score CANDYHOS 5
# blarson 2005-12-08
+# don 2007-11-21 -- combine other rule; increment score
body GEOCITIES /http\:\/\/.*geocities/i
describe GEOCITIES geocities url
-score GEOCITIES 1.6
+score GEOCITIES 2.5
# blarson 2005-12-24
body EMPTYURL /\bhttp:\/\/(?:www\.)?$/i
describe BESTLOANS Best loans url
score BESTLOANS 2
-# blarson 2007-07-22
-body PENPRO /\@penmailpro\.info\b/i
+# blarson 2007-07-22 2007-09-12
+body PENPRO /\@(?:penmailpro|OnsetIng|openprotection|NearOut|SuperOnset|medicalgloveonline|YourOnset|GreatGloveCell|thegloveworks|asiafriendworld|NaturalImprove|charmshine)\.info\b/i
describe PENPRO penmailpro spam
score PENPRO 3.5
-# blarson 2007-09-05
-body WWWCN /\bwww\.\w+\.cn\b/i
+# blarson 2007-09-05 2007-09-11
+body WWWCN /\b(?:www\.|https?\:.*)\w+\.cn\b/i
describe WWWCN chinese web site
score WWWCN 3
describe JUSTYAK JustSpam
score JUSTYAK 4.0
+# blarson 2007-09-10
+body SIZMATZ /\bsize-matterz\.com\b/i
+describe SIZMATZ size matterz
+score SIZMATZ 3
+
+# blarson 2007-09-10
+body EMAGX /\bhttp\:\/\/emagx\.net\b/i
+describe EMAGX wondercum spammer
+score EMAGX 3.5
+
+# blarson 2007-09-13
+body FREENFL /\bhttp\:\/\/freeNFLtracker\.com\b/i
+describe FREENFL nfl spam
+score FREENFL 3
+
+# blarson 2007-09-13
+body SPAMARREST /\bhttp\:\/\/www\.spamarrest\.com\b/
+describe SPAMARREST forwards thier spam problem
+score SPAMARREST 4
+
+# blarson 2007-09-14
+body FROMAD /\bhttp\:\/\/(?:budhipps|fromad|conavel|cliensy|comnoe)\.com\b/i
+describe FROMAD more penis spam
+score FROMAD 4
+
+# blarson 2007-09-14
+uridnsbl URIBL_CNKR cn-kr.blackholes.us. A
+body URIBL_CNKR eval:check_uridnsbl('URIBL_CNKR')
+describe URIBL_CNKR china or korea hosted web site
+tflags URIBL_CNKR net
+score URIBL_CNKR 2.5
+
+# blarson 2007-09-14
+uridnsbl_skip_domain debian.org debian.net yahoo.com google.com
+
+# blarson 2007-09-14
+uridnsbl URIBL_SBL sbl.spamhaus.org. A
+body URIBL_SBL eval:check_uridnsbl('URIBL_SBL')
+describe URIBL_SBL Contains an URL listed in the SBL blocklist
+tflags URIBL_SBL net
+#reuse URIBL_SBL
+score URIBL_SBL 3.5
+
+# blarson 2007-09-17
+body MYCHEAP /\b(?:my)?cheap(?:xp|adobe)?(?:oem|soft)+(?:now|ware)?(?:(?:4|for)?less)?\d*\s*\.\s*com\b/i
+describe MYCHEAP software spam
+score MYCHEAP 4
+
+# blarson 2007-09-16
+body WWWRU /\b(?:www\.|https?\:.*)\w+\.ru\b/i
+describe WWWRU russian web site
+score WWWRU 2
+
+# blarson 2007-09-24
+body VIPSMS /\bvipsms\.org\b/i
+describe VIPSMS vipsms.org
+score VIPSMS 4
+
+# don 2007-10-01
+header MAKEUP subject =~ /makeup\.com/i
+describe MAKEUP makeup.com url
+score MAKEUP 3
+
+# blarson 2007-10-04
+body SUBT /\bsubtracthold\.com\b/i
+describe SUBT subtracthold.com
+score SUBT 4
+
+body GRAPHICMAIL /\bhttp\:\/\/www\.graphicmail\.de\b/i
+describe GRAPHICMAIL graphicmail.de
+score GRAPHICMAIL 4
+
+
+body WWWRO /\b(?:www\.|https?\:.*)\w+\.ro\b/i
+describe WWWRO romanian web site
+score WWWRO 2
+
+# blarson 2007-10-10
+body CLEANDOM /http\:\/\/\{_clean_domains\}/
+describe CLEANDOM broken spamware
+score CLEANDOM 4
+
+# blarson 2007-10-11
+body SOFTNLSE /\bsoftnlse\s*\.\s*com\b/i
+describe SOFTNLSE softnlse.com
+score SOFTNLSE 4
+
+# blarson 2007-10-13
+body MUSVID /\b(?:MusicAndVideoWorld|usa-bestsellers)\.com/i
+describe MUSVID MusicAndVideoWorld.com
+score MUSVID 4
+
+# blarson 2007-10-16
+body PLATSOFT /\btheplatinumsoft\.com\b/i
+describe PLATSOFT theplatinumsoft.com
+score PLATSOFT 4
+
+# blarson 2007-10-22
+body BLOGSPOT /\bblogspot\.com\b/i
+describe BLOGSPOT spammers are hosting on blogspot
+score BLOGSPOT 2
+
+# blarson 2007-10-25
+body PILLUS /PILL-US\.COM\b/i
+describe PILLUS PILL-US spam
+score PILLUS 4
+
+# blarson 2007-10-25
+body BETWEENTO /\bhttp\:\/\/betweento\.com\b/i
+describe BETWEENTO betweento.com
+score BETWEENTO 4
+
+# don 2007-10-25
+body MASZON /mc?a(szon|yvidol|ttk)\.(com|org|net)/i
+describe MASZON pron spam
+score MASZON 4
+
+
+# blarson 2007-10-27
+body GMAIL /\@gmail\.com\b/i
+describe GMAIL @gmail.com
+score GMAIL 1
+
+# blarson 2007-10-28
+body MAILRU /\@mail\.ru\b/i
+describe MAILRU @mail.ru
+score MAILRU 3
+
+# blarson 2007-10-31
+body ADOBE4LESS /\b(?:adobe4less|realnewsoft|newmicrosoftdeals|kvaka-soft)\s*[.,]\s*com\b/i
+describe ADOBE4LESS adobe4less . com
+score ADOBE4LESS 4
+
+# blarson 2007-11-01
+body RMAPPLY /http\:\/\/rmapply\.com\b/i
+describe RMAPPLY http://rmapply.com
+score RMAPPLY 4
+
+# blarson 2007-11-04
+header HANOIFASH subject =~ /WWW\.HANOI-FASHION\.COM/i
+describe HANOIFASH WWW.HANOI-FASHION.COM
+score HANOIFASH 4
+
+# blarson 2007-11-06
+body ONLINEMED /\b(?:onlinemedicalkey|pharm\w*|webvinz|wendebay|webdcd|vowelstep|wclth|duringgear|broadbasic|instantsuffix|magnetdouble|drugsdirecteat)\s*\.\s*com\b/i
+describe ONLINEMED onlinemedicalkey.com
+score ONLINEMED 4
+
+# blarson 2007-11-15
+body GETUP /\bgetupgradednow\.com\b/i
+describe GETUP getupgradednow.com
+score GETUP 4
+
+# blarson (pusling's idea) 2007-11-16
+body SPACECOM /^[\w\d]+\s\.\scom\b/
+describe SPACECOM whatever . com
+score SPACECOM 3
+
+# don -- flowgoaway.com doesn't appear to be a working RBL anymore (if it ever was?)
+# blarson 2007-11-20
+# uridnsbl URIBL_FLO flowgoaway.com. A
+# body URIBL_FLO eval:check_uridnsbl('URIBL_FLO')
+# describe URIBL_FLO web site in flowgoaway.com
+# tflags URIBL_FLO net
+# score URIBL_FLO 1
+
+# blarson 2007-11-20
+body SOFTROU /\bwww\.softrou\.com\b/i
+describe SOFTROU www.softrou.com
+score SOFTROU 3
+
+# blarson 2007-11-20
+body GOOGLEPAGES /\bgooglepages\.com\b/i
+describe GOOGLEPAGES spammers use googlepages
+score GOOGLEPAGES 2
+
+# blarson 2007-12-07
+body SOFTBESTGRAND /\bsoft(?:bestgrand|wareonlinemuch)\.com\b/
+describe SOFTBESTGRAND softbestgrand.com
+score SOFTBESTGRAND 4
+
+# blarson 2007-12-10
+body PCSOFTCHEAP /\b(?:pcsoftcheap|cheapezsoft|cheapsoftxp|adobe4cheap|phonowa|saleonsoftware|bestdealoem|realcheapsoft|krasniyles|cheapxp4pc|supercheapoem|lowpriceoem|realcheapoem|cheapadobedeal|softwarefoundation|2008oem|xpxmas|cheap2008soft|snowysoftware|2008adobe|adobe2008|cheapgetsoftone|x(?:higher|main|prime)(?:soft|software|easy)|softonlinepc|andsoftware|softonlinedownload|kunchakoem|erhere\w|kiroemch|phonowd|cheap(?:soft|oem|software)here|softwarenowprox|xprosoftonlinedl|siniyglaz|popandosoem|xsoftprodepot|triudava|krasniynos|fastsoftnow|cheapeasy(soft|oem|software)|ezadobenow)\s?\.\s?(?:com|net)\b/
+describe PCSOFTCHEAP pcsoftcheap. com
+score PCSOFTCHEAP 4
+
+# blarson 2007-12-11
+body GOLDGAME /\b(?:gamblingplacegold|goldgamesite|topgamingsite|richbestgaming|luxgoldgaming)\.(?:net|com)\b/
+describe GOLDGAME gambling sites
+score GOLDGAME 4
+
+# blarson 2007-12-14
+body ENLARGETW /\b(?:enlarge|0rz)\.tw\b/
+describe ENLARGETW enlarge.tw
+score ENLARGETW 4
+
+# blarson 2007-12-15
+body POSTTHROUGH /\b(?:postthrough|speedgrand|certaincoast)\.com\b/
+describe POSTTHROUGH postthrough.com
+score POSTTHROUGH 4
+
+# blarson 2007-12-25
+body UHAVE /\b(?:uhavepost|happy(?:santa)?|newyear|familypost|fresh|post)cards?-?(?:2008)?\.com\b/
+describe UHAVE uhavepostcard.com
+score UHAVE 4
+
+# blarson 2007-12-26
+body RUSSWIFE /\b(?:your|best|new|the)(?:russian?|address)(?:wife|bride)\.info\b/
+describe RUSSWIFE yourrussianwife.info
+score RUSSWIFE 4
+
+# blarson 2007-12-31
+body HAPPY2008 /\b(?:happy2008toyou|hellosanta2008|hohoho2008|santawishes2008)\.com\b/
+describe HAPPY2008 happy2008toyou.com
+score HAPPY2008 4
+
+# blarson 2008-01-02
+body BONGHIT /\b(?:beaverbonghits|dobongworld)\.com\b/
+describe BONGHIT beaverbonghits.com
+score BONGHIT 4
+
+# blarson 2008-01-02
+body GOOGLESEARCH /\bgoo+gle\.(com|\w\w|com?\.\w\w)\/+search/i
+describe GOOGLESEARCH google search URL
+score GOOGLESEARCH 2
+
+# blarson 2008-01-02
+body SIGAS /\b(?:Sigashash|Reelhotsi|Erisgoonti|Erisgoners|Freesignsies|Rielhotties|Foredroons|Feeshoons|Erisgant|hapburge|wuimooed|jiuezdoo|goingoinghom|buloies|Poeshages|Rueshabesoo|clitoriseries|clitorina)(?:\.|\=2E)com\b/
+describe SIGAS www.Sigashash.com
+score SIGAS 4
+
+# blarson 2008-01-05
+body RUSSIABRIDE /\brussian?(bride|wife)(?:home|live|blog)\.info\b/
+describe RUSSIABRIDE russiabridehome.info
+score RUSSIABRIDE 4
+
+# blarson 2008-01-14
+body REDMEHS /\bwww\.redmehs\b/
+describe REDMEHS www.redmehs
+score REDMEHS 4
+
+# blarson 2008-01-15
+body MYURL /\bmyurl\.com\.tw\b/i
+describe MYURL myurl.com.tw
+score MYURL 3
projects / spamassassin_config.git / blobdiff