Will ensure any email you restore from Recycle Bin will come through marked as good and not marked for delete. False 200 #FF1A19B3 White False False False All Header Contains PlainText Resent-From: "MailWasher? Pro recycle bin" < Currently set for many non latin languages. You can edit this filter to your own preference. False -100 #FFCC0098 White False False All EntireMessage Contains Language Arabic,Chinese,Cyrillic,Hebrew,Indic,Japanese,Korean,Tamil,Vietnamese Looks for messages that are not addressed to you on either the To or CC lines. You need to edit this to include all your own email addresses to use. True -100 #FFCC0098 White False False All To NotContain PlainText bob@test.com To NotContain PlainText bob.builder@test.com To NotContain PlainText bbuilder@test.com Hide & Delete False 0 #FFCC0098 White False False All From Contains PlainText Domain Contains PlainText Subject Contains PlainText Body Contains PlainText TLD Contains PlainText STREAM,PARTY,DATE,FAITH,BID,XYZ,WIN,MOSCOW,TAB,PRO Spamcop report replies False 100 #FF149899 White False False All Subject Contains PlainText [SpamCop ( Nigerian Scammer False -150 #FFCC0098 White False False All Header Contains PlainText bobby-j0nes@hotmail.com EntireMessage Contains PlainText Rebecca Schieble EntireMessage Contains PlainText rebeccaschieble Header Contains PlainText Mrs Reb Body Contains PlainText I Have A Mutual Confidential Offer For You Body Contains PlainText MRS_SCHIEBLE Images Scam False -100 #FFCC0098 White False False All Body Contains PlainText I was confused, to put it nicely, when I came across my images at your web-site. Body Contains PlainText It's not legal to use stolen images and it's so mean! Body Contains PlainText If you don't remove the images mentioned in the document above within the next few days, Body Contains PlainText you may be pretty damn sure I am going to report and sue you! DocuSign Scam True -100 #FFCC0098 White False False All From Contains PlainText DocuSign From NotContain RegEx @docusign\.(com|net) Subject Contains PlainText DocuSign Docusign Scam False -100 #FFCC0098 White False False All Subject Contains PlainText You got invoice from DocuSign Electronic Service Counterfeit Goods False -200 #FFCC0098 White True False False All From Contains PlainText Ray Ban Outlet From Contains PlainText Louis Vuitton From Contains PlainText RAY-BAN Body Contains PlainText www.zlwrb.com/ Dating Scam False -200 #FFCC0098 White False False All EntireMessage Contains PlainText mydatehub. EntireMessage Contains PlainText datinghub. EntireMessage Contains PlainText datesuperhub. EntireMessage Contains PlainText bestdatehub. Chinese Characters Spam False -100 #FFCC0098 White False False All Header Contains PlainText From: =?utf-8?B?5 From China False -100 #FFCC0098 White False False All Header Contains RegEx @163.com EntireMessage Contains RegEx X-Mailer:\ Foxmail\ .*\ [cn] Header Contains RegEx Date:\s.+\s\+0800 Chinese Tee Shirts Spam False -100 #FFCC0098 White False False All Subject Contains PlainText TING's Family Body Contains PlainText Hello Mr (Mrs) TING, Body Contains PlainText TING's FAMILY COLLECTION Body Contains PlainText TING's FAMILY COLLECTION Body Contains PlainText I'm A Student And I'm Honored To Be Design Tee Shirts For You Body Contains PlainText I know your very very love Body Contains PlainText T-Shirts Online Spamvertised Chinese Domains False -100 #FFCC0098 White False False All EntireMessage Contains PlainText datewithbeauty.cn EntireMessage Contains PlainText girlsbeauty.cn Spam from known web hosts False -200 #FFCC0098 White True False All Header Contains PlainText Received: from web.sdwebserver.com Header Contains PlainText Received: from web.phxwebserver.com Header Contains PlainText Received: from vpsnode.webhubone.com Header Contains PlainText Received: from [23.228. Header Contains PlainText Received: from [93.190.9. Header Contains PlainText Received: from [104.148.18. Header Contains PlainText Received: from [104.148.21 Header Contains PlainText Received: from [134.73. Header Contains PlainText Received: from [192.200.200. Header Contains PlainText Received: from [193.17.7. Header Contains PlainText Received: from [193.111.76. Header Contains PlainText Received: from [194.116. Header Contains PlainText Received: from [23.247.36. Header Contains PlainText Received: from [109.236.50. Sextortion Scam False -100 #FFCC0098 White False False All Subject Contains PlainText I RECORDED YOU! Subject Contains PlainText YOUR DEVICE AND EMAIL HAS BEEN COMPROMISED Body Contains PlainText Unfortunately, there are some bad news for you. Body Contains PlainText I RECORDED YOU (through your camera) SATISFYING YOURSELF! Body Contains PlainText unless you prevent this by paying me Body Contains PlainText to my BTC account within 2 days: Body Contains PlainText As I got access to this email account, I will know if this email has already been read. Body Contains PlainText You are given not more than 2 days after you have opened this email. Body Contains PlainText An advice from me, regularly change all your passwords to your accounts and update your device with newest security patches. Body Contains PlainText With aid of Trojan Viruses, I managed to gain full access to any PC or other types of devices. Body Contains PlainText I have collected a video on the left screen where you enjoy wanking Body Contains PlainText I am also able to gain access to all e-mail correspondence as well as messengers used by you. Sextortion Scam False -150 #FFCC0098 White False False All Subject Contains PlainText Don't forget to pay the tax within 2 days! Subject Contains PlainText READ OR GO TO JAIL! Body Contains PlainText PRONOGRAPHIC Subject Contains PlainText Pending for a payment. Body Contains PlainText P0RN0graphic videos Body Contains PlainText BIT C0lN Body Contains PlainText Important! The address(CaSe SeNsItIvE) contains spaces so you must to eliminate all the spaces Body Contains PlainText The Address which is CASE SENSITIVE contains spaces so you have to manually remove all spaces Body Contains PlainText My malicious application Body Contains PlainText my bitcoin wallet: Body Contains PlainText I have gained access to your devices Body Contains PlainText you masturbate Body Contains PlainText where you must to send my bribery Body Contains PlainText you should end this habbit Body Contains PlainText You need to send that amount to this wallet: Body Contains RegEx MASTURBBATE Sextortion Scam True -200 #FFCC0098 White False False All EntireMessage Contains PlainText send that amount to this wallet: EntireMessage Contains RegEx (0-9a-zA-Z){34} Sextortion Scam False -100 #FFCC0098 White False False All From Contains PlainText Recorded You Subject Contains PlainText Video Of You! Body Contains PlainText Hey, today I got some bad news for you. Body Contains PlainText To stop me, pay Body Contains PlainText //paxful.om/buy-bitcoin Bitcoin Wallet False -100 #FFCC0098 White False False All Body Contains RegEx Bitcoin\ .*Wallet\ address\ is\x20 Body Contains RegEx My\s{1,2} bitcoin .* (wallet|address) .*: [0-9|a-z|A-Z]{34,42} Body Contains RegEx bitcoin\ wallet.*:\ [0-9|a-z|A-Z]{34} Body Contains PlainText Below is bitcoin address (BTC Wallet) Body Contains PlainText Bitcoin wallet Body Contains PlainText My Bitcoin (BTC) address is: T.co Spam True -150 #FFCC0098 White False False All Body Contains PlainText Head on over to cloudcone.com Body Contains PlainText Dear Lucky customer Body Contains PlainText t.co/ Security protocol update exploit link True -200 #FFCC0098 White False False All Header Contains PlainText .pw> Subject Contains PlainText Security protocol update Body Contains PlainText Update Emails .pw spam False -100 #FFCC0098 White False False All Header Contains PlainText .pw> Header Contains RegEx Received: from ns\d\.[a-z0-9]+\.pw\s .sbs domain spam True -100 #FFCC0098 White False False All From Contains PlainText .sbs> Body Contains PlainText .sbs/ Viagra Spam False -200 #FFCC0098 White False False All Subject Contains PlainText Viagra/Cialis/Levitra Subject Contains PlainText Buy Vaigra Subject Contains PlainText Always be ready. Subject Contains PlainText impotenc Subject Contains PlainText se>.< Subject Contains PlainText dysfunction Subject Contains PlainText $_e'xual Subject Contains RegEx (blue|love).?pills?\b Subject Is PlainText Be ready. Subject Contains RegEx \b(ciali[a-z]|levitra|viagra|VIGARA|Viigaaraa|Vi@gra|Pfizer|^Pending\ delivery)\b|(?-i)C[i1]al[i1]s|Kamagra Subject Contains RegEx (?-i)ED[_\s]dysfunction|\sED\.|[Aa]nti-ED Subject Contains RegEx (?-i)Online\ V[a-z1]{1,4}A\ Store Subject Contains RegEx ^user\ .+brand\ \d\d%\ Off\ Sale Subject Contains PlainText success stories about V Subject Contains RegEx personal\ \d\d%\ dis[cs]ount Subject Contains RegEx V I A G R A Header Contains RegEx Last Longer Viagra Spam False -200 #FFCC0098 White False False All Header Contains PlainText underhillzz.com Erectile Dysfunction Sapm False -200 #FFCC0098 White False False All EntireMessage Contains PlainText Erectile Dysfunction False -100 #FFCC0098 White False False All Body Contains PlainText .digitaloceanspaces.com/ Jinkmail True -100 #FFCC0098 White True False All Subject Contains PlainText Wiz, welcome to your new Pixel From Contains PlainText googlepixel-noreply@google.com X-Mailer: PHPMailer False 0 #FF434343 White False False All Header Contains PlainText X-Mailer: PHPMailer Russian X-Mailer Tool False -200 #FFCC0098 White False False All Header Contains PlainText Php_libMail_v_2.11(webi.ru) Header Contains PlainText X-Mailer: Php_libMail Amazon Scam True -100 #FFFFE500 Black False False All From Contains PlainText @amazon.com ReturnPath NotContain RegEx @(bounces\.)?amazon.com Not A Scam True 200 #FF149899 White False False False All From Contains RegEx (service|paypal)@paypal.com Header Contains RegEx Received:\ from\ (mx\d\.(phx|slc)\.paypal\.com|$?\[173.0.84.\d{1,3}\]|helo=mx\d{0,3}\.slc\.paypal\.com|.+\.paypalcorp\.com|mail\d{1,4}.\.paypal.mkt2944.com) Header Contains RegEx DKIM-Signature:\s.+\sd=paypal.com; Not A Scam True 100 #FF149899 White False False All From Contains PlainText noreply@mail.paypal.com Header Contains RegEx domain\ of\ bounce@mail\.paypal\.com\ designates\ 142\.54\.244\.\d{1,3}\ as\ permitted\ sender Header Contains PlainText Return-Path: <bounce@mail.paypal.com> PayPal Phishing Scam True -100 #FFCC0098 White False False All Header NotContain RegEx Received:\ from\ ([a-z0-9.-]+\.(epsl1|paypal)\.com\s|\[(\d{1,3}\.){3}\d{1,3}\]\ \((port=\d{4,5}\s)?helo=mx\d\..{3}\.paypal\.com$\s?\n|helo=outbound\.na\.e\.paypal\.com\)\n Header NotContain RegEx ^Received:\ from\ \[[0-9.]+\]\ $port=\d{4,5}\ helo=mail2550.paypal.mkt2944.com$\s?\n Header NotContain RegEx ^Received:\ from\ ccg\d\dmail\d\.ccg\d\d\.slc\.paypalinc\.com From Contains RegEx .+@(intl|www[-\.])?paypal(-us)?.com|^PayPa[l1I]|paypai\.com PayPal Phishing Scam True -100 #FFCC0098 White False False All Body Contains RegEx ^Dear\ PayPal\ (User|Member|Customer)|Your\ paypal\ access\ has\ been\ limited Header NotContain PlainText nix.paypal.com PayPal Scam True -200 #FFCC0098 White False False All From Contains PlainText service@paypal.com Header NotContain RegEx Received:\ from\ (mx\d\.slc\.paypal\.com|\(?\[173.0.84.\d{1,3}\]|helo=mx\d{0,3}\.slc\.paypal\.com|ccg\d\dmail\d\.ccg\d\d\.slc\.paypalinc\.com) XLSM Attachment/Stream False -150 #FFFFE500 Black False False All EntireMessage Contains RegEx Content-Disposition:\ attachment;\ filename=".+\.xlsm" EntireMessage Contains RegEx Content-Type:\ application/octet-stream;\ name=".+\.xlsm" Likely Sextortion Scam True -100 #FFCC0098 White False False All Body Contains PlainText Send Body Contains PlainText video Body Contains RegEx Bitcoin|bitcoin Body Contains RegEx address|wallet Body Contains RegEx (1|3|bc)(\d|\w){32,34}(=)?\s Googleapis Spam False -150 #FFCC0098 White False False All Body Contains RegEx https://storage.googleapis.com/.+ Body Contains RegEx <title>\nfacebook.com\ngoogle.com\namazon.com\nebay.com\ntwitter.com\nfacebook.com\ngoogle.com\namazon.com\nebay.com\nfacebook.com\ntwitter.com\n xn--p1ai or ru Russian Domain False -100 #FFCC0098 White False False All From Contains RegEx @.+\.ru> EntireMessage Contains PlainText xn--p1ai Body Contains PlainText .ru? Body Contains PlainText http://rhettacarolynn Invisible Text False -100 #FFCC0098 White False False All Body Contains RegEx (<|<)font.+color.+#f3f3f3.+(>|>)[0-9A-Za-z]+ Body Contains RegEx (<|<)span\ (=\n)?style=3D("|")\s?color:\s?(=\n)?#F.F.F.("|")(>|>)( |\s)?[A-Za-z0-9]{1,} Body Contains RegEx (<|<)span\ style=(3D=)?.*\n?"LINE-HEIGHT:\ 0px;\ DISPLAY:\ inline;.+\n?.*OVERFLOW:\ hidden.*(>|>)[a-zA-Z0-9]* Body Contains RegEx (<|<)(div|span)\ (=\n)?style=3D(=\n)?("|")\s?color:\s?(=\n)?#F.F.F.;?(\s?font-size:[0-8]p.)?("|")(>|>)( |\s)?[A-Za-z0-9]{1,} HTML Entity in Domain Name False -100 #FFCC0098 White False False All Body Contains PlainText 。 Character Code Viagra Spam True -100 #FFCC0098 White False False All Body Contains PlainText Ɣ Body Contains PlainText i Body Contains PlainText Ľ Body Contains PlainText   Body Contains PlainText Body Contains PlainText &nbs= Fake Pharmacy False -100 #FFCC0098 White False False All EntireMessage Contains PlainText Canadian Pharmacy Subject Contains RegEx ([CS]ertified|Best) Pharmacy Canadian Pharmacy Spam 2021/22 True -100 #FFCC0098 White False False All Body Contains PlainText <td>CA Body Contains PlainText <td>NA Body Contains PlainText <td>DI Body Contains PlainText <td>AN Webmail Verification Scam True -200 #FFCC0098 White False False All Subject Is PlainText Verification of your email account Body Contains PlainText You have 1 technical message regarding your mail security. Body Contains PlainText has Body Contains PlainText been Body Contains PlainText BLACKLISTED Body Contains PlainText webmail network service Body Contains PlainText due to Body Contains PlainText subsequent verification Body Contains PlainText failure Body Contains PlainText your Body Contains PlainText Account. Subscription Renewal Scam False -100 #FFCC0098 White False False All Body Contains PlainText ORPHANS: 2; WIDOWS: 2; Body Contains PlainText +1 888 - 499 - 2280 Body Contains PlainText our previous subscription plan is expired today, so we have renew Body Contains PlainText Should you have any query OR you wish to draw the charges Body Contains PlainText Please reach out to our Administration Dept. # +1 [888]- Phishing Scam False -100 #FFCC0098 White False False All Subject Contains PlainText EMAIL SERVER UPDATE Body Contains PlainText use the below link to update your email quota Business4today.com spam False -100 #FFCC0098 White False False All EntireMessage Contains PlainText Business4today.com EntireMessage Contains PlainText @business4today.com From India False -100 #FFCC0098 White False False All Header Contains RegEx Date:\s.+\s\+0530 From Pakistan +0500 False -200 #FFCC0098 White False False All Header Contains RegEx Date:\s.+\s\+0500 HTML Spam Template Code False -150 #FFCC0098 White False False All Body Contains PlainText unstyle-auto-detected-links"> Ace Hardware Scam False -150 #FFCC0098 White False False All Subject Contains PlainText Congratulations Ace Customer, You renewal-by-andersen False -150 #FFCC0098 White False False All From Contains PlainText renewal-by-andersen Body Contains PlainText <img alt="Renewal By Andersen Window Replacement" Huusk Knives False -150 #FFCC0098 White False False All EntireMessage Contains PlainText Huusk Wallet Guru Spam False -200 #FFCC0098 White True False False All Header Contains PlainText wallet_guru Header Contains PlainText Wallet Guru seniorperks False -200 #FFCC0098 White False False All Header Contains PlainText seniorperks Header Contains PlainText SeniorPerks Header Contains PlainText senior_perks Header Contains PlainText Senior Perks Header Contains PlainText senior_savings Header Contains PlainText Senior Savings galacticspinner False -200 #FFCC0098 White False False All Header Contains PlainText galacticspinner Header Contains PlainText GalacticSpinner bathroom-remodeler False -200 #FFCC0098 White False False All Header Contains PlainText bathroom-remodeler Header Contains PlainText Bathroom Remodeler Header Contains PlainText bathroom_remodel Header Contains PlainText Bathroom Remodel easy-canvas False -200 #FFCC0098 White False False All Header Contains PlainText easy-canvas Header Contains PlainText Easy Canvas Header Contains PlainText canvas.prints Header Contains PlainText Canvas Prints Header Contains PlainText canvasprints Header Contains PlainText CanvasPrints curious.finds False -200 #FFCC0098 White False False All Header Contains PlainText curious.finds Header Contains PlainText Curious Finds Header Contains PlainText curious_finds Known Scammer False -150 #FFCC0098 White False False All From Contains PlainText Aaron Jimenezz From Contains PlainText G E E K S Q Ad Restriction Scam True -100 #FFCC0098 White False False All From Contains PlainText Meta From Contains PlainText Business Header Contains PlainText salesforce.com Header Contains PlainText X-Sender: postmaster@salesforce.com Subject Contains PlainText Your ad Body Contains PlainText Meta Team SPF Fail True 0 #FF434343 White False False All Header Contains PlainText X-SPF-Check: Header Contains PlainText is not allowed to send mail from Award Program Scam False -100 #FFCC0098 White False False All EntireMessage Contains PlainText Burton Award Program EntireMessage Contains PlainText Best of Burton Award EntireMessage Contains PlainText Luci Edwards EntireMessage Contains PlainText businessawardlocal.com