+
+# blarson 2008-06-03
+header BOUNDARYID content-type =~ /\bboundary\=\"Boundary_\(ID_/
+describe BOUNDARYID spamware boundary
+score BOUNDARYID 0.6
+
+# blarson 2008-07-02
+body GBKXWFLXF /\bgbkxwflxf\b/
+describe GBKXWFLXF gbkxwflxf
+score GBKXWFLXF 5
+
+# blarson 2008-09-07
+body LUKSUS /\bluksus\b/i
+score LUKSUS 4
+describe LUKSUS Luksus
+
+# blarson 2008-09-22
+header XIRONPORT X-IronPort-Anti-Spam-Filtered =~ /true/
+describe XIRONPORT claims to be ironport filtered
+score XIRONPORT 2.5
+
+# blarson 2008-10-13
+header AUTORESPON subject =~ /Auto_response/
+describe AUTORESPON Auto_response
+score AUTORESPON 3
+
+# blarson 2008-10-28
+header XWUM x-wum-to =~ /./
+describe XWUM X-WUM-TO
+score XWUM 2
+
+# cord 2008-10-31
+# compensate false-positives for 140.Red-80-25-20.staticIP.rima-tde.net and stuff
+header STATIC_RIMA_TDE received =~ /staticIP\.rima-tde\.net/
+describe STATIC_RIMA_TDE static IP from rima-tde.net
+score STATIC_RIMA_TDE -5
+
+# cord 2008-11-30 # compensate LDO_SUBSCRIBER bonus for Forum2Mail-Gw
+full NABBLE /lists\@nabble\.com/
+describe NABBLE sent through nabble.com
+score NABBLE 5
+
+# don 2009-02-04
+full HTML_NBSP /(\ ){3,}/
+describe HTML_NBSP Lots of
+score HTML_NBSP 2
+