describe MESSAGESUB really descriptive subject
score MESSAGESUB 3
-# don 2007-09-20
-header SENTMESSAGE subject =~ /(sent you a( personal|) message|would like to chat)/i
-describe SENTMESSAGE Sent you a message (like duh?)
-score SENTMESSAGE 2
-
# blarson 2006-03-16 2007-09-18 not working, replaced 2007-12-08
# body DEARDIGIT /^(?:well\s+)?(?:Dear|Hey|H[ea]y?ll?.?o|To|Attention|Hi+|Hey+a?|Bonjorno|(?:Yo\s*)+|(?:g[o0]+d\s*)?(?:d?ay|morning|evening?|afternoon|night)|what.?i?s\s+up|wa(?:s|z)+up|greetings?|Salutations|(Mail|News)\s+to|how(?:.?s|\s+is)?\s*(?:(?:it)?(?:\s+is)??\s*going|have\s+you\s+been|are you).?\s*(?:there|to\s+you)?|compliments|Regards|Adieu)\,?\s+(?:Account\s+\#?|\=?3d|)(?:bro|there|sir|Mr\.?)\s*?\d{3,}/i
body DEARDIGIT /^\s*(?:Good\s*)?(?:evenin|night|day|hi|hello|greetin|Compliment|Wa[sz]+up|dear|Regard|Mornin|(?:yo\s*)+)[sg]?\s+(?:there\s+)?\d{3,}/i
score BIGINTER 4
# blarson 2007-09-20
-header HASSENT subject =~ /\b(?:sent you a (?:personal|confidential)?\s*(?:message|note)|would like to chat)\b/i
+header HASSENT subject =~ /\b(?:sent you a (?:personal|confidential)?\s*(?:message|note))\b/i
describe HASSENT sent a message
score HASSENT 4
+# don 2008-04-19
+header WANTTOCHAT subject =~ /\b(?:(?:would like|wants|feels?) (?:to chat|like chatting|to keep up with you))\b/i
+describe WANTTOCHAT I want to chat/keep up with spam
+score WANTTOCHAT 4
+
# blarson 2007-09-20
header ORDERNUM subject =~ /\b(?:Order|Recipet)\s*.?\d{3,}/i
describe ORDERNUM order number
describe NICEGIRL nice girl
score NICEGIRL 3
-# blarson 2007-10-16
-header FEALCHAT subject =~ /\bFeel Like Chatting\b/i
-describe FEALCHAT Feel Like Chatting
-score FEALCHAT 3
-
# blarson 2007-10-18
header DFF1CE subject =~ /UmU6INDSydfF1CE/i
describe DFF1CE korean spam
header SUMHERE subject =~ /\b(?:summer|winter|fall|spring) is here\b/i
describe SUMHERE summer is here
score SUMHERE 3
+
+# don 2008-04-24
+header INVITATIONFROM subject =~ /^\s*Invitation\s*from\s*\w+\s*$/i
+describe INVITATIONFROM Invitation from Spammer
+score INVITATIONFROM 5
+
+# blarson 2008-04-28
+header RERE subject =~ /^Re\:\s+Re\:\s+/i
+describe RERE Re: Re:
+score RERE 1
+
+# don 2008-04-30
+header CLAIMTICKETS subject =~ /claim.+ticket/i
+describe CLAIMTICKETS Blah blah claim ticket
+score CLAIMTICKETS 4