// MailWasher Pro filter rules #2, compiled and currently used by "Wiz" Feinberg, from www.wizcrafts.net. // If to be used to replace your existing filters, rename this file to: filters.txt // This page is a child of: http://www.wizcrafts.net/mailwasher.html and http://www.wizcrafts.net/mwp-filters.html where you can get MailWasher Pro, or learn more about it. // // If these rules prove beneficial to you, please make a donation, at: http://www.wizcrafts.net/donations/ // Thanks :-) // // READ THESE NOTES! They are being updated frequently with important information that may affect filtering and flagging and actions. // // Indicates a comment, and is not parsed. // // IMPORTANT READ THE FOLLOWING! // If you make changes to this file while MailWasher Pro is running, the changes will be overwritten when MailWasher Pro is closed. // To be safe, close MailWasher first,then edit the filters. Or, edit them within MailWasher using the Filter Sidebar (Control + F7). // I have had reports about corruption when copying and pasting my filters into existing filters.txt files. Most of the time this is caused because the text editor you are using is allowing a mixture of Unicode and Ascii entries to be copied. // If you experience MailWasher wiping out the pasted in filters, after you re-open it (assuming it was not running at all when you saved the changes), do this. // When copying and pasting some or all of these filters into your own "filters.txt," if you are using a text editor that is unicode-aware, you should not just SAVE the file. Rather you should use the "Save AS" feature to save the file as either all ASCII or all UNICODE. MailWasher will accept either, but can only deal with one at a time. // // Personally identifiable rules have been deleted from this list. You should create your own rules to deal with your domain name or email address in the Subject or From fields. // Sample rule for spam sent to an non-existent account on your Domain server, - contacts@yourDomain ... // (ex:) [enabled],"contacts@YourDomain.com","Contacts Spam",16711680,OR,Hidden,Delete,To,contains,contacts@YourDomain.com,EntireHeader,contains,contacts@YourDomain.com,Subject,contains,contacts@YourDomain.com,From,contains,contacts@yourDomain // The following are actual, functional rules, ready to drop in to your existing Mailwasher Filters. There may be duplicates because some are from common rules sources. // There must not be any blank lines from the start of the list to the end. Each rule must be on one continuous line, with a linefeed between rules. The last rule must end at the end of it's line, without a linefeed! // Turn off word wrap to view these rules. // Be sure you add your friends and contacts to your Friends List, or the image and PDF spam filter rules may delete email you wanted. // Removed undesirable "Bounce" directives on August 8, 2007. Bouncing no longer works for modern spam as the Return To and From field is always forged and is sent from zombie botnetted home or office computers. // Bouncing also creates more backscatter of useless, undeliverable email, which email servers must deal with. // On August 11-12, 2007: Removed all instances of actions "Hidden," and "Automatic." Reduced "Blacklist" command usage, except for 419 scams. // Email matching rules will be flagged as the various types of spam but you will have to delete them manually, by clicking the "Process Email" button. // You can change the action back to automatic, hidden, or blacklist if you wish, by editing the action rules here, or with MailWasher Pro's Filter sidebar. // Please read the Blocked Countries filter and remove any extensions for Countries you get legit email from. Use caution with all of the Country-based filters! Disable any that block legitimate foreign email. // Rearranged filters according to my own usage; most current rules nearest the top; catch-alls near bottom. // Recent filter additions: // May 2, 2010: New filter: DROA Domain Renewal Scam // May 9, 2010: New filter: Software For Windows (pirated) // May 27, 2010: New filter: iTunes Hostile Attachment // May 29, 2010: Replaced all of these filters with my current filterset, minus Automatic deletions. // June 22, 2010: New filter: Courier Scam #4 // Aug 11, 2010: "Viagra.com Spam" renamed to "Viagra Spam [From]" // Aug 14, 2010: New filter: "Pics Spam" - just below Porn Spam filter // Aug 25, 2010: New filter: Eastern European Sender // Filters updated last week: Misspelled Viagra, Unlicensed Prescription Drugs. New filter: Eastern European Sender // Filters previously updated this week: Counterfeit Goods, Twitter Scam (+ moved up) // Last updated filters on September 2, 2010: Courier Scams #3 and #4; Watches // All of these comments will be erased as soon as you save this file as filters.txt and activate MailWasher Pro. Keep a copy of this file on hand. [enabled],"AVG Returned Email","AVG Bounces",16711680,OR,Delete,Body,contains,"This is the AVG E-mail Scanner program.",Body,contains,"I'm sorry to inform you that the message",Subject,contains,"Undelivered Mail Returned to Sender" [enabled],"Restored by MWP","Restored by MWP",26112,AND,Legitimate,TakesPrecedence,EntireHeader,contains,"Resent-From: ""MailWasher Pro recycle bin""" [enabled],"Mailwasher Reports","MWP Report",26112,AND,Legitimate,Subject,contains,"MailWasher Pro summary" [enabled],"Chase Bank Online",filtered,26112,AND,Legitimate,From,containsRE,(?-i)Chase|@.+\.chase.com,EntireHeader,containsRE,"Received:\ from\ .{4,8}\.jpmchase\.com" [enabled],"Unlicensed Prescription Drugs",Pharmaceuticals,16711680,OR,Delete,From,containsRE,Doctor|Restricted|Rx|Meds|M3ds|Medd[sz]|Medz|V[i1l|]c[o0]d[i1l|]n|Perc[o0]cet|Pharma,Subject,contains,Oxycontin,Subject,contains,"without a prescription",Subject,contains,"EMS Delivery",Subject,containsRE,(?-i)Adderall?|CODEINE|Phentermine|Perco[cs]e.?t|Rit[ai]lin|Valiu[mn]|Vicodin?,Body,contains,"No RX required!",Body,contains,rxrefill.com,Body,contains,"no prescription needed",Body,contains,"medications available without a prescr",Body,contains,http://health.groups.yahoo.com/group/,Body,containsRE,(?-i)Codeine|Valium|Vicodin|Percocet|Phentermine|Ritalin [enabled],"Viagra Spam [From]","Viagra Spam",16711680,OR,Delete,TakesPrecedence,From,contains,Pfizer,From,contains,viagra.com,From,contains,"Free To Try",From,contains,"® Official Site",From,containsRE,"VI[A@]G®A|V[I1]AGR[A@]|Viag.?ra|viagar|ivagra|v[ia]{2}gra|v[iy]arga|V_I_A_G_R_A|Cia1is|^i?Ci?a.?li?s\b|Impotence|sexual\ health",From,containsRE,Erectile|Erection|\bP[i1l]lls\b|(Potency|Sex)\s?Tablets|(Anti.?)?(?-i)ED\b|[Aa]nti-ed,From,contains,"sex remedies" [enabled],"Viagra Spam [S]","Viagra Spam",16711680,OR,Delete,TakesPrecedence,Subject,contains,"Always be ready.",Subject,contains,impotency,Subject,contains,se>.<,Subject,contains," dysfunction",Subject,contains,$_e'xual,Subject,containsRE,(blue|love).?pills?\b,Subject,is,"Be ready.",Subject,containsRE,"\b(ciali[a-z]|levitra|viagra|VIGARA|Pfizer|^Pending\ delivery)\b",Subject,containsRE,(?-i)ED[_\s]dysfunction|\sED\.,Subject,containsRE,"(?-i)Online\ V[a-z1]{1,4}A\ Store",Subject,containsRE,"^user\ .+brand\ \d\d%\ Off\ Sale",Subject,contains,"success stories about V",Subject,containsRE,"personal\ \d\d%\ dis[cs]ount" [enabled],"Viagra Spam [S] #2","Viagra Spam",16711680,OR,Delete,TakesPrecedence,Subject,contains,"on Pfizer",Subject,contains,"Re: Please, placce you order now",Subject,contains,"Re: Please, conflrm you receipt",Subject,containsRE,"Hey,?\ [a-z0-9]+,?\ get\ percent [0O]FF",Subject,containsRE,".+\d\d% (off\s)?only\ for\ you",Subject,containsRE,".+Catch\ \d\d%\ discounts\ [a-z]+",Subject,containsRE,"^Your\ Order\ Status\ ID:\ [A-Z]{11,}",Subject,containsRE,"^Visitor\ .+'s\ personal\ \d\d%\ OFF$",Subject,containsRE,"^User\ .+\ save\ \d\d%\ now",Subject,containsRE,"^Hello,\ [a-z0-9]{3,}.?\ \d\d%\ off\ till?\ [A-Z][a-z]{3,8}\ [a-z]{3,}",Subject,containsRE,"^(RE:\ )?(January|February|March|April|May|June|July|August|September|October|November|December)\ \d\d%\ OFF\s?$" [enabled],"Viagra Spam [B]","Viagra Spam",16711680,OR,Delete,TakesPrecedence,Body,contains,Viagra!,Body,contains,VIAGQRA,Body,contains,"Best Price for VIAGRA",Body,containsRE,"\b(Erectifix|erectile\ dysfunction|(?-i)anti-ED|(?-i)cure\ ED|(im)?potence|ED\ treatment)\b",Body,contains,"Taste the V",Body,contains,"V-letter remedy",Body,containsRE,blue.?pill?|SoftTabs,Body,containsRE,"(?-i)Vi?",Body,containsRE,viiagra|Vagria|Vgaira|Pfizer,Body,containsRE,"(Buy|order|original|with)\ .*Viagra",Body,containsRE,"Viagra\s{1,3}tabs|Viagra.+\$\d",Body,containsRE,".*viagra.*",Body,containsRE,"bring\ back\ fire\ and\ passion|make\ (luv|love)\ all\ night|endless\ climaxes|your\ xxx\ drive|sexual\ health|\bmale problems?\b" [enabled],"Misspelled Viagra [S]","Viagra Spam",16711680,OR,Delete,Subject,contains,VlsAGRA,Subject,contains,VIAGQRA,Subject,contains,Vlagrxa,Subject,containsRE,"^V.{4,6}a\s\d\d\s?mg",Subject,containsRE,(V|\\/|/)[i|l!1]agr[a@],Subject,containsRE,\bv.i.a.g.r.a\b,Subject,contains,Vyagra,Subject,containsRE,(?-i)V[iy]a(rga|gar|gra),Subject,contains,Vgaira,Subject,containsRE,VAIGRA [enabled],"Canadian Pharmacy","Canadian Pharmacy",16711680,OR,Delete,TakesPrecedence,From,containsRE,CANAD[i1l|]AN.?(Meds|Ph[a4@]rm),Subject,containsRE,"(?-i)Canada\ Pharmacy|Canad[1i]an.?(Drugs|Meds|Pharmacy|P\.h\.a\.r\.m\.a\.c\.y|RX|Health\ (&|adn|and)\ Care\ Mall|Healthcare)|me\s?ds\ from\ Canada|^re:.{3,4}(?-i)Doctor\ [A-Z].+",Subject,containsRE,"^\d\d\ percent\ discount$",Body,containsRE,"(?-i)Canadian.{0,15}(Chemist|Healthcare|Medd?s|Medical|Pharmacy|Pharmacies|Pric(es|ing)|RX)",Body,contains,"Canadian Health and Care Mall",Body,contains,"Canadian Health & Care Mall",Body,contains,"We ship Worldwide! To all countries! To all destinations!",Body,contains,"This email was sent by: CMD",Body,contains,,Body,contains,"preparations for immunity improvement",Body,containsRE,"Canadian.?(online\s)?(drugstore|Phar?|p\.h\.a\.r\.m\.a\.c\.y)|Pharma?.*(Canada|market)|Pharmacy\ Online|Canada\ Drugs|C@n@di[a-z&;]{1,9}n|h@rm[a@]cy|Ρ.{0,2}h(a|&a|@)",Body,containsRE,"^.+>>>$",Body,contains,MEDRX [enabled],"Male Enhancement [S] #2","Male Enhancement",16711680,OR,Delete,Subject,containsRE,(?-i)Mega\s?(Dik|size)|E?Xtra\s?size|Manster|MaxGentleman|Max.?Man|Sizeable|VPXL,Subject,containsRE,"Gains?\ (up\ to\ )?(\d\+?\s)?(inches\ )?in\ (girth|length|size)|Gaining\ inches",Subject,containsRE,(big(ger|gest)?|fuck|hard(er)?|gigantic|love|man)\s(pecker|pole|rod|sausage|stick|tool|weapon),Subject,containsRE,"(get|grow)\ (a\s)?bigger|sc?h[l1][o0]ng|love\ muscle|your\ small\ (di.?k|stick)|your\ little\s",Subject,containsRE,"elongate|enhancements?|en[l|1]a?rge(d|ment)|Enlarge,\ Widen\ and\ Strengthen|enlarge\ and\ lengthen|enlarge\syour|(Enlarge|Super-Size)\ It|Upsize\ your\ D[il]C?'?K",Subject,containsRE,"(bat|bulge|monster|python|rocket|snake)\ in\ your\s{0,3}(pants|pocket|trousers)|trouser\ snake|giant\ bulge",Subject,containsRE,"Longer\ Harder\ Thicker|(harder|thicker)\ and\ longer|long(er)?\ and\ thick(er)?|thicker\ shaft|\b(bigger|harder|larger|thicker|your)\ (?-i)(PE)\b",Subject,containsRE,"(longest|your)\ device\b|short(er)?\s?Penis|Peni[l1]e|pen.?[i1l!]s\b|p[e3]nis|pen-nis|p\ e\ n\ [i1l]\ s|\bp[aei3]nis\b",Subject,containsRE,"add\ (\d\s)?inche?s|\d\ inn?cc?hes|girth,?\s( and\s)?(length|lenght)|(length|lenght)\ and\ (girth|thickness)|thickness\ (a[nd][dn])\ length",Subject,containsRE,"Bring\ her\ to\ seventh\ heaven|huge\s?(dic'?k|dignity|package)|problems?\swith\ssize|size\ (really\s)?(does\s)?matters?|I've\ gained\ an\ inch|your\ dic?'?k\ size|rock\ hard|Impress\ .*wom[ae]n",Subject,containsRE,"your\s?(male\ p[a@]ck[a@]ge|copulation|manhood|manliness|masculinity|(new|your)\ (tool|rod|size|weener|willy))|Bodypart|(giant|gigantic|male|man|pocket)\ tool|manly|Masculine|lovemaking|penetrate",Subject,containsRE,"boner|blue\ balls|c[o0]ck|\bcum\b|d1ck|dic'?k|\bdong\b|ejaculat(e|ion|ory)|ejauclation|Erectile|Erection|flaccid|foreplay|\bpeckers?\b|phall(i|us)?|prick|sex(ual)?|s'e[^a-z]?x|s'e_xual|\$e><" [enabled],"Male Enhancement [B]","Male Enhancement",16711680,OR,Delete,Body,containsRE,Magnum.?Pro|ManSter|Man[\s-]XL|Max[gG]ain(\+|Plus)|MaxGentleman|maxx?.?man|Megadik|PowerEnlarge|VPXL|Xtrasize\s?(\+|Plus),Body,containsRE,en(hanc|larg)ement\s?(formula|method|pills|suppliment),Body,containsRE,"(their|your)\ (enlarged|huge)\ (organ|package|prick|shaft)",Body,contains,"Extra inches gives",Body,contains,"Natural Male Enhancement",Body,contains,"Increase your organ size",Body,contains,"your manhood",Body,containsRE,Penis\s?En(hance|large)ment|Flaccid(ity)?,Body,contains,"PE forum",Body,contains,"male enhancement products" [enabled],"Pharmaceuticals [S]",Pharmaceuticals,16711680,OR,Delete,TakesPrecedence,Subject,contains,MensHealt,Subject,contains,"RE: MedHelp ",Subject,containsRE,"\b(?-i)(FDA|Doctor)\ Approved",Subject,containsRE,Pharmaceutical|Pharmacy|pharmas|apothecary|(?-i)RX,Subject,containsRE,(no\s)?(pres|pers?)cription,Subject,containsRE,"\bPhar|P.?ha.{0,2}rmacy\b",Subject,containsRE,med[il|1]c(al|ations?|ines?)|\bm3ds|medds|medzz?\b|(order|purchase|your)\smeds|drug.?store|usa.?drug,Subject,containsRE,PH.*[A@(/\)]RM[A@(/\)],Subject,containsRE,"health supersite",Subject,containsRE,"^discreet\ (delivery|packing|shipping)|worldwide\ delivery",Subject,containsRE,"save\ \d\d%\ on\ your\ (medic|meds|pharma|pills)|\d\d%\sdiscount\.\sCode\s#[a-z0-9]{4,8}|\d\d%\ personal\ discount",Subject,contains,"Enhance your life with these products",Subject,contains,"OFFICIAL SITE" [enabled],"Pharmaceuticals [B]",Pharmaceuticals,16711680,OR,Delete,Body,containsRE,"Prescription\ drugs\s{1,}without a prescription",Body,containsRE,"ON.?li[nm]e\ pharmacy|pharmacy\ club",Body,contains,PHARMACY,Body,contains,"prescription medications",Body,contains,»»»,Body,contains,"alt=3D""HUGE Discount",Body,contains,"Then I found this link and my life started changing for the better",Body,contains,"We are offering you the latest medical achievements.",Body,contains,"used to sleep in separate rooms",Body,contains,"that's when my problems in bed began",Body,contains,"delivered discreetly",Body,contains," but the results exceeded our expectations.",Body,contains,"due to intimate problems" [enabled],"Pills Spam","Pills Spam",16711680,OR,Delete,Subject,contains,P|\\S,Subject,contains,pills,Subject,containsRE,"BE$T|PILL.?S|Plills|p[i1l|!][1l|!]{2,3}s|pill\ that\ (.*)?works|Pilules",Subject,contains,MEDS,Subject,contains,generic,Body,containsRE,generics|pillstore|pillz|\bmeds\b,Body,containsRE,"(boost|our|these)\s{1,3}pills",Body,containsRE,"\b(buy|cheap|herbal|wonder)\ (drugs|pills|remed(y|ies)|solutions?)\b|pills\ at\ (dirt\s|the\s)?cheap(est)?\ prices?|medicines|your\ prescriptions",Body,containsRE,^http://.*pills.*\.com,Body,containsRE,"^" [enabled],"Courier Scam #1","Courier Scam",16711680,AND,Delete,Subject,containsRE,"(?-i)^(DHL|UPS)\ (?i)Delivery\ Problem",Body,containsRE,"we\ (failed|were\ not\ able)\ to\ deliver\ (the\ |your\ )?(postal\ )?package",Body,contains,"print out the invoice",Body,contains,"Content-Disposition: attachment;" [enabled],"Courier Scam #2","Courier Scam",16711680,AND,Delete,Subject,containsRE,"Confirm\ Your\ UPS\ Parcel\ Delivery|UPS\ Tracking\ (Number|#)",EntireHeader,doesn'tContainRE,"^Received:\ from\ [a-z0-9]+\.?ups\.com" [enabled],"Courier Scam #3","Courier Scam",16711680,AND,Delete,Subject,containsRE,(?-i)DHL,Subject,containsRE,"get\ (a|your)\ parcel|(?-i)Tracking\ NR\ \d{8,}|Error\ in\ delivery\ addres",Body,containsRE,"((our|The)\ (courier|postal)\ service\ was)|(we\ were)\ (not\ |un)able\ to\ deliver\s",Body,containsRE,"Print\ this\ label\ |print\ and\ fill\ attached\ document|The\ postal\ label\ is\ attached",Body,contains,"Content-Disposition: attachment;",From,containsRE,Director|Manager|Postal|DHL [enabled],"Courier Scam #4","Courier Scam",16711680,OR,Delete,Subject,containsRE,"(Delivery\ Problem|UPS\ INVOICE) NR\d{6,8}\.",From,contains,"Fedex Manager, " [enabled],"iTunes Hostile Attachment","Hostile Attachment",16711680,AND,Delete,Subject,contains,"Thank you for buying iTunes Gift Certificate!",Body,contains,"You have received an iTunes Gift Certificate in the amount of $",Body,contains,"You can find your certificate code in attachment below. ",Body,contains,"Content-Disposition: attachment;" [enabled],"Counterfeit Goods","Counterfeit Goods",16711680,OR,Delete,From,containsRE,Gucci|Luxury,Subject,containsRE,des1gner|designer\s(brands|footwear|shoes)|modish,Subject,containsRE,\b(gucci|prada|chanel|chloe|dior|(?-i)UGG|Vertu)\b,Subject,contains,repl!c@,Subject,containsRE,Cartier|Gucci|Versace|KN[0O]CK.?[0O]FFS,Subject,containsRE,(?-i)SHOES|\bBling\b,Subject,containsRE,"luxury\ (brands|footwear)",Subject,containsRE,"Branded\ (footwear|shoes)",Subject,contains,"Clad your feet",Body,contains,"~ Gucci",Body,containsRE,"Knock.?[O0]ffs|^Luxury\ blowout\ sale",Body,containsRE,"(?-i)Vertu\s.{3,14}phones\s" [enabled],"Watches Spam",Watches,16711680,OR,Delete,TakesPrecedence,From,containsRE,"R[o0][l1]exx?|Rep[l1]icas|Watches|(Luxury|Replica)\ watch|Luxurious",Subject,is,Luxury,Subject,contains,//atches,Subject,contains,\/\/ATCHES,Subject,containsRE,"Submariner\ SS|(replica|Rolex|swiss|vip)\ watches|w\.a\.t\.c\.h\.e\.s|\ba\ watch\b|designer\ watch|watch\ brands",Subject,containsRE,"\b(R[0olex\.]{8,}|Rolex|r,?eplicas?|r\.{1,3}e\.{1,3}p\.{1,3}.l\.{1,3}i\.{1,3}c\.{1,3}a\.{1,3}|watches|chronometers|timepieces?|time\ control)\b",Body,containsRE,"luxury\ (replica|watch)|famous\ watch\ manufacturer",Body,contains,"brand name watch",Body,contains,"We only sell premium watches.",Body,contains,"exact copies of the original watches",Body,contains,"Detailed replicas of best chronometers by the best brands",Body,contains,"put one of these on your xmas list, you will fall in love with them all",Body,containsRE,"copies\ of\ [a-z]{5,}\ watch|Rolex|Rollie|replicas?\b|Submariner\ SS|watches|//atches|chronometers?|timepieces?|flashy\ bling|expensive\ watch|fashion\ pieces",Body,contains,bling.com [enabled],"Amazon.com Scam","Amazon.com Scam",16711680,AND,Delete,TakesPrecedence,From,contains,@amazon.com,EntireHeader,doesn'tContainRE,"^Received:\ from\ (mm-[a-z]{5,8}|smtp)-out-.{4,7}\.amazon\.com\ \(\[[\d\.]{11,15}\]\)$",Subject,contains,Amazon.com [enabled],"Subject contains < * + ' >","Known Spam Subjects",16711680,AND,Delete,Subject,containsRE,"(.+(\*|\+|'|<|>)){4,}" [enabled],"Known Spam Subjects #1","Known Spam Subjects",16711680,OR,Delete,Subject,containsRE,"for\ dissount|^\d\d% discount$",Subject,contains,"Can you tell me what's wrong, and how we can fix it?",Subject,contains,"No more embarrassment",Subject,contains,"New size for Men",Subject,contains,"U on board",Subject,contains,"huge dignity",Subject,contains,"Won't forget last night",Subject,contains,"Realize all of her dreams",Subject,contains,"re:Nobody will know bout your problems",Subject,contains,"Get on this right away",Subject,is,"Batteries included",Subject,containsRE,(?-i)^Mego\s.+,Subject,containsRE,^(?-i)(MSG\s)?ID:\d{5}\s.+ [enabled],"Known Spam Subjects #2","Known Spam Subjects",16711680,OR,Delete,Subject,contains,"For every men of different ages unique decision",Subject,is,"What time is okay for you",Subject,contains,"We provide for you a real advantage to turn her on",Subject,contains,"Our best decision is suitable for every age",Subject,contains,"She will call you Macho",Subject,contains,"Legendary Hero of rumors",Subject,contains,"Extend your possibilities in your private life",Subject,contains,"Know her from the sexual side how is she inside exactly",Subject,containsRE,"(guys|Mens?)\ (Love|Need)\ This|Are\ you\ ...\?|XXX\ Video",Subject,containsRE,"size\ increase|(luck|pleasure)\ in\ love|\b(?-i)[GH]uu\w{2,}|virility|bikini\s.*shoot",Subject,contains,"The most powerful weapon for your battles",Subject,contains,"Fast Shipping WorldWide",Subject,containsRE,"(Best|Finest|Good)\ ([a-z]{3,}\ )?(propos(al|ition)|solution|suggestion)" [enabled],"Known Spam Subjects #3","Known Spam Subjects",16711680,OR,Delete,Subject,is,Spamit_New_Subj,Subject,is,"Bring back time when girls were yours.",Subject,is,"Solution for your sexual life",Subject,is,"You can do anything with it",Subject,is,"you have nothing to lose, just a lot to gain!",Subject,is,"Top Quality Size",Subject,contains,"Proven Effective",Subject,contains,"Make your lady w",Subject,contains,"Relax. Take a Deep Breath",Subject,contains,"Buy now, you won't regret!",Subject,contains,"formula for men",Subject,containsRE,"^\d\d%\ off\ for\ [a-z0-9]{3,}$",Subject,containsRE,"(?-i)^from\s[A-Z][a-z]{2,}\s[A-Z][a-z]{3,}$",Subject,containsRE,"<.*details\ inside>",Subject,containsRE,"(?-i)Try\ It\ Free$|FR33|RE:\s?security\ alert!\ [a-z]{6,}$" [enabled],"Re:Your Order Approve","Approve Order Spam",16711680,OR,Delete,Subject,containsRE,"^Re:\ your?\ order\ .*approv(al|e)|approve\ your?\ order ",Subject,contains,"Please, conflrm you receipt" [enabled],"Known Spam [From]","Known Spam [F]",16711680,OR,Delete,EntireHeader,contains,"From: ""USA Government Center""",EntireHeader,containsRE,"(^From:\s{1,3}""?(Mr\.?\ Song\ Li|ph[ra]{2}macy|(?-i)E-STORE|\{|\}|""=\?ISO-8859-1\?Q\?))",EntireHeader,contains,"From: =?UTF-8?Q?=C2=",EntireHeader,containsRE,"^(?-i)IME-Version:\ 1\.0$",From,containsRE,"CanadianPharm|Rx\ The\ Best\ Source|SENATOR\ DAVID\ MARK|SexBoosters|hard.{1}on",From,containsRE,"MensHealth\.com|Extenze|Try\s?[1i]t\s?4Free|TheDR|Max-?Man|Facebook\ Manager|sexual|iContact|Pharmacy.?Online|Online.?Pharmacy|Medical|Vicodin|Drugs|penile|Potency|Sex|Pharm|Pill.?store" [enabled],"Weight Loss Drugs","Weight Loss Drugs",16711680,OR,Delete,Subject,containsRE,weight.?loss,Subject,containsRE,"Loo?s(e|ing)\s?(your\ )?(pounds|weight)|unwanted\ fat",Subject,containsRE,(?-i)Hoodia|Gordonii|Anatrim|Acai[\sBW],Body,containsRE,(?-i)Hoodia|Gordonii|Fatblaster|QuickSlim|Anatrim|Acai\s,Body,containsRE,"herbal\ (capsules|components)",Body,contains,"lose weight",Body,contains,"Amazing weight loss ",Body,contains,"your weight.",From,contains,"Lose Weight",Body,contains,WeightL0SS [enabled],"Nigerian 419 Scam #1 [S]","419 Scam",16711680,AND,Delete,Subject,contains,URGENT,Subject,contains,AND,Subject,contains,CONFIDENTIAL [enabled],"Nigerian 419 Scam #2 [S]","419 Scam",16711680,AND,Delete,Subject,containsRE,(?-i)^URGENT|CONFIDENTIAL,Subject,contains,BUSINESS,Subject,containsRE,(?-i)PROPOSAL|RELATIONSHIP [enabled],"Nigerian 419 Scam #3 [S, F, R]","419 Scam",16711680,OR,Delete,From,containsRE,BARRISTER|TRANSFER,EntireHeader,containsRE,^Reply-To:\s.+?$|thwala,Subject,is,BUSINESS,Subject,is,"URGENT BUSINESS",Subject,containsRE,"(?-i)(^CONTACT\ (\w*\s)?(COURIER\ COMPANY|ATM\ DEPARTMENT))",Subject,containsRE,"(?-i)TREAT\ (AS|VERY)\ (CONFIDENTIAL|URGENT)|(EMINENTLY|STRICTLY|URGENTLY)\ CONFIDENTIAL",Subject,containsRE,"UNITEDN\ NATION|Director,\ United\ Nations",Subject,containsRE,"^Dear\ Friend$|Urgent\ Proposal|Business\ letter\ from",Subject,contains,"FUND TRANSFER",Subject,contains,"From Barrister" [enabled],"Nigerian 419 Scam #4 [B]","419 Scam",16711680,AND,Delete,Body,containsRE,^(Kind\s)?Atte?n:|ATTENTION|Hello,Body,containsRE,"Beneficiary|(My\ )?Dear\ (GOOD\s)?(Beloved|Friend)" [enabled],"Nigerian 419 Scam #5 [B]","419 Scam",16711680,OR,Delete,Body,contains,"contacting you based on Trust",Body,containsRE,"^Hello,\ I.{0,2}m\ Sgt\.",Body,containsRE,"^(?-i)\*?(Dear\ (Sir/Madam|Friend\b)|Complement\ of\ the\ day)",Body,contains,"I need your urgent assistance in transferring",Body,contains,"Waiting to hear from you soonest",Body,containsRE,"unclaimed\ (benefits|funds)",Body,containsRE,"(I\ am|My\ name\ is)\ Barrister|^Barrister.+ESQ$|(?-i)Barrister\ [A-Z][a-z]{2,}\ [A-Z][a-z]{2,}",Body,containsRE,^Best\sregards.?\r\nBarr\..?[A-Z],Body,containsRE,"^Mr\.\ \w{3,}\ \w{3,}\ \(Barrister\)",Body,contains,"your utmost confidentiality in this matter" [enabled],"Nigerian 419 Scam #6 [B]","419 Scam",16711680,OR,Delete,Body,containsRE,"Business\ proposal\ valued\ at|(?-i)(CONFIDENTIAL\s)?(MUTUAL\s)?BUSINESS\ (PROPOSAL|RELATIONSHIP?)|URGENT\ AND\ CONFIDENTIAL",Body,containsRE,"Bank\ (of\ )?(Nigeria|Benin|(South\s)?Africa)|Benin\ Republic|Republic\ of\ Benin|Director,\ United\ Nations|REPUBLIC\ OF\ NIGERIA",Body,containsRE,"beneficiary|no\ Beneficiaries|demurrage|dumourage|duemorrage|Clearance\ Certificate\ (\r\n)?Fee|keeping\ fees|(?-i)IMMEDIATE\ RELEASE\ OF\ YOUR\ PAYMENT",Body,containsRE,"\{[a-z]{3,8}\sMillion\s[a-z-]{3,6}\sHundred\sThousand\sDollars}",Body,contains,"I am Mr. Patrick Chan",Body,contains,"Compliment of the day to you",Body,containsRE,(?-i)\bNIGERIAN?\b [enabled],"Lottery Scam","Lottery Scam",16711680,OR,Delete,Subject,containsRE,"Your\ Email\s(Address\s)?Has\ Won",Subject,containsRE,"WINNING\ (Notification|NUMBER:)|ticket\ number\ \(.+\)|(?-i)COCA\ COLA.?TOBACCO\ COMPANY|(?-I)OFFICIAL\ PRIZE\ NOTIFICATION",Subject,contains," Lottery",Subject,contains,"GO FOR CLAIM VERIFICATION FORM",From,containsRE,"(?-i)LOTTERY|NOTIFICATION\ DRAW|DRAW\ 2010",From,containsRE,"coca.?cola.*promm?o|Microsoft\ Award\ Department|Department\ of\ National\ Lotteries|Superenalotto|WORLD\ CUP|your\ email\ (address|id)\ has\ (won|been\ selected)",Body,contains,"Attn: Lucky Winner",Body,contains,"DEAR WINNER",Body,contains,"YOUR E-MAIL ADDRESS WON ",Body,contains,"please contact your fudiciary agent",Body,contains,"International Program Online Co-ordinator",Body,containsRE,"(?-i)WINNING\ NUMBER:|LOTTERY|RE:\ LOTTO|Lottery\ Coordinator|your\ email\ (ID|identity)\ has\ won",Body,containsRE,"(jackpot|International|ExxonMobil|Microsoft|National)\ (Award|Lottery)|Freelotto|fiduciary|The\ Kings\ Charity|weekly\ sweepstakes",Body,containsRE,"You\ are\ advised\ to\ keep\ this\ winning\ (.+\s)?confidential",From,contains,AFRICA [enabled],"Dating Spam","Dating Spam",16711680,OR,Delete,Subject,containsRE,"\bdating\b|single.?ladies|Married.{1,5}lonely|(?-i)Add\ Me|Find\ Someone|^Hi\ remember\ me\?|Looking\ for\ love\b|Russian\ (beauties|girls?|hotties?|lad(ies|y)|wife|wives|wom[ae]n)|we\ fucked|from\ [Rr]ussia|meet\ a\ beautiful\ girl|blonde?\ and\ cute|Meet\ that\ special\ someone",Body,contains,"Greetings! I wish to get acquainted with you",Body,containsRE,"\bdating\ (site|system)\b|dating!|flirting",Body,containsRE,"\d\d%\ of\ our\ members\ .*hooked\ up\ (using|with)\ our\ .*system|maybe\ we\ can\ hook\ up",Body,contains,"I read your profile online and I was int",Body,contains,"Please write me a letter here http://",Body,contains,"Do you like beautiful girls?",Body,contains,"good looking girl who is looking to chat with you",Body,contains,"looking for a nice guy to chat with",Body,contains,Ifoundyourprofileonline,Body,contains,HithereI,Body,containsRE,"a\ nice\ pretty\ girl|I'm\ from\ Russia|Russian\ (beaut(y|ies)|girls|lad(ies|y))|single\ Russian\ (girl|lad.{1,3}|wom[ea]n)|i\ (found|loved|was\ just\ reading)\ your\ profile|and\ i\ would\ (like|love)\ to\ get\s",Body,contains,"My pics and short video",Body,contains,"your so hot!" [enabled],"Blogger Exploit Link","Blogger Exploit Link",16711680,AND,Delete,TakesPrecedence,Subject,contains,"Blogger account",Body,contains,"Dear Blogger account owner",Body,contains,"update your Blogger account",Body,contains,"please click the following link:",Body,containsRE,"",Body,contains,"have attached your document.",Body,contains,/viewmovie.html,Body,containsRE,".(avi|mpg).exe"">",Body,containsRE,"/(ecard|install|msvideoc)\.exe("">)?",Body,containsRE,"/(best|index1|up)(\.|=2E)php""",Body,containsRE,"(?-s)^Content-Transfer-Encoding:\ quoted-printable\r\n\r\n^.+http://.+/.+\.html$\r\n^------=_NextPart_",Body,containsRE,http://.+/(begin|checkit|default|first|fresh|index1|gowatch|live(streaming)?|lol|main|news|r|showvideo|start|stream(ing)?|topnews|up|viewmovie|watch|watchit|whatsup)\.html(
)?(\r\n)? [enabled],"Exploit Link Only","Exploit Link",16711680,AND,Delete,TakesPrecedence,Subject,containsRE,"^RE:|RE:\ FW:|FW:$",Body,doesn'tContainRE,.+\r\n.+,Body,containsRE,"^http://[a-z0-9.]+\.[a-z]{2,4}/archive[0-9]{2,6}/\?id=.+@.+\.[a-z]{2,4}$" [enabled],"Numeric IP Link","Numeric IP Link",16711680,AND,Delete,Body,containsRE,"^.*http://(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/)|\d{10}:\d{2,4}/",EntireHeader,doesn'tContainRE,"^Message-ID:\ <.+@mail.gmail.com>" [enabled],"Image Spam #11","Image Spam #11",16711680,OR,Delete,TakesPrecedence,Body,contains,img0.gif,Body,contains,sdjbvsj.gif,Body,contains,8dvs9.jpg,Body,contains,"""View image in browser now""",Body,contains,"alt=""One click to open store""",Body,contains,"alt=""Cant see a picture? Click Here!""",Body,contains,"alt=""Show picture and go to site now!""",Body,contains,"alt=3D""Want to request ? It's easy to make a request online.",Body,containsRE,"^<(center|/style)>\r\n^\r\n^