// MailWasher Pro filter rules #2, compiled and currently used by "Wiz" Feinberg, from www.wizcrafts.net. // If to be used to replace your existing filters, rename this file to: filters.txt // This page is a child of: http://www.wizcrafts.net/mailwasher.html and http://www.wizcrafts.net/mwp-filters.html where you can get MailWasher Pro, or learn more about it. // // If these rules prove beneficial to you, please make a donation, at: http://www.wizcrafts.net/donations/ // Thanks :-) // // READ THESE NOTES! They are being updated frequently with important information that may affect filtering and flagging and actions. // // Indicates a comment, and is not parsed. // // IMPORTANT READ THE FOLLOWING! // If you make changes to this file while MailWasher Pro is running, the changes will be overwritten when MailWasher Pro is closed. // To be safe, close MailWasher first,then edit the filters. Or, edit them within MailWasher using the Filter Sidebar (Control + F7). // I have had reports about corruption when copying and pasting my filters into existing filters.txt files. Most of the time this is caused because the text editor you are using is allowing a mixture of Unicode and Ascii entries to be copied. // If you experience MailWasher wiping out the pasted in filters, after you re-open it (assuming it was not running at all when you saved the changes), do this. // When copying and pasting some or all of these filters into your own "filters.txt," if you are using a text editor that is unicode-aware, you should not just SAVE the file. Rather you should use the "Save AS" feature to save the file as either all ASCII or all UNICODE. MailWasher will accept either, but can only deal with one at a time. // // Personally identifiable rules have been deleted from this list. You should create your own rules to deal with your domain name or email address in the Subject or From fields. // Sample rule for spam sent to an non-existent account on your Domain server, - contacts@yourDomain ... // (ex:) [enabled],"contacts@YourDomain.com","Contacts Spam",16711680,OR,Hidden,Delete,To,contains,contacts@YourDomain.com,EntireHeader,contains,contacts@YourDomain.com,Subject,contains,contacts@YourDomain.com,From,contains,contacts@yourDomain // The following are actual, functional rules, ready to drop in to your existing Mailwasher Filters. There may be duplicates because some are from common rules sources. // There must not be any blank lines from the start of the list to the end. Each rule must be on one continuous line, with a linefeed between rules. The last rule must end at the end of it's line, without a linefeed! // Turn off word wrap to view these rules. // Be sure you add your friends and contacts to your Friends List, or the image and PDF spam filter rules may delete email you wanted. // Removed undesirable "Bounce" directives on August 8, 2007. Bouncing no longer works for modern spam as the Return To and From field is always forged and is sent from zombie botnetted home or office computers. // Bouncing also creates more backscatter of useless, undeliverable email, which email servers must deal with. // On August 11-12, 2007: Removed all instances of actions "Hidden," and "Automatic." Reduced "Blacklist" command usage, except for 419 scams. // Email matching rules will be flagged as the various types of spam but you will have to delete them manually, by clicking the "Process Email" button. // You can change the action back to automatic, hidden, or blacklist if you wish, by editing the action rules here, or with MailWasher Pro's Filter sidebar. // Please read the Blocked Countries filter and remove any extensions for Countries you get legit email from. Use caution with all of the Country-based filters! Disable any that block legitimate foreign email. // Rearranged filters according to my own usage; most current rules nearest the top; catch-alls near bottom. // Recent filter additions: // May 2, 2010: New filter: DROA Domain Renewal Scam // May 9, 2010: New filter: Software For Windows (pirated) // May 27, 2010: New filter: iTunes Hostile Attachment // May 29, 2010: Replaced all of these filters with my current filterset, minus Automatic deletions. // June 22, 2010: New filter: Courier Scam #4 // Aug 11, 2010: "Viagra.com Spam" renamed to "Viagra Spam [From]" // Aug 14, 2010: New filter: "Pics Spam" - just below Porn Spam filter // Aug 25, 2010: New filter: Eastern European Sender // Sept 21, 2010: New filter: JS Exploit HTML Attachment // Sept 26, 2010: New filter: CV Zipfile Attachment // Sept 26, 2010: New filter: hello - how are you // Sept 30, 2010: New filter: LinkedIn Scam // Oct 16, 2010: New filter: Courier Scam #5 // Nov 14, 2010: New filter: Pump and Dump Scam // Dec 02: 2010: New filter: Work At Home Scam // Dec 30, 2010: New filter: Dating Spam #2 // Jan 04, 2011: New filter: E-card Scam // Jan 24, 2011: New filter: Russian Bride Scam // Mar 17, 2011: New filters: Courier Scam #6 (DHL) and Post Express Scam (Botnet Trojans) // Mar 24, 2011: New filter: .BR, .CN, .RU Domain Link // Mar 25, 2011: New filter: Courier Scam #7 // Mar 29, 2011: New filter: Known Spam Subjects #4 // Apr 29, 2011: New split filters: "Dating Spam [Subject]" and "Dating Spam [Body]" // May 30, 2011: New filters: Fake Adobe Reader Link and related "interact2 Spammer" and Skype Upgrade Scam // June 13, 2011: New filter: Accented Characters - Non-English Language // July 5, 2011: New filter: .doc attachment (419 Scam?) // July 20, 2011: New triple split filter: Diploma Spam // July 31, 2011: New Filter: Drugstore with spaced words // July 31, 2011: New Filter: Thunderbird Spam // August 2, 2011: New Filter: .CN or .BR Domain Link // August 2, 2011: New Filter: .RU or .UA Domain Link // Aug 15, 2011: New filter: .Info Images and Links // Aug 24, 2011: New filter: Fake Facebook Friend Request // Aug 24, 2011: Split Software Spam into 2 new filters: Software Spam [S] and Software Spam [B] // Sept 16, 2011: New Filter: Russian Pharmacy (also Romania and Ukraine) // Sept 19, 2011: New filter: No Subject, Just Link // Sept 29, 2011: New Filter: .com.ua (Ukrainian) spam domain // Oct 8, 2011: New Filter: Fake IRS Notice // Oct 18, 2011: New Filters: ".Info Sender and Link" and ".Info Sender" // Nov 3, 2011: Work At Home Scams split into 2 filters, for version 6.x. New Filter: Wire Transfer Scam // Nov 7, 2011: New Filter: From India // Nov 7, 2011: New Filter: Tax Fraud (EFTPS) // Nov 8, 2011: New Filter: Postal Service Scam // Dec 3, 2011: Money Mule Scam split into 2 filters: Money Mule Scam #1 and Money Mule Scam #2 // Dec 3, 2011: Watches Spam split into 2 new filters: [From or Subject] and [Body] // Dec 13, 2011: New Filter: BBB Fraud // Dec 14, 2011: New Filter: Fake Query String In Link // Jan 24, 2012: Casino Spam split into #1 and #2 // Filters updated last week: BBB Fraud, Casino Spam, Loans Spam, Work At Home Scam #1 // Filters previously updated this week: Casino Spam updated and split into #1 and #2, Work At Home Scam #1, Work At Home Scam #2 // Last updated filters on January 29, 2012: Casino Spam #2, Known X-Mailer Spam, .RU or .UA Domain Link, Russian Sender, URL Shortener (Spam) Link // All of these comments will be erased as soon as you save this file as filters.txt and activate MailWasher Pro. Keep a copy of this file on hand. [enabled],"AVG Returned Email","AVG Bounces",16711680,OR,Delete,Body,contains,"This is the AVG E-mail Scanner program.",Body,contains,"I'm sorry to inform you that the message",Subject,contains,"Undelivered Mail Returned to Sender" [enabled],"Restored by MWP","Restored by MWP",26112,AND,Legitimate,TakesPrecedence,EntireHeader,contains,"Resent-From: ""MailWasher Pro recycle bin""" [enabled],"Mailwasher Reports","MWP Report",26112,AND,Legitimate,Subject,contains,"MailWasher Pro summary" [enabled],"Chase Bank Online",filtered,26112,AND,Legitimate,From,containsRE,(?-i)Chase|@.+\.chase.com,EntireHeader,containsRE,"Received:\ from\ .{4,8}\.jpmchase\.com" [enabled],"Fake Facebook Friend Request","Fake Facebook Friend Request",16711680,AND,Delete,Subject,contains," wants to be friends on Facebook",From,contains,@facebookmail.com,EntireHeader,doesn'tContain,"Received: from mx-out.facebook.com",Body,contains,"Confirm Friend Request",Body,doesn'tContain,http://www.facebook.com/n/?reqs.php [enabled],"JS Exploit HTML Attachment","Exploit Code",16711680,AND,Delete,Body,contains,"Content-Transfer-Encoding: base64",Body,contains,"Content-Disposition: attachment; ",Body,containsRE,"\ filename="".+\.html""",Body,containsRE,^DQo8c2Nya|PHNjcmlwd [enabled],"Unlicensed Prescription Drugs",Pharmaceuticals,16711680,OR,Delete,From,containsRE,Doctor|Restricted|\bRx|Meds|M3ds|Medd[sz]|Medz|V[i1l|]c[o0]d[i1l|]n|Perc[o0]cet|Phh?aa?rr?mm?a,Subject,contains,"No Prescription required",Subject,contains,"without a prescription",Subject,contains,"EMS Delivery",Subject,containsRE,Adderall?|ADIPEX|Avandia|CODEINE|HYDROCODONE|KLONOPIN|Oxycontin|Phentermine|Perco[cs]e.?t|Rit[ai]lin|Tramadol|Valiu[mn]|Vicodin?|XANAX,Body,contains,"No RX required!",Body,contains,rxrefill.com,Body,contains,"no prescription needed",Body,contains,"medications available without a prescr",Body,contains,http://health.groups.yahoo.com/group/,Body,containsRE,(?-i)Codeine|Valium|Vicodin|Percocet|Phentermine|Ritalin [enabled],Cialis,Cialis,16711680,OR,Delete,Subject,contains,Cialis,Subject,containsRE,"C[I|i|1|y].?[A|@].?L[i|1]{1,2}.?[S$]|(?-i)Ca[iy]lis|(?-i)Cy[al][al]is",Body,containsRE,\b(?-i)Cialis\W,Body,containsRE,C\\Ialis|C1A.LIS|tadalafil|\bCalis\b,Body,containsRE,C\s(/|1|I)\sA\s(L|I|1)\s(/|I|1)\s(S|\$) [enabled],"Viagra Spam [From]","Viagra Spam",16711680,OR,Delete,TakesPrecedence,From,contains,Pfizer,From,contains,viagra.com,From,contains,"Free To Try",From,contains,"® Official Site",From,containsRE,"VI[A@]G®A|V[I1|]AGR[A@]|Viag.?ra|Vi.gra|Vigara|viagar|ivagra|v[ia]{2}gra|v[iy]arga|V_I_A_G_R_A|Impotence|sexual\ health",From,containsRE,Erectile|Erection|\bP[i1l]lls\b|(Potency|Sex)\s?(Pills|Tablets)|(Anti.?)?(?-i)ED\b|[Aa]nti-ed,From,contains,"sex remedies",From,containsRE,Cii?aa?lis|Cia1is|C1alis|^i?Ci?a.?li?s\b|Levitra [enabled],"Viagra Spam [S]","Viagra Spam",16711680,OR,Delete,TakesPrecedence,Subject,contains,"Always be ready.",Subject,contains,impotenc,Subject,contains,se>.<,Subject,contains," dysfunction",Subject,contains,$_e'xual,Subject,containsRE,(blue|love).?pills?\b,Subject,is,"Be ready.",Subject,containsRE,"\b(ciali[a-z]|levitra|viagra|VIGARA|Pfizer|^Pending\ delivery)\b|(?-i)C[i1]al[i1]s|Kamagra",Subject,containsRE,(?-i)ED[_\s]dysfunction|\sED\.|[Aa]nti-ED,Subject,containsRE,"(?-i)Online\ V[a-z1]{1,4}A\ Store",Subject,containsRE,"^user\ .+brand\ \d\d%\ Off\ Sale",Subject,contains,"success stories about V",Subject,containsRE,"personal\ \d\d%\ dis[cs]ount" [enabled],"Viagra Spam [S] #2","Viagra Spam",16711680,OR,Delete,TakesPrecedence,Subject,contains,"on Pfizer",Subject,contains,"Re: Please, placce you order now",Subject,contains,"Re: Please, conflrm you receipt",Subject,containsRE,"Hey,?\ [a-z0-9]+,?\ get\ percent [0O]FF",Subject,containsRE,".+\d\d% (off\s)?only\ for\ you",Subject,containsRE,".+Catch\ \d\d%\ discounts\ [a-z]+",Subject,containsRE,"^Your\ Order\ Status\ ID:\ [A-Z]{11,}",Subject,containsRE,"^Visitor\ .+'s\ personal\ \d\d%\ OFF$",Subject,containsRE,"^User\ .+\ save\ \d\d%\ now",Subject,containsRE,"^Hello,\ [a-z0-9]{3,}.?\ \d\d%\ off\ till?\ [A-Z][a-z]{3,8}\ [a-z]{3,}",Subject,containsRE,"^(RE:\ )?(January|February|March|April|May|June|July|August|September|October|November|December)\ \d\d%\ OFF\s?$" [enabled],"Viagra Spam [B]","Viagra Spam",16711680,OR,Delete,TakesPrecedence,Body,contains,Viagra!,Body,contains,VIAGQRA,Body,contains,"Viagra Professional",Body,contains,"Best Price for VIAGRA",Body,containsRE,"\b(Erectifix|erectile\ dysfunction|(?-i)anti-ED|(?-i)cure\ ED|(im)?potence|ED\ treatment)\b",Body,contains,"Taste the V",Body,contains,"V-letter remedy",Body,containsRE,"blue.?pill?|SoftTabs|\$1\.\d\d/pill\b ",Body,containsRE,"(?-i)Vi?",Body,containsRE,ViaGrow|viiagra|Vagria|Vgaira|Pfizer|Kamagra,Body,containsRE,"(Buy|order|original|with)\ .*Viagra",Body,containsRE,"Viagra\s{1,3}tabs|Viagra.+\$\d",Body,containsRE,".*viagra.*",Body,containsRE,"bring\ back\ fire\ and\ passion|make\ (luv|love)\ all\ night|endless\ climaxes|your\ xxx\ drive|sexual\ health|\bmale problems?\b" [enabled],"Misspelled Viagra [S]","Viagra Spam",16711680,OR,Delete,TakesPrecedence,Subject,containsRE,V\lsAGRA|VIAGQRA|VAIGRA|Vyagra|Vgaira|V\|AGRA|[vw]iag.?row,Subject,containsRE,(?-i)Vlagrxa|Viagr.a|Viagr\d|Vi\dgra|Vigara,Subject,containsRE,"^V.{4,6}a\s\d\d\s?mg",Subject,containsRE,(V|\\/|/)[i|l!1]agr[a@],Subject,containsRE,\bv.i.a.g.r.a\b,Subject,containsRE,(?-i)V[iy]a(rga|gar|gra),EntireHeader,containsRE,Subject:.+\bV[i1!l|]AGRA\b.+,Subject,contains,viaqqra,Subject,contains,VIAG*RA,Subject,containsRE,viaq[ij]ra [enabled],"Male Enhancement [S]","Male Enhancement",16711680,OR,Delete,Subject,containsRE,(?-i)Mega\s?(Dik|size)|E?Xtra\s?size|Manster|MaxGentleman|Max.?[mM]an\b|Sizeable|VPXL,Subject,containsRE,"Gains?\ (up\ to\ )?(\d\+?\s)?(inches\ )?in\ (girth|length|size)|Gaining\ inches",Subject,containsRE,(big(ger|gest)?|fuck|hard(er)?|gigantic|love|man)\s(pecker|pole|rod|sausage|stick|tool|weapon),Subject,containsRE,"(get|grow)\ (a\s)?bigger|sc?h[l1][o0]ng|love\ muscle|your\ small\ (di.?k|stick)|your\ little\s",Subject,containsRE,"elongate|enhancement|en[l|1]a?rge(d|ment)|Enlarge,\ Widen\ and\ Strengthen|enlarge\ and\ lengthen|enlarge\syour|(Enlarge|Super-Size)\ It|Upsize\ your\ D[il]C?'?K",Subject,containsRE,"(bat|bulge|monster|python|rocket|snake)\ in\ your\s{0,3}(pants|pocket|trousers)|trouser\ snake|giant\ bulge",Subject,containsRE,"Longer\ Harder\ Thicker|(harder|thicker)\ and\ longer|long(er)?\ and\ thick(er)?|thicker\ shaft|\b(bigger|harder|larger|thicker|your)\ (?-i)(PE)\b",Subject,containsRE,"(longest|your)\ device\b|short(er)?\s?Penis|Peni[l1]e|pen.?[i1l!]s\b|p[e3]nis|pen-nis|p\ e\ n\ [i1l]\ s|\bp[aei3]nis\b",Subject,containsRE,"add\ (\d\s)?inche?s|\d\ inn?cc?hes|girth,?\s( and\s)?(length|lenght)|(length|lenght)\ and\ (girth|thickness)|thickness\ (a[nd][dn])\ length",Subject,containsRE,"Bring\ her\ to\ seventh\ heaven|huge\s?(dic'?k|dignity|package)|problems?\swith\ssize|size\ (really\s)?(does\s)?matters?|I've\ gained\ an\ inch|your\ dic?'?k\ size|rock\ hard|Impress\ .*wom[ae]n",Subject,containsRE,"your\s?(male\ p[a@]ck[a@]ge|copulation|lovetoy|manhood|manliness|masculinity|(new|your)\ (tool|rod|size|weener|willy))|Bodypart|(giant|gigantic|male|man|pocket)\ tool|manly|Masculine|lovemaking|penetrate",Subject,containsRE,"boner|blue\ balls|c[o0]ck|\bcum\b|\bdong\b|ejaculat(e|ion|ory)|ejauclation|Erectile|Erection|flaccid|foreplay|\bpeckers?\b|phall(i|us)?|prick|sex(ual)?|s'e[^a-z]?x|s'e_xual|\$e><|(?-i)d1ck|dic'?k" [enabled],"Male Enhancement [B]","Male Enhancement",16711680,OR,Delete,Body,contains,"PE forum",Body,contains,"your manhood",Body,contains,"Extra inches gives",Body,contains,"enhance your male drive",Body,contains,"Natural Male Enhancement",Body,contains,"Increase your organ size",Body,contains,"male enhancement products",Body,containsRE,Penis\s?En(hance|large)ment|Flaccid(ity)?,Body,containsRE,en(hanc|larg)ement\s?(formula|method|pills|suppliment),Body,containsRE,"(their|your)\ (enlarged|huge)\ (organ|package|prick|shaft)",Body,containsRE,Magnum.?Pro|ManSter|Man[\s-]XL|Max[gG]ain(\+|Plus)|MaxGentleman|maxx?.?man|Megadik|PowerEnlarge|VPXL|Xtrasize\s?(\+|Plus) [enabled],"Counterfeit Goods","Counterfeit Goods",16711680,OR,Delete,From,containsRE,Gucci|Luxury,Subject,containsRE,des1gner|designer\s(brands|footwear|shoes)|modish,Subject,containsRE,\b(gucci|prada|chanel|chloe|dior|(?-i)UGG|Vertu)\b,Subject,contains,repl!c@,Subject,containsRE,Cartier|Gucci|Versace|KN[0O]CK.?[0O]FFS,Subject,containsRE,(?-i)SHOES|\bBling\b,Subject,containsRE,"luxury\ (brands|footwear|needs)|looking\ classy",Subject,containsRE,"Branded\ (footwear|shoes)",Subject,contains,"Clad your feet",Body,contains,"~ Gucci",Body,containsRE,"Knock.?[O0]ffs|^Luxury\ blowout\ sale|(?-i)\sLux\s",Body,containsRE,"(?-i)Vertu\s.{3,14}phones\s" [enabled],"Watches Spam [F or S]",Watches,16711680,OR,Delete,TakesPrecedence,From,containsRE,"R[o0][l1]exx?|Rep[l1]icas|Watches|(Luxury|Replica)\ watch|Luxurious",Subject,is,Luxury,Subject,contains,//atches,Subject,contains,\/\/ATCHES,Subject,containsRE,"\bHERMES\b|\bWa.ches\b|Wat4ch|Submariner\ SS|(replica|Rolex|swiss|vip)\ watches|w\.a\.t\.c\.h\.e\.s|\ba\ watch\b|(designer|Swiss)\ watch|watch\ brands",Subject,containsRE,"\b(R[0olex\.]{8,}|R[o0][lI1]ex|Re4plica|r,?eplicas?|r\.{1,3}e\.{1,3}p\.{1,3}.l\.{1,3}i\.{1,3}c\.{1,3}a\.{1,3}|watches|chronometers|timepieces?|time\ control)\b" [enabled],"Watches Spam [B]",Watches,16711680,OR,Delete,TakesPrecedence,Body,containsRE,"(luxury|luxurious|new)\ (replica|watch)|famous\ watch\ manufacturer",Body,contains,"brand name watch",Body,contains,"We only sell premium watches.",Body,contains,"exact copies of the original watches",Body,contains,"Detailed replicas of best chronometers by the best brands",Body,contains,"put one of these on your xmas list, you will fall in love with them all",Body,containsRE,"copies\ of\ [a-z]{5,}\ watch|Rolex|Rollie|\ replicas\b|Submariner\ SS|replica\ watches|//atches|chronometers?|timepieces?|flashy\ bling|expensive\ watch|fashion\ pieces",Body,contains,bling.com [enabled],"Known Spam Subjects #4","Known Spam Subjects",16711680,OR,Delete,Subject,contains,"Product Recommended by ",Subject,contains,"new In town",Subject,is,Alone,Subject,is,"Uniform traffic ticket",Subject,contains,"FDIC notification",Subject,contains,"Scan from a Xerox W" [enabled],"Known Spam [From]","Known Spam [F]",16711680,OR,Delete,EntireHeader,contains,HOTSINGLESNET.NET,EntireHeader,contains,"From: ""USA Government Center""",EntireHeader,containsRE,"(^From:\s{1,3}""?(Mr\.?\ Song\ Li|ph[ra]{2}macy|(?-i)E-STORE|\{|\}|""=\?ISO-8859-1\?Q\?))",EntireHeader,contains,"From: =?UTF-8?Q?=C2=",EntireHeader,containsRE,"^(?-i)IME-Version:\ 1\.0$",From,containsRE,"CanadianPharm|Rx\ The\ Best\ Source|SENATOR\ DAVID\ MARK|SexBoosters|hard.{1}on",From,containsRE,"MensHealth\.com|Extenze|Try\s?[1i]t\s?4Free|TheDR|Max-?Man|Facebook\ Manager|sexual|iContact|Pharmacy.?Online|Online.?Pharmacy|Medical|Vicodin|Drugs|penile|Potency|Sex|Pharm|Pill.?store|(?-i)ANGEL",From,contains,"Software Sale",From,contains,"OEM Software",From,contains,Easy-E-Cards-Online,From,contains,"Rock Cruit" [enabled],"Russian Pharmacy",Pharmaceuticals,16711680,AND,Delete,Body,contains,Pharmacy,Body,containsRE,http://(www\.)?(.+\.r[uo]/|.+\.r[uo]\b|.+\.ua) [enabled],"Pharmaceuticals [S]",Pharmaceuticals,16711680,OR,Delete,TakesPrecedence,Subject,contains,MensHealt,Subject,contains,"RE: MedHelp ",Subject,containsRE,"\b(?-i)(FDA|Doctor)\ Approved",Subject,containsRE,Phramacy|Pharmaceutical|Pharmacy|pharmas|apothecary|(?-i)RX,Subject,containsRE,"no\ (pres|pers?)cription|(pres|pers?)cription\ not",Subject,containsRE,"\bPhar|P.?ha.{0,2}rmacy\b",Subject,containsRE,\bBuy\sMeds\b|med[il|1]c(al|ations?|ines?)|\bm3ds|medds|medzz?\b|(order|purchase|your)\smeds|drug.?store|usa.?drug,Subject,containsRE,PH.*[A@(/\)]RM[A@(/\)],Subject,containsRE,"health supersite",Subject,containsRE,"^discreet\ (delivery|packing|shipping)|worldwide\ delivery",Subject,containsRE,"save\ \d\d%\ on\ your\ (medic|meds|pharma|pills)|\d\d%\sdiscount\.\sCode\s#[a-z0-9]{4,8}|\d\d%\ personal\ discount",Subject,contains,"Enhance your life with these products",Subject,contains,"OFFICIAL SITE",Subject,containsRE,"Canadian\ Health.*Care\ Mall" [enabled],"Pharmaceuticals [B]",Pharmaceuticals,16711680,OR,Delete,Body,containsRE,"Prescription\ drugs\s{1,}without a prescription",Body,containsRE,"ON.?li[nm]e\ pharmacy|pharmacy\ club",Body,contains,PHARMACY,Body,containsRE,"(high.quality|prescription)\ medications",Body,contains,»»»,Body,contains,"alt=3D""HUGE Discount",Body,contains,"Then I found this link and my life started changing for the better",Body,contains,"We are offering you the latest medical achievements.",Body,contains,"used to sleep in separate rooms",Body,contains,"that's when my problems in bed began",Body,contains,"delivered discreetly",Body,contains," but the results exceeded our expectations.",Body,contains,"due to intimate problems" [enabled],"Drugstore with spaced words",Pharmaceuticals,16711680,OR,Delete,Body,contains," DRUG ",Body,contains," DRUGS",Body,contains," Drugstore " [enabled],"Pills Spam","Pills Spam",16711680,OR,Delete,Subject,contains,P|\\S,Subject,contains,pills,Subject,containsRE,"BE$T|PILL.?S|Plills|p[i1l|!][1l|!]{2,3}s|pill\ that\ (.*)?works|Pilules|\bPILZ\b",Subject,contains,MEDS,Subject,contains,generic,Body,containsRE,generics|pillstore|pillz|\bmeds\b,Body,containsRE,"(boost|our|these)\s{1,3}pills",Body,containsRE,"\b(buy|cheap|herbal|wonder)\ (drugs|pills|remed(y|ies)|solutions?)\b|pills\ at\ (dirt\s|the\s)?cheap(est)?\ prices?|medicines|your\ prescriptions",Body,containsRE,^http://.*(medshop|pills).*\.com,Body,containsRE,"^" [enabled],".com.ua spam domain","Ukrainian spam domain",16711680,AND,Delete,TakesPrecedence,Body,containsRE,"http://[a-z0-9\._-]{3,}\.com\.ua/" [enabled],"Courier Scam #1","Courier Scam",16711680,AND,Delete,Subject,containsRE,"(?-i)^(DHL|UPS)\ (?i)Delivery\ Problem|Services",Body,containsRE,"we\ (failed|were\ not\ able)\ to\ deliver\ (the\ |your\ )?(postal\ )?package",Body,contains,"print out the invoice",Body,contains,"Content-Disposition: attachment;" [enabled],"Courier Scam #2","Courier Scam",16711680,AND,Delete,Subject,containsRE,"(?-i)Confirm\ Your\ UPS\ Parcel\ Delivery|UPS\ (Tracking\ (Number|#)|Package\ [A-Z]\d{8,})",EntireHeader,doesn'tContainRE,"^Received:\ from\ [a-z0-9]+\.?ups\.com" [enabled],"Courier Scam #3","Courier Scam",16711680,AND,Delete,Subject,containsRE,(?-i)DHL|FedEx,Subject,containsRE,"get\ (a|your)\ parcel|(?-i)Tracking\ (NR|Number).?\d{8,}|Error\ in\ delivery\ addres",Body,containsRE,"((our|The)\ (courier|postal)\ service\ was)|(we\ were)\ (not\ |un)able\ to\ deliver\s",Body,containsRE,"Print\ this\ label\ |print\ and\ fill\ attached\ document|The\ postal\ label\ is\ attached",Body,contains,"Content-Disposition: attachment;",From,containsRE,Director|Manager|Postal|DHL|FedEx [enabled],"Courier Scam #4","Courier Scam",16711680,OR,Delete,Subject,contains,"DELIVER CONFIRMATION - FAILED",Subject,containsRE,"(Delivery\ Problem|UPS\ INVOICE) NR\d{6,8}\.",From,contains,"Fedex Manager, " [enabled],"Courier Scam #5","Courier Scam",16711680,AND,Delete,From,contains,"UPS ",Subject,contains,"UPS ",EntireHeader,contains,"X-Mailer: The Bat!",Body,contains,"unable to deliver",Body,contains,"print ",Body,contains,"mailing label",Body,contains,"Content-Disposition: attachment;" [enabled],"Courier Scam #6","Courier Scam",16711680,AND,Delete,Subject,contains,"DHL notification",Body,contains,"Dear customer",Body,contains,"The parcel was send your home address",Body,contains,"will arrice within 7 bussness day",Body,contains,"attached in document below" [enabled],"Courier Scam #7","Courier Scam",16711680,AND,Delete,From,containsRE,"(DHL|United)\ (Global|Parcel)|Express|info\.?\d{1,2}@ups.com",Subject,containsRE,"^(?-i)(DHL|United\ Parcel)\ (Express\s)?Services?|Express\ delivery|UPS",Body,containsRE,"^The\ parcel\ was\ sent\ (to\ )?your\ home\ add?ress?",Body,containsRE,"it\ will\ arrive\ within\ \d{1,2}\ business\ day",Body,contains,"attached in document below" [enabled],"Postal Service Scam","Courier Scam",16711680,OR,Delete,Subject,contains,"USPS Delivery Failure Notification",Subject,contains,"United Postal Service",Body,contains,"Unfortunately we failed to deliver the postal package",Body,contains,"Please print out the shipment label attached and collect the package at our office.",Body,contains,"filename=""USPS report.zip""" [enabled],"Post Express Scam","Courier Scam",16711680,AND,Delete,From,contains,"Post Express",Subject,contains,"Post Express ",Subject,containsRE,(?-i)\bNR\b|Number,Body,contains,"Your package has been returned",Body,contains,"mailing label",Body,contains,"Post Express",Body,contains,Attached,Body,contains,print,Body,contains,"Content-Disposition: attachment;" [enabled],"ACH Fraud","ACH Fraud",16711680,AND,Hidden,Delete,Body,contains," ACH ",Body,contains,Transaction,Body,contains,report,Body,containsRE,Cancell?ed,Body,containsRE,"financial\ (body|institution)|bank",Body,containsRE,"details\ in\ the\ attachment|nacha\.(org|net|us)/reports?/|(?-i)Transaction\ Report:" [enabled],"BBB Fraud","BBB Fraud",16711680,OR,Delete,From,contains,"::Better Business Bureau::",From,contains,@bbb.org,Subject,contains,"BBB Case #",Body,contains,"The Better Business Bureau has been sent the above mentioned complaint from one of your clients",Body,contains,"the consumer's concern is included in attached file",Body,contains,"Business Bureau Council of Better Business Bureaus",Body,containsRE,"The\ details\ of\ the\ consumer's\ (concern|complaint)\ are\ (explained|included)\ in\ (the\s)?attached\ file\.",Body,containsRE,"Please\ (open|use)\ the\ link\ below\ to\ (re)?view\ the\ contents\ of\ the\ complaint:" [enabled],"Wire Transfer Fraud","Wire Transfer Fraud",16711680,AND,Delete,Subject,containsRE,"Wire\ [tT]ransfer\ ",Body,containsRE,"Federal\ (Bank|Reserve)",Body,containsRE,"Outgoing\ Wire\ transaction|by\ the\ other|Domestic\ Wire\ Transfer" [enabled],"Fake Query String In Link (Dangerous!)","Exploit Link",255,OR,Delete,Body,containsRE,"http://[a-z0-9]+\.[a-z]{2,4}/.+\.html?\?.+",Body,containsRE,"(?-i)""http://.+\.[a-z]{2,4}/.+\.html?\?[A-Z0-9=&]+=",Body,containsRE,"(?-i)http://[a-z0-9]+\.[a-z]{2,4}(\.[a-z]{2,4})?/.+\.html?\?[A-Z0-9=&]+=",Body,containsRE,"(?-i)/[a-z0-9]+\.htm\?[A-Z0-9]{4,6}=[A-z0-9&=]+=" [enabled],"Nigerian 419 Scam #1 [S]","419 Scam",16711680,AND,Delete,Subject,contains,URGENT,Subject,contains,AND,Subject,contains,CONFIDENTIAL [enabled],"Nigerian 419 Scam #2 [S]","419 Scam",16711680,AND,Delete,Subject,containsRE,(?-i)^URGENT|CONFIDENTIAL,Subject,contains,BUSINESS,Subject,containsRE,(?-i)PROPOSAL|RELATIONSHIP [enabled],"Nigerian 419 Scam #3 [S, F, R]","419 Scam",16711680,OR,Delete,From,containsRE,"(?-i)ARTHUR\ GUINNESS|BARRISTER|TRANSFER|Business\ Proposal|Micheal\ A\.\s?Potter|\(ESQ\)",EntireHeader,containsRE,^Reply-To:\s.+?$|thwala,Subject,contains,"Atten: Friend,",Subject,contains,"kindly reply/call me",Subject,contains,"kindly get back to me urgently",Subject,containsRE,(?-i)^(URGENT\s)?BUSINESS$,Subject,contains,"Oil license ",Subject,containsRE,"(?-i)(^CONTACT\ (\w*\s)?(COURIER\ COMPANY|ATM\ DEPARTMENT))",Subject,containsRE,"(?-i)TREAT\ (AS|VERY)\ (CONFIDENTIAL|URGENT)|(EMINENTLY|STRICTLY|URGENTLY)\ CONFIDENTIAL|CONFIDENTIALITY\ AND\ TRUST",Subject,containsRE,"UNITEDN\ NATION|Director,\ United\ Nations",Subject,containsRE,"^Dear\ Friend$|Urgent\ Proposal|Business\ letter\ from",Subject,contains,"FUND TRANSFER",Subject,contains,"From Barrister",Subject,containsRE,"^(From\s)(?-i)Mrs?[,\.]?\s?[A-Z][a-z]{2,}\s[A-Z][a-z]{1,}" [enabled],"Nigerian 419 Scam #4 [B]","419 Scam",16711680,AND,Delete,Body,containsRE,^(Kind\s)?Atte?n:|ATTENTION,Body,containsRE,"Beneficiary|(My\ )?Dear\ (GOOD\s)?(Beloved|Friend)" [enabled],"Nigerian 419 Scam #5 [B]","419 Scam",16711680,OR,Delete,Body,contains,"contacting you based on Trust",Body,containsRE,"^Hello,\ I.{0,2}m\ Sgt\.",Body,containsRE,"^(?-i)\*?(Dear\ (Sir/Madam|Friend\b)|Complement\ of\ the\ day)",Body,contains,"I need your urgent assistance in transferring",Body,contains,"Waiting to hear from you soonest",Body,containsRE,"unclaimed\ (benefits|funds)",Body,containsRE,"(I\ am|My\ name\ is)\ Barrister|^Barrister.+ESQ$|(?-i)Barrister\ [A-Z][a-z]{2,}\ [A-Z][a-z]{2,}",Body,containsRE,^Best\sregards.?\r\nBarr\..?[A-Z],Body,containsRE,"^Mr\.\ \w{3,}\ \w{3,}\ \(Barrister\)",Body,contains,"your utmost confidentiality in this matter" [enabled],"Nigerian 419 Scam #6 [B]","419 Scam",16711680,OR,Delete,Body,containsRE,"Business\ proposal\ valued\ at|(?-i)(CONFIDENTIAL\s)?(MUTUAL\s)?BUSINESS\ (PROPOSAL|RELATIONSHIP?)|URGENT\ AND\ CONFIDENTIAL",Body,containsRE,"Bank\ (of\ )?(Nigeria|Benin|(South\s)?Africa)|Benin\ Republic|Republic\ of\ Benin|Director,\ United\ Nations|REPUBLIC\ OF\ NIGERIA",Body,containsRE,"beneficiary|no\ Beneficiaries|demurrage|dumourage|duemorrage|Clearance\ Certificate\ (\r\n)?Fee|keeping\ fees|(?-i)IMMEDIATE\ RELEASE\ OF\ YOUR\ PAYMENT",Body,containsRE,"\{[a-z]{3,8}\sMillion\s[a-z-]{3,6}\sHundred\sThousand\sDollars}",Body,contains,"I am Mr. Patrick Chan",Body,contains,"Compliment of the day to you",Body,containsRE,(?-i)\bNIGERIAN?\b,Body,contains,(Esq. [enabled],"Lottery Scam","Lottery Scam",16711680,OR,Delete,Subject,containsRE,"Your\ Email\s(Address\s)?Has\ Won",Subject,containsRE,"WINNING\ (Notification|NUMBER:)|ticket\ number\ \(.+\)|(?-i)COCA\ COLA.?TOBACCO\ COMPANY|(?-I)OFFICIAL\ PRIZE\ NOTIFICATION",Subject,contains," Lottery",Subject,contains,"GO FOR CLAIM VERIFICATION FORM",From,containsRE,"\bLotto\b|Lottery\ Notification|International\ lottery|(?-i)LOTTERY|NOTIFICATION\ DRAW|DRAW\ 201\d",From,containsRE,"coca.?cola.*promm?o|Microsoft\ Award\ Department|Department\ of\ National\ Lotteries|Superenalotto|WORLD\ CUP|your\ email\ (address|id)\ has\ (won|been\ selected)",Body,contains,"Attn: Lucky Winner",Body,contains,"DEAR WINNER",Body,contains,"YOUR E-MAIL ADDRESS WON ",Body,contains,"please contact your fudiciary agent",Body,contains,"International Program Online Co-ordinator",Body,containsRE,"(?-i)WINNING\ NUMBER:|LOTTERY|(FREE|RE:)\ LOTTO|Lottery\ Coordinator|your\ email\ (ID|identity)\ has\ won",Body,containsRE,"(jackpot|International|ExxonMobil|Microsoft|National)\ (Award|Lottery)|Freelotto|fiduciary|The\ Kings\ Charity|weekly\ sweepstakes",Body,containsRE,"You\ are\ advised\ to\ keep\ this\ winning\ (.+\s)?confidential",From,contains,AFRICA [enabled],"Money Mule Scam #1","Money Mule Scam",16711680,OR,Delete,TakesPrecedence,Subject,contains,"We are searching for partners in USA",Body,contains,"VACANCY CODE: ",Body,contains,"EMPLOYER SNAPSHOT",Body,contains,"All banking, Western Union and cell phone expenses covered",Body,contains,"An import export company seeks remote employees in United States.",Body,contains,"managing the preparation and distribution for expected transactions",Body,contains,"(at the beginning of work) to 5-7 (after the first probation month)",Body,contains,"The main duties include receiving and making payments on client's behalf",Body,contains,"This position is for US residents only, please no applicants from other countries.",Body,contains,"Being foreign company makes it harder to manage sales transactions with US customers" [enabled],"Money Mule Scam #2","Money Mule Scam",16711680,OR,Delete,Subject,contains,"Your Job Application Status ",Subject,containsRE,"Update\ on\ available\ .+positions",Body,contains,"An at home Key Account Manager Position",Body,containsRE,"(?-i)Rock\s?[a-zA-z]{4,8}\s?Management",Body,containsRE,[a-z0-9]+@((jobsearchoo|newstatejob|usanewjobgov)\.com|europcareers\.net),Body,containsRE,"The\ pay\ (range|rate)\ for\ [a-z]{3,10}\ options\ range\ from\ \$35\.77\ .+\ to\ \$57\.62\ .{2,4}\ (hr|hour).\s?" [enabled],"Work At Home Scam #1","Work At Home Scam",16711680,OR,Delete,Body,contains,"thank me later",Body,contains,"online based job",Body,contains,"working from home!",Body,contains,"Work from the house",Body,contains,"at home on the computer!",Body,contains,"You will love me for this!",Body,contains,"You will thank me for this!",Body,contains," every 5 days from home",Body,contains,"who needs a 9-5 when you got this program",Body,contains,"anyone who wants to work in the comfort of their own home",Body,contains,"I had finally hit rock bottom",Body,contains,"I finally made a life changing decision",Body,contains,"I had reached the end of the line",Body,contains,"I was able to regain my independence using this" [enabled],"Work At Home Scam #2","Work At Home Scam",16711680,OR,Delete,From,contains,"W0RK FROM H0ME",Subject,containsRE,"Work(ing)?\ (at\From)\ Home|Career\ (Finders|Hunters?)",Body,containsRE,"(?-i)News\ Channel.?\d{1,2}",Body,containsRE,"http://www\.mynbcnews11\.com/|3Dcnbc7(\.[a-z]{2,4})?&btnI=3D1",Body,containsRE,"Don'?t\ forget\ to\ thank\ me",Body,containsRE,">(?-i)(Channel\ \d{1,2}\ )?(Career\ (Guide|News|Trends)|News\ [Dd]aily|Daily\ News|http://(localnews|newsbreaking)\d\d\.com).{0,3}",Body,containsRE,"^[iI]\ (just\s)?(earned|made|netted|profited|pulled(\ in)?)\ \$?\d{3,4}\$?\ in\ (\d\ days|less\ th[ae]n\ a\ day|a\ few\ (days|hours)|a\ couple\ (of\ )?hours)",Body,containsRE,"(Here'?s\ how|It's\ all\ because\ of)\ -(\s|=\r\n\s)",Body,contains,"Rock Cruit Management" [enabled],"Russian Bride Scam","Russian Bride Scam",16711680,OR,Delete,Subject,containsRE,"\ ru\ girls?",Subject,containsRE,\d\d\s?y\.o\..*\sRussia,Body,contains,".ru>Marriage Agency",Body,contains,"a pretty Ukrainian lady",Body,contains,"international marriage site",Body,contains,"Look at this girl who wants to get married",Body,containsRE,"^http://date[a-z]{4,8}\.ru/",Body,containsRE,"a\ nice\ pretty\ girl|I'm\ from\ Russia|Russian\ (beaut(y|ies)|girls|lad(ies|y))|single\ Russian\ (girl|lad.{1,3}|wom[ea]n)" [enabled],"Dating Spam [Subject]","Dating Spam",16711680,OR,Delete,Subject,is,"Personal Invite",Subject,contains,(status-online),Subject,containsRE,"\bdating\b|single.?ladies|Married.{1,5}lonely",Subject,containsRE,"Russian\ (beauties|girls?|hotties?|lad(ies|y)|wife|wives|wom[ae]n)|from\ [Rr]ussia",Subject,containsRE,"^Hi\ remember\ me\?|we\ fucked|blonde?\ and\ cute|(?-i)^[A-Z][a-z]{4,7}\s\d\d\s?y\.o[\.,]\s",Subject,containsRE,"(?-i)Add\ Me|Find\ Someone|meet\ a\ beautiful\ girl|Meet\ that\ special\ someone|Looking\ for\ love\b",Subject,containsRE,"Unread\ message\ from\ ~[A-Z][a-z]{3,6}\ \(uid:\d{4,6}\)" [enabled],"Dating Spam [Body]","Dating Spam",16711680,OR,Delete,Body,contains,HOTSINGLESNET.NET,Body,contains,"girls at our site",Body,contains,"My pics and short video",Body,contains,"Do you like beautiful girls?",Body,contains,"Please write me a letter here http://",Body,contains,"Greetings! I wish to get acquainted with you",Body,contains,"looking for a nice guy to chat with",Body,contains,"good looking girl who is looking to chat with you",Body,containsRE,"\bdating\ (site|system)\b|dating!|flirting",Body,containsRE,"HithereI|Ifoundyourprofileonline|you(r|'re)\ so\ hot!",Body,containsRE,"(status-online)\ sent\ new\ message|waiting\ you\ for\ chat",Body,containsRE,"I\ read\ your\ profile\ online|i\ (found|loved|was\ just\ reading)\ your\ profile",Body,contains,"I would like to find a man" [enabled],"Pics Spam","Pics Spam",16711680,AND,Delete,Body,containsRE,"profile\ on\ facebook|\ (yo)?ur\ profile|your\ pic",Body,containsRE,"share\ (mine|my\ pics?)\ with\ you|you\ my\ pics?|see\ my\ pic|(non-public\ photos|private\ (images|photos))",Body,contains,@hotmail.com [enabled],"Numeric IP Link","Numeric IP Link",16711680,AND,Delete,Body,containsRE,"^.*http://(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/)|\d{10}:\d{2,4}/",EntireHeader,doesn'tContainRE,"^Message-ID:\ <.+@mail.gmail.com>" [enabled],"Image Spam #11","Image Spam #11",16711680,OR,Delete,TakesPrecedence,Body,contains,img0.gif,Body,contains,"Please Enable Images to View this ",Body,contains,"Please Enable Links and Images to Confirm Your Order!
",Body,contains,"'Click above to show images'",Body,contains,"""View image in browser now""",Body,contains,"alt=""One click to open store""",Body,contains,"alt=""Cant see a picture? Click Here!""",Body,contains,"alt=""Show picture and go to site now!""",Body,contains,"alt=3D""Want to request ? It's easy to make a request online.",Body,containsRE,"^<(center|/style)>\r\n^\r\n^