2 body ORIENTSKY /orient-sky\.com/
3 describe ORIENTSKY Japanese spam
7 body PACHETES /www\.pachetes\.com/
8 describe PACHETES Spanish spam
11 # cjwatson, 2003/07/12
12 body NO_MORE_ACCENT /www\.no-more-accent\.com/
13 describe NO_MORE_ACCENT No More Accent spam
14 score NO_MORE_ACCENT 4
17 header FETHARD Subject =~ /fethard.biz/i
18 describe FETHARD Spam from Fethard.biz
21 # joy, 2003-10-21, 2003-10-31
22 body PHARMACYSPAM3 /http:\/\/www\.rx(salenow|ville)\.biz/i
23 describe PHARMACYSPAM3 pharmacy spam 3
26 # cjwatson, 2004-01-13
27 # blarson, any number 2004-04-01
28 # blarson, more ajustmets 2004-04-03
29 body HREF_NNNN /www\.\d{3,5}hosting\.com/
30 describe HREF_NNNN www.NNNNhosting.com spam
33 # cjwatson, 2004-02-16
34 body SOCCER_MOMS /www\.soccer-moms\.biz/
35 describe SOCCER_MOMS Porn spam
38 # cjwatson, 2004-02-22
39 body MRSM_TILO /mrsm-tilo\.com/
40 describe MRSM_TILO Medical spam
43 # cjwatson, 2004-02-27
44 body FAST_ACTING /fast-acting\.com/
45 describe FAST_ACTING Viagra spam
49 body COMCLICKPH /com-click\.com\.ph/
50 describe COMCLICKPH PH spam gang
54 body MEDS675 /(675meds|medsarergreat)\.com/i
55 describe MEDS675 More drug spam
59 body ERHOME /erhome\.com/i
60 describe ERHOME loan spammer
64 body CANDYHOS /\.(?:candyhos\.com|(?:mycountry|polty|make4u)\.cc|puchiphoto\.org|purepure\.org)\//i
65 describe CANDYHOS spams from korea, hosts in japan
69 body GEOCITIES /http\:\/\/.*geocities/i
70 describe GEOCITIES geocities url
74 body EMPTYURL /\bhttp:\/\/(?:www\.)?$/i
75 describe EMPTYURL empty URL
79 body AMPRO /www\.amateurprovideo\.info/i
80 describe AMPRO bug submitting spammer
84 body IMAGESHACK /\/img\d+\.imageshack\.us\//i
85 describe IMAGESHACK shack attack
90 header MSOUTLOOK x-mailer =~ /Microsoft\s+Outlook/i
91 describe MSOUTLOOK Microsoft Outlook
94 meta SHACKOUTLOOK IMAGESHACK && MSOUTLOOK
95 describe SHACKOUTLOOK shack'ed to outlook
99 body UNSUBG /\bwww\.guiaartistica\.com\.ar\b/
100 describe UNSUBG spamming bts with unsubscribe messages
104 body IMGCLOSET /\bhttp\:\/\/.*\b((image(closet|thrust|hosting)|mypicshare|tinypic|fileanchor|imgspot)\.com|bilder-hosting\.de|saunalahti\.fi|upload2\.net|imagehost\.ro)\b/i
105 describe IMGCLOSET closet spammer
109 body TROUBLEDE /\bhttp\:\/\/www\.TroubleAgent\.de\b/
110 describe TROUBLEDE troubleagent.de spam
114 body BESTLOANS /www.bestmortloans.com/i
115 describe BESTLOANS Best loans url
118 # blarson 2007-07-22 2007-09-12
119 body PENPRO /\@(?:penmailpro|OnsetIng|openprotection|NearOut)\.info\b/i
120 describe PENPRO penmailpro spam
123 # blarson 2007-09-05 2007-09-11
124 body WWWCN /\b(?:www\.|https?\:.*)\w+\.cn\b/i
125 describe WWWCN chinese web site
128 # cjwatson, 2002/04/04
129 body EMAILOFFER /www\.emailoffer\.us/
130 describe EMAILOFFER Gibberish HTML spammers
133 # cjwatson, 2002/04/08
134 body JUSTYAK /www\.JustYak\.com/
135 describe JUSTYAK JustSpam
139 body SIZMATZ /\bsize-matterz\.com\b/i
140 describe SIZMATZ size matterz
144 body EMAGX /\bhttp\:\/\/emagx\.net\b/i
145 describe EMAGX wondercum spammer
149 body FREENFL /\bhttp\:\/\/freeNFLtracker\.com\b/i
150 describe FREENFL nfl spam
154 body SPAMARREST /\bhttp\:\/\/www\.spamarrest\.com\b/
155 describe SPAMARREST forwards thier spam problem
159 body FROMAD /\bhttp\:\/\/(?:budhipps|fromad|conavel|cliensy|comnoe)\.com\b/i
160 describe FROMAD more penis spam
164 uridnsbl URIBL_CNKR cn-kr.blackholes.us. A
165 body URIBL_CNKR eval:check_uridnsbl('URIBL_CNKR')
166 describe URIBL_CNKR china or korea hosted web site
167 tflags URIBL_CNKR net
171 uridnsbl_skip_domain debian.org debian.net
174 uridnsbl URIBL_SBL sbl.spamhaus.org. A
175 body URIBL_SBL eval:check_uridnsbl('URIBL_SBL')
176 describe URIBL_SBL Contains an URL listed in the SBL blocklist
182 body MYCHEAP /\b(?:my)?cheap(?:oem|soft)(?:now)?\s*\.\s*com\b/i
183 describe MYCHEAP software spam
187 body WWWRU /\b(?:www\.|https?\:.*)\w+\.ru\b/i
188 describe WWWRU russian web site