describe BESTLOANS Best loans url
score BESTLOANS 2
-# blarson 2007-07-22
-body PENPRO /\@penmailpro\.info\b/i
+# blarson 2007-07-22 2007-09-12
+body PENPRO /\@(?:penmailpro|OnsetIng|openprotection|NearOut|SuperOnset|medicalgloveonline|YourOnset|GreatGloveCell)\.info\b/i
describe PENPRO penmailpro spam
score PENPRO 3.5
-# blarson 2007-09-05
-body WWWCN /\bwww\.\w+\.cn\b/i
+# blarson 2007-09-05 2007-09-11
+body WWWCN /\b(?:www\.|https?\:.*)\w+\.cn\b/i
describe WWWCN chinese web site
score WWWCN 3
describe JUSTYAK JustSpam
score JUSTYAK 4.0
+# blarson 2007-09-10
+body SIZMATZ /\bsize-matterz\.com\b/i
+describe SIZMATZ size matterz
+score SIZMATZ 3
+
+# blarson 2007-09-10
+body EMAGX /\bhttp\:\/\/emagx\.net\b/i
+describe EMAGX wondercum spammer
+score EMAGX 3.5
+
+# blarson 2007-09-13
+body FREENFL /\bhttp\:\/\/freeNFLtracker\.com\b/i
+describe FREENFL nfl spam
+score FREENFL 3
+
+# blarson 2007-09-13
+body SPAMARREST /\bhttp\:\/\/www\.spamarrest\.com\b/
+describe SPAMARREST forwards thier spam problem
+score SPAMARREST 4
+
+# blarson 2007-09-14
+body FROMAD /\bhttp\:\/\/(?:budhipps|fromad|conavel|cliensy|comnoe)\.com\b/i
+describe FROMAD more penis spam
+score FROMAD 4
+
+# blarson 2007-09-14
+uridnsbl URIBL_CNKR cn-kr.blackholes.us. A
+body URIBL_CNKR eval:check_uridnsbl('URIBL_CNKR')
+describe URIBL_CNKR china or korea hosted web site
+tflags URIBL_CNKR net
+score URIBL_CNKR 2.5
+
+# blarson 2007-09-14
+uridnsbl_skip_domain debian.org debian.net
+
+# blarson 2007-09-14
+uridnsbl URIBL_SBL sbl.spamhaus.org. A
+body URIBL_SBL eval:check_uridnsbl('URIBL_SBL')
+describe URIBL_SBL Contains an URL listed in the SBL blocklist
+tflags URIBL_SBL net
+#reuse URIBL_SBL
+score URIBL_SBL 3.5
+
+# blarson 2007-09-17
+body MYCHEAP /\b(?:my)?cheap(?:xp|adobe)?(?:oem|soft)(?:now|ware)?\s*\.\s*com\b/i
+describe MYCHEAP software spam
+score MYCHEAP 4
+
+# blarson 2007-09-16
+body WWWRU /\b(?:www\.|https?\:.*)\w+\.ru\b/i
+describe WWWRU russian web site
+score WWWRU 2
+
+# blarson 2007-09-24
+body VIPSMS /\bvipsms\.org\b/i
+describe VIPSMS vipsms.org
+score VIPSMS 4
+
+# don 2007-10-01
+header MAKEUP subject =~ /makeup\.com/i
+describe MAKEUP makeup.com url
+score MAKEUP 3
+
+# blarson 2007-10-04
+body SUBT /\bsubtracthold\.com\b/i
+describe SUBT subtracthold.com
+score SUBT 4
+
+body GRAPHICMAIL /\bhttp\:\/\/www\.graphicmail\.de\b/i
+describe GRAPHICMAIL graphicmail.de
+score GRAPHICMAIL 4
+
+
+body WWWRO /\b(?:www\.|https?\:.*)\w+\.ro\b/i
+describe WWWRO romanian web site
+score WWWRO 2
+
+# blarson 2007-10-10
+body CLEANDOM /http\:\/\/\{_clean_domains\}/
+describe CLEANDOM broken spamware
+score CLEANDOM 4
+
+# blarson 2007-10-11
+body SOFTNLSE /\bsoftnlse\s*\.\s*com\b/i
+describe SOFTNLSE softnlse.com
+score SOFTNLSE 4
+
+# blarson 2007-10-13
+body MUSVID /\b(?:MusicAndVideoWorld|usa-bestsellers)\.com/i
+describe MUSVID MusicAndVideoWorld.com
+score MUSVID 4
+
+# blarson 2007-10-16
+body PLATSOFT /\btheplatinumsoft\.com\b/i
+describe PLATSOFT theplatinumsoft.com
+score PLATSOFT 4
+
+# blarson 2007-10-22
+body BLOGSPOT /\bblogspot\.com\b/i
+describe BLOGSPOT spammers are hosting on blogspot
+score BLOGSPOT 2