# joy, 2003-06-29 body ORIENTSKY /orient-sky\.com/ describe ORIENTSKY Japanese spam score ORIENTSKY 4 # joy, 2003-07-06 body PACHETES /www\.pachetes\.com/ describe PACHETES Spanish spam score PACHETES 4 # cjwatson, 2003/07/12 body NO_MORE_ACCENT /www\.no-more-accent\.com/ describe NO_MORE_ACCENT No More Accent spam score NO_MORE_ACCENT 4 # joy, 2003-08-15 header FETHARD Subject =~ /fethard.biz/i describe FETHARD Spam from Fethard.biz score FETHARD 4 # joy, 2003-10-21, 2003-10-31 body PHARMACYSPAM3 /http:\/\/www\.rx(salenow|ville)\.biz/i describe PHARMACYSPAM3 pharmacy spam 3 score PHARMACYSPAM3 4 # cjwatson, 2004-01-13 # blarson, any number 2004-04-01 # blarson, more ajustmets 2004-04-03 body HREF_NNNN /www\.\d{3,5}hosting\.com/ describe HREF_NNNN www.NNNNhosting.com spam score HREF_NNNN 3 # cjwatson, 2004-02-16 body SOCCER_MOMS /www\.soccer-moms\.biz/ describe SOCCER_MOMS Porn spam score SOCCER_MOMS 4 # cjwatson, 2004-02-22 body MRSM_TILO /mrsm-tilo\.com/ describe MRSM_TILO Medical spam score MRSM_TILO 4 # cjwatson, 2004-02-27 body FAST_ACTING /fast-acting\.com/ describe FAST_ACTING Viagra spam score FAST_ACTING 4 # blarson 2004-04-04 body COMCLICKPH /com-click\.com\.ph/ describe COMCLICKPH PH spam gang score COMCLICKPH 4 # blarson 2004-05-01 body MEDS675 /(675meds|medsarergreat)\.com/i describe MEDS675 More drug spam score MEDS675 3 # blarson 2004-04-30 body ERHOME /erhome\.com/i describe ERHOME loan spammer score ERHOME 3 # blarson 2005-04-27 body CANDYHOS /\.(?:candyhos\.com|(?:mycountry|polty|make4u)\.cc|puchiphoto\.org|purepure\.org)\//i describe CANDYHOS spams from korea, hosts in japan score CANDYHOS 5 # blarson 2005-12-08 # don 2007-11-21 -- combine other rule; increment score body GEOCITIES /http\:\/\/.*geocities/i describe GEOCITIES geocities url score GEOCITIES 2.5 # blarson 2005-12-24 body EMPTYURL /\bhttp:\/\/(?:www\.)?$/i describe EMPTYURL empty URL score EMPTYURL 1.5 # blarson 2006-02-06 body AMPRO /www\.amateurprovideo\.info/i describe AMPRO bug submitting spammer score AMPRO 5 # blarson 2007-04-03 body IMAGESHACK /\/img\d+\.imageshack\.us\//i describe IMAGESHACK shack attack score IMAGESHACK 3.5 # dla 2007-04-03 header MSOUTLOOK x-mailer =~ /Microsoft\s+Outlook/i describe MSOUTLOOK Microsoft Outlook score MSOUTLOOK 0 meta SHACKOUTLOOK IMAGESHACK && MSOUTLOOK describe SHACKOUTLOOK shack'ed to outlook score SHACKOUTLOOK 2 # blarson 2007-04-09 body UNSUBG /\bwww\.guiaartistica\.com\.ar\b/ describe UNSUBG spamming bts with unsubscribe messages score UNSUBG 14 # blarson 2007-05-14 body IMGCLOSET /\bhttp\:\/\/.*\b((image(closet|thrust|hosting)|mypicshare|tinypic|fileanchor|imgspot)\.com|bilder-hosting\.de|saunalahti\.fi|upload2\.net|imagehost\.ro)\b/i describe IMGCLOSET closet spammer score IMGCLOSET 3.5 # blarson 2007-05-17 body TROUBLEDE /\bhttp\:\/\/www\.TroubleAgent\.de\b/ describe TROUBLEDE troubleagent.de spam score TROUBLEDE 3.5 # don 2007-05-24 body BESTLOANS /www.bestmortloans.com/i describe BESTLOANS Best loans url score BESTLOANS 2 # blarson 2007-07-22 2007-09-12 body PENPRO /\@(?:penmailpro|OnsetIng|openprotection|NearOut|SuperOnset|medicalgloveonline|YourOnset|GreatGloveCell|thegloveworks|asiafriendworld)\.info\b/i describe PENPRO penmailpro spam score PENPRO 3.5 # blarson 2007-09-05 2007-09-11 body WWWCN /\b(?:www\.|https?\:.*)\w+\.cn\b/i describe WWWCN chinese web site score WWWCN 3 # cjwatson, 2002/04/04 body EMAILOFFER /www\.emailoffer\.us/ describe EMAILOFFER Gibberish HTML spammers score EMAILOFFER 4.0 # cjwatson, 2002/04/08 body JUSTYAK /www\.JustYak\.com/ describe JUSTYAK JustSpam score JUSTYAK 4.0 # blarson 2007-09-10 body SIZMATZ /\bsize-matterz\.com\b/i describe SIZMATZ size matterz score SIZMATZ 3 # blarson 2007-09-10 body EMAGX /\bhttp\:\/\/emagx\.net\b/i describe EMAGX wondercum spammer score EMAGX 3.5 # blarson 2007-09-13 body FREENFL /\bhttp\:\/\/freeNFLtracker\.com\b/i describe FREENFL nfl spam score FREENFL 3 # blarson 2007-09-13 body SPAMARREST /\bhttp\:\/\/www\.spamarrest\.com\b/ describe SPAMARREST forwards thier spam problem score SPAMARREST 4 # blarson 2007-09-14 body FROMAD /\bhttp\:\/\/(?:budhipps|fromad|conavel|cliensy|comnoe)\.com\b/i describe FROMAD more penis spam score FROMAD 4 # blarson 2007-09-14 uridnsbl URIBL_CNKR cn-kr.blackholes.us. A body URIBL_CNKR eval:check_uridnsbl('URIBL_CNKR') describe URIBL_CNKR china or korea hosted web site tflags URIBL_CNKR net score URIBL_CNKR 2.5 # blarson 2007-09-14 uridnsbl_skip_domain debian.org debian.net yahoo.com google.com # blarson 2007-09-14 uridnsbl URIBL_SBL sbl.spamhaus.org. A body URIBL_SBL eval:check_uridnsbl('URIBL_SBL') describe URIBL_SBL Contains an URL listed in the SBL blocklist tflags URIBL_SBL net #reuse URIBL_SBL score URIBL_SBL 3.5 # blarson 2007-09-17 body MYCHEAP /\b(?:my)?cheap(?:xp|adobe)?(?:oem|soft)+(?:now|ware)?(?:(?:4|for)?less)?\d*\s*\.\s*com\b/i describe MYCHEAP software spam score MYCHEAP 4 # blarson 2007-09-16 body WWWRU /\b(?:www\.|https?\:.*)\w+\.ru\b/i describe WWWRU russian web site score WWWRU 2 # blarson 2007-09-24 body VIPSMS /\bvipsms\.org\b/i describe VIPSMS vipsms.org score VIPSMS 4 # don 2007-10-01 header MAKEUP subject =~ /makeup\.com/i describe MAKEUP makeup.com url score MAKEUP 3 # blarson 2007-10-04 body SUBT /\bsubtracthold\.com\b/i describe SUBT subtracthold.com score SUBT 4 body GRAPHICMAIL /\bhttp\:\/\/www\.graphicmail\.de\b/i describe GRAPHICMAIL graphicmail.de score GRAPHICMAIL 4 body WWWRO /\b(?:www\.|https?\:.*)\w+\.ro\b/i describe WWWRO romanian web site score WWWRO 2 # blarson 2007-10-10 body CLEANDOM /http\:\/\/\{_clean_domains\}/ describe CLEANDOM broken spamware score CLEANDOM 4 # blarson 2007-10-11 body SOFTNLSE /\bsoftnlse\s*\.\s*com\b/i describe SOFTNLSE softnlse.com score SOFTNLSE 4 # blarson 2007-10-13 body MUSVID /\b(?:MusicAndVideoWorld|usa-bestsellers)\.com/i describe MUSVID MusicAndVideoWorld.com score MUSVID 4 # blarson 2007-10-16 body PLATSOFT /\btheplatinumsoft\.com\b/i describe PLATSOFT theplatinumsoft.com score PLATSOFT 4 # blarson 2007-10-22 body BLOGSPOT /\bblogspot\.com\b/i describe BLOGSPOT spammers are hosting on blogspot score BLOGSPOT 2 # blarson 2007-10-25 body PILLUS /PILL-US\.COM\b/i describe PILLUS PILL-US spam score PILLUS 4 # blarson 2007-10-25 body BETWEENTO /\bhttp\:\/\/betweento\.com\b/i describe BETWEENTO betweento.com score BETWEENTO 4 # don 2007-10-25 body MASZON /mc?a(szon|yvidol|ttk)\.(com|org|net)/i describe MASZON pron spam score MASZON 4 # blarson 2007-10-27 body GMAIL /\@gmail\.com\b/i describe GMAIL @gmail.com score GMAIL 1 # blarson 2007-10-28 body MAILRU /\@mail\.ru\b/i describe MAILRU @mail.ru score MAILRU 3 # blarson 2007-10-31 body ADOBE4LESS /\b(?:adobe4less|realnewsoft|newmicrosoftdeals|kvaka-soft)\s*[.,]\s*com\b/i describe ADOBE4LESS adobe4less . com score ADOBE4LESS 4 # blarson 2007-11-01 body RMAPPLY /http\:\/\/rmapply\.com\b/i describe RMAPPLY http://rmapply.com score RMAPPLY 4 # blarson 2007-11-04 header HANOIFASH subject =~ /WWW\.HANOI-FASHION\.COM/i describe HANOIFASH WWW.HANOI-FASHION.COM score HANOIFASH 4 # blarson 2007-11-06 body ONLINEMED /\b(?:onlinemedicalkey|pharm\w*|webvinz|wendebay|webdcd|vowelstep|wclth|duringgear|broadbasic|instantsuffix|magnetdouble|drugsdirecteat)\s*\.\s*com\b/i describe ONLINEMED onlinemedicalkey.com score ONLINEMED 4 # blarson 2007-11-15 body GETUP /\bgetupgradednow\.com\b/i describe GETUP getupgradednow.com score GETUP 4 # blarson (pusling's idea) 2007-11-16 body SPACECOM /^[\w\d]+\s\.\scom\b/ describe SPACECOM whatever . com score SPACECOM 3 # don -- flowgoaway.com doesn't appear to be a working RBL anymore (if it ever was?) # blarson 2007-11-20 # uridnsbl URIBL_FLO flowgoaway.com. A # body URIBL_FLO eval:check_uridnsbl('URIBL_FLO') # describe URIBL_FLO web site in flowgoaway.com # tflags URIBL_FLO net # score URIBL_FLO 1 # blarson 2007-11-20 body SOFTROU /\bwww\.softrou\.com\b/i describe SOFTROU www.softrou.com score SOFTROU 3 # blarson 2007-11-20 body GOOGLEPAGES /\bgooglepages\.com\b/i describe GOOGLEPAGES spammers use googlepages score GOOGLEPAGES 2