meta STOCKLIKE (FOURLA && (MONEY || SUBJMONEY))
describe STOCKLIKE Four letter acronyms with money; stock scam
-score STOCKLIKE 2
+score STOCKLIKE 1
# blarson 2007-01-26
header ACROBAT8 subject =~ /\badobe acr[o0]bat 8\b/i
score SEEKEMP 3
# blarson 2007-12-27
-body PRICELIST /(?:^(?:adobe|microsoft|intuit|autodesk|symantec)\W.*\b\d{2,}$){3,}/i
+body PRICELIST /(?m:^(?:adobe|microsoft|intuit|autodesk|symantec)\W.*\b\d{2,}$){3,}/i
describe PRICELIST list of prices
score PRICELIST 1
body SITESUBJECT /\bPlease see this site in Subject\b/i
describe SITESUBJECT Pls check this new site
score SITESUBJECT 3
+
+# tomv 2008-01-01
+header PLSCHECKSITE from =~ /\bPls check this new site\b/i
+describe PLSCHECKSITE Pls check this new site
+score PLSCHECKSITE 4
+
+# blarson 2008-01-03
+header MARRYCH subject =~ /\bMarry Christmas\b/
+describe MARRYCH Marry Christmas
+score MARRYCH 3
+
+# don 2008-01-7
+header BUYTHEPRODUCT subject =~ /Buy the product/i
+describe BUYTHEPRODUCT Buy the product subject
+score BUYTHEPRODUCT 3
+
+# blarson 2008-01-11
+body IBERIS /\bIberis Capital Group\b/
+describe IBERIS Iberis Capital Group
+score IBERIS 4