// MailWasher Pro filter rules #1, compiled by "Wiz" Feinberg, from www.wizcrafts.net. // Can be used to replace the default rules, saved to your MWP profile data folders as filters.txt. // This page is a child of: http://www.wizcrafts.net/mailwasher.html and http://www.wizcrafts.net/mwp-filters.html where you can get MailWasher Pro, or learn more about it. // // If these rules prove beneficial to you, please make a donation, at: http://www.wizcrafts.net/donations/ // Thanks :-) // // READ THESE NOTES // // Indicates a comment, and is not parsed. // // IMPORTANT READ THE FOLLOWING! // If you make changes to this file while MailWasher Pro is running, the changes will be overwritten when MailWasher Pro is closed. // To be safe, close MailWasher first,then edit the filters. Or, edit them within MailWasher using the Filter Sidebar (Control + F7). // I have had reports about corruption when copying and pasting my filters into existing filters.txt files. Most of the time this is caused because the text editor you are using is allowing a mixture of Unicode and Ascii entries to be copied. // If you experience MailWasher wiping out the pasted in filters, after you re-open it (assuming it was not running at all when you saved the changes), do this. // When copying and pasting some or all of these filters into your own "filters.txt," if you are using a text editor that is unicode-aware, you should not just SAVE the file. Rather you should use the "Save AS" feature to save the file as either all ASCII or all UNICODE. MailWasher will accept either, but can only deal with one at a time. // // Personally identifiable rules have been deleted from this list. You should create your own rules to deal with your domain name or email address in the Subject or From fields. // Sample rule for spam sent to an non-existent account on your Domain server, - contacts@yourDomain ... // (ex:) [enabled],"contacts@YourDomain.com","Contacts Spam",16711680,OR,Hidden,Delete,Automatic,To,contains,contacts@YourDomain.com,EntireHeader,contains,contacts@YourDomain.com,Subject,contains,contacts@YourDomain.com,From,contains,contacts@yourDomain // The following are actual, functional rules, ready to drop in to your existing Mailwasher Filters. There may be duplicates because some are from common rules sources. // There must not be any blank lines from the start of the list to the end. Each rule must be on one continuous line, with a linefeed between rules. The last rule must end at the end of it's line, without a linefeed! // Turn off word wrap to view these rules. // Be sure you add your friends and contacts to your Friends List, or the image spam filter rules may delete email you wanted. // Removed undesirable "Bounce" directives on August 8, 2007. Bouncing no longer works for modern spam as the Return To and From field is always forged and is sent from zombie botnetted home or office computers. // Bouncing also creates more backscatter of useless, undeliverable email, which email servers must deal with. // Email matching rules will be flagged as the various types of spam but you will have to delete them manually, by clicking the "Process Email" button. // You can change the action back to automatic, hidden, or blacklist if you wish, by editing the action rules here, or with MailWasher Pro's Filter sidebar. // Please read the Blocked Countries filter and remove any extensions for Countries you get legit email from. Use caution with all of the Country-based filters! Disable any that block legitimate foreign email. // Removed all instances of actions "Hidden," "Automatic," and "Blacklist" on August 11, 2007 // Temporarily disabled the image spam filters because this type of spam is dying. Subject to instant reactivation! // This is the master filters.txt and includes old filters from years gone by, as well as the most current. // Rearranged filters according to my own usage; most current rules nearest the top; catch-alls near bottom. // December 2, 2007: (Split Pharmaceuticals and Male Enhancement filters into separate detections for Subject [S] and Body [B] word matches. Merged Canadian Pharmacy filter into Pharmaceuticals.) // January 3, 2008, I have begun anchoring the starting characters on new lines with ^ to improve rule processing. Many rules are getting updated to include this, as is appropriate. // January 17, 2008, I added a new filter to detect the same domain name on both sides of @ sign, in "From:" field. Removed part of .info sender filter to speed up processing. // May 24, 2009: Added new filter to detect URL Shortener spam links (above Blocked Countries filter) // May 31, 2009: Added "Stud Tips" spam filter // June 23, 2009: Known Spam [From or Body] now split into 2 filters (one for From, one for Body). // Aug 25, 2009: Added Google Reader Spam Link filter // Sept 28, 2009: Added Webmail Phishing Scam filter // Oct 17, 2009: Added African Sender (419) filter // Nov 10, 2009: Added Unlicensed Prescription Drugs filter // Nov 17, 2009: Phishing Scam updated and split into 2 filters; one for Subject/From, the other for Body text // Jan 13, 2010: Added a Western Union phishing filter // Jan 14, 2010: UPS Phishing Scam #2 added. Original renamed to: UPS Phishing Scam #1 // Jan 29, 2010: Added Courier Phishing Scam for DHL and others, aside from UPS // Feb 10, 2010: Added Facebook Phish filter // Feb 15, 2010: Added Live.com Spam Link filter // Feb 20, 2010: Added "Subject contains < * + ' >" filter. Added "Flagged by Spam Assassin" filter. Moved "XdomainY@domain" below it, to the bottom of the list. // Feb 22, 2010: Added Blogger Exploit Link filter // Feb 22, 2010: Split huge Nigerian 419 Scam filter into 6 separate filters, to speed things up // Mar 07, 2010: Added Craigslist Scammer filter - pitching get rich schemes to Craigslist posters // Mar 17, 2010: Added Warranty Spam filter (fraudulant extended car warranties) // Filters updated last week: Dating Scam, Male Enhancement [B], Nigerian 419 Scam #5 [B], Nigerian 419 Scam #6, Pharmaceuticals [S], // Filters previously updated this week: Pharmaceuticals [S], Live.com Spam Link, (New) Warranty Spam, Dating, Known Spam Domains, Known X-Mailer, Unlicensed Prescription Drugs // Last updated filters on March 20, 2010: Unlicensed Prescription Drugs // All of these comments will be erased as soon as you save this file as filters.txt and activate MailWasher Pro. Keep a copy of this file on hand. [enabled],"AVG Returned Email","AVG Bounces",16711680,OR,Delete,Body,contains,"This is the AVG E-mail Scanner program.",Body,contains,"I'm sorry to inform you that the message",Subject,contains,"Undelivered Mail Returned to Sender" [enabled],"Restored by MWP","Restored by MWP",26112,AND,Legitimate,TakesPrecedence,EntireHeader,contains,"Resent-From: ""MailWasher Pro recycle bin""" [enabled],"Mailwasher Reports","MWP Report",26112,AND,Legitimate,Subject,contains,"MailWasher Pro summary" [enabled],"Multiple Forwarded Messages","Multiple Forwarded Messages",16711680,AND,To,containsRE,"(.+@.+,\s){5,}",Subject,contains,FW: [enabled],"Phishing Scam [S or F]","Phishing Scam",16711680,OR,Delete,From,containsRE,"(?-i)HSBC\ Bank|NetBank.?Notification|Taxation\ Office|Tax\ |BOA\ Services|Online\ Banking\ Security",Subject,contains,"Facebook Update Tool",Subject,contains,"Unauthorized Activity",Subject,contains,"Taxation Office",Subject,contains,"Your paypal access has been limited",Subject,contains,"Online Banking Verification Process",Subject,contains,"Notification of limited account access",Subject,contains,"Security Notification for your Online Banking",Subject,contains,"Your AOL Instant Messenger account will be deleted",Subject,contains,"Please visit our Client Verification Form using the link below",Subject,containsRE,"Your\ .*account\ .+(has\ been|was)\ limited",Subject,containsRE,"(?-i)NetBank|Your\ Bank\s.+account\ has\ been\ locked|Internet\ Bank(ing)?:.*Urgent\ Security\ Update" [enabled],"Phishing Scam [B]","Phishing Scam",16711680,OR,Delete,Body,contains,"due to multiple login errors on your account",Body,contains,"Your account has been suspended after too many failed login",Body,contains,"Your account has been limited due to a login attempt failure.",Body,contains,"we were unable to verify your account details",Body,contains,"We were unable to verify your account information during our regular maintainance",Body,contains,"Click CONFIRM to confirm your identity",Body,contains,"Securely confirm your banking information",Body,contains,"failure to confirm your records may result in account ",Body,contains,"Failure to do so may result in temporary account suspension.",Body,contains," has been locked due to some internal issues.",Body,contains,"Read more about installation of SSL Certificate",Body,contains,"To restore your account we have attached a form to this email.",Body,containsRE,"Your\ [A-Za-z]{3,}\ account\ (is|has\ (been|become))\ (flagged\ as\ )?inactive|account\ is\ currently\ locked",Body,containsRE,":8080/www\.capitalone\.com/|Commonwealth\ (Net)?Bank|\sNetBank" [enabled],"UPS Phishing Scam #1","UPS Phishing Scam",16711680,AND,Delete,Subject,contains,"UPS Delivery Problem",Body,containsRE,"we\ (failed|were\ not\ able)\ to\ deliver\ (the\ |your\ )?(postal\ )?package",Body,contains,"print out the invoice",Body,contains,"Content-Disposition: attachment;" [enabled],"UPS Phishing Scam #2","UPS Phishing Scam",16711680,AND,Delete,Subject,containsRE,"Confirm\ Your\ UPS\ Parcel\ Delivery|UPS\ Tracking\ Number",EntireHeader,doesn'tContainRE,"^Received:\ from\ [a-z0-9]+\.?ups\.com" [enabled],"Courier Phishing Scam","Phishing Scam",16711680,AND,Delete,Subject,containsRE,(?-i)DHL,Subject,containsRE,"get\ (a|your)\ parcel",Body,contains,"The courier service was not able to deliver your parcel",Body,contains,"Print this label to get this package at our post office.",Body,contains,"Content-Disposition: attachment;",From,containsRE,Director|Manager|Postal [enabled],"Blogger Exploit Link","Blogger Exploit Link",16711680,AND,Delete,TakesPrecedence,Subject,contains,"Blogger account",Body,contains,"Dear Blogger account owner",Body,contains,"update your Blogger account",Body,contains,"please click the following link:",Body,containsRE,"" [enabled],"Trojan Video Link [S]","Trojan Video Link",16711680,OR,Delete,Subject,containsRE,(Kick-up|News)\s-.+-\svideo,Subject,contains,"video without cowards",Subject,contains,"Re: Delivery Protection",Subject,is,"BREAKING news",Subject,is,"Weekly top news",Subject,containsRE,"(BBC:|CNN:|Breaking\ news:|Hot\ news:)" [enabled],"Trojan Video Link [B]","Trojan Video Link",16711680,OR,Delete,Body,containsRE,"(Kick-up|New|Shocking)\s(presentation|video)|video\ without\ cowards|mp3\ is\ shocking|Interesting\ (cd|mp3|mpeg4)|Stunning\ (mpeg4|porno|video)|porno\ dvd",Body,containsRE,"Download\ and\ watch|Download\ (it\s)?now\!|get\ this\ kick-up\ cd|Look\ (at\s)?it\ now\!",Body,containsRE,"/(play(er)?|mov|stream|vid|video_?\d?|watchit)\.exe"">",Body,contains,"Download VIDEO",Body,contains,"Open video",Body,contains,/paris_hilton,Body,contains,"PUSH TO WATCH",Body,contains,"Shocking movie",Body,containsRE,"/index[0-9]{1,2}\.html"">",Body,contains,"Video attached" [enabled],"Trojan Video Link [S&B]","Trojan Video Link",16711680,AND,Delete,Subject,containsRE,"Barack\ Obama|Britney\ Spears|(Paris|Barron)\ Hilton",Body,containsRE,"\.exe"">|/index_?\d{1,2}\.html"">|video\ report|news\ page>>" [enabled],"Fake Daily Top 10","Exploit Link",16711680,AND,Delete,Subject,contains,"CNN.com Daily Top 10",From,contains,"Daily Top 10",From,doesn'tContain,cnn.com [enabled],"Fake CNN Alerts","Exploit Link",16711680,AND,Delete,Subject,contains,"CNN Alerts: ",From,doesn'tContain,cnn.com,EntireHeader,doesn'tContainRE,"^Received:\ from\ .+\.cnn\.com\ \(\[64\.236\.31\.[0-9]+\]\)$" [enabled],"Fake Msnbc Alerts","Exploit Link",16711680,AND,Delete,Subject,contains,"msnbc.com - BREAKING NEWS:",From,doesn'tContain,msnbc.com [enabled],"Known Spam Subjects #1","Known Spam Subjects",16711680,OR,Delete,Subject,containsRE,"^\d\d% discount$",Subject,contains,"Can you tell me what's wrong, and how we can fix it?",Subject,contains,"No more embarrassment",Subject,contains,"New size for Men",Subject,contains,"U on board",Subject,contains,"huge dignity",Subject,contains,"Won't forget last night",Subject,contains,"Realize all of her dreams",Subject,contains,"re:Nobody will know bout your problems",Subject,contains,"Get on this right away",Subject,is,"Batteries included",Subject,containsRE,(?-i)^Mego\s.+,Subject,containsRE,^(?-i)(MSG\s)?ID:\d{5}\s.+ [enabled],"Known Spam Subjects #2","Known Spam Subjects",16711680,OR,Delete,Subject,contains,"For every men of different ages unique decision",Subject,is,"What time is okay for you",Subject,contains,"We provide for you a real advantage to turn her on",Subject,contains,"Our best decision is suitable for every age",Subject,contains,"She will call you Macho",Subject,contains,"Legendary Hero of rumors",Subject,contains,"Extend your possibilities in your private life",Subject,contains,"Know her from the sexual side how is she inside exactly",Subject,containsRE,"(guys|Mens?)\ (Love|Need)\ This|Are\ you\ ...\?|XXX\ Video",Subject,containsRE,"size\ increase|(luck|pleasure)\ in\ love|\b(?-i)[GH]uu\w{2,}|virility|bikini\s.*shoot",Subject,contains,"The most powerful weapon for your battles",Subject,contains,"Fast Shipping WorldWide",Subject,containsRE,"(Best|Finest|Good)\ [a-z]{3,}\ (propos(al|ition)|solution|suggestion)" [enabled],"Known Spam Subjects #3","Known Spam Subjects",16711680,OR,Delete,Subject,is,Spamit_New_Subj,Subject,is,"Bring back time when girls were yours.",Subject,is,"Solution for your sexual life",Subject,is,"You can do anything with it",Subject,is,"you have nothing to lose, just a lot to gain!",Subject,is,"Top Quality Size",Subject,contains,"Proven Effective",Subject,contains,"Make your lady w",Subject,contains,"Relax. Take a Deep Breath",Subject,contains,"Buy now, you won't regret!",Subject,contains,"formula for men",Subject,containsRE,"^\d\d%\ off\ for\ [a-z0-9]{3,}$",Subject,containsRE,"(?-i)^from\s[A-Z][a-z]{2,}\s[A-Z][a-z]{3,}$",Subject,containsRE,"<.*details\ inside>",Subject,containsRE,"(?-i)Try\ It\ Free$|FR33" [enabled],"Known 1-word spam subject","Known Spam Subjects",16711680,OR,Delete,Subject,is,Enlarge,Subject,is,Rwd:,Subject,is,Vulcan!,Subject,containsRE,^[0-9]{4}$,Subject,containsRE,^(Ave|Best|Electronics|Finest|Good(iest)?|Salute|Super)$,Subject,containsRE,^(attehuor|fumerent|herkapit|Hermes|idaza|atiohar|Mego|ne-gnorw|nidnalad)$ [enabled],"Known Spam [From]","Known Spam [F]",16711680,OR,Delete,From,contains,"Rx The Best Source",From,containsRE,MensHealth\.com|Extenze|Try\s?[1i]t\s?4Free,EntireHeader,contains,"From: ""USA Government Center""",EntireHeader,containsRE,"(^From:\s{1,3}""?(Mr\.?\ Song\ Li|ph[ra]{2}macy|(?-i)E-STORE|\{|\}|""=\?ISO-8859-1\?Q\?))",From,contains,CanadianPharm,EntireHeader,contains,"From: =?UTF-8?Q?=C2=",From,contains,"SENATOR DAVID MARK",From,containsRE,Pharmacy.?Online|Online.?Pharmacy|Medical|Vicodin [enabled],"Known Spam [Body]","Known Spam [B]",16711680,OR,Delete,Body,contains,"Dear stevegilbie",Body,contains,"The most powerful weapon for your battles",Body,contains,"The finest of products, at the lowest of prices:",Body,containsRE,"\b(show\ woman\ you(rself)?\ care|(many|Your)\ w[eo]men)\b",Body,containsRE,"SpamIt\.com|best-kept\ secret\ for\ Men|^peascod|^(?-i)Severtieth|Healthcare\ Management\ Inc",Body,containsRE,"^Satisfy\ (your\ (girl|wom[ae]n)|her\b)|^Best\ offers\.\ \(c\)\ 200[89]",Body,contains,"gift for your lover",Body,contains,"Make her worship you",Body,contains,"pleasure in bed",Body,contains,"(c) 2008. To unsubscribe press ",Body,contains, ,Body,contains," ",Body,containsRE,"\.(com|net)"">Click here

" [enabled],"Viagra.com Spam","Viagra Spam",16711680,OR,Delete,TakesPrecedence,From,contains,Pfizer,From,contains,viagra.com,From,contains,"Free To Try",From,contains,"® Official Site",From,containsRE,VI[A@]G®A|VIAGR[A@]|Viag.?ra|viagar|ivagra|v[ia]{2}gra|v[iy]arga|V_I_A_G_R_A|^i?Ci?a.?li?s\b,From,containsRE,(Anti.?)?(?-i)ED\b|P[i1l]lls\b,Subject,containsRE,"^(RE:\ )?(January|February|March|April|May|June|July|August|September|October|November|December)\ \d\d%\ OFF\s?$",Subject,containsRE,"^Your\ Order\ Status\ ID:\ [A-Z]{11,}",Subject,containsRE,"^Visitor\ .+'s\ personal\ \d\d%\ OFF$",Subject,containsRE,"^User\ .+\ save\ \d\d%\ now",EntireHeader,containsRE,wizd(ist|om)\.com [enabled],"Fake MSN Newsletter","Canadian Pharmacy",16711680,AND,Delete,TakesPrecedence,EntireHeader,doesn'tContainRE,"^Received:\ from\ .*\.msn\.com",Body,contains,"because you subscribed to MSN Featured Of" [enabled],"Canadian Pharmacy Fake Newsletter","Canadian Pharmacy",16711680,OR,Delete,From,contains,noreply@newsletter.,From,containsRE,"(?-i)(Express\ Newsletter|WWW\ News|Healthcare\ Management\ Inc|Incredible\ News)",From,contains,"Morning Breaking news",Body,contains,"CPA Newsletters",Body,contains,"Gardena Professional Pharmacy" [enabled],"Canadian Pharmacy","Canadian Pharmacy",16711680,OR,Delete,TakesPrecedence,From,containsRE,CANAD[i1l|]AN.?(Meds|Ph[a4@]rm),Subject,containsRE,"(?-i)Canada\ Pharmacy|Canad[1i]an.?(Drugs|Meds|Pharmacy|P\.h\.a\.r\.m\.a\.c\.y|RX|Health\ (&|adn|and)\ Care\ Mall|Healthcare)|^re:.{3,4}(?-i)Doctor\ [A-Z].+",Subject,containsRE,"^\d\d\ percent\ discount$",Body,containsRE,"(?-i)Canadian.{0,15}(Chemist|Healthcare|Medd?s|Medical|Pharmacy|Pharmacies|Pric(es|ing)|RX)",Body,contains,"Canadian Health and Care Mall",Body,contains,"Canadian Health & Care Mall",Body,contains,"We ship Worldwide! To all countries! To all destinations!",Body,contains,"This email was sent by: CMD",Body,contains,,Body,contains,"preparations for immunity improvement",Body,containsRE,"Canadian.?(online\s)?(drugstore|Phar?|p\.h\.a\.r\.m\.a\.c\.y)|Pharma?.*(Canada|market)|Pharmacy\ Online|Canada\ Drugs",Body,containsRE,"^.+>>>$",Body,contains,MEDRX [enabled],"Fake Fox News Canadian Pharmacy","Canadian Pharmacy",16711680,AND,Delete,EntireHeader,contains,"X-MimeOLE: Produced By Microsoft Exchange V6.5",EntireHeader,doesn'tContain,"Received: from listserv.foxnews.com",Body,contains,"To stop ALL email from FOX News Network",Body,contains,"This email was sent by: FOX News Network" [enabled],"Fake ABCNews Canadian Pharmacy","Canadian Pharmacy",16711680,AND,Delete,Body,contains,"To stop ALL email from ABCNews Newsletters, click here to remove =",Body,contains,&SESSID=3D,EntireHeader,contains,"X-MimeOLE: Produced By Microsoft Exchange V6.5" [enabled],"Daily Top 10 Canadian Pharmacy","Canadian Pharmacy",16711680,AND,Delete,Body,contains,CNN.com,Body,contains,"THE DAILY TOP 10",EntireHeader,doesn'tContainRE,"^Received:\ from\ .+\.cnn\.com\ \(\[64\.236\.31\.[0-9]+\]\)$" [enabled],"Image Spam #11","Image Spam #11",16711680,OR,Delete,TakesPrecedence,Body,contains,img0.gif,Body,contains,sdjbvsj.gif,Body,contains,8dvs9.jpg,Body,contains,ioreuu78.jpg,Body,contains,"""View image in browser now""",Body,contains,"alt=""Cant see a picture? Click Here!""",Body,contains,"alt=""Show picture and go to site now!""",Body,contains,"alt=3D""Want to request ? It's easy to make a request online.",Body,containsRE,"^(?-i)Content-Type:\ image/png;\r\n\s{1,8}name="".{3,10}\.png""\r\nContent-Transfer-Encoding:\ base64$",Body,containsRE,"^<(center|/style)>\r\n^\r\n^