header TWITTER subject =~ /you on Twitter/
describe TWITTER Twitter invite spam
score TWITTER 4
+
+# don 2008-12-18
+uri DOS_LIVE_SPACES_CID /cid-.{10,20}\.spaces\.live\.com/
+describe DOS_LIVE_SPACES_CID live spaces uri
+score DOS_LIVE_SPACES_CID 3
+
+# don 2008-12-18
+header CHRISTMAS subject =~ /chris+tma+s (pleasure+|night)/i
+decribe CHRISTMAS Does christmas really give you pleasure?
+score CHRISTMAS 2