// MailWasher Pro filter rules #2, compiled and currently used by "Wiz" Feinberg, from www.wizcrafts.net.
// If to be used to replace your existing filters, rename this file to: filters.txt
// This page is a child of: http://www.wizcrafts.net/mailwasher.html and http://www.wizcrafts.net/mwp-filters.html where you can get MailWasher Pro, or learn more about it.
//
// If these rules prove beneficial to you, please make a donation, at: http://www.wizcrafts.net/donations/
// Thanks :-)
//
// READ THESE NOTES! They are being updated frequently with important information that may affect filtering and flagging and actions.
// // Indicates a comment, and is not parsed.
//
// IMPORTANT READ THE FOLLOWING!
// If you make changes to this file while MailWasher Pro is running, the changes will be overwritten when MailWasher Pro is closed.
// To be safe, close MailWasher first,then edit the filters. Or, edit them within MailWasher using the Filter Sidebar (Control + F7).
// I have had reports about corruption when copying and pasting my filters into existing filters.txt files. Most of the time this is caused because the text editor you are using is allowing a mixture of Unicode and Ascii entries to be copied.
// If you experience MailWasher wiping out the pasted in filters, after you re-open it (assuming it was not running at all when you saved the changes), do this.
// When copying and pasting some or all of these filters into your own "filters.txt," if you are using a text editor that is unicode-aware, you should not just SAVE the file. Rather you should use the "Save AS" feature to save the file as either all ASCII or all UNICODE. MailWasher will accept either, but can only deal with one at a time.
//
// Personally identifiable rules have been deleted from this list. You should create your own rules to deal with your domain name or email address in the Subject or From fields.
// Sample rule for spam sent to an non-existent account on your Domain server, - contacts@yourDomain ...
// (ex:) [enabled],"contacts@YourDomain.com","Contacts Spam",16711680,OR,Hidden,Delete,Automatic,To,contains,contacts@YourDomain.com,EntireHeader,contains,contacts@YourDomain.com,Subject,contains,contacts@YourDomain.com,From,contains,contacts@yourDomain
// The following are actual, functional rules, ready to drop in to your existing Mailwasher Filters. There may be duplicates because some are from common rules sources.
// There must not be any blank lines from the start of the list to the end. Each rule must be on one continuous line, with a linefeed between rules. The last rule must end at the end of it's line, without a linefeed!
// Turn off word wrap to view these rules.
// Be sure you add your friends and contacts to your Friends List, or the image and PDF spam filter rules may delete email you wanted.
// Removed undesirable "Bounce" directives on August 8, 2007. Bouncing no longer works for modern spam as the Return To and From field is always forged and is sent from zombie botnetted home or office computers.
// Bouncing also creates more backscatter of useless, undeliverable email, which email servers must deal with.
// On August 11-12, 2007: Removed all instances of actions "Hidden," "Automatic," and "Blacklist"; "TakesPrecedence" removed from "Japanese" filter; Blocked Countries moved down bottom; dangerous attachments group added at bottom.
// Email matching rules will be flagged as the various types of spam but you will have to delete them manually, by clicking the "Process Email" button.
// You can change the action back to automatic, hidden, or blacklist if you wish, by editing the action rules here, or with MailWasher Pro's Filter sidebar.
// Please read the Blocked Countries filter and remove any extensions for Countries you get legit email from. Use caution with all of the Country-based filters! Disable any that block legitimate foreign email.
// Temporarily disabled the image spam filters and moved to bottom, because this type of spam is dying. Subject to instant reactivation!
// Rearranged filters according to my own usage; most current rules nearest the top; catch-alls near bottom.
// December 2, 2007: (Split Pharmaceuticals and Male Enhancement filters into separate detections for Subject [S] and Body [B] word matches. Merged Canadian Pharmacy filter into Pharmaceuticals.)
// January 3, 2008, I have begun anchoring the starting characters on new lines with ^ to improve rule processing. Many rules are getting updated to include this, as is appropriate.
// January 17, 2008, I added a new filter to detect the same domain name on both sides of @ sign, in "From:" field. Removed part of .info sender filter to speed up processing.
// Last Updated on September 5, 2008 {2x} (Added Google Phishing Scam. Updated Trojan Video Link [B], Known 1-word spam subject, Viagra.com Spam, Viagra Spam [S], and Male Enhancement [S] & [B] filters.)
// All of these comments will be erased as soon as you save this file as filters.txt and activate MailWasher Pro. Keep a copy of this file on hand.
[enabled],"AVG Returned Email","AVG Bounces",16711680,OR,Delete,Body,contains,"This is the AVG E-mail Scanner program.",Body,contains,"I'm sorry to inform you that the message",Subject,contains,"Undelivered Mail Returned to Sender"
[enabled],"Restored by MWP","Restored by MWP",26112,AND,Legitimate,TakesPrecedence,EntireHeader,contains,"Resent-From: ""MailWasher Pro recycle bin"""
[enabled],"Mailwasher Reports","MWP Report",26112,AND,Legitimate,Subject,contains,"MailWasher Pro summary"
[enabled],"Multiple Forwarded Messages","Multiple Forwarded Messages",16711680,AND,To,containsRE,"(.+@.+,\s){5,}",Subject,contains,FW:
[enabled],"Angelina Jolie Video Trojan","Angelina Jolie Video Trojan",255,AND,Delete,TakesPrecedence,Subject,containsRE,"An[gj]elina\s{1,2}(Jolie\s)?(Free|naked|nude|XXX)?\s(movie|Video)|Jolie\ naked"
[enabled],XdomainY@domain,BlackList,0,AND,Delete,EntireHeader,containsRE,"^Received: from.*@(([\w\d]*)\.\w{2,4}).*^From:.*<\w{2,}\2\w+?@\1"
[enabled],"Fake Windows Update","Exploit Link",16711680,AND,Delete,TakesPrecedence,Subject,contains,"Official Update",Body,containsRE,"/.+\.exe"">"
[enabled],"Trojan Video Link [S]","Trojan Video Link",16711680,OR,Delete,Subject,containsRE,(Kick-up|News)\s-.+-\svideo,Subject,contains,"video without cowards",Subject,contains,"Re: Delivery Protection",Subject,is,"BREAKING news",Subject,is,"Weekly top news"
[enabled],"Trojan Video Link [B]","Trojan Video Link",16711680,OR,Delete,Body,containsRE,"(Kick-up|New|Shocking)\s(presentation|video)|video\ without\ cowards|mp3\ is\ shocking|Interesting\ (cd|mp3|mpeg4)|Stunning\ (mpeg4|porno|video)|porno\ dvd",Body,containsRE,"Download\ and\ watch|Download\ (it\s)?now\!|get\ this\ kick-up\ cd|Look\ (at\s)?it\ now\!",Body,containsRE,"/(play(er)?|mov|stream|vid|video_?\d?|watchit)\.exe"">",Body,contains,"Download VIDEO",Body,contains,"Open video",Body,contains,/paris_hilton,Body,contains,"PUSH TO WATCH",Body,contains,"Shocking movie",Body,containsRE,"/index[0-9]{1,2}\.html"">"
[enabled],"Trojan Video Link [S&B]","Trojan Video Link",16711680,AND,Delete,Subject,containsRE,"Britney\ Spears|(Paris|Barron)\ Hilton",Body,containsRE,"\.exe"">|/index_?\d{1,2}\.html"">"
[enabled],"Exploit Link","Exploit Link",16711680,OR,Delete,Body,contains,"Please read the attachment to get the message",Body,contains,"Please read the attachment.",Body,contains,"have attached your document.",Body,containsRE,http://.+/(begin|checkit|default|first|fresh|index1|gowatch|live(streaming)?|lol|main|news|r|showvideo|start|stream(ing)?|topnews|up|viewmovie|watch|watchit|whatsup)\.html(
)?(\r\n)?,Body,contains,/viewmovie.html,Body,containsRE,"/(install|msvideoc)\.exe"">",Body,containsRE,".(avi|mpg).exe"">",Body,containsRE,"/(best|index1|up)(\.|=2E)php""",Body,contains,"American soldiery",Body,containsRE,"(?-s)^Content-Transfer-Encoding:\ quoted-printable\r\n\r\n^.+http://.+/.+\.html$\r\n^------=_NextPart_"
[enabled],"Fake Daily Top 10","Exploit Link",16711680,AND,Delete,Subject,contains,"CNN.com Daily Top 10",From,contains,"Daily Top 10",From,doesn'tContain,cnn.com
[enabled],"Fake CNN Alerts","Exploit Link",16711680,AND,Delete,Subject,contains,"CNN Alerts: ",From,doesn'tContain,cnn.com,EntireHeader,doesn'tContainRE,"^Received:\ from\ .+\.cnn\.com\ \(\[64\.236\.31\.[0-9]+\]\)$"
[enabled],"Fake Msnbc Alerts","Exploit Link",16711680,AND,Delete,Subject,contains,"msnbc.com - BREAKING NEWS:",From,doesn'tContain,msnbc.com
[enabled],"Known Spam Subjects #1","Known Spam Subjects",16711680,OR,Delete,Subject,containsRE,"^\d\d% discount$",Subject,contains,"Can you tell me what's wrong, and how we can fix it?",Subject,contains,"No more embarrassment",Subject,contains,"New size for Men",Subject,contains,"U on board",Subject,contains,"huge dignity",Subject,contains,"Won't forget last night",Subject,contains,"Realize all of her dreams",Subject,contains,"re:Nobody will know bout your problems",Subject,contains,"Get on this right away",Subject,is,"Batteries included",Subject,containsRE,(?-i)^Mego\s.+,Subject,containsRE,^(?-i)(MSG\s)?ID:\d{5}\s.+
[enabled],"Known Spam Subjects #2","Known Spam Subjects",16711680,OR,Delete,Subject,contains,"For every men of different ages unique decision",Subject,is,"What time is okay for you",Subject,contains,"We provide for you a real advantage to turn her on",Subject,contains,"Our best decision is suitable for every age",Subject,contains,"She will call you Macho",Subject,contains,"Legendary Hero of rumors",Subject,contains,"Extend your possibilities in your private life",Subject,contains,"Know her from the sexual side how is she inside exactly",Subject,containsRE,"(guys|Mens?)\ (Love|Need)\ This|Are\ you\ ...\?|XXX\ Video",Subject,containsRE,"size\ increase|(luck|pleasure)\ in\ love|\b(?-i)[GH]uu\w{2,}|virility|bikini\s.*shoot",Subject,contains,"The most powerful weapon for your battles",Subject,contains,"Fast Shipping WorldWide",Subject,containsRE,"(Best|Finest|Good)\ [a-z]{3,}\ (propos(al|ition)|solution|suggestion)"
[enabled],"Known 1-word spam subject","Known 1-word spam subject",16711680,OR,Delete,Subject,containsRE,^(attehuor|fumerent|herkapit|Hermes|idaza|atiohar|ne-gnorw|nidnalad)$,Subject,containsRE,^(Best|Electronics|Good|Super)$,Subject,is,Rwd:,Subject,is,Vulcan!,Subject,containsRE,^[0-9]{4}$
[enabled],"Hidden ISO Subject","Hidden ISO or Ascii Subject",16711680,OR,Delete,EntireHeader,containsRE,^Subject:[^\n]*?=?ISO-8859-[^\n]*?\n,EntireHeader,contains,"Subject: =?us-ascii?"
[enabled],"Known Spam [From or Body]","Known Spam [F or B]",16711680,OR,Delete,Body,contains,"The most powerful weapon for your battles",Body,containsRE,"SpamIt\.com|8th\ march\ is\ almost\ here",Body,containsRE,"\b(show\ woman\ you(rself)?\ care|(many|Your)\ w[eo]men)\b",Body,contains,"The finest of products, at the lowest of prices:",EntireHeader,containsRE,"^From:\s{1,3}(ph[ra]{2}macy|(?-i)E-STORE|\{|\}|""=\?ISO-8859-1\?Q\?)",Body,contains,"Your tool can only get BIGGER",From,containsRE,^i?Ci?a.?li?s\b,Body,containsRE,"^Satisfy\ (your\ (girl|wom[ae]n)|her\b)",Body,contains,"gift for your lover",Body,contains,"Make her worship you"
[enabled],"Known Spam Domains","Known Spam Domains",255,OR,Delete,Body,contains,.freehyperspace2.com,EntireHeader,contains,.server4you.de,EntireHeader,contains,.ono.com,EntireHeader,contains,".es ",EntireHeader,contains,"User-Agent: Microsoft-Entourage/12.1.0.080305",EntireHeader,contains,Taipei,EntireHeader,contains,Ö,EntireHeader,contains,"Received: from %RND_IP",Body,contains,http://heartremember.com
[enabled],"Nigerian 419 Scams","419 Scam",16711680,OR,Delete,Subject,is,"URGENT AND CONFIDENTIAL",Subject,containsRE,"(?-i)(CONFIDENTIAL\s)?(MUTUAL\s)?BUSINESS\ PROPOSAL|UNITEDN\ NATION|CONTACT\ ATM\ DEPARTMENT|Director,\ United\ Nations",Subject,containsRE,"(?-i)^CONTACT\ .+\ (COURIER\ COMPANY|ATM\ DEPARTMENT)",Subject,containsRE,"(?-i)TREAT\ (AS|VERY)\ (CONFIDENTIAL|URGENT)|(EMINENTLY|STRICTLY|URGENTLY)\ CONFIDENTIAL",Body,containsRE,"^(?-i)\*?Dear\ (Sir/Madam|Friend),\*?(
)?$",Body,contains,"URGENT AND CONFIDENTIAL",Body,containsRE,"Bank\ of\ (Nigeria|Benin|(South\s)?Africa)|Benin\ Republic|Republic\ of\ Benin|Director,\ United\ Nations",Body,containsRE,"unclaimed\ (benefits|funds)",Body,contains,"contacting you based on Trust",Body,containsRE,"(Kind\s)?Attn:\s?Beneficiary|^(Hello\s)?(MY\s)?(DEAR\s)?(GOOD\s)?FRIEND[,.]|^Atte?n:Dear\ Friend,|^(Attn,\s)?My Dear\ (Beloved|Friend)[,.]$|^ATTENTION\s?:\s?BENEFICIARY.?$|(?-i)Kind\ Attn:\s?|(?-i)Beneficiary",Body,containsRE,"demurrage|dumourage|Clearance\ Certificate\ (\r\n)?Fee|keeping\ fees|(?-i)IMMEDIATE\ RELEASE\ OF\ YOUR\ PAYMENT|(I\ am|My\ name\ is)\ Barrister"
[enabled]," Spam"," Spam",16711680,AND,Delete,Body,contains,"",Body,contains,| | ,Body,contains," | ",Body,containsRE,"\.(com|net)"">Click here"
[enabled],"Postcard Trojan Scam","Postcard Scam",16711680,AND,Delete,Subject,containsRE,"\b(e-?)?(card|greeting|postcard|new\ year|Happy\ 2008!|New\ Hope\ and\ New\ Beginnings|new\s.*year)",Body,containsRE,"\b((e-?)?(post|greeting\s)?card)|new\ year\b",Body,containsRE,"^http://(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/|(.*postcards?.*|newyearwithlove|.+2008|happy.+cards?|happy2008.*?)\.com/?)"
[enabled],"Numeric IP Link","Numeric IP Link",16711680,AND,Delete,Body,containsRE,"^.*http://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/",EntireHeader,doesn'tContainRE,"^Message-ID:\ <.+@mail.gmail.com>"
[enabled],"Viagra.com Spam","Viagra Spam",16711680,OR,Delete,TakesPrecedence,From,contains,viagra.com,From,containsRE,VI[A@]G®A|VIAGR[A@]|Viag.?ra|viagar|ivagra|v[ia]{2}gra|v[iy]arga,EntireHeader,contains,wizd(ist|om).com,From,contains,"® Official Site",Subject,containsRE,"^(RE:\ )?(January|February|March|April|May|June|July|August|September|October|November|December)\ \d\d%\ OFF\s?$",Subject,containsRE,"^Your\ Order\ Status\ ID:\ [A-Z]{11,}"
[enabled],"Image Spam #11","Image Spam #11",16711680,OR,Delete,TakesPrecedence,Body,containsRE,"^<(center|/style)>\r\n^\r\n^ds)\b,Body,containsRE,"""http://(www\.)?(prescription|drug).+\.c(om|n)/?"">"
[enabled],"Male Enhancement [B]","Male Enhancement",16711680,OR,Delete,Body,contains,"a man that is big",Body,contains,"inches in length is now possible",Body,contains,"3 inch, its up to you",Body,contains,"Want 1 inch more or 3 more inches?",Body,containsRE,"(inch(es)?|larger?|stronger|true|tiny|your?)\ (lovemaking|manh[o0]{2}d|masculinity)|your\ (D[il1|]CK|love\ (stick|tool)|sex|willy)|(a|your)\ (huge|giant|larger|longer|massive)\ (\d{1,2}\sinch\s)?(shotgun|tool)",Body,containsRE,"(bat|bulge|monster|python|rocket|rod|snake|tool)\ in\ your\s{0,3}(pants|trousers)|trouser\ (mouse|snake)",Body,containsRE,"\bbest\ climax|Penetrate\ her|Make\ her\ moan|(boner|c[o0]ck|dic'k|d1ck|elongate|erections?|man\ (meat|pole|tool)|masculinity|masculine\spower|p3nis.?s|pen[i1!]s|phallus|sc?h[l1][o0]ngs?|sexually|s'e_x|se>\.?<|\$e><|(my|your|huge|larger|perfect)\ (new\s)?(dic'?k|manhood)|dic'?k\ big(ger)?|\bpeckers?\b|p[o0]rnstar.{0,2}|VPXL)\b",Body,containsRE,"Bodypart|Phallus|Fuck\s?(stick|weapon)|love\ (banana|gun|stick|wand|weapon)|(male|organ)\ (enhance|enlarge|supple)ment|sex\ life|much\ bigger\ now|problem\ with\ your\ size|size\ (really\ )?does\ matter|size\ matters|sex\ is\ great\ .+satisfy\ her|FDA\ Approved|(herbal|organic|wonderful)\ en(hanc|larg)ement\ (formula|method|pills|suppliment)|(my|your|main)\ (love|main|masculine)\ muscle|your\ huge\ package|satisfy\ (more\s)?women",Body,containsRE,"(girls|women)\ .*laugh\ at\ (m[ey]|your)|my\ girl\ loves\ the\ new\ me|my\ wife\ has\ never\ been\ happier|(Get|make)\ it\ bigger|a\ (big|huge|larger)\ you|Increase\ \w{2,4}\ size|add\ \d\ inches|problems?.?with.*size|(Amazing|Great)\ lovemaking|improves?\ your\ self-esteem|huge\ manhood|well[-\s]hung|super\ size\!",Body,containsRE,"(little|small|big(ger)?|enlarged|hard(er)?|huge|larger?|stronger|thick(er)?)\ ((fat|hard|male)\ )?(coc?k|d[i1]c?k|PE!?$|pen\sis|organ|package!|sc?hl[o0]ng|stick|tool|weener|willy)",Body,containsRE,"\bGain(ing)?\ (\d\+\s)?Inches\b|\badd\ inches\ in\s|gain\ in\ size|\d-\d\ inches\ (in|of)\ growth|add\s\d-\d\sinches\s(in|of|to)\slength|Amazing\ growth",Body,containsRE,"(big|improved|long(er)?)\ (hard\s|strong\s)?dick|GROW\ longer\ and\ harder|larger\ and\ thicker|small\ \$ize|(massive|muscular|huge)\ manhood|enlarge\ your|pleasure\ rod|dick\ thickness"
[enabled],"Casino Spam","Casino Spam",16711680,OR,Delete,Subject,contains,"YOU play we PAY",Subject,containsRE,"\b(Cas[i1]n[o0]|club\s?world|No\ Deposit\ Required|Gambling|roulette|black.?jack|poker|slot\ machines)\b",Body,containsRE,".*Casino",Body,containsRE,"(Big\ Dollars?|Free|Golden\ Gate|online|no\ deposit|the)\ Casino",From,containsRE,(?-i)Gambl(e|ing)|Casino|Casnio|Cazino,Subject,contains,"Sign up & collect $500!",Body,contains,"Sign up & collect $500!",Body,containsRE,"\b(poker|jackpot)|poker\ blackjack\ slots\b",Body,containsRE,"Club\s?World|casino\ (games|members)|(Bet|Gamble)\s{1,2}On\s{0,2}(line|credit)|^\s{1,2}Win\s{1,2}\$",Body,containsRE,"Gambling\s{1,2}(chips|credit|from\ home|online)"
[enabled],"Software Spam","Software Spam",16711680,OR,Delete,Subject,is,Software,Subject,contains,"software price$",Subject,containsRE,"(cheap(est)?|downloadable|oem|office|quality).*soft(wares?)|Soft(ware)?\ in\ many\ languages|software\ at\ (amazingly|surprisingly)\ low\ prices|perfectly\ working\ software|software\ immediately\ after\ purchase|ado6e|Vista\ Microsoft\ SP1\ and\ XP\ Cracked|Office\ (Enterprise\ 200[789]|200[789]\ Enterprise)|(?-i)(Access|Communicator|PowerPoint)\ 200[789]|Auto([cC]ad|desk)\ 200[789]",Body,contains,"European languages",Body,contains,"you can download them right after pur",Body,contains,"The best software products at the best prices.",Body,contains,"Microsoft Office Enterprise 2008 includes:",Body,containsRE,"^Retail Price:?\s{1,10}\$\d{3,4}\.[0-9]{2}\r\n^Our Price:?\s{1,10}\$\d{3,4}\.[0-9]{2}",Body,containsRE,"newsoft|softwares|Cheap.*soft(ware)?|oem\ssoftware|software\ (you\s)?needs?",Body,containsRE,"SSoftwarr?e|down.?lo.?ad(d?able)?\ (legal\ )?s?so.?ft(ware)?|(Best|cheapest|lowest)\ software\ prices",Body,containsRE,http://.*software.*\.(com|cn|net|org|php|html?),Body,containsRE,^(type|vis[il]t)\s'?.+soft.*\s\.\scom'?\sin\syour\s.nternet\sExplorer,Body,containsRE,"(?-i)Office\ (Enterprise\ 200[789]|200[789]\ Enterprise)|(Access|Communicator|PowerPoint)\ 200[789]|Auto([cC]ad|desk)\ 200[789]"
[enabled],"RX Spam","RX Spam",16711680,OR,Delete,Body,containsRE,"^Remove\ .*""\*""\ to\ make\ the\ link\ work(ing)?(\!)?",Body,containsRE,"^Remove\ .*space\ in\ the\ above\ link",Body,containsRE,"^Remove "".+"" in the above link",Body,containsRE,"((wonder)?cum|ej[a|@]cul[a|@]t(e|ing|ions?)|org[a|@]sm|pheromones|sperm|strongest\ activator|virility|gnezbenz\.com|glufacts\.net|ED\ (problem[s.]?|treatments?)|ED.?dysfunction|erectile|sexual\ performance|Premature.?Ejaa?culation)\b",Body,containsRE,"^Tired\ of\ being\ just\ (mr\.?\ )?average.*\?",Body,contains,"miracle supplement",Body,contains,"ladies prefer a man",Body,contains,"Any bigger and i would be in a ",Body,containsRE,"sexual(
).{0,2}(problems?|relationships?)",Body,contains,"What do women really want?",Body,contains,"Growth Patch",Body,contains,"Improved Self-Esteem",Subject,containsRE,"^Best\ way\ to\ cure\ yourself|RX|better\ sex"
[enabled],"Pills Spam","Pills Spam",16711680,OR,Delete,Subject,contains,P|\\S,Subject,contains,pills,Subject,containsRE,"BE$T|PILL.?S|Plills|p[i1l|!][1l|!]{2,3}s|pill\ that\ (.*)?works",Subject,contains,MEDS,Subject,contains,generic,Body,containsRE,generics|pillz,Body,contains,"these pills ",Body,containsRE,"\b(cheap|herbal|wonder)\ (drugs|pills|remed(y|ies)|solutions?)\b|pills\ at\ (dirt\s|the\s)?cheap(est)?\ prices?",Body,containsRE,^http://.*pills.*\.com,Body,containsRE,"^"
[enabled],"HGH Spam","HGH Spam",16711680,OR,Delete,Body,contains,HGH,Body,contains,Regenisis,Body,containsRE,H\s{2}G\s{2}H,Body,contains,"Rediscover your youth with ",Body,contains,"Who wouldn't want to feel younger and stronger?",Body,contains,"The Fountain of Youth today!",Body,contains,"Tighten and Increase skin vitality",Subject,contains,"Experience the feeling of youth again",Body,contains,"Feel young again today!"
[enabled],"5 Line Spam","5 Line Spam",16711680,OR,Delete,Body,containsRE,"^(hi(\sthere)?|compliments|Greetings?|hello|Regards|Wa[sz][sz]up|Yo\sYo\sYo|(Good\s)?(afternoon|day|evening|morning|night))\ \b(\w|-){3,12}\b\s?\r\n.+\r\nhttp://.+\r\n\r\n\w{3,9}\s\w{3,9}",Body,containsRE,"^(hi(\sthere)?|compliments|Greetings?|hello|Regards|Wa[sz][sz]up|Yo\sYo\sYo|(Good\s)?(afternoon|day|evening|morning|night))\ \b(\w|-){3,12}\b\s?\r\n.+\r\n\r\n\w{3,9}\s\w{3,9}\r\nhttp://.+\r\n"
[enabled],"Female Sex Organs","Female Sex Organs",16711680,OR,Delete,Subject,containsRE,cunt|personal\s?puss|pussy|twat|Vagina,Body,containsRE,cunt|masterbator|personal\s?puss|pussy|twat|Vagina
[enabled],"Breast Enlargement Pills",Breasts,16711680,OR,Delete,Subject,contains,breasts,Subject,contains,"breast enh",Body,contains,SizeUp,Body,contains,ratedjay.com,Body,contains,breasts,Body,contains,"breast enh"
[enabled],"Lottery Scam","Lottery Scam",16711680,OR,Delete,Subject,contains,"WINNING NUMBER:",Subject,contains,"Microsoft Lottery",Subject,contains,"GO FOR CLAIM VERIFICATION FORM",From,contains,LOTTERY,From,contains,"Department of National Lotteries",Body,contains,"Attn: Lucky Winner",Body,contains,"ATTENTION: DEAR WINNER",Body,contains,"YOUR E-MAIL ADDRESS WON ",Body,contains,"please contact your fudiciary agent",Body,contains,"International Program Online Co-ordinator",Body,containsRE,"(?-i)WINNING\ NUMBER:|LOTTERY|RE:\ LOTTO",Body,containsRE,"(jackpot|International|Microsoft|National)\ Lottery|fiduciary",Body,containsRE,"You\ are\ advised\ to\ keep\ this\ winning\ (.+\s)?confidential"
[enabled],"Money Transfer Scam","$ Xfer Scam",16711680,OR,Delete,Subject,contains,"SWIFT CREDIT CARD",Body,contains,AWARD/INHERITANCE/CONTRACT,Body,contains,"Promptitude in sending the payment",Body,contains,"We redirect the client's payment to you",Body,contains,"after you'll keep our(and yours) earnings, ",Body,contains,"it is your obligation to transfer the rest",Body,contains,"Basic knowledge in Acconting and payment transactions.",Body,containsRE,"^My\ dear\ friend,$|modalities|money\ transfer\ system",Body,contains,CONTRACT/INHERITANCE,Subject,contains,"TRANSFER ASSISTANCE"
[enabled],"Weight Loss Drugs","Weight Loss Drugs",16711680,OR,Delete,Subject,containsRE,"Loo?s(e|ing)\ (your\ )?(pounds|weight)",Subject,contains,"weight loss",Subject,containsRE,Hoodia|Gordonii|Anatrim,Body,containsRE,Hoodia|Gordonii|Fatblaster|anatrim,Subject,contains,"Are you satisfied with the size of your ",Body,containsRE,"herbal\ (capsules|components)",Body,contains,"lose weight",Body,contains,"Amazing weight loss ",Body,contains,"your weight."
[enabled],"Quit Smoking Spam","Quit Smoking",16711680,OR,Delete,Subject,contains,"Live longer life without cigarettes",Subject,contains,"quit smoking",Subject,contains,"Stop Smoking ",Body,contains,"Break free from Nicotine",Body,contains,"break the nasty habit",Body,contains,LIVEFREE,Body,contains,"quit smoking once and for all.",Body,containsRE,"(quit|stop)\ smoking\."
[enabled],"Counterfeit Goods","Counterfeit Goods",16711680,OR,Delete,Subject,containsRE,designer\s(brands|footwear|shoes),Subject,containsRE,\b(gucci|prada|chanel|dior)\b,Subject,contains,repl!c@,Subject,containsRE,Cartier|Gucci|Versace,Subject,containsRE,(?-i)SHOES,Subject,contains,"luxury footwear"
[enabled],"Get Laid Spam","Get Laid Spam",16711680,OR,Delete,Body,contains,"Best of all: it is free...",Body,contains," get laid",Body,contains,"% of members have already gotten laid using our system!",Body,contains,"Are you interested in hooking up with people who live just minutes from you?",Body,contains,"Are you interested in getting laid with locals?",Body,contains,"We have the power to make this happen!",Body,containsRE,fuck.?(buddy|friend),Body,containsRE,".*(It's\ all\ here|Here\ it\ is|Check\ it\!)(\!)?",Body,contains,"want more sex"
[enabled],"Dating Spam","Dating Spam",16711680,OR,Delete,Subject,contains,dating,Body,contains,"Greetings! I wish to get acquainted with you",Body,contains,flirting,Body,contains,"dating system",Body,containsRE,"\d\d%\ of\ our\ members\ .*hooked\ up\ (using|with)\ our\ .*system",Body,contains,"I read your profile online and I was int",Body,contains,"Please write me a letter here http://",Body,contains,"Do you like beautiful girls?"
[enabled],"The Bat Image Spam","The Bat Image Spam",16711680,AND,Delete,EntireHeader,contains,"X-Mailer: The Bat!",Body,containsRE,"^(?-i)\r\n^\r\n^.+