score BESTLOANS 2
# blarson 2007-07-22 2007-09-12
-body PENPRO /\@(?:penmailpro|OnsetIng|openprotection|NearOut|SuperOnset)\.info\b/i
+body PENPRO /\@(?:penmailpro|OnsetIng|openprotection|NearOut|SuperOnset|medicalgloveonline|YourOnset|GreatGloveCell|thegloveworks|asiafriendworld)\.info\b/i
describe PENPRO penmailpro spam
score PENPRO 3.5
score URIBL_SBL 3.5
# blarson 2007-09-17
-body MYCHEAP /\b(?:my)?cheap(?:oem|soft)(?:now)?\s*\.\s*com\b/i
+body MYCHEAP /\b(?:my)?cheap(?:xp|adobe)?(?:oem|soft)+(?:now|ware)?(?:(?:4|for)?less)?\d*\s*\.\s*com\b/i
describe MYCHEAP software spam
score MYCHEAP 4
score VIPSMS 4
# don 2007-10-01
-header MAKEUP /makeup.com/i
+header MAKEUP subject =~ /makeup\.com/i
describe MAKEUP makeup.com url
-score MAKEUP 3
\ No newline at end of file
+score MAKEUP 3
+
+# blarson 2007-10-04
+body SUBT /\bsubtracthold\.com\b/i
+describe SUBT subtracthold.com
+score SUBT 4
+
+body GRAPHICMAIL /\bhttp\:\/\/www\.graphicmail\.de\b/i
+describe GRAPHICMAIL graphicmail.de
+score GRAPHICMAIL 4
+
+
+body WWWRO /\b(?:www\.|https?\:.*)\w+\.ro\b/i
+describe WWWRO romanian web site
+score WWWRO 2
+
+# blarson 2007-10-10
+body CLEANDOM /http\:\/\/\{_clean_domains\}/
+describe CLEANDOM broken spamware
+score CLEANDOM 4
+
+# blarson 2007-10-11
+body SOFTNLSE /\bsoftnlse\s*\.\s*com\b/i
+describe SOFTNLSE softnlse.com
+score SOFTNLSE 4
+
+# blarson 2007-10-13
+body MUSVID /\b(?:MusicAndVideoWorld|usa-bestsellers)\.com/i
+describe MUSVID MusicAndVideoWorld.com
+score MUSVID 4
+
+# blarson 2007-10-16
+body PLATSOFT /\btheplatinumsoft\.com\b/i
+describe PLATSOFT theplatinumsoft.com
+score PLATSOFT 4
+
+# blarson 2007-10-22
+body BLOGSPOT /\bblogspot\.com\b/i
+describe BLOGSPOT spammers are hosting on blogspot
+score BLOGSPOT 2
+
+# blarson 2007-10-25
+body PILLUS /PILL-US\.COM\b/i
+describe PILLUS PILL-US spam
+score PILLUS 4
+
+# blarson 2007-10-25
+body BETWEENTO /\bhttp\:\/\/betweento\.com\b/i
+describe BETWEENTO betweento.com
+score BETWEENTO 4
+
+# don 2007-10-25
+body MASZON /mc?a(szon|yvidol|ttk)\.(com|org|net)/i
+describe MASZON pron spam
+score MASZON 4
+
+# blarson 2007-10-26
+full GEOCITIES /\bhttp\:\/\/geocities\.com\b/i
+describe GEOCITIES http://geocities.com/
+score GEOCITIES 1
+
+# blarson 2007-10-27
+body GMAIL /\@gmail\.com\b/i
+describe GMAIL @gmail.com
+score GMAIL 1
+
+# blarson 2007-10-28
+body MAILRU /\@mail\.ru\b/i
+describe MAILRU @mail.ru
+score MAILRU 3
+
+# blarson 2007-10-31
+body ADOBE4LESS /\b(?:adobe4less|realnewsoft|newmicrosoftdeals|kvaka-soft)\s*[.,]\s*com\b/i
+describe ADOBE4LESS adobe4less . com
+score ADOBE4LESS 4
+
+# blarson 2007-11-01
+body RMAPPLY /http\:\/\/rmapply\.com\b/i
+describe RMAPPLY http://rmapply.com
+score RMAPPLY 4
+
+# blarson 2007-11-04
+header HANOIFASH subject =~ /WWW\.HANOI-FASHION\.COM/i
+describe HANOIFASH WWW.HANOI-FASHION.COM
+score HANOIFASH 4
+
+# blarson 2007-11-06
+body ONLINEMED /\b(?:onlinemedicalkey|pharm\w*|webvinz|wendebay|webdcd|vowelstep|wclth|duringgear|broadbasic|instantsuffix|magnetdouble|drugsdirecteat)\s*\.\s*com\b/i
+describe ONLINEMED onlinemedicalkey.com
+score ONLINEMED 4
+
+# blarson 2007-11-15
+body GETUP /\bgetupgradednow\.com\b/i
+describe GETUP getupgradednow.com
+score GETUP 4
+
+# blarson (pusling's idea) 2007-11-16
+body SPACECOM /^[\w\d]+\s\.\scom\b/
+describe SPACECOM whatever . com
+score SPACECOM 3
+
+# blarson 2007-11-20
+uridnsbl URIBL_FLO flogoaway.com. A
+body URIBL_FLO eval:check_uridnsbl('URIBL_FLO')
+describe URIBL_FLO web sit in flogoaway.com
+tflags URIBL_FLO net
+score URIBL_FLO 1
+
+# blarson 2007-11-20
+body SOFTROU /\bwww\.softrou\.com\b/i
+describe SOFTROU www.softrou.com
+score SOFTROU 3
+
+# blarson 2007-11-20
+body GOOGLEPAGES /\bgooglepages\.com\b/i
+describe GOOGLEPAGES spammers use googlepages
+score GOOGLEPAGES 2