White True False All From Contains RegEx R[o0][l1]exx?|Rep[l1]icas|Watches|(Luxury|Replica)\ watch|Luxurious Subject Is PlainText Luxury Subject Contains PlainText //atches Subject Contains PlainText \/\/ATCHES Subject Contains RegEx \bHERMES\b|\bWa.ches\b|Wat4ch|Submariner\ SS|(replica|Rolex|swiss|vip)\ watches|w\.a\.t\.c\.h\.e\.s|\ba\ watch\b|(designer|Swiss)\ watch|watch\ brands Subject Contains RegEx \b(R[0olex\.]{8,}|R[o0][lI1]ex|Re4plica|r,?eplicas?|r\.{1,3}e\.{1,3}p\.{1,3}.l\.{1,3}i\.{1,3}c\.{1,3}a\.{1,3}|watches|chronometers|timepieces?|time\ control)\b Body Contains RegEx (luxury|luxurious|new)\ (replica|watch)|famous\ watch\ manufacturer Body Contains PlainText brand name watch Body Contains PlainText We only sell premium watches. Body Contains PlainText exact copies of the original watches Body Contains PlainText Detailed replicas of best chronometers by the best brands Body Contains PlainText put one of these on your xmas list, you will fall in love with them all Body Contains RegEx copies\ of\ [a-z]{5,}\ watch|Rolex|Rollie|\ replicas\b|Submariner\ SS|replica\ watches|//atches|chronometers?|timepieces?|flashy\ bling|expensive\ watch|fashion\ pieces Body Contains PlainText bling.com Counterfeit Goods False -200 #FFCC0098 White False False All From Contains RegEx Gucci|Luxury Subject Contains RegEx des1gner|designer\s(brands|footwear|shoes)|modish Subject Contains RegEx \b(gucci|prada|chanel|chloe|dior|(?-i)UGG|Vertu)\b Subject Contains PlainText repl!c@ Subject Contains RegEx Cartier|Gucci|Versace|KN[0O]CK.?[0O]FFS Subject Contains RegEx (?-i)SHOES|\bBling\b Subject Contains RegEx luxury\ (brands|footwear|needs)|looking\ classy Subject Contains RegEx Branded\ (footwear|shoes) Subject Contains PlainText Clad your feet Body Contains PlainText ~ Gucci Body Contains RegEx Knock.?[O0]ffs|^Luxury\ blowout\ sale|(?-i)\sLux\s Body Contains RegEx (?-i)Vertu\s.{3,14}phones\s Casino Spam False -200 #FFCC0098 White False False All From Contains RegEx (?-i)[Gg]ambl(e|ing)|Casino|Casnio|Cazino|Club.?VIP|CVC\s?Support Subject Is PlainText VIP Subject Contains PlainText YOU play we PAY Subject Contains PlainText no-deposit bonus Subject Contains PlainText Sign up & collect $500! Subject Contains RegEx [''\*s\_-]?(Cas[i1]n[o0]s?|club\s?world|No\ Deposit\ Required|Gambling|online\ games|roulette|black.?jack|\bcraps|poker|slot\ machines|video\ slots?|win\ money)[''\*s\_-]?|\d{3,4}\sGratuits Body Contains PlainText 777$ Body Contains PlainText 777USD Body Contains PlainText Gâmës Body Contains PlainText the velvet ropes Body Contains PlainText Play at our club Body Contains PlainText free gaming money Body Contains PlainText Sign up & collect $500! Body Contains RegEx Club.?VIP Body Contains RegEx Games\ Online|Online\ Gambling Body Contains RegEx \b(poker|jackpot)|poker\ blackjack\ slots\b Body Contains RegEx Gambling\s{1,2}(chips|credit|from\ home|online) Body Contains RegEx (Big\ Dollars?|Free|Golden\ Gate|online|no\ deposit|the|World)\ Casino|casino\.com/ Body Contains RegEx Club\s?World|casino\ (classics|games|members)|(Bet|Gamble)\s{1,2}On\s{0,2}(line|credit)|^\s{1,2}Win\s{1,2}\$ Pharmaceuticals True -200 #FFCC0098 White False False All EntireMessage Contains PlainText Pharmacy Body Contains RegEx http://(www\.)?(.+\.r[uo]/|.+\.r[uo]\b|.+\.ua) Pharmaceuticals False -200 #FFCC0098 White True False All Subject Contains PlainText MensHealt Subject Contains PlainText RE: MedHelp Subject Contains PlainText OFFICIAL SITE Subject Contains PlainText Enhance your life with these products Subject Contains RegEx \b(?-i)(FDA|Doctor)\ Approved Subject Contains RegEx Phramacy|Pharmaceutical|Pharmacy|pharmas|apothecary|(?-i)RX Subject Contains RegEx no\ (pres|pers?)cription|(pres|pers?)cription\ not Subject Contains RegEx \bPhar|P.?ha.{0,2}rmacy\b Subject Contains RegEx med[il|1]c(al|ations?|ines?)|\bm3ds|medds|medzz?\b|(order|purchase|your)\smeds|drug.?store|usa.?drug Subject Contains RegEx PH.*[A@(/\)]RM[A@(/\)] Subject Contains RegEx health supersite Subject Contains RegEx ^discreet\ (delivery|packing|shipping)|worldwide\ delivery Subject Contains RegEx save\ \d\d%\ on\ your\ (medic|meds|pharma|pills)|\d\d%\sdiscount\.\sCode\s#[a-z0-9]{4,8}|\d\d%\ personal\ discount Subject Contains PlainText Buy Meds Subject Contains RegEx Canadian\ Health.*Care\ Mall Pharmaceuticals False -150 #FFCC0098 White False False All Body Contains PlainText PHARMACY Body Contains RegEx (high.quality|prescription)\ medications Body Contains PlainText »»» Body Contains PlainText alt=3D'HUGE Discount Body Contains PlainText Then I found this link and my life started changing for the better Body Contains PlainText We are offering you the latest medical achievements. Body Contains PlainText used to sleep in separate rooms Body Contains PlainText that's when my problems in bed began Body Contains PlainText delivered discreetly Body Contains PlainText but the results exceeded our expectations. Body Contains PlainText due to intimate problems Body Contains RegEx ON.?li[nm]e\ pharmacy|pharmacy\ club Body Contains RegEx Prescription\ drugs\s{1,}without a prescription Pharmaceuticals False -200 #FFCC0098 White True False All Body Contains PlainText DRUG Body Contains PlainText DRUGS Body Contains PlainText Drugstore Pills Spam False -100 #FFCC0098 White False False All Subject Contains PlainText P|\\S Subject Contains PlainText pills Subject Contains RegEx BE$T|PILL.?S|Plills|p[i1l|!][1l|!]{2,3}s|pill\ that\ (.*)?works|Pilules|\bPILZ\b Subject Contains PlainText MEDS Subject Contains PlainText generic Body Contains RegEx generics|pillstore|pillz|\bmeds\b Body Contains RegEx (boost|our|these)\s{1,3}pills Body Contains RegEx \b(buy|cheap|herbal|wonder)\ (drugs|pills|remed(y|ies)|solutions?)\b|pills\ at\ (dirt\s|the\s)?cheap(est)?\ prices?|medicines|your\ prescriptions Body Contains RegEx ^http://.*(medshop|pills).*\.com Body Contains RegEx ^<a\ href=(3D)?'http://.*pharmacy.*\.com'> Software Spam False -200 #FFCC0098 White False False All Subject Contains PlainText software outlet Subject Contains RegEx Buy.?Software|SoftwareDiscounts Subject Contains RegEx ^[Ss]oftware$ Subject Contains RegEx Eurosoft|(best|cheap(est)?|downloadable|oem|office|popular|quality).*s[o0]ft(wares?)?|Soft(ware)?\ in\ many\ languages|software\ at\ (amazingly|surprisingly)\ low\ prices|perfectly\ working\ software|software\ you\ need|software\ immediately\ after\ purchase|ado6e|Vista\ Microsoft\ SP1\ and\ XP\ Cracked|Office\ (Enterprise\ 200[789]|200[789]\ Enterprise)|(?-i)(Access|Communicator|PowerPoint)\ 200[789]|Auto([cC]ad|desk)\ 200[789]|OEM\ full\ version\ download|Microsoft,\ Adobe\ and\ many\ other\ software\ brands|purchase\ any\ software\ you\ want|look\ at\ our\ prices\ for\ Adobe\ \w|100%\ workable\ software|\$oftware|software\ price\$|(?-i)^_Buy\ And\ Download Subject Contains RegEx Windows\ 7.+Office\ 201\d.+Adobe CS\d Courier Scam True -100 #FFCC0098 White False False All Subject Contains RegEx (?-i)^(DHL|UPS)\ (?i)Delivery\ Problem|Services Body Contains RegEx we\ (failed|were\ not\ able)\ to\ deliver\ (the\ |your\ )?(postal\ )?package Body Contains PlainText print out the invoice Body Contains PlainText Content-Disposition: attachment; Courier Scam True -100 #FFCC0098 White False False All Subject Contains RegEx (?-i)Confirm\ Your\ UPS\ Parcel\ Delivery|UPS\ (Tracking\ (Number|#)|Package\ [A-Z]\d{8,}) Header NotContain RegEx ^Received:\ from\ [a-z0-9]+\.?ups\.com Courier Scam True -100 #FFCC0098 White False False All Subject Contains RegEx (?-i)DHL|FedEx Subject Contains RegEx get\ (a|your)\ parcel|(?-i)Tracking\ (NR|Number)\ \d{8,}|Error\ in\ delivery\ addres Body Contains RegEx ((our|The)\ (courier|postal)\ service\ was)|(we\ were)\ (not\ |un)able\ to\ deliver\s Body Contains RegEx Print\ this\ label\ |print\ and\ fill\ attached\ document|The\ postal\ label\ is\ attached Body Contains PlainText Content-Disposition: attachment; From Contains RegEx Director|Manager|Postal|DHL|FedEx Courier Scam False -100 #FFCC0098 White False False All Subject Contains PlainText DELIVER CONFIRMATION - FAILED Subject Contains RegEx (Delivery\ Problem|UPS\ INVOICE) NR\d{6,8}\. From Contains PlainText Fedex Manager, Courier Scam True -100 #FFCC0098 White False False All From Contains PlainText UPS Subject Contains PlainText UPS Header Contains PlainText X-Mailer: The Bat! Body Contains PlainText unable to deliver Body Contains PlainText print Body Contains PlainText mailing label Body Contains PlainText Content-Disposition: attachment; Courier Scam True -200 #FFCC0098 White True False False All Subject Contains PlainText DHL notification Body Contains PlainText Dear customer Body Contains PlainText The parcel was send your home address Body Contains PlainText will arrice within 7 bussness day Body Contains PlainText attached in document below Courier Scam True -200 #FFCC0098 White False False All From Contains RegEx (DHL|United)\ (Global|Parcel)|Express|(info|support)\.?\d{1,2}@ups.com Subject Contains RegEx ^(?-i)(DHL|United\ Parcel)\ (Express\s)?Services?|Express\ delivery|UPS Body Contains RegEx The\ parcel\ was\ sent\ (to\ )?your\ home\ add?ress? Body Contains RegEx it\ will\ arrive\ within\ \d{1,2}\ business\ day Body Contains PlainText attached in document below Courier Scam False -200 #FFCC0098 White True False All Subject Contains PlainText USPS Delivery Failure Notification Subject Contains PlainText United Postal Service Body Contains PlainText Unfortunately we failed to deliver the postal package Body Contains PlainText Please print out the shipment label attached and collect the package at our office. Body Contains PlainText filename="USPS report.zip" Courier Scam True -200 #FFCC0098 White False False All From Contains RegEx Post Express Subject Contains PlainText Post Express Subject Contains RegEx (?-i)\bNR\b|Number Body Contains PlainText Your package has been returned Body Contains PlainText print Body Contains PlainText mailing label Body Contains PlainText Attached Body Contains PlainText Post Express Body Contains PlainText Content-Disposition: attachment; 419 Scam True -100 #FFCC0098 White False False All Subject Contains PlainText URGENT Subject Contains PlainText AND Subject Contains PlainText CONFIDENTIAL 419 Scam True -100 #FFCC0098 White False False All Subject Contains RegEx (?-i)^URGENT|CONFIDENTIAL Subject Contains PlainText BUSINESS Subject Contains RegEx (?-i)PROPOSAL|RELATIONSHIP 419 Scam False -200 #FFCC0098 White False False All From Contains RegEx (?-i)ARTHUR\ GUINNESS|BARRISTER|TRANSFER|Business\ Proposal|Micheal\ A\.\s?Potter|$ESQ$ Header Contains RegEx ^Reply-To:\s.+<?.+@yahoo.com\.hk>?$|thwala Subject Is PlainText BUSINESS Subject Is PlainText URGENT BUSINESS Subject Contains PlainText Oil license Subject Contains PlainText kindly get back to me urgently Subject Contains PlainText KINDLY OPEN THE ATTACHED FILE AND GET BACK TO ME Subject Contains PlainText kindly reply/call me Subject Contains PlainText Atten: Friend, Subject Contains RegEx (?-i)(^CONTACT\ (\w*\s)?(COURIER\ COMPANY|ATM\ DEPARTMENT)) Subject Contains RegEx (?-i)TREAT\ (AS|VERY)\ (CONFIDENTIAL|URGENT)|(EMINENTLY|STRICTLY|URGENTLY)\ CONFIDENTIAL|CONFIDENTIALITY\ AND\ TRUST Subject Contains RegEx UNITEDN\ NATION|Director,\ United\ Nations Subject Contains RegEx ^Dear\ Friend$|Urgent\ Proposal|Business\ letter\ from Subject Contains PlainText FUND TRANSFER Subject Contains PlainText From Barrister Subject Contains RegEx ^(From\s)(?-i)Mrs?[,\.]?\s?[A-Z][a-z]{2,}\s[A-Z][a-z]{1,} 419 Scam True -100 #FFCC0098 White False False All Body Contains RegEx ^(Kind\s)?Atte?n:|ATTENTION Body Contains RegEx Beneficiary|(My\ )?Dear\ (GOOD\s)?(Beloved|Friend) 419 Scam False -100 #FFCC0098 White False False All Body Contains PlainText contacting you based on Trust Body Contains RegEx ^Hello,\ I.{0,2}m\ Sgt\. Body Contains RegEx ^(?-i)\*?(Dear\ (Sir/Madam|Friend\b)|Complement\ of\ the\ day) Body Contains PlainText I need your urgent assistance in transferring Body Contains PlainText Waiting to hear from you soonest Body Contains RegEx unclaimed\ (benefits|funds) Body Contains RegEx (I\ am|My\ name\ is)\ Barrister|^Barrister.+ESQ$|(?-i)Barrister\ [A-Z][a-z]{2,}\ [A-Z][a-z]{2,} Body Contains RegEx ^Best\sregards.?\r\nBarr\..?[A-Z] Body Contains RegEx ^Mr\.\ \w{3,}\ \w{3,}\ $Barrister$ Body Contains PlainText your utmost confidentiality in this matter 419 Scam False -100 #FFCC0098 White False False All Body Contains RegEx Business\ proposal\ valued\ at|(?-i)(CONFIDENTIAL\s)?(MUTUAL\s)?BUSINESS\ (PROPOSAL|PARTNERSHIP|RELATIONSHIP?)|URGENT\ AND\ CONFIDENTIAL Body Contains RegEx Bank\ (of\ )?(Nigeria|Benin|(South\s)?Africa)|Benin\ Republic|Republic\ of\ Benin|Director,\ United\ Nations|REPUBLIC\ OF\ NIGERIA Body Contains RegEx beneficiary|no\ Beneficiaries|demurrage|dumourage|duemorrage|Clearance\ Certificate\ (\r\n)?Fee|keeping\ fees|(?-i)IMMEDIATE\ RELEASE\ OF\ YOUR\ PAYMENT Body Contains RegEx \{[a-z]{3,8}\sMillion\s[a-z-]{3,6}\sHundred\sThousand\sDollars} Body Contains PlainText I am Mr. Patrick Chan Body Contains PlainText Compliment of the day to you Body Contains RegEx (?-i)\bNIGERIAN?\b Body Contains PlainText (Esq. Nigerian 419 Scam True -100 #FFCC0098 White False False All Body Contains PlainText @rediffmail.com Lottery Scam False -100 #FFCC0098 White False False All Subject Contains RegEx Your\ Email\s(Address\s)?Has\ Won Subject Contains RegEx WINNING\ (Notification|NUMBER:)|ticket\ number\ $.+$|(?-i)COCA\ COLA.?TOBACCO\ COMPANY|(?-I)OFFICIAL\ PRIZE\ NOTIFICATION Subject Contains PlainText Lottery Subject Contains PlainText GO FOR CLAIM VERIFICATION FORM From Contains RegEx \bLotto\b|Lottery\ Notification|International\ lottery|(?-i)LOTTERY|NOTIFICATION\ DRAW|DRAW\ 201\d From Contains RegEx coca.?cola.*promm?o|Microsoft\ Award\ Department|Department\ of\ National\ Lotteries|Superenalotto|WORLD\ CUP|your\ email\ (address|id)\ has\ (won|been\ selected) Body Contains PlainText Attn: Lucky Winner Body Contains PlainText DEAR WINNER Body Contains PlainText YOUR E-MAIL ADDRESS WON Body Contains PlainText please contact your fudiciary agent Body Contains PlainText International Program Online Co-ordinator Body Contains RegEx (?-i)WINNING\ NUMBER:|LOTTERY|RE:\ LOTTO|Lottery\ Coordinator|your\ email\ (ID|identity)\ has\ won Body Contains RegEx (jackpot|International|ExxonMobil|Microsoft|National)\ (Award|Lottery)|Freelotto|fiduciary|The\ Kings\ Charity|weekly\ sweepstakes Body Contains RegEx You\ are\ advised\ to\ keep\ this\ winning\ (.+\s)?confidential From Contains PlainText AFRICA Money Mule Scam False -200 #FFCC0098 White True False All Subject Contains PlainText Your Job Application Status Subject Contains RegEx Update\ on\ available\ .+positions Subject Contains PlainText We are searching for partners in USA Body Contains RegEx [a-z0-9]+@((jobsearchoo|newstatejob|usanewjobgov)\.com|europcareers\.net) Body Contains PlainText EMPLOYER SNAPSHOT Body Contains PlainText VACANCY CODE: Body Contains PlainText An at home Key Account Manager Position Body Contains PlainText An import export company seeks remote employees in United States. Body Contains PlainText Being foreign company makes it harder to manage sales transactions with US customers Body Contains PlainText The main duties include receiving and making payments on client's behalf Body Contains PlainText managing the preparation and distribution for expected transactions Body Contains PlainText (at the beginning of work) to 5-7 (after the first probation month) Body Contains PlainText All banking, Western Union and cell phone expenses covered Body Contains PlainText This position is for US residents only, please no applicants from other countries. Body Contains RegEx ^The pay (range|rate) for [a-z]{3,10} options range from \$35\.77 .+ to \$57\.62 .{2,4} (hr|hour).\s? Body Contains RegEx (?-i)Rock\s?[a-zA-z]{4,8}\s?Management Work At Home Scam False -200 #FFCC0098 White True False All Body Contains PlainText Rock Cruit Management Body Contains PlainText everybody thats got access to a computer will be able to perform this job Body Contains PlainText thank me later Body Contains PlainText online based job Body Contains PlainText working from home! Body Contains PlainText Work from the house Body Contains PlainText make money at home Body Contains PlainText at home on the computer! Body Contains PlainText every 5 days from home Body Contains PlainText You will love me for this! Body Contains PlainText You will thank me for this! Body Contains PlainText Don't forget to thank me for this! Body Contains PlainText who needs a 9-5 when you got this program Body Contains PlainText its the greatest thing that's hapened to us all year Body Contains PlainText anyone who wants to work in the comfort of their own home Body Contains PlainText I had finally hit rock bottom Body Contains PlainText I finally made a life changing decision Body Contains PlainText I had reached the end of the line Body Contains PlainText I was able to regain my independence using this Work At Home Scam False -200 #FFCC0098 White True False All From Contains PlainText W0RK FROM H0ME Subject Contains PlainText Work from home Subject Contains RegEx Work(ing)?\ (at\From)\ Home|Career\ (Finders|Hunters?) Body Contains RegEx (?-i)News\ Channel.?\d{1,2} Body Contains RegEx Don'?t\ forget\ to\ thank\ me Body Contains RegEx http://www\.mynbcnews11\.com/|3Dcnbc7(\.[a-z]{2,4})?&btnI=3D1 Body Contains RegEx >(?-i)(Channel\ \d{1,2}\ )?(Career\ (Guide|News|Trends)|News\ [Dd]aily|Daily\ News|http://(localnews|newsbreaking)\d\d\.com).{0,3}</[aA]> Body Contains RegEx ^[iI]\ (just\s)?(earned|made|netted|profited|pulled(\ in)?)\ \$?\d{3,4}\$?\ in\ (\d\ days|less\ th[ae]n\ a\ day|a\ few\ (days|hours)|a\ couple\ (of\ )?hours) Body Contains RegEx (Here'?s\ how|It's\ all\ because\ of)\ -(\s|=\r\n\s)<a\ href=(3D)?"h.*t.*t.*p://(goo\.gl|[tx]\.co)/.{5,8}"> Russian Bride Scam False -200 #FFCC0098 White True False All Subject Contains RegEx \ ru\ girls?|\d\d\s?y\.o\..*\sRussia Body Contains PlainText .ru>Marriage Agency</a> Body Contains PlainText a pretty Ukrainian lady Body Contains PlainText international marriage site Body Contains PlainText Look at this girl who wants to get married Body Contains RegEx ^http://date[a-z]{4,8}\.ru/ Dating Spam False -100 #FFCC0098 White True False All Subject Is PlainText Personal Invite Subject Contains PlainText (status-online) Subject Contains RegEx \bdating\b|single.?ladies|Married.{1,5}lonely Subject Contains RegEx Russian\ (beauties|girls?|hotties?|lad(ies|y)|wife|wives|wom[ae]n)|from\ [Rr]ussia Subject Contains RegEx ^Hi\ remember\ me\?|we\ fucked|blonde?\ and\ cute|(?-i)^[A-Z][a-z]{4,7}\s\d\d\s?y\.o[\.,]\s Subject Contains RegEx (?-i)Add\ Me|Find\ Someone|meet\ a\ beautiful\ girl|Meet\ that\ special\ someone|Looking\ for\ love\b Subject Contains RegEx Unread\ message\ from\ ~[A-Z][a-z]{3,6}\ $uid:\d{4,6}$ Dating Spam False -150 #FFCC0098 White True False All Body Contains PlainText I would like to find a man Body Contains PlainText HOTSINGLESNET.NET Body Contains PlainText girls at our site Body Contains PlainText My pics and short video Body Contains PlainText Do you like beautiful girls? Body Contains PlainText Please write me a letter here http:// Body Contains PlainText Greetings! I wish to get acquainted with you Body Contains PlainText looking for a nice guy to chat with Body Contains PlainText good looking girl who is looking to chat with you Body Contains RegEx \bdating\ (site|system)\b|dating!|flirting Body Contains RegEx HithereI|Ifoundyourprofileonline|you(r|'re)\ so\ hot! Body Contains RegEx (status-online)\ sent\ new\ message|waiting\ you\ for\ chat Body Contains RegEx I\ read\ your\ profile\ online|i\ (found|loved|was\ just\ reading)\ your\ profile Body Contains RegEx a\ nice\ pretty\ girl|I'm\ from\ Russia|Russian\ (beaut(y|ies)|girls|lad(ies|y))|single\ Russian\ (girl|lad.{1,3}|wom[ea]n) Pics Spam True -100 #FFCC0098 White False False All Body Contains RegEx profile\ on\ facebook|\ (yo)?ur\ profile|your\ pic Body Contains RegEx share\ (mine|my\ pics?)\ with\ you|you\ my\ pics?|see\ my\ pic|(non-public\ photos|private\ (images|photos)) Body Contains PlainText @hotmail.com Numeric IP Link True -100 #FFCC0098 White False False All Header NotContain RegEx ^Message-ID:\ <.+@mail.gmail.com> Body Contains RegEx ^.*http://(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/)|\d{10}:\d{2,4}/ Image Spam #11 False -100 #FFCC0098 White False False All Body Contains PlainText img0.gif Body Contains PlainText Please Enable Images to View this Body Contains PlainText Please Enable Links and Images to Confirm Your Order! Body Contains PlainText 'Click above to show images' Body Contains PlainText '"View image in browser now' Body Contains PlainText alt='One click to open store' Body Contains PlainText alt='Cant see a picture? Click Here!' Body Contains PlainText alt='Show picture and go to site now!' Body Contains PlainText alt=3D'Want to request ? It's easy to make a request online. Body Contains PlainText this picture is blocked. Click to unblock now Body Contains RegEx ^<(center|/style)>\r\n^<a\ href='http://.+\.(ca|cn|com|net|org|info)'><img\ src='.+/.*\.gif'>\r\n^<style>$ Body Contains RegEx (?-i)^<BODY><table>\r\n<tr><td><a\ href='http://.+\.com/'><img\ src='http://.+\.com/.+\.jpg'\ border=0\ alt='Visit\ site\ now!'></a> \r\n </td></tr></table></BODY></HTML>$ Body Contains RegEx (?-i)^<BODY><a\ href='http://.+\.com/'\ target='_blank'>\r\n^<img\ src='http://.+\.com/.+\.(gif|jpg)'\ border=0\ alt='Having\ trouble\ viewing\ this\ email\?\s?\r\n^Click\ here\ to\ view\ as\ a\ webpage\.'></a></BODY></HTML>$ Re [digits] False -200 #FFCC0098 White False False All Subject Contains RegEx ^re.?\s?(\d{1,2}|\[\d{1,3}\]:?)$ Subject Contains RegEx ^Re\[\d{1,2}\]:\s.* Loans/Bankrupcy False -100 #FFCC0098 White False False All Subject Contains RegEx reduce\ (your\s)?debt|debt\ reduction Subject Contains RegEx consolidat(e|ion)|lenders|loan|mortgage|refinan?c(e|ing|ment)|Your\ Life\ Insurance|\bLender\b Body Contains PlainText Bad credit Body Contains PlainText Bankruptcy Body Contains PlainText fixed low rate Body Contains PlainText You have been pre-approved Body Contains PlainText Refinance Body Contains PlainText loans Body Contains PlainText NetLoan Body Contains PlainText Are your premiums payments too high Body Contains PlainText eLoan is offering loan to Body Contains RegEx low(est)?\ rate(s)?|payday\ (loan|advance)|(Equity|short-term)\ loan|debt\ reduction Body Contains RegEx ^C[o0]ngra[dt]ulati[o0]ns.*you('ll|\scan)\ get\ (.*\ )?\$'?\d\d\d.+'?\ loan\ for\ Diploma Spam False -200 #FFCC0098 White True False All Subject Contains RegEx \b(Dgeree|Dergee|diplomas?|dip1omas?|DIMPLOMAS?|Degree)\b|(?-i)Bacheelor|Masteer|MBA\b|Doctoraate|Uinversity|Unviersity Diploma Spam False -200 #FFCC0098 White True False All Body Contains PlainText diplomas Body Contains PlainText get a Diploma Body Contains PlainText Please leave us the infarmation: Body Contains PlainText non-accredited Body Contains PlainText UNIVERSITY DIPLOMA Body Contains PlainText your Graduation is a phone call away Body Contains PlainText obtain Master degree Body Contains PlainText Obtain the_degree you deserve Body Contains PlainText Please leave us a voice message with your phone number with country code if outside USA Diploma Spam False -200 #FFCC0098 White True False All Body Contains RegEx \s{10,}diplomas?\b Body Contains RegEx ^No\ (classes|Exams|Pre-School) Body Contains RegEx your\ (degree|diploma)|No\ Pre-School Body Contains RegEx Diiploma|DIMPLOMA|(?-i)D\ I\ P\ L\ O\ M\ A\sS? Body Contains RegEx (?-i)([dD]iplomas|Bachelor'?s,?|\bMaster'?s,?\b|\bMBA[,\s']|Doctora(l|te)|PhD's) Body Contains RegEx Outside\ (the\ )?U.?S.?A.?:?\ \+1-(206|267|301|305|501|718|781|832|845)-\d\d\d-\d\d\d\d Body Contains RegEx ^((Inside|For)\s\s?U\.?S\.?(A\.?)?:\s)?\+?1[-,'\.\*\s\~](206|267|305|501|718|781|832|845)[-,'\.\*\s\~]\d{3}[-,'\.\*\s\~]\d{4}|call(ing)?\ this\ number: Phishing Scam False -100 #FFCC0098 White False False All Subject Contains PlainText Your Card Number 5018-0XXX-XXXX-XXXXX Body Contains PlainText MasterCard has been deactivated. Body Contains PlainText As the primary contact, you have to reactivate your card or you will not be able to use it. Body Contains PlainText Please reactivate your MasterCard by going to: Body Contains PlainText Dear VISA card holder, Body Contains PlainText .vc/secureapps/ Webmail Phishing Scam False -100 #FFCC0098 White False False All Subject Contains RegEx (?-i)^Dear\ Account\ Owner|^Dear\ Webmail\ Subscriber|^YOUR\ WEBMAIL\ ACCOUNT Body Contains RegEx ^Dear\sWebmail\s(Subscriber|User)[;,]$ Porn Spam False -100 #FFCC0098 White False False All Subject Contains PlainText FuckBook Subject Contains RegEx \bporn\b Subject Contains RegEx lesbian.*(pics|movie) Body Contains PlainText I have some sexy undies Body Contains PlainText nude pictures Body Contains PlainText FuckDirect Body Contains PlainText there is any porn Body Contains PlainText More Pron Body Contains PlainText We have porn Weight Loss Drugs False -200 #FFCC0098 White False False All Subject Contains RegEx weight.?loss Subject Contains RegEx Loo?s(e|ing)\s?(your\ )?(pounds|weight)|unwanted\ fat|Lose\ \d\d\ (lbs|pounds) Subject Contains RegEx \bhcg\b|(?-i)Hoodia|Gordonii|Anatrim|Acai[\sBW]|HCG Body Contains RegEx \bhcg\b|(?-i)Hoodia|Gordonii|Fatblaster|QuickSlim|Anatrim|Acai\s Body Contains RegEx herbal\ (capsules|components) Body Contains PlainText lose weight Body Contains PlainText Amazing weight loss Body Contains PlainText your weight. From Contains PlainText Lose Weight Body Contains PlainText WeightL0SS Software Spam False -150 #FFFFE500 Black False False All Body Contains PlainText bestsoftware Body Contains RegEx Whirl Wind Software Body Contains PlainText Click this link and download most popular software Body Contains PlainText Click this link and downloaded newest software Body Contains PlainText you can download them right after pur Body Contains PlainText The best software products at the best prices. Body Contains PlainText Any program for any operational system Body Contains RegEx (?-i)Twit\sfrom:\r\n\s+\r\n\s+@Adobe Body Contains RegEx Software\ (is\s)?in\ different\ languages|All\ programs\ offered\ in\ many\ languages Body Contains RegEx EURO.?SOFT(WARE)?|European\ languages|Fully\ localized\ versions Body Contains RegEx ^Retail Price:?\s{1,10}\$\d{3,4}\.[0-9]{2}\r\n^Our Price:?\s{1,10}\$\d{3,4}\.[0-9]{2} Body Contains RegEx Operational\ systems|newsoft|softwares|Cheap.*soft(ware)?|(License|oem)\ssoftware|software\ (you\s)?needs? Body Contains RegEx SSoftwarr?e|down.?lo.?ad(d?able)?\ (legal\ )?s?so.?ft(ware)?|(Best|cheapest|lowest)\ software\ prices|popular\s?software|\boem\ soft(\b|ware) Body Contains RegEx ^(type|vis[il]t)\s'?.+soft.*\s\.\scom'?\sin\syour\s.nternet\sExplorer Body Contains RegEx (?-i)Office\ (Enterprise\ 20\d\d|20\d\d\ Enterprise)|(Access|Communicator|PowerPoint)\ 20\d\d|Auto([cC]ad|desk)\ 20\d\d Software Spam True -100 #FFCC0098 White False False All Body Contains RegEx for\ MAC\s? Body Contains RegEx Retail\ price:\ \$\ \d{3,4}\.\d\d\s? Body Contains RegEx Our\ price:\ \$\ \d{2,3}\.\d\d\s? Body Contains PlainText Features: Software Spam True -100 #FFCC0098 White False False All Body Contains RegEx for\ Windows\s? Body Contains RegEx Retail\ price:\ \$\ \d{3,4}\.\d\d\s? Body Contains RegEx Our\ price:\ \$\ \d{2,3}\.\d\d\s? Body Contains PlainText Features: .BR or .CN Domain Link False -200 #FFCC0098 White False False All Body Contains RegEx http://(www\.)?(.+\.br/.*|.+\.cn/.*['"]>|.+\.cn$) .RU or .UA Domain Link False -200 #FFCC0098 White True False All Body Contains RegEx http://(www\.)?(.+\.r[uo]/|.+\.r[uo]\b|.+\.(su|ua)) Body Contains RegEx www\.[a-z0-9-]{1,16}\.ru(/.+)? Body Contains RegEx <a href=(3D)?'[a-z0-9\.]{4,}\.ru'> Known Spam Domains False -200 #FFFF0000 White False False All Header Contains PlainText .es Header Contains PlainText Taipei Header Contains PlainText .ono.com Header Contains PlainText Received: from %RND_IP Header Contains RegEx \.server4you\.de|staticip\.rima-tde\.net|emaillove\.net|\.cwazy\.net|(\.163|coughfusion|explodefast|otcpundit)\.com|myautorepair\.info Body Contains PlainText .freehyperspace2.com Body Contains PlainText sent from: iContact Body Contains PlainText /group.php?group_id=152 Body Contains PlainText /group.php?group_id=3D152 Body Contains PlainText Altera product announcements Body Contains RegEx (?-i)P\.P\.\ Monthly\ Newsletter|SMART-LIST|iContact\ Family|E-mail\ Newsletter\ Services Body Contains RegEx (?-i)(Discovery\ Health|Men's\ Health\ Today|Health\s?Central|OTC\ Pundit|Plentiful\ Pleasures|US\ Pharmacy) Body Contains RegEx http://(www\.)?(2mb\.eu/.{5,7}|\d\dvip-?2010\.com|.+\co\.cc/.{2,8}\.php|pages\.suddenlink\.net/|(cleans?\w{2,7}|healthcentral|heartremember|highoptimism|icontact|izonyou|kubdirect|menshealth|noticepride|perfectdeliveries|rangesure|sheetcome|tronicspalace|whenflat)\.com|spamsoft)|http://.+\.(globalfortoday|heardouble|himsuch|t35|tumblr)\.com|vvmarketv\.com|users\d\.Jabry\.com/.+|SpecialGrantAccess|(\.110mb|globalfortoday|medicamor|mimartar|trlvi)\.com|new2town|newyearsdate\.net|\.com/s/h/o/p/ Russian Sender False -200 #FFCC0098 White False False All Header Contains PlainText From: =?koi8-r Header Contains PlainText Subject: =?koi8-r Header Contains PlainText Subject: =?windows-1251 Header Contains PlainText charset='koi8-r'; Body Contains PlainText charset=3Dkoi8-r Header Contains RegEx ^Received:\ from\ .*85\.140\.\d{1,3}\.\d{1,3} Header Contains RegEx ^Received:\ from\ .*80\.85\.1([7][6-9]|[8[0-9]|9[01])\.\d{1,3}(\]\))? Header Contains RegEx Message-ID:\s<.+@.+\.(ru|su)> Header Contains RegEx $envelope-from\ <.+@.+\.(ru|su)>$ Header Contains RegEx HELO\s.+\.(ru|su) Header Contains PlainText ukrtel.net Header Contains RegEx Received:\ from\ .+\.(ru|su)\ HTML Tricks False -100 #FFCC0098 White False False All Subject Contains RegEx .*@.*@|(?-i)\$REPSBJ Body Contains RegEx (?-i)\$REP(BODY|LINK) Body Contains RegEx font\ size='?0'? Body Contains RegEx ((<![\w\s,\.\-]+>)([\w\s,\.\-]){1,10}){7,} Body Contains RegEx ((&#0*(3[3-9]|[4-9]\d|1[01]\d|12[0-6]);).*?){6} Body Contains RegEx (/[a-z0-9]/[a-z0-9]){5,} Body Contains PlainText <iframe Body Contains PlainText Body Contains PlainText Unsubscribe Body Contains PlainText Body Contains PlainText </td><td\ colspan=(3D)?'\d{1,3}'\ bgcolor=(3D)?'#[a-z0-9]{6}'> Body Contains RegEx <a\ href='http://.+\.com'></a> Body Contains RegEx (\w{1,}.{0,6}<[a-z]{8,}>){3,}\w+</a>$ PDF Attachment True -100 #FF434343 White False False All Body Contains RegEx ^Content-Type: application/(pdf|octet-stream); Body Contains RegEx ^Content-Disposition:\ (attachment|inline); Body Contains RegEx filename=['"].+\.pdf['"] Malware Attachment True -200 #FFCC0098 White True False All Body Contains PlainText (ZIP archive, Adobe PDF) Body Contains PlainText Content-Disposition: attachment; Body Contains PlainText .pdf.zip" CV Zipfile Attachment True -150 #FFFF0000 White False False All Body Contains RegEx ^Content-Type:\ application/zip; Body Contains RegEx ^Content-disposition:\ attachment; Body Contains RegEx (\s?filename|\tname)=".+cv\.zip" Zip, Rar, Gz Attachment True 0 #FFFF0000 White False False All Body Contains RegEx ^Content-disposition:\ attachment;|^Content-Type:\ application/zip; Body Contains RegEx (^\s?filename|\tname)=".+\.(zip|rar|t?gz)" Base 64 Encoded True 0 #FF434343 White False False All Body Contains PlainText Content-Transfer-Encoding: base64 Body Contains PlainText Content-Type: text/plain Body NotContain RegEx ^Content-Disposition:\ (inline|attachment);|^Content-Type:\ (application|image)/[a-z]{3,};|Content-Type:\ application/octet-stream; Hidden ISO Subject False 0 #FF434343 White False False All Header Contains RegEx ^Subject:[^\n]*?=?ISO-8859-[^\n]*?\n Header Contains PlainText Subject: =?ISO-2022-JP? African Sender (419) False -200 #FFCC0098 White False False All Header Contains RegEx Received:\sfrom\s.*[\[$]41\.\d{1,3}\.\d{1,3}\.\d{1,3}[\[\]$] Header Contains RegEx Received:\sfrom\s.*[\[$]196\.\d{1,3}\.\d{1,3}\.\d{1,3}[\[\]$] Header Contains RegEx Received:\sfrom\s.*[\[$]81\.199\.\d{1,3}\.\d{1,3}[\[\]$] Header Contains RegEx ^Received:\ from\ .+41\.\d{1,3}\.\d{1,3}\.\d{1,3} Body Contains RegEx (Tele)?phone\s\+?(0027|002[123456]\d)[\s_\*'-]\d{3,} Subject All Caps True -100 #FFCC0098 White False False All Subject NotContain RegEx (?-i)[a-z] Subject Contains RegEx (?-i)[A-Z]{3,}\s filtered True 100 #FF006600 White False False All From Contains RegEx (?-i)Chase|@.+\.chase.com Header Contains RegEx Received:\ from\ .{4,8}\.jpmchase\.com Phishing Scam False -100 #FFCC0098 White False False All From Contains RegEx (?-i)HSBC\ Bank|NetBank.?Notification|Taxation\ Office|Tax\ |BOA\ Services|Online\ Banking\ Security|Chase\ Bank|TD\ Canada|Internet\ Banking|(Bank\s)?Midwest(\sBank)?|USAA Subject Contains PlainText Facebook Update Tool Subject Contains PlainText Unauthorized Activity Subject Contains PlainText Taxation Office Subject Contains PlainText Your paypal access has been limited Subject Contains PlainText Online Banking Verification Process Subject Contains PlainText Notification of limited account access Subject Contains PlainText Security Notification for your Online Banking Subject Contains PlainText Your AOL Instant Messenger account will be deleted Subject Contains PlainText Please visit our Client Verification Form using the link below Subject Contains RegEx Your\ .*account\ .*(has\ been|was)\ (limited|locked) Subject Contains RegEx (?-i)NetBank|Your\ Bank\s.+account\ has\ been\ locked|Internet\ Bank(ing)?:.*Urgent\ Security\ Update|Underreported\ Income\ Notice|American\ Express\ Online\ Form|Restore\ your\ Online\ Banking Phishing Scam False -100 #FFCC0098 White False False All Body Contains PlainText due to multiple login errors on your account Body Contains PlainText Your account has been suspended after too many failed login Body Contains PlainText Your account has been limited due to a login attempt failure. Body Contains PlainText we were unable to verify your account details Body Contains PlainText We were unable to verify your account information during our regular maintainance Body Contains PlainText Click CONFIRM to confirm your identity Body Contains PlainText Securely confirm your banking information Body Contains PlainText failure to confirm your records may result in account Body Contains PlainText Failure to do so may result in temporary account suspension. Body Contains PlainText has been locked due to some internal issues. Body Contains PlainText Read more about installation of SSL Certificate Body Contains PlainText To restore your account we have attached a form to this email. Body Contains PlainText Due to inactivity, your account has been deactivated Body Contains PlainText account was locked because of too many failed logon attempts. Body Contains RegEx Your\ [A-Za-z]{3,}\ account\ (is|has\ (been|become))\ (flagged\ as\ )?inactive|account\ is\ currently\ locked|:8080/www\.capitalone\.com/|Commonwealth\ (Net)?Bank|\sNetBank|^Issue:\ Unreported/Underreported\ Income\ $Fraud\ Application$ Phishing Scam True -100 #FFCC0098 White False False All Header NotContain RegEx ^Received:\ from\ .+\..+ebay\.com\ .+\ helo=.+\.ebay\.com Subject Contains RegEx (?-i)eBay|Security Message Body Contains RegEx ^Dear\ eBay\ (Customer|Member),|^You\ have\ \d\ new\ Security\ Message\ Alert!|eBay\ Confirmation\ Request Facebook Scam True -150 #FFCC0098 White False False All From Contains PlainText @facebook.com Subject Contains RegEx password Body Contains RegEx new\ password\ (in|is)\ attached Body Contains PlainText Facebook Body Contains PlainText Content-Disposition: attachment; PayPal Phishing Scam True -100 #FFCC0098 White False False All Header NotContain RegEx ^Received:\ from\ ([a-z0-9.-]+\.paypal\.com\s|\[(\d{1,3}\.){3}\d{1,3}\]\ $helo=mx\d\.phx\.paypal\.com$\r\n) From Contains RegEx .+@(intl|www[-\.])?paypal(-us)?.com|^PayPa[l1I]|paypai\.com PayPal Phishing Scam True -100 #FFCC0098 White False False All Body Contains RegEx ^Dear\ PayPal\ (User|Member|Customer)|Your\ paypal\ access\ has\ been\ limited Header NotContain PlainText nix.paypal.com WORM >Double Extension!! True -100 #FFFF0000 White False False All Body Contains PlainText Content-disposition: attachment; filename= Body Contains RegEx (file)?name='.+\.(gif|jpg)\.(scr|pif|exe|cmd|com)' Dangerous Attachment Extension! True -100 #FFFF0000 White False False All Body Contains PlainText Content-disposition: attachment; Body Contains RegEx ^\s?filename='.+\.(pif|scr|hta|cmd|bat|vbs|com|cpl|hlp)' .exe attachment True 0 #FFFF0000 White False False All Body Contains PlainText Content-disposition:\ attachment; Body Contains RegEx ^\s?filename='.+\.exe' .doc attachment (419 Scam?) True -100 #FFCC0098 White False False All Subject Contains PlainText attach Body Contains PlainText Content-Disposition: attachment; Body Contains PlainText filename=" Body Contains PlainText .doc" Exploit Link True -200 #FFCC0098 White False False All Subject Contains PlainText New Acrobat PDF Reader Has Released ! Subject Contains RegEx (Download|Upgrade)\ Now Header Contains PlainText X-rext: 3.interact2 Body Contains PlainText ADOBE PDF READER UPGRADE NOTIFICATION Body Contains RegEx We\ are\ pleased\ to\ announce\ the\ new\ (Acrobat|Adobe|PDF)\ Reader Body Contains PlainText contains critical security updates Body Contains PlainText To upgrade your application:  Body Contains RegEx -(download|upgrade)=2Ecom< Exploit Link True -200 #FFCC0098 White False False All Subject Contains PlainText Download New Version Of Skype ! ReturnPath NotContain PlainText @skype.com Body NotContain PlainText To download the latest version , go to Body Contains RegEx -downloads?=2Ecom interact2 Spammer False -200 #FFCC0098 White False False All Header Contains RegEx X-rext: \d.interact\d\. Exploit Link True -100 #FFFFCC00 Black False False All Subject Contains PlainText Official Update Body Contains RegEx /.+\.exe'> digits-consnts False -100 #FFCC0098 White False False All Subject Contains RegEx ^\s?[bcdfghjklmnpqrstvwxz0-9]{5,} Non-English Language True -200 #FFCC0098 White False False All Subject Contains RegEx Á|Â|à|á|â|ã|è|é|ê|ë|ì|í|î|ï|ñ|ò|ó|õ|ù|ú|û|ü|ý|\b(avec|des?|et|la|vous)\b Body Contains RegEx Á|Â|à|á|â|ã|è|é|ê|ë|ì|í|î|ï|ñ|ò|ó|õ|ù|ú|û|ü|ý|\b(avec|des?|et|la|vous)\b Subject NotContain RegEx R[eé]sum[eé] Body NotContain RegEx R[eé]sum[eé] Thunderbird Spam True -100 #FFCC0098 White False False All Header Contains RegEx ^User-Agent:\ .+Thunderbird/\d\.\d(\.\d)?$ Body Contains RegEx ^(?)[A-Z][a-z]{3,6}[A-Za-z\s\w,]+\d\d%\s[O0]FF.?\r\n Body Contains RegEx http://.+\.[a-z]{2}/[a-z0-9]{3,6} URL Shortener Link False -100 #FF434343 White False False All Body Contains PlainText goo.gl Body Contains PlainText http://lawurl.com/ Body Contains RegEx http://[tx]\.co/ Body Contains RegEx http://.+\.\w{2}/[a-z0-9]{4,6} Body Contains RegEx http://takeme\.to\.it/[a-z0-9]{4,6} Body Contains RegEx http://(www\.)?dwarfurl\.com/[a-z0-9]{4,6} Body Contains RegEx http://mp77.com/[a-z0-9]{4,6} Body Contains RegEx http://wurl\.ca/\?r=.+ Body Contains RegEx http://linkzip\.net/F/.{4,5} Chain Letter True 0 #FFD4D4D4 Black False False All To Contains RegEx (.+@.+,\s){5,} Subject Contains PlainText FW: Re: or Fw: False -100 #FFCC0098 White False False All Subject Is PlainText Re: Subject Is PlainText Fw: Subject Contains PlainText RE:RE: No Subject, Just Link True -100 #FFCC0098 White False False All Subject NotContain RegEx .{1,} Body Contains RegEx \A^http://.+=?(\r\n)?.*\.html?(\r\n)?$\Z No Subject True -80 #FFCC0098 White False False All Subject NotContain RegEx .{1,} 1 Word Subject False -100 #FFCC0098 White False False All Subject Contains RegEx ^[a-z''\|\{\}\[\]]{7,8}$ Subject Contains RegEx ^\d{7,8}$ TO: Contains << >> True -100 #FFCC0098 White False False All To Contains RegEx <<.+@.+>> Subject contains email address True -100 #FFCC0098 White False False All Subject Contains RegEx .+@.+\.[a-z]{2,4} Subject NotContain RegEx inside-adsense@googlegroups.com To Webmaster Spam False -100 #FFCC0098 White False False All Subject Is PlainText to webmaster Phishing Scam True -100 #FFCC0098 White False False All Subject Contains RegEx Notification\ of\ limited\ (account\ )access|(?-i)Western\ Union From Contains PlainText Western Union Header NotContain RegEx Received:\ from\ (westernunion|instantservice).com Body Contains RegEx (?-i)Western\ Union|Your account has been limited Twitter Scam False -100 #FFCC0098 White False False All Body Contains PlainText Once you confirm, all future email from Twitter will be sent to this Body Contains PlainText You have 3 unreaded message(s) from Twitter. Subject Contains RegEx You\ have\ \d\ (unread\ direct|urgent)\ messages\ (from|on)\ (?-i)Twitter! E-Card Scam False -150 #FFCC0098 White False False All From Contains RegEx (?-i)E-Card-|-E-Cards|Instant\ [eE]-Cards Subject Contains PlainText Ecard Special Delivery Subject Contains PlainText You have [1] new e-card waiting for you. Subject Contains PlainText There is [1] new e-Card waiting to be read Subject Contains PlainText Someone likes you and has sent you an e-Card Subject Contains PlainText There is currently [1] e-Card waiting for you to read. Subject Contains PlainText Someone has just sent you an e-Card! Body Contains PlainText Click here to view the e-card waiting for you from [Secret Admirer] Body Contains PlainText -e-card4you.com Body Contains PlainText [Secret Admirer] has just sent you an e-Card! Body Contains PlainText http://yourluckyday.info Email Addresses 4 Sale False -200 #FFCC0098 White False False All Subject Contains PlainText Large sending of email newsletters Body Contains PlainText Do you need to send millions of emails per month? Body Contains PlainText List of country-targeted recepients Body Contains PlainText USA 89 000 000 records - 700 EUR (1000 $) Body Contains PlainText please contact sales@mail-netpost.ru charset=iso-8859-2 False -100 #FFCC0098 White False False All Header Contains PlainText Content-Type: text/plain; charset=iso-8859-2 Header Contains PlainText charset="iso-8859-2" From India False -200 #FFCC0098 White False False All EntireMessage Contains RegEx ^Date:\s\w+,\s\d{1,2}\s\w+\s201\d\s\d\d:\d\d:\d\d\s\+0530$ Spain False -100 #FFCC0098 White False False All Header Contains RegEx Received:\ from\ .*\[84\.12[0-3]\.\d{1,3}\.\d{1,3}\] Header Contains PlainText .ono.com Header Contains PlainText Content-language: es Turkey False -100 #FFCC0098 White False False All Header Contains RegEx ^Received:\ from\ (\[(85.10[56]\.\d{1,3}\.\d{1,3}|88\.234\..+\..+|194\.27\.\d{1,3}\.\d{1,3}|195.175\.\d{1,3}\.\d{1,3})\])|.+\.tr\) Header Contains RegEx 88\.255\.\d{1,3}\.\d{1,3} Hong Kong Spam False -100 #FFCC0098 White False False All Body Contains RegEx ^http://.+\.hk/\?.+ APNIC False -100 #FFCC0098 White False False All Header Contains RegEx ^Received: from [^[]*?\[(6[01]|20[23]|21[01]|21[89]|22[0-2])(\.[1-2]?\d?\d?){3}\] Header Contains RegEx ^Received: from [^[]*?\[(\[58|\[59]|6[01]|20[23]|21[01]|21[89]|22[0-2])(\.[1-2]?\d?\d?){3}\] Header Contains PlainText SE Asia Standard Time Header Contains PlainText charset=big5 Header Contains RegEx ^Message-Id:\s.*<.+@.+\.cn>$ Header Contains RegEx Received:\ from\ .+\.hinet\.net Header Contains RegEx 112\.201\.\d{1,3}\.\d{1,3} Body Contains PlainText charset="iso-2022-jp" RIPE False -100 #FFCC0098 White False False All Header Contains RegEx ^Received: from [^[]*?\[(62|8[0-2]|19[345]|21[237])(\.[1-2]?\d?\d?){3}\] Header Contains PlainText kpnplanet.nl Header Contains PlainText kpnxchange.com LACNIC False -100 #FFCC0098 White False False All Header Contains RegEx ^Received: from [^[]*?\[20[01](\.[1-2]?\d?\d?){3}\] Header Contains RegEx (\.fibertel\.com\.ar|\.cable\.net\.co|\.(com|net)\.br)\b Blocked Country False -100 #FFCC0098 White False False All Header Contains RegEx ^Received:\ from\ .+\.(ar|br|cn|co|jp|kr|ma|my|ng|pl|ro|ru|th|tr|vn|hinet\.net|orange.fr|ukrtel\.net)\b\s? Currently set for many non latin languages. You can edit this filter to your own preference. False -100 #FFCC0098 White False False All EntireMessage Contains Language Arabic,Chinese,Cyrillic,Hebrew,Indic,Japanese,Korean,Tamil,Vietnamese Known X-Mailer False 0 #FF434343 White False False All Header Contains PlainText X-Mailer: Apple Mail (2.924) Header Contains PlainText X-Mailer: The Bat! Header Contains PlainText X-Mailer: Mediacomm Communicator Header Contains PlainText X-Mailer: xinnet.com webmail 1.0 Header Contains PlainText X-Mailer: Openwave WebEngine Header Contains PlainText X-Mailer: iPlanet Messenger Express Header Contains PlainText X-Mailer: CommuniGate Pro WebUser Header Contains PlainText X-Mailer: Sun Java Header Contains PlainText X-Mailer: Evolution Header Contains RegEx ^X-Mailer:\ (Prayer|sejkuuk|Zimbra) Spam Assassin True -100 #FFCC0098 White False False All Subject Contains PlainText *****SPAM***** Pump and Dump Scam False -200 #FF0000FF White True False All Subject Contains RegEx (?-i)DYNV|PennyStock|Market\ News|ECMZ|Insider\ Report|Trading\ Alert Body Contains PlainText DYNV.ob Body Contains RegEx \bst.ck\ symbol\ is\s Body Contains PlainText call your broker NOW before it is Body Contains PlainText PowerPlay2Day Body Contains RegEx Penny.?Stock.?(Newsletter|Picks) Body Contains PlainText Please Enable Links and Images to View the Newsletter! Body Contains RegEx ^(?-i)Symbol:?\ [A-Z]{3,5} Body Contains PlainText Market Newsletter .Info Sender, Images and Links True -200 #FFCC0098 White True False All Header Contains PlainText Subject: =?ISO-8859-1?Q? Body Contains RegEx <a href=['"]http://.+.info/\d{10,22}['"]> Body Contains RegEx <img src=http://.+.info/\d{10,22}['"]' border='0' /></a> Body Contains PlainText <div style="color:#FEFFFE;font-size:0.25em;"> .Info Sender and Links True -200 #FFCC0098 White False False All Header Contains RegEx ^Received:\ from\ .+\.info\ $.+$\r\n From Contains PlainText .info Body Contains RegEx http://.+\.info/ .Info Sender True 0 #FF434343 White False False All Header Contains RegEx ^Received:\ from\ .+\.info\ $.+$\r\n From Contains PlainText .info