// MailWasher Pro version 6.x filter rules, compiled by "Wiz" Feinberg: https://www.wizcrafts.com. // If to be used to replace your existing filters, save this file to your %AppData%\MailWasherPro\ folder, overwriting the existing filters.txt // Make sure that MailWasher Pro is completely closed before you overwrite the old file! // If these rules prove beneficial to you, please make a donation, at: https://www.wizcrafts.com/donations/ // Thanks :-) // // READ THESE NOTES! They are being updated frequently with important information that may affect filtering and flagging and actions. // // Indicates a comment, and is not parsed. // // IMPORTANT READ THE FOLLOWING! // If you make changes to this file while MailWasher Pro is running, the changes will be overwritten when MailWasher Pro is closed. // To be safe, close MailWasher first,then edit the filters. Or, edit them within MailWasher using the Filter Sidebar (Control + F7). // I have had reports about corruption when copying and pasting my filters into existing filters.txt files. Most of the time this is caused because the text editor you are using is allowing a mixture of Unicode and Ascii entries to be copied. // If you experience MailWasher wiping out the pasted in filters, after you re-open it (assuming it was not running at all when you saved the changes), do this. // When copying and pasting some or all of these filters into your own "filters.txt," if you are using a text editor that is unicode-aware, you should not just SAVE the file. Rather you should use the "Save AS" feature to save the file as either all ASCII or all UNICODE. MailWasher will accept either, but can only deal with one at a time. // // Personally identifiable rules have been deleted from this list. You should create your own rules to deal with your domain name or email address in the Subject or From fields. // Sample rule for spam sent to an non-existent account on your Domain server, - contacts@yourDomain ... // (ex:) [enabled],"contacts@YourDomain.com","Contacts Spam",16711680,OR,Hidden,Delete,To,contains,contacts@YourDomain.com,EntireHeader,contains,contacts@YourDomain.com,Subject,contains,contacts@YourDomain.com,From,contains,contacts@yourDomain // The following are actual, functional rules, ready to drop in to your existing Mailwasher Filters. There may be duplicates because some are from common rules sources. // There must not be any blank lines from the start of the list to the end. Each rule must be on one continuous line, with a linefeed between rules. The last rule must end at the end of it's line, without a linefeed! // Turn off word wrap to view these rules. // Be sure you add your friends and contacts to your Friends List, or the image and PDF spam filter rules may delete email you wanted. // Removed undesirable "Bounce" directives on August 8, 2007. Bouncing no longer works for modern spam as the Return To and From field is always forged and is sent from zombie botnetted home or office computers. // Bouncing also creates more backscatter of useless, undeliverable email, which email servers must deal with. // Email matching rules will be flagged as the various types of spam but you will have to delete them manually, by clicking the "Process Email" button. // You can change the action back to automatic, hidden, or blacklist if you wish, by editing the action rules here, or with MailWasher Pro's Filter sidebar. // Please read the Blocked Countries filter and remove any extensions for Countries you get legit email from. Use caution with all of the Country-based filters! Disable any that block legitimate foreign email. // Rearrange your own filters vertically to match the types of spam you see at the current point in time. The Rules are processed from the top down, so place most current rules nearest the top. // // Filters previously updated on September 4, 2018: Known Spam [From] // Last updated filters on September 26, 2018: Exploit Link // // NOTE! This is probably the last update I will make to this filter list for the long-outdated MailWasher version 6.x. // I will do custom filter updates on a paid basis for individual users. Contact me via my contact form at https://www.wizcrafts.com/contact.html // All of these comments will be erased as soon as you save this file as filters.txt and activate MailWasher Pro. Keep a copy of this file on hand. [enabled],"AVG Returned Email","AVG Bounces",16711680,OR,Delete,Body,contains,"This is the AVG E-mail Scanner program.",Body,contains,"I'm sorry to inform you that the message",Subject,contains,"Undelivered Mail Returned to Sender" [enabled],"Restored by MWP","Restored by MWP",26112,AND,Legitimate,TakesPrecedence,EntireHeader,contains,"Resent-From: ""MailWasher Pro recycle bin""" [enabled],"Mailwasher Reports","MWP Report",26112,AND,Legitimate,Subject,contains,"MailWasher Pro summary" [enabled],"Chase Bank Online",filtered,26112,AND,Legitimate,From,containsRE,(?-i)Chase|@.+\.chase.com,EntireHeader,containsRE,"Received:\ from\ .{4,8}\.jpmchase\.com" [enabled],"Legitimate PayPal Email","Not A Scam",26112,AND,Legitimate,TakesPrecedence,From,contains,service@paypal.com,EntireHeader,containsRE,"Received:\ from\ (mx\d\.(phx|slc)\.paypal\.com|\(?\[173.0.84.\d{1,3}\]|helo=mx\d{0,3}\.slc\.paypal\.com|.+\.paypalcorp\.com|mail\d{1,4}.\.paypal.mkt2944.com)" [enabled],"PHP Image Tag Email Harvester","Email Harvester Scam",16711680,AND,Delete,Body,containsRE,"" [enabled],"CNBC Diet Scam","CNBC Diet Scam",16711680,AND,Delete,From,contains,CNBC,From,doesn'tContain,cnbc.com,EntireHeader,contains,"X-Mailer: WhatCounts" [enabled],".EU Spam Domain Link",".EU Spam Domain Link",16711680,OR,Delete,Body,containsRE,http://[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.eu/\?.+ [enabled],"Weight Loss Scam #1","Weight Loss Scam",16711680,OR,Delete,EntireHeader,containsRE,Lbs.?[O0]FF,EntireHeader,containsRE,Slim-Fast|Slimmer|slimming,From,containsRE,(?i)Los(e|ing).?Weight|weight.?loss|FatBurning|Los(e|ing).?(Fat|Pounds)|WeightLoss|Slim|Nanoxyn\sAlpha,From,containsRE,(?-i)^(Dr\.?\s?(O|0)(Z|z)|OZ),Subject,contains,WegihtLoss,Subject,contains,"Pure Forskolin Extract",Subject,contains,"your body's natural weight",Subject,contains,"Unheard of results guaranteed",Subject,containsRE,"(?i)(Drop|Shed|your)\ Weight",Subject,containsRE,"(?i)Get\ (Skinny|Slim)|Lose.+\d\d\ lbs",Subject,containsRE,(?i)weight.?loss|Fat.?Loss|FatBurning,Subject,containsRE,\d\dkg|\bhcg\b|(?-i)Hoodia|Gordonii|Anatrim|Acai[\sBW]|HCG,Subject,containsRE,"(?i)Loo?s(e|ing)\s?(your\ )?(fat|pounds|weight)|unwanted\ fat|Lose\ \d\d\ (lbs|pounds)",Subject,containsRE,nutrionist|weight\sreduction|weight\s.*loss,Subject,containsRE,(?i)(our\s)?(diet|dietary)\s(aid|formula|medicine|pills?|plan|products|science|solution|suppliments?) [enabled],"Weight Loss Scam #2","Weight Loss Scam",16711680,OR,Delete,Body,contains,"Dr. OZ Newsletter",Body,contains,"Its The Best Product We Have Seen - Mark Cuban",Body,contains,"lose weight",Body,contains,"shed weight",Body,contains,"your weight.",Body,contains,"Weight Loss",Body,contains,"Losing Weight",Body,contains,"Amazing weight loss ",Body,contains,"kilograms a month",Body,contains,"get rid of extra pounds",Body,contains,"pounds in the next two weeks",Body,contains,"slimming product",Body,contains,"get a slim figure",Body,contains,"Better Your Body",Body,contains,"Nanoxyn Alpha" [enabled],"Weight Loss Scam #3","Weight Loss Scam",16711680,OR,Delete,Body,containsRE,"(excess|lose)\ fat",Body,containsRE,obese|obe\.se|o\.b\.esity|(?-i)Obesity,Body,containsRE,"herbal\ (capsules|components)",Body,containsRE,"http://.*greencoffe.+\.[a-z]{2,4}/",Body,containsRE,"los(e|ing)\ [a-z0-9\+]{2,8}\ kilograms",Body,containsRE,\bhcg\b|(?-i)Anatrim|Acai\s|Fatblaster|garciniacambo|Gordonii|Hoodia|QuickSlim,Body,containsRE,bodyfat|fatburn|fatsolution|healthnews|iWellHealth|sciencedaily|WeightL0SS,Body,containsRE,http://.*g?arcinia.+,Body,containsRE,drop(ped)?\s20-?lbs [enabled],"Anti-Aging Treatment Spam","Anti-Aging Treatment Spam",16711680,OR,Delete,Subject,containsRE,Anti-?Aging,Body,containsRE,anti-aging,Body,contains,Ceramide,Body,containsRE,\bFirmativ\b [enabled],"Pump and Dump Scam #1","Pump and Dump Scam",16711680,OR,Delete,EntireHeader,containsRE,"X-cid:\ scott\.\d+|pennystockcrew\.com",From,containsRE,"(?i)Stocks|(Buy|Penny).?Stock|Stock.?(Advisor|Watch)|stock.?(pick|tip)|(?-i)OTC\b|iMarket|Investors?|Investments|IHub|Money\ Runners",Subject,contains,"this company could yield you a ten bagger",Subject,contains,"stock is guaranteed to jump",Subject,contains,"on your principal in just a few days",Subject,contains,"This company just found a",Subject,containsRE,"(?i)(Best|One|this)\s?stock|stock.{0,2}(pick|tip)|Penny\ Stocks?|bioceutical|IHub|Money\ Runners",Subject,containsRE,"This\ (company|stock)\ is\ going\ to\ triple",Body,contains,"Thank me later.",Body,contains,"I'm Mike Statler",Body,contains,"and only broker",Body,contains,"stocks adviser",Body,contains,"This company is going to triple",Body,contains,"call your broker NOW before it is",Body,contains,pennystockcrew.com,Body,contains,"(use the first letters of each word to make up your 4 letter symbol" [disbled],"Pump and Dump Scam #4","Pump and Dump Scam",16711680,OR,Delete,Body,containsRE,"^(?-i)Symbol:?\ [A-Z]{3,5}",Body,containsRE,(?-i)\b(3D)?(E[_-\W\s]?C[_-\W\s]?G[_-\W\s]?R)\b,Body,containsRE,(?-i)\b(3D)?(Q[_-\W\s]?S[_-\W\s]?M[_-\W\s]?G)\b,Body,containsRE,(?-i)ISM\s?\.\s?TO|\sISM\s,Body,containsRE,(?-i)\b(3D)?(I[_-\W\s]?N[_-\W\s]?C[_-\W\s]?T)\b,Body,containsRE,(?-i)\b(3D)?(N[_-\W\s]?T[_-\W\s]?E[_-\W\s]?K)\b,Body,containsRE,(?-i)\b(3D)?(T[_-\W\s]?P[_-\W\s]?H[_-\W\s]?X)\b,Body,containsRE,(?-i)\b(3D)?(B[_-\W\s]?W[_-\W\s]?P[_-\W\s]?C)\b,Body,containsRE,(?-i)\b(3D)?(A[_-\W\s]?G[_-\W\s]?H[_-\W\s]?I)\b,Body,containsRE,(?-i)\b(3D)?(D[_-\W\s]?J[_-\W\s]?R[_-\W\s]?T)\b,Body,containsRE,(?-i)\b(3D)?(S[_-\W\s]?N[_-\W\s]?X[_-\W\s]?G)\b,Body,containsRE,(?-i)\b(3D)?(N[_-\W\s]?U[_-\W\s]?A[_-\W\s]?N)\b,Body,containsRE,(?-i)\b(3D)?(C[_-\W\s]?R[_-\W\s]?G[_-\W\s]?P)\b,Body,containsRE,(?-i)\b(3D)?(G[_-\W\s]?R[_-\W\s]?Y[_-\W\s]?N)\b,Body,containsRE,(?-i)\b(R[_-\W\s]?N[_-\W\s]?B[_-\W\s]?I)\b,Body,containsRE,(?-i)\b(I[_-\W\s]?R[_-\W\s]?M[_-\W\s]?G[_-\W\s]?F)\b,Body,containsRE,"(?-i)DYNV|Market\ News|ECMZ|Insider\ Report|Trading\ Alert",Body,containsRE,(?-i)Date:\s.+\n.*(Company|Name):\s.+\n.+\n.*\n(.*Price:|.*Target:),Body,containsRE,PennyStock|Penny.?Stock.?(Newsletter|Picks)|Investors.?Hub|iStocks|MarketWatch|PowerPlay2Day [enabled],"Recent Pump and Dump Scams","Pump and Dump Scam",16711680,OR,Delete,Body,containsRE,"^(?-i)Symbol:?\ [A-Z]{3,5}",Body,containsRE,(?-i)\b(3D)?(S[._-\W\s]?I[._-\W\s]?C)\b,Body,containsRE,(?-i)\b(3D)?(E[._-\W\s]?C[._-\W\s]?G[._-\W\s]?R)\b,Body,containsRE,(?i)\b(3D)?(Q[._-\W\s>]?S[._-\W\s>]?M[._-\W\s>]?G),Body,containsRE,(?-i)ISM\s?\.\s?TO|\sISM\s,Body,containsRE,"(?-i)DYNV|Market\ News|ECMZ|Insider\ Report|Trading\ Alert",Body,containsRE,(?-i)Date:\s.+\n.*(Company|Name):\s.+\n.+\n.*\n(.*Price:|.*Target:),Body,containsRE,PennyStock|Penny.?Stock.?(Newsletter|Picks)|Investors.?Hub|iStocks|MarketWatch|PowerPlay2Day [enabled],"Previous Pump and Dump Scams","Pump and Dump Scam",16711680,OR,Delete,Body,containsRE,(?-i)\b(3D)?(I[_-\W\s]?N[_-\W\s]?C[_-\W\s]?T)\b,Body,containsRE,(?-i)\b(3D)?(N[_-\W\s]?T[_-\W\s]?E[_-\W\s]?K)\b,Body,containsRE,(?-i)\b(3D)?(T[_-\W\s]?P[_-\W\s]?H[_-\W\s]?X)\b,Body,containsRE,(?-i)\b(3D)?(B[_-\W\s]?W[_-\W\s]?P[_-\W\s]?C)\b,Body,containsRE,(?-i)\b(3D)?(A[_-\W\s]?G[_-\W\s]?H[_-\W\s]?I)\b,Body,containsRE,(?-i)\b(3D)?(D[_-\W\s]?J[_-\W\s]?R[_-\W\s]?T)\b,Body,containsRE,(?-i)\b(3D)?(S[_-\W\s]?N[_-\W\s]?X[_-\W\s]?G)\b,Body,containsRE,(?-i)\b(3D)?(N[_-\W\s]?U[_-\W\s]?A[_-\W\s]?N)\b,Body,containsRE,(?-i)\b(3D)?(C[_-\W\s]?R[_-\W\s]?G[_-\W\s]?P)\b,Body,containsRE,(?-i)\b(3D)?(G[_-\W\s]?R[_-\W\s]?Y[_-\W\s]?N)\b,Body,containsRE,(?-i)\b(R[_-\W\s]?N[_-\W\s]?B[_-\W\s]?I)\b,Body,containsRE,(?-i)\b(I[_-\W\s]?R[_-\W\s]?M[_-\W\s]?G[_-\W\s]?F)\b [enabled],"Russian Domain Link","Russian Domain Link",16711680,OR,Delete,TakesPrecedence,Body,containsRE,http://(www\.)?(.+\.r[uo]/|.+\.r[uo](\r|\n|\s)|.+\.ua)|.+\.[se]u(/|\s|$)|.+\.by(/|\b),Body,containsRE,"www\.[a-z0-9-]{1,16}\.ru(/.+)?",Body,containsRE,"" [enabled],"Known Spam [From]","Known Spam [From]",16711680,OR,Delete,EntireHeader,containsRE,\.(bid|club|faith|host|science|space|stream|website|win)[>)],EntireHeader,contains,"From: ""Support""",EntireHeader,contains,"boundary=""--_com.android.email_",EntireHeader,containsRE,(alumni|HOTSINGLESNET|sikhguardian)\.net|offeronmail\.com,EntireHeader,containsRE,"Received:\sfrom\s\[(5\.230\.126|27.122.14|45\.35\.\d{1,3}|45\.58\.132|50\.115\.167|66\.23\.212|81\.7\.1[4-7]|95\.58\.2[01]|104.36.84|104\.217\.137|104\.254\.213|185\.105\.[4-7]|188.72.68|193\.124\.1(7[6-9]|8[0-9]|9[01])|194\.67\.222|199\.116\.11[89]|204\.188\.245|208\.89\.2(0[8-9]|1[0-5])|216.126.239)\.\d{1,3}\]\s",EntireHeader,containsRE,"From: ""(USA\ Government\ Center|News)""",EntireHeader,containsRE,"^From:\s{1,3}""?(Mr\.?\ Song\ Li|ph[ra]{2}macy|(?-i)E-STORE|\{|\}|""=\?ISO-8859-1\?Q\?)",EntireHeader,containsRE,\[198\.27\.110\.(6[4-9]|7[0-9]|8[0-9]|9[0-9]|1([0-1][0-9]|2[0-7]))\]|\[198\.50\.205\.1(2[89]|[345][0-9])\],From,containsRE,(?-i)i?[A-Z][a-z]+Health\s|iGreatLife,From,containsRE,"(Dr\.?|Doctor)\s?[O0]Z\b|[O0]Z\ .*News|Dr\.?\ Travis\ Stork|George\ Aguiar|CockBlocked|FB\ Account|FreeAdultHookup|mail\.justechnology\.com|support@aicpa\.org|Software\ Sale|OEM\ Software|Easy-E-Cards-Online|Express\ Mail\ Service|4Sale|CanadianPharm|Rx\ The\ Best\ Source|SENATOR\ DAVID\ MARK|SexBoosters|hard.{1}on|MensHealth\.com|Extenze|Try\s?[1i]t\s?4Free|TheDR|Max-?Man|Facebook\ Manager|sexual|iContact|Pharmacy.?Online|Online.?Pharmacy|Medical|Vicodin|Drugs|penile|Potency|Sex|Pharm|Pill.?store|(?-i)ANGEL",EntireHeader,containsRE,"Received:\ from\ \[23\.95\.187\.(19[6-9]|2[01][0-9]|22[012])\]",EntireHeader,containsRE,"Received:\ from\ \[36\.(5[6-9]|6[0-3])\.\d{1,3}\.\d{1,3}\]",EntireHeader,containsRE,"Received:\ from\ \[194\.67\.\d{1,3}\.\d{1,3}\]",EntireHeader,containsRE,"Received:\ from\ \[64\.71\.76\.(199|20[0-9])\]" [enabled],"X-PHP-Originating-Script Spam","Spam from PHP script",16711680,AND,Delete,EntireHeader,containsRE,"X-PHP-Originating-Script:\ \d{5}:(Api|Mailer|Qmail)\.php",EntireHeader,containsRE,"X-PHP-Originating-Script: 10\d\d:Sendmail.php" [enabled],"Malware in Attachment","Malware Attachment",255,AND,Delete,EntireHeader,contains,"Return-path: ",Body,contains,"Content-Type: application/zip;",Body,contains,"Content-Disposition: attachment;",Body,containsRE,"name="".+\.zip""" [enabled],"Possible Malware in Fake IMG Attachment","IMG subject, but ZIP attachment",255,AND,Delete,EntireHeader,containsRE,"Subject:\ (\[SPAM\]\s{2})?IMG_\d{4,5}(\.(BMP|GIF|JPE?G|PDF))?\s?\n",Body,contains,"Content-Type: application/octet-stream;",Body,containsRE,(file)?name=IMG_\d+\.zip [enabled],"Malware scam from fraud@aexp.com","Malware Scam",255,OR,Delete,ReturnPath,contains,,EntireHeader,contains,"(envelope-from )" [enabled],"ACH Fraud","ACH Fraud",16711680,AND,Delete,Body,contains," ACH ",Body,contains,Transaction,Body,contains,report,Body,containsRE,Cancell?ed|rejected,Body,containsRE,"financial\ (body|institution)|bank",Body,containsRE,"details\ in\ the\ attachment|nacha\.(org|net|us)/reports?/|(?-i)Transaction\ Report:?" [enabled],"ADP Fraud","ADP Fraud",16711680,AND,Delete,From,containsRE,(?-i)ADP,EntireHeader,doesn'tContainRE,helo=.*adp\.com\),Body,doesn'tContainRE,"?" [enabled],"BBB Fraud","BBB Fraud",16711680,OR,Delete,From,contains,"::Better Business Bureau::",From,contains,@bbb.org,Subject,contains,"BBB Case #",Body,contains,"The Better Business Bureau has been sent the above mentioned complaint from one of your clients",Body,contains,"the consumer's concern is included in attached file",Body,contains,"Business Bureau Council of Better Business Bureaus",Body,containsRE,"The\ details\ of\ the\ consumer's\ (concern|complaint)\ are\ (explained|included)\ in\ (the\s)?attached\ file\.",Body,containsRE,"Please\ (open|use)\ the\ link\ below\ to\ (re)?view\ the\ contents\ of\ the\ complaint:" [enabled],"CNN Scam","CNN Scam",16711680,AND,Delete,TakesPrecedence,From,containsRE,\b(?-i)CNN\b,EntireHeader,doesn'tContainRE,web\d\.mail\.cnn\.com|helo=.*\.(cnn\.com|mail\.turner\.com)\) [enabled],"Fox News Scam","Fox News Scam",16711680,AND,Delete,From,containsRE,Fox.?News,EntireHeader,doesn'tContainRE,helo=.+\.foxnews\.com\) [enabled],"FDIC Fraud","FDIC Fraud",16711680,OR,Delete,From,contains,FDIC [enabled],"NACHA Fraud","NACHA Fraud",16711680,OR,Delete,From,contains,NACHA [enabled],"Wire Transfer Fraud","Wire Transfer Fraud",16711680,AND,Delete,Subject,containsRE,"Wire\ [tT]ransfer",Body,containsRE,"Federal\ (Bank|Reserve)|Bank\ Account\ Operator|(?i)Operator",Body,containsRE,"Outgoing\ Wire\ transaction|by\ the\ other|Domestic\ Wire\ Transfer|WIRE\ TRANSACTION:|WIRE N:" [enabled],"Fake Query String In Link (Dangerous!)","Exploit Link",255,OR,Delete,Body,containsRE,"(?-i)http://[a-z0-9-]+\.[a-z]{2,4}/.+\.htm\?[A-Z0-9=&]+=",Body,containsRE,"(?-i)http://[a-z0-9-]+\.[a-z]{2,4}(\.[a-z]{2,4})?/.+\.htm\?[A-Z0-9=&]+=",Body,containsRE,"(?-i)/[a-z0-9]+(=\s*[a-z0-9]+)?\.htm\?[A-Z0-9]{4,7}=[A-z0-9&=]+=" [enabled],"Credit Card Locked Scam","Credit Card Locked Scam",16711680,OR,Delete,Subject,containsRE,"Your\ credit\ card\ has\ been\ b?locked",From,contains,"VISA TEAM",Body,contains,"Your credit card is locked!",Body,contains,"From your credit card has been removed",Body,contains,"Possibly illegal operation!" [enabled],"Fake Facebook Friend Request","Fake Facebook Friend Request",16711680,AND,Delete,Subject,contains," wants to be friends on Facebook",From,contains,@facebookmail.com,EntireHeader,doesn'tContain,"Received: from mx-out.facebook.com",Body,contains,"Confirm Friend Request",Body,doesn'tContain,http://www.facebook.com/n/?reqs.php [enabled],"Spoofing Facebook","Facebook Spoof",16711680,AND,Delete,From,contains,Facebook,From,doesn'tContainRE,@(support\.)?facebook(mail)?\.com,EntireHeader,doesn'tContain,"Received: from mx-out.facebook.com" [enabled],"WhatsApp Malware Link","Malware Link",16711680,AND,Delete,Body,containsRE,Whats.?App,Body,containsRE,(©|©)\s(2014\s)?Whats.?App,Body,containsRE,"New\ offline\ video\ mail|You\ have\ a\ new\ incoming\ audiomessage.|New\ voice\ mail.",Body,containsRE,"a href=""http://.+/.+\.(php|pl)""",Body,containsRE,(Autoplay|Play|Listen) [enabled],"JS Exploit HTML Attachment","Exploit Code",16711680,AND,Delete,Body,contains,"Content-Transfer-Encoding: base64",Body,contains,"Content-Disposition: attachment; ",Body,containsRE,"\ filename="".+\.html""",Body,containsRE,^DQo8c2Nya|PHNjcmlwd [enabled],"Unlicensed Prescription Drugs",Pharmaceuticals,16711680,OR,Delete,From,containsRE,Doctor|Restricted|\bRx|Meds|M3ds|Medd[sz]|Medz|V[i1l|]c[o0]d[i1l|]n|Perc[o0]cet|Phh?aa?rr?mm?a,Subject,contains,"No Prescription required",Subject,contains,"without a prescription",Subject,contains,"EMS Delivery",Subject,containsRE,Adderall?|ADIPEX|Avandia|CODEINE|HYDROCODONE|KLONOPIN|Oxycontin|Phentermine|Perco[cs]e.?t|Rit[ai]lin|Tramadol|Valiu[mn]|Vicodin?|XANAX,Body,contains,"No RX required!",Body,contains,rxrefill.com,Body,contains,"no prescription needed",Body,contains,"medications available without a prescr",Body,contains,http://health.groups.yahoo.com/group/,Body,containsRE,(?-i)Codeine|Valium|Vicodin|Percocet|Phentermine|Ritalin [enabled],"Pizza Exploit Link Scam","Exploit Link",16711680,AND,Delete,Subject,contains,"Order Confirmation",Body,contains,"You've just ordered pizza from our site",Body,containsRE,"Pizza\ .{8,30}with\ extras:",Body,containsRE,"Total (Due|to\ pay):.+[0-9]{2,3}\$",Body,containsRE,"(?-i)CANCEL\ ORDER\ .*NOW(=)?\s?\r?\n?!",Body,containsRE,"(?-i)Pizza\ by\ [A-Z]{4,}$" [enabled],"Known Malware Template","Malware Template",16711680,AND,Delete,Body,contains,"" [enabled],"Spam link with multiple long lines of characters",Pharmaceuticals,16711680,AND,Delete,EntireHeader,contains,"Content-Type: text/plain; charset=utf-8",EntireHeader,contains,"Content-Transfer-Encoding: 7bit",Body,containsRE,"^(?i)([A-Z0-9]{22,}\r?\n|\n?)[A-Z].+http://.+\.\w{2}/(\??[A-Z0-9]{22,})?(\r?\n){2,3}([A-Z0-9]{22,}\r?\n){3,}$" [enabled],"Male Enhancement [From]","Male Enhancement",255,OR,Delete,TakesPrecedence,From,containsRE,Penis|Enlarger|Maxman,From,containsRE,Dr\..?Maxman,From,contains,NEOSIZE [enabled],"Male Enhancement [S]","Male Enhancement",16711680,OR,Delete,TakesPrecedence,Subject,containsRE,(?-i)Dr\..?Maxman|E?Xtra\s?size|ErectGrow|Manster|MaxGentleman|Max.?[mM]an\b|Mega\s?(Dik|size)|NEOSIZE|Sizeable|Viamax|VPXL,Subject,containsRE,"Gains?\ (up\ to\ )?(\d\+?\s)?(inches\ )?in\ (girth|length|size)|Gaining\ inches",Subject,containsRE,(big(ger|gest)?|fuck|hard(er)?|gigantic|love|man)\s(pecker|pole|rod|sausage|stick|tool|weapon),Subject,containsRE,"(get|grow)\ (a\s)?bigger|sc?h[l1][o0]ng|love\ muscle|your\ small\ (di.?k|stick)|your\ little\s",Subject,containsRE,"elongate|enhancement|en[l|1]a?rge(d|ment)|Enlarge,\ Widen\ and\ Strengthen|enlarge\ and\ lengthen|enlarge\syour|(Enlarge|Super-Size)\ It|Upsize\ your\ D[il]C?'?K",Subject,containsRE,"(bat|bulge|monster|python|rocket|snake)\ in\ your\s{0,3}(pants|pocket|trousers)|trouser\ snake|giant\ bulge",Subject,containsRE,"Longer\ Harder\ Thicker|(harder|thicker)\ and\ longer|long(er)?\ and\ thick(er)?|thicker\ shaft|\b(bigger|harder|larger|thicker|your)\ (?-i)(PE)\b",Subject,containsRE,"(longest|your)\ device\b|short(er)?\s?Penis|Peni[l1]e|pen.?[i1l!]s\b|p[e3]nis|pen-nis|p\ e\ n\ [i1l]\ s|\bp[aei3]nis\b",Subject,containsRE,"add\ (\d\s)?inche?s|\d\ inn?cc?hes|girth,?\s( and\s)?(length|lenght)|(length|lenght)\ and\ (girth|thickness)|thickness\ (a[nd][dn])\ length",Subject,containsRE,"Bring\ her\ to\ seventh\ heaven|huge\s?(dic'?k|dignity|package)|problems?\swith\ssize|size\ (really\s)?(does\s)?matters?|I've\ gained\ an\ inch|your\ dic?'?k\ size|rock\ hard|Impress\ .*wom[ae]n",Subject,containsRE,"your\s?(male\ p[a@]ck[a@]ge|copulation|lovetoy|manhood|manliness|masculinity|(new|your)\ (tool|rod|size|weener|willy))|Bodypart|(giant|gigantic|male|man|pocket)\ tool|manly|Masculine|lovemaking|penetrate",Subject,containsRE,"boner|blue\ balls|c[o0]ck|\bcum\b|\bdong\b|ejaculat(e|ion|ory)|ejauclation|Erectile|Erection|flaccid|foreplay|\bpeckers?\b|phall(i|us)?|pleasance|prick|sex(ual)?|s'e[^a-z]?x|s'e_xual|\$e><|(?-i)d1ck|dic'?k" [enabled],"Fake Pharmacy Spam","Fake Pharmacy",16711680,AND,Delete,EntireHeader,contains,"Return-path: <>",Subject,containsRE,"beloved|girlfriend|intimate|ladies|satisfy|sex|your\ (lady|lov[ei]|girl|gf|nature|(female\s)?partner|night)" [enabled],"Russian Punycode Domain Link","Russian Punycode Domain Link",255,AND,Delete,Body,containsRE,http://.+\.xn--p1ai/ [enabled],"Empty Return-Path","Empty Return-path",255,AND,Delete,EntireHeader,contains,"Return-path: <>" [enabled],"Fake Pharmacy Spam #2","Fake Pharmacy",16711680,AND,Delete,ReturnPath,is,<>,Body,containsRE,^https?://www.google.com/url\?q=http%3A%2F%2F [enabled],"American Health Shop","Fake Pharmacy",16711680,OR,Delete,EntireHeader,contains,"American Health Shop",Body,contains,"American Health Shop" [enabled],Cialis,Cialis,16711680,OR,Delete,Subject,contains,Cialis,Subject,containsRE,"C[I|i|1|y].?[A|@].?L[i|1]{1,2}.?[S$]|(?-i)Ca[iy]lis|(?-i)Cy[al][al]is",Body,containsRE,\b(?-i)Cialis\W,Body,containsRE,C\\Ialis|C1A.LIS|tadalafil|\bCalis\b,Body,containsRE,C\s(/|1|I)\sA\s(L|I|1)\s(/|I|1)\s(S|\$) [enabled],"Viagra Spam [From]","Viagra Spam",16711680,OR,Delete,TakesPrecedence,From,contains,Pfizer,From,contains,viagra.com,From,contains,"Free To Try",From,contains,"® Official Site",From,containsRE,"VI[A@]G®A|V[I1|]AGR[A@]|Viag.?ra|Vi.gra|Vigara|viagar|ivagra|v[ia]{2}gra|v[iy]arga|V_I_A_G_R_A|Impotence|sexual\ health",From,containsRE,Erectile|Erection|\bP[i1l]lls\b|(Potency|Sex)\s?(Pills|Tablets)|\b(Anti.?)?(?-i)ED\b|[Aa]nti-ed,From,contains,"sex remedies",From,containsRE,Cii?aa?lii?s|Cia1is|C1alis|^i?Ci?a.?li?s\b|Levitra,From,containsRE,Vii?a?a?gg?a?a?rr?aa? [enabled],"Viagra Spam [S]","Viagra Spam",16711680,OR,Delete,TakesPrecedence,Subject,contains,"Always be ready.",Subject,contains,impotenc,Subject,contains,se>.<,Subject,contains," dysfunction",Subject,contains,$_e'xual,Subject,containsRE,(blue|love).?pills?\b,Subject,is,"Be ready.",Subject,containsRE,"\b(ciali[a-z]|levitra|viagra|VIGARA|Viigaaraa|Pfizer|^Pending\ delivery)\b|(?-i)C[i1]al[i1]s|Kamagra",Subject,containsRE,(?-i)ED[_\s]dysfunction|\sED\.|[Aa]nti-ED,Subject,containsRE,"(?-i)Online\ V[a-z1]{1,4}A\ Store",Subject,containsRE,"^user\ .+brand\ \d\d%\ Off\ Sale",Subject,contains,"success stories about V",Subject,containsRE,"personal\ \d\d%\ dis[cs]ount" [enabled],"Viagra Spam [S] #2","Viagra Spam",16711680,OR,Delete,TakesPrecedence,Subject,contains,"on Pfizer",Subject,contains,"Re: Please, placce you order now",Subject,contains,"Re: Please, conflrm you receipt",Subject,containsRE,"Hey,?\ [a-z0-9]+,?\ get\ percent [0O]FF",Subject,containsRE,".+\d\d% (off\s)?only\ for\ you",Subject,containsRE,".+Catch\ \d\d%\ discounts\ [a-z]+",Subject,containsRE,"^Your\ Order\ Status\ ID:\ [A-Z]{11,}",Subject,containsRE,"^Visitor\ .+'s\ personal\ \d\d%\ OFF$",Subject,containsRE,"^User\ .+\ save\ \d\d%\ now",Subject,containsRE,"^Hello,\ [a-z0-9]{3,}.?\ \d\d%\ off\ till?\ [A-Z][a-z]{3,8}\ [a-z]{3,}",Subject,containsRE,"^(RE:\ )?(January|February|March|April|May|June|July|August|September|October|November|December)\ \d\d%\ OFF\s?$" [enabled],"Viagra Spam [B]","Viagra Spam",16711680,OR,Delete,TakesPrecedence,Body,contains,Viagra!,Body,contains,VIAGQRA,Body,contains,"Viagra Professional",Body,contains,"Best Price for VIAGRA",Body,containsRE,"\b(Erectifix|erectile\ dysfunction|(?-i)anti-ED|(?-i)cure\ ED|(im)?potence|ED\ treatment)\b",Body,contains,"Taste the V",Body,contains,"V-letter remedy",Body,containsRE,"blue.?pill?|SoftTabs|\$1\.\d\d/pill\b ",Body,containsRE,"(?-i)Vi?",Body,containsRE,ViaGrow|viiagra|Vagria|Vgaira|Pfizer|Kamagra,Body,containsRE,"(Buy|order|original|with)\ .*Viagra",Body,containsRE,"Viagra\s{1,3}tabs|Viagra.+\$\d",Body,containsRE,".*viagra.*",Body,containsRE,"bring\ back\ fire\ and\ passion|make\ (luv|love)\ all\ night|endless\ climaxes|your\ xxx\ drive|sexual\ health|\bmale problems?\b" [enabled],"Misspelled Viagra [S]","Viagra Spam",16711680,OR,Delete,TakesPrecedence,Subject,contains,???g??,Subject,contains,viaqqra,Subject,contains,VIAG*RA,Subject,containsRE,viaq[ij]ra,Subject,containsRE,\bv.i.a.g.r.a\b,Subject,containsRE,"^V.{4,6}a\s\d\d\s?mg",Subject,containsRE,(V|\\/|/)[i|l!1]agr[a@],Subject,containsRE,(?-i)V[iy]a(rga|gar|gra),EntireHeader,containsRE,Subject:.+\bV[i1!l|]AGRA\b.+,Subject,containsRE,(?-i)Vlagrxa|Viagr.a|Viagr\d|Vi\dgra|Vigara,Subject,containsRE,V\lsAGRA|VIAGQRA|VAIGRA|Vyagra|Vgaira|V\|AGRA|[vw]iag.?row [enabled],"Male Enhancement [B]","Male Enhancement",16711680,OR,Delete,Body,contains,"PE forum",Body,contains,"your manhood",Body,contains,"Extra inches gives",Body,contains,"enhance your male drive",Body,contains,"Natural Male Enhancement",Body,contains,"Increase your organ size",Body,contains,"male enhancement products",Body,containsRE,Penis\s?En(hance|large)ment|Flaccid(ity)?,Body,containsRE,en(hanc|larg)ement\s?(formula|method|pills|suppliment),Body,containsRE,"(their|your)\ (enlarged|huge)\ (organ|package|prick|shaft)",Body,containsRE,Magnum.?Pro\b|ManSter|Man[\s-]XL|Max[gG]ain(\+|Plus)|MaxGentleman|maxx?.?man|Megadik|PowerEnlarge|VPXL|Xtrasize\s?(\+|Plus) [enabled],"Counterfeit Goods","Counterfeit Goods",16711680,OR,Delete,From,containsRE,Gucci|Luxury|Tiffany,Subject,containsRE,des1gner|designer\s(brands|footwear|shoes)|modish,Subject,containsRE,\b(gucci|prada|chanel|chloe|dior|(?-i)UGG|Vertu)\b,Subject,contains,repl!c@,Subject,containsRE,Cartier|Gucci|Versace|KN[0O]CK.?[0O]FFS,Subject,containsRE,(?-i)SHOES|\bBling\b,Subject,containsRE,"luxury\ (brands|footwear|needs)|looking\ classy",Subject,containsRE,"Branded\ (footwear|shoes)",Subject,contains,"Clad your feet",Body,contains,"~ Gucci",Body,containsRE,"Knock.?[O0]ffs|^Luxury\ blowout\ sale|(?-i)\sLux\s",Body,containsRE,"(?-i)Vertu\s.{3,14}phones\s" [enabled],"Watches Spam [F or S]",Watches,16711680,OR,Delete,TakesPrecedence,From,containsRE,"R[o0][l1]exx?|Rep[l1]icas|Watches|(Luxury|Replica)\ watch|Luxurious|VIP\ (Watch|G[o0]{2}ds)",Subject,is,Luxury,Subject,contains,//atches,Subject,contains,\/\/ATCHES,Subject,containsRE,"(Breitling|ROLEX)\ Discount|R_O_L_E_X",Subject,containsRE,"\bHERMES\b|\bWa.ches\b|Wat4ch|Submariner\ SS|(replica|Rolex|swiss|vip)\s?watches|w\.a\.t\.c\.h\.e\.s|\ba\ watch\b|(designer|Swiss)\ watch|watch\ brands",Subject,containsRE,"\b(R[0olex\.]{8,}|R[o0][lI1]ex|Re4plica|r,?eplicas?|r\.{1,3}e\.{1,3}p\.{1,3}.l\.{1,3}i\.{1,3}c\.{1,3}a\.{1,3}|watches|chronometers|timepieces?|time\ control)\b",Subject,containsRE,Cheap\s?(Rolex|Omega) [enabled],"Watches Spam [B]",Watches,16711680,OR,Delete,TakesPrecedence,Body,containsRE,"(luxury|luxurious|new)\ (replica|watch)|famous\ watch\ manufacturer",Body,contains,"brand name watch",Body,contains,"We only sell premium watches.",Body,contains,"exact copies of the original watches",Body,contains,"Detailed replicas of best chronometers by the best brands",Body,contains,"put one of these on your xmas list, you will fall in love with them all",Body,containsRE,"copies\ of\ [a-z]{5,}\ watch|Rolex|Rollie|\ replicas\b|Submariner\ SS|replica\ watches|//atches|chronometers?|timepieces?|flashy\ bling|expensive\ watch|fashion\ pieces",Body,contains,bling.com [enabled],"Malformed Spam Subject","Malformed Spam Subject",16711680,AND,Delete,EntireHeader,doesn'tContainRE,"^(?-i)Subject: " [enabled],"Known Spam Subjects #4","Known Spam Subjects",16711680,OR,Delete,Subject,contains,"Product Recommended by ",Subject,contains,"new In town",Subject,is,Alone,Subject,is,"Uniform traffic ticket",Subject,contains,"FDIC notification",Subject,contains,"Scan from a Xerox W",Subject,contains,"Scan from a HP ScanJet",Subject,contains,"Scan from a Hewlett-Packard ScanJet",Subject,contains,"Termination of your accountant license",Subject,contains,"Cannabis Cancer Treatment",Subject,contains,(random),Subject,contains,"- Copies of Policies.",Subject,is,"You pig!",Subject,contains,Questionary,Subject,contains,"Your CashPro Online Digital Certificate",Subject,containsRE,"^Your\ friend\ .+\ has\ recommended\ this\ great\ product\ from\s",Subject,containsRE,"^Web\ design\ and\ marketing\ \$\d\d\ /\ Month$",Subject,is,"SPECIAL PROMOCODE INSIDE",Subject,is,"SPECIAL PROMO CODE INSIDE" [enabled],".co.cc/aff/ Spam",".co.cc/aff/ Spam",16711680,AND,Delete,Body,contains,.co.cc/aff/ [enabled],"Russian Pharmacy",Pharmaceuticals,16711680,AND,Delete,Body,contains,Pharmacy,Body,containsRE,http://(www\.)?(.+\.r[uo]/|.+\.r[uo]\b|.+\.ua) [enabled],"Pharmaceuticals [S]",Pharmaceuticals,16711680,OR,Delete,TakesPrecedence,Subject,contains,MensHealt,Subject,contains,"RE: MedHelp ",Subject,containsRE,"\b(?-i)(FDA|Doctor)\ Approved",Subject,containsRE,Phramacy|Pharmaceutical|Pharmacy|pharmas|apothecary|(?-i)\bRX\b,Subject,containsRE,"no\ (pres|pers?)cription|(pres|pers?)cription\ not",Subject,containsRE,"\bPhar|P.?ha.{0,2}rmacy\b",Subject,containsRE,\bBuy\sMeds\b|med[il|1]c(al|ations?|ines?)|\bm3ds|medds|medzz?\b|(order|purchase|your)\smeds|drug.?store|usa.?drug,Subject,containsRE,PH.*[A@(/\)]RM[A@(/\)],Subject,containsRE,"health supersite",Subject,containsRE,"^discreet\ (delivery|packing|shipping)|worldwide\ delivery",Subject,containsRE,"save\ \d\d%\ on\ your\ (medic|meds|pharma|pills)|\d\d%\sdiscount\.\sCode\s#[a-z0-9]{4,8}|\d\d%\ personal\ discount",Subject,contains,"Enhance your life with these products",Subject,contains,"OFFICIAL SITE",Subject,containsRE,"Canadian\ Health.*Care\ Mall" [enabled],"Pharmaceuticals [B]",Pharmaceuticals,16711680,OR,Delete,Body,containsRE,"Prescription\ drugs\s{1,}without a prescription",Body,containsRE,"ON.?li[nm]e\ pharmacy|pharmacy\ club",Body,contains,PHARMACY,Body,containsRE,"(high.quality|prescription)\ medications",Body,contains,»»»,Body,contains,"alt=3D""HUGE Discount",Body,contains,"Then I found this link and my life started changing for the better",Body,contains,"We are offering you the latest medical achievements.",Body,contains,"used to sleep in separate rooms",Body,contains,"that's when my problems in bed began",Body,contains,"delivered discreetly",Body,contains," but the results exceeded our expectations.",Body,contains,"due to intimate problems",Body,contains,"I'm your new family physician" [enabled],"Drugstore with spaced words",Pharmaceuticals,16711680,OR,Delete,Body,contains," DRUG ",Body,contains," DRUGS",Body,contains," Drugstore " [enabled],"Pills Spam","Pills Spam",16711680,OR,Delete,Subject,contains,P|\\S,Subject,containsRE,"BE$T|\bPILL.?S\b|Plills|\bp[i1l|!][1l|!]{2,3}s\b|pill\ that\ (.*)?works|Pilules|\bPILZ\b",Subject,contains,MEDS,Subject,contains,generic,Body,containsRE,generics|pillstore|pillz|\bmeds\b,Body,containsRE,"(boost|our|these)\s{1,3}pills",Body,containsRE,"\b(buy|cheap|herbal|wonder)\ (drugs|pills|remed(y|ies)|solutions?)\b|pills\ at\ (dirt\s|the\s)?cheap(est)?\ prices?|medicines|your\ prescriptions",Body,containsRE,^http://.*(medshop|pills).*\.com,Body,containsRE,"^" [enabled],".com.ua spam domain","Ukrainian spam domain",16711680,AND,Delete,TakesPrecedence,Body,containsRE,"http://[a-z0-9\._-]{3,}\.com\.ua/" [enabled],"Pump and Dump Scam #2","Pump and Dump Scam",16711680,AND,Delete,Body,contains,$.,Body,contains,range.,Body,contains,"is selling",Body,contains,"for pennies",Body,contains,buy [enabled],"Pump and Dump Scam #3","Pump and Dump Scam",16711680,AND,Delete,Body,contains,trade,Body,contains,shares,Body,contains,value,Body,containsRE,(below|under)\s(\$1|dollar) [enabled],"Pump and Dump Scam #5","Pump and Dump Scam",16711680,AND,Delete,EntireHeader,contains,"Content-Type: multipart/related; boundary=",Body,contains,"Content-Type: multipart/alternative; boundary=",Body,containsRE,"^Content-Type:\ text/plain;\ charset=utf-8\nContent-Transfer-Encoding:\ base64\n",Body,contains,PGRpdiBkaXI9Imx0ciI+ [enabled],"Agora Financial Spoof","Pump and Dump Scam",16711680,AND,Blacklist,Delete,From,containsRE,Agora.*Financial,From,doesn'tContain,@agorafinancial.com> [enabled],"Courier Scam #1","Courier Scam",16711680,AND,Delete,Subject,containsRE,"(?-i)^(DHL|UPS)\ (?i)Delivery\ Problem|Services",Body,containsRE,"we\ (failed|were\ not\ able)\ to\ deliver\ (the\ |your\ )?(postal\ )?package",Body,contains,"print out the invoice",Body,contains,"Content-Disposition: attachment;" [enabled],"Courier Scam #2","Courier Scam",16711680,AND,Delete,Subject,containsRE,"(?-i)Confirm\ Your\ UPS\ Parcel\ Delivery|UPS\ (Tracking\ (Number|#)|Package\ [A-Z]\d{8,})",EntireHeader,doesn'tContainRE,"^Received:\ from\ [a-z0-9]+\.?ups\.com" [enabled],"Courier Scam #3","Courier Scam",16711680,AND,Delete,Subject,containsRE,(?-i)DHL|FedEx,Subject,containsRE,"get\ (a|your)\ parcel|(?-i)Tracking\ (NR|Number).?\d{8,}|Error\ in\ delivery\ addres",Body,containsRE,"((our|The)\ (courier|postal)\ service\ was)|(we\ were)\ (not\ |un)able\ to\ deliver\s",Body,containsRE,"Print\ this\ label\ |print\ and\ fill\ attached\ document|The\ postal\ label\ is\ attached",Body,contains,"Content-Disposition: attachment;",From,containsRE,Director|Manager|Postal|DHL|FedEx [enabled],"Courier Scam #4","Courier Scam",16711680,OR,Delete,Subject,contains,"DELIVER CONFIRMATION - FAILED",Subject,containsRE,"(Delivery\ Problem|UPS\ INVOICE) NR\d{6,8}\.",From,contains,"Fedex Manager, ",Body,containsRE,"^Content-Disposition: attachment; filename=""(UPS|Fedex).+.zip""$" [enabled],"Courier Scam #5","Courier Scam",16711680,AND,Delete,From,contains,"UPS ",Subject,contains,"UPS ",EntireHeader,contains,"X-Mailer: The Bat!",Body,contains,"unable to deliver",Body,contains,"print ",Body,contains,"mailing label",Body,contains,"Content-Disposition: attachment;" [enabled],"Courier Scam #6","Courier Scam",16711680,AND,Delete,Subject,contains,"DHL notification",Body,contains,"Dear customer",Body,contains,"The parcel was send your home address",Body,contains,"will arrice within 7 bussness day",Body,contains,"attached in document below" [enabled],"Courier Scam #7","Courier Scam",16711680,AND,Delete,From,containsRE,"(DHL|United)\ (Global|Parcel)|Express|info\.?\d{1,2}@ups.com",Subject,containsRE,"^(?-i)(DHL|United\ Parcel)\ (Express\s)?Services?|Express\ delivery|UPS",Body,containsRE,"^The\ parcel\ was\ sent\ (to\ )?your\ home\ add?ress?",Body,containsRE,"it\ will\ arrive\ within\ \d{1,2}\ business\ day",Body,contains,"attached in document below" [enabled],"Postal Service Scam","Courier Scam",16711680,OR,Delete,Subject,contains,"USPS Delivery Failure Notification",Subject,contains,"United Postal Service",Body,contains,"Unfortunately we failed to deliver the postal package",Body,contains,"Please print out the shipment label attached and collect the package at our office.",Body,contains,"filename=""USPS report.zip""" [enabled],"USPS Delivery Scam","Courier Scam",255,AND,Delete,From,contains,"USPS Express Services",Subject,contains,package,Body,containsRE,"US?PS\ Logistics\ Services|UPS\ ," [enabled],"Post Express Scam","Courier Scam",16711680,AND,Delete,From,contains,"Post Express",Subject,contains,"Post Express ",Subject,containsRE,(?-i)\bNR\b|Number,Body,contains,"Your package has been returned",Body,contains,"mailing label",Body,contains,"Post Express",Body,contains,Attached,Body,contains,print,Body,contains,"Content-Disposition: attachment;" [enabled],"Nigerian 419 Scam #1 [S]","419 Scam",16711680,AND,Delete,Subject,contains,URGENT,Subject,contains,AND,Subject,contains,CONFIDENTIAL [enabled],"Nigerian 419 Scam #2 [S]","419 Scam",16711680,AND,Delete,Subject,containsRE,(?-i)^URGENT|CONFIDENTIAL,Subject,contains,BUSINESS,Subject,containsRE,(?-i)PROPOSAL|RELATIONSHIP [enabled],"Nigerian 419 Scam #3 [S, F, R]","419 Scam",16711680,OR,Delete,From,contains,"Bill & Melinda Gates Foundation",From,containsRE,"(?-i)ARTHUR\ GUINNESS|BARRISTER|TRANSFER|Business\ Proposal|Micheal\ A\.\s?Potter|\(ESQ\)",EntireHeader,containsRE,^Reply-To:\s.+?$|thwala|infogatefoundation@usa\.com,Subject,contains,"Atten: Friend,",Subject,contains,"2015 Application Tender for Grant",Subject,containsRE,"(kindly|Please)\ reply/call\ me",Subject,contains," KINDLY OPEN THE ATTACHED FILE AND GET BACK TO ME",Subject,containsRE,(?-i)^(URGENT\s)?BUSINESS$,Subject,contains,"Oil license ",Subject,containsRE,"(?-i)(^CONTACT\ (\w*\s)?(COURIER\ COMPANY|ATM\ DEPARTMENT))",Subject,containsRE,"(?-i)TREAT\ (AS|VERY)\ (CONFIDENTIAL|URGENT)|(EMINENTLY|STRICTLY|URGENTLY)\ CONFIDENTIAL|CONFIDENTIALITY\ AND\ TRUST",Subject,containsRE,"UNITEDN\ NATION|Director,\ United\ Nations",Subject,containsRE,"^Dear\ Friend$|Urgent\ Proposal|Business\ letter\ from",Subject,contains,"FUND TRANSFER",Subject,contains,"From Barrister",Subject,containsRE,"^(From\s)(?-i)Mrs?[,\.]?\s?[A-Z][a-z]{2,}\s[A-Z][a-z]{1,}" [enabled],"Nigerian 419 Scam #4 [B]","419 Scam",16711680,AND,Delete,Body,containsRE,^(Kind\s)?Atte?n:|ATTENTION,Body,containsRE,"Beneficiary|(My\ )?Dear\ (GOOD\s)?(Beloved|Friend)" [enabled],"Nigerian 419 Scam #5 [B]","419 Scam",16711680,OR,Delete,Body,contains,"contacting you based on Trust",Body,containsRE,"^Hello,\ I.{0,2}m\ Sgt\.",Body,containsRE,"^(?-i)\*?(Dear\ (Sir/Madam|Friend\b)|Complement\ of\ the\ day)",Body,contains,"I need your urgent assistance in transferring",Body,contains,"Waiting to hear from you soonest",Body,containsRE,"unclaimed\ (benefits|funds)",Body,containsRE,"(I\ am|My\ name\ is)\ Barrister|^Barrister.+ESQ$|(?-i)Barrister\ [A-Z][a-z]{2,}\ [A-Z][a-z]{2,}",Body,containsRE,^Best\sregards.?\r\nBarr\..?[A-Z],Body,containsRE,"^Mr\.\ \w{3,}\ \w{3,}\ \(Barrister\)",Body,contains,"your utmost confidentiality in this matter" [enabled],"Nigerian 419 Scam #6 [B]","419 Scam",16711680,OR,Delete,Body,containsRE,"Business\ proposal\ valued\ at|(?-i)(CONFIDENTIAL\s)?(MUTUAL\s)?BUSINESS\ (PROPOSAL|PARTNERSHIP|RELATIONSHIP?)|URGENT\ AND\ CONFIDENTIAL",Body,containsRE,"Bank\ (of\ )?(Nigeria|Benin|(South\s)?Africa)|Benin\ Republic|Republic\ of\ Benin|Director,\ United\ Nations|REPUBLIC\ OF\ NIGERIA",Body,containsRE,"beneficiary|no\ Beneficiaries|codicil|demurrage|dumourage|duemorrage|Clearance\ Certificate\ (\r\n)?Fee|keeping\ fees|(?-i)IMMEDIATE\ RELEASE\ OF\ YOUR\ PAYMENT",Body,containsRE,"\{[a-z]{3,8}\sMillion\s[a-z-]{3,6}\sHundred\sThousand\sDollars}",Body,contains,"I am Mr. Patrick Chan",Body,contains,"Compliment of the day to you",Body,containsRE,(?-i)\bNIGERIAN?\b,Body,contains,(Esq.,Body,contains,"MUTUAL BUSINESS TRANSACTION" [enabled],"Possible 419 Scam","Nigerian 419 Scam",16711680,OR,Delete,Body,contains,@rediffmail.com,Body,contains,"PRIVATE AND CONFIDENTIAL",EntireHeader,contains,@hotmail.co.za,Body,contains,@hotmail.co.za,Body,contains,@live.co.za,Subject,is,"I Seek Your Consent.",From,contains,"Thomas James",EntireHeader,containsRE,\b41.(58|66|71|85|93|136|138|139|155|184|189|190|191|194|20[2-8]|21[0-24-9]|22[0-3])\.[\d\.]+ [enabled],"Lottery Scam","Lottery Scam",16711680,OR,Delete,Subject,containsRE,"Your\ Email\s(Address\s)?Has\ Won",Subject,containsRE,"WINNING\ (Notification|NUMBER:)|ticket\ number\ \(.+\)|(?-i)COCA\ COLA.?TOBACCO\ COMPANY|(?-I)OFFICIAL\ PRIZE\ NOTIFICATION",Subject,contains," Lottery",Subject,contains,"GO FOR CLAIM VERIFICATION FORM",From,containsRE,"\bLotto\b|Lottery\ Notification|International\ lottery|(?-i)LOTTERY|NOTIFICATION\ DRAW|DRAW\ 201\d",From,containsRE,"coca.?cola.*promm?o|Microsoft\ Award\ Department|Department\ of\ National\ Lotteries|Superenalotto|WORLD\ CUP|your\ email\ (address|id)\ has\ (won|been\ selected)",Body,contains,"Attn: Lucky Winner",Body,contains,"DEAR WINNER",Body,contains,"YOUR E-MAIL ADDRESS WON ",Body,contains,"please contact your fudiciary agent",Body,contains,"International Program Online Co-ordinator",Body,containsRE,"(?-i)WINNING\ NUMBER:|LOTTERY|(FREE|RE:)\ LOTTO|Lottery\ Coordinator|your\ email\ (ID|identity)\ has\ won",Body,containsRE,"(jackpot|International|ExxonMobil|Microsoft|National)\ (Award|Lottery)|Freelotto|fiduciary|The\ Kings\ Charity|weekly\ sweepstakes",Body,containsRE,"You\ are\ advised\ to\ keep\ this\ winning\ (.+\s)?confidential",From,contains,AFRICA [enabled],"Money Mule Scam #1","Money Mule Scam",16711680,OR,Delete,TakesPrecedence,Subject,contains,"We are searching for partners in USA",Body,contains,"VACANCY CODE: ",Body,contains,"EMPLOYER SNAPSHOT",Body,contains,"All banking, Western Union and cell phone expenses covered",Body,contains,"An import export company seeks remote employees in United States.",Body,contains,"managing the preparation and distribution for expected transactions",Body,contains,"(at the beginning of work) to 5-7 (after the first probation month)",Body,contains,"The main duties include receiving and making payments on client's behalf",Body,contains,"This position is for US residents only, please no applicants from other countries.",Body,contains,"Being foreign company makes it harder to manage sales transactions with US customers" [enabled],"Money Mule Scam #2","Money Mule Scam",16711680,OR,Delete,EntireHeader,containsRE,"(?-i)Rock\s?[a-zA-z]{4,8}\s?Management",Subject,contains,"Your Job Application Status ",Subject,containsRE,"Update\ on\ available\ .+positions",Body,containsRE,"range\ from\ \$35\.77\ .+ to\ \$57\.62\ .{1,4}(hr|hour).\s?",Body,contains,"An at home Key Account Manager Position",Body,containsRE,"(?-i)Rock\s?[a-zA-z]{4,8}\s?Management",Body,containsRE,[a-z0-9]+@((jobsearchoo|newstatejob|usanewjobgov)\.com|europcareers\.net) [enabled],"Work At Home Scam #1","Work At Home Scam",16711680,OR,Delete,Body,contains,"thank me later",Body,contains,"online based job",Body,contains,"working from home!",Body,contains,"make money at home",Body,contains,"Work from the house",Body,contains,"Make money online!",Body,contains," every 5 days from home",Body,contains,"at home on the computer!",Body,contains,"self-employed testimonials",Body,contains,"I had finally hit rock bottom",Body,contains,"I had reached the end of the line",Body,contains,"This is not a Pyramid or MLM Program",Body,contains,"I finally made a life changing decision",Body,contains,TeachYouToBeRich,Body,contains,"Work At Home Group",Body,contains,http://automobcode.com/,Body,contains,"Gold Digger Software",Body,contains,"We are looking for employees working remotely." [enabled],"Work At Home Scam #2","Work At Home Scam",16711680,OR,Delete,To,contains,marketer,To,contains,"Fellow Entrepreneur",From,containsRE,"W0RK\ FROM\ H0ME|Work\ (at|from)\ Home|Rock\ Cruit|Home\ Business|Home.?Job",Subject,contains,"Start making money immediately without risk",Subject,containsRE,"Work(ing)?\ (at\From)\ Home|Career\ (Finders|Hunters?)",Subject,containsRE,"^Your\ friend\ [A-Za-z]{5,10}\ has\ recommended\ this\ great\ product\ from\ ",Body,contains,"Rock Cruit Management",Body,contains,"You will love me for this!",Body,contains,"You will thank me for this!",Body,contains,"who needs a 9-5 when you got this program",Body,contains,"I was able to regain my independence using this",Body,contains,"its the greatest thing that's hapened to us all year",Body,contains,"anyone who wants to work in the comfort of their own home",Body,contains,"everybody thats got access to a computer will be able to perform this job",Body,contains,"You dont need any special skills to do this work.",Body,contains,"Hi marketer!" [enabled],"Work At Home Scam #3","Work At Home Scam",16711680,OR,Delete,Body,containsRE,Work.At.Home,Body,containsRE,"(?-i)News\ Channel.?\d{1,2}",Body,containsRE,"Don'?t\ forget\ to\ thank\ me",Body,containsRE,"http://www\.mynbcnews11\.com/|3Dcnbc7(\.[a-z]{2,4})?&btnI=3D1",Body,containsRE,"(Here'?s\ how|It's\ all\ because\ of)\ -(\s|=\r\n\s)",Body,containsRE,">(?-i)(Channel\ \d{1,2}\ )?(Career\ (Guide|News|Trends)|News\ [Dd]aily|Daily\ News|http://(localnews|newsbreaking)\d\d\.com).{0,3}",Body,containsRE,"^[iI]\ (just\s)?(earned|made|netted|profited|pulled(\ in)?)\ \$?\d{3,4}\$?\ in\ (\d\ days|less\ th[ae]n\ a\ day|a\ few\ (days|hours)|a\ couple\ (of\ )?hours)",Body,containsRE,"/\d\d(?-i)[A-Z][a-z]{3,}Thomas/"">",Body,containsRE,"^Please\ reply\ to:\ [\w\d_-]{3,9}@googlein-de\.com$",Body,containsRE,"^Marketing,\ Liaison\ and\ HR\ Department$",EntireHeader,contains,"Get paid $25 for each email you process",Body,contains,"Get paid $25 for each email you process" [enabled],"Russian Bride Scam","Russian Bride Scam",16711680,OR,Delete,Subject,containsRE,"\ ru\ girls?",Subject,containsRE,\d\d\s?y\.o\..*\sRussia,Body,contains,".ru>Marriage Agency",Body,contains,"a pretty Ukrainian lady",Body,contains,"international marriage site",Body,contains,"Look at this girl who wants to get married",Body,containsRE,"^http://date[a-z]{4,8}\.ru/",Body,containsRE,"a\ nice\ pretty\ girl|I'm\ from\ Russia|Russian\ (beaut(y|ies)|girls|lad(ies|y))|single\ Russian\ (girl|lad.{1,3}|wom[ea]n)" [enabled],"Dating Spam [From]","Dating Spam",16711680,OR,Delete,From,contains,Dating [enabled],"Dating Spam [Subject]","Dating Spam",16711680,OR,Delete,Subject,is,"Personal Invite",Subject,is,"Come to my profile",Subject,is,"New message for you",Subject,contains,(status-online),Subject,contains,"Kiss to you",Subject,containsRE,"\bdating\b|single.?ladies|Married.{1,5}lonely",Subject,containsRE,"Russian\ (beauties|girls?|hotties?|lad(ies|y)|wife|wives|wom[ae]n)|from\ [Rr]ussia",Subject,containsRE,"^Hi\ remember\ me\?|we\ fucked|blonde?\ and\ cute|(?-i)^[A-Z][a-z]{4,7}\s\d\d\s?y\.o[\.,]\s",Subject,containsRE,"(?-i)Add\ Me|Find\ Someone|meet\ a\ beautiful\ girl|Meet\ that\ special\ someone|Looking\ for\ love\b",Subject,containsRE,"Unread\ message\ from\ ~[A-Z][a-z]{3,6}\ \(uid:\d{4,6}\)" [enabled],"Dating Spam [Body #1"],"Dating Spam",16711680,OR,Delete,Body,contains,my_photo.zip,Body,contains,my_iphone_photo.zip,Body,contains,"I want to know you better.",Body,contains,"ur email from a fling app",Body,contains,"if you like what you see txt me",Body,contains,AdultFriendFinder,Body,contains,HOTSINGLESNET.NET,Body,contains,"girls at our site",Body,contains,"My pics and short video",Body,contains,"Do you like beautiful girls?",Body,contains,"Please write me a letter here http://",Body,contains,"Greetings! I wish to get acquainted with you",Body,contains,"looking for a nice guy to chat with",Body,contains,"good looking girl who is looking to chat with you",Body,contains,"I would like to find a man",Body,contains,"I saw you on this website the other day",Body,contains,asiandate.,Body,contains,anastasiadate.,Body,contains,anastasiaaffiliate [enabled],"Dating Spam [Body #2]","Dating Spam",16711680,OR,Delete,Body,containsRE,"\bdating\ (site|system)\b|dating!|flirting",Body,containsRE,"HithereI|Ifoundyourprofileonline|you(r|'re)\ so\ hot!",Body,containsRE,"(status-online)\ sent\ new\ message|waiting\ you\ for\ chat",Body,containsRE,"I\ read\ your\ profile\ online|i\ (found|loved|was\ just\ reading)\ your\ profile",Body,containsRE,"a\ nice\ pretty\ girl|I'm\ from\ Russia|Russian\ (beaut(y|ies)|girls|lad(ies|y))|single\ Russian\ (girl|lad.{1,3}|wom[ea]n)" [enabled],"Dating spam with yandex.ru email address","Dating Spam",16711680,OR,Delete,Body,containsRE,.+@yandex\.ru\b [enabled],"Pics Spam","Pics Spam",16711680,AND,Delete,Body,containsRE,"profile\ on\ facebook|\ (yo)?ur\ profile|your\ pic",Body,containsRE,"share\ (mine|my\ pics?)\ with\ you|you\ my\ pics?|see\ my\ pic|(non-public\ photos|private\ (images|photos))",Body,contains,@hotmail.com [enabled],"Numeric IP Link","Numeric IP Link",16711680,AND,Delete,Body,containsRE,"^.*http://(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/)|\d{10}:\d{2,4}/",EntireHeader,doesn'tContainRE,"^Message-ID:\ <.+@mail.gmail.com>" [enabled],"Image Spam #11","Image Spam #11",16711680,OR,Delete,TakesPrecedence,Body,contains,"Please unlock images. VERY IMPORTANT",Body,contains,"This is very important. Please enable images!",Body,contains,"You must [Enable Images] to Unlock this image",Body,contains,"Please Enable Images to View this ",Body,contains,"Please Enable Links and Images to Confirm Your Order!
",Body,contains,"'Click above to show images'",Body,contains,"""View image in browser now""",Body,contains,"alt=""One click to open store""",Body,contains,"alt=""Cant see a picture? Click Here!""",Body,contains,"alt=""Show picture and go to site now!""",Body,contains,"alt=3D""Want to request ? It's easy to make a request online.",Body,contains,"this picture is blocked. Click to unblock now",Body,containsRE,"\r\n^\r\n^