score ACRO8PR0 4
# blarson 2007-10-05
-body WBRS /\b(WBRS|FPMC|ADYN|AFML|MISJ|HXPN|WHKA|CBFE|HSBC|PCAI|MPRG|HPRS|AUNI|TGVI|MHII|TAMG|GDKI|ACEN|CDYV|G7Q\.F|mbwc|CHFR|CDPN|DSDI|UTEV|P-S-U-D|GPSI|SGXI|CAON|SREA|ERMX|VPSN|SZSN|PAYI\.OB|LTDI|C\W\W?Y\W\W?T\W\W?V|E\WX\WM\WT|CYTV|VGPM|V\s?G\s?P\s?M(\.PK)?|wwng|WWNG|F\WD\WE\WG|FDEG|UTYW|M\s*I\s*H\s*I|O\W?N\W?C\W?O|P\W?P\W?Y\W?H|S\W?R\W?E\W?A|A\W?C\W?G\W?U|S\W?C\W?Y\W?F|C\W?H\W?V\W?C|D\W?M\W?X\W?C|F\W?R\W?L\W?E|M\W?A\W?K\W?U|C\W?W\W?T\W?E|F\W?R\W?L\W?E|M\W?X\W?X\W?R|P\W?R\W?T\W?H|A\W?L\W?L\W?U|C\W?W\W?T\W?D|T\W?A\W?D\W?F|D\W?M\W?H\W?N|C\W?A\W?O\W?N|Cwtd|N\W?C\W?S\W?H|F\W?R\W?L\W?E|M\W?A\W?K\W?U|d\W?m\W?h\W?n|T\W?R\W?T\W?M|[Ee]\W?[Tt]\W?[Gg]\W?[Uu]|PERT|EWIN|SXB\.F)\b/
+body WBRS /\b(WBRS|FPMC|ADYN|AFML|MISJ|HXPN|WHKA|CBFE|HSBC|PCAI|MPRG|HPRS|AUNI|TGVI|MHII|TAMG|GDKI|ACEN|CDYV|G7Q\.F|mbwc|CHFR|CDPN|DSDI|UTEV|P-S-U-D|GPSI|SGXI|CAON|SREA|ERMX|VPSN|SZSN|PAYI\.OB|LTDI|C\W\W?Y\W\W?T\W\W?V|E\WX\WM\WT|CYTV|VGPM|V\s?G\s?P\s?M(\.PK)?|wwng|WWNG|F\WD\WE\WG|FDEG|UTYW|M\s*I\s*H\s*I|O\W?N\W?C\W?O|P\W?P\W?Y\W?H|S\W?R\W?E\W?A|A\W?C\W?G\W?U|S\W?C\W?Y\W?F|C\W?H\W?V\W?C|D\W?M\W?X\W?C|F\W?R\W?L\W?E|M\W?A\W?K\W?U|C\W?W\W?T\W?E|F\W?R\W?L\W?E|M\W?X\W?X\W?R|P\W?R\W?T\W?H|A\W?L\W?L\W?U|C\W?W\W?T\W?D|T\W?A\W?D\W?F|D\W?M\W?H\W?N|C\W?A\W?O\W?N|Cwtd|N\W?C\W?S\W?H|F\W?R\W?L\W?E|M\W?A\W?K\W?U|d\W?m\W?h\W?n|T\W?R\W?T\W?M|[Ee]\W?[Tt]\W?[Gg]\W?[Uu]|P\W?E\W?R\W?T|EWIN|SXB\.F)\b/
describe WBRS stock spam
score WBRS 4
meta STOCKLIKE (FOURLA && (MONEY || SUBJMONEY))
describe STOCKLIKE Four letter acronyms with money; stock scam
-score STOCKLIKE 2
+score STOCKLIKE 1
# blarson 2007-01-26
header ACROBAT8 subject =~ /\badobe acr[o0]bat 8\b/i
# blarson 2007-11-22
header CAPINIT subject =~ /^(?:Re:)?\s*(?:(?:[A-Z][a-z-]+|PaintBrush|Jet (?:plane|fighter)|Tennis racquet|Leather jacket|IWC|\&|Jaeger-LeCoultre)\s+)+(?:[A-Z][a-z-]+|PaintBrush|Jet (?:plane|fighter)|Tennis racquet|Leather jacket)\s*$/
describe CAPINIT Capinit Every Word
-score CAPINIT 2.2
+score CAPINIT 3
# blarson 2007-11-23
body REMOVESPACE /\b(?:remove|w\/o|without|delete) spaces?\b/i
score SEEKEMP 3
# blarson 2007-12-27
-body PRICELIST /(?:^(?:adobe|microsoft|intuit|autodesk|symantec)\W.*\b\d{2,}$){3,}/i
+body PRICELIST /(?m:^(?:adobe|microsoft|intuit|autodesk|symantec)\W.*\b\d{2,}$){3,}/i
describe PRICELIST list of prices
score PRICELIST 1
describe BUYTHEPRODUCT Buy the product subject
score BUYTHEPRODUCT 3
+# blarson 2008-01-11
+body IBERIS /\bIberis Capital Group\b/
+describe IBERIS Iberis Capital Group
+score IBERIS 4
+
+# blarson 2008-01-18
+header HIFROM subject =~ /\b(?:hello|hi)\s+from/i
+describe HIFROM hello from
+score HIFROM 2
+
+# blarson 2008-01-22
+body INTCORP /\bInternational\s+corporation\b/i
+describe INTCORP International corporation
+score INTCORP 2
+
+# blarson 2008-01-23
+header ISITYOU subject =~ /\bis it you\b/i
+describe ISITYOU is it you
+score ISITYOU 2
+
+# blarson 2008-01-27
+header CUSTOMERALERT subject =~ /\bCustomer alert\b/i
+describe CUSTOMERALERT Customer alert
+score CUSTOMERALERT 3
+
+# blarson 2008-02-16
+body SLASHITY /^\s*\/\/\/.*\\\\\\\s*$/
+describe SLASHITY /// ... \\\
+score SLASHITY 2
+
+# blarson 2008-02-20
+full OPENPOS /\bopen\s*position/i
+describe OPENPOS open positions
+score OPENPOS 3
+
+# don 2008-02-23
+header EBAYMEMBER subject =~ /message from ebay member/i
+describe EBAYMEMBER Message from ebay member
+score EBAYMEMBER 4