describe FROMAD more penis spam
score FROMAD 4
-# blarson 2007-09-14
-uridnsbl URIBL_CNKR cn-kr.blackholes.us. A
-body URIBL_CNKR eval:check_uridnsbl('URIBL_CNKR')
-describe URIBL_CNKR china or korea hosted web site
-tflags URIBL_CNKR net
-score URIBL_CNKR 2.5
-
-# blarson 2007-09-14
-uridnsbl_skip_domain debian.org debian.net yahoo.com google.com
-
-# blarson 2007-09-14
-uridnsbl URIBL_SBL sbl.spamhaus.org. A
-body URIBL_SBL eval:check_uridnsbl('URIBL_SBL')
-describe URIBL_SBL Contains an URL listed in the SBL blocklist
-tflags URIBL_SBL net
-#reuse URIBL_SBL
-score URIBL_SBL 3.5
-
# blarson 2007-09-17
body MYCHEAP /\b(?:my)?cheap(?:xp|adobe)?(?:oem|soft)+(?:now|ware)?(?:(?:4|for)?less)?\d*\s*\.\s*com\b/i
describe MYCHEAP software spam
score SOFTBESTGRAND 4
# blarson 2007-12-10
-body PCSOFTCHEAP /\b(?:pcsoftcheap|cheapezsoft|cheapsoftxp|adobe4cheap|phonowa|saleonsoftware|bestdealoem|realcheapsoft|krasniyles|cheapxp4pc|supercheapoem|lowpriceoem|realcheapoem|cheapadobedeal|softwarefoundation|2008oem|xpxmas|cheap2008soft|snowysoftware|2008adobe|adobe2008|cheapgetsoftone|x(?:higher|main|prime)(?:soft|software|easy)|softonlinepc|andsoftware|softonlinedownload|kunchakoem|erhere\w|kiroemch|phonowd|cheap(?:soft|oem|software)here|softwarenowprox|xprosoftonlinedl|siniyglaz|popandosoem|xsoftprodepot|triudava|krasniynos|fastsoftnow|cheapeasy(soft|oem|software)|ezadobenow|softnowpromohere|primenetsofthe|nowinstantsoftieq|isktesoft|best(?:oem|soft|software)2008|new2008(?:soft|oem|software)|fastez(?:soft|oem|software)|ezfast(?:oem|soft|software)|2008(?:micro)?softdeals|oemfactorysale|nbuysoft|softnuhere|softsale2008|softwintersale|blatnoyoem|svedsoft|gsxoempromo|getmicrosoftfast|adobeoemsale|xp4(?:cheap|less)|xpoemnow|buycheapxp|alloem4less)\s?\.\s?(?:com|net)\b/
+body PCSOFTCHEAP /\b(?:pcsoftcheap|cheapezsoft|cheapsoftxp|adobe4cheap|phonowa|saleonsoftware|bestdealoem|realcheapsoft|krasniyles|cheapxp4pc|supercheapoem|lowpriceoem|realcheapoem|cheapadobedeal|softwarefoundation|2008oem|xpxmas|cheap2008soft|snowysoftware|2008adobe|adobe2008|cheapgetsoftone|x(?:higher|main|prime)(?:soft|software|easy)|softonlinepc|andsoftware|softonlinedownload|kunchakoem|erhere\w|kiroemch|phonowd|cheap(?:soft|oem|software)here|softwarenowprox|xprosoftonlinedl|siniyglaz|popandosoem|xsoftprodepot|triudava|krasniynos|fastsoftnow|cheapeasy(soft|oem|software)|ezadobenow|softnowpromohere|primenetsofthe|nowinstantsoftieq|isktesoft|best(?:oem|soft|software)2008|new2008(?:soft|oem|software)|fastez(?:soft|oem|software)|ezfast(?:oem|soft|software)|2008(?:micro)?softdeals|oemfactorysale|nbuysoft|softnuhere|softsale2008|softwintersale|blatnoyoem|svedsoft|gsxoempromo|getmicrosoftfast|adobeoemsale|xp4(?:cheap|less)|xpoemnow|buycheapxp|alloem4less|lun(?:soft|oem|software)|(?:new|fast)xp(?:soft|oem|software)|frukanoka|softcheap(?:n[eo]w|xp)|adobe(?:web|blog|new)(?:soft|spot|deal))\s?\.\s?(?:com|net)\b/
describe PCSOFTCHEAP pcsoftcheap. com
score PCSOFTCHEAP 4
describe SCIJOURNALS scientific journals
score SCIJOURNALS 4
+# blarson 2008-03-19
+body JANEHOT /\bjane\d[\w\d]*\@hotmail\.com\s*$/
+describe JANEHOT jane*@hotmail.com
+score JANEHOT 3
+
+# blarson 2008-03-20
+rawbody BIFUTRA /\b(?:bifutra|veriapoli|xenifeao|toporaig|jieros|bifreca|werikine|incroomise|genbullenst|writeprovide)(?:\.|\=2E)com\b/
+describe BIFUTRA spammer web sites
+score BIFUTRA 4
+
+# don 2008-04-02
+body LONGLINEURL /^.{55,}\S\shttp:\/\/www\.\w+\.(?:com|net|org)\/\s*$/
+describe LONGLINEURL long line ending in a simple url
+score LONGLINEURL 2
+
+# don 2008-04-07
+uri MYTHANKYOUURI /www\.mythankyou\.com/i
+describe MYTHANKYOUURI www.mythankyou.com
+score MYTHANKYOUURI 5
+
+# don 2008-04-08
+uri BLOGSPOTURI /blogspot\.com/i
+describe BLOGSPOTURI something.blogspot.com
+score BLOGSPOTURI 2.5
+
+# blarson 2008-04-09
+uri SAMEAS /\bsupersameas\.com\b/
+describe SAMEAS supersameas.com
+score SAMEAS 3
+
+# blarson 2008-04-12
+body URIEXE /\bhttp:\S*\.exe\b/
+describe URIEXE .exe url
+score URIEXE 3
+
+# blarson 2008-04-24
+uri SANSATION /\b(?:sansationel|garmenys|iconaliste)\.com\b/i
+describe SANSATION sansationel.com
+score SANSATION 4
+
+# blarson 2008-05-04
+body EQMEDS /\beqmeds\b/i
+describe EQMEDS eqmeds
+score EQMEDS 4
+
+# blarson 2008-05-06
+uri MYLIVE /\bmylivegi\b/i
+describe MYLIVE mylivegirlx.com
+score MYLIVE 4
+
+# don 2008-05-26
+body BROKENURL /^\s*www((\s+\.\s*)|(\s*\.\+))\S+((\s+\.\s*)|(\s*\.\+))(com|net|org)\s*$/
+describe BROKENURL Broken url displayed
+score BROKENURL 4