]> git.donarmstrong.com Git - spamassassin_config.git/commitdiff
add spamassassin configuration
authorDon Armstrong <don@debian.org>
Sat, 8 Sep 2007 17:39:45 +0000 (17:39 +0000)
committerDon Armstrong <don@debian.org>
Sat, 8 Sep 2007 17:39:45 +0000 (17:39 +0000)
git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@2 0b7a5b0c-1f2c-0410-bd74-c376f8064c91

20 files changed:
bugs/user_prefs [new file with mode: 0644]
common/blacklists [new file with mode: 0644]
common/bts_scores [new file with mode: 0644]
common/bts_specific [new file with mode: 0644]
common/charset_tests [new file with mode: 0644]
common/common_rbl [new file with mode: 0644]
common/common_spam [new file with mode: 0644]
common/debian_specific [new file with mode: 0644]
common/disabled_rules [new file with mode: 0644]
common/drug_spam [new file with mode: 0644]
common/list_specific [new file with mode: 0644]
common/misc_spam [new file with mode: 0644]
common/money_spam [new file with mode: 0644]
common/phrase_spam [new file with mode: 0644]
common/pron_spam [new file with mode: 0644]
common/scam_spam [new file with mode: 0644]
common/scores [new file with mode: 0644]
common/url_spam [new file with mode: 0644]
common/virus_spam [new file with mode: 0644]
lists/user_prefs [new file with mode: 0644]

diff --git a/bugs/user_prefs b/bugs/user_prefs
new file mode 100644 (file)
index 0000000..8188d43
--- /dev/null
@@ -0,0 +1,97 @@
+# This is the right place to customize your installation of SpamAssassin.
+# See 'perldoc Mail::SpamAssassin::Conf' for details of what can be tweaked.
+#
+###########################################################################
+#
+# (/org/bugs.debian.org/spamassassin/spamc)
+
+# HEY YOU. YES YOU.
+# RUN spamassassin --lint!
+
+rewrite_subject                0
+report_safe            1
+#defang_mime           0
+required_hits          4
+version_tag             bugs.debian.org-2005-01-02
+# just for testing!
+#always_add_report     1
+
+# cjwatson 2004-04-09 sorry, but we're stalling on Razor all the time at the
+# moment and it's causing bad delays; turning off until spamscan is fixed to
+# be multiprocess
+# 2005-10-30 blarson turn back on finally
+use_razor2             1
+
+# testing only --joy, 2003-09-12
+# 2005-01-28 blarson -- doesn't seem to be useful, disabling
+#ok_locales              en
+#ok_languages            en
+#score CHARSET_FARAWAY           0.03
+#score CHARSET_FARAWAY_HEADERS   0.02
+#score HTML_CHARSET_FARAWAY      0.005
+#score MIME_CHARSET_FARAWAY      0.02
+#score UNDESIRED_LANGUAGE_BODY   0.03
+ok_locales              all
+ok_languages            all
+score CHARSET_FARAWAY          0
+score CHARSET_FARAWAY_HEADERS  0
+score HTML_CHARSET_FARAWAY     0
+score MIME_CHARSET_FARAWAY     0
+score UNDESIRED_LANGUAGE_BODY  0
+
+#bayes_expiry_scan_count 20000
+
+# blarson 2005-01-28 -- try a bigger datebase
+bayes_expiry_max_db_size 300000
+# may solve locking problem at cost of slower updates
+bayes_learn_to_journal 1
+
+# Cope with refiltered mail
+bayes_ignore_header X-Spam-Checker-Version
+bayes_ignore_header X-Spam-Flag
+bayes_ignore_header X-Spam-Level
+bayes_ignore_header X-Spam-Status
+
+# a bit cautious (cf. #188703)
+# blarson -- ajust again, now that it's trained 2004-05-13
+# blarson 2004-10-22
+# blarson 2006-10-29 2006-11-17
+auto_learn_threshold_nonspam  -5
+score BAYES_00 -3
+score BAYES_01 -2
+score BAYES_10 -1.5
+score BAYES_20 -1
+score BAYES_30 -0.5
+score BAYES_40 -0.2
+score BAYES_44 -0.1
+score BAYES_50 0.5
+score BAYES_56 1
+score BAYES_60 2
+score BAYES_70 2.5
+score BAYES_80 3
+score BAYES_90 4
+score BAYES_99 4.5
+
+include common/bts_specific
+# blarson 2005-01-28
+clear_trusted_networks
+# the /24 around spohr, master, and gluck
+trusted_networks 127.0.0.1 128.193.0.0/24 146.82.138.0/24 192.25.206.0/24 140.211.166.0/24
+
+# blarson 2004-03-20
+# Disable most DNSBLs -- overhead to high 
+# blarson 2005-01-28 try reducing timeout while adding spamcop back
+# blarson 2005-10-29 adding some back now we are multi-threaded
+rbl_timeout 10
+
+include common/common_rbl
+
+include common/common_spam
+
+include common/bts_spam
+
+include common/debian_specific
+
+include common/bts_specific
+
+include common/bts_scores
diff --git a/common/blacklists b/common/blacklists
new file mode 100644 (file)
index 0000000..44b0cb7
--- /dev/null
@@ -0,0 +1,76 @@
+# cjwatson, 2002/03/07
+blacklist_from cyberbet@shaw.ca
+
+# cjwatson, 2002/03/18
+blacklist_from bounce@alliancecreditgroup.com
+
+# cjwatson, 2003/05/19
+blacklist_from k.graves@oracle.com
+
+# cjwatson, 2003/06/03
+blacklist_from *@163.com
+
+# cjwatson, 2003/09/24
+blacklist_from ggandara@uocra.org
+
+# cjwatson, 2003/09/28
+blacklist_from AVAdmin@xnet.ro
+
+# cjwatson, 2003/09/29
+blacklist_from DrWEB-DAEMON@ntci.nnov.ru
+
+# cjwatson, 2003/09/29
+blacklist_from dnicotra@saomail.com.ar
+
+# cjwatson, 2003/09/30
+blacklist_from euro@laregion.net
+
+# cjwatson, 2003/10/01
+blacklist_from RAV@home.becks.com.br
+
+# cjwatson, 2003/10/02
+blacklist_from ravms@ss1.kyrnet.kg
+
+# cjwatson, 2003/10/11
+blacklist_from virus-alert@wakwak.com
+
+# cjwatson, 2003/10/13
+blacklist_from ravms@*.stonline.sk
+
+# cjwatson, 2003/10/13
+blacklist_from root@ns5.glide.net.in
+
+# cjwatson, 2003/10/17
+blacklist_from VirusScanner@connexus.net.au
+
+# cjwatson, 2003/10/20
+blacklist_from antivir@Wheel.TSR.Ru
+
+# cjwatson, 2003/10/21
+blacklist_from DrWEB-DAEMON@example.com
+
+# cjwatson, 2003/10/21
+blacklist_from tech@shanghai.fr
+
+# cjwatson, 2003/10/28
+blacklist_from comercial@dafne.pt
+
+# cjwatson, 2003/11/03
+blacklist_from antivirus@comintern.ru
+
+# cjwatson, 2003-11-13
+blacklist_from masterroutine@america.com
+
+# cjwatson, 2003/11/15
+blacklist_from vaong@streetfan.com
+
+# cjwatson, 2004-02-20
+# Subject: Você tem Estilo de Vida?, e.g. #225634
+blacklist_from *@onda.com.br
+
+# cjwatson, 2004-03-08: junk flood to debian-boot
+blacklist_from bornagain@gibnynex.gi
+
+# cjwatson, 2004-03-09: virus alert flood
+blacklist_from support@vds.it
+
diff --git a/common/bts_scores b/common/bts_scores
new file mode 100644 (file)
index 0000000..5808578
--- /dev/null
@@ -0,0 +1,232 @@
+# relays.osirusoft.com is gone --joy, 2003-08-27
+score RCVD_IN_OSIRUSOFT_COM 0
+
+
+# Rules against generally dubious things that aren't supposed to be
+# valid mails to the BTS
+
+# joy, 2003-04-08
+# bug in old spamassassins
+score HTML_WEB_BUGS            4
+
+# cjwatson, 2002/04/03
+# joy, 2003-04-12, 2003-04-19
+# cjwatson upgraded to 2.53, 2003/04/23
+# several of the following were suggested by Santiago Vila
+
+# adding 3 points to defaults as of 2.53
+score MICROSOFT_EXECUTABLE     3.100
+score MIME_HTML_ONLY           3.100
+score PENIS_ENLARGE            5.342 5.174 5.342 5.469
+score PENIS_ENLARGE2           5.290 5.799 3.909 5.126
+score HTML_MESSAGE             1.667 1.600 1.666 1.5
+
+# adding 2 points to defaults as of 2.53
+score THE_BEST_RATE            6.300 6.141 5.954 6.284
+# cjwatson: this produces too many false positives
+#score SUSPICIOUS_RECIPS       4.052 3.953 3.972 5.407
+score URGENT_BIZ               3.397 3.153 3.799 3.696
+score BASE64_ENC_TEXT          4.685 3.735 3.857 3.738
+score FROM_HAS_MIXED_NUMS2     3.101 3.699 3.101 4.178
+score HTTP_EXCESSIVE_ESCAPES   3.101 3.500 3.259 4.060
+score TO_MALFORMED             3.146 3.085 3.697 3.803
+score MIME_HTML_NO_CHARSET     2.742 2.738 2.141 2
+score BAD_CREDIT               2.787 2.716 2.535 2.491
+score MISSING_MIMEOLE          2.500 2.500 2.437 2.100
+score GREAT_OFFER              2
+score CLICK_BELOW_CAPS         2.500 2.500 2.100 2.500
+score CLICK_BELOW              2.227 2.100 2.100 2
+
+# adding 1 point to defaults as of 2.53
+score X_PRIORITY_HIGH          2.919 2.989 1.815 2.873
+score MANY_EXCLAMATIONS                2.097 1.782 2.216 2.094
+score NORMAL_HTTP_TO_IP                1.942 1.531 1.524 1.926
+score X_MSMAIL_PRIORITY_HIGH   1.404 1 1 1.021
+score FROM_HAS_MIXED_NUMS      1 1 1.339 1
+# HTML_COMMENT_UNIQUE_ID gone in 2.53?
+score HTML_FONT_BIG            1.294 1.136 1.262 1.293
+score HTML_FONT_COLOR_RED      1.100
+score HTML_FONT_COLOR_BLUE     1.100
+score HTML_FONT_COLOR_GRAY     1.100
+score HTML_FONT_COLOR_UNSAFE   1.100
+score SUB_FREE_OFFER           1.339 1.488 1.224 1.383
+score OFFER                    1.100
+# FREE_MONEY gone in 2.53?
+score DIET                     1 1 1.042 1
+score UPPERCASE_75_100         1
+score UPPERCASE_50_75          1.840 1 1.334 1.478
+score UPPERCASE_25_50          2.555 2.132 1.860 1.584
+score HTML_FONT_COLOR_NOHASH   1
+score REMOVE_PAGE              1.318 1.100 1.365 1.303
+score MAILTO_WITH_SUBJ         1.409 1.115 1 1.573
+score HTML_TABLE_THICK_BORDER  2.101 2.101 2.101 1.500
+score MIME_BOUND_NEXTPART      1.427 1.361 1.376 1.307
+score DEAR_SOMETHING           3.596 3.596 2.806 2.803
+score HTML_IMAGE_ONLY_06       2.228 2.072 2.433 1.610
+score SUBJ_REMOVE              2.101 1.500 2.263 1.500
+score EARN_MONEY               1.967 2.228 1.960 1.744
+# /you (?:do not|no longer) wish to receive/i
+score EXCUSE_14                        1.046 1.100 1 1.016
+score HTML_TITLE_UNTITLED      1.386 1.423 1.501 1.0
+score FOR_FREE                 1.625 1.545 1.592 1.455
+score REMOVE_SUBJ              2.639 1.813 2.193 1.440
+score DEAR_FREIND              2.5
+# these get +1 just on the merit of being fsckin' HTML in email
+score HTML_10_20               0.996 1.030 1.303 1.036
+score HTML_20_30               1.287 1.104 1.293 1.571
+score HTML_30_40               1.708 1.834 1.344 1.658
+score HTML_40_50               2.058 1.747 1.814 1.428
+score HTML_50_60               1.551 1.212 1.532 1.100
+score HTML_60_70               1.518 1.121 1.100 1.100
+score HTML_70_80               1.682 1.379 1.310 1.254
+score HTML_80_90               1.406 1.483 1.163 1.166
+score HTML_90_100              1.500 1 1 1
+
+# and these get 1 point for being pr0n
+score PORN_16                  3.896 3.896 3.166 3.799
+score PORN_4                   3.371 3.599 2.457 3.135
+score PORN_6                   2.560 3.613 3.900 2.764
+score PORN_15                  3.900 3.900 2.666 3.900
+score AMATEUR_PORN             2.110 3.748 2.654 1.142
+
+# adding 0.5 points to defaults as of 2.53
+score FROM_ENDS_IN_NUMS                1.111 1.219 1.080 1.175
+score NO_REAL_NAME             1.6
+
+# many spams have In-Reply-To as well,
+# the 2.44 default of -0.847 is too much
+# the 2.53 default of -3.300 -3.301 -0.600 -3.201 is even worse
+score IN_REP_TO                        0
+
+# same as In-Reply-To, References gets abused as well
+# the 2.53 default is -6.600 -6.600 -6.500 -6.500
+score REFERENCES -0.600 -0.600 -0.500 -0.500
+
+# normal mails which have debbugs-derived Subject fields have space,
+# the 2.44 default of 2.639 is too much
+# the 2.53 default is 2.425 2.026 1.101 2.329
+score SUBJ_HAS_SPACES          1.5
+
+# spams sometimes have attributions too,
+# the 2.53 default of -6.600 -6.500 -6.500 -6.500 is too much
+score EMAIL_ATTRIBUTION                -2.600 -2.500 -2.500 -2.500
+
+# mass spams often seem to come from Exchange
+# the 2.53 default of -5.801 -5.701 -5.701 -5.701 is just bonkers
+score MSGID_GOOD_EXCHANGE      0.5
+
+# stupidly too negative by default in 2.53, normalizing most to -1.
+score USER_AGENT_MOZILLA_UA    -1
+score USER_AGENT_APPLEMAIL     -1
+score USER_AGENT_ENTOURAGE     -1
+score USER_AGENT_GNUS_XM       -1
+score USER_AGENT_IMP           -1
+score USER_AGENT_MACOE         -1
+score USER_AGENT_MOZILLA_XM    -1
+score USER_AGENT_PINE          -2
+score USER_AGENT_VM            -1
+score USER_AGENT_FORTE         -1
+score USER_AGENT_GNUS_UA       -2
+score USER_AGENT_KMAIL         -1
+score USER_AGENT_MOZILLA_UA    -1
+score USER_AGENT_MSN           -1
+score USER_AGENT_MUTT          -2
+score USER_AGENT_TONLINE       -1
+score USER_AGENT_XIMIAN                -1
+
+# pointless
+score X_MAILING_LIST           0
+
+# trust Razor2 more, --joy 2003-07-20
+# blarson 2006-10-29 rescore again
+score RAZOR2_CHECK             1.5
+score RAZOR2_CF_RANGE_01_10    0.5
+score RAZOR2_CF_RANGE_11_20    1
+score RAZOR2_CF_RANGE_21_30    1.5
+score RAZOR2_CF_RANGE_31_40    2
+score RAZOR2_CF_RANGE_41_50    2.5
+score RAZOR2_CF_RANGE_51_60    3
+score RAZOR2_CF_RANGE_61_70    3.5
+score RAZOR2_CF_RANGE_71_80    4
+score RAZOR2_CF_RANGE_81_90    4.5
+score RAZOR2_CF_RANGE_91_100   5
+# blarson 2006-02-09
+score RAZOR2_CF_RANGE_51_100   3
+
+# causes too many false positives since default 4.3 > required 4.0
+# blarson, 2004-04-11
+score SORTED_RECIPS            1
+score SUSPICIOUS_RECIPS                0.5
+# blarson 2005-11-01
+score USERPASS                 1
+
+# blarson 2006-10-26
+score MISSING_OUTLOOK_NAME     1
+
+# blarson 2006-11-13 drop score, many non-spams hit
+score FORGED_YAHOO_RCVD                1
+
+# blarson 2006-12-12
+score ORDER_NOW                        2
+
+# blarson 2004-03-20
+# Disable most DNSBLs -- overhead to high 
+# blarson 2005-01-28 try reducing timeout while adding spamcop back
+# blarson 2005-10-29 adding some back now we are multi-threaded
+score RCVD_IN_BL_SPAMCOP_NET 1
+score RCVD_IN_BSP_OTHER 0 
+score RCVD_IN_BSP_TRUSTED 0 
+score RCVD_IN_DSBL 2
+score RCVD_IN_DYNABLOCK 0
+score RCVD_IN_NJABL 0
+score RCVD_IN_NJABL_CGI 0
+score RCVD_IN_NJABL_DIALUP 0
+score RCVD_IN_NJABL_MULTI 0
+score RCVD_IN_NJABL_PROXY 0
+score RCVD_IN_NJABL_RELAY 0
+score RCVD_IN_NJABL_SPAM 0
+# OPM is below
+score RCVD_IN_OPM 0
+score RCVD_IN_OPM_HTTP 0
+score RCVD_IN_OPM_HTTP_POST 0
+score RCVD_IN_OPM_ROUTER 0
+score RCVD_IN_OPM_SOCKS 0
+score RCVD_IN_OPM_WINGATE 0
+score RCVD_IN_RFCI 0.5
+# SBL done below
+score RCVD_IN_SBL 0
+# blarson 2006-01-06 SORBS up to 1
+score RCVD_IN_SORBS 1
+score RCVD_IN_SORBS_BLOCK 0.1
+score RCVD_IN_SORBS_HTTP 0.1
+score RCVD_IN_SORBS_MISC 0.1
+score RCVD_IN_SORBS_SMTP 0.1
+score RCVD_IN_SORBS_SOCKS 0.1
+score RCVD_IN_SORBS_WEB 0.1
+score RCVD_IN_SORBS_ZOMBIE 0.1
+
+# blarson 2004-11-16
+# other network checks -- also disable
+# blarson 2005-10-29 enable again
+score DNS_FROM_RFCI_DSN 0.5
+score MSGID_FROM_MTA_BACKUP 0.1
+score NO_DNS_FOR_FROM 1
+score ROUND_THE_WORLD 0
+
+# blarson 2004-10-22
+# spammers use habeas
+score HABEAS_SWE 0.5
+
+# blarson, 2004-04-14
+score BIZ_TLD  2.5
+
+# blarson 2004-04-25
+score REMOVE_PAGE 2.5
+
+# blarson 2004-11-08
+# claiming to be amazon...
+score USER_IN_DEF_WHITELIST 0.5
+
+# blarson 2004-11-08
+score BANG_GUARENTEE 2
+
diff --git a/common/bts_specific b/common/bts_specific
new file mode 100644 (file)
index 0000000..87e4199
--- /dev/null
@@ -0,0 +1,82 @@
+# BTS Specific rules
+# Rules to credit some properties of valid BTS mail
+
+rawbody HAS_PACKAGE            /^Package:/im
+describe HAS_PACKAGE           Has a Package: line, probably a valid report
+tflags HAS_PACKAGE             nice
+score HAS_PACKAGE              -6.0
+
+header X_DEBBUGS_CC            exists:X-Debbugs-Cc
+describe X_DEBBUGS_CC          Has an X-Debbugs-Cc: header
+tflags X_DEBBUGS_CC            nice
+score X_DEBBUGS_CC             -3.0
+
+header X_DEBBUGS_NO_ACK                exists:X-Debbugs-No-Ack
+describe X_DEBBUGS_NO_ACK      Has an X-Debbugs-No-Ack: header
+tflags X_DEBBUGS_NO_ACK                nice
+score X_DEBBUGS_NO_ACK         -3.0
+
+# SA doesn't like literal # symbols in rules
+# blarson 2006-10-27 Allow space
+header HAS_BUG_NUMBER          Subject =~ /Bug\s*\x23\d+:/i
+describe HAS_BUG_NUMBER                Has a debbugs-style Bug# in the subject line
+tflags HAS_BUG_NUMBER          nice
+score HAS_BUG_NUMBER           -3.0
+
+# blarson 2007-07-05
+rawbody VALID_BTS_CONTROL      /^(reassign\s+\d{3,6}\s+[a-z\d-]+\s*|(reopen|submitter|owner)\s+\d{3,6}\s|forward\s+\d{3,6}\s+|(notforwarded|unmerge|noowner)\s+\d{3,6}\s*$|retitle\s+\d{3,6}\s+.{10,80}$|severity\s+\d{3,6}\s+(critical|grave|serious|important|normal|minor|wishlist)|clone\s+\d{3,6}\s+-\d$|merge(\s+\d{3,6}){2,4}\s*$|tags?\s+\d{3,6}\s+([\-\+\=]?\s*[a-z]+\s*)*|(not)?found\s+.+$)/i
+describe VALID_BTS_CONTROL     Seems to be valid BTS control command
+tflags VALID_BTS_CONTROL       nice
+score VALID_BTS_CONTROL                -2
+
+# blarson 2004-04-10 20050316 add index packages
+rawbody INDEXMAINT             /^index(?:-|\s+)(?:maint\s+\S+\@|packages)/
+describe INDEXMAINT            index-maint command
+tflags INDEXMAINT              nice
+score  INDEXMAINT              -5
+
+# blarson 2006-05-11 2006-09-09 change score
+header SUBSCRIBEBUG    To =~ /\b\d{3,7}\-(?:(?:un)?subscribe|subhelp|ignore|(?:sub(?:yes|approve|reject)|unsubyes|bounce|probe|approve|reject|setlistyes|setlistsilentyes).*)\@bugs\.debian\.org\b/
+describe SUBSCRIBEBUG  subscribing to bug
+tflags SUBSCRIBEBUG    nice
+score SUBSCRIBEBUG     -1
+
+# blarson 2007-04-26
+header SUBSCRIBE2      received =~ /\b for \d{3,7}\-(?:(?:un)?subscribe|subhelp|ignore|(?:sub(?:yes|approve|reject)|unsubyes|bounce|probe|approve|reject|setlistyes|setlistsilentyes).*)\@bugs\.debian\.org\b/
+describe SUBSCRIBE2    subscribing to bug
+tflags SUBSCRIBE2      nice
+score SUBSCRIBE2       -6
+
+header FROMDEVELOPER   From =~ /\@debian.org/i
+describe FROMDEVELOPER Appears to be a message from a developer
+tflags FROMDEVELOPER   nice
+score  FROMDEVELOPER   -2
+
+
+# joy, 2003-07-20, 2003-11-09
+# this is pretty generic
+header BUGNUMBERGREETING       Subject =~ /^(hi|hey)?\s*\d{4}\d*(-\S+)?(\!|,)/i
+describe BUGNUMBERGREETING     greeting or addressing the bug number
+score BUGNUMBERGREETING                3
+
+# joy, 2003-11-09, 2003-12-28
+# note that Subject: Bug#12345 ... and Subject: Re: Bug#12345 ... won't match
+header SPAMBUGNUMSUBJ  Subject =~ /^\d\d\d\d/i
+describe SPAMBUGNUMSUBJ        greeting or addressing the bug number, simple test
+score SPAMBUGNUMSUBJ   1
+
+# joy, 2003-12-29
+header SPAMBUGADDRSUBJ Subject =~ /^\d{4,}(-[^@]+)?\@bugs/i
+describe SPAMBUGADDRSUBJ       greeting or addressing the bug address
+score SPAMBUGADDRSUBJ  2.5
+
+# blarson 2007-07-06
+header MAJORDOMO       subject =~ /\bMajordomo results\: Bug\b/
+describe MAJORDOMO     MAJORDOMO infinite loop
+score MAJORDOMO                4
+
+# blarson 2007-07-19
+header INFOLOOP                subject =~ /Re: Bug\#\d+\: Info received \(Bug\#\d+: Info received/
+describe INFOLOOP      Loopy autoresponder
+score INFOLOOP         7
+
diff --git a/common/charset_tests b/common/charset_tests
new file mode 100644 (file)
index 0000000..2bee3d5
--- /dev/null
@@ -0,0 +1,1891 @@
+# SpamAssassin rules file: Chinese subject and body tests
+#
+# Maintainer: Quang-Anh Tran, <qa@ccert.edu.cn>,
+#             at CERNET Computer Emergency Response Team (CCERT)
+#
+# Please don't modify this file as your changes will be overwritten with
+# the next update. Use @@LOCAL_RULES_DIR@@/local.cf instead.
+# See 'perldoc Mail::SpamAssassin::Conf' for details.
+#
+# <@LICENSE>
+# Copyright 2004-2005 CERNET Computer Emergency Response Team (CCERT)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# </@LICENSE>
+#
+##############################################################################
+#
+# Chinese_rules.cf, updated 2005 Apr 24
+#
+# Test against 77159 spam and 147735 ham
+# (using only the Chinese_rules.cf)
+#
+#      Threshold       Spam recall     Ham error
+#      0.5     90.8%   2.6%
+#      1.0     87.4%   0.9%
+#      1.5     83.3%   0.4%
+#      2.0     79.1%   0.2%
+#      2.5     74.5%   0.1%
+#      3.0     70.5%   0.0%
+#      3.5     66.0%   0.0%
+#      4.0     61.5%   0.0%
+#      4.5     56.8%   0.0%
+#
+# It takes 0.02 seconds to scan an email with size 2580.65 bytes (P4-2.8G CPU)
+
+# More info on CCERT website : http://www.ccert.edu.cn/spam/sa/Chinese_rules.htm
+# ******************************************************************************
+
+header CN_SUBJECT_1    Subject =~ /ÓÅ»Ý/
+describe CN_SUBJECT_1  Subject contains "ÓÅ»Ý"
+score CN_SUBJECT_1     1.547
+
+header CN_SUBJECT_4    Subject =~ /Ʊ£¡/
+describe CN_SUBJECT_4  Subject contains "Ʊ£¡"
+score CN_SUBJECT_4     1.650
+
+header CN_SUBJECT_5    Subject =~ /·¢Æ±/
+describe CN_SUBJECT_5  Subject contains "·¢Æ±"
+score CN_SUBJECT_5     0.357
+
+header CN_SUBJECT_8    Subject =~ /ÒµÎñ/
+describe CN_SUBJECT_8  Subject contains "ÒµÎñ"
+score CN_SUBJECT_8     0.914
+
+header CN_SUBJECT_9    Subject =~ /´ú¿ª/
+describe CN_SUBJECT_9  Subject contains "´ú¿ª"
+score CN_SUBJECT_9     2.700
+
+header CN_SUBJECT_12   Subject =~ /ºÏ×÷/
+describe CN_SUBJECT_12 Subject contains "ºÏ×÷"
+score CN_SUBJECT_12    1.413
+
+header CN_SUBJECT_15   Subject =~ /¹«Ë¾/
+describe CN_SUBJECT_15 Subject contains "¹«Ë¾"
+score CN_SUBJECT_15    0.177
+
+header CN_SUBJECT_17   Subject =~ /¸÷Àà/
+describe CN_SUBJECT_17 Subject contains "¸÷Àà"
+score CN_SUBJECT_17    0.568
+
+header CN_SUBJECT_20   Subject =~ /ÆóÒµ/
+describe CN_SUBJECT_20 Subject contains "ÆóÒµ"
+score CN_SUBJECT_20    0.773
+
+header CN_SUBJECT_32   Subject =~ /ÔËÊä/
+describe CN_SUBJECT_32 Subject contains "ÔËÊä"
+score CN_SUBJECT_32    0.043
+
+header CN_SUBJECT_34   Subject =~ /Åàѵ/
+describe CN_SUBJECT_34 Subject contains "Åàѵ"
+score CN_SUBJECT_34    1.098
+
+header CN_SUBJECT_35   Subject =~ /ÏúÊÛ/
+describe CN_SUBJECT_35 Subject contains "ÏúÊÛ"
+score CN_SUBJECT_35    1.078
+
+header CN_SUBJECT_41   Subject =~ /²úÆ·/
+describe CN_SUBJECT_41 Subject contains "²úÆ·"
+score CN_SUBJECT_41    0.972
+
+header CN_SUBJECT_48   Subject =~ /ʵҵ/
+describe CN_SUBJECT_48 Subject contains "ʵҵ"
+score CN_SUBJECT_48    1.306
+
+header CN_SUBJECT_51   Subject =~ /ÉÌÎñ/
+describe CN_SUBJECT_51 Subject contains "ÉÌÎñ"
+score CN_SUBJECT_51    1.440
+
+header CN_SUBJECT_52   Subject =~ /ÌؼÛ/
+describe CN_SUBJECT_52 Subject contains "ÌؼÛ"
+score CN_SUBJECT_52    1.440
+
+header CN_SUBJECT_57   Subject =~ /¾­Àí/
+describe CN_SUBJECT_57 Subject contains "¾­Àí"
+score CN_SUBJECT_57    0.245
+
+header CN_SUBJECT_58   Subject =~ /¹ãÖÝ/
+describe CN_SUBJECT_58 Subject contains "¹ãÖÝ"
+score CN_SUBJECT_58    0.512
+
+header CN_SUBJECT_59   Subject =~ /²ÆÎñ/
+describe CN_SUBJECT_59 Subject contains "²ÆÎñ"
+score CN_SUBJECT_59    0.150
+
+header CN_SUBJECT_62   Subject =~ /óÒ×/
+describe CN_SUBJECT_62 Subject contains "óÒ×"
+score CN_SUBJECT_62    0.591
+
+header CN_SUBJECT_64   Subject =~ /ÑÐÐÞ/
+describe CN_SUBJECT_64 Subject contains "ÑÐÐÞ"
+score CN_SUBJECT_64    1.380
+
+header CN_SUBJECT_68   Subject =~ /ÄãºÃ/
+describe CN_SUBJECT_68 Subject contains "ÄãºÃ"
+score CN_SUBJECT_68    1.200
+
+header CN_SUBJECT_73   Subject =~ /׬Ǯ/
+describe CN_SUBJECT_73 Subject contains "׬Ǯ"
+score CN_SUBJECT_73    1.020
+
+header CN_SUBJECT_74   Subject =~ /¡°µçÄÔ/
+describe CN_SUBJECT_74 Subject contains "¡°µçÄÔ"
+score CN_SUBJECT_74    0.870
+
+header CN_SUBJECT_75   Subject =~ /×îС°/
+describe CN_SUBJECT_75 Subject contains "×îС°"
+score CN_SUBJECT_75    0.213
+
+header CN_SUBJECT_77   Subject =~ /ÓªÏú/
+describe CN_SUBJECT_77 Subject contains "ÓªÏú"
+score CN_SUBJECT_77    0.085
+
+header CN_SUBJECT_82   Subject =~ /¸÷ÖÖ/
+describe CN_SUBJECT_82 Subject contains "¸÷ÖÖ"
+score CN_SUBJECT_82    1.101
+
+header CN_SUBJECT_84   Subject =~ /ÄúµÄ/
+describe CN_SUBJECT_84 Subject contains "ÄúµÄ"
+score CN_SUBJECT_84    1.320
+
+header CN_SUBJECT_86   Subject =~ /¿Î³Ì/
+describe CN_SUBJECT_86 Subject contains "¿Î³Ì"
+score CN_SUBJECT_86    0.683
+
+header CN_SUBJECT_87   Subject =~ /¿Í»§/
+describe CN_SUBJECT_87 Subject contains "¿Í»§"
+score CN_SUBJECT_87    0.655
+
+header CN_SUBJECT_89   Subject =~ /¾Æµê/
+describe CN_SUBJECT_89 Subject contains "¾Æµê"
+score CN_SUBJECT_89    1.200
+
+header CN_SUBJECT_99   Subject =~ /ÔùËÍ/
+describe CN_SUBJECT_99 Subject contains "ÔùËÍ"
+score CN_SUBJECT_99    1.140
+
+header CN_SUBJECT_106  Subject =~ /ÐÂÄê¿ìÀÖ/
+describe CN_SUBJECT_106        Subject contains "ÐÂÄê¿ìÀÖ"
+score CN_SUBJECT_106   1.260
+
+header CN_SUBJECT_111  Subject =~ /×¢²áÏã¸Û/
+describe CN_SUBJECT_111        Subject contains "×¢²áÏã¸Û"
+score CN_SUBJECT_111   1.260
+
+header CN_SUBJECT_114  Subject =~ /Íƹã/
+describe CN_SUBJECT_114        Subject contains "Íƹã"
+score CN_SUBJECT_114   0.494
+
+header CN_SUBJECT_115  Subject =~ /´óÈ«/
+describe CN_SUBJECT_115        Subject contains "´óÈ«"
+score CN_SUBJECT_115   1.028
+
+header CN_SUBJECT_117  Subject =~ /¸¶¿î/
+describe CN_SUBJECT_117        Subject contains "¸¶¿î"
+score CN_SUBJECT_117   0.052
+
+header CN_SUBJECT_118  Subject =~ /ÓµÓÐ/
+describe CN_SUBJECT_118        Subject contains "ÓµÓÐ"
+score CN_SUBJECT_118   0.780
+
+header CN_SUBJECT_121  Subject =~ /άÐÞ/
+describe CN_SUBJECT_121        Subject contains "άÐÞ"
+score CN_SUBJECT_121   0.809
+
+header CN_SUBJECT_122  Subject =~ /Ͷ×Ê/
+describe CN_SUBJECT_122        Subject contains "Ͷ×Ê"
+score CN_SUBJECT_122   0.870
+
+header CN_SUBJECT_128  Subject =~ /ѵÁ·/
+describe CN_SUBJECT_128        Subject contains "ѵÁ·"
+score CN_SUBJECT_128   0.198
+
+header CN_SUBJECT_129  Subject =~ /ÓÃÆ·/
+describe CN_SUBJECT_129        Subject contains "ÓÃÆ·"
+score CN_SUBJECT_129   0.960
+
+header CN_SUBJECT_130  Subject =~ /ÍËÐÅ/
+describe CN_SUBJECT_130        Subject contains "ÍËÐÅ"
+score CN_SUBJECT_130   1.320
+
+header CN_SUBJECT_138  Subject =~ /»úƱ/
+describe CN_SUBJECT_138        Subject contains "»úƱ"
+score CN_SUBJECT_138   0.995
+
+header CN_SUBJECT_140  Subject =~ /·½°¸/
+describe CN_SUBJECT_140        Subject contains "·½°¸"
+score CN_SUBJECT_140   0.605
+
+header CN_SUBJECT_142  Subject =~ /¼ÓÃË/
+describe CN_SUBJECT_142        Subject contains "¼ÓÃË"
+score CN_SUBJECT_142   1.140
+
+header CN_SUBJECT_149  Subject =~ /²É¹º/
+describe CN_SUBJECT_149        Subject contains "²É¹º"
+score CN_SUBJECT_149   0.696
+
+header CN_SUBJECT_158  Subject =~ /·ÑÓÃ/
+describe CN_SUBJECT_158        Subject contains "·ÑÓÃ"
+score CN_SUBJECT_158   0.654
+
+header CN_SUBJECT_159  Subject =~ /ÈËÁ¦/
+describe CN_SUBJECT_159        Subject contains "ÈËÁ¦"
+score CN_SUBJECT_159   0.108
+
+header CN_SUBJECT_161  Subject =~ /ÀñÆ·/
+describe CN_SUBJECT_161        Subject contains "ÀñÆ·"
+score CN_SUBJECT_161   0.987
+
+header CN_SUBJECT_169  Subject =~ /ÌáÉý/
+describe CN_SUBJECT_169        Subject contains "ÌáÉý"
+score CN_SUBJECT_169   1.140
+
+header CN_SUBJECT_170  Subject =~ /µÍ¼Û/
+describe CN_SUBJECT_170        Subject contains "µÍ¼Û"
+score CN_SUBJECT_170   1.080
+
+header CN_SUBJECT_173  Subject =~ /ÔÓÖ¾/
+describe CN_SUBJECT_173        Subject contains "ÔÓÖ¾"
+score CN_SUBJECT_173   0.840
+
+header CN_SUBJECT_174  Subject =~ /×ÊÁÏ£¡/
+describe CN_SUBJECT_174        Subject contains "×ÊÁÏ£¡"
+score CN_SUBJECT_174   1.065
+
+header CN_SUBJECT_176  Subject =~ /ÄÚ²¿/
+describe CN_SUBJECT_176        Subject contains "ÄÚ²¿"
+score CN_SUBJECT_176   0.222
+
+header CN_SUBJECT_177  Subject =~ /½øÏú´æ/
+describe CN_SUBJECT_177        Subject contains "½øÏú´æ"
+score CN_SUBJECT_177   1.140
+
+header CN_SUBJECT_179  Subject =~ /¹©Ó¦/
+describe CN_SUBJECT_179        Subject contains "¹©Ó¦"
+score CN_SUBJECT_179   1.055
+
+header CN_SUBJECT_180  Subject =~ /¶ú»ú /
+describe CN_SUBJECT_180        Subject contains "¶ú»ú "
+score CN_SUBJECT_180   1.140
+
+header CN_SUBJECT_181  Subject =~ /¾«Æ·/
+describe CN_SUBJECT_181        Subject contains "¾«Æ·"
+score CN_SUBJECT_181   0.960
+
+header CN_SUBJECT_187  Subject =~ /Ͷ¸å/
+describe CN_SUBJECT_187        Subject contains "Ͷ¸å"
+score CN_SUBJECT_187   1.020
+
+header CN_SUBJECT_194  Subject =~ /É豸/
+describe CN_SUBJECT_194        Subject contains "É豸"
+score CN_SUBJECT_194   0.776
+
+header CN_SUBJECT_199  Subject =~ /³É¹¦µÄ/
+describe CN_SUBJECT_199        Subject contains "³É¹¦µÄ"
+score CN_SUBJECT_199   1.080
+
+header CN_SUBJECT_202  Subject =~ /¼æÖ°/
+describe CN_SUBJECT_202        Subject contains "¼æÖ°"
+score CN_SUBJECT_202   0.731
+
+header CN_SUBJECT_205  Subject =~ /±êÇ©/
+describe CN_SUBJECT_205        Subject contains "±êÇ©"
+score CN_SUBJECT_205   1.010
+
+header CN_SUBJECT_214  Subject =~ /É̱ê/
+describe CN_SUBJECT_214        Subject contains "É̱ê"
+score CN_SUBJECT_214   1.020
+
+header CN_SUBJECT_216  Subject =~ /¼¼ÇÉ/
+describe CN_SUBJECT_216        Subject contains "¼¼ÇÉ"
+score CN_SUBJECT_216   0.539
+
+header CN_SUBJECT_217  Subject =~ /KR-G ºÍ/
+describe CN_SUBJECT_217        Subject contains "KR-G ºÍ"
+score CN_SUBJECT_217   1.320
+
+header CN_SUBJECT_221  Subject =~ /ÁªÃË/
+describe CN_SUBJECT_221        Subject contains "ÁªÃË"
+score CN_SUBJECT_221   0.860
+
+header CN_SUBJECT_223  Subject =~ /ÎÞÏß×ÔÓÉ/
+describe CN_SUBJECT_223        Subject contains "ÎÞÏß×ÔÓÉ"
+score CN_SUBJECT_223   1.080
+
+header CN_SUBJECT_230  Subject =~ / ÎÞÏß/
+describe CN_SUBJECT_230        Subject contains " ÎÞÏß"
+score CN_SUBJECT_230   1.020
+
+header CN_SUBJECT_234  Subject =~ /¼¼ÄÜ/
+describe CN_SUBJECT_234        Subject contains "¼¼ÄÜ"
+score CN_SUBJECT_234   0.998
+
+header CN_SUBJECT_235  Subject =~ /ÉÏÃÅ/
+describe CN_SUBJECT_235        Subject contains "ÉÏÃÅ"
+score CN_SUBJECT_235   0.501
+
+header CN_SUBJECT_238  Subject =~ /ÇáËÉ/
+describe CN_SUBJECT_238        Subject contains "ÇáËÉ"
+score CN_SUBJECT_238   0.960
+
+header CN_SUBJECT_239  Subject =~ /²ß»®/
+describe CN_SUBJECT_239        Subject contains "²ß»®"
+score CN_SUBJECT_239   0.900
+
+header CN_SUBJECT_241  Subject =~ /100MÍøÒ³/
+describe CN_SUBJECT_241        Subject contains "100MÍøÒ³"
+score CN_SUBJECT_241   1.020
+
+header CN_SUBJECT_242  Subject =~ /ÍøÒ³¿Õ¼ä/
+describe CN_SUBJECT_242        Subject contains "ÍøÒ³¿Õ¼ä"
+score CN_SUBJECT_242   1.020
+
+header CN_SUBJECT_243  Subject =~ /ÕÆÎÕ/
+describe CN_SUBJECT_243        Subject contains "ÕÆÎÕ"
+score CN_SUBJECT_243   0.939
+
+header CN_SUBJECT_244  Subject =~ /»áÔ±/
+describe CN_SUBJECT_244        Subject contains "»áÔ±"
+score CN_SUBJECT_244   0.720
+
+header CN_SUBJECT_247  Subject =~ /À¶ÑÀ/
+describe CN_SUBJECT_247        Subject contains "À¶ÑÀ"
+score CN_SUBJECT_247   1.320
+
+header CN_SUBJECT_248  Subject =~ /ËÍÀñ/
+describe CN_SUBJECT_248        Subject contains "ËÍÀñ"
+score CN_SUBJECT_248   0.877
+
+header CN_SUBJECT_249  Subject =~ /Ãؾ÷/
+describe CN_SUBJECT_249        Subject contains "Ãؾ÷"
+score CN_SUBJECT_249   0.960
+
+header CN_SUBJECT_251  Subject =~ /ÈÃÄãµÄ/
+describe CN_SUBJECT_251        Subject contains "ÈÃÄãµÄ"
+score CN_SUBJECT_251   1.020
+
+header CN_SUBJECT_252  Subject =~ /¡¢¹ã¸æ/
+describe CN_SUBJECT_252        Subject contains "¡¢¹ã¸æ"
+score CN_SUBJECT_252   0.576
+
+header CN_SUBJECT_256  Subject =~ /ÍùÍù/
+describe CN_SUBJECT_256        Subject contains "ÍùÍù"
+score CN_SUBJECT_256   0.366
+
+header CN_SUBJECT_258  Subject =~ /ʪ¶È/
+describe CN_SUBJECT_258        Subject contains "ʪ¶È"
+score CN_SUBJECT_258   0.960
+
+header CN_SUBJECT_259  Subject =~ /˰Ʊ/
+describe CN_SUBJECT_259        Subject contains "˰Ʊ"
+score CN_SUBJECT_259   0.673
+
+header CN_SUBJECT_260  Subject =~ /É̳Ç/
+describe CN_SUBJECT_260        Subject contains "É̳Ç"
+score CN_SUBJECT_260   0.871
+
+header CN_SUBJECT_261  Subject =~ /£ºÒ»Äê/
+describe CN_SUBJECT_261        Subject contains "£ºÒ»Äê"
+score CN_SUBJECT_261   0.482
+
+header CN_SUBJECT_264  Subject =~ /ÑéÖ¤ºó/
+describe CN_SUBJECT_264        Subject contains "ÑéÖ¤ºó"
+score CN_SUBJECT_264   0.862
+
+header CN_SUBJECT_267  Subject =~ /дº/
+describe CN_SUBJECT_267        Subject contains "дº"
+score CN_SUBJECT_267   0.960
+
+header CN_SUBJECT_268  Subject =~ /±¨¹Ø/
+describe CN_SUBJECT_268        Subject contains "±¨¹Ø"
+score CN_SUBJECT_268   0.658
+
+header CN_SUBJECT_282  Subject =~ /¡¢·þÎñ/
+describe CN_SUBJECT_282        Subject contains "¡¢·þÎñ"
+score CN_SUBJECT_282   0.729
+
+header CN_SUBJECT_283  Subject =~ /¹ÉƱ/
+describe CN_SUBJECT_283        Subject contains "¹ÉƱ"
+score CN_SUBJECT_283   0.535
+
+header CN_SUBJECT_284  Subject =~ /´ÙÏú/
+describe CN_SUBJECT_284        Subject contains "´ÙÏú"
+score CN_SUBJECT_284   0.720
+
+header CN_SUBJECT_285  Subject =~ /³öÊÛ/
+describe CN_SUBJECT_285        Subject contains "³öÊÛ"
+score CN_SUBJECT_285   0.812
+
+header CN_SUBJECT_288  Subject =~ /ºÍÉú»î/
+describe CN_SUBJECT_288        Subject contains "ºÍÉú»î"
+score CN_SUBJECT_288   0.842
+
+header CN_SUBJECT_289  Subject =~ /Åú·¢/
+describe CN_SUBJECT_289        Subject contains "Åú·¢"
+score CN_SUBJECT_289   1.080
+
+header CN_SUBJECT_291  Subject =~ /¹ã½»»á/
+describe CN_SUBJECT_291        Subject contains "¹ã½»»á"
+score CN_SUBJECT_291   0.900
+
+header CN_SUBJECT_294  Subject =~ /³ÏÕ÷/
+describe CN_SUBJECT_294        Subject contains "³ÏÕ÷"
+score CN_SUBJECT_294   1.058
+
+header CN_SUBJECT_298  Subject =~ /Ô´´úÂë/
+describe CN_SUBJECT_298        Subject contains "Ô´´úÂë"
+score CN_SUBJECT_298   0.780
+
+header CN_SUBJECT_301  Subject =~ /ÄãµÄÊÂÒµ/
+describe CN_SUBJECT_301        Subject contains "ÄãµÄÊÂÒµ"
+score CN_SUBJECT_301   0.498
+
+header CN_SUBJECT_302  Subject =~ /´úÀíÉÌ/
+describe CN_SUBJECT_302        Subject contains "´úÀíÉÌ"
+score CN_SUBJECT_302   0.767
+
+header CN_SUBJECT_303  Subject =~ /ÊÂÒµºÍ/
+describe CN_SUBJECT_303        Subject contains "ÊÂÒµºÍ"
+score CN_SUBJECT_303   0.498
+
+header CN_SUBJECT_307  Subject =~ /¸ü¼Ó/
+describe CN_SUBJECT_307        Subject contains "¸ü¼Ó"
+score CN_SUBJECT_307   0.097
+
+header CN_SUBJECT_311  Subject =~ /´óÖÚ/
+describe CN_SUBJECT_311        Subject contains "´óÖÚ"
+score CN_SUBJECT_311   0.780
+
+header CN_SUBJECT_312  Subject =~ /½¨Íø/
+describe CN_SUBJECT_312        Subject contains "½¨Íø"
+score CN_SUBJECT_312   0.840
+
+header CN_SUBJECT_315  Subject =~ /Ò£¿Ø/
+describe CN_SUBJECT_315        Subject contains "Ò£¿Ø"
+score CN_SUBJECT_315   0.706
+
+header CN_SUBJECT_316  Subject =~ /»Ø±¨/
+describe CN_SUBJECT_316        Subject contains "»Ø±¨"
+score CN_SUBJECT_316   0.780
+
+header CN_SUBJECT_322  Subject =~ /Õ÷¸å/
+describe CN_SUBJECT_322        Subject contains "Õ÷¸å"
+score CN_SUBJECT_322   0.677
+
+header CN_SUBJECT_323  Subject =~ /-±±¾©/
+describe CN_SUBJECT_323        Subject contains "-±±¾©"
+score CN_SUBJECT_323   0.807
+
+header CN_SUBJECT_328  Subject =~ /·þÎñµÈ/
+describe CN_SUBJECT_328        Subject contains "·þÎñµÈ"
+score CN_SUBJECT_328   0.574
+
+header CN_SUBJECT_330  Subject =~ /¹ã¸æ¡¢/
+describe CN_SUBJECT_330        Subject contains "¹ã¸æ¡¢"
+score CN_SUBJECT_330   0.487
+
+header CN_SUBJECT_336  Subject =~ /ʱÉÐ/
+describe CN_SUBJECT_336        Subject contains "ʱÉÐ"
+score CN_SUBJECT_336   0.720
+
+header CN_SUBJECT_338  Subject =~ /³ö¿Ú/
+describe CN_SUBJECT_338        Subject contains "³ö¿Ú"
+score CN_SUBJECT_338   0.538
+
+header CN_SUBJECT_339  Subject =~ /¹©Çó/
+describe CN_SUBJECT_339        Subject contains "¹©Çó"
+score CN_SUBJECT_339   0.780
+
+header CN_SUBJECT_345  Subject =~ /ÍøÕ¾½¨Éè/
+describe CN_SUBJECT_345        Subject contains "ÍøÕ¾½¨Éè"
+score CN_SUBJECT_345   0.780
+
+header CN_SUBJECT_346  Subject =~ /Ô¤¶©/
+describe CN_SUBJECT_346        Subject contains "Ô¤¶©"
+score CN_SUBJECT_346   0.720
+
+header CN_SUBJECT_347  Subject =~ /Ô¤Ëã¹ÜÀí/
+describe CN_SUBJECT_347        Subject contains "Ô¤Ëã¹ÜÀí"
+score CN_SUBJECT_347   0.464
+
+header CN_SUBJECT_348  Subject =~ /È«ÃæÔ¤Ëã/
+describe CN_SUBJECT_348        Subject contains "È«ÃæÔ¤Ëã"
+score CN_SUBJECT_348   0.464
+
+header CN_SUBJECT_354  Subject =~ /Íâó/
+describe CN_SUBJECT_354        Subject contains "Íâó"
+score CN_SUBJECT_354   0.780
+
+header CN_SUBJECT_363  Subject =~ /ΪÄú/
+describe CN_SUBJECT_363        Subject contains "ΪÄú"
+score CN_SUBJECT_363   1.320
+
+header CN_SUBJECT_367  Subject =~ /°à£¨/
+describe CN_SUBJECT_367        Subject contains "°à£¨"
+score CN_SUBJECT_367   0.539
+
+header CN_SUBJECT_372  Subject =~ /ר¿¯/
+describe CN_SUBJECT_372        Subject contains "ר¿¯"
+score CN_SUBJECT_372   0.780
+
+header CN_SUBJECT_374  Subject =~ /¹ÜÀíôß/
+describe CN_SUBJECT_374        Subject contains "¹ÜÀíôß"
+score CN_SUBJECT_374   0.381
+
+header CN_SUBJECT_375  Subject =~ /³ÏÐÅ/
+describe CN_SUBJECT_375        Subject contains "³ÏÐÅ"
+score CN_SUBJECT_375   0.645
+
+header CN_SUBJECT_379  Subject =~ /°ìÀí¿í´ø/
+describe CN_SUBJECT_379        Subject contains "°ìÀí¿í´ø"
+score CN_SUBJECT_379   0.780
+
+header CN_SUBJECT_385  Subject =~ /¶À¼Ò/
+describe CN_SUBJECT_385        Subject contains "¶À¼Ò"
+score CN_SUBJECT_385   0.720
+
+header CN_SUBJECT_389  Subject =~ /¹ÜÀíÈí¼þ/
+describe CN_SUBJECT_389        Subject contains "¹ÜÀíÈí¼þ"
+score CN_SUBJECT_389   0.780
+
+header CN_SUBJECT_392  Subject =~ /12ÔÂ11È/
+describe CN_SUBJECT_392        Subject contains "12ÔÂ11È"
+score CN_SUBJECT_392   0.445
+
+header CN_SUBJECT_393  Subject =~ /ºÃÀûͨ/
+describe CN_SUBJECT_393        Subject contains "ºÃÀûͨ"
+score CN_SUBJECT_393   0.659
+
+header CN_SUBJECT_394  Subject =~ /ÉÌÒµÓ¢Óï/
+describe CN_SUBJECT_394        Subject contains "ÉÌÒµÓ¢Óï"
+score CN_SUBJECT_394   0.720
+
+header CN_SUBJECT_396  Subject =~ /Ê×·Ý/
+describe CN_SUBJECT_396        Subject contains "Ê×·Ý"
+score CN_SUBJECT_396   0.720
+
+header CN_SUBJECT_398  Subject =~ /¶©ÔÄ/
+describe CN_SUBJECT_398        Subject contains "¶©ÔÄ"
+score CN_SUBJECT_398   0.641
+
+header CN_SUBJECT_399  Subject =~ /Ãû¼/
+describe CN_SUBJECT_399        Subject contains "Ãû¼"
+score CN_SUBJECT_399   0.780
+
+header CN_SUBJECT_404  Subject =~ /»ï°é/
+describe CN_SUBJECT_404        Subject contains "»ï°é"
+score CN_SUBJECT_404   0.551
+
+header CN_SUBJECT_406  Subject =~ /äìÈ÷/
+describe CN_SUBJECT_406        Subject contains "äìÈ÷"
+score CN_SUBJECT_406   0.009
+
+header CN_SUBJECT_414  Subject =~ /¹ÜÀíϵͳ/
+describe CN_SUBJECT_414        Subject contains "¹ÜÀíϵͳ"
+score CN_SUBJECT_414   0.720
+
+header CN_SUBJECT_416  Subject =~ /Éú»îÕæ/
+describe CN_SUBJECT_416        Subject contains "Éú»îÕæ"
+score CN_SUBJECT_416   0.001
+
+header CN_SUBJECT_417  Subject =~ /ÕæÐèÒª/
+describe CN_SUBJECT_417        Subject contains "ÕæÐèÒª"
+score CN_SUBJECT_417   0.566
+
+header CN_SUBJECT_420  Subject =~ /»õÔË/
+describe CN_SUBJECT_420        Subject contains "»õÔË"
+score CN_SUBJECT_420   0.720
+
+header CN_SUBJECT_422  Subject =~ /ÖúÄú/
+describe CN_SUBJECT_422        Subject contains "ÖúÄú"
+score CN_SUBJECT_422   0.840
+
+header CN_SUBJECT_423  Subject =~ /²éÊÕ/
+describe CN_SUBJECT_423        Subject contains "²éÊÕ"
+score CN_SUBJECT_423   0.600
+
+header CN_SUBJECT_425  Subject =~ /º£ÔË/
+describe CN_SUBJECT_425        Subject contains "º£ÔË"
+score CN_SUBJECT_425   0.780
+
+header CN_SUBJECT_429  Subject =~ /ÊÕÒæ/
+describe CN_SUBJECT_429        Subject contains "ÊÕÒæ"
+score CN_SUBJECT_429   0.720
+
+header CN_SUBJECT_436  Subject =~ /½ÚÊ¡/
+describe CN_SUBJECT_436        Subject contains "½ÚÊ¡"
+score CN_SUBJECT_436   0.660
+
+header CN_SUBJECT_437  Subject =~ /2005Öйú/
+describe CN_SUBJECT_437        Subject contains "2005Öйú"
+score CN_SUBJECT_437   0.600
+
+header CN_SUBJECT_441  Subject =~ /¿ìÀÖ£¬/
+describe CN_SUBJECT_441        Subject contains "¿ìÀÖ£¬"
+score CN_SUBJECT_441   0.540
+
+header CN_SUBJECT_448  Subject =~ /ɳÅÌ/
+describe CN_SUBJECT_448        Subject contains "ɳÅÌ"
+score CN_SUBJECT_448   0.660
+
+header CN_SUBJECT_450  Subject =~ /»¥Àû/
+describe CN_SUBJECT_450        Subject contains "»¥Àû"
+score CN_SUBJECT_450   0.660
+
+header CN_SUBJECT_457  Subject =~ /Ìåϵ/
+describe CN_SUBJECT_457        Subject contains "Ìåϵ"
+score CN_SUBJECT_457   0.004
+
+header CN_SUBJECT_464  Subject =~ /ÍøÕ¾!/
+describe CN_SUBJECT_464        Subject contains "ÍøÕ¾!"
+score CN_SUBJECT_464   0.660
+
+header CN_SUBJECT_467  Subject =~ /°ü×°/
+describe CN_SUBJECT_467        Subject contains "°ü×°"
+score CN_SUBJECT_467   0.600
+
+header CN_SUBJECT_469  Subject =~ /¾«ÃÀ/
+describe CN_SUBJECT_469        Subject contains "¾«ÃÀ"
+score CN_SUBJECT_469   0.660
+
+header CN_SUBJECT_470  Subject =~ /ÂòÂô/
+describe CN_SUBJECT_470        Subject contains "ÂòÂô"
+score CN_SUBJECT_470   0.660
+
+header CN_SUBJECT_480  Subject =~ /ÖйúÐÐÒµ/
+describe CN_SUBJECT_480        Subject contains "ÖйúÐÐÒµ"
+score CN_SUBJECT_480   0.600
+
+header CN_SUBJECT_495  Subject =~ /º£Íâ/
+describe CN_SUBJECT_495        Subject contains "º£Íâ"
+score CN_SUBJECT_495   0.540
+
+header CN_SUBJECT_497  Subject =~ /Éç¿Æ/
+describe CN_SUBJECT_497        Subject contains "Éç¿Æ"
+score CN_SUBJECT_497   0.443
+
+header CN_SUBJECT_500  Subject =~ /ÌìµØ/
+describe CN_SUBJECT_500        Subject contains "ÌìµØ"
+score CN_SUBJECT_500   0.419
+
+header CN_SUBJECT_503  Subject =~ /·Àα/
+describe CN_SUBJECT_503        Subject contains "·Àα"
+score CN_SUBJECT_503   0.448
+
+header CN_SUBJECT_506  Subject =~ /ÏîÄ¿¹ÜÀí/
+describe CN_SUBJECT_506        Subject contains "ÏîÄ¿¹ÜÀí"
+score CN_SUBJECT_506   0.465
+
+header CN_SUBJECT_507  Subject =~ /ÊýÂëÔÚÏß/
+describe CN_SUBJECT_507        Subject contains "ÊýÂëÔÚÏß"
+score CN_SUBJECT_507   0.600
+
+header CN_SUBJECT_508  Subject =~ /»¨ºÜÉÙ/
+describe CN_SUBJECT_508        Subject contains "»¨ºÜÉÙ"
+score CN_SUBJECT_508   0.720
+
+header CN_SUBJECT_512  Subject =~ /ӦƸ/
+describe CN_SUBJECT_512        Subject contains "ӦƸ"
+score CN_SUBJECT_512   0.600
+
+header CN_SUBJECT_515  Subject =~ /×ÊÔ´3P/
+describe CN_SUBJECT_515        Subject contains "×ÊÔ´3P"
+score CN_SUBJECT_515   0.600
+
+header CN_SUBJECT_516  Subject =~ /3Pϵͳ/
+describe CN_SUBJECT_516        Subject contains "3Pϵͳ"
+score CN_SUBJECT_516   0.600
+
+header CN_SUBJECT_517  Subject =~ /´ú·¢Óʼþ/
+describe CN_SUBJECT_517        Subject contains "´ú·¢Óʼþ"
+score CN_SUBJECT_517   0.600
+
+header CN_SUBJECT_518  Subject =~ /Ô±¹¤/
+describe CN_SUBJECT_518        Subject contains "Ô±¹¤"
+score CN_SUBJECT_518   0.438
+
+header CN_SUBJECT_519  Subject =~ /±¨¼Û/
+describe CN_SUBJECT_519        Subject contains "±¨¼Û"
+score CN_SUBJECT_519   0.456
+
+header CN_SUBJECT_523  Subject =~ /³ê±ö/
+describe CN_SUBJECT_523        Subject contains "³ê±ö"
+score CN_SUBJECT_523   0.540
+
+header CN_SUBJECT_525  Subject =~ /°ïÄãÕÒ/
+describe CN_SUBJECT_525        Subject contains "°ïÄãÕÒ"
+score CN_SUBJECT_525   0.646
+
+header CN_SUBJECT_531  Subject =~ /×£Äú/
+describe CN_SUBJECT_531        Subject contains "×£Äú"
+score CN_SUBJECT_531   0.780
+
+header CN_SUBJECT_533  Subject =~ /¼¨Ð§/
+describe CN_SUBJECT_533        Subject contains "¼¨Ð§"
+score CN_SUBJECT_533   0.600
+
+header CN_SUBJECT_536  Subject =~ /ÆÀ¹À˵Ã÷/
+describe CN_SUBJECT_536        Subject contains "ÆÀ¹À˵Ã÷"
+score CN_SUBJECT_536   0.323
+
+header CN_SUBJECT_537  Subject =~ /£©´òÓ¡»ú/
+describe CN_SUBJECT_537        Subject contains "£©´òÓ¡»ú"
+score CN_SUBJECT_537   0.323
+
+header CN_SUBJECT_540  Subject =~ /ÌõÐÎÂë/
+describe CN_SUBJECT_540        Subject contains "ÌõÐÎÂë"
+score CN_SUBJECT_540   0.323
+
+header CN_SUBJECT_542  Subject =~ /ͶÈëÆÀ¹À/
+describe CN_SUBJECT_542        Subject contains "ͶÈëÆÀ¹À"
+score CN_SUBJECT_542   0.323
+
+header CN_SUBJECT_548  Subject =~ /Åä¶Ôϵͳ/
+describe CN_SUBJECT_548        Subject contains "Åä¶Ôϵͳ"
+score CN_SUBJECT_548   0.364
+
+header CN_SUBJECT_549  Subject =~ /×Ô¶¯ÕÒ/
+describe CN_SUBJECT_549        Subject contains "×Ô¶¯ÕÒ"
+score CN_SUBJECT_549   0.364
+
+header CN_SUBJECT_551  Subject =~ /Òµ¼¨/
+describe CN_SUBJECT_551        Subject contains "Òµ¼¨"
+score CN_SUBJECT_551   0.004
+
+header CN_SUBJECT_552  Subject =~ /¶¥¼â/
+describe CN_SUBJECT_552        Subject contains "¶¥¼â"
+score CN_SUBJECT_552   0.540
+
+header CN_SUBJECT_559  Subject =~ /·ÀÉí/
+describe CN_SUBJECT_559        Subject contains "·ÀÉí"
+score CN_SUBJECT_559   0.660
+
+header CN_SUBJECT_560  Subject =~ /ÀñÒÇ/
+describe CN_SUBJECT_560        Subject contains "ÀñÒÇ"
+score CN_SUBJECT_560   0.409
+
+header CN_SUBJECT_563  Subject =~ /Æ÷²Ä/
+describe CN_SUBJECT_563        Subject contains "Æ÷²Ä"
+score CN_SUBJECT_563   0.505
+
+header CN_SUBJECT_564  Subject =~ /½»ÓÑ/
+describe CN_SUBJECT_564        Subject contains "½»ÓÑ"
+score CN_SUBJECT_564   0.540
+
+header CN_SUBJECT_569  Subject =~ /µÍË°µã´ú/
+describe CN_SUBJECT_569        Subject contains "µÍË°µã´ú"
+score CN_SUBJECT_569   0.235
+
+header CN_SUBJECT_572  Subject =~ /¼à¿Ø/
+describe CN_SUBJECT_572        Subject contains "¼à¿Ø"
+score CN_SUBJECT_572   0.420
+
+header CN_SUBJECT_574  Subject =~ /¹ÜÀíÄÑÌâ/
+describe CN_SUBJECT_574        Subject contains "¹ÜÀíÄÑÌâ"
+score CN_SUBJECT_574   0.540
+
+header CN_SUBJECT_575  Subject =~ /¹ËÎÊ/
+describe CN_SUBJECT_575        Subject contains "¹ËÎÊ"
+score CN_SUBJECT_575   0.540
+
+header CN_SUBJECT_576  Subject =~ /ÑÐÌÖ»á/
+describe CN_SUBJECT_576        Subject contains "ÑÐÌÖ»á"
+score CN_SUBJECT_576   0.328
+
+header CN_SUBJECT_577  Subject =~ /½ø¿Ú/
+describe CN_SUBJECT_577        Subject contains "½ø¿Ú"
+score CN_SUBJECT_577   0.540
+
+header CN_SUBJECT_578  Subject =~ /ºÃÏûÏ¢/
+describe CN_SUBJECT_578        Subject contains "ºÃÏûÏ¢"
+score CN_SUBJECT_578   0.420
+
+header CN_SUBJECT_579  Subject =~ /²Ö´¢/
+describe CN_SUBJECT_579        Subject contains "²Ö´¢"
+score CN_SUBJECT_579   0.540
+
+header CN_SUBJECT_582  Subject =~ /О´Çë/
+describe CN_SUBJECT_582        Subject contains "О´Çë"
+score CN_SUBJECT_582   0.540
+
+header CN_SUBJECT_583  Subject =~ /Ó°Ïñ/
+describe CN_SUBJECT_583        Subject contains "Ó°Ïñ"
+score CN_SUBJECT_583   0.540
+
+header CN_SUBJECT_584  Subject =~ /ÍøÂçµç»°/
+describe CN_SUBJECT_584        Subject contains "ÍøÂçµç»°"
+score CN_SUBJECT_584   0.480
+
+header CN_SUBJECT_587  Subject =~ /µçÄÔ°æ/
+describe CN_SUBJECT_587        Subject contains "µçÄÔ°æ"
+score CN_SUBJECT_587   0.686
+
+header CN_SUBJECT_589  Subject =~ /»úÆ÷ÈË/
+describe CN_SUBJECT_589        Subject contains "»úÆ÷ÈË"
+score CN_SUBJECT_589   0.480
+
+header CN_SUBJECT_596  Subject =~ /±Ø±¸/
+describe CN_SUBJECT_596        Subject contains "±Ø±¸"
+score CN_SUBJECT_596   0.480
+
+header CN_SUBJECT_597  Subject =~ /Å·ÃÀ/
+describe CN_SUBJECT_597        Subject contains "Å·ÃÀ"
+score CN_SUBJECT_597   0.540
+
+header CN_SUBJECT_598  Subject =~ /ÍŶÓ/
+describe CN_SUBJECT_598        Subject contains "ÍŶÓ"
+score CN_SUBJECT_598   0.022
+
+header CN_SUBJECT_599  Subject =~ /ÍøÂçÈÕ¼Ç/
+describe CN_SUBJECT_599        Subject contains "ÍøÂçÈÕ¼Ç"
+score CN_SUBJECT_599   0.540
+
+header CN_SUBJECT_604  Subject =~ /רҵ´úÀí/
+describe CN_SUBJECT_604        Subject contains "רҵ´úÀí"
+score CN_SUBJECT_604   0.480
+
+header CN_SUBJECT_606  Subject =~ /Э»áÈ«Ì×/
+describe CN_SUBJECT_606        Subject contains "Э»áÈ«Ì×"
+score CN_SUBJECT_606   0.202
+
+header CN_SUBJECT_615  Subject =~ /ÔË×÷/
+describe CN_SUBJECT_615        Subject contains "ÔË×÷"
+score CN_SUBJECT_615   0.350
+
+header CN_SUBJECT_619  Subject =~ /¹¤×÷Óʼþ/
+describe CN_SUBJECT_619        Subject contains "¹¤×÷Óʼþ"
+score CN_SUBJECT_619   0.480
+
+header CN_SUBJECT_623  Subject =~ /¶©»õ/
+describe CN_SUBJECT_623        Subject contains "¶©»õ"
+score CN_SUBJECT_623   0.480
+
+header CN_SUBJECT_624  Subject =~ /Ó¡Ë¢/
+describe CN_SUBJECT_624        Subject contains "Ó¡Ë¢"
+score CN_SUBJECT_624   0.480
+
+header CN_SUBJECT_628  Subject =~ /Æó¹Ü/
+describe CN_SUBJECT_628        Subject contains "Æó¹Ü"
+score CN_SUBJECT_628   0.480
+
+header CN_SUBJECT_630  Subject =~ /Ö»Ðè500/
+describe CN_SUBJECT_630        Subject contains "Ö»Ðè500"
+score CN_SUBJECT_630   0.477
+
+header CN_SUBJECT_632  Subject =~ /ÉÌ»ú/
+describe CN_SUBJECT_632        Subject contains "ÉÌ»ú"
+score CN_SUBJECT_632   1.260
+
+header CN_SUBJECT_634  Subject =~ /»¶Ó­Äú/
+describe CN_SUBJECT_634        Subject contains "»¶Ó­Äú"
+score CN_SUBJECT_634   1.080
+
+header CN_SUBJECT_636  Subject =~ /Ñо¿±¨¸æ/
+describe CN_SUBJECT_636        Subject contains "Ñо¿±¨¸æ"
+score CN_SUBJECT_636   0.480
+
+header CN_SUBJECT_637  Subject =~ /ÄúºÃ/
+describe CN_SUBJECT_637        Subject contains "ÄúºÃ"
+score CN_SUBJECT_637   1.440
+
+header CN_SUBJECT_640  Subject =~ /ÉîÛÚ\)/
+describe CN_SUBJECT_640        Subject contains "ÉîÛÚ\)"
+score CN_SUBJECT_640   0.480
+
+header CN_SUBJECT_645  Subject =~ /³ÉÈË/
+describe CN_SUBJECT_645        Subject contains "³ÉÈË"
+score CN_SUBJECT_645   0.353
+
+header CN_SUBJECT_646  Subject =~ /ÉãÏñ»ú/
+describe CN_SUBJECT_646        Subject contains "ÉãÏñ»ú"
+score CN_SUBJECT_646   0.330
+
+header CN_SUBJECT_650  Subject =~ /ÏîÄ¿£¨/
+describe CN_SUBJECT_650        Subject contains "ÏîÄ¿£¨"
+score CN_SUBJECT_650   0.457
+
+header CN_SUBJECT_654  Subject =~ /×ÊѶ/
+describe CN_SUBJECT_654        Subject contains "×ÊѶ"
+score CN_SUBJECT_654   0.420
+
+header CN_SUBJECT_655  Subject =~ /²ÙÅÌ/
+describe CN_SUBJECT_655        Subject contains "²ÙÅÌ"
+score CN_SUBJECT_655   0.508
+
+header CN_SUBJECT_659  Subject =~ /°ÝÄê/
+describe CN_SUBJECT_659        Subject contains "°ÝÄê"
+score CN_SUBJECT_659   0.420
+
+header CN_SUBJECT_660  Subject =~ /¡¾ÍøÂç/
+describe CN_SUBJECT_660        Subject contains "¡¾ÍøÂç"
+score CN_SUBJECT_660   0.480
+
+header CN_SUBJECT_663  Subject =~ /°ïÄú/
+describe CN_SUBJECT_663        Subject contains "°ïÄú"
+score CN_SUBJECT_663   1.020
+
+header CN_SUBJECT_667  Subject =~ /KR-GÐÍÎÂ/
+describe CN_SUBJECT_667        Subject contains "KR-GÐÍÎÂ"
+score CN_SUBJECT_667   0.540
+
+header CN_SUBJECT_670  Subject =~ /ÐéÄâÖ÷»ú/
+describe CN_SUBJECT_670        Subject contains "ÐéÄâÖ÷»ú"
+score CN_SUBJECT_670   0.480
+
+header CN_SUBJECT_671  Subject =~ /¶ÌÆÚ/
+describe CN_SUBJECT_671        Subject contains "¶ÌÆÚ"
+score CN_SUBJECT_671   0.300
+
+header CN_SUBJECT_674  Subject =~ /Ô˼Û/
+describe CN_SUBJECT_674        Subject contains "Ô˼Û"
+score CN_SUBJECT_674   0.540
+
+header CN_SUBJECT_675  Subject =~ /¼°×î/
+describe CN_SUBJECT_675        Subject contains "¼°×î"
+score CN_SUBJECT_675   0.420
+
+header CN_SUBJECT_681  Subject =~ /¿Õµ÷/
+describe CN_SUBJECT_681        Subject contains "¿Õµ÷"
+score CN_SUBJECT_681   0.300
+
+header CN_SUBJECT_689  Subject =~ /ÓÉÎÒÃÇ/
+describe CN_SUBJECT_689        Subject contains "ÓÉÎÒÃÇ"
+score CN_SUBJECT_689   0.420
+
+header CN_SUBJECT_690  Subject =~ /¡¶ÍøÂç/
+describe CN_SUBJECT_690        Subject contains "¡¶ÍøÂç"
+score CN_SUBJECT_690   0.333
+
+header CN_SUBJECT_692  Subject =~ /ÇÔÌý/
+describe CN_SUBJECT_692        Subject contains "ÇÔÌý"
+score CN_SUBJECT_692   0.360
+
+header CN_SUBJECT_693  Subject =~ /ÉÌÇé/
+describe CN_SUBJECT_693        Subject contains "ÉÌÇé"
+score CN_SUBJECT_693   0.420
+
+header CN_SUBJECT_694  Subject =~ /ÐÐÒµÑо¿/
+describe CN_SUBJECT_694        Subject contains "ÐÐÒµÑо¿"
+score CN_SUBJECT_694   0.420
+
+header CN_SUBJECT_698  Subject =~ /ÂþÓÎ/
+describe CN_SUBJECT_698        Subject contains "ÂþÓÎ"
+score CN_SUBJECT_698   0.405
+
+header CN_SUBJECT_705  Subject =~ /ÇáÇá/
+describe CN_SUBJECT_705        Subject contains "ÇáÇá"
+score CN_SUBJECT_705   0.300
+
+header CN_SUBJECT_709  Subject =~ /»ð±¬/
+describe CN_SUBJECT_709        Subject contains "»ð±¬"
+score CN_SUBJECT_709   0.348
+
+header CN_SUBJECT_711  Subject =~ /»úÓö/
+describe CN_SUBJECT_711        Subject contains "»úÓö"
+score CN_SUBJECT_711   0.300
+
+header CN_SUBJECT_718  Subject =~ /ÕæƱ/
+describe CN_SUBJECT_718        Subject contains "ÕæƱ"
+score CN_SUBJECT_718   0.175
+
+header CN_SUBJECT_719  Subject =~ /¹¤³§/
+describe CN_SUBJECT_719        Subject contains "¹¤³§"
+score CN_SUBJECT_719   0.415
+
+header CN_SUBJECT_723  Subject =~ /¼Ç¼¹ÜÀí/
+describe CN_SUBJECT_723        Subject contains "¼Ç¼¹ÜÀí"
+score CN_SUBJECT_723   0.420
+
+header CN_SUBJECT_728  Subject =~ /Á¢¼´/
+describe CN_SUBJECT_728        Subject contains "Á¢¼´"
+score CN_SUBJECT_728   0.360
+
+header CN_SUBJECT_732  Subject =~ /ÉúÒâ/
+describe CN_SUBJECT_732        Subject contains "ÉúÒâ"
+score CN_SUBJECT_732   0.600
+
+header CN_SUBJECT_736  Subject =~ /ÌØ»Ý/
+describe CN_SUBJECT_736        Subject contains "ÌØ»Ý"
+score CN_SUBJECT_736   0.420
+
+header CN_SUBJECT_738  Subject =~ /»Ø¸´£¡/
+describe CN_SUBJECT_738        Subject contains "»Ø¸´£¡"
+score CN_SUBJECT_738   0.420
+
+header CN_SUBJECT_743  Subject =~ /»¥»Ý/
+describe CN_SUBJECT_743        Subject contains "»¥»Ý"
+score CN_SUBJECT_743   0.420
+
+header CN_SUBJECT_746  Subject =~ /¸åÔ¼/
+describe CN_SUBJECT_746        Subject contains "¸åÔ¼"
+score CN_SUBJECT_746   0.420
+
+header CN_SUBJECT_751  Subject =~ /¡·V2005/
+describe CN_SUBJECT_751        Subject contains "¡·V2005"
+score CN_SUBJECT_751   0.262
+
+header CN_SUBJECT_752  Subject =~ /ÉÌó/
+describe CN_SUBJECT_752        Subject contains "ÉÌó"
+score CN_SUBJECT_752   0.420
+
+header CN_SUBJECT_756  Subject =~ /ÁãÊÛ/
+describe CN_SUBJECT_756        Subject contains "ÁãÊÛ"
+score CN_SUBJECT_756   0.420
+
+header CN_SUBJECT_757  Subject =~ /\[ͬ־/
+describe CN_SUBJECT_757        Subject contains "\[ͬ־"
+score CN_SUBJECT_757   0.420
+
+header CN_SUBJECT_759  Subject =~ /\]ÃǺã¬/
+describe CN_SUBJECT_759        Subject contains "\]ÃǺã¬"
+score CN_SUBJECT_759   0.420
+
+header CN_SUBJECT_761  Subject =~ /»î¶¯Å¶/
+describe CN_SUBJECT_761        Subject contains "»î¶¯Å¶"
+score CN_SUBJECT_761   0.420
+
+header CN_SUBJECT_762  Subject =~ /µç»°Â¼Òô/
+describe CN_SUBJECT_762        Subject contains "µç»°Â¼Òô"
+score CN_SUBJECT_762   0.420
+
+header CN_SUBJECT_764  Subject =~ /Õ÷ ¸å/
+describe CN_SUBJECT_764        Subject contains "Õ÷ ¸å"
+score CN_SUBJECT_764   0.480
+
+header CN_SUBJECT_769  Subject =~ /̸̸Âð\?/
+describe CN_SUBJECT_769        Subject contains "̸̸Âð\?"
+score CN_SUBJECT_769   0.139
+
+header CN_SUBJECT_771  Subject =~ /¼ÎöÎ/
+describe CN_SUBJECT_771        Subject contains "¼ÎöÎ"
+score CN_SUBJECT_771   0.057
+
+header CN_SUBJECT_774  Subject =~ /ʱ¼ä£¬/
+describe CN_SUBJECT_774        Subject contains "ʱ¼ä£¬"
+score CN_SUBJECT_774   0.300
+
+header CN_SUBJECT_778  Subject =~ /×îÐÂÍƼö/
+describe CN_SUBJECT_778        Subject contains "×îÐÂÍƼö"
+score CN_SUBJECT_778   0.333
+
+header CN_SUBJECT_781  Subject =~ /\.°üÕæ¡¢/
+describe CN_SUBJECT_781        Subject contains "\.°üÕæ¡¢"
+score CN_SUBJECT_781   0.409
+
+header CN_SUBJECT_783  Subject =~ /ËÉËÉд/
+describe CN_SUBJECT_783        Subject contains "ËÉËÉд"
+score CN_SUBJECT_783   0.360
+
+header CN_SUBJECT_784  Subject =~ /Ô¿¯/
+describe CN_SUBJECT_784        Subject contains "Ô¿¯"
+score CN_SUBJECT_784   0.351
+
+header CN_SUBJECT_785  Subject =~ /ÍøÕ¾ÓÐÈË/
+describe CN_SUBJECT_785        Subject contains "ÍøÕ¾ÓÐÈË"
+score CN_SUBJECT_785   0.360
+
+header CN_SUBJECT_790  Subject =~ /Âð\?Óʼþ/
+describe CN_SUBJECT_790        Subject contains "Âð\?Óʼþ"
+score CN_SUBJECT_790   0.360
+
+header CN_SUBJECT_792  Subject =~ /µÇ½Âð\?/
+describe CN_SUBJECT_792        Subject contains "µÇ½Âð\?"
+score CN_SUBJECT_792   0.360
+
+header CN_SUBJECT_794  Subject =~ /ÓÐÈ˵ǽ/
+describe CN_SUBJECT_794        Subject contains "ÓÐÈ˵ǽ"
+score CN_SUBJECT_794   0.360
+
+header CN_SUBJECT_802  Subject =~ /ÐèÒª!/
+describe CN_SUBJECT_802        Subject contains "ÐèÒª!"
+score CN_SUBJECT_802   0.289
+
+header CN_SUBJECT_803  Subject =~ /¸ü»»/
+describe CN_SUBJECT_803        Subject contains "¸ü»»"
+score CN_SUBJECT_803   0.284
+
+header CN_SUBJECT_804  Subject =~ /¿§·ÈµÄ/
+describe CN_SUBJECT_804        Subject contains "¿§·ÈµÄ"
+score CN_SUBJECT_804   0.360
+
+header CN_SUBJECT_805  Subject =~ /¿ÆѧÑо¿/
+describe CN_SUBJECT_805        Subject contains "¿ÆѧÑо¿"
+score CN_SUBJECT_805   0.001
+
+header CN_SUBJECT_806  Subject =~ /±¦µä£¡/
+describe CN_SUBJECT_806        Subject contains "±¦µä£¡"
+score CN_SUBJECT_806   0.273
+
+header CN_SUBJECT_810  Subject =~ /ÍƼö  /
+describe CN_SUBJECT_810        Subject contains "ÍƼö  "
+score CN_SUBJECT_810   0.273
+
+header CN_SUBJECT_812  Subject =~ /Ⱥ·¢/
+describe CN_SUBJECT_812        Subject contains "Ⱥ·¢"
+score CN_SUBJECT_812   1.140
+
+header CN_SUBJECT_813  Subject =~ /ÄÉË°/
+describe CN_SUBJECT_813        Subject contains "ÄÉË°"
+score CN_SUBJECT_813   0.360
+
+header CN_SUBJECT_814  Subject =~ /  ³¬¼¶/
+describe CN_SUBJECT_814        Subject contains "  ³¬¼¶"
+score CN_SUBJECT_814   0.273
+
+header CN_SUBJECT_824  Subject =~ /Ƶ·±/
+describe CN_SUBJECT_824        Subject contains "Ƶ·±"
+score CN_SUBJECT_824   0.291
+
+header CN_SUBJECT_829  Subject =~ /Íæ¾ß/
+describe CN_SUBJECT_829        Subject contains "Íæ¾ß"
+score CN_SUBJECT_829   0.282
+
+header CN_SUBJECT_839  Subject =~ /Ò»¾ø/
+describe CN_SUBJECT_839        Subject contains "Ò»¾ø"
+score CN_SUBJECT_839   0.240
+
+header CN_SUBJECT_844  Subject =~ /ËûÈË¿ìÀÖ/
+describe CN_SUBJECT_844        Subject contains "ËûÈË¿ìÀÖ"
+score CN_SUBJECT_844   0.360
+
+header CN_SUBJECT_849  Subject =~ /¸øËûÈË/
+describe CN_SUBJECT_849        Subject contains "¸øËûÈË"
+score CN_SUBJECT_849   0.360
+
+header CN_SUBJECT_850  Subject =~ /¿ìÀÖΪ/
+describe CN_SUBJECT_850        Subject contains "¿ìÀÖΪ"
+score CN_SUBJECT_850   0.360
+
+header CN_SUBJECT_855  Subject =~ /ʵÎñ/
+describe CN_SUBJECT_855        Subject contains "ʵÎñ"
+score CN_SUBJECT_855   0.480
+
+header CN_SUBJECT_859  Subject =~ /µØַרÂô/
+describe CN_SUBJECT_859        Subject contains "µØַרÂô"
+score CN_SUBJECT_859   0.360
+
+header CN_SUBJECT_865  Subject =~ /ÀÏͬѧ/
+describe CN_SUBJECT_865        Subject contains "ÀÏͬѧ"
+score CN_SUBJECT_865   0.300
+
+header CN_SUBJECT_868  Subject =~ /´ÊÆð/
+describe CN_SUBJECT_868        Subject contains "´ÊÆð"
+score CN_SUBJECT_868   0.259
+
+header CN_SUBJECT_875  Subject =~ /½»Ò×/
+describe CN_SUBJECT_875        Subject contains "½»Ò×"
+score CN_SUBJECT_875   0.360
+
+header CN_SUBJECT_876  Subject =~ /Öвã/
+describe CN_SUBJECT_876        Subject contains "Öвã"
+score CN_SUBJECT_876   0.339
+
+header CN_SUBJECT_877  Subject =~ /²Ö¿â/
+describe CN_SUBJECT_877        Subject contains "²Ö¿â"
+score CN_SUBJECT_877   0.360
+
+header CN_SUBJECT_878  Subject =~ /Îʺò!/
+describe CN_SUBJECT_878        Subject contains "Îʺò!"
+score CN_SUBJECT_878   0.360
+
+header CN_SUBJECT_893  Subject =~ /´ºÌìÎʺò/
+describe CN_SUBJECT_893        Subject contains "´ºÌìÎʺò"
+score CN_SUBJECT_893   0.300
+
+header CN_SUBJECT_894  Subject =~ /»Û´Ï/
+describe CN_SUBJECT_894        Subject contains "»Û´Ï"
+score CN_SUBJECT_894   0.300
+
+header CN_SUBJECT_897  Subject =~ />Èí¼þ/
+describe CN_SUBJECT_897        Subject contains ">Èí¼þ"
+score CN_SUBJECT_897   0.360
+
+header CN_SUBJECT_902  Subject =~ /³ÏÕÐ/
+describe CN_SUBJECT_902        Subject contains "³ÏÕÐ"
+score CN_SUBJECT_902   0.900
+
+header CN_SUBJECT_905  Subject =~ /µçÂë/
+describe CN_SUBJECT_905        Subject contains "µçÂë"
+score CN_SUBJECT_905   0.300
+
+header CN_SUBJECT_909  Subject =~ /¹ÜÀí×ÊÁÏ/
+describe CN_SUBJECT_909        Subject contains "¹ÜÀí×ÊÁÏ"
+score CN_SUBJECT_909   0.300
+
+header CN_SUBJECT_911  Subject =~ /¹úÄÚ³¤Í¾/
+describe CN_SUBJECT_911        Subject contains "¹úÄÚ³¤Í¾"
+score CN_SUBJECT_911   0.300
+
+header CN_SUBJECT_912  Subject =~ /ÓÊÖ·3ÒÚ/
+describe CN_SUBJECT_912        Subject contains "ÓÊÖ·3ÒÚ"
+score CN_SUBJECT_912   0.300
+
+header CN_SUBJECT_917  Subject =~ /»§Íâ/
+describe CN_SUBJECT_917        Subject contains "»§Íâ"
+score CN_SUBJECT_917   0.300
+
+header CN_SUBJECT_918  Subject =~ /»¯×±Æ·/
+describe CN_SUBJECT_918        Subject contains "»¯×±Æ·"
+score CN_SUBJECT_918   0.240
+
+header CN_SUBJECT_920  Subject =~ /£¬Ñéºó/
+describe CN_SUBJECT_920        Subject contains "£¬Ñéºó"
+score CN_SUBJECT_920   0.305
+
+header CN_SUBJECT_923  Subject =~ /¸É²¿¹ÜÀí/
+describe CN_SUBJECT_923        Subject contains "¸É²¿¹ÜÀí"
+score CN_SUBJECT_923   0.218
+
+header CN_SUBJECT_930  Subject =~ /ÐÅÓùÜÀí/
+describe CN_SUBJECT_930        Subject contains "ÐÅÓùÜÀí"
+score CN_SUBJECT_930   0.300
+
+header CN_SUBJECT_932  Subject =~ /·­Òë·þÎñ/
+describe CN_SUBJECT_932        Subject contains "·­Òë·þÎñ"
+score CN_SUBJECT_932   0.300
+
+header CN_SUBJECT_934  Subject =~ /·Ä»ú/
+describe CN_SUBJECT_934        Subject contains "·Ä»ú"
+score CN_SUBJECT_934   0.300
+
+header CN_SUBJECT_935  Subject =~ /Åä¼þ/
+describe CN_SUBJECT_935        Subject contains "Åä¼þ"
+score CN_SUBJECT_935   0.214
+
+header CN_SUBJECT_942  Subject =~ /µÏ»ù/
+describe CN_SUBJECT_942        Subject contains "µÏ»ù"
+score CN_SUBJECT_942   0.097
+
+header CN_SUBJECT_944  Subject =~ /ºè·¢/
+describe CN_SUBJECT_944        Subject contains "ºè·¢"
+score CN_SUBJECT_944   0.360
+
+header CN_SUBJECT_945  Subject =~ /ÈռDZ¾£¬/
+describe CN_SUBJECT_945        Subject contains "ÈռDZ¾£¬"
+score CN_SUBJECT_945   0.300
+
+header CN_SUBJECT_946  Subject =~ /ºóÃÅ/
+describe CN_SUBJECT_946        Subject contains "ºóÃÅ"
+score CN_SUBJECT_946   0.300
+
+header CN_SUBJECT_950  Subject =~ /¿ìÀÖ!/
+describe CN_SUBJECT_950        Subject contains "¿ìÀÖ!"
+score CN_SUBJECT_950   0.360
+
+header CN_SUBJECT_952  Subject =~ /¸ÐȾµÄ/
+describe CN_SUBJECT_952        Subject contains "¸ÐȾµÄ"
+score CN_SUBJECT_952   0.300
+
+header CN_SUBJECT_953  Subject =~ /³É±¾½µµÍ/
+describe CN_SUBJECT_953        Subject contains "³É±¾½µµÍ"
+score CN_SUBJECT_953   0.300
+
+header CN_SUBJECT_955  Subject =~ /Ô¶³Ì½ÌÓý/
+describe CN_SUBJECT_955        Subject contains "Ô¶³Ì½ÌÓý"
+score CN_SUBJECT_955   0.300
+
+header CN_SUBJECT_956  Subject =~ /Ö¸»/
+describe CN_SUBJECT_956        Subject contains "Ö¸»"
+score CN_SUBJECT_956   0.216
+
+header CN_SUBJECT_963  Subject =~ /»ò±»Èä³æ/
+describe CN_SUBJECT_963        Subject contains "»ò±»Èä³æ"
+score CN_SUBJECT_963   0.300
+
+header CN_SUBJECT_968  Subject =~ /Éè¼Æʦ/
+describe CN_SUBJECT_968        Subject contains "Éè¼Æʦ"
+score CN_SUBJECT_968   0.300
+
+header CN_SUBJECT_970  Subject =~ /³ÏÒâ/
+describe CN_SUBJECT_970        Subject contains "³ÏÒâ"
+score CN_SUBJECT_970   0.240
+
+header CN_SUBJECT_971  Subject =~ /ºÚÂí/
+describe CN_SUBJECT_971        Subject contains "ºÚÂí"
+score CN_SUBJECT_971   0.300
+
+header CN_SUBJECT_973  Subject =~ /¿¼ºË/
+describe CN_SUBJECT_973        Subject contains "¿¼ºË"
+score CN_SUBJECT_973   0.291
+
+header CN_SUBJECT_978  Subject =~ /·ÀµÁ/
+describe CN_SUBJECT_978        Subject contains "·ÀµÁ"
+score CN_SUBJECT_978   0.240
+
+header CN_SUBJECT_982  Subject =~ /É̹ÜÀí/
+describe CN_SUBJECT_982        Subject contains "É̹ÜÀí"
+score CN_SUBJECT_982   0.291
+
+header CN_SUBJECT_983  Subject =~ /»»¹ã¸æ/
+describe CN_SUBJECT_983        Subject contains "»»¹ã¸æ"
+score CN_SUBJECT_983   0.300
+
+header CN_SUBJECT_985  Subject =~ /×Ê·Ñ/
+describe CN_SUBJECT_985        Subject contains "×Ê·Ñ"
+score CN_SUBJECT_985   0.240
+
+header CN_SUBJECT_986  Subject =~ /×°±¸/
+describe CN_SUBJECT_986        Subject contains "×°±¸"
+score CN_SUBJECT_986   0.286
+
+header CN_SUBJECT_989  Subject =~ /Ö»Ðè800/
+describe CN_SUBJECT_989        Subject contains "Ö»Ðè800"
+score CN_SUBJECT_989   0.300
+
+header CN_SUBJECT_991  Subject =~ /ÄúÐèÒª/
+describe CN_SUBJECT_991        Subject contains "ÄúÐèÒª"
+score CN_SUBJECT_991   0.780
+
+header CN_SUBJECT_994  Subject =~ /Íø¹Ø/
+describe CN_SUBJECT_994        Subject contains "Íø¹Ø"
+score CN_SUBJECT_994   0.300
+
+header CN_SUBJECT_996  Subject =~ /ÓÐÏÞ/
+describe CN_SUBJECT_996        Subject contains "ÓÐÏÞ"
+score CN_SUBJECT_996   0.009
+
+header CN_SUBJECT_998  Subject =~ /ÊÂÒË/
+describe CN_SUBJECT_998        Subject contains "ÊÂÒË"
+score CN_SUBJECT_998   0.015
+
+header CN_SUBJECT_999  Subject =~ /¹¤Ã³/
+describe CN_SUBJECT_999        Subject contains "¹¤Ã³"
+score CN_SUBJECT_999   0.300
+
+body CN_BODY_1 /¹«Ë¾/
+describe CN_BODY_1     Body contains "¹«Ë¾"
+score CN_BODY_1        0.004
+
+body CN_BODY_4 /ÐÅÏ¢/
+describe CN_BODY_4     Body contains "ÐÅÏ¢"
+score CN_BODY_4        0.008
+
+body CN_BODY_7 /·þÎñ/
+describe CN_BODY_7     Body contains "·þÎñ"
+score CN_BODY_7        0.016
+
+body CN_BODY_8 /ÏúÊÛ/
+describe CN_BODY_8     Body contains "ÏúÊÛ"
+score CN_BODY_8        0.008
+
+body CN_BODY_10        /ÓÅ»Ý/
+describe CN_BODY_10    Body contains "ÓÅ»Ý"
+score CN_BODY_10       0.091
+
+body CN_BODY_18        /ÁªÏµÈË/
+describe CN_BODY_18    Body contains "ÁªÏµÈË"
+score CN_BODY_18       2.010
+
+body CN_BODY_19        /¸ù¾Ý/
+describe CN_BODY_19    Body contains "¸ù¾Ý"
+score CN_BODY_19       0.016
+
+body CN_BODY_21        /ÉÌÆ·/
+describe CN_BODY_21    Body contains "ÉÌÆ·"
+score CN_BODY_21       0.003
+
+body CN_BODY_22        /¹ã¸æ/
+describe CN_BODY_22    Body contains "¹ã¸æ"
+score CN_BODY_22       0.106
+
+body CN_BODY_23        /ÓÐЧ/
+describe CN_BODY_23    Body contains "ÓÐЧ"
+score CN_BODY_23       0.018
+
+body CN_BODY_30        /ÏêÇé/
+describe CN_BODY_30    Body contains "ÏêÇé"
+score CN_BODY_30       1.778
+
+body CN_BODY_33        /³Ðŵ/
+describe CN_BODY_33    Body contains "³Ðŵ"
+score CN_BODY_33       0.001
+
+body CN_BODY_34        /ÉÏÍø/
+describe CN_BODY_34    Body contains "ÉÏÍø"
+score CN_BODY_34       0.018
+
+body CN_BODY_35        /ÆóÒµ/
+describe CN_BODY_35    Body contains "ÆóÒµ"
+score CN_BODY_35       0.011
+
+body CN_BODY_37        /»¶Ó­/
+describe CN_BODY_37    Body contains "»¶Ó­"
+score CN_BODY_37       0.132
+
+body CN_BODY_38        /½øÏî/
+describe CN_BODY_38    Body contains "½øÏî"
+score CN_BODY_38       1.147
+
+body CN_BODY_43        /Ôöֵ˰/
+describe CN_BODY_43    Body contains "Ôöֵ˰"
+score CN_BODY_43       0.957
+
+body CN_BODY_44        /ÊýÁ¿/
+describe CN_BODY_44    Body contains "ÊýÁ¿"
+score CN_BODY_44       0.016
+
+body CN_BODY_48        /Íê³É/
+describe CN_BODY_48    Body contains "Íê³É"
+score CN_BODY_48       0.008
+
+body CN_BODY_51        /Óʼþ/
+describe CN_BODY_51    Body contains "Óʼþ"
+score CN_BODY_51       0.282
+
+body CN_BODY_53        /ʵÁ¦/
+describe CN_BODY_53    Body contains "ʵÁ¦"
+score CN_BODY_53       0.044
+
+body CN_BODY_56        /µãÊý/
+describe CN_BODY_56    Body contains "µãÊý"
+score CN_BODY_56       0.804
+
+body CN_BODY_60        /²úÆ·/
+describe CN_BODY_60    Body contains "²úÆ·"
+score CN_BODY_60       0.141
+
+body CN_BODY_62        /¿Í»§/
+describe CN_BODY_62    Body contains "¿Í»§"
+score CN_BODY_62       0.356
+
+body CN_BODY_66        /ÐÛºñ/
+describe CN_BODY_66    Body contains "ÐÛºñ"
+score CN_BODY_66       0.055
+
+body CN_BODY_67        /Çëµç/
+describe CN_BODY_67    Body contains "Çëµç"
+score CN_BODY_67       0.915
+
+body CN_BODY_69        /µØÖ·/
+describe CN_BODY_69    Body contains "µØÖ·"
+score CN_BODY_69       0.021
+
+body CN_BODY_72        /Á¼ºÃ/
+describe CN_BODY_72    Body contains "Á¼ºÃ"
+score CN_BODY_72       0.018
+
+body CN_BODY_87        /ËùÓÃ/
+describe CN_BODY_87    Body contains "ËùÓÃ"
+score CN_BODY_87       0.007
+
+body CN_BODY_89        /µØË°/
+describe CN_BODY_89    Body contains "µØË°"
+score CN_BODY_89       0.300
+
+body CN_BODY_90        /ÓÀ¾Ã/
+describe CN_BODY_90    Body contains "ÓÀ¾Ã"
+score CN_BODY_90       0.001
+
+body CN_BODY_92        /Éç»á¹Øϵ/
+describe CN_BODY_92    Body contains "Éç»á¹Øϵ"
+score CN_BODY_92       0.005
+
+body CN_BODY_97        /µÖ¿Û/
+describe CN_BODY_97    Body contains "µÖ¿Û"
+score CN_BODY_97       1.593
+
+body CN_BODY_111       /´«Õæ/
+describe CN_BODY_111   Body contains "´«Õæ"
+score CN_BODY_111      1.147
+
+body CN_BODY_116       /Ç¢ÉÌ/
+describe CN_BODY_116   Body contains "Ç¢ÉÌ"
+score CN_BODY_116      0.638
+
+body CN_BODY_124       /ÓÊÏä/
+describe CN_BODY_124   Body contains "ÓÊÏä"
+score CN_BODY_124      0.095
+
+body CN_BODY_134       /»òµ£ÐÄ/
+describe CN_BODY_134   Body contains "»òµ£ÐÄ"
+score CN_BODY_134      0.306
+
+body CN_BODY_144       /´ú¿ª»ò/
+describe CN_BODY_144   Body contains "´ú¿ª»ò"
+score CN_BODY_144      1.483
+
+body CN_BODY_146       /³ÉÁ¢/
+describe CN_BODY_146   Body contains "³ÉÁ¢"
+score CN_BODY_146      0.018
+
+body CN_BODY_151       /¶«Ý¸/
+describe CN_BODY_151   Body contains "¶«Ý¸"
+score CN_BODY_151      0.419
+
+body CN_BODY_154       /ÈÈÏß/
+describe CN_BODY_154   Body contains "ÈÈÏß"
+score CN_BODY_154      0.162
+
+body CN_BODY_156       /µ£ÐÄ£¬¿É/
+describe CN_BODY_156   Body contains "µ£ÐÄ£¬¿É"
+score CN_BODY_156      0.202
+
+body CN_BODY_157       /»áÓë¹ó˾/
+describe CN_BODY_157   Body contains "»áÓë¹ó˾"
+score CN_BODY_157      1.372
+
+body CN_BODY_160       /£¬±Ø³É/
+describe CN_BODY_160   Body contains "£¬±Ø³É"
+score CN_BODY_160      0.004
+
+body CN_BODY_173       /ÁªÏµµç»°/
+describe CN_BODY_173   Body contains "ÁªÏµµç»°"
+score CN_BODY_173      0.788
+
+body CN_BODY_177       /ÍøÖ·/
+describe CN_BODY_177   Body contains "ÍøÖ·"
+score CN_BODY_177      0.272
+
+body CN_BODY_179       /½Ï¶àÏÖ/
+describe CN_BODY_179   Body contains "½Ï¶àÏÖ"
+score CN_BODY_179      0.914
+
+body CN_BODY_182       /¿ª·¢/
+describe CN_BODY_182   Body contains "¿ª·¢"
+score CN_BODY_182      0.045
+
+body CN_BODY_187       /²éѯ/
+describe CN_BODY_187   Body contains "²éѯ"
+score CN_BODY_187      0.403
+
+body CN_BODY_190       /Óë¹ó˾ȥ/
+describe CN_BODY_190   Body contains "Óë¹ó˾ȥ"
+score CN_BODY_190      0.698
+
+body CN_BODY_208       /ÐÐÒµ/
+describe CN_BODY_208   Body contains "ÐÐÒµ"
+score CN_BODY_208      0.097
+
+body CN_BODY_229       /ÄúµÄ/
+describe CN_BODY_229   Body contains "ÄúµÄ"
+score CN_BODY_229      0.414
+
+body CN_BODY_236       /ÉÌÎñ/
+describe CN_BODY_236   Body contains "ÉÌÎñ"
+score CN_BODY_236      0.738
+
+body CN_BODY_237       /¸¶¿î/
+describe CN_BODY_237   Body contains "¸¶¿î"
+score CN_BODY_237      0.861
+
+body CN_BODY_245       /´úÀí/
+describe CN_BODY_245   Body contains "´úÀí"
+score CN_BODY_245      0.018
+
+body CN_BODY_267       /×óÓÒ£©/
+describe CN_BODY_267   Body contains "×óÓÒ£©"
+score CN_BODY_267      0.015
+
+body CN_BODY_269       /»áÔ±/
+describe CN_BODY_269   Body contains "»áÔ±"
+score CN_BODY_269      0.449
+
+body CN_BODY_276       /ÑéÖ¤/
+describe CN_BODY_276   Body contains "ÑéÖ¤"
+score CN_BODY_276      0.026
+
+body CN_BODY_277       /µã»÷/
+describe CN_BODY_277   Body contains "µã»÷"
+score CN_BODY_277      0.271
+
+body CN_BODY_291       /רÓÃ/
+describe CN_BODY_291   Body contains "רÓÃ"
+score CN_BODY_291      0.009
+
+body CN_BODY_293       /ÓªÏú/
+describe CN_BODY_293   Body contains "ÓªÏú"
+score CN_BODY_293      0.509
+
+body CN_BODY_317       /Ê÷Á¢/
+describe CN_BODY_317   Body contains "Ê÷Á¢"
+score CN_BODY_317      0.003
+
+body CN_BODY_324       /´òÈÅ/
+describe CN_BODY_324   Body contains "´òÈÅ"
+score CN_BODY_324      0.585
+
+body CN_BODY_326       /Ʊ¾Ý/
+describe CN_BODY_326   Body contains "Ʊ¾Ý"
+score CN_BODY_326      0.023
+
+body CN_BODY_330       /·¢ËÍ/
+describe CN_BODY_330   Body contains "·¢ËÍ"
+score CN_BODY_330      0.120
+
+body CN_BODY_335       /½ÏµÍ¡£»¹/
+describe CN_BODY_335   Body contains "½ÏµÍ¡£»¹"
+score CN_BODY_335      0.202
+
+body CN_BODY_348       /¸÷Àà/
+describe CN_BODY_348   Body contains "¸÷Àà"
+score CN_BODY_348      0.108
+
+body CN_BODY_356       /½É¿î/
+describe CN_BODY_356   Body contains "½É¿î"
+score CN_BODY_356      1.694
+
+body CN_BODY_375       /ƽ̨/
+describe CN_BODY_375   Body contains "ƽ̨"
+score CN_BODY_375      0.063
+
+body CN_BODY_389       /2%×óÓÒ/
+describe CN_BODY_389   Body contains "2%×óÓÒ"
+score CN_BODY_389      0.001
+
+body CN_BODY_394       /À´µç/
+describe CN_BODY_394   Body contains "À´µç"
+score CN_BODY_394      0.013
+
+body CN_BODY_395       /È«¹ú¸÷µØ/
+describe CN_BODY_395   Body contains "È«¹ú¸÷µØ"
+score CN_BODY_395      0.036
+
+body CN_BODY_400       /ÖÐÐÄ×÷Ϊ/
+describe CN_BODY_400   Body contains "ÖÐÐÄ×÷Ϊ"
+score CN_BODY_400      1.373
+
+body CN_BODY_412       /ÉèÓÐ/
+describe CN_BODY_412   Body contains "ÉèÓÐ"
+score CN_BODY_412      0.032
+
+body CN_BODY_418       /Ó¦ÓÃ/
+describe CN_BODY_418   Body contains "Ó¦ÓÃ"
+score CN_BODY_418      0.011
+
+body CN_BODY_419       /¾´Çë/
+describe CN_BODY_419   Body contains "¾´Çë"
+score CN_BODY_419      0.510
+
+body CN_BODY_426       /µÈÊÐÓÐ/
+describe CN_BODY_426   Body contains "µÈÊÐÓÐ"
+score CN_BODY_426      1.103
+
+body CN_BODY_436       /×öµ½¡°/
+describe CN_BODY_436   Body contains "×öµ½¡°"
+score CN_BODY_436      0.012
+
+body CN_BODY_472       /ÔùËÍ/
+describe CN_BODY_472   Body contains "ÔùËÍ"
+score CN_BODY_472      0.037
+
+body CN_BODY_489       /\(24Сʱ/
+describe CN_BODY_489   Body contains "\(24Сʱ"
+score CN_BODY_489      1.551
+
+body CN_BODY_492       /Ǣ̸/
+describe CN_BODY_492   Body contains "Ǣ̸"
+score CN_BODY_492      0.590
+
+body CN_BODY_494       /×ð¾´µÄ/
+describe CN_BODY_494   Body contains "×ð¾´µÄ"
+score CN_BODY_494      0.479
+
+body CN_BODY_495       /¡¢±Ø³É/
+describe CN_BODY_495   Body contains "¡¢±Ø³É"
+score CN_BODY_495      0.270
+
+body CN_BODY_503       /Ö÷°ì/
+describe CN_BODY_503   Body contains "Ö÷°ì"
+score CN_BODY_503      0.003
+
+body CN_BODY_512       /´óÏÃ/
+describe CN_BODY_512   Body contains "´óÏÃ"
+score CN_BODY_512      0.048
+
+body CN_BODY_532       /Á÷³Ì/
+describe CN_BODY_532   Body contains "Á÷³Ì"
+score CN_BODY_532      0.018
+
+body CN_BODY_537       /Óʱà/
+describe CN_BODY_537   Body contains "Óʱà"
+score CN_BODY_537      0.175
+
+body CN_BODY_545       /ÀíÄî/
+describe CN_BODY_545   Body contains "ÀíÄî"
+score CN_BODY_545      0.020
+
+body CN_BODY_553       /ÓòÃû/
+describe CN_BODY_553   Body contains "ÓòÃû"
+score CN_BODY_553      0.955
+
+body CN_BODY_556       /²É¹º/
+describe CN_BODY_556   Body contains "²É¹º"
+score CN_BODY_556      0.032
+
+body CN_BODY_579       /ѧԱ/
+describe CN_BODY_579   Body contains "ѧԱ"
+score CN_BODY_579      0.002
+
+body CN_BODY_583       /µÄÍøÕ¾/
+describe CN_BODY_583   Body contains "µÄÍøÕ¾"
+score CN_BODY_583      0.047
+
+body CN_BODY_606       /¹ÜÀí¡¢/
+describe CN_BODY_606   Body contains "¹ÜÀí¡¢"
+score CN_BODY_606      0.029
+
+body CN_BODY_628       /ʵս/
+describe CN_BODY_628   Body contains "ʵս"
+score CN_BODY_628      0.136
+
+body CN_BODY_660       /ÐË¡/
+describe CN_BODY_660   Body contains "ÐË¡"
+score CN_BODY_660      0.259
+
+body CN_BODY_668       /ÎïÁ÷/
+describe CN_BODY_668   Body contains "ÎïÁ÷"
+score CN_BODY_668      0.679
+
+body CN_BODY_669       /Îç²Í/
+describe CN_BODY_669   Body contains "Îç²Í"
+score CN_BODY_669      0.045
+
+body CN_BODY_682       /¸ßЧ/
+describe CN_BODY_682   Body contains "¸ßЧ"
+score CN_BODY_682      0.125
+
+body CN_BODY_684       /£¨¹úË°¡¢/
+describe CN_BODY_684   Body contains "£¨¹úË°¡¢"
+score CN_BODY_684      0.984
+
+body CN_BODY_685       /¹úÄÚÍâ/
+describe CN_BODY_685   Body contains "¹úÄÚÍâ"
+score CN_BODY_685      0.234
+
+body CN_BODY_692       /²ßÂÔ/
+describe CN_BODY_692   Body contains "²ßÂÔ"
+score CN_BODY_692      0.015
+
+body CN_BODY_725       /½ÏµÍ£¬»¹/
+describe CN_BODY_725   Body contains "½ÏµÍ£¬»¹"
+score CN_BODY_725      0.955
+
+body CN_BODY_727       /»¥¶¯/
+describe CN_BODY_727   Body contains "»¥¶¯"
+score CN_BODY_727      0.007
+
+body CN_BODY_729       /¹ÜÀíÈË/
+describe CN_BODY_729   Body contains "¹ÜÀíÈË"
+score CN_BODY_729      0.002
+
+body CN_BODY_765       /ÐÅÓþ/
+describe CN_BODY_765   Body contains "ÐÅÓþ"
+score CN_BODY_765      0.009
+
+body CN_BODY_777       /ÉÆÒâ/
+describe CN_BODY_777   Body contains "ÉÆÒâ"
+score CN_BODY_777      0.096
+
+body CN_BODY_793       /ʵÓÃ/
+describe CN_BODY_793   Body contains "ʵÓÃ"
+score CN_BODY_793      0.008
+
+body CN_BODY_795       /ÀñÆ·/
+describe CN_BODY_795   Body contains "ÀñÆ·"
+score CN_BODY_795      0.365
+
+body CN_BODY_800       /ºÚÌå/
+describe CN_BODY_800   Body contains "ºÚÌå"
+score CN_BODY_800      1.407
+
+body CN_BODY_833       /µçÆ÷/
+describe CN_BODY_833   Body contains "µçÆ÷"
+score CN_BODY_833      0.038
+
+body CN_BODY_840       /£¨6%/
+describe CN_BODY_840   Body contains "£¨6%"
+score CN_BODY_840      1.187
+
+body CN_BODY_843       /Êý¾Ý¿â/
+describe CN_BODY_843   Body contains "Êý¾Ý¿â"
+score CN_BODY_843      0.171
+
+body CN_BODY_858       /ÎÞÐè/
+describe CN_BODY_858   Body contains "ÎÞÐè"
+score CN_BODY_858      0.019
+
+body CN_BODY_863       /¼¼ÄÜ/
+describe CN_BODY_863   Body contains "¼¼ÄÜ"
+score CN_BODY_863      0.025
+
+body CN_BODY_868       /¼¨Ð§/
+describe CN_BODY_868   Body contains "¼¨Ð§"
+score CN_BODY_868      0.722
+
+body CN_BODY_872       /ÐÎÏó¡¢/
+describe CN_BODY_872   Body contains "ÐÎÏó¡¢"
+score CN_BODY_872      0.129
+
+body CN_BODY_874       /²ß»®/
+describe CN_BODY_874   Body contains "²ß»®"
+score CN_BODY_874      0.011
+
+body CN_BODY_895       /»ã¿î/
+describe CN_BODY_895   Body contains "»ã¿î"
+score CN_BODY_895      0.035
+
+body CN_BODY_898       /ÊÚ¿Î/
+describe CN_BODY_898   Body contains "ÊÚ¿Î"
+score CN_BODY_898      0.025
+
+body CN_BODY_907       /ËæÊÖ/
+describe CN_BODY_907   Body contains "ËæÊÖ"
+score CN_BODY_907      0.208
+
+body CN_BODY_912       /Îĵµ/
+describe CN_BODY_912   Body contains "Îĵµ"
+score CN_BODY_912      0.104
+
+body CN_BODY_916       /¡£ÎÒ˾/
+describe CN_BODY_916   Body contains "¡£ÎÒ˾"
+score CN_BODY_916      2.160
+
+body CN_BODY_920       /¡¢µç»°/
+describe CN_BODY_920   Body contains "¡¢µç»°"
+score CN_BODY_920      0.005
+
+body CN_BODY_927       /ÊÕÒæ/
+describe CN_BODY_927   Body contains "ÊÕÒæ"
+score CN_BODY_927      0.014
+
+body CN_BODY_930       /Ìîд/
+describe CN_BODY_930   Body contains "Ìîд"
+score CN_BODY_930      0.033
+
+body CN_BODY_945       /ΪÄú/
+describe CN_BODY_945   Body contains "ΪÄú"
+score CN_BODY_945      0.715
+
+body CN_BODY_947       /¶©µ¥/
+describe CN_BODY_947   Body contains "¶©µ¥"
+score CN_BODY_947      0.012
+
+body CN_BODY_955       /ÁªÏµÎÒÃÇ/
+describe CN_BODY_955   Body contains "ÁªÏµÎÒÃÇ"
+score CN_BODY_955      1.308
+
+body CN_BODY_981       /£¨5%/
+describe CN_BODY_981   Body contains "£¨5%"
+score CN_BODY_981      1.014
+
+body CN_BODY_994       /ÎÒÃǽ«/
+describe CN_BODY_994   Body contains "ÎÒÃǽ«"
+score CN_BODY_994      0.006
+
+body CN_BODY_995       /¼ÓÃË/
+describe CN_BODY_995   Body contains "¼ÓÃË"
+score CN_BODY_995      0.202
+
+body CN_BODY_999       /·Ñ¡¢/
+describe CN_BODY_999   Body contains "·Ñ¡¢"
+score CN_BODY_999      0.021
diff --git a/common/common_rbl b/common/common_rbl
new file mode 100644 (file)
index 0000000..229d836
--- /dev/null
@@ -0,0 +1,19 @@
+# blarson 2004-11-20
+header RCVD_IN_SBLXBL  eval:check_rbl('SBLXBL', 'sbl-xbl.spamhaus.org')
+describe RCVD_IN_SBLXBL listed in spamhaus.org sbl-xbl
+# blarson 2005-01-28 see which return part 2005-02-26 ajust scores
+score RCVD_IN_SBLXBL   1
+header RCVD_IN_SBLXBL_SBL eval:check_rbl_sub('SBLXBL', '127.0.0.2')
+score RCVD_IN_SBLXBL_SBL 2
+header RCVD_IN_SBLXBL_CBL eval:check_rbl_sub('SBLXBL', '127.0.0.4')
+score RCVD_IN_SBLXBL_CBL 1
+header RCVD_IN_SBLXBL_5 eval:check_rbl_sub('SBLXBL', '127.0.0.5')
+score RCVD_IN_SBLXBL_5 1
+header RCVD_IN_SBLXBL_OPM eval:check_rbl_sub('SBLXBL', '127.0.0.6')
+score RCVD_IN_SBLXBL_OPM 1
+
+header         RCVD_IN_NIX1            eval:check_rbl('NiX', 'ix.dnsbl.manitu.net.')
+describe RCVD_IN_NIX1          Received in NiX filter http://www.ix.de/nixspam/dnsbl/
+tflags         RCVD_IN_NIX1            net
+score  RCVD_IN_NIX1            1.5
+
diff --git a/common/common_spam b/common/common_spam
new file mode 100644 (file)
index 0000000..508efa2
--- /dev/null
@@ -0,0 +1,22 @@
+# this file includes rules that are common which have been split out
+# into separate files in this directory.
+
+include drug_spam
+
+include pron_spam
+
+include phrase_spam
+
+include misc_spam
+
+include money_spam
+
+meta DIGEST_MULTIPLE            RAZOR2_CHECK + PYZOR_CHECK > 1
+describe DIGEST_MULTIPLE        Message hits more than one network digest check
+tflags DIGEST_MULTIPLE          net
+#reuse DIGEST_MULTIPLE
+score DIGEST_MULTIPLE 0
+
+
+
+
diff --git a/common/debian_specific b/common/debian_specific
new file mode 100644 (file)
index 0000000..1041489
--- /dev/null
@@ -0,0 +1,25 @@
+# this contains headers and such which are Debian specific
+
+# cord, 20050811
+header HEADER_X_KATIE  exists:X-Katie
+describe HEADER_X_KATIE        X-Katie-Mailheader present
+score HEADER_X_KATIE   -2
+
+header RCVD_FROM_SPOHR Received =~ /^from spohr.debian.org \(spohr.debian.org \[140.211.166.43\]\)/
+describe RCVD_FROM_SPOHR Mail comes from Spohr
+score RCVD_FROM_SPOHR -2
+
+# Added by cord 2004/10/24 (to let Release-critical Bugreport through)
+whitelist_from_rcvd bugscan@debian.org debian.org 
+whitelist_from_rcvd webmaster@debian.org debian.org
+whitelist_from bugscan@debian.org
+header MURPHY_DEBIAN_MESSAGE   exists:X-Debian-Message
+describe MURPHY_DEBIAN_MESSAGE Found Debian-Header.
+# yea. this sucks. if a spammer finds out this... 
+score MURPHY_DEBIAN_MESSAGE    -10
+
+# joy, 2003-08-17
+header OUR_MTA_MSGID           Message-Id =~ /\@(master|murphy|gluck)\.debian\.org/
+describe OUR_MTA_MSGID         Sounds like a msgid autogenerated by our MTAs
+score OUR_MTA_MSGID            2
+
diff --git a/common/disabled_rules b/common/disabled_rules
new file mode 100644 (file)
index 0000000..e648cd6
--- /dev/null
@@ -0,0 +1,18 @@
+# The rule graveyard
+
+# don 2007-04-25
+#body GOTBODY          /.{21}/
+#score GOTBODY         0       
+
+#meta NOBODY           ! GOTBODY
+#describe NOBODY               No Body; probably spam  
+#score    NOBODY               0
+
+#header CONTROLSUB     Received =~ /control|request|(?:(?:un)?subscribe|subhelp|help|ignore|(?:sub(?:yes|approve|reject)|unsubyes|bounce|probe|approve|reject|setlistyes|setlistsilentyes))/i
+#describe CONTROLSUB   Message to control, request or subscription
+#score CONTROLSUB      0
+
+#meta NOBODYNOTCONT    NOBODY && ! CONTROLSUB
+#describe NOBODYNOTCONT        No body, and not a message that should have no body
+#score NOBODYNOTCONT   4       
+
diff --git a/common/drug_spam b/common/drug_spam
new file mode 100644 (file)
index 0000000..4a2af62
--- /dev/null
@@ -0,0 +1,205 @@
+# various drugs match these rules
+
+# blarson, 2004-05-10 -> lists --pasc 04/05/11
+body DRUGSPAM   /(\b|_)(c.?(i|\?|\=ed|\xed).?a.?l.?[ig].?s|v.?(i|1|=ed|\xed).?[\a@].?g.?r.?a|v.?i.?c.?o.?d.?i.?n|h.?y.?d.?r.?o.?c.?o.?d.?o.?n.?e|[xz].?a.?n.?a.\?x|p.?r.?o.?z.?a.?c|rx|hgh)(\b|_)/i
+describe DRUGSPAM       drug spam 
+score DRUGSPAM  3                                                                                                                              
+                                                                                                                                               
+# blarson, 2004-05-10 -> lists --pasc 04/05/11
+header DRUGSPAM2        subject =~ /(\b|_)(c.?(i|\?|\=ed|\xed).?a.?l.?[ig].?s|v\.?(i|1|=ed).?[a@].?g.?r.?a|v.?i.?c.?o.?d.?i.?n|h.?y.?d.?r.?o.?c.?o.?d.?o.?n.?e|\[xz].?a.?n.?a.?x|p.?r.?o.?z.?a.?c|rx|hgh)(\b|_)/i
+describe DRUGSPAM2      more drug spam
+score DRUGSPAM2         3
+
+# More drugs! --pasc 2003-05-13
+body           DRUGSPAM3       /(v.?i.?o.?x|x.?a.?n.?(a|@).?x|p.?h.?e.?n.?t.?r.?e.?m.?i.?n.?e|v.?i.?a.?g.?r.?a)/i
+describe       DRUGSPAM3       yet more drugs
+score          DRUGSPAM3       1
+
+body           MURPHY_DRUGS1   /v.?i.?a.?g.?r.?a/i
+describe       MURPHY_DRUGS1   Viagra
+score          MURPHY_DRUGS1   0.5
+
+body           MURPHY_DRUGS2   /v.?i.?o.?x/i
+describe       MURPHY_DRUGS2   Viox
+score          MURPHY_DRUGS2   0.5
+
+body           MURPHY_DRUGS3   /F.?i.?o.?r.?i.?c.?e.?e.?t/i
+describe       MURPHY_DRUGS3   Fioriceet
+score          MURPHY_DRUGS3   0.5
+
+body           MURPHY_DRUGS4   /P.?h.?e.?n.?t.?(r.?e|e.?r).?m.?i.?n.?e/i
+describe       MURPHY_DRUGS4   Phentremine
+score          MURPHY_DRUGS4   0.5
+
+body           MURPHY_DRUGS5   /v.?a.?l.?i.?u.?m/i
+describe       MURPHY_DRUGS5   Valium
+score          MURPHY_DRUGS5   0.5
+
+body           MURPHY_DRUGS6   /x.?(a|@).?n.?a.?x/i
+describe       MURPHY_DRUGS6   Xanax
+score          MURPHY_DRUGS6   0.5
+
+body           MURPHY_DRUGS7   /v.?i.?c.?o.?d.?i.?n/i
+describe       MURPHY_DRUGS7   Vicodin
+score          MURPHY_DRUGS7   0.5
+
+body           MURPHY_DRUGS8   /h.?y.?d.?r.?o.?c.?o.?d.?o.?n.?e/i
+describe       MURPHY_DRUGS8   Hydrocodone
+score          MURPHY_DRUGS8   0.5
+
+body           MURPHY_DRUGS_REL1       /medication/i
+score          MURPHY_DRUGS_REL1       0.5
+
+body           MURPHY_DRUGS_REL2       /P.?r.?e.?s.?c.?r.?i.?p.?t.?i.?o.?n/i
+score          MURPHY_DRUGS_REL2       0.5
+
+body           MURPHY_DRUGS_REL3       /health product/i
+score          MURPHY_DRUGS_REL3       0.5
+
+body           MURPHY_DRUGS_REL4       /drug.*expensive/i
+score          MURPHY_DRUGS_REL4       0.5
+
+body           MURPHY_DRUGS_REL5       /p.?h.?a.?r.?m.?a.?c.?e.?u.?t.?i.?c.?a.?l/i
+score          MURPHY_DRUGS_REL5       0.5
+
+body           MURPHY_DRUGS_REL6       /formula/i
+score          MURPHY_DRUGS_REL6       0.2
+
+body           MURPHY_DRUGS_REL7       /dosing/i
+score          MURPHY_DRUGS_REL7       0.2
+
+body           MURPHY_DRUGS_REL8       /patch/i
+score          MURPHY_DRUGS_REL8       0.02
+
+body           MURPHY_DRUGS_REL9       /pill/i
+score          MURPHY_DRUGS_REL9       0.2
+
+body           MURPHY_DRUGS_REL10      /bacteria/i
+score          MURPHY_DRUGS_REL10      0.1
+
+body           MURPHY_DRUGS_REL11      /antidote/i
+score          MURPHY_DRUGS_REL11      0.1
+
+meta           MURPHY_DRUGS_META1      (MURPHY_DRUGS1 + MURPHY_DRUGS2 + MURPHY_DRUGS3 + MURPHY_DRUGS4 + MURPHY_DRUGS5 + MURPHY_DRUGS6 + MURPHY_DRUGS7 + MURPHY_DRUGS8 + MURPHY_DRUGS_REL1 + MURPHY_DRUGS_REL2 + MURPHY_DRUGS_REL3 + MURPHY_DRUGS_REL4 + MURPHY_DRUGS_REL5 + MURPHY_DRUGS_REL9 + MURPHY_DRUGS_REL10 + MURPHY_DRUGS_REL11) > 1
+score          MURPHY_DRUGS_META1      3.0
+
+meta           MURPHY_DRUGS_META2      (MURPHY_DRUGS1 + MURPHY_DRUGS2 + MURPHY_DRUGS3 + MURPHY_DRUGS4 + MURPHY_DRUGS5 + MURPHY_DRUGS6 + MURPHY_DRUGS7 + MURPHY_DRUGS8 + MURPHY_DRUGS_REL1 + MURPHY_DRUGS_REL2 + MURPHY_DRUGS_REL3 + MURPHY_DRUGS_REL4 + MURPHY_DRUGS_REL5 + MURPHY_DRUGS_REL11 + MURPHY_DRUGS_REL10 + MURPHY_DRUGS_REL9) > 2
+score          MURPHY_DRUGS_META2      4.0
+
+
+meta           MURPHY_DRUGS_META3      (MURPHY_DRUGS_REL6 + MURPHY_DRUGS_REL7 + MURPHY_DRUGS_REL8 + MURPHY_DRUGS_REL9) > 1
+score          MURPHY_DRUGS_META3      2.0
+
+meta DRUGS_STOCK_MIMEOLE (__MIMEOLE_1106 && __MAILER_OL_5510)
+header __MIMEOLE_1106   X-MimeOLE =~ /^Produced By Microsoft MimeOLE V6.00.2800.1106$/
+header __MAILER_OL_5510 X-Mailer =~ /^Microsoft Office Outlook, Build 11.0.5510$/
+describe DRUGS_STOCK_MIMEOLE Stock-spam forged headers found (5510)
+score DRUGS_STOCK_MIMEOLE 3
+
+# More penis enlargement --pasc 061012
+body   M_BIGGER1 /gain \d inches/i
+score  M_BIGGER1 5
+
+# cjwatson, 2003/02/26
+body AMAZINGHEALTHGROUP                /www\.amazinghealthgroup\.com/
+describe AMAZINGHEALTHGROUP    Amazing Spam Group
+score AMAZINGHEALTHGROUP       4.0
+
+# joy, 2003-09-16
+body PHARMACYSPAM1     /http:\/\/www.pharmacy[^\.]+.biz/i
+describe PHARMACYSPAM1 pharmacy spam 1
+score PHARMACYSPAM1    4
+
+header PHARMACYSPAM2   Subject =~ /Best Discount Online Drugs/i
+describe PHARMACYSPAM2 pharmacy spam 2
+score PHARMACYSPAM2    4
+
+# joy, 2003-11-09
+body PRESCRIPTION      /prescription/i
+describe PRESCRIPTION  pharmacy spam
+score PRESCRIPTION     2
+
+body PHARMACY          /pharmacy/i
+describe PHARMACY      pharmacy spam
+score PHARMACY         1
+
+body FDAAPPROVEDB      /(USA?|FDA)( official)?[ -]approved/
+describe FDAAPPROVEDB  US FDA approved pharmacy spam
+score FDAAPPROVEDB     2
+
+header FDAAPPROVEDS    Subject =~ /(USA?|FDA)( official)?[ -]approved/
+describe FDAAPPROVEDS  US FDA approved pharmacy spam
+score FDAAPPROVEDS     3
+
+# cjwatson, 2004-01-16
+body MYPILLSOURCE      /mypillsource\.com/
+describe MYPILLSOURCE  mypillsource.com spam
+score MYPILLSOURCE     4
+
+# cjwatson, 2004-02-18
+body HGH_PROVEN                /HGH is proven to help/
+describe HGH_PROVEN    Yeah, sure
+score HGH_PROVEN       3
+
+# cjwatson, 2004-02-22
+header CIALGS          Subject =~ /sug?per viagrga/
+describe CIALGS                Viagra derivative spam
+score CIALGS           4
+
+# cjwatson, 2004-03-01, 2004-03-05
+body LAY_THE_PIPE      /the next (chick|girl) you (screw|bang)/
+describe LAY_THE_PIPE  Viagra spam
+score LAY_THE_PIPE     4
+
+# blarson 2004-04-13
+body SPERM             /\bsperm/i
+describe SPERM         fertility spam
+score SPERM            3
+
+# blarson 2005-06-04
+header MED             subject =~ /\b(?:doctor|health|medic(?:al|ine))$/
+describe MED           medical spam
+score MED              2
+
+# blarson 2006-09-25
+body HOODIA            /\bh.?oodia/i
+describe HOODIA                weight loss scam
+score HOODIA           3
+
+# dla 2007-02-27
+header PHARRMACY       subject =~ /Can+adian\s+Fami+ly\s+Phar+macy/i
+describe PHARRMACY     pharrmacy can't spell
+score  PHARRMACY       3
+
+# don 2007-05-20 
+body MALEENHANCE       /male\s+enhan[c\(]e/i
+describe MALEENHANCE   Enhanced males
+score MALEENHANCE      2
+
+# blarson 2007-05-20
+body SIZEMAT           /\b(?:Does Size|size does) Matter\b/i
+describe SIZEMAT       size matters spam
+score SIZEMAT          2
+
+# blarson 2007-08-30
+body SIZEMAT           /\bsizematters\.cn\b/i
+describe SIZEMAT       size matters
+score SIZEMAT          4
+
+# blarson 2007-06-19
+body ENLARGEPL         /\benlargeplus\b/
+describe ENLARGEPL     more penis spam
+score ENLARGEPL                3
+
+# blarson 2007-07-19
+body PHYSCONS          /^After this we will require a physician consultation/
+describe PHYSCONS      more php spam
+score PHYSCONS         3
+
+
+# blarson 2007-08-12
+body GETABIG           /\bwww\.getabiggercock\.net\b/i
+describe GETABIG       cock spam
+score GETABIG          4
+
+
diff --git a/common/list_specific b/common/list_specific
new file mode 100644 (file)
index 0000000..a5726c2
--- /dev/null
@@ -0,0 +1,72 @@
+# This configuration file contains lists.debian.org specific rulessets
+
+# our MTAs fix up headers for a slew of spams, so mark these as suspicious
+# -- joy, 2003-06-28
+header OUR_MTA_MSGID           Message-Id =~ /\@(murphy|master|gluck)\.debian\.org/
+describe OUR_MTA_MSGID         Sounds like a MsgId autogenerated by our MTAs
+score OUR_MTA_MSGID            1
+
+# -- joy, 2003-08-15
+header SENDER_FOR_US   From =~ /\@(murphy|master|gluck|lists)\.debian\.org/
+describe SENDER_FOR_US Sounds like a mail aimed at tricking our MTAs
+score SENDER_FOR_US    2
+
+# exception... --joy, 2003-07-12
+header WEBSUBS                 X-Remote-IP =~ /./
+describe WEBSUBS               Sounds like a subscription request from the web
+score WEBSUBS                  -2
+
+# another exception... --joy, 2003-07-27
+header SUBSCONFIRM             Subject =~ /CONFIRM [su]\d+/
+describe SUBSCONFIRM           Sounds like a subscription request confirmation
+score SUBSCONFIRM              -2
+
+# some valid autogenerated mail of ours
+# -- joy, 2003-07-09
+header OUR_SCRIPTS_1           Orig-From =~ /.+\@debian\.org \(.+ as listmaster\)/
+describe OUR_SCRIPTS_1         Mail likely generated by .bin/mladmin
+score OUR_SCRIPTS_1            -5
+
+# our daily un/subscription report gets ~8 SA points !
+# lower it to 3
+# -- zobel, 2006-12-10
+header _OUR_UNSUB_CHANGES1     Subject =~ /Daily un\/subscription report/
+meta OUR_UNSUB_CHANGES         (_OUR_UNSUB_CHANGES1 && OUR_MTA_MSGID)
+describe OUR_UNSUB_CHANGES     Daily mail sent to listmaster about un/subscriptions
+score OUR_UNSUB_CHANGES                -5
+
+# exception... --joy, 2003-08-15
+body MDOMOSUBS         /^Request forwarded.$/
+describe MDOMOSUBS     Sounds like a subscription request via majorsmart
+score MDOMOSUBS                -2
+
+# another exception --joy, 2004-05-27
+#body OURCRONMAILS     Subject =~ /^Cron \<list\@.*\/var\/list\//
+#describe OURCRONMAILS Sounds like a legitimate cron job mail
+#score OURCRONMAILS    -3
+
+header MURPHY_LOCAL_FORWARDED  Resent-From =~ /murphy\.debian\.org/
+describe MURPHY_LOCAL_FORWARDED        Mail has been locally forwarded.
+score MURPHY_LOCAL_FORWARDED   -5
+
+# temp work-around for d-l-f
+
+header RFR  Subject =~ /\[RFR\]/
+describe RFR Request for revision
+score RFR -5
+
+# pasc 2004-02-02
+header AM_REPORT       Subject =~ /AM Report for Week Ending/
+describe AM_REPORT     Auto-generated AM summary
+score AM_REPORT                -5
+
+# automated reports on debian-l10n-french
+header MURPHY_MIGUS_REPORT     Subject =~ /Etat dans le CVS des/
+describe MURPHY_MIGUS_REPORT   Auto-generated report from migus on translations
+score MURPHY_MIGUS_REPORT      -5
+
+# our own whitelisting of subscribers
+header LDOSUBSCRIBER           X-Subscriber-murphy.debian.org =~ /./
+describe LDOSUBSCRIBER         Sender is a lists.debian.org subscriber
+score LDOSUBSCRIBER            -6
+
diff --git a/common/misc_spam b/common/misc_spam
new file mode 100644 (file)
index 0000000..097ae87
--- /dev/null
@@ -0,0 +1,274 @@
+# This seems to catch a lot of spam, but not sure about false positive (from airmax.cf)
+# pasc couldn't find any false positives on the lists he's on
+header   X_MESSAGE_INFO exists:X-Message-Info
+score    X_MESSAGE_INFO 4.0
+
+# Added by pasc 2004/07/08 (sent by abuse@outblaze via karsten)
+# host no longer exists according to administrator
+header FAKE_OUTBLAZE_RCVD      Received =~ /\.mr\.outblaze\.com/
+describe FAKE_OUTBLAZE_RCVD    Received header contains faked 'mr.outblaze.com'
+score FAKE_OUTBLAZE_RCVD       3.0
+
+# blarson 2005-01-19 (--pasc 2005-01-30)
+header TRACKING         subject =~ /\b(?:tracking|package|shipping|shipment|delivery) number :/i
+describe TRACKING       tracking number
+score TRACKING          2
+
+# Sent in by blars (20050220) -- applied by pasc
+body GUEBDE     /http\:\/\/www\.gueb\.de\//
+describe GUEBDE www.geub.de
+score GUEBDE    5
+
+
+# TODO: The rules below seem to be very similar; possibly fix them.
+
+# These might trip up on non-english lists. We'll see.
+# They're fucking up on GPG signatures
+body MURPHY_WRONG_WORD1        /[bcdfghjklmnpqrstvwxz]{7,}/i
+score MURPHY_WRONG_WORD1 0.1
+
+body MURPHY_WRONG_WORD2 /[bcdfghjklmnpqrstvwxz]{6,}/i
+score MURPHY_WRONG_WORD2 0.2
+
+#Impronounceable. Need to check this one for accuracy (from airmax.cf)
+body IMPRONONCABLE_1                            /([bcdfghjklmnpqrstvwxz]){5,20}/
+describe IMPRONONCABLE_1                        Some words aren't easy to pronounce (too much vowels)
+body IMPRONONCABLE_2                            /(([abcdefghijklmnopqrstvwxyz]){1,9}\d{1,4}){2,9}/
+describe IMPRONONCABLE_2                        Some words aren't easy to pronounce (mixed numbers and lower-case letters)
+
+# From http://www.exit0.us/index.php/FredsRules
+# Added by pasc 2004/06/20
+
+body      __FVGT_b_OBFU_J      /j(b|c|f|g|w)/i
+body      __FVGT_b_OBFU_OTHER  /(vj|vk|xj|xk|yy|zf|zj)/i
+body      __FVGT_b_OBFU_Q0     /(j|k|p|q|t|v|w|z)q/i
+body      __FVGT_b_OBFU_Q1     /q(a|f|h|j|k|m|n|s|y)/i
+body      __FVGT_b_OBFU_V      /(f|g|q|w)v/i
+body      __FVGT_b_OBFU_X      /(c|g|j|k|q|s|v|z)x/i
+body      __FVGT_b_OBFU_Z      /(f|j|k|p|q|x)z/i
+meta      FVGT_m_MULTI_ODD     ((__FVGT_b_OBFU_J + __FVGT_b_OBFU_OTHER + __FVGT_b_OBFU_Q0 + __FVGT_b_OBFU_Q1 + __FVGT_b_OBFU_V + __FVGT_b_OBFU_X + __FVGT_b_OBFU_Z) > 1)
+describe  FVGT_m_MULTI_ODD      FVGT - contains multiple odd letter combinations
+score     FVGT_m_MULTI_ODD      0.02
+
+# joy, 2003-07-20
+header NEPEYO                  From =~ /nepeyo\@catlover/
+describe NEPEYO                        spamvertizers
+score NEPEYO                   4
+
+# cjwatson, 2003/07/28
+header MP3_PLAYERS             Subject =~ /New mp3 player,usb flash drive/
+describe MP3_PLAYERS           Spam from "HY Tech"
+score MP3_PLAYERS              4
+
+# joy, 2003-08-15
+header UOSJUNK                 Subject =~ /UOS online Degree Programme/i
+describe UOSJUNK               Spam from UOS
+score UOSJUNK                  4
+
+# cjwatson, 2004-02-27
+body GAS_MILEAGE       /This amazing, revolutionary device|www\.mrev\.biz/
+describe GAS_MILEAGE   Fuel-saving snake oil
+score GAS_MILEAGE      3
+
+# blarson, 2004-03-31
+body FUELSAVER         /fuel.?saver/i
+describe FUELSAVER     Fuel Saver spam
+score FUELSAVER                3
+
+# blarson, 2004-04-03
+body CABLEFILTERZ      /cablefilterz/
+describe CABLEFILTERZ  cablefilterz spam
+score CABLEFILTERZ     4
+
+# blarson 2004-04-15
+header PARENNUM                subject =~ /^\(\s*([0-9\/]+\)|\%RND)/
+describe PARENNUM      paren number in subject
+score PARENNUM         3
+
+# blarson 2004-04-25
+# bounces our bounces.... (had negitive score)
+header COVADRT         X-RT-Loop-Prevention =~ /^Covad$/
+describe COVADRT       Covad request tracker bounces
+score COVADRT          8
+
+# blarson 2005-03-02
+header ROBERTOJIMENOCA from =~ /ROBERTOJIMENOCA\@terra\.es/
+describe ROBERTOJIMENOCA ROBERTOJIMENOCA sends spammy looking messages
+score ROBERTOJIMENOCA  -2
+
+# blarson 2005-07-10
+header TURBOPRO                subject =~ /\bturbonet pro\b/i
+describe TURBOPRO      dialup accelerator spam
+score TURBOPRO         3
+
+# blarson 2006-04-28
+header RESUBJECT       subject =~ /\sRe(?:\[\d+\])?:\s*$/i
+describe RESUBJECT     re nothing
+score RESUBJECT                2
+
+# blarson 2004-10-22 2007-07-18 up score
+header NOSUBJECT       subject =~ /^\s*$/
+describe NOSUBJECT     No subject
+score NOSUBJECT                2.5
+
+# blarson 2006-10-17
+full NEXTPART  /\-\=\_NextPart\_000\_/
+describe NEXTPART      spammer mime separator
+score NEXTPART         2.5
+
+# blarson 2006-10-17
+full CT_IMAGE          /Content\-Type\:\s*image/i
+describe CT_IMAGE      Picture attached
+score CT_IMAGE         1
+
+# blarson 2006-12-01 (score so low since it will also hit CT_IMAGE)
+header CT_IMAGE_HEAD   content-type =~ /image/
+describe CT_IMAGE_HEAD entire message is image
+score CT_IMAGE_HEAD    2.5
+
+
+# don 2006-10-25
+header THREADINDEX     Thread-Index =~ /A-Z/
+describe THREADINDEX   thread-index header on spam
+score   THREADINDEX    1.5
+
+# blarson 2006-10-30
+header FORDASH         subject =~ /\bFor \- \d+/
+describe FORDASH       for dash
+score FORDASH          3
+
+# blarson 2006-11-01
+header KOREAN          subject =~ /\=\?koi8\-r/
+describe KOREAN                Korean Character set spam
+score KOREAN           2
+
+# blarson 2006-12-04
+header FWDNAME         subject =~ /fwd\: \w+\s*$/
+describe FWDNAME       fwd: name spam
+score FWDNAME          3
+
+# blarson 2006-12-06
+body NUMONLY           /^\s*\d+\s*$/
+describe NUMONLY       number only body
+score NUMONLY          1
+
+# blarson 2007-04-24
+header THUNDERB                User-Agent =~ /^Thunderbird 1\.5\.0\.10/
+describe THUNDERB      spam missing content
+score THUNDERB         2
+
+
+# blarson 2007-06-15
+header FAILNOTE                subject =~ /Failure notice\:/
+describe FAILNOTE      bounced spam
+score FAILNOTE         2
+
+# blarson 2007-06-28
+rawbody CTINLINE       /^Content\-Disposition\: inline\;\b/
+describe CTINLINE      Inline attachment
+score CTINLINE         1
+
+# blarson 2007-07-07
+body BOXTRAPPER                /^This message is a reply to a boxtrapper verifcation message\./
+describe BOXTRAPPER    boxtrapper spam
+score BOXTRAPPER       9
+
+# blarson 2007-07-09
+body PROMOCODE         /^promo code\:/i
+describe PROMOCODE     promo code
+score PROMOCODE                3
+
+# blarson 2007-07-11
+body XLMAN             /\bwww\.xl\-man\.net\b/
+describe XLMAN         xl-man spam
+score XLMAN            3
+
+# blarson 2007-07-12
+body COSTUMER          /^Dear costumer\b/
+describe COSTUMER      paypal scam
+score COSTUMER         3
+
+# blarson 2007-07-13
+body PRIVATE           /^Your private and confidential message is attached\./
+describe PRIVATE       private message
+score PRIVATE          4
+
+# don 2007-07-15
+header AUTOGENERATE    auto-submitted =~ /auto/i
+describe AUTOGENERATE  auto generated crap
+score AUTOGENERATE     3
+
+# blarson 2007-07-15
+body PRIVPDF           /^All our private messages are in pdf format/
+describe PRIVPDF       private pdf
+score PRIVPDF          4
+
+# don 2007-07-19
+header AUTORESPOND     X-Autorespond =~ /./
+describe AUTORESPOND   Automatic response
+score  AUTORESPOND     4
+
+header AUTOMAILER      X-Mailer =~ /autors/
+describe AUTOMAILER    Auto response mailer
+score AUTOMAILER       3       
+
+# blarson 2007-07-22
+header OUTOFOFFICE_SUB subject =~ /Out_of_Office/
+describe OUTOFOFFICE_SUB       broken autoresponder
+score OUTOFOFFICE_SUB  6
+
+body OUTOFOFFICE       /out of the office/i
+describe OUTOFOFFICE   Out of the office
+score OUTOFOFFICE      3
+
+# blarson 2007-08-01 \w was too broad 2007-08-12 add dash, at least 3 digits
+header SUBENDNUM       subject =~ /[a-zA-Z!]-?\d{3,}$/
+describe SUBENDNUM     Subject ends in word989
+score SUBENDNUM                2
+
+# blarson 2007-07-27
+body PRIVMES           /^You have been sent a private message/
+describe PRIVMES       more pdf spam
+score PRIVMES          3
+
+# blarson 2007-07-27
+header MIXEDBDN                Content-Type =~ /multipart\/mixed\;.*boundary\=\"\-{4,}\d{4,}\"/
+describe MIXEDBDN      more pdf spam
+score MIXEDBDN         3
+
+# blarson 2007-07-28
+header DOTZIP          subject =~ /\d\.zip\b/
+describe DOTZIP                zip spam
+score DOTZIP           3
+
+# blarson 2007-07-30
+header MIXED2          Content-Type =~ /multipart\/mixed\;charset\=iso\-8859\-1\;.*boundary\=\"\-\-\-\-\=\_\d{8,}\_\d{4,}\"/
+describe MIXED2                more pdf spam
+score MIXED2           2.5
+
+# blarson 2007-07-31
+header KEYENCE         From =~ /KEYENCE CORPORATION/
+describe KEYENCE       opt out spam
+score KEYENCE          10
+
+# blarson 2007-08-02
+header NOSUB           subject =~ /\(No Subject\)$/i
+describe NOSUB         explicity no subject
+score NOSUB            1
+
+# blarson 2007-08-07
+header CTPDF           Content-Type =~ /\bapplication\/pdf\;/i
+describe CTPDF         more pdf spam
+score CTPDF            4
+
+# blarson 2007-06-12
+header JAPSUB          subject =~ /\=\?iso\-2022\-jp/i
+describe JAPSUB                subject in japanese
+score JAPSUB           3
+
+# blarson 2007-08-24
+header XMSATT          X-MS-Has-Attach =~ /yes/i
+describe XMSATT                more pdf spam
+score XMSATT           2
+
+
diff --git a/common/money_spam b/common/money_spam
new file mode 100644 (file)
index 0000000..199e2df
--- /dev/null
@@ -0,0 +1,245 @@
+# Spam dealing with selling stuff, stocks, etc. is matched by these
+# rules
+
+# Financial/mortage spam --pasc 04/05/12
+# Added the _L set --pasc 04/05/14
+body   MURPHY_FINANCE1 /m.?(o|\?).?r.?t.?g.?a.?g.?e.?a.?p.?p.?l.?i.?c.?a.?t.?(i|\?).?o.?n/
+score  MURPHY_FINANCE1 0.1
+
+body   MURPHY_FINANCE2 /b.?a.?d.?c.?r.?(e|\?).?d.?i.?t/
+score  MURPHY_FINANCE2 0.1
+
+body   MURPHY_FINANCE3 /lowest fixed rate/
+score  MURPHY_FINANCE3 0.1
+
+body   MURPHY_FINANCE4 /application (is )?accepted/i
+score  MURPHY_FINANCE4 0.1
+
+body   MURPHY_FINANCE5 /loan/i
+score  MURPHY_FINANCE5 0.1
+
+body   MURPHY_FINANCE6 /payment/i
+score  MURPHY_FINANCE6 1.7
+
+body   MURPHY_FINANCE7 /re.?finance/i
+score  MURPHY_FINANCE7 0.1
+
+body   MURPHY_FINANCE8 /interest.?rate/i
+score  MURPHY_FINANCE8 0.1
+# YEs I know about MURPHY_FINANCE1
+body   MURPHY_FINANCE9 /m.?(o|\?).?r.?t.?g.?a.?g.?e/i
+score  MURPHY_FINANCE9 0.1
+
+body   MURPHY_FINANCE10 /borrow/i
+score  MURPHY_FINANCE10 0.5
+
+body   MURPHY_FINANCE11 /pre.?approved/i
+score  MURPHY_FINANCE11 1.0
+
+body   MURPHY_FINANCE_L1 /app(l|1)y/i
+score  MURPHY_FINANCE_L1 0.0
+
+body   MURPHY_FINANCE_L2 /bil(l|1)/i
+score  MURPHY_FINANCE_L2 0.0
+
+body   MURPHY_FINANCE_L3 /budget/i
+score  MURPHY_FINANCE_L3 0.0
+
+body   MURPHY_FINANCE_L4 /home value/i
+score  MURPHY_FINANCE_L4 0.0
+
+body   MURPHY_FINANCE_L5 /quote/i
+score   MURPHY_FINANCE_L5 0.0
+
+body   MURPHY_FINANCE_L6 /income verification/i
+score  MURPHY_FINANCE_L6 0.0
+
+
+# meta MURPHY_FINANCE_LOW (MURPHY_FINANCE_L1 + MURPHY_FINANCE_L2 + MURPHY_FINANCE_L3 + MURPHY_FINANCE_L4 + MURPHY_FINANCE_L5 + MURPHY_FINANCE_L6) > 1
+# score        MURPHY_FINANCE_LOW 1.0
+
+# meta MURPHY_FINANCE_META1    (MURPHY_FINANCE_LOW + MURPHY_FINANCE1 + MURPHY_FINANCE2 + MURPHY_FINANCE3 + MURPHY_FINANCE4 + MURPHY_FINANCE5 + MURPHY_FINANCE6 + MURPHY_FINANCE7 + MURPHY_FINANCE8 + MURPHY_FINANCE9 + MURPHY_FINANCE10 + MURPHY_FINANCE11) > 1
+# score        MURPHY_FINANCE_META1    3.0
+
+# Try and catch some of this new spam --pasc 06/10/12
+body   M_CASH1 /(prompt|instant|immediate)(aneous)? (cash|funds|capital|finances)/i
+score  M_CASH1 5
+
+# Make money fast --pasc 061016
+body   M_CASH2 /(Learn|Find out) how to (make|generate).*k (daily|(a|per) day) from (your )?(home|house)/
+score  M_CASH2 5
+
+#Stock market scam --pasc 061016
+body   M_CASH3 /this symbol will experience (phenomenal|fantastic|amazing) (growth|increase)/i
+score  M_CASH3 5
+
+# cjwatson, 2004-01-14
+header STOCK_MARKET    Subject =~ /STOCK MARKET ALERT/
+describe STOCK_MARKET  stock market spam
+score STOCK_MARKET     4
+
+# cjwatson, 2004-02-12
+body GOLDMINE          /GOLD MINE SWEEPSTAKES LOTTERY/
+describe GOLDMINE      You have won a prize! Sure.
+score GOLDMINE         3
+
+# blarson, 2004-03-18
+body CASINO            /casino/i
+describe CASINO                Casino spam
+score CASINO           2
+
+# blarson, 2005-09-21
+body MORTGAGE          /m\s*[o0]\s*r\s*t?\s*g\s*a\s*g+\s*e/i
+describe MORTGAGE      Mortgage spam
+score MORTGAGE         2
+
+# blarson 2004-04-27
+body CORELDRAW         /Corel Draw (graphics suite)?11/i
+describe CORELDRAW     Corel sales spam
+score CORELDRAW                3
+
+# blarson 2004-04-10
+body FREESHIPPING      /\bf.?r.?e.?e.?\s+s.?h.?[il1].?p.?p.?[il1].?n.?g\b/i
+describe FREESHIPPING  free shipping
+score FREESHIPPING     3
+
+# blarson 2004-04-27
+body   STOK            /\b(OSSI|AMTK|LETH|QIIIF)\b/
+describe STOK          stock spam
+score STOK             3
+
+# blarson 2004-04-18
+body BANNEDCD          /(banned|underground)\s*cd/i
+describe BANNEDCD      banned cd spam
+score BANNEDCD         3
+
+# cjwatson, 2003/10/09
+body TIMESHARE         /Would you like to sell or rent your Timeshare for a profit\?/
+describe TIMESHARE     Oddly enough, bugs don't own timeshares
+score TIMESHARE                4
+
+# blarson 2004-05-02
+body AUTOWAR           /\b(auto|car)\s*warr?[ae]nt(y|ee|ie)/i
+describe AUTOWAR       auto warrenty spam
+score AUTOWAR          3
+
+# blarson 2004-05-02
+body FORONLY           /for\s+only\s+\$/i
+describe FORONLY       sales spam
+score FORONLY          2
+
+# blarson 2005-04-15
+body ROLEX             /\br[o0a][l1w][l1]?[ea][xzc]/i
+describe ROLEX         Rolex
+score ROLEX            3
+
+# blarson 2005-04-15
+header HANDCLOCK       subject =~ /\bhand\s*-?clock/i
+describe HANDCLOCK     Hand Clock
+score HANDCLOCK                3
+
+# blarson 2004-10-29
+header REPLICAWATCH    subject =~ /replica\s*watch/i
+describe REPLICAWATCH  Replica Watch
+score REPLICAWATCH     2
+
+# blarson 2004-10-29
+body HANDBAG           /hand\s*-?bag/i
+describe HANDBAG       Handbag
+score HANDBAG          2
+
+# blarson 2004-11-11
+header ECONOBETTER     subject =~ /Economy is much better/i
+describe ECONOBETTER   Economy is much better
+score ECONOBETTER      3
+
+# blarson 2004-11-11
+header MRG             subject =~ /\bmrg\b/i
+describe MRG           mrg mortgage spammer
+score MRG              2
+
+# blarson 2004-11-08
+body CITIBANK          /\bciti.?bank\b/i
+describe CITIBANK      citibank scam
+score CITIBANK         2
+
+# blarson 2005-01-14
+body HOMEOWNER         /home.?owner/i
+describe HOMEOWNER     home owner
+score HOMEOWNER                2
+
+# blarson 2005-03-09
+body THOUSANDZ         /\bTHOUSANDZ\b/
+describe THOUSANDZ     loan spam
+score THOUSANDZ                3
+
+# blarson 2005-04-15
+header EBAY            subject =~ /\bebay\s+account\b/i
+describe EBAY          ebay account
+score EBAY             3
+
+# don 2006-10-19
+body INVESTOR_ALERT    /an\s*investor\s*alert/i
+describe INVESTOR_ALERT stock spam
+score INVESTOR_ALERT    2
+
+# don 2006-10-19
+body STOCK_ALERT    /stock.+press\s*release.+stock/i
+describe STOCK_ALERT   stock scam
+score  STOCK_ALERT     2
+
+# blarson 2006-10-25
+header NEWSOFTWARE     subject =~ /\bNew software uploaded by\b/i
+describe NEWSOFTWARE   new software spam
+score NEWSOFTWARE      4
+
+# blarson 2006-11-13
+body REFI              /\bhome re-fi\b/i
+describe REFI          mortgage spam
+score REFI             3
+
+# don 2006-11-25
+full COMPANYSYMBOLPRICE     /((company|symbol|price|marke?t|schlusskurs)\:.+){3,}/si
+describe COMPANYSYMBOLPRICE Stock scam
+score COMPANYSYMBOLPRICE    3
+
+# blarson 2007-04-09
+body PRETTYRUS         /\b(pretty|cute) russian (girl|woman)\b/i
+describe PRETTYRUS     pretty russian spam
+score PRETTYRUS                3.5
+
+# blarson 2007-04-17
+header INVESTORS       subject =~ /\b(investors?|portfolio|radar)\b/i
+describe INVESTORS     stock spam
+score INVESTORS                2
+
+# blarson 2007-04-20
+body ANALLE            /\bAN ALLE FINANZINVESTOREN\b/
+describe ANALLE                stock spam in german
+score ANALLE           3
+
+# blarson 2007-06-17
+body REPWATCH2         /\breplica watch/i
+describe REPWATCH      still pushing fake watches
+score REPWATCH2                2
+
+# blarson 2007-07-19
+header WEEKLYNEWS      subject =~ /\bWeekly (:?Sales? )(Newsletter|Special)\b/i
+describe WEEKLYNEWS    weekly spam
+score WEEKLYNEWS       3
+
+# blarson 2007-07-23
+body COSTWATCH         /\b(dollar|costly|valuable|pricey|expensive)\s+watch\b/i
+describe COSTWATCH     watch spam
+score COSTWATCH                4
+
+# don 2007-07-26
+body LEADINGPROVIDER   /leading\s+providers?.*consult/i
+describe LEADINGPROVIDER Leading provider of consulting
+score LEADINGPROVIDER  2
+
+# blarson 2007-07-31
+body REFI              /\bRe-Fi\b/i
+describe REFI          mortgage spam
+score REFI             2
+
diff --git a/common/phrase_spam b/common/phrase_spam
new file mode 100644 (file)
index 0000000..552fdbb
--- /dev/null
@@ -0,0 +1,414 @@
+# Added some rules from Rule du Jour that I've been testing for a while
+
+#Monotone (from airmax.cf)
+body     MONOTONE_WORDS_2_15            /^([a-z]{2,20}[\s\.]+){15}/
+describe MONOTONE_WORDS_2_15            Lines with many (long) lowercase words (15+ words, 2+ letters)
+body     MONOTONE_WORDS_2_30            /^([a-z]{2,20}[\s\.]+){30}/
+describe MONOTONE_WORDS_2_30            Lines with many (long) lowercase words (30+ words, 2+ letters)
+body     MONOTONE_WORDS_3_20            /^([a-z]{3,20}[\s\.]+){20}/
+describe MONOTONE_WORDS_3_20            Lines with many (long) lowercase words (20+ words, 3+ letters)
+body     MONOTONE_WORDS_5_8                     /^([a-z]{5,20}[\s\.]+){8}/
+describe MONOTONE_WORDS_5_8                     Lines with many (long) lowercase words (8+ words, 5+ letters)
+body     MONOTONE_WORDS_5_12            /^([a-z]{5,20}[\s\.]+){12}/
+describe MONOTONE_WORDS_5_12            Lines with many (long) lowercase words (12+ words, 5+ letters)
+body     MONOTONE_WORDS_5_20            /^([a-z]{5,20}[\s\.]+){20}/
+describe MONOTONE_WORDS_5_20            Lines with many (long) lowercase words (20+ words, 5+ letters)
+
+# Lots of auto-responders seem to have this
+body   MDO_AUTORESP1   /online form/i
+score  MDO_AUTORESP1   0.1
+
+body   MDO_AUTORESP2   /large amount of (spam|virus)/i
+score  MDO_AUTORESP2   0.1
+
+body   MDO_AUTORESP3   /(electronically|automatically) (generated|created) (email|ack)/i
+score  MDO_AUTORESP3   0.1
+
+body   MDO_AUTORESP4   /(respond|answer) your enquiry/i
+score  MDO_AUTORESP4   0.1
+
+body   MDO_AUTORESP5   /(email|enquiry) has been received/i
+score  MDO_AUTORESP5   0.1
+
+body   MDO_AUTORESP6   /will be answered within/i
+score  MDO_AUTORESP6   0.1
+
+body   MDO_AUTORESP7   /the e-mail address to which you have written does not support incoming messages/i
+score  MDO_AUTORESP7   0.1
+
+meta   MDO_AUTORESP_META1      (MDO_AUTORESP1 + MDO_AUTORESP2 + MDO_AUTORESP3 + MDO_AUTORESP4 + MDO_AUTORESP5 + MDO_AUTORESP6 + MDO_AUTORESP7) > 1
+score  MDO_AUTORESP_META1      2.0
+
+body MURPHY_DIPLOMA    /Diploma/
+describe MURPHY_DIPLOMA        No Diploma
+score MURPHY_DIPLOMA   1
+
+body MURPHY_CALORIES   /calories/
+describe MURPHY_CALORIES       No Calories
+score MURPHY_CALORIES  1
+
+header MURPHY_CONTENT_GIF      Content-Type =~ /image\/gif/
+describe MURPHY_CONTENT_GIF    Content contains image/gif
+score MURPHY_CONTENT_GIF       1
+
+# cable tv spam -- pasc 04/05/11-12
+body MDO_CABLE_TV1     /pay.?per.?view/i
+score MDO_CABLE_TV1    0.5
+
+body MDO_CABLE_TV2     /mature.?channel/i
+score MDO_CABLE_TV2    0.5
+
+body MDO_CABLE_TV3     /c(\@|a)ble/i
+score MDO_CABLE_TV3    0.5
+
+body MDO_CABLE_TV4     /rem(o|0)te.?control/i
+score MDO_CABLE_TV4    0.5
+
+meta MDO_CABLE_META1   (MDO_CABLE_TV1 || MDO_CABLE_TV2 || MDO_CABLE_TV4) && (MDO_CABLE_TV3)
+describe MDO_CABLE_META1 Too much cable stuff
+score MDO_CABLE_META1  3
+
+header MDO_TAGSPAM1            Subject =~ /Unknown Tag *free* Please Fix/
+score  MDO_TAGSPAM1            4
+
+body   MDO_BAD_WORD1           /PORTFOLIO/i
+score  MDO_BAD_WORD1           2.8
+
+# blarson, 2004-04-30 -> lists --pasc 04/05/11 
+body AFFILIATEID        /affiliate.?id/i
+describe AFFILIATEID    affiliate id
+score AFFILIATEID       3
+
+# joy, 2003-08-30, 2003-09-21
+header FW               Subject =~ /^Fw: /
+describe FW             Sounds like a Fw: spam
+score FW                3
+
+# blarson 2007-07-13
+header REFWD           subject =~ /\b(?:RE|FWD)\:\s*$/i
+describe REFWD         re or fwd nothing
+score REFWD            3
+
+# blarson 2005-11-11
+header ONEWORD         subject =~ /^(?:Fw:|re:)?\s*\w+\s*$/i
+describe ONEWORD       one word subject
+score ONEWORD          1
+
+# robot101, 2003-09-22
+header CROSSWALK       X-UnityUser =~ /^Crosswalk.com, Inc/
+describe CROSSWALK     Crosswalk bible mailing list
+score CROSSWALK                3
+
+header CROSSWALK_SPAM  From =~ /Crosswalk/
+describe CROSSWALK_SPAM        Crosswalk Spam
+score CROSSWALK_SPAM   1
+
+# -- joy, 2003-06-28
+header BOMDIA          Subject =~ /Bom dia /
+describe BOMDIA                Bom dia, usually some Romanic language spam
+score BOMDIA           2
+
+header RCVD_FROM_UNCONF_HOST   Received =~ /^from localhost.localdomain/
+describe RCVD_FROM_UNCONF_HOST Mail comes from a host with unconfigured mailer daemon
+score RCVD_FROM_UNCONF_HOST    2
+
+# joy, 2003/01/25
+body ECOSPAM                   /Corridas de Toros para los turistas Ingleses en Barcelona/
+describe ECOSPAM               Eco-spam all right
+score ECOSPAM                  5.0
+
+# cjwatson, 2003/02/24
+body SPANISH_FORM_CGI          /Este formulario fue enviado por/
+describe SPANISH_FORM_CGI      "Below is the result of your feedback form", eh?
+score SPANISH_FORM_CGI         4.0
+
+# joy, 2003-06-18
+body TRAFFICMAGNET             /Become a TrafficMagnet Reseller/
+describe TRAFFICMAGNET         SpamMagnet
+score TRAFFICMAGNET            4
+
+# joy, 2003-06-27
+header BKR                     Subject =~ /^bkr/
+describe BKR                   bkr spam
+score BKR                      4
+
+# joy, 2003-06-27
+header RISEANDSHINE            Subject =~ /^Rise and Shine in 15 minutes/
+describe RISEANDSHINE          Rise and Shine in 15 minutes spam
+score RISEANDSHINE             4
+
+# joy, 2003-09-20
+header UNIVDIP         Subject =~ /U N I V E R S I T Y . D I P L O M A S/i
+describe UNIVDIP       university diplomas spam
+score UNIVDIP          4
+
+# joy, 2003-09-21
+header YOUTHERE                Subject =~ /^(Re: )?You/i
+describe YOUTHERE      Who, me? Likely spam
+score YOUTHERE         2
+
+# cjwatson, 2003-11-20
+header HOUSECLEANING   Subject =~ /^Affordable Housecleaning Service/
+describe HOUSECLEANING let's clean out the spam instead
+score HOUSECLEANING    3
+
+# cjwatson, 2003-12-11
+header OTC_FIRST       Subject =~ /OTC FIRST ALERT/
+describe OTC_FIRST     OTC spam
+score OTC_FIRST                3
+
+# joy, 2004-01-03
+body AVAILABLENOW      /available now/i
+describe AVAILABLENOW  must be selling some shit
+score AVAILABLENOW     1
+
+# cjwatson, 2004-01-16
+body TEDIOUS_WITTER    /If not i included it below so let me know if you like it/
+describe TEDIOUS_WITTER        annoying wittering spam, mypillsource.com I think
+score TEDIOUS_WITTER   2
+
+# cjwatson, 2004-03-12
+# blarson 2004-06-09
+header UNI_DIPLOMA     Subject =~ /\b(university|college)\s+(diploma|cert|degree)/i
+describe UNI_DIPLOMA   Got one, thanks
+score UNI_DIPLOMA      4
+
+# blarson 2004-04-27
+body UNI2      /university\s+(diploma|cert|degree)/i
+describe UNI2  Got one, thanks
+score UNI2     4
+
+# cjwatson, 2004-03-12
+header JOB_CONFIRM     Subject =~ /Job confirmation/
+describe JOB_CONFIRM   Got one of these too, thanks
+score JOB_CONFIRM      3
+
+# blarson 2005-09-20
+header MESSAGESUB      subject =~ /^\s*\(?message\s*(subject)?\)?$/i
+describe MESSAGESUB    really descriptive subject
+score MESSAGESUB       3
+
+# blarson 2006-03-16 2007-08-28
+body DEARDIGIT         /^(?:well\s+)?(?:Dear|Hey|H[ea]y?ll?.?o|To|Attention|Hi+|Hey+a?|Bonjorno|Yo|(?:g[o0]+d\s*)?(?:d?ay|morning|evening?|afternoon)|what.?i?s\s+up|greetings|Salutations|(Mail|News)\s+to|how.?s?\s*(?:(?:it)?\s*going|have\s+you\s+been|are you).?\s*(?:there|to\s+you)?)\,?\s+(?:Account\s+\#?|\=?3d|)\d{3,}/i
+describe DEARDIGIT     Dear number
+score DEARDIGIT                3.9
+
+# blarson 2004-11-08
+header SIZEMATTERS     subject =~ /^S.ze matters$/i
+describe SIZEMATTERS   Size matters spammer
+score SIZEMATTERS      3
+
+# cjwatson 2005-01-02
+header RNDMX           subject =~ /^<rndmx/
+describe RNDMX         weird empty spam
+score RNDMX            4
+
+# blarson 2005-01-06
+header VERIFYCAT       subject =~ /verifycation mail/
+describe VERIFYCAT     verifycation spam
+score  VERIFYCAT       4
+
+# blarson 2005-01-10
+header D0WNLOAD                subject =~ /\bd[o0]wn[l1][o0]ad.*(?:m[o0]v[i1]e|mp3|tune|music)/i
+describe D0WNLOAD      download spam
+score D0WNLOAD         3
+
+# blarson 2005-02-11
+header REDUCESPAM      subject =~ /Reduce Spam\b/i
+describe REDUCESPAM    reduce spam spam
+score REDUCESPAM       2
+
+# blarson 2005-04-15
+body DIRT              /\.(?:the|\d|)dirty?\d+\.info\//
+describe DIRT          dirty spammer
+score DIRT             3
+
+# blarson 2005-04-17
+body RNDWORD           /^RND_WORD\s*$/
+describe RNDWORD       RND_WORD
+score RND_WORD         3
+
+# blarson 2005-08-18
+header D3GREE          subject =~ /\bd(?:3gres?|esgre|eerge|eeerg|reege|egres)e?s?\b/i
+describe D3GREE                Want a used paper from someone who can't spell
+score D3GREE           3
+
+# blarson 2005-08-19
+body FINALNOTE         /\bfinal\s+notif/i
+describe FINALNOTE     yet another final notification
+score FINALNOTE                2
+
+# blarson 2005-08-23
+header HIITS           subject =~ /\bHi\! It\'s\b/i
+describe HIITS         hi its
+score HIITS            3
+
+# blarson 2005-08-23
+header GOTONE          subject =~ /\bgot one$/i
+describe GOTONE                got this spam already
+score GOTONE           3
+
+# blarson 2005-09-06
+body IMMEDIATEREV      /^ATTENTION- For your immediate review:/
+describe IMMEDIATEREV  immediate discard
+score IMMEDIATEREV     3
+
+# blarson 2005-09-12
+body CLIENTALERT       /^(?:CLIENT ALERT|ATTENTION CLIENT)/i
+describe CLIENTALERT   client alert
+score CLIENTALERT      3
+
+# cjwatson 2005-10-20
+header DEBIANTUX23     From =~ /DebianTux23|wieseltux23/i
+describe DEBIANTUX23   Linux spammer, sigh
+score DEBIANTUX23      5
+
+# blarson 2005-10-29
+body SHITBRO           /^\s*sh[i1]+t\s+bro/i
+describe SHITBRO       shitty spam
+score SHITBRO          3
+
+# blarson 2005-12-05
+header POPPROG         subject =~ /popular programs for everyday use/i
+describe POPPROG       unpopular spam
+score POPPROG          3
+
+# blarson 2006-02-03
+body GREET             /^\%(?:GREET|EXIT)/
+describe GREET         broken spamware
+score GREET            3
+
+# blarson 2006-10-18
+header WROTE           subject =~ /\bwrote\:\s*$/i
+describe WROTE         stock scam
+score WROTE            2
+
+body DEGREE_SPAM       /earn.+degree.+transcripts/i
+describe DEGREE_SPAM   earn a degree with transcripts spam
+score   DEGREE_SPAM    2.5     
+
+# blarson 2006-10-23
+body BLUEPILL          /blue pill/i
+describe BLUEPILL      Blue pill spam
+score BLUEPILL         2
+
+# blarson 2006-11-04
+header PHOTOQUEST      subject =~ /question about your photo/i
+describe PHOTOQUEST    questioning photo
+score PHOTOQUEST       2
+
+# blarson 2006-11-08
+body KBDP              /Knowledge Based Degree Program/i
+describe KBDP          degree spam
+score KBDP             4
+
+# blarson 2006-11-13
+body CRITERIAHAS       /\bOur criteria has changed\b/i
+describe CRITERIAHAS   Diploma salesman with bad english
+score CRITERIAHAS      3
+
+# blarson 2006-11-18
+body TORA08            /\b\d{6}   \d{7}   \d{6}         \d             \d{7}   \d{7}/
+describe TORA08                TORA.08 spam
+score TORA08           3
+
+# blarson 2006-11-21
+body SERIOUSBRO                /^Seriously bro\b/i
+describe SERIOUSBRO    Seriously bro
+score SERIOUSBRO       3
+
+# blarson 2006-12-06
+body INSETET           /\bwilson\@insitetcnologia\.com\.br\b/
+describe INSETET       please send spammer
+score INSETET          4
+
+# blarson 2006-12-09
+body USUARIO           /\bEl usuario destinatario no es un usuario valido/
+describe USUARIO       No such user -- sent in infinite loop
+score  USUARIO         3
+
+# don 2006-12-13
+body NOMAILRECBI       /no recibi tu mail/i
+describe NOMAILRECBI   No recbi of mail -- was closing way to many bugs
+score  NOMAILRECBI     3
+
+# blarson 2007-02-13
+header URHELP          subject =~ /\bi need ur help\b/
+describe URHELP                blank spam
+score URHELP           3
+
+# blarson 2006-12-08
+header ACRO8PR0                subject =~ /\bAcr[0o]bat\s*[78]\s+(?:PR[0O]\b|\$?\d+\$?)/i
+describe ACRO8PR0      sales spam
+score ACRO8PR0         4       
+
+# blarson 2007-08-31
+body WBRS              /\b(WBRS|FPMC|ADYN|AFML|MISJ|HXPN|WHKA|CBFE|HSBC|PCAI|MPRG|HPRS|AUNI|TGVI|MHII|TAMG|GDKI|ACEN|CDYV|G7Q\.F|mbwc|CHFR|CDPN|DSDI|UTEV|P-S-U-D|GPSI|SGXI|CAON|SREA|ERMX|VPSN|SZSN|PAYI\.OB|LTDI|C\W\W?Y\W\W?T\W\W?V|E\WX\WM\WT|CYTV|VGPM|V\s?G\s?P\s?M(\.PK)?)\b/
+describe WBRS          stock spam
+score BRS              4
+
+# blarson 2007-01-26
+header ACROBAT8                subject =~ /\badobe acr[o0]bat 8\b/i
+describe ACROBAT8      more sales spam
+score ACROBAT8         3
+
+# blarson 2007-03-14
+header VLSTA           subject =~ /VlSTA|0FFlCE|ACR0B8T/i
+describe VLSTA         misspelled microshit software
+score VLSTA            3
+
+# blarson 2007-04-19
+header ANGEKUEN                subject =~ /\bTrauer angekuendigt\b/
+describe ANGEKUEN      german spam
+score ANGEKUEN         3
+
+# blarson 2007-05-06
+body INTCAFE           /\binternet caff?e\b/i
+describe INTCAFE       internet cafe spam
+score INTCAFE          2
+
+# blarson 2007-07-14
+header VERIFIC         subject =~ /Your email requires verification/
+describe VERIFIC       some people prefer you get their spam
+score VERIFIC          3
+
+# blarson 2007-07-14
+header WHITELIST       subject =~ /You have been added to .* whitelist/
+describe WHITELIST     whitelist spam
+score WHITELIST                3
+
+# blarson 2007-07-15
+body CASNIO            /^Please be advised that your casnio account is still inactive/
+describe CASNIO                casnio account
+score CASNIO           3
+
+# don 2007-07-17
+header AUTOREPLY       subject =~ /\bauto(?:mated|matic|)[\s-]+re(?:spon[cs]e|ply)\b/i
+describe AUTOREPLY     Automatic reply
+score AUTOREPLY                2
+
+# blarson 2007-07-18
+body CONFSERV          /^Thanks for using our confidential service/
+describe CONFSERV      confidential service
+score CONFSERV         3
+
+# blarson 2007-07-18
+body CONTENC           /^Confirmation has been enclosed/
+describe CONTENC       more pdf spam
+score CONTENC          4
+
+# blarson 2007-07-23
+header PHONE           subject =~ /\b(tele)?phone\b/i
+describe PHONE         phone spam
+score PHONE            2
+
+# blarson 2007-07-30
+body ASPDF             /^We send our messages as Portable Document Format/
+describe ASPDF         more pdf spam
+score ASPDF            3
+
+# blarson 2007-08-20
+body DELAFT            /Please delete your private message after reading/
+describe DELAFT                more pdf spam
+score DELAFT           3
+
diff --git a/common/pron_spam b/common/pron_spam
new file mode 100644 (file)
index 0000000..aa20e51
--- /dev/null
@@ -0,0 +1,214 @@
+# spam messages dealing with pr0n, dating, sex, etc. match these rules
+
+# sexually-explicit stuff on a bunch of lists --pasc 04/05/11, --pasc 04/05/14
+body MURPHY_SEX1       /w(who|ohr|hro)re/i
+describe MURPHY_SEX1   No whores in Debian
+score MURPHY_SEX1      1
+
+body MURPHY_SEX2       /(jizzed|jizezd|jizz)/i
+describe MURPHY_SEX2   Debian ain't that exciting
+score MURPHY_SEX2      1
+
+body MURPHY_SEX3       /gang bang/i
+describe MURPHY_SEX3   No gang bangs
+score MURPHY_SEX3      1
+
+body MURPHY_SEX4       /dripping/i
+describe MURPHY_SEX4   Don't drip
+score MURPHY_SEX4      0.5
+
+body MURPHY_SEX5       /slut/i
+score MURPHY_SEX5      1
+
+body MURPHY_SEX6       /intercourse/i
+score MURPHY_SEX6      0.5
+
+body MURPHY_SEX7       /feel better/i
+score MURPHY_SEX7      0.5
+
+body MURPHY_SEX_L1     /amateur/i
+score MURPHY_SEX_L1    0.1
+
+body MURPHY_SEX_L2     /posing/i
+score MURPHY_SEX_L2    0.1
+
+body MURPHY_SEX_L3     /nude/i
+score MURPHY_SEX_L3    0.1
+
+body MURPHY_SEX_L4     /shy/i
+score MURPHY_SEX_L4    0.1
+
+body MURPHY_SEX_L5     /dirty/i
+score MURPHY_SEX_L5    0.1
+
+body MURPHY_SEX_L6     /bitch/i
+score MURPHY_SEX_L6    0.1
+
+body MURPHY_SEX_L7     /tits/i
+score MURPHY_SEX_L7    0.1
+
+body MURPHY_SEX_L7     /lingerie/i
+score MURPHY_SEX_L7    0.8
+
+
+meta MURPHY_SEX_L_META1 (MURPHY_SEX_L1 + MURPHY_SEX_L2 + MURPHY_SEX_L3 + MURPHY_SEX_L4 + MURPHY_SEX_L5 + MURPHY_SEX_L6 + MURPHY_SEX_L7) > 1
+score MURPHY_SEX_L_META1 2.0
+
+meta MURPHY_SEX_META1  (MURPHY_SEX1 + MURPHY_SEX2 + MURPHY_SEX3 + MURPHY_SEX4 + MURPHY_SEX5 + MURPHY_SEX6 + MURPHY_SEX7 + MURPHY_SEX_L_META1) > 1
+score MURPHY_SEX_META1 3.0
+
+body           MDO_DATING2     /l(o|0)ve/i
+describe       MDO_DATING2     Don't look for love on debian lists
+score          MDO_DATING2     0.1
+
+body           MDO_DATING3     /bar.?hopping/i
+describe       MDO_DATING3     Bar hopping (looking for dates?)
+score          MDO_DATING3     0.1
+
+body   MDO_DATING4     /(meet|find)(ing)?.?(a|the)?.?(perfect|right|new)?.?(stranger|people|partner|person|friend)/i
+describe MDO_DATING4   You don't want to pickup a DD
+score  MDO_DATING4     1.5
+
+body   MDO_DATING5     /blind.?date/i
+score  MDO_DATING5     0.1
+
+body   MDO_DATING7     /hooked you up on a date/i
+score  MDO_DATING7     0.1
+
+body   MDO_DATING8     /sex life/i
+score  MDO_DATING8     0.1
+
+body   MDO_DATING9     /pleasure your partner/i
+score  MDO_DATING9     0.1
+
+body   MDO_DATING10    /sweety/i
+score  MDO_DATING10    0.1
+
+body   MDO_DATING11    /personals/i
+score  MDO_DATING11    0.1
+
+body   MDO_DATING12    /check out my site/i
+score  MDO_DATING12    0.1
+
+body   MDO_DATING13    /see .*pics/i
+score  MDO_DATING13    0.1
+
+body   MDO_DATING14    /baby/i
+score  MDO_DATING14    0.1
+
+# cjwatson, 2003/01/31
+body SEXYADULTPAGES            /sexyadultpages\.net/
+describe SEXYADULTPAGES                Porn spam
+score SEXYADULTPAGES           4.0
+
+# cjwatson, 2003/02/13
+body FREE_MEMBERS_ACCESS       /entry codes.*100% FREE MEMBERS ACCESS/
+describe FREE_MEMBERS_ACCESS   Porn spam
+score FREE_MEMBERS_ACCESS      4.0
+
+# cjwatson, 2003/06/17
+header SAW_PROFILE             Subject =~ /\d+.*, I saw your profile/
+describe SAW_PROFILE           People keep thinking bugs are cute
+score SAW_PROFILE              4.0
+
+# cjwatson, 2003/01/07
+body FREELIVECAMGIRLS          /www\.freelive(?:camgirls\.net|webcamteens\.com)/
+describe FREELIVECAMGIRLS      And they all use Debian!
+score FREELIVECAMGIRLS         4.0
+
+# cjwatson, 2003/01/28
+header REALLY_CUTE             Subject =~ /you're really cute/
+describe REALLY_CUTE           It's a *bug*, dammit ...
+score REALLY_CUTE              4.0
+
+# joy, 2003-07-20
+# this is also pretty generic
+rawbody PENISACCENT            /pen(í|i)s/i
+describe PENISACCENT           mentioning penis, esp. with an acute
+score PENISACCENT              3
+
+# joy, 2003-08-15
+header RAPE_1                  Subject =~ /\brape\b/i
+describe RAPE_1                        Mentions rape, likely porn spam
+score RAPE_1                   1
+body RAPE_2                    /\brape\b/i
+describe RAPE_2                        Mentions rape, likely porn spam
+score RAPE_2                   1
+
+# joy, 2003-07-20
+header NIGHTHOBBY              Subject =~ /many gir.s as they can/
+describe NIGHTHOBBY            www.nighthobby.com spamvertizers
+score NIGHTHOBBY               4
+
+# joy, 2003-11-01
+body ONLINEDATE                /online date/i
+describe ONLINEDATE    offline date
+score ONLINEDATE       3
+
+# blarson 2005-02-05 add \b
+body DATING            /\bdating\b/i
+describe DATING                inundating with spam
+score DATING           1
+
+# cjwatson, 2003-12-11
+header GIRLS_EJAC      Subject =~ /girls ejaculating/
+describe GIRLS_EJAC    porn spam, go away
+score GIRLS_EJAC       4
+
+# cjwatson, 2004-03-25
+# fixed blarson 2004-03-30
+header ZOOPHILS                Subject =~ /Z[O0][O0]fils/i
+describe ZOOPHILS      Ewww. Bestiality spam.
+score ZOOPHILS         4
+
+# blarson, 2004-03-28
+# fixed blarson 2004-03-30
+header WIVESONIINE     Subject =~ /wives\s+[o0]n\s+[il]ine/i
+describe WIVESONIINE   Wives on Iine
+score WIVESONIINE      4
+
+# blarson 2004-04-13
+body BLINDDATE         /\bblind\s+date\b/i
+describe BLINDDATE     dating spam
+score BLINDDATE                3
+
+# blarson 2004-04-26
+body SWINGERCLUB       /swingers?\s+club/i
+describe SWINGERCLUB   swinger club spam
+score SWINGERCLUB      3
+
+# blarson 2005-02-08
+body HUSBAND           /\bhusband\b/i
+describe HUSBAND       husbanding a bug
+score HUSBAND          1
+
+# blarson 2004-05-13
+body ADULTDVD          /adult\s+dvd/i
+describe ADULTDVD      adult dvd
+score ADULTDVD         3
+
+# blarson 2005-01-07   2005-01-30 trollwife submits bugs
+body WIFE                      /(?<!troll)wi[fv]e/i
+describe WIFE          wife
+score WIFE             2
+
+# blarson 2005-07-10
+header JACKRABBIT      subject =~ /Jack Rabbit Vibrator/i
+describe JACKRABBIT    vibrator spam
+score JACKRABBIT       3.9
+
+# blarson 2005-10-24
+# don 2005-10-21 munging to match body
+body JACKRABBIT2       /Jack Rabbit Vibrator/i
+describe JACKRABBIT2   vibrator spam
+score JACKRABBIT2      3
+
+# blarson 2007-05-09
+body NUDEPIC           /\b(nude|naked|undressed)\s+(pictures?|video|snapshot|pic)\b/i
+describe NUDEPIC       nude pictures
+score NUDEPIC          2
+
+# blarson 2007-06-17
+body PRETTYGIRL                /\bpretty girl/i
+describe PRETTYGIRL    pretty girls trying to seduce bugs
+score PRETTYGIRL       2
diff --git a/common/scam_spam b/common/scam_spam
new file mode 100644 (file)
index 0000000..ca4398b
--- /dev/null
@@ -0,0 +1,40 @@
+# Nigerian-type spam
+
+body           MURPHY_SCAM1    /I am.*(son|daughter|wife)/i
+describe       MURPHY_SCAM1    Family relation
+score          MURPHY_SCAM1    0.1
+
+body           MURPHY_SCAM2    /confidential transaction/i
+score          MURPHY_SCAM2    0.1
+
+body           MURPHY_SCAM3    /may be surprise/i
+score          MURPHY_SCAM3    0.1
+
+body           MURPHY_SCAM4    /(Robert Mugabe|Richard Taylor)/i
+score          MURPHY_SCAM4    0.1
+
+body           MURPHY_SCAM5    /(zimbabwe|nigeria)/i
+score          MURPHY_SCAM5    0.1
+
+meta           MURPHY_SCAM_META1       (MURPHY_SCAM1 + MURPHY_SCAM2 + MURPHY_SCAM3 + MURPHY_SCAM4 + MURPHY_SCAM5) > 1
+score          MURPHY_SCAM_META1       3.0
+
+header RESPOND         Subject =~ /^Respond/
+describe RESPOND       respond 419 scam spam
+score REPSOND          2
+
+# cjwatson, 2003/10/18
+header NIGERIAN_XIAN   Subject =~ /^DONATION FOR THE LORD/
+describe NIGERIAN_XIAN The 419 scam with a Christian twist
+score NIGERIAN_XIAN    4
+
+# cjwatson, 2004-02-10
+header BIZ_PROP                Subject =~ /Business Proposition:Respond ASAP/i
+describe BIZ_PROP      419 variant
+score BIZ_PROP         4
+
+# cjwatson, 2004-03-05
+header NEW_PUB_COMP    Subject =~ /NEW PUBLIC COMPNAY ALERT/
+describe NEW_PUB_COMP  Filesharing spam
+score NEW_PUB_COMP     3
+
diff --git a/common/scores b/common/scores
new file mode 100644 (file)
index 0000000..28f4059
--- /dev/null
@@ -0,0 +1,110 @@
+# This configuration file alters scores of different tests
+
+# use newer score and rules, but don't override our own scores
+# which is why the scores are divided with a hundred, duh --joy, 2004-05-27
+score CHARSET_FARAWAY          0.03
+# score CHARSET_FARAWAY_HEADERS        0.02
+score CHARSET_FARAWAY_HEADER   0.02
+score HTML_CHARSET_FARAWAY     0.005
+score MIME_CHARSET_FARAWAY     0.02
+# score UNDESIRED_LANGUAGE_BODY   0.03
+score UNWANTED_LANGUAGE_BODY   0.03
+#score BODY_8BITS 1.500
+# give it another shot with a low score. 
+score USER_IN_WHITELIST -1
+score LDOSUBSCRIBER            -6
+score FROM_AND_TO_SAME         4.097 3.826 4.197 3.464
+# score MASS_EMAIL             2.0 2.0 2.0 2.482
+# score BASE64_ENC_TEXT                4.354 3.643 3.544 3.768
+score HTML_WEB_BUGS            2.542 2.100 2.100 2.100
+score EXCUSE_10                        2.069 2.0 2.0 2.0
+score MIME_HTML_ONLY           4
+# score CLICK_BELOW            2.489 2.101 2.100 2
+score CLICK_BELOW_CAPS         2.639 2.500 2.100 2.500
+score NORMAL_HTTP_TO_IP                2.3
+# score HTML_LINK_CLICK_HERE   2.100
+# score HTML_JAVASCRIPT                2 2 2 2.230
+score MAILTO_TO_REMOVE         1.274 1.299 1.092 1.273
+score MISSING_MIMEOLE          1.501 1.501 1.241 1.100
+score HTTP_EXCESSIVE_ESCAPES   2.101 2.566 2.208 2.918
+# score MICROSOFT_EXECUTABLE   1.1
+score MIME_SUSPECT_NAME                1.1
+score HTML_MESSAGE             1.112 1.101 1.100 1.0
+# score HTML_WIN_OPEN          1.500 1.501 1.501 1.578
+# score JAVASCRIPT_URI         1.0 1.017 1.0 1.0
+score MAILTO_TO_SPAM_ADDR      1.606 1.377 1.795 1.676
+# score HTML_FONT_COLOR_UNSAFE 1
+# score HTML_FONT_COLOR_RED    1
+# score HTML_FONT_COLOR_BLUE   1
+# score HTML_FONT_COLOR_GREEN  1
+# score HTML_FONT_COLOR_GRAY   1
+# score UNSUB_PAGE             1
+# score MAILTO_WITH_SUBJ_REMOVE        2.101 1.500 2.100 1.500
+# score REMOVE_FROM_LIST               1
+# score REMOVE_IN_QUOTES               1.001 1.197 1.001 1.301
+score REMOVE_PAGE              1.313 1.265 1.675 1.401
+# score EARN_MONEY             1.950 2.018 1.379 1.949
+score EARN_PER_WEEK            1
+score DNS_FROM_RFC_DSN         4
+score DNS_FROM_RFC_BOGUSMX     2.5
+score DNS_FROM_RFC_POST        2.44 
+# score RCVD_IN_DYNABLOCK              0
+score RCVD_IN_NJABL_DUL 0
+score FORGED_MUA_OUTLOOK       3.717 3.476 3.850 2.173
+score RAZOR2_CHECK             1
+# score RAZOR2_CF_RANGE_11_50  4
+score RAZOR2_CF_RANGE_51_100    4
+score PYZOR_CHECK              2
+score BAYES_00 0 0 -2 -2
+# score BAYES_01 0 0 -2 -2
+# score BAYES_10 0 0 -1 -1
+score BAYES_20 0 0 -1 -1
+# score BAYES_30 0 0 -1 -1
+score BAYES_40 0
+# score BAYES_44 0
+score BAYES_50 0
+# score BAYES_56 0
+score BAYES_60 0 0  1  1
+# score BAYES_70 0 0  1  1
+score BAYES_80 0 0  1  1
+# score BAYES_90 0 0  2  2
+# score BAYES_99 0 0  3  3
+score BAYES_99 4
+
+# don't trust RBLs so much, esp. not dialup lists, moved them towards 0
+# --joy, 2003-07-19
+score RCVD_IN_RFCI             0.0 0.1 0.0 0.092
+score RCVD_IN_ORBS             0.0 0.0 0.0 0.114
+score RCVD_IN_UNCONFIRMED_DSBL 0.0 0.012 0.0 0.0
+score RCVD_IN_NJABL            0.0 0.053 0.0 0.344
+# relays.osirusoft.com is gone --joy, 2003-08-27
+# score RCVD_IN_OSIRUSOFT_COM 0
+score RCVD_IN_SORBS 0.2
+# sometimes kills off valid excite etc users, and doesn't detect much spam
+# so -1 point from 2.55 default --joy, 2003-07-19
+score RCVD_FAKE_HELO_DOTCOM    0.791 1.606 1.264 2.434
+# score RCVD_FAKE_HELO_DOTCOM_2        1.335 1.404 0.221 1.799
+
+# Upped some rules which only seem to happen in spam. Suggestion from Santiago
+# --pasc 2004-05-23
+
+score HTML_FONT_BIG    3.0
+# score HTML_IMAGE_ONLY        3.0
+score MIME_MISSING_BOUNDARY 3.0
+score MIME_HTML_MOSTLY  3.0
+# score DATE_IN_FUTURE 3.0
+score INVALID_DATE_TZ_ABSURD 3.0
+score MSGID_FROM_MTA_HEADER 3.0
+
+# This only seems to happen in spam as well
+score HTML_FONT_FACE_BAD       3.0
+
+# score RCVD_IN_OSIRUSOFT_COM 0
+score RCVD_IN_SORBS 0.2
+score RCVD_FAKE_HELO_DOTCOM    0.791 1.606 1.264 2.434
+# score RCVD_FAKE_HELO_DOTCOM_2        1.335 1.404 0.221 1.799
+score HTML_FONT_BIG    3.0
+# score HTML_IMAGE_ONLY        3.0
+score MIME_MISSING_BOUNDARY 3.0
+score MIME_HTML_MOSTLY  3.0
+# score DATE_IN_FUTURE 3.0
diff --git a/common/url_spam b/common/url_spam
new file mode 100644 (file)
index 0000000..57c233b
--- /dev/null
@@ -0,0 +1,137 @@
+# joy, 2003-06-29
+body ORIENTSKY                 /orient-sky\.com/
+describe ORIENTSKY             Japanese spam
+score ORIENTSKY                        4
+
+# joy, 2003-07-06
+body PACHETES                  /www\.pachetes\.com/
+describe PACHETES              Spanish spam
+score PACHETES                 4
+
+# cjwatson, 2003/07/12
+body NO_MORE_ACCENT            /www\.no-more-accent\.com/
+describe NO_MORE_ACCENT                No More Accent spam
+score NO_MORE_ACCENT           4
+
+# joy, 2003-08-15
+header FETHARD                 Subject =~ /fethard.biz/i
+describe FETHARD               Spam from Fethard.biz
+score FETHARD                  4
+
+# joy, 2003-10-21, 2003-10-31
+body PHARMACYSPAM3     /http:\/\/www\.rx(salenow|ville)\.biz/i
+describe PHARMACYSPAM3 pharmacy spam 3
+score PHARMACYSPAM3    4
+
+# cjwatson, 2004-01-13
+# blarson, any number 2004-04-01
+# blarson, more ajustmets 2004-04-03
+body HREF_NNNN         /www\.\d{3,5}hosting\.com/
+describe HREF_NNNN     www.NNNNhosting.com spam
+score HREF_NNNN                3
+
+# cjwatson, 2004-02-16
+body SOCCER_MOMS       /www\.soccer-moms\.biz/
+describe SOCCER_MOMS   Porn spam
+score SOCCER_MOMS      4
+
+# cjwatson, 2004-02-22
+body MRSM_TILO         /mrsm-tilo\.com/
+describe MRSM_TILO     Medical spam
+score MRSM_TILO                4
+
+# cjwatson, 2004-02-27
+body FAST_ACTING       /fast-acting\.com/
+describe FAST_ACTING   Viagra spam
+score FAST_ACTING      4
+
+# blarson 2004-04-04
+body COMCLICKPH                /com-click\.com\.ph/
+describe COMCLICKPH    PH spam gang
+score COMCLICKPH       4
+
+# blarson 2004-05-01
+body MEDS675           /(675meds|medsarergreat)\.com/i
+describe MEDS675       More drug spam
+score MEDS675          3
+
+# blarson 2004-04-30
+body ERHOME            /erhome\.com/i
+describe ERHOME                loan spammer
+score ERHOME           3
+
+# blarson 2005-04-27
+body CANDYHOS          /\.(?:candyhos\.com|(?:mycountry|polty|make4u)\.cc|puchiphoto\.org|purepure\.org)\//i
+describe CANDYHOS      spams from korea, hosts in japan
+score CANDYHOS         5
+
+# blarson 2005-12-08
+body GEOCITIES         /http\:\/\/.*geocities/i
+describe GEOCITIES     geocities url
+score GEOCITIES                1.6
+
+# blarson 2005-12-24
+body EMPTYURL          /\bhttp:\/\/(?:www\.)?$/i
+describe EMPTYURL      empty URL
+score EMPTYURL         1.5
+
+# blarson 2006-02-06
+body AMPRO             /www\.amateurprovideo\.info/i
+describe AMPRO         bug submitting spammer
+score AMPRO            5
+
+# blarson 2007-04-03
+body IMAGESHACK                /\/img\d+\.imageshack\.us\//i
+describe IMAGESHACK    shack attack
+score IMAGESHACK       3.5
+
+
+# dla 2007-04-03
+header MSOUTLOOK       x-mailer =~ /Microsoft\s+Outlook/i
+describe MSOUTLOOK     Microsoft Outlook
+score  MSOUTLOOK       0
+
+meta SHACKOUTLOOK      IMAGESHACK && MSOUTLOOK
+describe SHACKOUTLOOK  shack'ed to outlook
+score SHACKOUTLOOK     2
+
+# blarson 2007-04-09
+body UNSUBG            /\bwww\.guiaartistica\.com\.ar\b/
+describe UNSUBG                spamming bts with unsubscribe messages
+score UNSUBG           14
+
+# blarson 2007-05-14
+body IMGCLOSET         /\bhttp\:\/\/.*\b((image(closet|thrust|hosting)|mypicshare|tinypic|fileanchor|imgspot)\.com|bilder-hosting\.de|saunalahti\.fi|upload2\.net|imagehost\.ro)\b/i
+describe IMGCLOSET     closet spammer
+score IMGCLOSET                3.5
+
+# blarson 2007-05-17
+body TROUBLEDE         /\bhttp\:\/\/www\.TroubleAgent\.de\b/
+describe TROUBLEDE     troubleagent.de spam
+score TROUBLEDE                3.5
+
+# don 2007-05-24
+body BESTLOANS         /www.bestmortloans.com/i
+describe BESTLOANS     Best loans url
+score BESTLOANS                2
+
+# blarson 2007-07-22
+body PENPRO            /\@penmailpro\.info\b/i
+describe PENPRO                penmailpro spam
+score PENPRO           3.5
+
+# blarson 2007-09-05
+body WWWCN             /\bwww\.\w+\.cn\b/i
+describe WWWCN         chinese web site
+score WWWCN            3
+
+# cjwatson, 2002/04/04
+body EMAILOFFER                        /www\.emailoffer\.us/
+describe EMAILOFFER            Gibberish HTML spammers
+score EMAILOFFER               4.0
+
+# cjwatson, 2002/04/08
+body JUSTYAK                   /www\.JustYak\.com/
+describe JUSTYAK               JustSpam
+score JUSTYAK                  4.0
+
diff --git a/common/virus_spam b/common/virus_spam
new file mode 100644 (file)
index 0000000..c9686d2
--- /dev/null
@@ -0,0 +1,80 @@
+# joy, 2003-08-15
+rawbody PIC_GIF                        /^Content-ID: <pic\d*\.gif>/i
+describe PIC_GIF               pic*.gif in attachment, common spam/virus
+score PIC_GIF                  3
+
+header POSSIBLEVIRUS   Subject =~ /\{Virus\?\} /
+describe POSSIBLEVIRUS possible or cleaned virus tag found in Subject
+score POSSIBLEVIRUS    2
+
+# cjwatson, 2003/09/22 2003/10/02
+header AV_SCAN         Subject =~ /AntiVirus scan results/
+describe AV_SCAN       virus fallout
+score AV_SCAN          4
+
+# cjwatson, 2003/09/24
+body CORREO_TERRA      /Antivirus de Correo de Terra/
+describe CORREO_TERRA  virus fallout
+score CORREO_TERRA     2
+
+# cjwatson, 2003/09/24
+body WEBSHIELD         /Network Associates WebShield SMTP.*detected virus/
+describe WEBSHIELD     virus fallout
+score WEBSHIELD                3
+
+# cjwatson, 2003/09/25, joy 2003-10-01
+header AV_ALERT                Subject =~ /^(Anti)?Virus Alert/
+describe AV_ALERT      virus fallout
+score AV_ALERT         4.5
+
+# cjwatson, 2003/09/29
+body INFECTED_OBJ      /because contains an infected object/
+describe INFECTED_OBJ  virus fallout
+score INFECTED_OBJ     4
+
+# joy, 2003-10-01
+header AV_RESULTS      Subject =~ /AntiVirus scan results/i
+describe AV_ALERT       anti-virus spam
+score AV_ALERT          4
+
+# cjwatson, 2004-01-27
+header IOL_ALERTA      Subject =~ /IOL - ALERTA de Virus/
+describe IOL_ALERTA    misdirected antivirus
+score IOL_ALERTA       4
+
+# blarson 2004-04-10
+rawbody ZIPCOMPRESSED  /application\/x-zip-compressed/i
+describe ZIPCOMPRESSED zip compressed attachment
+score ZIPCOMPRESSED    2
+
+# blarson 2005-04-29
+header MICROVIRUS      subject =~ /(?:Current|Latest|Newest|New) (?:Microsoft|Internet|Net) (?:Security|Critical)? ?(?:Patch|Pack|Update|Upgrade)/i
+describe MICROVIRUS    microsoft email virus
+score MICROVIRUS       4
+
+# blarson 2006-11-21
+rawbody AVGMAIL                /\b\-\-\=\=\=\=\=\=\=AVGMAIL/
+describe AVGMAIL       avg virus claim
+score AVGMAIL          3
+
+# don 2007-06-25 blarson 2007-06-28
+# This is %PDF-1.1 base64 encoded
+full PDFATTACH         /JVBERi0xLjE/
+describe PDFATTACH     PDF Attachment
+score PDFATTACH                2               
+
+# blarson 2007-06-29
+header PDFNAME         subject =~ /\w\.pdf\b/i
+describe PDFNAME       pdf spam
+score PDFNAME          3.5
+
+# blarson 2007-07-18
+rawbody APPPDF         /\bContent-Type\:\s+application\/pdf/i
+describe APPPDF                pdf attachment
+score APPPDF           2
+
+# blarson 2007-09-01
+body NOVIR             /^No virus found in this incoming message\./
+describe NOVIR         bogus no virus
+score NOVIR            1
+
diff --git a/lists/user_prefs b/lists/user_prefs
new file mode 100644 (file)
index 0000000..48a7430
--- /dev/null
@@ -0,0 +1,85 @@
+# SpamAssassin user preferences file.  See 'man Mail::SpamAssassin::Conf' for
+# details of what can be tweaked.
+###########################################################################
+
+# XXX update the date in the version tag whenever you make changes!
+# version_tag          lists.debian.org-2007-04-23-01
+
+required_hits          4.0
+# use_terse_report     0
+# check_mx_attempts    2
+#rbl_timeout           5
+# dns_available                yes
+skip_rbl_checks                0
+dns_available test: gluck.debian.org master.debian.org klecker.debian.org
+
+# use newer score and rules, but don't override our own scores
+include /var/list/.spamassassin/newer-rules/50_scores.cf
+
+internal_networks      70.103.162.31/32 127.0.0.1/32
+trusted_networks       70.103.162.0/24 127.0.0.1/32 192.25.206.10/32
+
+# No unnecessary crap --liiwi 2004-08-29
+report_safe            0
+
+# Making this explicit --pasc, 2004-02-22
+use_razor2             1
+
+# This should work now -- pasc, 2005-07-19
+use_pyzor              1
+
+# testing only --joy, 2003-09-05
+# we have non english lists on lists.d.o --rmurray, 2003-12-03
+# which is why the scores are divided with a hundred, duh --joy, 2004-05-27
+ok_locales              en
+# ok_languages            en
+
+# good idea, should have been taken further, but preemptively
+# commented out by Joy after the 2003-06-27 debacle where the
+# 10 MB bayesian database caused spamds to consume gobs of memory
+#bayes_expiry_scan_count 20000
+
+# we don't train the Bayesian classifier so don't give it full weight
+# cf. bug #188703 --joy, 2003-04-12, 2003-04-28
+# 
+# set more realistic settings, so bayes is not automatic poisoned any more
+#                 -- zobel, 2207-01-13
+bayes_auto_learn_threshold_nonspam  -5
+bayes_auto_learn_threshold_spam      27
+
+
+################################################################
+# SARE-rules (http://www.rulesemporium.com/rules.htm)
+################################################################
+
+include /var/list/.spamassassin/sare-rules/70_sare_adult.cf
+include /var/list/.spamassassin/sare-rules/70_sare_header0.cf
+include /var/list/.spamassassin/sare-rules/70_sare_header1.cf
+include /var/list/.spamassassin/sare-rules/70_sare_html0.cf
+include /var/list/.spamassassin/sare-rules/70_sare_html1.cf
+include /var/list/.spamassassin/sare-rules/70_sare_oem.cf
+include /var/list/.spamassassin/sare-rules/70_sare_specific.cf
+include /var/list/.spamassassin/sare-rules/70_sare_stocks.cf
+include /var/list/.spamassassin/sare-rules/72_sare_bml_post25x.cf
+include /var/list/.spamassassin/sare-rules/75_black_uri_list.cf
+include /var/list/.spamassassin/sare-rules/99_sare_fraud_post25x.cf
+
+
+################################################################
+# newer rules which aren't in /usr/share/spamassassin
+################################################################
+
+include /var/list/.spamassassin/newer-rules/20_dnsbl_tests.cf
+include /var/list/.spamassassin/newer-rules/20_head_tests.cf
+include /var/list/.spamassassin/newer-rules/20_ratware.cf
+include /var/list/.spamassassin/newer-rules/20_uri_tests.cf
+include /var/list/.spamassassin/newer-rules/25_uribl.cf
+include /var/list/.spamassassin/newer-rules/60_whitelist_dk.cf
+include /var/list/.spamassassin/newer-rules/70_iadb.cf
+include /var/list/.spamassassin/newer-rules/80_additional.cf
+
+# Include common spam stuff
+
+include common/common_spam
+include common/list_specific
+include common/score