1 # SARE Specific Ruleset for SpamAssassin
6 # 01.00.00 - Created new rule set
7 # 01.00.01 - Shortened some descriptions for version 3.0 lint
8 # 01.01.00 - Added rules for Word of Mouth / Shared Experiences spammer
9 # 01.01.01 - Removed rules duplicated elsewhere
10 # - Minor score tweaks based on recent mass-check
11 # 01.01.02 - Migrated some rules here from HTML rule set
12 # - Minor score tweaks based on recent mass-check
13 # 01.02.00 - Added a rule
14 # - Removed some obsolete rules (spam nolonger hitting)
15 # 01.02.01 - Improved WoM rules.
16 # Moved ANUMA rule to new uri.cf file
17 # 01.02.02 - Added SARE_SPEC_FROM_WOMR
18 # Added exclusion to SARE_SPEC_URI_WOMR
19 # 01.02.03 - Added __SARE_SPEC_BDY_WOMR8
20 # 01.02.04 - Added SARE_STRIPE
21 # 01.02.05 - Archived SARE_SPEC_MOOSQ, SARE_HTML_PILL3, SARE_HTML_PILL4
22 # 01.03.00 - Added Rolex rules
23 # 01.03.01 - Added SARE_SPEC_ROLEX_BRANDS and SARE_LOTTO rules
24 # 01.03.02 - Added SARE_SPEC_HDR_WOMR2 and SARE_SPEC_URI_WOMR2
25 # 01.03.03: May 26 2005
26 # Minor score updates based on additional mass-check
27 # Added "rawlex" intentional misspelling to rolex rules
28 # Added SARE_SPEC_URI_GGFF
29 # Added SARE_BODY_URI_STOCK
30 # 01.03.04: May 27 2005
31 # No rule changes; simply correcting revision history.
32 # 01.03.05: May 27 2005
33 # Added SARE_SPEC_BODY_NONEED
34 # 01.03.06: Sept 22 2005
35 # Modified WOMR From, Header, and URI rules.
36 # Added file 0: SARE_SPEC_LEO_CHEM
37 # Added file 0: SARE_SPEC_LEO_COST
38 # Added file 0: SARE_SPEC_LEO_DOLLARS
39 # Added file 0: SARE_SPEC_LEO_DRUGS
40 # Added file 0: SARE_SPEC_LEO_LINE02
41 # Added file 0: SARE_SPEC_LEO_LINE03
42 # Added file 0: SARE_SPEC_LEO_LINE04
43 # Added file 0: SARE_SPEC_LEO_LINE04d
44 # Added file 0: SARE_SPEC_LEO_LINE06
45 # Added file 0: SARE_SPEC_LEO_MEDS
46 # Added file 0: SARE_SPEC_LEO_PHARM
47 # Added file 0: SARE_SPEC_LEO_PHARM2
48 # Added file 0: SARE_SPEC_SPAMIS_FROM
49 # Added file 0: SARE_SPEC_SPAMIS_RECV
50 # 01.03.07: Oct 1 2005
51 # Added: SARE_SPEC_SPAMIS_BDY1, _BDY2
52 # 01.03.08: Oct 13 2005
53 # Added SARE_SPEC_LRD_COST_M1 and SARE_SPEC_LRD_COST_M2
54 # 01.03.09: Nov 18 2005
55 # Minor score tweaks based on recent mass-check
56 # Added SARE_SPEC_CLIENT_TOS
57 # Added SARE_SPEC_CLIENT_TOS2
58 # Added SARE_SPEC_DIPLOMA
59 # Added SARE_SPEC_GETITFREE
60 # Added SARE_SPEC_LEO_BORD
61 # Added SARE_SPEC_LEO_PIE2
62 # Added SARE_SPEC_PLEASEDOTHIS
63 # Added SARE_SPEC_PROLEO_M1
64 # Added SARE_SPEC_PROLEO_M1, M2, M2a
65 # Added SARE_SPEC_REALLY_WORKS, WORK2, WORK3, WORK4
66 # Added SARE_SPEC_ROLEX_HIQLT
67 # Added SARE_SPEC_ROLEX_NOV5A
68 # Added SARE_SPEC_XXGEOCITIES
70 # Archive SARE_SPEC_BANNEDCD
71 # Archive SARE_SPEC_DIRMEDIA
72 # Archive SARE_SPEC_FROM_BOB
73 # Archive SARE_SPEC_LEO_LINE06
74 # Archive SARE_SPEC_URI_GGFF
76 # 01.03.10: Nov 18 2005
77 # Added SARE_SPEC_ROLEX_NOV5B
78 # 01.03.11: Nov 24 2005
79 # Minor score tweaks based on recent mass-check
80 # Enhanced SARE_SPEC_XXGEOCITIES
81 # Modified SARE_SPEC_PROLEO_M1 subrules
82 # Added SARE_SPEC_ROLEX_NOV5C, NOV5D, NOV5E
83 # Added SARE_SPEC_REPL_OBFU1, OBFU2, OBFU3, OBFU4, OBFU5, OBFU6
84 # Added SARE_SPEC_REPLICA
85 # Added SARE_SPEC_SHORTQ
86 # Added SARE_SPEC_SPAMARREST
87 # 01.03.12: Nov 25 2005
88 # Improved SARE_SPEC_SPAMARREST to key only on spamarrest bounces
89 # Expanded watch spam tests
90 #@@# 01.03.13: May 27 2006
91 #@@# Modified repetition counts for efficiency
92 #@@# Minor score tweaks based on recent mass-check
93 #@@# Added SARE_SPEC_XXGEOCITIE5
94 #@@# Archived SARE_SPEC_CLIENT_TOS, SARE_SPEC_CLIENT_TOS2
95 #@@# Archived SARE_SPEC_PLEASEDOTHIS
96 #@@# Archived SARE_SPEC_GETITFREE
97 #@@# Archived SARE_SPEC_GETITFREE2
98 #@@# Archived SARE_SPEC_XXGEOCITIES
99 #@@# Archived SARE_STRIPE
100 #@@# Archived SARE_LOTTO_GREENCARD
101 #@@# Archived SARE_SPEC_SHORTQ
102 #@@# Archived SARE_SPEC_ROLEX_SUB2
103 #@@# Archived SARE_SPEC_ROLEX_NOV5C
105 # License: Artistic - see http://www.rulesemporium.com/license.txt
106 # Current Maintainer: Bob Menschel - RMSA@Menschel.net
107 # Current Home: http://www.rulesemporium.com/rules/70_sare_specific.cf
109 # This rule set is intended to catch the M.O. of specific spammers and/or
110 # specific spam that might otherwise elude more general-purpose rules.
111 # Our intent is that this rule set should not hit any non-spam.
112 # Because of the nature of the specific spams this rules file aims for,
113 # we cannot avoid ALL non-spam. However, any rule that hits ham hits
114 # spam/ham by at least 1000:1.
116 # Note that __subrules used within this rule set will frequently hit ham,
117 # but the meta tests or other tests with scores should NOT hit any ham.
119 body __SARE_SPEC_SPAMARR_UR m'http://(?:www\.)?spamarrest\.com/\w'
120 header __SARE_SPEC_SPAMARR_SB Subject =~ /Spam Arrest Verification Confirmation/
121 meta SARE_SPEC_SPAMARREST __SARE_SPEC_SPAMARR_UR && !__SARE_SPEC_SPAMARR_SB
122 describe SARE_SPEC_SPAMARREST probable invalid spam bounce
123 score SARE_SPEC_SPAMARREST 0.822
124 #ham SARE_SPEC_SPAMARREST confirmed
125 #hist SARE_SPEC_SPAMARREST Bob Menschel, Nov 2005
126 #note SARE_SPEC_SPAMARREST Since SpamArrest bounces contain only the headers of the original message, it's extremely
127 #note SARE_SPEC_SPAMARREST difficult to get a false positive on them. We use a high score, so that subject tests can flag emails as spam.
128 #note SARE_SPEC_SPAMARREST We do require at least a 1.666 score from other rule(s), to avoid false positives
129 #counts SARE_SPEC_SPAMARREST 45s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
130 #max SARE_SPEC_SPAMARREST 403s/6h of 366082 corpus (108301s/257781h RM) 11/25/05
131 #counts SARE_SPEC_SPAMARREST 3s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
133 ######## ###################### ##################################################
135 ######## ###################### ##################################################
137 header __SARE_SPEC_ROLEX_SUBJ Subject =~ /\b(?:r(?:[0o@]|aw)[1l|][3e]x|[g6]ucc[1l|])/i
138 describe __SARE_SPEC_ROLEX_SUBJ Subject: mentions a Rolex/Gucci/etc.
139 body __SARE_SPEC_ROLEX_BODY /\b(?:r(?:[0o@]|aw)[1l|][3e]x|[g6]ucc[1l|])/i
140 describe __SARE_SPEC_ROLEX_BODY Body: mentions a Rolex/Gucci/etc.
141 header __SARE_SPEC_WATCH_SUBJ Subject =~ /\b(?:w[a@]tch|h[a@]ndb[a@][g6])/i
142 describe __SARE_SPEC_WATCH_SUBJ Subject: mentions watch/handbag/etc.
143 body __SARE_SPEC_WATCH_BODY /\b(?:w[a@]tch|h[a@]ndb[a@][g6])/i
144 describe __SARE_SPEC_WATCH_BODY Body: mentions watch/handbag/etc.
146 meta SARE_SPEC_ROLEX ( ( __SARE_SPEC_WATCH_SUBJ && __SARE_SPEC_ROLEX_BODY ) || ( __SARE_SPEC_ROLEX_SUBJ && __SARE_SPEC_WATCH_BODY ) || ( __SARE_SPEC_ROLEX_SUBJ && __SARE_SPEC_ROLEX_BODY ) )
147 describe SARE_SPEC_ROLEX Rolex watch spam
148 score SARE_SPEC_ROLEX 1.666
149 #ham SARE_SPEC_ROLEX confirmed (2)
150 #hist SARE_SPEC_ROLEX Brent J. Nordquist -- b-nordquist at bethel.edu
151 #counts SARE_SPEC_ROLEX 890s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
152 #max SARE_SPEC_ROLEX 4335s/1h of 689155 corpus (348140s/341015h RM) 09/18/05
153 #counts SARE_SPEC_ROLEX 115s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
154 #counts SARE_SPEC_ROLEX 15s/0h of 682 corpus (290s/392h CRF) 02/20/05
155 #counts SARE_SPEC_ROLEX 93s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
156 #max SARE_SPEC_ROLEX 151s/0h of 10801 corpus (6349s/4452h CT) 05/24/05
157 #counts SARE_SPEC_ROLEX 611s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
158 #counts SARE_SPEC_ROLEX 434s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
159 #max SARE_SPEC_ROLEX 680s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
160 #counts SARE_SPEC_ROLEX 556s/0h of 54874 corpus (17700s/37174h JH-3.01) 03/13/05
161 #counts SARE_SPEC_ROLEX 298s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
162 #counts SARE_SPEC_ROLEX 76s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
163 #max SARE_SPEC_ROLEX 250s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
165 rawbody SARE_SPEC_WANT_ROLEX /^\s{0,30}(?:do\s{1,30})?(?:you\s{1,30})?(?:want|need)\s{1,30}(?:a\s{1,30})?(?:(?:cheap|non.?(?:expensive|pricey))s{1,30})?(R(?:[0o@]|aw)lex\s{1,30})?watch\s{0,30}\?/i
166 describe SARE_SPEC_WANT_ROLEX Body: asks if we want/need a Rolex
167 score SARE_SPEC_WANT_ROLEX 2.333
168 #hist SARE_SPEC_WANT_ROLEX Brent J. Nordquist -- b-nordquist at bethel.edu
169 #counts SARE_SPEC_WANT_ROLEX 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
170 #max SARE_SPEC_WANT_ROLEX 2038s/0h of 238467 corpus (112478s/125989h RM) 02/28/05
171 #counts SARE_SPEC_WANT_ROLEX 1s/0h of 682 corpus (290s/392h CRF) 02/20/05
172 #counts SARE_SPEC_WANT_ROLEX 4s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
173 #max SARE_SPEC_WANT_ROLEX 51s/0h of 11002 corpus (6572s/4430h CT) 03/10/05
174 #counts SARE_SPEC_WANT_ROLEX 39s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
175 #max SARE_SPEC_WANT_ROLEX 169s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
176 #counts SARE_SPEC_WANT_ROLEX 0s/0h of 4358 corpus (754s/3604h ft) 05/24/05
177 #counts SARE_SPEC_WANT_ROLEX 264s/0h of 54874 corpus (17700s/37174h JH-3.01) 03/13/05
178 #counts SARE_SPEC_WANT_ROLEX 4s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
179 #counts SARE_SPEC_WANT_ROLEX 0s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
180 #max SARE_SPEC_WANT_ROLEX 6s/0h of 27712 corpus (24263s/3449h MY) 02/27/05
182 body __SARE_SPEC_ROLEX_REP1 /r(?:[0o@]|aw)lex.{1,30}replica/i
183 body __SARE_SPEC_ROLEX_REP2 /replica.{1,30}r(?:[0o@]|aw)lex/i
184 meta SARE_SPEC_ROLEX_REP (__SARE_SPEC_ROLEX_REP1 || __SARE_SPEC_ROLEX_REP2)
185 describe SARE_SPEC_ROLEX_REP Rolex Replica
186 score SARE_SPEC_ROLEX_REP 1.666
187 #ham SARE_SPEC_ROLEX_REP Actual watch dealer / repair shop who occasionally fixes replicas
188 #hist SARE_SPEC_ROLEX_REP ninjaz -at- webexpress.com
189 #counts SARE_SPEC_ROLEX_REP 383s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
190 #max SARE_SPEC_ROLEX_REP 6436s/0h of 494544 corpus (223913s/270631h RM) 10/08/05
191 #counts SARE_SPEC_ROLEX_REP 191s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
192 #counts SARE_SPEC_ROLEX_REP 1s/0h of 682 corpus (290s/392h CRF) 02/20/05
193 #counts SARE_SPEC_ROLEX_REP 83s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
194 #max SARE_SPEC_ROLEX_REP 128s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
195 #counts SARE_SPEC_ROLEX_REP 714s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
196 #counts SARE_SPEC_ROLEX_REP 392s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
197 #max SARE_SPEC_ROLEX_REP 537s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
198 #counts SARE_SPEC_ROLEX_REP 255s/0h of 54874 corpus (17700s/37174h JH-3.01) 03/13/05
199 #counts SARE_SPEC_ROLEX_REP 310s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
200 #counts SARE_SPEC_ROLEX_REP 25s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
201 #max SARE_SPEC_ROLEX_REP 112s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
203 body SARE_SPEC_ROLEX_SEL /\bselection\b.{1,5}\bof\b.{1,30}\br(?:[0o@]|aw)lex/i
204 describe SARE_SPEC_ROLEX_SEL Large selection of Rolex
205 score SARE_SPEC_ROLEX_SEL 2.222
206 #hist SARE_SPEC_ROLEX_SEL ninjaz -at- webexpress.com
207 #counts SARE_SPEC_ROLEX_SEL 56s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
208 #max SARE_SPEC_ROLEX_SEL 1411s/0h of 174352 corpus (98963s/75389h RM) 02/18/05
209 #counts SARE_SPEC_ROLEX_SEL 17s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
210 #counts SARE_SPEC_ROLEX_SEL 2s/0h of 682 corpus (290s/392h CRF) 02/20/05
211 #counts SARE_SPEC_ROLEX_SEL 6s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
212 #max SARE_SPEC_ROLEX_SEL 27s/0h of 10801 corpus (6349s/4452h CT) 05/24/05
213 #counts SARE_SPEC_ROLEX_SEL 7s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
214 #max SARE_SPEC_ROLEX_SEL 42s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
215 #counts SARE_SPEC_ROLEX_SEL 12s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
216 #counts SARE_SPEC_ROLEX_SEL 65s/0h of 54874 corpus (17700s/37174h JH-3.01) 03/13/05
217 #counts SARE_SPEC_ROLEX_SEL 23s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
218 #counts SARE_SPEC_ROLEX_SEL 0s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
219 #max SARE_SPEC_ROLEX_SEL 4s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
221 body SARE_SPEC_ROLEX_ORD /\border\b.{1,30}\br(?:[0o@]|aw)lex/i
222 describe SARE_SPEC_ROLEX_ORD Order rolex
223 score SARE_SPEC_ROLEX_ORD 2.222
224 #hist SARE_SPEC_ROLEX_ORD ninjaz -at- webexpress.com
225 #counts SARE_SPEC_ROLEX_ORD 1s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
226 #max SARE_SPEC_ROLEX_ORD 1166s/0h of 174352 corpus (98963s/75389h RM) 02/18/05
227 #counts SARE_SPEC_ROLEX_ORD 1s/0h of 682 corpus (290s/392h CRF) 02/20/05
228 #counts SARE_SPEC_ROLEX_ORD 0s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
229 #max SARE_SPEC_ROLEX_ORD 5s/0h of 11002 corpus (6572s/4430h CT) 03/10/05
230 #counts SARE_SPEC_ROLEX_ORD 7s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
231 #max SARE_SPEC_ROLEX_ORD 51s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
232 #counts SARE_SPEC_ROLEX_ORD 0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
233 #max SARE_SPEC_ROLEX_ORD 1s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
234 #counts SARE_SPEC_ROLEX_ORD 67s/0h of 54131 corpus (16957s/37174h JH-3.01) 03/02/05
235 #counts SARE_SPEC_ROLEX_ORD 2s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
236 #counts SARE_SPEC_ROLEX_ORD 0s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
237 #max SARE_SPEC_ROLEX_ORD 7s/0h of 27712 corpus (24263s/3449h MY) 02/27/05
239 body SARE_SPEC_ROLEX_ITAL /\bitalian\b.{1,30}\bcrafted\b.{1,30}\br(?:[0o@]|aw)lex/i
240 describe SARE_SPEC_ROLEX_ITAL Italian Crafted Rolex
241 score SARE_SPEC_ROLEX_ITAL 2.222
242 #hist SARE_SPEC_ROLEX_ITAL ninjaz -at- webexpress.com
243 #counts SARE_SPEC_ROLEX_ITAL 56s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
244 #max SARE_SPEC_ROLEX_ITAL 118s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
245 #counts SARE_SPEC_ROLEX_ITAL 17s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
246 #counts SARE_SPEC_ROLEX_ITAL 2s/0h of 682 corpus (290s/392h CRF) 02/20/05
247 #counts SARE_SPEC_ROLEX_ITAL 2s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
248 #max SARE_SPEC_ROLEX_ITAL 33s/0h of 11002 corpus (6572s/4430h CT) 03/10/05
249 #counts SARE_SPEC_ROLEX_ITAL 12s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
250 #max SARE_SPEC_ROLEX_ITAL 83s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
251 #counts SARE_SPEC_ROLEX_ITAL 12s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
252 #counts SARE_SPEC_ROLEX_ITAL 150s/0h of 54874 corpus (17700s/37174h JH-3.01) 03/13/05
253 #counts SARE_SPEC_ROLEX_ITAL 24s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
254 #counts SARE_SPEC_ROLEX_ITAL 1s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
255 #max SARE_SPEC_ROLEX_ITAL 12s/0h of 27712 corpus (24263s/3449h MY) 02/27/05
257 body SARE_SPEC_ROLEX_PRICE /r(?:[0o@]|aw)le.?x.{1,30}\bfrom\b.{1,30}\$\d{1,30}/i
258 describe SARE_SPEC_ROLEX_PRICE Rolex for only...
259 score SARE_SPEC_ROLEX_PRICE 1.666
260 #hist SARE_SPEC_ROLEX_PRICE ninjaz -at- webexpress.com
261 #counts SARE_SPEC_ROLEX_PRICE 1s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
262 #max SARE_SPEC_ROLEX_PRICE 638s/0h of 174352 corpus (98963s/75389h RM) 02/18/05
263 #counts SARE_SPEC_ROLEX_PRICE 0s/0h of 682 corpus (290s/392h CRF) 02/20/05
264 #counts SARE_SPEC_ROLEX_PRICE 0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
265 #max SARE_SPEC_ROLEX_PRICE 2s/0h of 11002 corpus (6572s/4430h CT) 03/10/05
266 #counts SARE_SPEC_ROLEX_PRICE 5s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
267 #max SARE_SPEC_ROLEX_PRICE 42s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
268 #counts SARE_SPEC_ROLEX_PRICE 0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
269 #max SARE_SPEC_ROLEX_PRICE 9s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
270 #counts SARE_SPEC_ROLEX_PRICE 72s/0h of 54131 corpus (16957s/37174h JH-3.01) 03/02/05
271 #counts SARE_SPEC_ROLEX_PRICE 0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
272 #max SARE_SPEC_ROLEX_PRICE 7s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
273 #counts SARE_SPEC_ROLEX_PRICE 1s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
274 #max SARE_SPEC_ROLEX_PRICE 8s/0h of 27712 corpus (24263s/3449h MY) 02/27/05
276 body SARE_SPEC_ROLEX_BUY /\bbuy\b.{1,30}\br(?:[0o@]|aw)lex/i
277 describe SARE_SPEC_ROLEX_BUY Buy rolex
278 score SARE_SPEC_ROLEX_BUY 1.666
279 #ham SARE_SPEC_ROLEX_BUY confirmed (3)
280 #hist SARE_SPEC_ROLEX_BUY ninjaz -at- webexpress.com
281 #counts SARE_SPEC_ROLEX_BUY 191s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
282 #max SARE_SPEC_ROLEX_BUY 5938s/0h of 494544 corpus (223913s/270631h RM) 10/08/05
283 #counts SARE_SPEC_ROLEX_BUY 54s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
284 #counts SARE_SPEC_ROLEX_BUY 2s/0h of 682 corpus (290s/392h CRF) 02/20/05
285 #counts SARE_SPEC_ROLEX_BUY 28s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
286 #max SARE_SPEC_ROLEX_BUY 55s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
287 #counts SARE_SPEC_ROLEX_BUY 355s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
288 #counts SARE_SPEC_ROLEX_BUY 26s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
289 #max SARE_SPEC_ROLEX_BUY 174s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
290 #counts SARE_SPEC_ROLEX_BUY 130s/0h of 54874 corpus (17700s/37174h JH-3.01) 03/13/05
291 #counts SARE_SPEC_ROLEX_BUY 91s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
292 #counts SARE_SPEC_ROLEX_BUY 1s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
293 #max SARE_SPEC_ROLEX_BUY 23s/0h of 47717 corpus (43727s/3990h MY) 05/25/05
295 body __SARE_SPEC_GENU_REPL /\bgenuine\b.{1,30}\breplica/i
296 meta SARE_SPEC_ROLEX_GENREP ( __SARE_SPEC_GENU_REPL && SARE_SPEC_ROLEX )
297 describe SARE_SPEC_ROLEX_GENREP Genuine Replica Rolex!
298 score SARE_SPEC_ROLEX_GENREP 1.666
299 #hist SARE_SPEC_ROLEX_GENREP ninjaz -at- webexpress.com
300 #counts SARE_SPEC_ROLEX_GENREP 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
301 #max SARE_SPEC_ROLEX_GENREP 243s/0h of 400503 corpus (178160s/222343h RM) 03/31/05
302 #counts SARE_SPEC_ROLEX_GENREP 2s/0h of 682 corpus (290s/392h CRF) 02/20/05
303 #counts SARE_SPEC_ROLEX_GENREP 2s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
304 #max SARE_SPEC_ROLEX_GENREP 25s/0h of 11002 corpus (6572s/4430h CT) 03/10/05
305 #counts SARE_SPEC_ROLEX_GENREP 3s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
306 #max SARE_SPEC_ROLEX_GENREP 20s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
307 #counts SARE_SPEC_ROLEX_GENREP 24s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
308 #counts SARE_SPEC_ROLEX_GENREP 83s/0h of 54874 corpus (17700s/37174h JH-3.01) 03/13/05
309 #counts SARE_SPEC_ROLEX_GENREP 2s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
310 #counts SARE_SPEC_ROLEX_GENREP 0s/0h of 53432 corpus (48386s/5046h MY) 10/08/05
311 #max SARE_SPEC_ROLEX_GENREP 12s/0h of 31513 corpus (27912s/3601h MY) 03/09/05
313 body SARE_SPEC_ROLEX_CHEAP /(?:cheap|non.?expensive){1,30}r(?:[0o@]|aw)le.?x/i
314 describe SARE_SPEC_ROLEX_CHEAP Cheap Rolex!
315 score SARE_SPEC_ROLEX_CHEAP 1.178
316 #hist SARE_SPEC_ROLEX_CHEAP ninjaz -at- webexpress.com
317 #ham SARE_SPEC_ROLEX_CHEAP Spam statement quoted from NBC Universal CEO Bob Wright on electronic newsletter
318 #counts SARE_SPEC_ROLEX_CHEAP 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
319 #max SARE_SPEC_ROLEX_CHEAP 81s/0h of 174380 corpus (98964s/75416h RM) 02/19/05
320 #counts SARE_SPEC_ROLEX_CHEAP 0s/0h of 682 corpus (290s/392h CRF) 02/20/05
321 #counts SARE_SPEC_ROLEX_CHEAP 0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
322 #max SARE_SPEC_ROLEX_CHEAP 5s/0h of 11002 corpus (6572s/4430h CT) 03/10/05
323 #counts SARE_SPEC_ROLEX_CHEAP 0s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
324 #max SARE_SPEC_ROLEX_CHEAP 2s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
325 #counts SARE_SPEC_ROLEX_CHEAP 0s/0h of 4358 corpus (754s/3604h ft) 05/24/05
326 #counts SARE_SPEC_ROLEX_CHEAP 15s/0h of 54131 corpus (16957s/37174h JH-3.01) 03/02/05
327 #counts SARE_SPEC_ROLEX_CHEAP 0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
328 #max SARE_SPEC_ROLEX_CHEAP 6s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
329 #counts SARE_SPEC_ROLEX_CHEAP 0s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
330 #max SARE_SPEC_ROLEX_CHEAP 3s/0h of 47717 corpus (43727s/3990h MY) 05/25/05
332 body SARE_SPEC_REPLICA_OBFU /\b(?:rep[l|]i[ck]a|rep lica|watach|wacth)\b/i
333 describe SARE_SPEC_REPLICA_OBFU Rolex with obfuscated replica
334 score SARE_SPEC_REPLICA_OBFU 1.812
335 #stype SARE_SPEC_REPLICA_OBFU obfu
336 #ham SARE_SPEC_REPLICA_OBFU Replika in non-English emails
337 #hist SARE_SPEC_REPLICA_OBFU Robert Brooks, Feb 18 2005; Fred Taresevicius, Nov 2005
338 #counts SARE_SPEC_REPLICA_OBFU 821s/4h of 173230 corpus (99061s/74169h RM) 05/11/06
339 #counts SARE_SPEC_REPLICA_OBFU 1s/0h of 9999 corpus (5651s/4348h AxB) 05/14/06
340 #counts SARE_SPEC_REPLICA_OBFU 0s/0h of 682 corpus (290s/392h CRF) 02/20/05
341 #counts SARE_SPEC_REPLICA_OBFU 31s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
342 #counts SARE_SPEC_REPLICA_OBFU 58s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
343 #counts SARE_SPEC_REPLICA_OBFU 61s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
344 #counts SARE_SPEC_REPLICA_OBFU 4s/0h of 54131 corpus (16957s/37174h JH-3.01) 03/02/05
345 #counts SARE_SPEC_REPLICA_OBFU 143s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
346 #counts SARE_SPEC_REPLICA_OBFU 12s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
348 header SARE_SPEC_ROLEX_AFFRD Subject =~ /\bafford\b.{1,30}\br(?:[0o@]|aw)lex\b/i
349 describe SARE_SPEC_ROLEX_AFFRD Can you afford a rolex?
350 score SARE_SPEC_ROLEX_AFFRD 0.867
351 #hist SARE_SPEC_ROLEX_AFFRD Robert Brooks, Feb 18 2005
352 #counts SARE_SPEC_ROLEX_AFFRD 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
353 #max SARE_SPEC_ROLEX_AFFRD 47s/0h of 400503 corpus (178160s/222343h RM) 03/31/05
354 #counts SARE_SPEC_ROLEX_AFFRD 0s/0h of 682 corpus (290s/392h CRF) 02/20/05
355 #counts SARE_SPEC_ROLEX_AFFRD 0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
356 #max SARE_SPEC_ROLEX_AFFRD 1s/0h of 11002 corpus (6572s/4430h CT) 03/10/05
357 #counts SARE_SPEC_ROLEX_AFFRD 1s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
358 #counts SARE_SPEC_ROLEX_AFFRD 3s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
359 #max SARE_SPEC_ROLEX_AFFRD 4s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
360 #counts SARE_SPEC_ROLEX_AFFRD 3s/0h of 54131 corpus (16957s/37174h JH-3.01) 03/02/05
361 #counts SARE_SPEC_ROLEX_AFFRD 0s/0h of 27712 corpus (24263s/3449h MY) 02/27/05
363 header SARE_SPEC_ROLEX_BRANDS Subject =~ /(\b(cartier|piaget|omega|longines|vuitton|r(?:[0o@]|aw)lex)\b.{0,30}){3,}/i
364 describe SARE_SPEC_ROLEX_BRANDS Spammer subject - multiple brands
365 score SARE_SPEC_ROLEX_BRANDS 1.111
366 #stype SARE_SPEC_ROLEX_BRANDS spamp
367 #hist SARE_SPEC_ROLEX_BRANDS Robert Brooks, Feb 21 2005
368 #counts SARE_SPEC_ROLEX_BRANDS 25s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
369 #max SARE_SPEC_ROLEX_BRANDS 48s/0h of 400503 corpus (178160s/222343h RM) 03/31/05
370 #counts SARE_SPEC_ROLEX_BRANDS 1s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
371 #counts SARE_SPEC_ROLEX_BRANDS 0s/0h of 11002 corpus (6572s/4430h CT) 03/10/05
372 #counts SARE_SPEC_ROLEX_BRANDS 1s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
373 #counts SARE_SPEC_ROLEX_BRANDS 26s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
374 #counts SARE_SPEC_ROLEX_BRANDS 20s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
375 #counts SARE_SPEC_ROLEX_BRANDS 0s/0h of 27712 corpus (24263s/3449h MY) 02/27/05
376 #counts SARE_SPEC_ROLEX_BRANDS 0s/0h of 54131 corpus (16957s/37174h JH-3.01) 03/02/05
378 header SARE_SPEC_ROLEX_BRAND2 Subject =~ /(?:yearn for|want) (?:cartier|piaget|omega|longines|vuitton|r(?:[0o@]|aw)lex)/i
379 describe SARE_SPEC_ROLEX_BRAND2 Spammer subject - multiple brands
380 score SARE_SPEC_ROLEX_BRAND2 1.111
381 #stype SARE_SPEC_ROLEX_BRAND2 spamp
382 #hist SARE_SPEC_ROLEX_BRAND2 Bob Menschel, Nov 2005
383 #counts SARE_SPEC_ROLEX_BRAND2 8s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
384 #counts SARE_SPEC_ROLEX_BRAND2 4s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
385 #counts SARE_SPEC_ROLEX_BRAND2 2s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
386 #counts SARE_SPEC_ROLEX_BRAND2 2s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
387 #counts SARE_SPEC_ROLEX_BRAND2 3s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
389 body SARE_SPEC_ROLEX_HIQLT m'high(?:est)?[- ]qualit(?:y|ies) (:?rep[|l]i[ck]a|reproduction|dup[l|]i[ck]ate|look)'i
390 describe SARE_SPEC_ROLEX_HIQLT replica watch spam sign
391 score SARE_SPEC_ROLEX_HIQLT 1.666
392 #ham SARE_SPEC_ROLEX_HIQLT confirmation pending
393 #hist SARE_SPEC_ROLEX_HIQLT Bob Menschel, Nov 2005
394 #counts SARE_SPEC_ROLEX_HIQLT 366s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
395 #max SARE_SPEC_ROLEX_HIQLT 1051s/0h of 386238 corpus (131050s/255188h RM) 11/17/05
396 #counts SARE_SPEC_ROLEX_HIQLT 63s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
397 #counts SARE_SPEC_ROLEX_HIQLT 37s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
398 #max SARE_SPEC_ROLEX_HIQLT 53s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
399 #counts SARE_SPEC_ROLEX_HIQLT 325s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
400 #counts SARE_SPEC_ROLEX_HIQLT 13s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
401 #counts SARE_SPEC_ROLEX_HIQLT 16s/1h of 23026 corpus (17290s/5736h MY) 05/14/06
402 #counts SARE_SPEC_ROLEX_HIQLT 79s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
404 body SARE_SPEC_ROLEX_NOV5A /(?!want, watch)(?!(?:see|want)(?:[,s]|ed|ing)? (?:> )?(?:(?:me|you|him|her|them|us|--) )?(?:> )?(?:and|it|to|the|your) (?:> )?(?:clock|watch))(?:too many|see your|present of|replicas?|reproductions?|imitations?|duplicates?|look.?alike|decent|producing|acquire|(?:want|do not blow).{1,10}|solid(?:ly.?built)|wear.{1,10}new.{1,10}|(?:retail|consignment|Fair buys|fashionable|(?:gift|treat) for you|swiss.?(?:made|style)|be (?:trendy|visible) with).{1,25}) \b(?:(wrist(?:wear)? ?)?(?:watch(es)?|clocks?)|chrono(?:meter|piece|keeper)s?|time.?(?:piece|keeper)s?)\b/i
405 describe SARE_SPEC_ROLEX_NOV5A replica watch spam sign
406 score SARE_SPEC_ROLEX_NOV5A 1.062
407 #hist SARE_SPEC_ROLEX_NOV5A Bob Menschel, Nov 2005
408 #counts SARE_SPEC_ROLEX_NOV5A 142s/1h of 173230 corpus (99061s/74169h RM) 05/11/06
409 #max SARE_SPEC_ROLEX_NOV5A 392s/7h of 386802 corpus (130807s/255995h RM) 11/13/05
410 #counts SARE_SPEC_ROLEX_NOV5A 200s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
411 #counts SARE_SPEC_ROLEX_NOV5A 45s/4h of 13339 corpus (7462s/5877h CT) 05/14/06
412 #counts SARE_SPEC_ROLEX_NOV5A 138s/3h of 42419 corpus (34292s/8127h FVGT) 05/15/06
413 #counts SARE_SPEC_ROLEX_NOV5A 288s/4h of 155610 corpus (103978s/51632h DOC) 05/14/06
414 #counts SARE_SPEC_ROLEX_NOV5A 305s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
415 #counts SARE_SPEC_ROLEX_NOV5A 67s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
416 #max SARE_SPEC_ROLEX_NOV5A 71s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
418 body SARE_SPEC_ROLEX_NOV5B /(?:appearance|brand.?name) at (?:a )?(?:dis[ck]ount|reasonable|sensible|(?:quarter|fra[ck]tion).{1,15}(?:[ck]ost|price|fee))|noteworthy variety|[ck]oveted provider|deluxe masterpiece|(?:more than|over) \d{4}.{1,15}(?:brands|styles)|Shopper gratifi[ck]ation|[ck]hronomaster|(?:sele[ck]tion of|solid(?:ly.?build|superb)) (?:repli[ck]as?|reprodu[ck]tions?|dupli[ck]ates?|look.?alikes?)|noteworthy [ck]onsignments?|(?:repli[ck]as?|reprodu[ck]tions?|dupli[ck]ates?|look.?alikes?) trade|fusion of craftmanship and affordability/i
419 describe SARE_SPEC_ROLEX_NOV5B replica watch spam sign
420 score SARE_SPEC_ROLEX_NOV5B 1.111
421 #stype SARE_SPEC_ROLEX_NOV5B spamp
422 #hist SARE_SPEC_ROLEX_NOV5B Bob Menschel, Nov 2005
423 #counts SARE_SPEC_ROLEX_NOV5B 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
424 #max SARE_SPEC_ROLEX_NOV5B 16s/0h of 330817 corpus (115576s/215241h RM) 11/19/05
425 #counts SARE_SPEC_ROLEX_NOV5B 5s/0h of 4891 corpus (3546s/1345h AxB) 11/20/05
426 #counts SARE_SPEC_ROLEX_NOV5B 0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
427 #counts SARE_SPEC_ROLEX_NOV5B 0s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
428 #counts SARE_SPEC_ROLEX_NOV5B 1s/0h of 74875 corpus (25026s/49849h DOC) 11/19/05
429 #counts SARE_SPEC_ROLEX_NOV5B 0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
430 #max SARE_SPEC_ROLEX_NOV5B 2s/0h of 9802 corpus (4922s/4880h FT) 11/20/05
431 #counts SARE_SPEC_ROLEX_NOV5B 12s/0h of 42567 corpus (37305s/5262h MY) 11/19/05
432 #counts SARE_SPEC_ROLEX_NOV5B 1s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
434 body SARE_SPEC_ROLEX_NOV5D /online.{1,20}purchase.{1,20}watch|purchase.{1,20}watch.{1,20}online|purchase.{1,20}online.{1,20}watch|watch.{1,10}purchase.{1,20}online|Online trailing system/i
435 describe SARE_SPEC_ROLEX_NOV5D replica watch spam sign
436 score SARE_SPEC_ROLEX_NOV5D 1.111
437 #stype SARE_SPEC_ROLEX_NOV5D spamp
438 #hist SARE_SPEC_ROLEX_NOV5D Bob Menschel, Nov 2005
439 #counts SARE_SPEC_ROLEX_NOV5D 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
440 #max SARE_SPEC_ROLEX_NOV5D 4s/0h of 366082 corpus (108301s/257781h RM) 11/25/05
441 #counts SARE_SPEC_ROLEX_NOV5D 1s/0h of 9999 corpus (5651s/4348h AxB) 05/14/06
442 #counts SARE_SPEC_ROLEX_NOV5D 2s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
444 body SARE_SPEC_ROLEX_NOV5E /(?!watch(?:ed|ing)?.{1,15}for you)\b(?:(wrist(?:wear)? ?)?(?:watch(es)?|clocks?)|chrono(?:meter|piece|keeper)s?|time.?(?:piece|keeper)s?).{1,15}for you\b/i
445 describe SARE_SPEC_ROLEX_NOV5E replica watch spam sign
446 score SARE_SPEC_ROLEX_NOV5E 0.500
447 #hist SARE_SPEC_ROLEX_NOV5E Bob Menschel, Nov 2005
448 #stype SARE_SPEC_ROLEX_NOV5E spamp
449 #counts SARE_SPEC_ROLEX_NOV5E 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
450 #max SARE_SPEC_ROLEX_NOV5E 6s/3h of 366109 corpus (108323s/257786h RM) 11/25/05
451 #counts SARE_SPEC_ROLEX_NOV5E 1s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
452 #counts SARE_SPEC_ROLEX_NOV5E 1s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
454 body SARE_SPEC_ROLEX_NOV5F /(?:decadent|brand.?name).{1,15}\b(?:(wrist(?:wear)? ?)?(?:watch(es)?|clocks?)|chrono(?:meter|piece|keeper)s?|time.?(?:piece|keeper)s?)\b/i
455 describe SARE_SPEC_ROLEX_NOV5F replica watch spam sign
456 score SARE_SPEC_ROLEX_NOV5F 0.666
457 #stype SARE_SPEC_ROLEX_NOV5F spamp
458 #ham SARE_SPEC_ROLEX_NOV5F valid watch/clock importer/wholesaler
459 #hist SARE_SPEC_ROLEX_NOV5F Bob Menschel, Nov 2005
460 #counts SARE_SPEC_ROLEX_NOV5F 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
461 #max SARE_SPEC_ROLEX_NOV5F 11s/2h of 366082 corpus (108301s/257781h RM) 11/25/05
462 #counts SARE_SPEC_ROLEX_NOV5F 8s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
463 #counts SARE_SPEC_ROLEX_NOV5F 2s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
465 body SARE_SPEC_REPL_OBFU1 /(?!watches)(?!watch \* ?s)(?:w|\\\/\\\/|VV|[\xC5][\xB4-\xB5]|[\xCF][\x88-\x89]|[\xCF]\x8E])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|[\xC4][\x80-\x85]|[\xC7][\x8D-\x8E]|[\xC7][\xBA-\xBB]|[\xCE][\x86]|[\xCE][\x91]|[\xCE][\x94]|[\xCE][\x9B]|[\xCE][\xAC]|[\xCE][\xB1]|[\xD0][\x90]|[\xD0]\xB0)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|[\xC5][\xA2-\xA7]|[\xCE][\xA4]|[\xCF][\x84]|[\xD0][\xA2]|[\xD1]\x82)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[c\*\xC7\xE7\xA2\xA9]|[\xC4][\x86-\x8D]|[\xD0][\xA1]|[\xD1]\x81)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:h|[\xC4][\xA4-\xA7]|[\xCE][\x89]|[\xCE][\x97]|[\xD0][\x9D]|[\xD0][\xBD]|[\xD1][\x92]|[\xD2][\xA2-\xA3]|[\xD2][\xBA-\xBB]|[\xD5]\xB0])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE][\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|[\xD1]\x91)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[s5\$\xA7]|[\xC5][\x9A-\xA1]|[\xD0][\x85]|[\xD1][\x95]|[\xD5]\x8F)\b/i
466 body SARE_SPEC_REPL_OBFU2 /(?!wrist.?watch)(?:w|\\\/\\\/|VV|[\xC5][\xB4-\xB5]|[\xCF][\x88-\x89]|[\xCF]\x8E])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|[\xC5][\x94-\x99]|[\xD1]\x93)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|[\xC4][\xA8-\xB0]|[\xC4][\xBA]|[\xC4][\xBC]|[\xC4][\xBE]|[\xC5][\x80]|[\xC5][\x82]|[\xC7][\x8F-\x90]|[\xD0][\x86-\x87]|[\xD1][\x96-\x97]|[\xCE][\x8A]|[\xCE][\x90]|[\xCE][\x99]|[\xCE][\xAA]|[\xCE][\xAF]|[\xCE][\xB9]|[\xCF]\x8A)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[s5\$\xA7]|[\xC5][\x9A-\xA1]|[\xD0][\x85]|[\xD1][\x95]|[\xD5]\x8F)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|[\xC5][\xA2-\xA7]|[\xCE][\xA4]|[\xCF][\x84]|[\xD0][\xA2]|[\xD1]\x82)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:w|\\\/\\\/|VV|[\xC5][\xB4-\xB5]|[\xCF][\x88-\x89]|[\xCF]\x8E])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|[\xC4][\x80-\x85]|[\xC7][\x8D-\x8E]|[\xC7][\xBA-\xBB]|[\xCE][\x86]|[\xCE][\x91]|[\xCE][\x94]|[\xCE][\x9B]|[\xCE][\xAC]|[\xCE][\xB1]|[\xD0][\x90]|[\xD0]\xB0)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|[\xC5][\xA2-\xA7]|[\xCE][\xA4]|[\xCF][\x84]|[\xD0][\xA2]|[\xD1]\x82)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[c\*\xC7\xE7\xA2\xA9]|[\xC4][\x86-\x8D]|[\xD0][\xA1]|[\xD1]\x81)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:h|[\xC4][\xA4-\xA7]|[\xCE][\x89]|[\xCE][\x97]|[\xD0][\x9D]|[\xD0][\xBD]|[\xD1][\x92]|[\xD2][\xA2-\xA3]|[\xD2][\xBA-\xBB]|[\xD5]\xB0])/i
467 body SARE_SPEC_REPL_OBFU3 /(?:w|\\\/\\\/|VV|[\xC5][\xB4-\xB5]|[\xCF][\x88-\x89]|[\xCF\x8E])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|[\xC5][\x94-\x99]|[\xD1\x93])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|[\xC4][\xA8-\xB0]|[\xC4][\xBA]|[\xC4][\xBC]|[\xC4][\xBE]|[\xC5][\x80]|[\xC5][\x82]|[\xC7][\x8F-\x90]|[\xD0][\x86-\x87]|[\xD1][\x96-\x97]|[\xCE][\x8A]|[\xCE][\x90]|[\xCE][\x99]|[\xCE][\xAA]|[\xCE][\xAF]|[\xCE][\xB9]|[\xCF\x8A])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[s5\$\xA7]|[\xC5][\x9A-\xA1]|[\xD0][\x85]|[\xD1][\x95]|[\xD5]\x8F)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|[\xC5][\xA2-\xA7]|[\xCE][\xA4]|[\xCF][\x84]|[\xD0][\xA2]|[\xD1]\x82)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[c\*\xC7\xE7\xA2\xA9]|[\xC4][\x86-\x8D]|[\xD0][\xA1]|[\xD1]\x81)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[l1I\|\xA3]|(?:\xC5[\x80-\x82]|[\xC4][\xB9-\xBF]))[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|[\xC5][\x8C-\x91]|[\xC6][\xA0-\xA1]|[\xC7][\x91-\x92]|[\xC7][\xBE-\xBF]|[\xCE][\x8C]|[\xCE][\x98]|[\xCE][\x9F]|[\xCE][\xB8]|[\xCE][\xBF]|[\xCF][\x8C]|[\xD0][\x9E]|[\xD0][\xBE]|[\xD5]\x95)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[c\*\xC7\xE7\xA2\xA9]|[\xC4][\x86-\x8D]|[\xD0][\xA1]|[\xD1\x81])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:k|[\xC4][\xB6-\xB8]|[\xCE][\x9A]|[\xCE][\xBA]|[\xD0][\x8C]|[\xD0][\x9A]|[\xD0][\xBA]|[\xD1][\x9C]|[\xD2][\x9A-\x9D]])/i
468 body SARE_SPEC_REPL_OBFU4 /(?!chronometer)(?:[c\*\xC7\xE7\xA2\xA9]|[\xC4][\x86-\x8D]|[\xD0][\xA1]|[\xD1]\x81)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:h|[\xC4][\xA4-\xA7]|[\xCE][\x89]|[\xCE][\x97]|[\xD0][\x9D]|[\xD0][\xBD]|[\xD1][\x92]|[\xD2][\xA2-\xA3]|[\xD2][\xBA-\xBB]|[\xD5]\xB0])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|[\xC5][\x94-\x99]|[\xD1]\x93)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|[\xC5][\x8C-\x91]|[\xC6][\xA0-\xA1]|[\xC7][\x91-\x92]|[\xC7][\xBE-\xBF]|[\xCE][\x8C]|[\xCE][\x98]|[\xCE][\x9F]|[\xCE][\xB8]|[\xCE][\xBF]|[\xCF][\x8C]|[\xD0][\x9E]|[\xD0][\xBE]|[\xD5]\x95)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[n\xD1\xF1]|\|\\\||[\xC5][\x83-\x8B]|[\xCE][\x9D]|[\xCE][\xA0]|[\xCE][\xAE]|[\xCE][\xB7]|[\xD5][\xB2]|[\xD5]\xB8)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|[\xC5][\x8C-\x91]|[\xC6][\xA0-\xA1]|[\xC7][\x91-\x92]|[\xC7][\xBE-\xBF]|[\xCE][\x8C]|[\xCE][\x98]|[\xCE][\x9F]|[\xCE][\xB8]|[\xCE][\xBF]|[\xCF][\x8C]|[\xD0][\x9E]|[\xD0][\xBE]|[\xD5]\x95)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:m|rn|\/V\\|\/\\\/\\|[\xCE][\x9C]|[\xD0][\x9C]|[\xD0]\xBC])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE][\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|[\xD1]\x91)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|[\xC5][\xA2-\xA7]|[\xCE][\xA4]|[\xCF][\x84]|[\xD0][\xA2]|[\xD1]\x82)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE][\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|[\xD1\x91])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|[\xC5][\x94-\x99]|[\xD1\x93])/i
469 body SARE_SPEC_REPL_OBFU5 /(?!time.?piece)(?:[t\+]|[\xC5][\xA2-\xA7]|[\xCE][\xA4]|[\xCF][\x84]|[\xD0][\xA2]|[\xD1]\x82)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|[\xC4][\xA8-\xB0]|[\xC4][\xBA]|[\xC4][\xBC]|[\xC4][\xBE]|[\xC5][\x80]|[\xC5][\x82]|[\xC7][\x8F-\x90]|[\xD0][\x86-\x87]|[\xD1][\x96-\x97]|[\xCE][\x8A]|[\xCE][\x90]|[\xCE][\x99]|[\xCE][\xAA]|[\xCE][\xAF]|[\xCE][\xB9]|[\xCF]\x8A)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:m|rn|\/V\\|\/\\\/\\|[\xCE][\x9C]|[\xD0][\x9C]|[\xD0]\xBC])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE][\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|[\xD1]\x91)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[p\xDE]|[\xCE][\xA1]|[\xCF][\x81]|[\xD0][\xA0]|[\xD1]\x80)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|[\xC4][\xA8-\xB0]|[\xC4][\xBA]|[\xC4][\xBC]|[\xC4][\xBE]|[\xC5][\x80]|[\xC5][\x82]|[\xC7][\x8F-\x90]|[\xD0][\x86-\x87]|[\xD1][\x96-\x97]|[\xCE][\x8A]|[\xCE][\x90]|[\xCE][\x99]|[\xCE][\xAA]|[\xCE][\xAF]|[\xCE][\xB9]|[\xCF]\x8A)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE][\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|[\xD1]\x91)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[c\*\xC7\xE7\xA2\xA9]|[\xC4][\x86-\x8D]|[\xD0][\xA1]|[\xD1]\x81)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE][\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|[\xD1]\x91)/i
470 body SARE_SPEC_REPL_OBFU6 /(?!time.?keeper)(?:[t\+]|[\xC5][\xA2-\xA7]|[\xCE][\xA4]|[\xCF][\x84]|[\xD0][\xA2]|[\xD1]\x82)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|[\xC4][\xA8-\xB0]|[\xC4][\xBA]|[\xC4][\xBC]|[\xC4][\xBE]|[\xC5][\x80]|[\xC5][\x82]|[\xC7][\x8F-\x90]|[\xD0][\x86-\x87]|[\xD1][\x96-\x97]|[\xCE][\x8A]|[\xCE][\x90]|[\xCE][\x99]|[\xCE][\xAA]|[\xCE][\xAF]|[\xCE][\xB9]|[\xCF]\x8A)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:m|rn|\/V\\|\/\\\/\\|[\xCE][\x9C]|[\xD0][\x9C]|[\xD0]\xBC])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE][\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|[\xD1]\x91)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:k|[\xC4][\xB6-\xB8]|[\xCE][\x9A]|[\xCE][\xBA]|[\xD0][\x8C]|[\xD0][\x9A]|[\xD0][\xBA]|[\xD1][\x9C]|[\xD2][\x9A-\x9D]])[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE][\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|[\xD1]\x91)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE][\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|[\xD1]\x91)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[p\xDE]|[\xCE][\xA1]|[\xCF][\x81]|[\xD0][\xA0]|[\xD1]\x80)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE][\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|[\xD1]\x91)[\x01-\x2F\x3A-\x40\x5B-\x60\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|[\xC5][\x94-\x99]|[\xD1]\x93)/i
471 score SARE_SPEC_REPL_OBFU1 1.666
472 score SARE_SPEC_REPL_OBFU2 1.666
473 score SARE_SPEC_REPL_OBFU3 1.666
474 score SARE_SPEC_REPL_OBFU4 1.666
475 score SARE_SPEC_REPL_OBFU5 1.666
476 score SARE_SPEC_REPL_OBFU6 1.666
477 #stype SARE_SPEC_REPL_OBFU1 obfu
478 #stype SARE_SPEC_REPL_OBFU2 obfu
479 #stype SARE_SPEC_REPL_OBFU3 obfu
480 #stype SARE_SPEC_REPL_OBFU4 obfu
481 #stype SARE_SPEC_REPL_OBFU5 obfu
482 #stype SARE_SPEC_REPL_OBFU6 obfu
483 #hist SARE_SPEC_REPL_OBFU1 Bob Menschel, Nov 2005
484 #hist SARE_SPEC_REPL_OBFU2 Bob Menschel, Nov 2005
485 #hist SARE_SPEC_REPL_OBFU3 Bob Menschel, Nov 2005
486 #hist SARE_SPEC_REPL_OBFU4 Bob Menschel, Nov 2005
487 #hist SARE_SPEC_REPL_OBFU5 Bob Menschel, Nov 2005
488 #hist SARE_SPEC_REPL_OBFU6 Bob Menschel, Nov 2005
489 #counts SARE_SPEC_REPL_OBFU1 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
490 #counts SARE_SPEC_REPL_OBFU1 8s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
491 #counts SARE_SPEC_REPL_OBFU1 1s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
492 #counts SARE_SPEC_REPL_OBFU1 10s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
493 #counts SARE_SPEC_REPL_OBFU1 37s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
494 #counts SARE_SPEC_REPL_OBFU1 7s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
495 #counts SARE_SPEC_REPL_OBFU1 2s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
496 #counts SARE_SPEC_REPL_OBFU2 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
497 #counts SARE_SPEC_REPL_OBFU2 1s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
498 #counts SARE_SPEC_REPL_OBFU3 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
499 #counts SARE_SPEC_REPL_OBFU3 4s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
500 #counts SARE_SPEC_REPL_OBFU3 1s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
501 #counts SARE_SPEC_REPL_OBFU4 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
502 #counts SARE_SPEC_REPL_OBFU5 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
503 #counts SARE_SPEC_REPL_OBFU5 6s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
504 #counts SARE_SPEC_REPL_OBFU6 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
505 #max SARE_SPEC_REPL_OBFU1 8s/0h of 366109 corpus (108323s/257786h RM) 11/25/05
506 #max SARE_SPEC_REPL_OBFU2 6s/0h of 366109 corpus (108323s/257786h RM) 11/25/05
507 #max SARE_SPEC_REPL_OBFU3 22s/0h of 366109 corpus (108323s/257786h RM) 11/25/05
508 #max SARE_SPEC_REPL_OBFU4 1s/0h of 366109 corpus (108323s/257786h RM) 11/25/05
509 #max SARE_SPEC_REPL_OBFU5 0s/0h of 366109 corpus (108323s/257786h RM) 11/25/05
510 #max SARE_SPEC_REPL_OBFU6 0s/0h of 366109 corpus (108323s/257786h RM) 11/25/05
512 ######## ###################### ##################################################
514 ######## ###################### ##################################################
516 body __SARE_LOTTO_LOTTERY /\blott(?:o|ery)/i
517 body __SARE_LOTTO_BATCH /batch number/i
518 body __SARE_LOTTO_SERIAL /serial number/i
519 body __SARE_LOTTO_TICKET /ticket number/i
520 body __SARE_LOTTO_LUCKY /lucky number/i
521 body __SARE_LOTTO_CATEGORY /categor(?:y|ies)/i
522 body __SARE_LOTTO_CONGRAT /congratulation/i
524 meta SARE_LOTTO_SPAM __SARE_LOTTO_LOTTERY && __SARE_LOTTO_SERIAL && __SARE_LOTTO_TICKET && __SARE_LOTTO_CATEGORY && __SARE_LOTTO_CONGRAT
525 describe SARE_LOTTO_SPAM Lottery Spam
526 score SARE_LOTTO_SPAM 2.444
527 #hist SARE_LOTTO_SPAM Robert Brooks, Feb 18 2005
528 #stype SARE_LOTTO_SPAM spamg
529 #counts SARE_LOTTO_SPAM 111s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
530 #max SARE_LOTTO_SPAM 3270s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
531 #counts SARE_LOTTO_SPAM 60s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
532 #counts SARE_LOTTO_SPAM 3s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
533 #max SARE_LOTTO_SPAM 3s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
534 #counts SARE_LOTTO_SPAM 200s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
535 #counts SARE_LOTTO_SPAM 120s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
536 #max SARE_LOTTO_SPAM 160s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
537 #counts SARE_LOTTO_SPAM 44s/0h of 54874 corpus (17700s/37174h JH-3.01) 03/13/05
538 #counts SARE_LOTTO_SPAM 134s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
539 #counts SARE_LOTTO_SPAM 6s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
540 #max SARE_LOTTO_SPAM 24s/0h of 31513 corpus (27912s/3601h MY) 03/09/05
542 meta SARE_LOTTO_SPAM2 __SARE_LOTTO_LOTTERY && __SARE_LOTTO_BATCH
543 describe SARE_LOTTO_SPAM2 Lottery Spam
544 score SARE_LOTTO_SPAM2 2.444
545 #hist SARE_LOTTO_SPAM2 Robert Brooks, Feb 18 2005
546 #stype SARE_LOTTO_SPAM2 spamg
547 #counts SARE_LOTTO_SPAM2 178s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
548 #max SARE_LOTTO_SPAM2 3607s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
549 #counts SARE_LOTTO_SPAM2 114s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
550 #counts SARE_LOTTO_SPAM2 25s/0h of 682 corpus (290s/392h CRF) 03/11/05
551 #counts SARE_LOTTO_SPAM2 3s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
552 #counts SARE_LOTTO_SPAM2 238s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
553 #counts SARE_LOTTO_SPAM2 145s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
554 #max SARE_LOTTO_SPAM2 180s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
555 #counts SARE_LOTTO_SPAM2 54s/0h of 54874 corpus (17700s/37174h JH-3.01) 03/13/05
556 #counts SARE_LOTTO_SPAM2 166s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
557 #counts SARE_LOTTO_SPAM2 4s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
558 #max SARE_LOTTO_SPAM2 27s/0h of 31513 corpus (27912s/3601h MY) 03/09/05
560 ######## ###################### ##################################################
561 # Spammers who identify themselves or their specific product in message body
562 ######## ###################### ##################################################
564 body SARE_BODY_URI_STOCK /st[0o]ck\s{0,30}\d{1,30}\s{0,30}\@\s{0,30}yahoo.com/i
565 describe SARE_BODY_URI_STOCK Signature of stock market spammer
566 score SARE_BODY_URI_STOCK 1.666
567 #hist SARE_BODY_URI_STOCK Bob Menschel, Apr 17 2005, from a variety of suggestions
568 #counts SARE_BODY_URI_STOCK 0s/0h of 494544 corpus (223913s/270631h RM) 10/08/05
569 #max SARE_BODY_URI_STOCK 400s/0h of 281295 corpus (109907s/171388h RM) 05/06/05
570 #counts SARE_BODY_URI_STOCK 0s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
571 #max SARE_BODY_URI_STOCK 4s/0h of 10801 corpus (6349s/4452h CT) 05/24/05
572 #counts SARE_BODY_URI_STOCK 172s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
573 #counts SARE_BODY_URI_STOCK 0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
574 #max SARE_BODY_URI_STOCK 26s/0h of 4358 corpus (754s/3604h ft) 05/24/05
575 #counts SARE_BODY_URI_STOCK 0s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
576 #max SARE_BODY_URI_STOCK 2s/0h of 47717 corpus (43727s/3990h MY) 05/25/05
578 body SARE_SPEC_BODY_NONEED /\b(?:noneed|st0ck)\d{2,4}/
579 describe SARE_SPEC_BODY_NONEED No need to spam us!
580 score SARE_SPEC_BODY_NONEED 1.666
581 #hist SARE_SPEC_BODY_NONEED Robert Brooks, May 27 2005
582 #counts SARE_SPEC_BODY_NONEED 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
583 #max SARE_SPEC_BODY_NONEED 313s/0h of 256964 corpus (112869s/144095h RM) 05/27/05
584 #counts SARE_SPEC_BODY_NONEED 0s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
585 #max SARE_SPEC_BODY_NONEED 5s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
586 #counts SARE_SPEC_BODY_NONEED 222s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
587 #counts SARE_SPEC_BODY_NONEED 0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
588 #max SARE_SPEC_BODY_NONEED 34s/0h of 4359 corpus (759s/3600h ft) 05/27/05
589 #counts SARE_SPEC_BODY_NONEED 0s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
590 #max SARE_SPEC_BODY_NONEED 4s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
592 header SARE_SPEC_DIPLOMA Subject =~ m'\bd.?iplomas?\b'i
593 describe SARE_SPEC_DIPLOMA educational spam subject
594 score SARE_SPEC_DIPLOMA 1.094
595 #hist SARE_SPEC_DIPLOMA Bob Menschel, Nov 2005
596 #counts SARE_SPEC_DIPLOMA 117s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
597 #counts SARE_SPEC_DIPLOMA 0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
598 #max SARE_SPEC_DIPLOMA 1s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
599 #counts SARE_SPEC_DIPLOMA 10s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
600 #counts SARE_SPEC_DIPLOMA 46s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
601 #counts SARE_SPEC_DIPLOMA 8s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
602 #counts SARE_SPEC_DIPLOMA 196s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
603 #counts SARE_SPEC_DIPLOMA 4s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
604 #max SARE_SPEC_DIPLOMA 6s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
606 body SARE_SPEC_ANTIDOTE /(?:"The Antidote"|Health Monthly Newsletter|Kills all Known|full-guarantee)/i
607 describe SARE_SPEC_ANTIDOTE Antidote spammer
608 score SARE_SPEC_ANTIDOTE 1.666
609 #hist SARE_SPEC_ANTIDOTE Loren Wilton, May 29 2005
610 #ham SARE_SPEC_ANTIDOTE mentions book with title "The Antidote" avail from amazon.com
611 #counts SARE_SPEC_ANTIDOTE 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
612 #max SARE_SPEC_ANTIDOTE 329s/0h of 273328 corpus (132835s/140493h RM) 05/30/05
613 #counts SARE_SPEC_ANTIDOTE 0s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
614 #max SARE_SPEC_ANTIDOTE 26s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
615 #counts SARE_SPEC_ANTIDOTE 3s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
616 #max SARE_SPEC_ANTIDOTE 10s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
617 #counts SARE_SPEC_ANTIDOTE 0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
618 #max SARE_SPEC_ANTIDOTE 82s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
619 #counts SARE_SPEC_ANTIDOTE 0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
620 #max SARE_SPEC_ANTIDOTE 1s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
621 #counts SARE_SPEC_ANTIDOTE 0s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
622 #max SARE_SPEC_ANTIDOTE 227s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
624 header SARE_SPEC_SPAMIS_FROM From =~ /\bspamis\b/i
625 describe SARE_SPEC_SPAMIS_FROM Possibly from or via spammer system
626 score SARE_SPEC_SPAMIS_FROM 1.666
627 #stype SARE_SPEC_SPAMIS_FROM spamg
628 #hist SARE_SPEC_SPAMIS_FROM Bob Menschel, Aug 07 2005
629 #counts SARE_SPEC_SPAMIS_FROM 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
630 #max SARE_SPEC_SPAMIS_FROM 79s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
631 #counts SARE_SPEC_SPAMIS_FROM 0s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
632 #max SARE_SPEC_SPAMIS_FROM 15s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
633 #counts SARE_SPEC_SPAMIS_FROM 0s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
634 #max SARE_SPEC_SPAMIS_FROM 1s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
636 header SARE_SPEC_SPAMIS_RECV Received =~ /\bspamis\b/i
637 describe SARE_SPEC_SPAMIS_RECV Possibly from or via spammer system
638 score SARE_SPEC_SPAMIS_RECV 1.666
639 #stype SARE_SPEC_SPAMIS_RECV spamg
640 #hist SARE_SPEC_SPAMIS_RECV Bob Menschel, Aug 07 2005
641 #counts SARE_SPEC_SPAMIS_RECV 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
642 #max SARE_SPEC_SPAMIS_RECV 80s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
643 #counts SARE_SPEC_SPAMIS_RECV 0s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
644 #max SARE_SPEC_SPAMIS_RECV 15s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
645 #counts SARE_SPEC_SPAMIS_RECV 0s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
646 #max SARE_SPEC_SPAMIS_RECV 1s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
648 body SARE_SPEC_SPAMIS_BDY1 /\b(?:spamis|s p a m i s)\b/i
649 describe SARE_SPEC_SPAMIS_BDY1 Possibly from or via spammer system
650 score SARE_SPEC_SPAMIS_BDY1 1.666
651 #stype SARE_SPEC_SPAMIS_BDY1 spamg
652 #hist SARE_SPEC_SPAMIS_BDY1 Bob Menschel, Sep 26 2005
653 #counts SARE_SPEC_SPAMIS_BDY1 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
654 #max SARE_SPEC_SPAMIS_BDY1 93s/0h of 646449 corpus (258764s/387685h RM) 09/30/05
655 #counts SARE_SPEC_SPAMIS_BDY1 0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
656 #counts SARE_SPEC_SPAMIS_BDY1 5s/0h of 3327 corpus (2029s/1298h AXB) 10/02/05
657 #counts SARE_SPEC_SPAMIS_BDY1 0s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
658 #max SARE_SPEC_SPAMIS_BDY1 21s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
659 #counts SARE_SPEC_SPAMIS_BDY1 3s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
660 #max SARE_SPEC_SPAMIS_BDY1 4s/0h of 54753 corpus (49767s/4986h MY) 10/01/05
661 #counts SARE_SPEC_SPAMIS_BDY1 0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
662 #max SARE_SPEC_SPAMIS_BDY1 13s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
664 body SARE_SPEC_SPAMIS_BDY2 /P\s?O\s?B\s?o\s?x\s?1\s?2\s?5\s?9\s?,\s?S\s?e\s?a\s?t\s?t\s?l\s?e\s?,\s?W\s?A\s?9\s?8\s?1\s?0\s?1/i
665 describe SARE_SPEC_SPAMIS_BDY2 Possibly from or via spammer system
666 score SARE_SPEC_SPAMIS_BDY2 1.666
667 #stype SARE_SPEC_SPAMIS_BDY2 spamg
668 #hist SARE_SPEC_SPAMIS_BDY2 Bob Menschel, Sep 26 2005
669 #counts SARE_SPEC_SPAMIS_BDY2 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
670 #counts SARE_SPEC_SPAMIS_BDY2 0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
671 #max SARE_SPEC_SPAMIS_BDY2 5s/0h of 3327 corpus (2029s/1298h AXB) 10/02/05
672 #counts SARE_SPEC_SPAMIS_BDY2 15s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
673 #max SARE_SPEC_SPAMIS_BDY2 27s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
674 #counts SARE_SPEC_SPAMIS_BDY2 0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
675 #max SARE_SPEC_SPAMIS_BDY2 10s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
676 #counts SARE_SPEC_SPAMIS_BDY2 5s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
677 #counts SARE_SPEC_SPAMIS_BDY2 0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
678 #max SARE_SPEC_SPAMIS_BDY2 203s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
679 #counts SARE_SPEC_SPAMIS_BDY2 6s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
681 body SARE_SPEC_LEO_DOLLARS /(?:\$[13]\s){3}/
682 score SARE_SPEC_LEO_DOLLARS 2.444
683 describe SARE_SPEC_LEO_DOLLARS Leo table drug spam
684 #hist SARE_SPEC_LEO_DOLLARS Loren Wilton, Sept 07, 2005
685 #counts SARE_SPEC_LEO_DOLLARS 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
686 #max SARE_SPEC_LEO_DOLLARS 3095s/0h of 494544 corpus (223913s/270631h RM) 10/08/05
687 #counts SARE_SPEC_LEO_DOLLARS 3s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
688 #max SARE_SPEC_LEO_DOLLARS 12s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
689 #counts SARE_SPEC_LEO_DOLLARS 24s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
690 #counts SARE_SPEC_LEO_DOLLARS 0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
691 #max SARE_SPEC_LEO_DOLLARS 59s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
692 #counts SARE_SPEC_LEO_DOLLARS 0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
693 #max SARE_SPEC_LEO_DOLLARS 122s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
694 #counts SARE_SPEC_LEO_DOLLARS 11s/0h of 53432 corpus (48386s/5046h MY) 10/08/05
696 body SARE_SPEC_LEO_DOLLARSa /(?:\$\s?[123]\s){3}/
697 score SARE_SPEC_LEO_DOLLARSa 1.666
698 describe SARE_SPEC_LEO_DOLLARSa Leo table drug spam
699 #ham SARE_SPEC_LEO_DOLLARSa source code, list of $n parameters
700 #hist SARE_SPEC_LEO_DOLLARSa Loren Wilton, Sept 07, 2005, mod Oct 8 2005
701 #counts SARE_SPEC_LEO_DOLLARSa 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
702 #max SARE_SPEC_LEO_DOLLARSa 3095s/1h of 494544 corpus (223913s/270631h RM) 10/08/05
703 #counts SARE_SPEC_LEO_DOLLARSa 3s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
704 #max SARE_SPEC_LEO_DOLLARSa 12s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
705 #counts SARE_SPEC_LEO_DOLLARSa 25s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
706 #counts SARE_SPEC_LEO_DOLLARSa 0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
707 #max SARE_SPEC_LEO_DOLLARSa 59s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
708 #counts SARE_SPEC_LEO_DOLLARSa 0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
709 #max SARE_SPEC_LEO_DOLLARSa 122s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
710 #counts SARE_SPEC_LEO_DOLLARSa 11s/0h of 53432 corpus (48386s/5046h MY) 10/08/05
712 body SARE_SPEC_LEO_COST /(?:\s\$[13]){3}\s(?:(?:21|75|33)[\.\s]){3}/
713 score SARE_SPEC_LEO_COST 2.222
714 describe SARE_SPEC_LEO_COST Table drug cost
715 #hist SARE_SPEC_LEO_COST Loren Wilton, Sept 07, 2005
716 #counts SARE_SPEC_LEO_COST 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
717 #max SARE_SPEC_LEO_COST 1595s/0h of 494544 corpus (223913s/270631h RM) 10/08/05
718 #counts SARE_SPEC_LEO_COST 0s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
719 #max SARE_SPEC_LEO_COST 7s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
720 #counts SARE_SPEC_LEO_COST 0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
721 #max SARE_SPEC_LEO_COST 8s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
722 #counts SARE_SPEC_LEO_COST 0s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
723 #counts SARE_SPEC_LEO_COST 0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
724 #max SARE_SPEC_LEO_COST 48s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
725 #counts SARE_SPEC_LEO_COST 5s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
727 body SARE_SPEC_LEO_COSTa /(?:\s\$\s?[123]){3}\s(?:\d\d[\.\s]){3}/
728 score SARE_SPEC_LEO_COSTa 2.222
729 describe SARE_SPEC_LEO_COSTa Table drug cost
730 #hist SARE_SPEC_LEO_COSTa Loren Wilton, Sept 07, 2005, mod Oct 8 2005
731 #counts SARE_SPEC_LEO_COSTa 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
732 #max SARE_SPEC_LEO_COSTa 1612s/0h of 494544 corpus (223913s/270631h RM) 10/08/05
733 #counts SARE_SPEC_LEO_COSTa 1s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
734 #max SARE_SPEC_LEO_COSTa 8s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
735 #counts SARE_SPEC_LEO_COSTa 0s/0h of 53432 corpus (48386s/5046h MY) 10/08/05
736 #counts SARE_SPEC_LEO_COSTa 0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
737 #max SARE_SPEC_LEO_COSTa 8s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
738 #counts SARE_SPEC_LEO_COSTa 0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
739 #max SARE_SPEC_LEO_COSTa 54s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
740 #counts SARE_SPEC_LEO_COSTa 5s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
742 body __SARE_SPEC_LRD_COST1 /3\.75/
743 body __SARE_SPEC_LRD_COST2 /1\.21/
744 body __SARE_SPEC_LRD_COST3 /3\.33/
745 meta SARE_SPEC_LRD_COST_M1 __SARE_SPEC_LRD_COST1 && __SARE_SPEC_LRD_COST2 && __SARE_SPEC_LRD_COST3
746 describe SARE_SPEC_LRD_COST_M1 LEO drug pricing variations
747 score SARE_SPEC_LRD_COST_M1 0.698
748 #ham SARE_SPEC_LRD_COST_M1 firewall logs emailed
749 #hist SARE_SPEC_LRD_COST_M1 Raymond Dijkxhoorn, Oct 2005
750 #counts SARE_SPEC_LRD_COST_M1 0s/2h of 173230 corpus (99061s/74169h RM) 05/11/06
751 #max SARE_SPEC_LRD_COST_M1 4374s/32h of 494544 corpus (223913s/270631h RM) 10/08/05
752 #counts SARE_SPEC_LRD_COST_M1 0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
753 #max SARE_SPEC_LRD_COST_M1 3s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
754 #counts SARE_SPEC_LRD_COST_M1 17s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
755 #counts SARE_SPEC_LRD_COST_M1 101s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
756 #counts SARE_SPEC_LRD_COST_M1 0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
757 #max SARE_SPEC_LRD_COST_M1 589s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
758 #counts SARE_SPEC_LRD_COST_M1 55s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
759 #counts SARE_SPEC_LRD_COST_M1 5s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
760 #max SARE_SPEC_LRD_COST_M1 189s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
762 body __SARE_SPEC_PROLEO1 /85(\,|\.)45|1(\,|\.)(20|21|22|56)/
763 body __SARE_SPEC_PROLEO2 /69(\,|\.)95|2(\,|\.)78|3(\,|\.)(32|33|70)/
764 body __SARE_SPEC_PROLEO3 /99(\,|\.)95|3(\,|\.)(00|35|75)/
765 uri __SARE_SPEC_PROLEO4 /http:\/\/.{0,30}\.tripod\.com/
766 body __SARE_SPEC_PROLEO5 /http:\/\/www\.\b/
767 meta SARE_SPEC_PROLEO_M1 (__SARE_SPEC_PROLEO1 && __SARE_SPEC_PROLEO2 && __SARE_SPEC_PROLEO3 && __SARE_SPEC_PROLEO4)
768 describe SARE_SPEC_PROLEO_M1 Leo drug spam signs
769 score SARE_SPEC_PROLEO_M1 4.000
770 #stype SARE_SPEC_PROLEO_M1 spamg
771 #hist SARE_SPEC_PROLEO_M1 Raymond Dijkxhoorn, Nov 2005
772 #counts SARE_SPEC_PROLEO_M1 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
773 #counts SARE_SPEC_PROLEO_M1 0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
774 #max SARE_SPEC_PROLEO_M1 248s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
775 #counts SARE_SPEC_PROLEO_M1 18s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
776 #counts SARE_SPEC_PROLEO_M1 6s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
777 #counts SARE_SPEC_PROLEO_M1 27s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
778 #counts SARE_SPEC_PROLEO_M1 0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
779 #max SARE_SPEC_PROLEO_M1 84s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
780 #counts SARE_SPEC_PROLEO_M1 0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
781 #max SARE_SPEC_PROLEO_M1 316s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
783 meta SARE_SPEC_PROLEO_M2 (__SARE_SPEC_PROLEO1 && __SARE_SPEC_PROLEO2 && __SARE_SPEC_PROLEO3 && __SARE_SPEC_PROLEO5 && !SARE_SPEC_PROLEO_M2a)
784 describe SARE_SPEC_PROLEO_M2 Leo drug spam signs
785 score SARE_SPEC_PROLEO_M2 0.692
786 #hist SARE_SPEC_PROLEO_M2 Raymond Dijkxhoorn, Nov 2005
787 #counts SARE_SPEC_PROLEO_M2 1s/5h of 173230 corpus (99061s/74169h RM) 05/11/06
788 #max SARE_SPEC_PROLEO_M2 108s/20h of 366082 corpus (108301s/257781h RM) 11/25/05
789 #counts SARE_SPEC_PROLEO_M2 42s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
790 #counts SARE_SPEC_PROLEO_M2 0s/3h of 36686 corpus (32345s/4341h AxB2) 05/14/06
791 #max SARE_SPEC_PROLEO_M2 4s/0h of 4178 corpus (2833s/1345h AxB) 11/12/05
792 #counts SARE_SPEC_PROLEO_M2 27s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
793 #counts SARE_SPEC_PROLEO_M2 142s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
794 #counts SARE_SPEC_PROLEO_M2 0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
795 #max SARE_SPEC_PROLEO_M2 1s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
796 #counts SARE_SPEC_PROLEO_M2 9s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
797 #max SARE_SPEC_PROLEO_M2 10s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
799 meta SARE_SPEC_PROLEO_M2a (__SARE_SPEC_PROLEO1 && __SARE_SPEC_PROLEO2 && __SARE_SPEC_PROLEO3 && __SARE_SPEC_PROLEO5 && MIME_QP_LONG_LINE)
800 describe SARE_SPEC_PROLEO_M2a Leo drug spam signs
801 score SARE_SPEC_PROLEO_M2a 3.333
802 #stype SARE_SPEC_PROLEO_M2a spamg
803 rawbody MIME_QP_LONG_LINE eval:check_for_mime('mime_qp_long_line')
804 #hist SARE_SPEC_PROLEO_M2a Raymond Dijkxhoorn, Nov 2005
805 #counts SARE_SPEC_PROLEO_M2a 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
806 #max SARE_SPEC_PROLEO_M2a 255s/0h of 366082 corpus (108301s/257781h RM) 11/25/05
807 #counts SARE_SPEC_PROLEO_M2a 0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
808 #max SARE_SPEC_PROLEO_M2a 4s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
809 #counts SARE_SPEC_PROLEO_M2a 5s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
810 #max SARE_SPEC_PROLEO_M2a 7s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
811 #counts SARE_SPEC_PROLEO_M2a 25s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
812 #counts SARE_SPEC_PROLEO_M2a 0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
813 #max SARE_SPEC_PROLEO_M2a 13s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
814 #counts SARE_SPEC_PROLEO_M2a 0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
815 #max SARE_SPEC_PROLEO_M2a 134s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
816 #counts SARE_SPEC_PROLEO_M2a 0s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
818 body __SARE_SPEC_LRD_COST4 /134/
819 body __SARE_SPEC_LRD_COST5 /169/
820 body __SARE_SPEC_LRD_COST6 /218/
821 header __SARE_SPEC_LRD_COST7 Subject =~ /ceutical/i
822 meta SARE_SPEC_LRD_COST_M2 __SARE_SPEC_LRD_COST4 && __SARE_SPEC_LRD_COST5 && __SARE_SPEC_LRD_COST6 && __SARE_SPEC_LRD_COST7
823 describe SARE_SPEC_LRD_COST_M2 LEO drug pricing variations
824 score SARE_SPEC_LRD_COST_M2 1.111
825 #stype SARE_SPEC_LRD_COST_M2 spamp
826 #hist SARE_SPEC_LRD_COST_M2 Raymond Dijkxhoorn, Oct 2005
827 #counts SARE_SPEC_LRD_COST_M2 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
828 #max SARE_SPEC_LRD_COST_M2 36s/0h of 366109 corpus (108323s/257786h RM) 11/25/05
829 #counts SARE_SPEC_LRD_COST_M2 1s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
830 #counts SARE_SPEC_LRD_COST_M2 0s/0h of 53432 corpus (48386s/5046h MY) 10/08/05
831 #counts SARE_SPEC_LRD_COST_M2 0s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
832 #counts SARE_SPEC_LRD_COST_M2 0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
833 #max SARE_SPEC_LRD_COST_M2 17s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
834 #counts SARE_SPEC_LRD_COST_M2 4s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
836 body __SARE_SPEC_LEO_DRGS /^(?:Am|Me|Pr|Le|Xa|Ci|Ce|Vi|Ul|Va){3,}\s(?:bi|ri|op|vi|na|al|le|ag|tr|li){3,}\s(?:en|dia|ecia|tra|x|is|brex|ra|am|um){3,}\s/ # no /i
837 body __SARE_SPEC_LEO_DRGS5a /\b(?:(?:Am|AM|Me|ME|Pr|PR|Le|LE|Xa|XA|Ci|CI|Ce|CE|Vi|VI|Ul|UL|Va|VA)(?:$|\s{1,30})){10}/
838 body __SARE_SPEC_LEO_DRGS5b /\b(?:(?:bi|ri|op|vi|na|al|le|ag|tr|li)(?:$|\s{1,30})){10}/i
839 body __SARE_SPEC_LEO_DRGS5c /\b(?:(?:am|di|dia|br|brex|ra|en|x|um|ec|ecia|is|tr|tra)(?:$|\s{1,30})){10}/i
840 body __SARE_SPEC_LEO_DRGS6a /\b(?:(?:M|L|A|P|C|V|V|X|U|C)(?:$|\s{1,30})){10}/
841 body __SARE_SPEC_LEO_DRGS6b /\b(?:(?:e|e|m|r|I|I|A|a|l|e)(?:$|\s{1,30})){10}/i
842 body __SARE_SPEC_LEO_DRGS6c /\b(?:(?:r|v|b|o|A|A|L|n|t|l)(?:$|\s{1,30})){10}/i
843 body __SARE_SPEC_LEO_DRGS6d /\b(?:(?:d|t|e|e|I|R|U|x|a|b)(?:$|\s{1,30})){10}/i
845 meta SARE_SPEC_LEO_DRUGS __SARE_SPEC_LEO_DRGS || (__SARE_SPEC_LEO_DRGS5a && __SARE_SPEC_LEO_DRGS5b && __SARE_SPEC_LEO_DRGS5c) || (__SARE_SPEC_LEO_DRGS6a && __SARE_SPEC_LEO_DRGS6b && __SARE_SPEC_LEO_DRGS6c && __SARE_SPEC_LEO_DRGS6d)
846 score SARE_SPEC_LEO_DRUGS 2.888
847 describe SARE_SPEC_LEO_DRUGS Vertical table drug spam
848 #hist SARE_SPEC_LEO_DRUGS Loren Wilton, Sept 07, 2005
849 #counts SARE_SPEC_LEO_DRUGS 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
850 #max SARE_SPEC_LEO_DRUGS 6734s/0h of 494544 corpus (223913s/270631h RM) 10/08/05
851 #counts SARE_SPEC_LEO_DRUGS 230s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
852 #counts SARE_SPEC_LEO_DRUGS 0s/1h of 13339 corpus (7462s/5877h CT) 05/14/06
853 #max SARE_SPEC_LEO_DRUGS 27s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
854 #counts SARE_SPEC_LEO_DRUGS 0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
855 #max SARE_SPEC_LEO_DRUGS 48s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
856 #counts SARE_SPEC_LEO_DRUGS 0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
857 #max SARE_SPEC_LEO_DRUGS 238s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
858 #counts SARE_SPEC_LEO_DRUGS 21s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
860 body SARE_SPEC_LEO_MEDS /(?!medications?)\b(?:m|rn|\/V\\|\/\\\/\\]).?(?:[e3\*\xC8-\xCB\xE8-\xEB]).?(?:[d\xD0]).?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]).?(?:[c\*\xC7\xE7\xA2\xA9]).?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\).?(?:[t\+]).?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]).?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]).?(?:[n\xD1\xF1]|\|\\\|).?(?:[s5\$\xA7])?/i
861 describe SARE_SPEC_LEO_MEDS obfuscated subject body
862 score SARE_SPEC_LEO_MEDS 1.666
863 #hist SARE_SPEC_LEO_MEDS Bob Menschel, Sept 11, 2005
864 #ham SARE_SPEC_LEO_MEDS misspelling
865 #counts SARE_SPEC_LEO_MEDS 263s/1h of 173230 corpus (99061s/74169h RM) 05/11/06
866 #max SARE_SPEC_LEO_MEDS 6780s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
867 #counts SARE_SPEC_LEO_MEDS 34s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
868 #counts SARE_SPEC_LEO_MEDS 12s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
869 #max SARE_SPEC_LEO_MEDS 40s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
870 #counts SARE_SPEC_LEO_MEDS 191s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
871 #max SARE_SPEC_LEO_MEDS 240s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
872 #counts SARE_SPEC_LEO_MEDS 46s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
873 #max SARE_SPEC_LEO_MEDS 722s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
874 #counts SARE_SPEC_LEO_MEDS 67s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
875 #max SARE_SPEC_LEO_MEDS 452s/0h of 57287 corpus (52272s/5015h MY) 09/22/05
876 #counts SARE_SPEC_LEO_MEDS 307s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
877 #max SARE_SPEC_LEO_MEDS 355s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
879 body SARE_SPEC_LEO_PHARM /(?!pharmac(?:y|ies))\b(?:[p\xDE]).?h.?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\).?(?:[r\xAE]).?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\)?(?:m|rn|\/V\\|\/\\\/\\]).?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\)?(?:[c\*\xC7\xE7\xA2\xA9])(?:(?:[y\xA5\xDD\xFD])|(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]).?(?:[e3\*\xC8-\xCB\xE8-\xEB]).?(?:[s5\$\xA7]))/i
880 describe SARE_SPEC_LEO_PHARM obfuscated subject body
881 score SARE_SPEC_LEO_PHARM 1.666
882 #hist SARE_SPEC_LEO_PHARM Bob Menschel, Sept 11, 2005
883 #ham SARE_SPEC_LEO_PHARM misspelling (2)
884 #counts SARE_SPEC_LEO_PHARM 413s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
885 #max SARE_SPEC_LEO_PHARM 3205s/3h of 679260 corpus (323056s/356204h RM) 09/13/05
886 #counts SARE_SPEC_LEO_PHARM 87s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
887 #counts SARE_SPEC_LEO_PHARM 167s/2h of 13339 corpus (7462s/5877h CT) 05/14/06
888 #counts SARE_SPEC_LEO_PHARM 1000s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
889 #counts SARE_SPEC_LEO_PHARM 45s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
890 #max SARE_SPEC_LEO_PHARM 692s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
891 #counts SARE_SPEC_LEO_PHARM 105s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
892 #max SARE_SPEC_LEO_PHARM 462s/0h of 53432 corpus (48386s/5046h MY) 10/08/05
893 #counts SARE_SPEC_LEO_PHARM 1996s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
895 body SARE_SPEC_LEO_PHARM2 /(?!Pharmaceuticals?)\b(?:[p\xDE]).?h.?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\).?(?:[r\xAE]).?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\)?(?:m|rn|\/V\\|\/\\\/\\]).?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\).?(?:[c\*\xC7\xE7\xA2\xA9]).?(?:[e3\*\xC8-\xCB\xE8-\xEB]).?(?:[uv\*\xB5\xD9-\xDC\xF9-\xFC]).?(?:[t\+]).?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]).?(?:[c\*\xC7\xE7\xA2\xA9]).?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\).?(?:[l1I\|\xA3]).?(?:[s5\$\xA7])?/i
896 describe SARE_SPEC_LEO_PHARM2 obfuscated subject body
897 score SARE_SPEC_LEO_PHARM2 1.666
898 #hist SARE_SPEC_LEO_PHARM2 Bob Menschel, Sept 11, 2005
899 #ham SARE_SPEC_LEO_PHARM2 Intentional strange spacing
900 #counts SARE_SPEC_LEO_PHARM2 30s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
901 #max SARE_SPEC_LEO_PHARM2 5774s/2h of 494544 corpus (223913s/270631h RM) 10/08/05
902 #counts SARE_SPEC_LEO_PHARM2 23s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
903 #counts SARE_SPEC_LEO_PHARM2 188s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
904 #counts SARE_SPEC_LEO_PHARM2 27s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
905 #max SARE_SPEC_LEO_PHARM2 467s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
906 #counts SARE_SPEC_LEO_PHARM2 134s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
907 #max SARE_SPEC_LEO_PHARM2 167s/0h of 53432 corpus (48386s/5046h MY) 10/08/05
908 #counts SARE_SPEC_LEO_PHARM2 9s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
909 #max SARE_SPEC_LEO_PHARM2 137s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
911 body SARE_SPEC_LEO_CHEM /(?!chemist)\b(?:[c\*\xC7\xE7\xA2\xA9]).?h.?(?:[e3\*\xC8-\xCB\xE8-\xEB]).?(?:m|rn|\/V\\|\/\\\/\\]).?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]).?(?:[s5\$\xA7]).?(?:[t\+])/i
912 describe SARE_SPEC_LEO_CHEM obfuscated subject body
913 score SARE_SPEC_LEO_CHEM 0.992
914 #hist SARE_SPEC_LEO_CHEM Bob Menschel, Sept 11, 2005
915 #counts SARE_SPEC_LEO_CHEM 1s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
916 #max SARE_SPEC_LEO_CHEM 50s/0h of 689155 corpus (348140s/341015h RM) 09/18/05
917 #counts SARE_SPEC_LEO_CHEM 0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
918 #max SARE_SPEC_LEO_CHEM 1s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
919 #counts SARE_SPEC_LEO_CHEM 0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
920 #counts SARE_SPEC_LEO_CHEM 0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
921 #max SARE_SPEC_LEO_CHEM 1s/0h of 7500 corpus (1767s/5733h ft) 09/18/05
922 #counts SARE_SPEC_LEO_CHEM 3s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
923 #max SARE_SPEC_LEO_CHEM 152s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
924 #counts SARE_SPEC_LEO_CHEM 0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
925 #max SARE_SPEC_LEO_CHEM 2s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
927 body SARE_SPEC_LEO_LINE02 m'(?:[A-Z][a-z]{1,2}){5}\w{1,30}\s[a-z]{10}'
928 describe SARE_SPEC_LEO_LINE02 common Leo body text
929 score SARE_SPEC_LEO_LINE02 2.666
930 #hist SARE_SPEC_LEO_LINE02 Bob Menschel, Sept 11, 2005
931 #counts SARE_SPEC_LEO_LINE02 3s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
932 #max SARE_SPEC_LEO_LINE02 5058s/0h of 494544 corpus (223913s/270631h RM) 10/08/05
933 #counts SARE_SPEC_LEO_LINE02 1s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
934 #max SARE_SPEC_LEO_LINE02 20s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
935 #counts SARE_SPEC_LEO_LINE02 27s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
936 #counts SARE_SPEC_LEO_LINE02 0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
937 #max SARE_SPEC_LEO_LINE02 72s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
938 #counts SARE_SPEC_LEO_LINE02 0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
939 #max SARE_SPEC_LEO_LINE02 205s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
941 rawbody SARE_SPEC_LEO_LINE03a m'<DIV[^>]{0,40}style=[^>]{0,40}FLOAT: left;'i
942 describe SARE_SPEC_LEO_LINE03a common Leo body text
943 score SARE_SPEC_LEO_LINE03a 0.408
944 #hist SARE_SPEC_LEO_LINE03a Bob Menschel, Sept 11, 2005, modified Oct 8 2005
945 #counts SARE_SPEC_LEO_LINE03a 3s/19h of 173230 corpus (99061s/74169h RM) 05/11/06
946 #max SARE_SPEC_LEO_LINE03a 11045s/41h of 494544 corpus (223913s/270631h RM) 10/08/05
947 #counts SARE_SPEC_LEO_LINE03a 43s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
948 #counts SARE_SPEC_LEO_LINE03a 26s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
949 #max SARE_SPEC_LEO_LINE03a 36s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
950 #counts SARE_SPEC_LEO_LINE03a 153s/42h of 155610 corpus (103978s/51632h DOC) 05/14/06
951 #counts SARE_SPEC_LEO_LINE03a 0s/1h of 42419 corpus (34292s/8127h FVGT) 05/15/06
952 #max SARE_SPEC_LEO_LINE03a 860s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
953 #counts SARE_SPEC_LEO_LINE03a 0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
954 #max SARE_SPEC_LEO_LINE03a 368s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
955 #counts SARE_SPEC_LEO_LINE03a 260s/4h of 23026 corpus (17290s/5736h MY) 05/14/06
957 rawbody SARE_SPEC_LEO_LINE03b m'<DIV[^>]{0,40}style=[^>]{0,40}(?:BORDER|MARGIN|PADDING)-(?:BOTTOM|LEFT|RIGHT|TOP)-WIDTH: 0px;'i
958 describe SARE_SPEC_LEO_LINE03b common Leo body text
959 score SARE_SPEC_LEO_LINE03b 2.222
960 #hist SARE_SPEC_LEO_LINE03b Bob Menschel, Oct 8 2005
961 #counts SARE_SPEC_LEO_LINE03b 81s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
962 #max SARE_SPEC_LEO_LINE03b 380s/0h of 366082 corpus (108301s/257781h RM) 11/25/05
963 #counts SARE_SPEC_LEO_LINE03b 8s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
964 #counts SARE_SPEC_LEO_LINE03b 38s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
965 #counts SARE_SPEC_LEO_LINE03b 303s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
966 #counts SARE_SPEC_LEO_LINE03b 46s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
967 #counts SARE_SPEC_LEO_LINE03b 7s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
968 #counts SARE_SPEC_LEO_LINE03b 134s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
970 rawbody SARE_SPEC_LEO_LINE03e m'<TABLE[^>]{0,40}style=[^>]{0,40}(?:BORDER|MARGIN|PADDING)-(?:BOTTOM|LEFT|RIGHT|TOP)-WIDTH: 0px;'i
971 describe SARE_SPEC_LEO_LINE03e common Leo body text
972 score SARE_SPEC_LEO_LINE03e 0.635
973 #ham SARE_SPEC_LEO_LINE03e confirmed (3)
974 #hist SARE_SPEC_LEO_LINE03e Bob Menschel, Oct 8 2005
975 #counts SARE_SPEC_LEO_LINE03e 2s/1h of 173230 corpus (99061s/74169h RM) 05/11/06
976 #max SARE_SPEC_LEO_LINE03e 759s/5h of 366082 corpus (108301s/257781h RM) 11/25/05
977 #counts SARE_SPEC_LEO_LINE03e 1s/1h of 9999 corpus (5651s/4348h AxB) 05/14/06
978 #max SARE_SPEC_LEO_LINE03e 25s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
979 #counts SARE_SPEC_LEO_LINE03e 4s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
980 #max SARE_SPEC_LEO_LINE03e 5s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
981 #counts SARE_SPEC_LEO_LINE03e 33s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
982 #counts SARE_SPEC_LEO_LINE03e 0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
983 #max SARE_SPEC_LEO_LINE03e 55s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
984 #counts SARE_SPEC_LEO_LINE03e 17s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
985 #counts SARE_SPEC_LEO_LINE03e 0s/1h of 106098 corpus (72789s/33309h ML) 05/14/06
986 #max SARE_SPEC_LEO_LINE03e 162s/1h of 19215 corpus (15849s/3366h ML) 11/18/05
988 rawbody SARE_SPEC_LEO_LINE03f m'<TABLE[^>]{0,40}style=[^>]{0,40}(?:BORDER|MARGIN|PADDING)-(?:BOTTOM|LEFT|RIGHT|TOP): 0px;'i
989 describe SARE_SPEC_LEO_LINE03f common Leo body text
990 score SARE_SPEC_LEO_LINE03f 0.612
991 #hist SARE_SPEC_LEO_LINE03f Bob Menschel, Oct 8 2005
992 #counts SARE_SPEC_LEO_LINE03f 0s/1h of 173230 corpus (99061s/74169h RM) 05/11/06
993 #max SARE_SPEC_LEO_LINE03f 2134s/22h of 366082 corpus (108301s/257781h RM) 11/25/05
994 #counts SARE_SPEC_LEO_LINE03f 0s/3h of 36686 corpus (32345s/4341h AxB2) 05/14/06
995 #max SARE_SPEC_LEO_LINE03f 47s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
996 #counts SARE_SPEC_LEO_LINE03f 11s/2h of 13339 corpus (7462s/5877h CT) 05/14/06
997 #max SARE_SPEC_LEO_LINE03f 15s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
998 #counts SARE_SPEC_LEO_LINE03f 68s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
999 #counts SARE_SPEC_LEO_LINE03f 0s/4h of 42419 corpus (34292s/8127h FVGT) 05/15/06
1000 #max SARE_SPEC_LEO_LINE03f 144s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
1001 #counts SARE_SPEC_LEO_LINE03f 43s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
1002 #counts SARE_SPEC_LEO_LINE03f 0s/1h of 106098 corpus (72789s/33309h ML) 05/14/06
1003 #max SARE_SPEC_LEO_LINE03f 436s/1h of 19215 corpus (15849s/3366h ML) 11/18/05
1005 rawbody SARE_SPEC_LEO_LINE04 m'(?:(?:<BR>+)+(?:<B>)?[a-z]{1,3}(?:<\B>)?){5}'i
1006 describe SARE_SPEC_LEO_LINE04 common Leo body text
1007 score SARE_SPEC_LEO_LINE04 1.666
1008 #hist SARE_SPEC_LEO_LINE04 Bob Menschel, Sept 11, 2005
1009 #ham SARE_SPEC_LEO_LINE04 S P O I L E R spelled vertically to give people a chance to not scroll down to the spoiler.
1010 #counts SARE_SPEC_LEO_LINE04 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
1011 #max SARE_SPEC_LEO_LINE04 8643s/2h of 494544 corpus (223913s/270631h RM) 10/08/05
1012 #counts SARE_SPEC_LEO_LINE04 0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
1013 #max SARE_SPEC_LEO_LINE04 50s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
1014 #counts SARE_SPEC_LEO_LINE04 42s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
1015 #counts SARE_SPEC_LEO_LINE04 179s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
1016 #counts SARE_SPEC_LEO_LINE04 185s/1h of 42419 corpus (34292s/8127h FVGT) 05/15/06
1017 #max SARE_SPEC_LEO_LINE04 815s/1h of 139999 corpus (133260s/6739h ft) 10/09/05
1018 #counts SARE_SPEC_LEO_LINE04 198s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
1019 #counts SARE_SPEC_LEO_LINE04 16s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
1020 #max SARE_SPEC_LEO_LINE04 398s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
1022 rawbody SARE_SPEC_LEO_LINE04d m'(?:(?:<BR>+)(?:<B>)?[a-z]{1,3}(?:<\B>)?){9}'i
1023 describe SARE_SPEC_LEO_LINE04d common Leo body text
1024 score SARE_SPEC_LEO_LINE04d 1.666
1025 #ham SARE_SPEC_LEO_LINE04d confirmed
1026 #hist SARE_SPEC_LEO_LINE04d Bob Menschel, Sept 11, 2005
1027 #counts SARE_SPEC_LEO_LINE04d 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
1028 #max SARE_SPEC_LEO_LINE04d 3605s/0h of 494544 corpus (223913s/270631h RM) 10/08/05
1029 #counts SARE_SPEC_LEO_LINE04d 1s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
1030 #max SARE_SPEC_LEO_LINE04d 19s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
1031 #counts SARE_SPEC_LEO_LINE04d 26s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
1032 #counts SARE_SPEC_LEO_LINE04d 0s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
1033 #max SARE_SPEC_LEO_LINE04d 39s/0h of 139999 corpus (133260s/6739h ft) 10/09/05
1034 #counts SARE_SPEC_LEO_LINE04d 134s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
1035 #counts SARE_SPEC_LEO_LINE04d 16s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
1036 #max SARE_SPEC_LEO_LINE04d 206s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
1038 full SARE_SPEC_LEO_PIE2 />(?:[a-z]\s){3,7}[a-z]<.{4,50}>(?:[a-z]\s){3,7}[a-z]<.{4,50}>(?:[a-z]\s){3,5}[a-z]/is
1039 describe SARE_SPEC_LEO_PIE2 pseudo-table-format spam
1040 score SARE_SPEC_LEO_PIE2 4.000
1041 #stype SARE_SPEC_LEO_PIE2 spamg
1042 #hist SARE_SPEC_LEO_PIE2 Fred Tarasevicius, Nov 2005
1043 #counts SARE_SPEC_LEO_PIE2 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
1044 #max SARE_SPEC_LEO_PIE2 1462s/0h of 366109 corpus (108323s/257786h RM) 11/25/05
1045 #counts SARE_SPEC_LEO_PIE2 0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
1046 #max SARE_SPEC_LEO_PIE2 304s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
1047 #counts SARE_SPEC_LEO_PIE2 8s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
1048 #counts SARE_SPEC_LEO_PIE2 36s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
1049 #counts SARE_SPEC_LEO_PIE2 0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
1050 #max SARE_SPEC_LEO_PIE2 102s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
1051 #counts SARE_SPEC_LEO_PIE2 12s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
1052 #counts SARE_SPEC_LEO_PIE2 1s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
1053 #counts SARE_SPEC_LEO_PIE2 425s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
1055 header __SARE_SPEC_SUBJ_LEO Subject =~ /^(?:Re:\s?)?(?:\w{4,20}\s){2,4}\s?$/
1056 rawbody __SARE_SPEC_BORDER_W0 /BORDER-(?:RIGHT|TOP)-WIDTH: 0/
1057 meta SARE_SPEC_LEO_BORD (__SARE_SPEC_SUBJ_LEO && __SARE_SPEC_BORDER_W0)
1058 score SARE_SPEC_LEO_BORD 0.639
1059 #stype SARE_SPEC_LEO_BORD spamg
1060 #hist SARE_SPEC_LEO_BORD Fred Tarasevicius, Nov 2005
1061 #counts SARE_SPEC_LEO_BORD 6s/1h of 173230 corpus (99061s/74169h RM) 05/11/06
1062 #max SARE_SPEC_LEO_BORD 410s/6h of 366082 corpus (108301s/257781h RM) 11/25/05
1063 #counts SARE_SPEC_LEO_BORD 0s/1h of 36686 corpus (32345s/4341h AxB2) 05/14/06
1064 #counts SARE_SPEC_LEO_BORD 1s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
1065 #counts SARE_SPEC_LEO_BORD 19s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
1066 #counts SARE_SPEC_LEO_BORD 0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
1067 #max SARE_SPEC_LEO_BORD 16s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
1068 #counts SARE_SPEC_LEO_BORD 0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
1069 #max SARE_SPEC_LEO_BORD 4s/0h of 8121 corpus (6866s/1255h ML) 11/04/05
1070 #counts SARE_SPEC_LEO_BORD 19s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
1072 header SARE_SPEC_REALLY_WORKS Subject =~ m'really works (?:wonder|excellent|good|amazing|great|fine|very)'i
1073 describe SARE_SPEC_REALLY_WORKS spamsign for specific drug spammer
1074 score SARE_SPEC_REALLY_WORKS 1.666
1075 #hist SARE_SPEC_REALLY_WORKS Bob Menschel, Nov 2005
1076 #counts SARE_SPEC_REALLY_WORKS 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
1077 #max SARE_SPEC_REALLY_WORKS 478s/0h of 386238 corpus (131050s/255188h RM) 11/17/05
1078 #counts SARE_SPEC_REALLY_WORKS 0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
1079 #max SARE_SPEC_REALLY_WORKS 6s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
1080 #counts SARE_SPEC_REALLY_WORKS 1s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
1081 #max SARE_SPEC_REALLY_WORKS 2s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
1082 #counts SARE_SPEC_REALLY_WORKS 6s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
1083 #counts SARE_SPEC_REALLY_WORKS 0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
1084 #max SARE_SPEC_REALLY_WORKS 10s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
1085 #counts SARE_SPEC_REALLY_WORKS 0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
1086 #max SARE_SPEC_REALLY_WORKS 48s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
1087 #counts SARE_SPEC_REALLY_WORKS 17s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
1088 #max SARE_SPEC_REALLY_WORKS 24s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
1090 header SARE_SPEC_REALLY_WORK2 Subject =~ m'works wonders?$'i
1091 describe SARE_SPEC_REALLY_WORK2 spamsign for specific drug spammer
1092 score SARE_SPEC_REALLY_WORK2 0.617
1093 #hist SARE_SPEC_REALLY_WORK2 Bob Menschel, Nov 2005
1094 #counts SARE_SPEC_REALLY_WORK2 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
1095 #max SARE_SPEC_REALLY_WORK2 118s/1h of 386238 corpus (131050s/255188h RM) 11/17/05
1096 #counts SARE_SPEC_REALLY_WORK2 0s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
1097 #max SARE_SPEC_REALLY_WORK2 5s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
1098 #counts SARE_SPEC_REALLY_WORK2 0s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
1099 #max SARE_SPEC_REALLY_WORK2 1s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
1100 #counts SARE_SPEC_REALLY_WORK2 1s/0h of 90468 corpus (40568s/49900h DOC) 11/18/05
1101 #counts SARE_SPEC_REALLY_WORK2 0s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
1102 #max SARE_SPEC_REALLY_WORK2 6s/0h of 9823 corpus (4931s/4892h FT) 11/18/05
1103 #counts SARE_SPEC_REALLY_WORK2 0s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
1104 #max SARE_SPEC_REALLY_WORK2 13s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
1105 #counts SARE_SPEC_REALLY_WORK2 5s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
1106 #max SARE_SPEC_REALLY_WORK2 13s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
1108 header SARE_SPEC_REALLY_WORK3 Subject =~ m'really works\!$'i
1109 describe SARE_SPEC_REALLY_WORK3 spamsign for specific drug spammer
1110 score SARE_SPEC_REALLY_WORK3 1.017
1111 #hist SARE_SPEC_REALLY_WORK3 Bob Menschel, Nov 2005
1112 #counts SARE_SPEC_REALLY_WORK3 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
1113 #max SARE_SPEC_REALLY_WORK3 54s/0h of 386238 corpus (131050s/255188h RM) 11/17/05
1114 #counts SARE_SPEC_REALLY_WORK3 0s/0h of 11588 corpus (6361s/5227h CT) 11/18/05
1115 #counts SARE_SPEC_REALLY_WORK3 23s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
1116 #counts SARE_SPEC_REALLY_WORK3 6s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
1118 header SARE_SPEC_REALLY_WORK4 Subject =~ m'(?:\b(?:you|u) (?:could|might|do|maybe)? ?need it|(?:useful|interesting) information|don\'t (?:miss (?:the|a good) chance|miss it)|good proposal|just (?:do|think about) it|very good news|to let you know|(?:upi|u) can (?:do|ride) it|just have a look|(?:new|good) offr)\W{0,30}$'i
1119 describe SARE_SPEC_REALLY_WORK4 spamsign for specific drug spammer
1120 score SARE_SPEC_REALLY_WORK4 0.665
1121 #hist SARE_SPEC_REALLY_WORK4 Bob Menschel, Nov 2005
1122 #counts SARE_SPEC_REALLY_WORK4 14s/10h of 173230 corpus (99061s/74169h RM) 05/11/06
1123 #max SARE_SPEC_REALLY_WORK4 2566s/11h of 366082 corpus (108301s/257781h RM) 11/25/05
1124 #counts SARE_SPEC_REALLY_WORK4 12s/0h of 36686 corpus (32345s/4341h AxB2) 05/14/06
1125 #max SARE_SPEC_REALLY_WORK4 130s/0h of 4676 corpus (3324s/1352h AxB) 11/18/05
1126 #counts SARE_SPEC_REALLY_WORK4 11s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
1127 #counts SARE_SPEC_REALLY_WORK4 101s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
1128 #counts SARE_SPEC_REALLY_WORK4 34s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
1129 #counts SARE_SPEC_REALLY_WORK4 29s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
1130 #max SARE_SPEC_REALLY_WORK4 254s/0h of 19215 corpus (15849s/3366h ML) 11/18/05
1131 #counts SARE_SPEC_REALLY_WORK4 16s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
1132 #max SARE_SPEC_REALLY_WORK4 31s/0h of 42678 corpus (37399s/5279h MY) 11/18/05
1134 ######## ###################### ##################################################
1135 # Spammers identified by their web site or "service"
1136 ######## ###################### ##################################################
1138 uri __SARE_SPEC_XXGEOCITIE m'\b(?:(?!www)[a-z]{2,3})\.(?:geocities|tripod)\.com/\w{1,30}/\?'i
1139 uri __SARE_SPEC_XX2GEOCIT /\b[a-z]{2}\.geocities\.com/i
1141 meta SARE_SPEC_XXGEOCITIES2 !__SARE_SPEC_XXGEOCITIE && __SARE_SPEC_XX2GEOCIT
1142 describe SARE_SPEC_XXGEOCITIES2 spamsign pointing to free webhost spam site
1143 score SARE_SPEC_XXGEOCITIES2 1.666
1144 #hist SARE_SPEC_XXGEOCITIES2 Fred Tarasevicius, Nov 2005
1145 #counts SARE_SPEC_XXGEOCITIES2 497s/18h of 173230 corpus (99061s/74169h RM) 05/11/06
1146 #max SARE_SPEC_XXGEOCITIES2 1237s/2h of 369947 corpus (112058s/257889h RM) 11/24/05
1147 #counts SARE_SPEC_XXGEOCITIES2 66s/2h of 9999 corpus (5651s/4348h AxB) 05/14/06
1148 #counts SARE_SPEC_XXGEOCITIES2 238s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
1149 #counts SARE_SPEC_XXGEOCITIES2 698s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
1150 #counts SARE_SPEC_XXGEOCITIES2 1251s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
1151 #counts SARE_SPEC_XXGEOCITIES2 2881s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
1152 #counts SARE_SPEC_XXGEOCITIES2 62s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
1154 meta SARE_SPEC_XXGEOCITIES3 __SARE_SPEC_XXGEOCITIE && __SARE_SPEC_XX2GEOCIT
1155 describe SARE_SPEC_XXGEOCITIES3 spamsign pointing to free webhost spam site
1156 score SARE_SPEC_XXGEOCITIES3 1.666
1157 #hist SARE_SPEC_XXGEOCITIES3 Fred Tarasevicius, Nov 2005
1158 #ham SARE_SPEC_XXGEOCITIES3 confirmed (1)
1159 #counts SARE_SPEC_XXGEOCITIES3 0s/0h of 173230 corpus (99061s/74169h RM) 05/11/06
1160 #max SARE_SPEC_XXGEOCITIES3 499s/0h of 366082 corpus (108301s/257781h RM) 11/25/05
1161 #counts SARE_SPEC_XXGEOCITIES3 8s/0h of 9999 corpus (5651s/4348h AxB) 05/14/06
1162 #counts SARE_SPEC_XXGEOCITIES3 27s/0h of 13339 corpus (7462s/5877h CT) 05/14/06
1163 #counts SARE_SPEC_XXGEOCITIES3 23s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
1164 #counts SARE_SPEC_XXGEOCITIES3 168s/0h of 42419 corpus (34292s/8127h FVGT) 05/15/06
1165 #counts SARE_SPEC_XXGEOCITIES3 75s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
1166 #counts SARE_SPEC_XXGEOCITIES3 916s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
1168 uri __SARE_SPEC_XXGEOCIT5 m'\bgeocities\.yahoo\.com\b'i
1169 meta SARE_SPEC_XXGEOCITIE5 __SARE_SPEC_XXGEOCIT5
1170 describe SARE_SPEC_XXGEOCITIE5 spamsign pointing to free webhost spam site
1171 score SARE_SPEC_XXGEOCITIE5 0.667
1172 #hist SARE_SPEC_XXGEOCITIE5 Bob Menschel, Dec 2005
1173 #counts SARE_SPEC_XXGEOCITIE5 31s/12h of 173230 corpus (99061s/74169h RM) 05/11/06
1174 #counts SARE_SPEC_XXGEOCITIE5 6s/0h of 9999 corpus (5651s/4348h AxB) 05/14/06
1175 #counts SARE_SPEC_XXGEOCITIE5 11s/1h of 13339 corpus (7462s/5877h CT) 05/14/06
1176 #counts SARE_SPEC_XXGEOCITIE5 14s/0h of 155610 corpus (103978s/51632h DOC) 05/14/06
1177 #counts SARE_SPEC_XXGEOCITIE5 16s/1h of 42419 corpus (34292s/8127h FVGT) 05/15/06
1178 #counts SARE_SPEC_XXGEOCITIE5 5s/0h of 23026 corpus (17290s/5736h MY) 05/14/06
1179 #counts SARE_SPEC_XXGEOCITIE5 197s/0h of 106098 corpus (72789s/33309h ML) 05/14/06
1181 ######## ###################### ##################################################
1182 # Other specific spammers
1183 ######## ###################### ##################################################
projects / spamassassin_config.git / blob