score CANDYHOS 5
# blarson 2005-12-08
+# don 2007-11-21 -- combine other rule; increment score
body GEOCITIES /http\:\/\/.*geocities/i
describe GEOCITIES geocities url
-score GEOCITIES 1.6
+score GEOCITIES 2.5
# blarson 2005-12-24
body EMPTYURL /\bhttp:\/\/(?:www\.)?$/i
score URIBL_CNKR 2.5
# blarson 2007-09-14
-uridnsbl_skip_domain debian.org debian.net
+uridnsbl_skip_domain debian.org debian.net yahoo.com google.com
# blarson 2007-09-14
uridnsbl URIBL_SBL sbl.spamhaus.org. A
describe MASZON pron spam
score MASZON 4
-# blarson 2007-10-26
-full GEOCITIES /\bhttp\:\/\/geocities\.com\b/i
-describe GEOCITIES http://geocities.com/
-score GEOCITIES 1
# blarson 2007-10-27
body GMAIL /\@gmail\.com\b/i
score HANOIFASH 4
# blarson 2007-11-06
-body ONLINEMED /\b(?:onlinemedicalkey|pharm\w*|webvinz|wendebay|webdcd|vowelstep|wclth)\s*\.\s*com\b/i
+body ONLINEMED /\b(?:onlinemedicalkey|pharm\w*|webvinz|wendebay|webdcd|vowelstep|wclth|duringgear|broadbasic|instantsuffix|magnetdouble|drugsdirecteat)\s*\.\s*com\b/i
describe ONLINEMED onlinemedicalkey.com
score ONLINEMED 4
body GETUP /\bgetupgradednow\.com\b/i
describe GETUP getupgradednow.com
score GETUP 4
+
+# blarson (pusling's idea) 2007-11-16
+body SPACECOM /^[\w\d]+\s\.\scom\b/
+describe SPACECOM whatever . com
+score SPACECOM 3
+
+# blarson 2007-11-20
+uridnsbl URIBL_FLO flowgoaway.com. A
+body URIBL_FLO eval:check_uridnsbl('URIBL_FLO')
+describe URIBL_FLO web site in flowgoaway.com
+tflags URIBL_FLO net
+score URIBL_FLO 1
+
+# blarson 2007-11-20
+body SOFTROU /\bwww\.softrou\.com\b/i
+describe SOFTROU www.softrou.com
+score SOFTROU 3
+
+# blarson 2007-11-20
+body GOOGLEPAGES /\bgooglepages\.com\b/i
+describe GOOGLEPAGES spammers use googlepages
+score GOOGLEPAGES 2