2 body ORIENTSKY /orient-sky\.com/
3 describe ORIENTSKY Japanese spam
7 body PACHETES /www\.pachetes\.com/
8 describe PACHETES Spanish spam
11 # cjwatson, 2003/07/12
12 body NO_MORE_ACCENT /www\.no-more-accent\.com/
13 describe NO_MORE_ACCENT No More Accent spam
14 score NO_MORE_ACCENT 4
17 header FETHARD Subject =~ /fethard.biz/i
18 describe FETHARD Spam from Fethard.biz
21 # joy, 2003-10-21, 2003-10-31
22 body PHARMACYSPAM3 /http:\/\/www\.rx(salenow|ville)\.biz/i
23 describe PHARMACYSPAM3 pharmacy spam 3
26 # cjwatson, 2004-01-13
27 # blarson, any number 2004-04-01
28 # blarson, more ajustmets 2004-04-03
29 body HREF_NNNN /www\.\d{3,5}hosting\.com/
30 describe HREF_NNNN www.NNNNhosting.com spam
33 # cjwatson, 2004-02-16
34 body SOCCER_MOMS /www\.soccer-moms\.biz/
35 describe SOCCER_MOMS Porn spam
38 # cjwatson, 2004-02-22
39 body MRSM_TILO /mrsm-tilo\.com/
40 describe MRSM_TILO Medical spam
43 # cjwatson, 2004-02-27
44 body FAST_ACTING /fast-acting\.com/
45 describe FAST_ACTING Viagra spam
49 body COMCLICKPH /com-click\.com\.ph/
50 describe COMCLICKPH PH spam gang
54 body MEDS675 /(675meds|medsarergreat)\.com/i
55 describe MEDS675 More drug spam
59 body ERHOME /erhome\.com/i
60 describe ERHOME loan spammer
64 body CANDYHOS /\.(?:candyhos\.com|(?:mycountry|polty|make4u)\.cc|puchiphoto\.org|purepure\.org)\//i
65 describe CANDYHOS spams from korea, hosts in japan
69 body GEOCITIES /http\:\/\/.*geocities/i
70 describe GEOCITIES geocities url
74 body EMPTYURL /\bhttp:\/\/(?:www\.)?$/i
75 describe EMPTYURL empty URL
79 body AMPRO /www\.amateurprovideo\.info/i
80 describe AMPRO bug submitting spammer
84 body IMAGESHACK /\/img\d+\.imageshack\.us\//i
85 describe IMAGESHACK shack attack
90 header MSOUTLOOK x-mailer =~ /Microsoft\s+Outlook/i
91 describe MSOUTLOOK Microsoft Outlook
94 meta SHACKOUTLOOK IMAGESHACK && MSOUTLOOK
95 describe SHACKOUTLOOK shack'ed to outlook
99 body UNSUBG /\bwww\.guiaartistica\.com\.ar\b/
100 describe UNSUBG spamming bts with unsubscribe messages
104 body IMGCLOSET /\bhttp\:\/\/.*\b((image(closet|thrust|hosting)|mypicshare|tinypic|fileanchor|imgspot)\.com|bilder-hosting\.de|saunalahti\.fi|upload2\.net|imagehost\.ro)\b/i
105 describe IMGCLOSET closet spammer
109 body TROUBLEDE /\bhttp\:\/\/www\.TroubleAgent\.de\b/
110 describe TROUBLEDE troubleagent.de spam
114 body BESTLOANS /www.bestmortloans.com/i
115 describe BESTLOANS Best loans url
118 # blarson 2007-07-22 2007-09-11
119 body PENPRO /\@(?:penmailpro|OnsetIng|openprotection)\.info\b/i
120 describe PENPRO penmailpro spam
123 # blarson 2007-09-05 2007-09-11
124 body WWWCN /\b(?:www\.|https?\:.*)\w+\.cn\b/i
125 describe WWWCN chinese web site
128 # cjwatson, 2002/04/04
129 body EMAILOFFER /www\.emailoffer\.us/
130 describe EMAILOFFER Gibberish HTML spammers
133 # cjwatson, 2002/04/08
134 body JUSTYAK /www\.JustYak\.com/
135 describe JUSTYAK JustSpam
139 body SIZMATZ /\bsize-matterz\.com\b/i
140 describe SIZMATZ size matterz
144 body EMAGX /\bhttp\:\/\/emagx\.net\b/i
145 describe EMAGX wondercum spammer