+
+# don 2008-03-04
+body VIDEOFILBMS /www\.videofilbms\.cn/i
+describe VIDEOFILBMS video filbms url
+score VIDEOFILBMS 4
+
+# blarson 2008-03-05
+body ABESOFT /\bca.abesoft\.com\b/i
+describe ABESOFT www.cazabesoft.com etc.
+score ABESOFT 4
+
+# blarson 2008-03-06
+body STARLEYT /\bstarleyt\.com\b/i
+describe STARLEYT starleyt.com
+score STARLEYT 4
+
+# blarson 2008-03-07
+body URLOEM /\bhttp\:\/\/\{/
+describe URLOEM http://{urloem2}
+score URLOEM 3
+
+# blarson 2008-03-12
+body WILDERGO /\b(?:WilderGoLovan|golovable|BestGolova|SuperGolovaWorld)\.com\b/i
+describe WILDERGO WilderGoLovan.com
+score WILDERGO 4
+
+# don 2008-03-17
+body PROGOLD /\bprogold-inc\.com\b/i
+describe PROGOLD progold-inc.com
+score PROGOLD 4
+
+# blarson 2008-03-18
+body KMINU /\b(?:kminutte|rubstream)\.com\b/i
+describe KMINU kminutte.com
+score KMINU 4
+
+# don 2008-03-19
+body SCIJOURNALS /\bsciencejournals\.info\b/i
+describe SCIJOURNALS scientific journals
+score SCIJOURNALS 4
+
+# blarson 2008-03-19
+body JANEHOT /\bjane\d[\w\d]*\@hotmail\.com\s*$/
+describe JANEHOT jane*@hotmail.com
+score JANEHOT 3
+
+# blarson 2008-03-20
+rawbody BIFUTRA /\b(?:bifutra|veriapoli|xenifeao|toporaig|jieros|bifreca|werikine|incroomise|genbullenst|writeprovide)(?:\.|\=2E)com\b/
+describe BIFUTRA spammer web sites
+score BIFUTRA 4
+
+# don 2008-04-02
+body LONGLINEURL /^.{55,}\S\shttp:\/\/www\.\w+\.(?:com|net|org)\/\s*$/
+describe LONGLINEURL long line ending in a simple url
+score LONGLINEURL 2
+
+# don 2008-04-07
+uri MYTHANKYOUURI /www\.mythankyou\.com/i
+describe MYTHANKYOUURI www.mythankyou.com
+score MYTHANKYOUURI 5
+
+# blarson 2008-04-09
+uri SAMEAS /\bsupersameas\.com\b/
+describe SAMEAS supersameas.com
+score SAMEAS 3
+
+# blarson 2008-04-12
+body URIEXE /\bhttp:\S*\.exe\b/
+describe URIEXE .exe url
+score URIEXE 3
+
+# blarson 2008-04-24
+uri SANSATION /\b(?:sansationel|garmenys|iconaliste)\.com\b/i
+describe SANSATION sansationel.com
+score SANSATION 4
+
+# blarson 2008-05-04
+body EQMEDS /\beqmeds\b/i
+describe EQMEDS eqmeds
+score EQMEDS 4
+
+# blarson 2008-05-06
+uri MYLIVE /\bmylivegi\b/i
+describe MYLIVE mylivegirlx.com
+score MYLIVE 4
+
+# don 2008-05-26
+body BROKENURL /^\s*www((\s+\.\s*)|(\s*\.\+))\S+((\s+\.\s*)|(\s*\.\+))(com|net|org)\s*$/
+describe BROKENURL Broken url displayed
+score BROKENURL 4
+
+# don 2008-06-13
+body STUPIDURL /\w+\[\w+\](?:com|net|org)/
+describe STUPIDURL No one will guess that fooo[DOT]com is an URL!
+score STUPIDURL 2.5
+
+# blarson 2008-06-16
+body SUGARCOM /\b(?:indicatesugar|industryexpect|eset)\.com\b/
+describe SUGARCOM indicatesugar.com
+score SUGARCOM 4
+
+# blarson 2008-07-22
+body VIEWMOVIE /\/(?:(?:viewmovie|stream|watchit|topnews|hotnews|fresh|checkit|default|gowatch|showvideo|livestreaming|top|whatsup|tophot|lol|first|index1|1)\.html\b|(?:video|news2\/)\s*$)/
+describe VIEWMOVIE tabiloid style spam
+score VIEWMOVIE 3
+
+# blarson 2008-07-22
+uri OPERAMAIL /\bwww\.opera\.com\/mail\//
+describe OPERAMAIL opera.com mail
+score OPERAMAIL 1
+
+# blarson 2008-08-09
+body NOSITE /http:\/\/\//
+describe NOSITE http URL with no site
+score NOSITE 2
+
+# don 2008-09-04
+uri TIECORRECT /tiecorrect\.com/
+describe TIECORRECT Contains a tiecorrect.com uri
+score TIECORRECT 4
+
+# don 2009-02-04
+body FOURMINUTI /4minuti/
+describe FOURMINUTI Spam from 4 minuti
+score FOURMINUTI 3
+
+# don 2009-02-09
+uri CREDITREPORTURI /creditreport/
+describe CREDITREPORTURI Credit report in the url isn't good
+score CREDITREPORTURI 2
+
+uri YAARIURI /yaari.com/i
+describe YAARIURI Contains a yaari.com uri
+score YAARIURI 3
+
+uri MALADIRET /maladiretaemails/
+describe MALADIRET Contains a maladiret uri
+score MALADIRET 5
+
+uri DEBRICOLAJE /debricolaje/i
+describe DEBRICOLAJE Contains a debricolaje url
+score DEBRICOLAJE 6
+
+# blarson 2009-05-02
+uri ISUISSE /\bisuisse\.com/
+describe ISUISSE isuisse.com
+score ISUISSE 4
+
+# formorer 2010-01-23
+header LEXCHANGE subject =~ /(?:for|4)\s+L[i1]nks?\s+E?xcha?nge/i
+describe LEXCHANGE ask for link exchange
+score LEXCHANGE 4
+
+# don 2010-03-16
+uri EMAILSPARKLE /emailsparkle.com/
+describe EMAILSPARKLE emailsparkle.com uri
+score EMAILSPARKLE 4
+
+# don 2011-10-3
+uri MULTIPLYCOM /multiply.com/
+describge MULTIPLYCOM multiply.com uri
+score MULTIPLYCOM 3