From 652703901508da38854d07b3b53b6d231eff175f Mon Sep 17 00:00:00 2001 From: Don Armstrong Date: Sat, 8 Sep 2007 17:39:45 +0000 Subject: [PATCH] add spamassassin configuration git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@2 0b7a5b0c-1f2c-0410-bd74-c376f8064c91 --- bugs/user_prefs | 97 +++ common/blacklists | 76 ++ common/bts_scores | 232 +++++ common/bts_specific | 82 ++ common/charset_tests | 1891 ++++++++++++++++++++++++++++++++++++++++ common/common_rbl | 19 + common/common_spam | 22 + common/debian_specific | 25 + common/disabled_rules | 18 + common/drug_spam | 205 +++++ common/list_specific | 72 ++ common/misc_spam | 274 ++++++ common/money_spam | 245 ++++++ common/phrase_spam | 414 +++++++++ common/pron_spam | 214 +++++ common/scam_spam | 40 + common/scores | 110 +++ common/url_spam | 137 +++ common/virus_spam | 80 ++ lists/user_prefs | 85 ++ 20 files changed, 4338 insertions(+) create mode 100644 bugs/user_prefs create mode 100644 common/blacklists create mode 100644 common/bts_scores create mode 100644 common/bts_specific create mode 100644 common/charset_tests create mode 100644 common/common_rbl create mode 100644 common/common_spam create mode 100644 common/debian_specific create mode 100644 common/disabled_rules create mode 100644 common/drug_spam create mode 100644 common/list_specific create mode 100644 common/misc_spam create mode 100644 common/money_spam create mode 100644 common/phrase_spam create mode 100644 common/pron_spam create mode 100644 common/scam_spam create mode 100644 common/scores create mode 100644 common/url_spam create mode 100644 common/virus_spam create mode 100644 lists/user_prefs diff --git a/bugs/user_prefs b/bugs/user_prefs new file mode 100644 index 0000000..8188d43 --- /dev/null +++ b/bugs/user_prefs @@ -0,0 +1,97 @@ +# This is the right place to customize your installation of SpamAssassin. +# See 'perldoc Mail::SpamAssassin::Conf' for details of what can be tweaked. +# +########################################################################### +# +# (/org/bugs.debian.org/spamassassin/spamc) + +# HEY YOU. YES YOU. +# RUN spamassassin --lint! + +rewrite_subject 0 +report_safe 1 +#defang_mime 0 +required_hits 4 +version_tag bugs.debian.org-2005-01-02 +# just for testing! +#always_add_report 1 + +# cjwatson 2004-04-09 sorry, but we're stalling on Razor all the time at the +# moment and it's causing bad delays; turning off until spamscan is fixed to +# be multiprocess +# 2005-10-30 blarson turn back on finally +use_razor2 1 + +# testing only --joy, 2003-09-12 +# 2005-01-28 blarson -- doesn't seem to be useful, disabling +#ok_locales en +#ok_languages en +#score CHARSET_FARAWAY 0.03 +#score CHARSET_FARAWAY_HEADERS 0.02 +#score HTML_CHARSET_FARAWAY 0.005 +#score MIME_CHARSET_FARAWAY 0.02 +#score UNDESIRED_LANGUAGE_BODY 0.03 +ok_locales all +ok_languages all +score CHARSET_FARAWAY 0 +score CHARSET_FARAWAY_HEADERS 0 +score HTML_CHARSET_FARAWAY 0 +score MIME_CHARSET_FARAWAY 0 +score UNDESIRED_LANGUAGE_BODY 0 + +#bayes_expiry_scan_count 20000 + +# blarson 2005-01-28 -- try a bigger datebase +bayes_expiry_max_db_size 300000 +# may solve locking problem at cost of slower updates +bayes_learn_to_journal 1 + +# Cope with refiltered mail +bayes_ignore_header X-Spam-Checker-Version +bayes_ignore_header X-Spam-Flag +bayes_ignore_header X-Spam-Level +bayes_ignore_header X-Spam-Status + +# a bit cautious (cf. #188703) +# blarson -- ajust again, now that it's trained 2004-05-13 +# blarson 2004-10-22 +# blarson 2006-10-29 2006-11-17 +auto_learn_threshold_nonspam -5 +score BAYES_00 -3 +score BAYES_01 -2 +score BAYES_10 -1.5 +score BAYES_20 -1 +score BAYES_30 -0.5 +score BAYES_40 -0.2 +score BAYES_44 -0.1 +score BAYES_50 0.5 +score BAYES_56 1 +score BAYES_60 2 +score BAYES_70 2.5 +score BAYES_80 3 +score BAYES_90 4 +score BAYES_99 4.5 + +include common/bts_specific +# blarson 2005-01-28 +clear_trusted_networks +# the /24 around spohr, master, and gluck +trusted_networks 127.0.0.1 128.193.0.0/24 146.82.138.0/24 192.25.206.0/24 140.211.166.0/24 + +# blarson 2004-03-20 +# Disable most DNSBLs -- overhead to high +# blarson 2005-01-28 try reducing timeout while adding spamcop back +# blarson 2005-10-29 adding some back now we are multi-threaded +rbl_timeout 10 + +include common/common_rbl + +include common/common_spam + +include common/bts_spam + +include common/debian_specific + +include common/bts_specific + +include common/bts_scores diff --git a/common/blacklists b/common/blacklists new file mode 100644 index 0000000..44b0cb7 --- /dev/null +++ b/common/blacklists @@ -0,0 +1,76 @@ +# cjwatson, 2002/03/07 +blacklist_from cyberbet@shaw.ca + +# cjwatson, 2002/03/18 +blacklist_from bounce@alliancecreditgroup.com + +# cjwatson, 2003/05/19 +blacklist_from k.graves@oracle.com + +# cjwatson, 2003/06/03 +blacklist_from *@163.com + +# cjwatson, 2003/09/24 +blacklist_from ggandara@uocra.org + +# cjwatson, 2003/09/28 +blacklist_from AVAdmin@xnet.ro + +# cjwatson, 2003/09/29 +blacklist_from DrWEB-DAEMON@ntci.nnov.ru + +# cjwatson, 2003/09/29 +blacklist_from dnicotra@saomail.com.ar + +# cjwatson, 2003/09/30 +blacklist_from euro@laregion.net + +# cjwatson, 2003/10/01 +blacklist_from RAV@home.becks.com.br + +# cjwatson, 2003/10/02 +blacklist_from ravms@ss1.kyrnet.kg + +# cjwatson, 2003/10/11 +blacklist_from virus-alert@wakwak.com + +# cjwatson, 2003/10/13 +blacklist_from ravms@*.stonline.sk + +# cjwatson, 2003/10/13 +blacklist_from root@ns5.glide.net.in + +# cjwatson, 2003/10/17 +blacklist_from VirusScanner@connexus.net.au + +# cjwatson, 2003/10/20 +blacklist_from antivir@Wheel.TSR.Ru + +# cjwatson, 2003/10/21 +blacklist_from DrWEB-DAEMON@example.com + +# cjwatson, 2003/10/21 +blacklist_from tech@shanghai.fr + +# cjwatson, 2003/10/28 +blacklist_from comercial@dafne.pt + +# cjwatson, 2003/11/03 +blacklist_from antivirus@comintern.ru + +# cjwatson, 2003-11-13 +blacklist_from masterroutine@america.com + +# cjwatson, 2003/11/15 +blacklist_from vaong@streetfan.com + +# cjwatson, 2004-02-20 +# Subject: Você tem Estilo de Vida?, e.g. #225634 +blacklist_from *@onda.com.br + +# cjwatson, 2004-03-08: junk flood to debian-boot +blacklist_from bornagain@gibnynex.gi + +# cjwatson, 2004-03-09: virus alert flood +blacklist_from support@vds.it + diff --git a/common/bts_scores b/common/bts_scores new file mode 100644 index 0000000..5808578 --- /dev/null +++ b/common/bts_scores @@ -0,0 +1,232 @@ +# relays.osirusoft.com is gone --joy, 2003-08-27 +score RCVD_IN_OSIRUSOFT_COM 0 + + +# Rules against generally dubious things that aren't supposed to be +# valid mails to the BTS + +# joy, 2003-04-08 +# bug in old spamassassins +score HTML_WEB_BUGS 4 + +# cjwatson, 2002/04/03 +# joy, 2003-04-12, 2003-04-19 +# cjwatson upgraded to 2.53, 2003/04/23 +# several of the following were suggested by Santiago Vila + +# adding 3 points to defaults as of 2.53 +score MICROSOFT_EXECUTABLE 3.100 +score MIME_HTML_ONLY 3.100 +score PENIS_ENLARGE 5.342 5.174 5.342 5.469 +score PENIS_ENLARGE2 5.290 5.799 3.909 5.126 +score HTML_MESSAGE 1.667 1.600 1.666 1.5 + +# adding 2 points to defaults as of 2.53 +score THE_BEST_RATE 6.300 6.141 5.954 6.284 +# cjwatson: this produces too many false positives +#score SUSPICIOUS_RECIPS 4.052 3.953 3.972 5.407 +score URGENT_BIZ 3.397 3.153 3.799 3.696 +score BASE64_ENC_TEXT 4.685 3.735 3.857 3.738 +score FROM_HAS_MIXED_NUMS2 3.101 3.699 3.101 4.178 +score HTTP_EXCESSIVE_ESCAPES 3.101 3.500 3.259 4.060 +score TO_MALFORMED 3.146 3.085 3.697 3.803 +score MIME_HTML_NO_CHARSET 2.742 2.738 2.141 2 +score BAD_CREDIT 2.787 2.716 2.535 2.491 +score MISSING_MIMEOLE 2.500 2.500 2.437 2.100 +score GREAT_OFFER 2 +score CLICK_BELOW_CAPS 2.500 2.500 2.100 2.500 +score CLICK_BELOW 2.227 2.100 2.100 2 + +# adding 1 point to defaults as of 2.53 +score X_PRIORITY_HIGH 2.919 2.989 1.815 2.873 +score MANY_EXCLAMATIONS 2.097 1.782 2.216 2.094 +score NORMAL_HTTP_TO_IP 1.942 1.531 1.524 1.926 +score X_MSMAIL_PRIORITY_HIGH 1.404 1 1 1.021 +score FROM_HAS_MIXED_NUMS 1 1 1.339 1 +# HTML_COMMENT_UNIQUE_ID gone in 2.53? +score HTML_FONT_BIG 1.294 1.136 1.262 1.293 +score HTML_FONT_COLOR_RED 1.100 +score HTML_FONT_COLOR_BLUE 1.100 +score HTML_FONT_COLOR_GRAY 1.100 +score HTML_FONT_COLOR_UNSAFE 1.100 +score SUB_FREE_OFFER 1.339 1.488 1.224 1.383 +score OFFER 1.100 +# FREE_MONEY gone in 2.53? +score DIET 1 1 1.042 1 +score UPPERCASE_75_100 1 +score UPPERCASE_50_75 1.840 1 1.334 1.478 +score UPPERCASE_25_50 2.555 2.132 1.860 1.584 +score HTML_FONT_COLOR_NOHASH 1 +score REMOVE_PAGE 1.318 1.100 1.365 1.303 +score MAILTO_WITH_SUBJ 1.409 1.115 1 1.573 +score HTML_TABLE_THICK_BORDER 2.101 2.101 2.101 1.500 +score MIME_BOUND_NEXTPART 1.427 1.361 1.376 1.307 +score DEAR_SOMETHING 3.596 3.596 2.806 2.803 +score HTML_IMAGE_ONLY_06 2.228 2.072 2.433 1.610 +score SUBJ_REMOVE 2.101 1.500 2.263 1.500 +score EARN_MONEY 1.967 2.228 1.960 1.744 +# /you (?:do not|no longer) wish to receive/i +score EXCUSE_14 1.046 1.100 1 1.016 +score HTML_TITLE_UNTITLED 1.386 1.423 1.501 1.0 +score FOR_FREE 1.625 1.545 1.592 1.455 +score REMOVE_SUBJ 2.639 1.813 2.193 1.440 +score DEAR_FREIND 2.5 +# these get +1 just on the merit of being fsckin' HTML in email +score HTML_10_20 0.996 1.030 1.303 1.036 +score HTML_20_30 1.287 1.104 1.293 1.571 +score HTML_30_40 1.708 1.834 1.344 1.658 +score HTML_40_50 2.058 1.747 1.814 1.428 +score HTML_50_60 1.551 1.212 1.532 1.100 +score HTML_60_70 1.518 1.121 1.100 1.100 +score HTML_70_80 1.682 1.379 1.310 1.254 +score HTML_80_90 1.406 1.483 1.163 1.166 +score HTML_90_100 1.500 1 1 1 + +# and these get 1 point for being pr0n +score PORN_16 3.896 3.896 3.166 3.799 +score PORN_4 3.371 3.599 2.457 3.135 +score PORN_6 2.560 3.613 3.900 2.764 +score PORN_15 3.900 3.900 2.666 3.900 +score AMATEUR_PORN 2.110 3.748 2.654 1.142 + +# adding 0.5 points to defaults as of 2.53 +score FROM_ENDS_IN_NUMS 1.111 1.219 1.080 1.175 +score NO_REAL_NAME 1.6 + +# many spams have In-Reply-To as well, +# the 2.44 default of -0.847 is too much +# the 2.53 default of -3.300 -3.301 -0.600 -3.201 is even worse +score IN_REP_TO 0 + +# same as In-Reply-To, References gets abused as well +# the 2.53 default is -6.600 -6.600 -6.500 -6.500 +score REFERENCES -0.600 -0.600 -0.500 -0.500 + +# normal mails which have debbugs-derived Subject fields have space, +# the 2.44 default of 2.639 is too much +# the 2.53 default is 2.425 2.026 1.101 2.329 +score SUBJ_HAS_SPACES 1.5 + +# spams sometimes have attributions too, +# the 2.53 default of -6.600 -6.500 -6.500 -6.500 is too much +score EMAIL_ATTRIBUTION -2.600 -2.500 -2.500 -2.500 + +# mass spams often seem to come from Exchange +# the 2.53 default of -5.801 -5.701 -5.701 -5.701 is just bonkers +score MSGID_GOOD_EXCHANGE 0.5 + +# stupidly too negative by default in 2.53, normalizing most to -1. +score USER_AGENT_MOZILLA_UA -1 +score USER_AGENT_APPLEMAIL -1 +score USER_AGENT_ENTOURAGE -1 +score USER_AGENT_GNUS_XM -1 +score USER_AGENT_IMP -1 +score USER_AGENT_MACOE -1 +score USER_AGENT_MOZILLA_XM -1 +score USER_AGENT_PINE -2 +score USER_AGENT_VM -1 +score USER_AGENT_FORTE -1 +score USER_AGENT_GNUS_UA -2 +score USER_AGENT_KMAIL -1 +score USER_AGENT_MOZILLA_UA -1 +score USER_AGENT_MSN -1 +score USER_AGENT_MUTT -2 +score USER_AGENT_TONLINE -1 +score USER_AGENT_XIMIAN -1 + +# pointless +score X_MAILING_LIST 0 + +# trust Razor2 more, --joy 2003-07-20 +# blarson 2006-10-29 rescore again +score RAZOR2_CHECK 1.5 +score RAZOR2_CF_RANGE_01_10 0.5 +score RAZOR2_CF_RANGE_11_20 1 +score RAZOR2_CF_RANGE_21_30 1.5 +score RAZOR2_CF_RANGE_31_40 2 +score RAZOR2_CF_RANGE_41_50 2.5 +score RAZOR2_CF_RANGE_51_60 3 +score RAZOR2_CF_RANGE_61_70 3.5 +score RAZOR2_CF_RANGE_71_80 4 +score RAZOR2_CF_RANGE_81_90 4.5 +score RAZOR2_CF_RANGE_91_100 5 +# blarson 2006-02-09 +score RAZOR2_CF_RANGE_51_100 3 + +# causes too many false positives since default 4.3 > required 4.0 +# blarson, 2004-04-11 +score SORTED_RECIPS 1 +score SUSPICIOUS_RECIPS 0.5 +# blarson 2005-11-01 +score USERPASS 1 + +# blarson 2006-10-26 +score MISSING_OUTLOOK_NAME 1 + +# blarson 2006-11-13 drop score, many non-spams hit +score FORGED_YAHOO_RCVD 1 + +# blarson 2006-12-12 +score ORDER_NOW 2 + +# blarson 2004-03-20 +# Disable most DNSBLs -- overhead to high +# blarson 2005-01-28 try reducing timeout while adding spamcop back +# blarson 2005-10-29 adding some back now we are multi-threaded +score RCVD_IN_BL_SPAMCOP_NET 1 +score RCVD_IN_BSP_OTHER 0 +score RCVD_IN_BSP_TRUSTED 0 +score RCVD_IN_DSBL 2 +score RCVD_IN_DYNABLOCK 0 +score RCVD_IN_NJABL 0 +score RCVD_IN_NJABL_CGI 0 +score RCVD_IN_NJABL_DIALUP 0 +score RCVD_IN_NJABL_MULTI 0 +score RCVD_IN_NJABL_PROXY 0 +score RCVD_IN_NJABL_RELAY 0 +score RCVD_IN_NJABL_SPAM 0 +# OPM is below +score RCVD_IN_OPM 0 +score RCVD_IN_OPM_HTTP 0 +score RCVD_IN_OPM_HTTP_POST 0 +score RCVD_IN_OPM_ROUTER 0 +score RCVD_IN_OPM_SOCKS 0 +score RCVD_IN_OPM_WINGATE 0 +score RCVD_IN_RFCI 0.5 +# SBL done below +score RCVD_IN_SBL 0 +# blarson 2006-01-06 SORBS up to 1 +score RCVD_IN_SORBS 1 +score RCVD_IN_SORBS_BLOCK 0.1 +score RCVD_IN_SORBS_HTTP 0.1 +score RCVD_IN_SORBS_MISC 0.1 +score RCVD_IN_SORBS_SMTP 0.1 +score RCVD_IN_SORBS_SOCKS 0.1 +score RCVD_IN_SORBS_WEB 0.1 +score RCVD_IN_SORBS_ZOMBIE 0.1 + +# blarson 2004-11-16 +# other network checks -- also disable +# blarson 2005-10-29 enable again +score DNS_FROM_RFCI_DSN 0.5 +score MSGID_FROM_MTA_BACKUP 0.1 +score NO_DNS_FOR_FROM 1 +score ROUND_THE_WORLD 0 + +# blarson 2004-10-22 +# spammers use habeas +score HABEAS_SWE 0.5 + +# blarson, 2004-04-14 +score BIZ_TLD 2.5 + +# blarson 2004-04-25 +score REMOVE_PAGE 2.5 + +# blarson 2004-11-08 +# claiming to be amazon... +score USER_IN_DEF_WHITELIST 0.5 + +# blarson 2004-11-08 +score BANG_GUARENTEE 2 + diff --git a/common/bts_specific b/common/bts_specific new file mode 100644 index 0000000..87e4199 --- /dev/null +++ b/common/bts_specific @@ -0,0 +1,82 @@ +# BTS Specific rules +# Rules to credit some properties of valid BTS mail + +rawbody HAS_PACKAGE /^Package:/im +describe HAS_PACKAGE Has a Package: line, probably a valid report +tflags HAS_PACKAGE nice +score HAS_PACKAGE -6.0 + +header X_DEBBUGS_CC exists:X-Debbugs-Cc +describe X_DEBBUGS_CC Has an X-Debbugs-Cc: header +tflags X_DEBBUGS_CC nice +score X_DEBBUGS_CC -3.0 + +header X_DEBBUGS_NO_ACK exists:X-Debbugs-No-Ack +describe X_DEBBUGS_NO_ACK Has an X-Debbugs-No-Ack: header +tflags X_DEBBUGS_NO_ACK nice +score X_DEBBUGS_NO_ACK -3.0 + +# SA doesn't like literal # symbols in rules +# blarson 2006-10-27 Allow space +header HAS_BUG_NUMBER Subject =~ /Bug\s*\x23\d+:/i +describe HAS_BUG_NUMBER Has a debbugs-style Bug# in the subject line +tflags HAS_BUG_NUMBER nice +score HAS_BUG_NUMBER -3.0 + +# blarson 2007-07-05 +rawbody VALID_BTS_CONTROL /^(reassign\s+\d{3,6}\s+[a-z\d-]+\s*|(reopen|submitter|owner)\s+\d{3,6}\s|forward\s+\d{3,6}\s+|(notforwarded|unmerge|noowner)\s+\d{3,6}\s*$|retitle\s+\d{3,6}\s+.{10,80}$|severity\s+\d{3,6}\s+(critical|grave|serious|important|normal|minor|wishlist)|clone\s+\d{3,6}\s+-\d$|merge(\s+\d{3,6}){2,4}\s*$|tags?\s+\d{3,6}\s+([\-\+\=]?\s*[a-z]+\s*)*|(not)?found\s+.+$)/i +describe VALID_BTS_CONTROL Seems to be valid BTS control command +tflags VALID_BTS_CONTROL nice +score VALID_BTS_CONTROL -2 + +# blarson 2004-04-10 20050316 add index packages +rawbody INDEXMAINT /^index(?:-|\s+)(?:maint\s+\S+\@|packages)/ +describe INDEXMAINT index-maint command +tflags INDEXMAINT nice +score INDEXMAINT -5 + +# blarson 2006-05-11 2006-09-09 change score +header SUBSCRIBEBUG To =~ /\b\d{3,7}\-(?:(?:un)?subscribe|subhelp|ignore|(?:sub(?:yes|approve|reject)|unsubyes|bounce|probe|approve|reject|setlistyes|setlistsilentyes).*)\@bugs\.debian\.org\b/ +describe SUBSCRIBEBUG subscribing to bug +tflags SUBSCRIBEBUG nice +score SUBSCRIBEBUG -1 + +# blarson 2007-04-26 +header SUBSCRIBE2 received =~ /\b for \d{3,7}\-(?:(?:un)?subscribe|subhelp|ignore|(?:sub(?:yes|approve|reject)|unsubyes|bounce|probe|approve|reject|setlistyes|setlistsilentyes).*)\@bugs\.debian\.org\b/ +describe SUBSCRIBE2 subscribing to bug +tflags SUBSCRIBE2 nice +score SUBSCRIBE2 -6 + +header FROMDEVELOPER From =~ /\@debian.org/i +describe FROMDEVELOPER Appears to be a message from a developer +tflags FROMDEVELOPER nice +score FROMDEVELOPER -2 + + +# joy, 2003-07-20, 2003-11-09 +# this is pretty generic +header BUGNUMBERGREETING Subject =~ /^(hi|hey)?\s*\d{4}\d*(-\S+)?(\!|,)/i +describe BUGNUMBERGREETING greeting or addressing the bug number +score BUGNUMBERGREETING 3 + +# joy, 2003-11-09, 2003-12-28 +# note that Subject: Bug#12345 ... and Subject: Re: Bug#12345 ... won't match +header SPAMBUGNUMSUBJ Subject =~ /^\d\d\d\d/i +describe SPAMBUGNUMSUBJ greeting or addressing the bug number, simple test +score SPAMBUGNUMSUBJ 1 + +# joy, 2003-12-29 +header SPAMBUGADDRSUBJ Subject =~ /^\d{4,}(-[^@]+)?\@bugs/i +describe SPAMBUGADDRSUBJ greeting or addressing the bug address +score SPAMBUGADDRSUBJ 2.5 + +# blarson 2007-07-06 +header MAJORDOMO subject =~ /\bMajordomo results\: Bug\b/ +describe MAJORDOMO MAJORDOMO infinite loop +score MAJORDOMO 4 + +# blarson 2007-07-19 +header INFOLOOP subject =~ /Re: Bug\#\d+\: Info received \(Bug\#\d+: Info received/ +describe INFOLOOP Loopy autoresponder +score INFOLOOP 7 + diff --git a/common/charset_tests b/common/charset_tests new file mode 100644 index 0000000..2bee3d5 --- /dev/null +++ b/common/charset_tests @@ -0,0 +1,1891 @@ +# SpamAssassin rules file: Chinese subject and body tests +# +# Maintainer: Quang-Anh Tran, , +# at CERNET Computer Emergency Response Team (CCERT) +# +# Please don't modify this file as your changes will be overwritten with +# the next update. Use @@LOCAL_RULES_DIR@@/local.cf instead. +# See 'perldoc Mail::SpamAssassin::Conf' for details. +# +# <@LICENSE> +# Copyright 2004-2005 CERNET Computer Emergency Response Team (CCERT) +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +############################################################################## +# +# Chinese_rules.cf, updated 2005 Apr 24 +# +# Test against 77159 spam and 147735 ham +# (using only the Chinese_rules.cf) +# +# Threshold Spam recall Ham error +# 0.5 90.8% 2.6% +# 1.0 87.4% 0.9% +# 1.5 83.3% 0.4% +# 2.0 79.1% 0.2% +# 2.5 74.5% 0.1% +# 3.0 70.5% 0.0% +# 3.5 66.0% 0.0% +# 4.0 61.5% 0.0% +# 4.5 56.8% 0.0% +# +# It takes 0.02 seconds to scan an email with size 2580.65 bytes (P4-2.8G CPU) + +# More info on CCERT website : http://www.ccert.edu.cn/spam/sa/Chinese_rules.htm +# ****************************************************************************** + +header CN_SUBJECT_1 Subject =~ /ÓÅ»Ý/ +describe CN_SUBJECT_1 Subject contains "ÓÅ»Ý" +score CN_SUBJECT_1 1.547 + +header CN_SUBJECT_4 Subject =~ /Ʊ£¡/ +describe CN_SUBJECT_4 Subject contains "Ʊ£¡" +score CN_SUBJECT_4 1.650 + +header CN_SUBJECT_5 Subject =~ /·¢Æ±/ +describe CN_SUBJECT_5 Subject contains "·¢Æ±" +score CN_SUBJECT_5 0.357 + +header CN_SUBJECT_8 Subject =~ /ÒµÎñ/ +describe CN_SUBJECT_8 Subject contains "ÒµÎñ" +score CN_SUBJECT_8 0.914 + +header CN_SUBJECT_9 Subject =~ /´ú¿ª/ +describe CN_SUBJECT_9 Subject contains "´ú¿ª" +score CN_SUBJECT_9 2.700 + +header CN_SUBJECT_12 Subject =~ /ºÏ×÷/ +describe CN_SUBJECT_12 Subject contains "ºÏ×÷" +score CN_SUBJECT_12 1.413 + +header CN_SUBJECT_15 Subject =~ /¹«Ë¾/ +describe CN_SUBJECT_15 Subject contains "¹«Ë¾" +score CN_SUBJECT_15 0.177 + +header CN_SUBJECT_17 Subject =~ /¸÷Àà/ +describe CN_SUBJECT_17 Subject contains "¸÷Àà" +score CN_SUBJECT_17 0.568 + +header CN_SUBJECT_20 Subject =~ /ÆóÒµ/ +describe CN_SUBJECT_20 Subject contains "ÆóÒµ" +score CN_SUBJECT_20 0.773 + +header CN_SUBJECT_32 Subject =~ /ÔËÊä/ +describe CN_SUBJECT_32 Subject contains "ÔËÊä" +score CN_SUBJECT_32 0.043 + +header CN_SUBJECT_34 Subject =~ /Åàѵ/ +describe CN_SUBJECT_34 Subject contains "Åàѵ" +score CN_SUBJECT_34 1.098 + +header CN_SUBJECT_35 Subject =~ /ÏúÊÛ/ +describe CN_SUBJECT_35 Subject contains "ÏúÊÛ" +score CN_SUBJECT_35 1.078 + +header CN_SUBJECT_41 Subject =~ /²úÆ·/ +describe CN_SUBJECT_41 Subject contains "²úÆ·" +score CN_SUBJECT_41 0.972 + +header CN_SUBJECT_48 Subject =~ /ʵҵ/ +describe CN_SUBJECT_48 Subject contains "ʵҵ" +score CN_SUBJECT_48 1.306 + +header CN_SUBJECT_51 Subject =~ /ÉÌÎñ/ +describe CN_SUBJECT_51 Subject contains "ÉÌÎñ" +score CN_SUBJECT_51 1.440 + +header CN_SUBJECT_52 Subject =~ /ÌؼÛ/ +describe CN_SUBJECT_52 Subject contains "ÌؼÛ" +score CN_SUBJECT_52 1.440 + +header CN_SUBJECT_57 Subject =~ /¾­Àí/ +describe CN_SUBJECT_57 Subject contains "¾­Àí" +score CN_SUBJECT_57 0.245 + +header CN_SUBJECT_58 Subject =~ /¹ãÖÝ/ +describe CN_SUBJECT_58 Subject contains "¹ãÖÝ" +score CN_SUBJECT_58 0.512 + +header CN_SUBJECT_59 Subject =~ /²ÆÎñ/ +describe CN_SUBJECT_59 Subject contains "²ÆÎñ" +score CN_SUBJECT_59 0.150 + +header CN_SUBJECT_62 Subject =~ /óÒ×/ +describe CN_SUBJECT_62 Subject contains "óÒ×" +score CN_SUBJECT_62 0.591 + +header CN_SUBJECT_64 Subject =~ /ÑÐÐÞ/ +describe CN_SUBJECT_64 Subject contains "ÑÐÐÞ" +score CN_SUBJECT_64 1.380 + +header CN_SUBJECT_68 Subject =~ /ÄãºÃ/ +describe CN_SUBJECT_68 Subject contains "ÄãºÃ" +score CN_SUBJECT_68 1.200 + +header CN_SUBJECT_73 Subject =~ /׬Ǯ/ +describe CN_SUBJECT_73 Subject contains "׬Ǯ" +score CN_SUBJECT_73 1.020 + +header CN_SUBJECT_74 Subject =~ /¡°µçÄÔ/ +describe CN_SUBJECT_74 Subject contains "¡°µçÄÔ" +score CN_SUBJECT_74 0.870 + +header CN_SUBJECT_75 Subject =~ /×îС°/ +describe CN_SUBJECT_75 Subject contains "×îС°" +score CN_SUBJECT_75 0.213 + +header CN_SUBJECT_77 Subject =~ /ÓªÏú/ +describe CN_SUBJECT_77 Subject contains "ÓªÏú" +score CN_SUBJECT_77 0.085 + +header CN_SUBJECT_82 Subject =~ /¸÷ÖÖ/ +describe CN_SUBJECT_82 Subject contains "¸÷ÖÖ" +score CN_SUBJECT_82 1.101 + +header CN_SUBJECT_84 Subject =~ /ÄúµÄ/ +describe CN_SUBJECT_84 Subject contains "ÄúµÄ" +score CN_SUBJECT_84 1.320 + +header CN_SUBJECT_86 Subject =~ /¿Î³Ì/ +describe CN_SUBJECT_86 Subject contains "¿Î³Ì" +score CN_SUBJECT_86 0.683 + +header CN_SUBJECT_87 Subject =~ /¿Í»§/ +describe CN_SUBJECT_87 Subject contains "¿Í»§" +score CN_SUBJECT_87 0.655 + +header CN_SUBJECT_89 Subject =~ /¾Æµê/ +describe CN_SUBJECT_89 Subject contains "¾Æµê" +score CN_SUBJECT_89 1.200 + +header CN_SUBJECT_99 Subject =~ /ÔùËÍ/ +describe CN_SUBJECT_99 Subject contains "ÔùËÍ" +score CN_SUBJECT_99 1.140 + +header CN_SUBJECT_106 Subject =~ /ÐÂÄê¿ìÀÖ/ +describe CN_SUBJECT_106 Subject contains "ÐÂÄê¿ìÀÖ" +score CN_SUBJECT_106 1.260 + +header CN_SUBJECT_111 Subject =~ /×¢²áÏã¸Û/ +describe CN_SUBJECT_111 Subject contains "×¢²áÏã¸Û" +score CN_SUBJECT_111 1.260 + +header CN_SUBJECT_114 Subject =~ /Íƹã/ +describe CN_SUBJECT_114 Subject contains "Íƹã" +score CN_SUBJECT_114 0.494 + +header CN_SUBJECT_115 Subject =~ /´óÈ«/ +describe CN_SUBJECT_115 Subject contains "´óÈ«" +score CN_SUBJECT_115 1.028 + +header CN_SUBJECT_117 Subject =~ /¸¶¿î/ +describe CN_SUBJECT_117 Subject contains "¸¶¿î" +score CN_SUBJECT_117 0.052 + +header CN_SUBJECT_118 Subject =~ /ÓµÓÐ/ +describe CN_SUBJECT_118 Subject contains "ÓµÓÐ" +score CN_SUBJECT_118 0.780 + +header CN_SUBJECT_121 Subject =~ /άÐÞ/ +describe CN_SUBJECT_121 Subject contains "άÐÞ" +score CN_SUBJECT_121 0.809 + +header CN_SUBJECT_122 Subject =~ /Ͷ×Ê/ +describe CN_SUBJECT_122 Subject contains "Ͷ×Ê" +score CN_SUBJECT_122 0.870 + +header CN_SUBJECT_128 Subject =~ /ѵÁ·/ +describe CN_SUBJECT_128 Subject contains "ѵÁ·" +score CN_SUBJECT_128 0.198 + +header CN_SUBJECT_129 Subject =~ /ÓÃÆ·/ +describe CN_SUBJECT_129 Subject contains "ÓÃÆ·" +score CN_SUBJECT_129 0.960 + +header CN_SUBJECT_130 Subject =~ /ÍËÐÅ/ +describe CN_SUBJECT_130 Subject contains "ÍËÐÅ" +score CN_SUBJECT_130 1.320 + +header CN_SUBJECT_138 Subject =~ /»úƱ/ +describe CN_SUBJECT_138 Subject contains "»úƱ" +score CN_SUBJECT_138 0.995 + +header CN_SUBJECT_140 Subject =~ /·½°¸/ +describe CN_SUBJECT_140 Subject contains "·½°¸" +score CN_SUBJECT_140 0.605 + +header CN_SUBJECT_142 Subject =~ /¼ÓÃË/ +describe CN_SUBJECT_142 Subject contains "¼ÓÃË" +score CN_SUBJECT_142 1.140 + +header CN_SUBJECT_149 Subject =~ /²É¹º/ +describe CN_SUBJECT_149 Subject contains "²É¹º" +score CN_SUBJECT_149 0.696 + +header CN_SUBJECT_158 Subject =~ /·ÑÓÃ/ +describe CN_SUBJECT_158 Subject contains "·ÑÓÃ" +score CN_SUBJECT_158 0.654 + +header CN_SUBJECT_159 Subject =~ /ÈËÁ¦/ +describe CN_SUBJECT_159 Subject contains "ÈËÁ¦" +score CN_SUBJECT_159 0.108 + +header CN_SUBJECT_161 Subject =~ /ÀñÆ·/ +describe CN_SUBJECT_161 Subject contains "ÀñÆ·" +score CN_SUBJECT_161 0.987 + +header CN_SUBJECT_169 Subject =~ /ÌáÉý/ +describe CN_SUBJECT_169 Subject contains "ÌáÉý" +score CN_SUBJECT_169 1.140 + +header CN_SUBJECT_170 Subject =~ /µÍ¼Û/ +describe CN_SUBJECT_170 Subject contains "µÍ¼Û" +score CN_SUBJECT_170 1.080 + +header CN_SUBJECT_173 Subject =~ /ÔÓÖ¾/ +describe CN_SUBJECT_173 Subject contains "ÔÓÖ¾" +score CN_SUBJECT_173 0.840 + +header CN_SUBJECT_174 Subject =~ /×ÊÁÏ£¡/ +describe CN_SUBJECT_174 Subject contains "×ÊÁÏ£¡" +score CN_SUBJECT_174 1.065 + +header CN_SUBJECT_176 Subject =~ /ÄÚ²¿/ +describe CN_SUBJECT_176 Subject contains "ÄÚ²¿" +score CN_SUBJECT_176 0.222 + +header CN_SUBJECT_177 Subject =~ /½øÏú´æ/ +describe CN_SUBJECT_177 Subject contains "½øÏú´æ" +score CN_SUBJECT_177 1.140 + +header CN_SUBJECT_179 Subject =~ /¹©Ó¦/ +describe CN_SUBJECT_179 Subject contains "¹©Ó¦" +score CN_SUBJECT_179 1.055 + +header CN_SUBJECT_180 Subject =~ /¶ú»ú / +describe CN_SUBJECT_180 Subject contains "¶ú»ú " +score CN_SUBJECT_180 1.140 + +header CN_SUBJECT_181 Subject =~ /¾«Æ·/ +describe CN_SUBJECT_181 Subject contains "¾«Æ·" +score CN_SUBJECT_181 0.960 + +header CN_SUBJECT_187 Subject =~ /Ͷ¸å/ +describe CN_SUBJECT_187 Subject contains "Ͷ¸å" +score CN_SUBJECT_187 1.020 + +header CN_SUBJECT_194 Subject =~ /É豸/ +describe CN_SUBJECT_194 Subject contains "É豸" +score CN_SUBJECT_194 0.776 + +header CN_SUBJECT_199 Subject =~ /³É¹¦µÄ/ +describe CN_SUBJECT_199 Subject contains "³É¹¦µÄ" +score CN_SUBJECT_199 1.080 + +header CN_SUBJECT_202 Subject =~ /¼æÖ°/ +describe CN_SUBJECT_202 Subject contains "¼æÖ°" +score CN_SUBJECT_202 0.731 + +header CN_SUBJECT_205 Subject =~ /±êÇ©/ +describe CN_SUBJECT_205 Subject contains "±êÇ©" +score CN_SUBJECT_205 1.010 + +header CN_SUBJECT_214 Subject =~ /É̱ê/ +describe CN_SUBJECT_214 Subject contains "É̱ê" +score CN_SUBJECT_214 1.020 + +header CN_SUBJECT_216 Subject =~ /¼¼ÇÉ/ +describe CN_SUBJECT_216 Subject contains "¼¼ÇÉ" +score CN_SUBJECT_216 0.539 + +header CN_SUBJECT_217 Subject =~ /KR-G ºÍ/ +describe CN_SUBJECT_217 Subject contains "KR-G ºÍ" +score CN_SUBJECT_217 1.320 + +header CN_SUBJECT_221 Subject =~ /ÁªÃË/ +describe CN_SUBJECT_221 Subject contains "ÁªÃË" +score CN_SUBJECT_221 0.860 + +header CN_SUBJECT_223 Subject =~ /ÎÞÏß×ÔÓÉ/ +describe CN_SUBJECT_223 Subject contains "ÎÞÏß×ÔÓÉ" +score CN_SUBJECT_223 1.080 + +header CN_SUBJECT_230 Subject =~ / ÎÞÏß/ +describe CN_SUBJECT_230 Subject contains " ÎÞÏß" +score CN_SUBJECT_230 1.020 + +header CN_SUBJECT_234 Subject =~ /¼¼ÄÜ/ +describe CN_SUBJECT_234 Subject contains "¼¼ÄÜ" +score CN_SUBJECT_234 0.998 + +header CN_SUBJECT_235 Subject =~ /ÉÏÃÅ/ +describe CN_SUBJECT_235 Subject contains "ÉÏÃÅ" +score CN_SUBJECT_235 0.501 + +header CN_SUBJECT_238 Subject =~ /ÇáËÉ/ +describe CN_SUBJECT_238 Subject contains "ÇáËÉ" +score CN_SUBJECT_238 0.960 + +header CN_SUBJECT_239 Subject =~ /²ß»®/ +describe CN_SUBJECT_239 Subject contains "²ß»®" +score CN_SUBJECT_239 0.900 + +header CN_SUBJECT_241 Subject =~ /100MÍøÒ³/ +describe CN_SUBJECT_241 Subject contains "100MÍøÒ³" +score CN_SUBJECT_241 1.020 + +header CN_SUBJECT_242 Subject =~ /ÍøÒ³¿Õ¼ä/ +describe CN_SUBJECT_242 Subject contains "ÍøÒ³¿Õ¼ä" +score CN_SUBJECT_242 1.020 + +header CN_SUBJECT_243 Subject =~ /ÕÆÎÕ/ +describe CN_SUBJECT_243 Subject contains "ÕÆÎÕ" +score CN_SUBJECT_243 0.939 + +header CN_SUBJECT_244 Subject =~ /»áÔ±/ +describe CN_SUBJECT_244 Subject contains "»áÔ±" +score CN_SUBJECT_244 0.720 + +header CN_SUBJECT_247 Subject =~ /À¶ÑÀ/ +describe CN_SUBJECT_247 Subject contains "À¶ÑÀ" +score CN_SUBJECT_247 1.320 + +header CN_SUBJECT_248 Subject =~ /ËÍÀñ/ +describe CN_SUBJECT_248 Subject contains "ËÍÀñ" +score CN_SUBJECT_248 0.877 + +header CN_SUBJECT_249 Subject =~ /Ãؾ÷/ +describe CN_SUBJECT_249 Subject contains "Ãؾ÷" +score CN_SUBJECT_249 0.960 + +header CN_SUBJECT_251 Subject =~ /ÈÃÄãµÄ/ +describe CN_SUBJECT_251 Subject contains "ÈÃÄãµÄ" +score CN_SUBJECT_251 1.020 + +header CN_SUBJECT_252 Subject =~ /¡¢¹ã¸æ/ +describe CN_SUBJECT_252 Subject contains "¡¢¹ã¸æ" +score CN_SUBJECT_252 0.576 + +header CN_SUBJECT_256 Subject =~ /ÍùÍù/ +describe CN_SUBJECT_256 Subject contains "ÍùÍù" +score CN_SUBJECT_256 0.366 + +header CN_SUBJECT_258 Subject =~ /ʪ¶È/ +describe CN_SUBJECT_258 Subject contains "ʪ¶È" +score CN_SUBJECT_258 0.960 + +header CN_SUBJECT_259 Subject =~ /˰Ʊ/ +describe CN_SUBJECT_259 Subject contains "˰Ʊ" +score CN_SUBJECT_259 0.673 + +header CN_SUBJECT_260 Subject =~ /É̳Ç/ +describe CN_SUBJECT_260 Subject contains "É̳Ç" +score CN_SUBJECT_260 0.871 + +header CN_SUBJECT_261 Subject =~ /£ºÒ»Äê/ +describe CN_SUBJECT_261 Subject contains "£ºÒ»Äê" +score CN_SUBJECT_261 0.482 + +header CN_SUBJECT_264 Subject =~ /ÑéÖ¤ºó/ +describe CN_SUBJECT_264 Subject contains "ÑéÖ¤ºó" +score CN_SUBJECT_264 0.862 + +header CN_SUBJECT_267 Subject =~ /дº/ +describe CN_SUBJECT_267 Subject contains "дº" +score CN_SUBJECT_267 0.960 + +header CN_SUBJECT_268 Subject =~ /±¨¹Ø/ +describe CN_SUBJECT_268 Subject contains "±¨¹Ø" +score CN_SUBJECT_268 0.658 + +header CN_SUBJECT_282 Subject =~ /¡¢·þÎñ/ +describe CN_SUBJECT_282 Subject contains "¡¢·þÎñ" +score CN_SUBJECT_282 0.729 + +header CN_SUBJECT_283 Subject =~ /¹ÉƱ/ +describe CN_SUBJECT_283 Subject contains "¹ÉƱ" +score CN_SUBJECT_283 0.535 + +header CN_SUBJECT_284 Subject =~ /´ÙÏú/ +describe CN_SUBJECT_284 Subject contains "´ÙÏú" +score CN_SUBJECT_284 0.720 + +header CN_SUBJECT_285 Subject =~ /³öÊÛ/ +describe CN_SUBJECT_285 Subject contains "³öÊÛ" +score CN_SUBJECT_285 0.812 + +header CN_SUBJECT_288 Subject =~ /ºÍÉú»î/ +describe CN_SUBJECT_288 Subject contains "ºÍÉú»î" +score CN_SUBJECT_288 0.842 + +header CN_SUBJECT_289 Subject =~ /Åú·¢/ +describe CN_SUBJECT_289 Subject contains "Åú·¢" +score CN_SUBJECT_289 1.080 + +header CN_SUBJECT_291 Subject =~ /¹ã½»»á/ +describe CN_SUBJECT_291 Subject contains "¹ã½»»á" +score CN_SUBJECT_291 0.900 + +header CN_SUBJECT_294 Subject =~ /³ÏÕ÷/ +describe CN_SUBJECT_294 Subject contains "³ÏÕ÷" +score CN_SUBJECT_294 1.058 + +header CN_SUBJECT_298 Subject =~ /Ô´´úÂë/ +describe CN_SUBJECT_298 Subject contains "Ô´´úÂë" +score CN_SUBJECT_298 0.780 + +header CN_SUBJECT_301 Subject =~ /ÄãµÄÊÂÒµ/ +describe CN_SUBJECT_301 Subject contains "ÄãµÄÊÂÒµ" +score CN_SUBJECT_301 0.498 + +header CN_SUBJECT_302 Subject =~ /´úÀíÉÌ/ +describe CN_SUBJECT_302 Subject contains "´úÀíÉÌ" +score CN_SUBJECT_302 0.767 + +header CN_SUBJECT_303 Subject =~ /ÊÂÒµºÍ/ +describe CN_SUBJECT_303 Subject contains "ÊÂÒµºÍ" +score CN_SUBJECT_303 0.498 + +header CN_SUBJECT_307 Subject =~ /¸ü¼Ó/ +describe CN_SUBJECT_307 Subject contains "¸ü¼Ó" +score CN_SUBJECT_307 0.097 + +header CN_SUBJECT_311 Subject =~ /´óÖÚ/ +describe CN_SUBJECT_311 Subject contains "´óÖÚ" +score CN_SUBJECT_311 0.780 + +header CN_SUBJECT_312 Subject =~ /½¨Íø/ +describe CN_SUBJECT_312 Subject contains "½¨Íø" +score CN_SUBJECT_312 0.840 + +header CN_SUBJECT_315 Subject =~ /Ò£¿Ø/ +describe CN_SUBJECT_315 Subject contains "Ò£¿Ø" +score CN_SUBJECT_315 0.706 + +header CN_SUBJECT_316 Subject =~ /»Ø±¨/ +describe CN_SUBJECT_316 Subject contains "»Ø±¨" +score CN_SUBJECT_316 0.780 + +header CN_SUBJECT_322 Subject =~ /Õ÷¸å/ +describe CN_SUBJECT_322 Subject contains "Õ÷¸å" +score CN_SUBJECT_322 0.677 + +header CN_SUBJECT_323 Subject =~ /-±±¾©/ +describe CN_SUBJECT_323 Subject contains "-±±¾©" +score CN_SUBJECT_323 0.807 + +header CN_SUBJECT_328 Subject =~ /·þÎñµÈ/ +describe CN_SUBJECT_328 Subject contains "·þÎñµÈ" +score CN_SUBJECT_328 0.574 + +header CN_SUBJECT_330 Subject =~ /¹ã¸æ¡¢/ +describe CN_SUBJECT_330 Subject contains "¹ã¸æ¡¢" +score CN_SUBJECT_330 0.487 + +header CN_SUBJECT_336 Subject =~ /ʱÉÐ/ +describe CN_SUBJECT_336 Subject contains "ʱÉÐ" +score CN_SUBJECT_336 0.720 + +header CN_SUBJECT_338 Subject =~ /³ö¿Ú/ +describe CN_SUBJECT_338 Subject contains "³ö¿Ú" +score CN_SUBJECT_338 0.538 + +header CN_SUBJECT_339 Subject =~ /¹©Çó/ +describe CN_SUBJECT_339 Subject contains "¹©Çó" +score CN_SUBJECT_339 0.780 + +header CN_SUBJECT_345 Subject =~ /ÍøÕ¾½¨Éè/ +describe CN_SUBJECT_345 Subject contains "ÍøÕ¾½¨Éè" +score CN_SUBJECT_345 0.780 + +header CN_SUBJECT_346 Subject =~ /Ô¤¶©/ +describe CN_SUBJECT_346 Subject contains "Ô¤¶©" +score CN_SUBJECT_346 0.720 + +header CN_SUBJECT_347 Subject =~ /Ô¤Ëã¹ÜÀí/ +describe CN_SUBJECT_347 Subject contains "Ô¤Ëã¹ÜÀí" +score CN_SUBJECT_347 0.464 + +header CN_SUBJECT_348 Subject =~ /È«ÃæÔ¤Ëã/ +describe CN_SUBJECT_348 Subject contains "È«ÃæÔ¤Ëã" +score CN_SUBJECT_348 0.464 + +header CN_SUBJECT_354 Subject =~ /Íâó/ +describe CN_SUBJECT_354 Subject contains "Íâó" +score CN_SUBJECT_354 0.780 + +header CN_SUBJECT_363 Subject =~ /ΪÄú/ +describe CN_SUBJECT_363 Subject contains "ΪÄú" +score CN_SUBJECT_363 1.320 + +header CN_SUBJECT_367 Subject =~ /°à£¨/ +describe CN_SUBJECT_367 Subject contains "°à£¨" +score CN_SUBJECT_367 0.539 + +header CN_SUBJECT_372 Subject =~ /ר¿¯/ +describe CN_SUBJECT_372 Subject contains "ר¿¯" +score CN_SUBJECT_372 0.780 + +header CN_SUBJECT_374 Subject =~ /¹ÜÀíôß/ +describe CN_SUBJECT_374 Subject contains "¹ÜÀíôß" +score CN_SUBJECT_374 0.381 + +header CN_SUBJECT_375 Subject =~ /³ÏÐÅ/ +describe CN_SUBJECT_375 Subject contains "³ÏÐÅ" +score CN_SUBJECT_375 0.645 + +header CN_SUBJECT_379 Subject =~ /°ìÀí¿í´ø/ +describe CN_SUBJECT_379 Subject contains "°ìÀí¿í´ø" +score CN_SUBJECT_379 0.780 + +header CN_SUBJECT_385 Subject =~ /¶À¼Ò/ +describe CN_SUBJECT_385 Subject contains "¶À¼Ò" +score CN_SUBJECT_385 0.720 + +header CN_SUBJECT_389 Subject =~ /¹ÜÀíÈí¼þ/ +describe CN_SUBJECT_389 Subject contains "¹ÜÀíÈí¼þ" +score CN_SUBJECT_389 0.780 + +header CN_SUBJECT_392 Subject =~ /12ÔÂ11È/ +describe CN_SUBJECT_392 Subject contains "12ÔÂ11È" +score CN_SUBJECT_392 0.445 + +header CN_SUBJECT_393 Subject =~ /ºÃÀûͨ/ +describe CN_SUBJECT_393 Subject contains "ºÃÀûͨ" +score CN_SUBJECT_393 0.659 + +header CN_SUBJECT_394 Subject =~ /ÉÌÒµÓ¢Óï/ +describe CN_SUBJECT_394 Subject contains "ÉÌÒµÓ¢Óï" +score CN_SUBJECT_394 0.720 + +header CN_SUBJECT_396 Subject =~ /Ê×·Ý/ +describe CN_SUBJECT_396 Subject contains "Ê×·Ý" +score CN_SUBJECT_396 0.720 + +header CN_SUBJECT_398 Subject =~ /¶©ÔÄ/ +describe CN_SUBJECT_398 Subject contains "¶©ÔÄ" +score CN_SUBJECT_398 0.641 + +header CN_SUBJECT_399 Subject =~ /Ãû¼/ +describe CN_SUBJECT_399 Subject contains "Ãû¼" +score CN_SUBJECT_399 0.780 + +header CN_SUBJECT_404 Subject =~ /»ï°é/ +describe CN_SUBJECT_404 Subject contains "»ï°é" +score CN_SUBJECT_404 0.551 + +header CN_SUBJECT_406 Subject =~ /äìÈ÷/ +describe CN_SUBJECT_406 Subject contains "äìÈ÷" +score CN_SUBJECT_406 0.009 + +header CN_SUBJECT_414 Subject =~ /¹ÜÀíϵͳ/ +describe CN_SUBJECT_414 Subject contains "¹ÜÀíϵͳ" +score CN_SUBJECT_414 0.720 + +header CN_SUBJECT_416 Subject =~ /Éú»îÕæ/ +describe CN_SUBJECT_416 Subject contains "Éú»îÕæ" +score CN_SUBJECT_416 0.001 + +header CN_SUBJECT_417 Subject =~ /ÕæÐèÒª/ +describe CN_SUBJECT_417 Subject contains "ÕæÐèÒª" +score CN_SUBJECT_417 0.566 + +header CN_SUBJECT_420 Subject =~ /»õÔË/ +describe CN_SUBJECT_420 Subject contains "»õÔË" +score CN_SUBJECT_420 0.720 + +header CN_SUBJECT_422 Subject =~ /ÖúÄú/ +describe CN_SUBJECT_422 Subject contains "ÖúÄú" +score CN_SUBJECT_422 0.840 + +header CN_SUBJECT_423 Subject =~ /²éÊÕ/ +describe CN_SUBJECT_423 Subject contains "²éÊÕ" +score CN_SUBJECT_423 0.600 + +header CN_SUBJECT_425 Subject =~ /º£ÔË/ +describe CN_SUBJECT_425 Subject contains "º£ÔË" +score CN_SUBJECT_425 0.780 + +header CN_SUBJECT_429 Subject =~ /ÊÕÒæ/ +describe CN_SUBJECT_429 Subject contains "ÊÕÒæ" +score CN_SUBJECT_429 0.720 + +header CN_SUBJECT_436 Subject =~ /½ÚÊ¡/ +describe CN_SUBJECT_436 Subject contains "½ÚÊ¡" +score CN_SUBJECT_436 0.660 + +header CN_SUBJECT_437 Subject =~ /2005Öйú/ +describe CN_SUBJECT_437 Subject contains "2005Öйú" +score CN_SUBJECT_437 0.600 + +header CN_SUBJECT_441 Subject =~ /¿ìÀÖ£¬/ +describe CN_SUBJECT_441 Subject contains "¿ìÀÖ£¬" +score CN_SUBJECT_441 0.540 + +header CN_SUBJECT_448 Subject =~ /ɳÅÌ/ +describe CN_SUBJECT_448 Subject contains "ɳÅÌ" +score CN_SUBJECT_448 0.660 + +header CN_SUBJECT_450 Subject =~ /»¥Àû/ +describe CN_SUBJECT_450 Subject contains "»¥Àû" +score CN_SUBJECT_450 0.660 + +header CN_SUBJECT_457 Subject =~ /Ìåϵ/ +describe CN_SUBJECT_457 Subject contains "Ìåϵ" +score CN_SUBJECT_457 0.004 + +header CN_SUBJECT_464 Subject =~ /ÍøÕ¾!/ +describe CN_SUBJECT_464 Subject contains "ÍøÕ¾!" +score CN_SUBJECT_464 0.660 + +header CN_SUBJECT_467 Subject =~ /°ü×°/ +describe CN_SUBJECT_467 Subject contains "°ü×°" +score CN_SUBJECT_467 0.600 + +header CN_SUBJECT_469 Subject =~ /¾«ÃÀ/ +describe CN_SUBJECT_469 Subject contains "¾«ÃÀ" +score CN_SUBJECT_469 0.660 + +header CN_SUBJECT_470 Subject =~ /ÂòÂô/ +describe CN_SUBJECT_470 Subject contains "ÂòÂô" +score CN_SUBJECT_470 0.660 + +header CN_SUBJECT_480 Subject =~ /ÖйúÐÐÒµ/ +describe CN_SUBJECT_480 Subject contains "ÖйúÐÐÒµ" +score CN_SUBJECT_480 0.600 + +header CN_SUBJECT_495 Subject =~ /º£Íâ/ +describe CN_SUBJECT_495 Subject contains "º£Íâ" +score CN_SUBJECT_495 0.540 + +header CN_SUBJECT_497 Subject =~ /Éç¿Æ/ +describe CN_SUBJECT_497 Subject contains "Éç¿Æ" +score CN_SUBJECT_497 0.443 + +header CN_SUBJECT_500 Subject =~ /ÌìµØ/ +describe CN_SUBJECT_500 Subject contains "ÌìµØ" +score CN_SUBJECT_500 0.419 + +header CN_SUBJECT_503 Subject =~ /·Àα/ +describe CN_SUBJECT_503 Subject contains "·Àα" +score CN_SUBJECT_503 0.448 + +header CN_SUBJECT_506 Subject =~ /ÏîÄ¿¹ÜÀí/ +describe CN_SUBJECT_506 Subject contains "ÏîÄ¿¹ÜÀí" +score CN_SUBJECT_506 0.465 + +header CN_SUBJECT_507 Subject =~ /ÊýÂëÔÚÏß/ +describe CN_SUBJECT_507 Subject contains "ÊýÂëÔÚÏß" +score CN_SUBJECT_507 0.600 + +header CN_SUBJECT_508 Subject =~ /»¨ºÜÉÙ/ +describe CN_SUBJECT_508 Subject contains "»¨ºÜÉÙ" +score CN_SUBJECT_508 0.720 + +header CN_SUBJECT_512 Subject =~ /ӦƸ/ +describe CN_SUBJECT_512 Subject contains "ӦƸ" +score CN_SUBJECT_512 0.600 + +header CN_SUBJECT_515 Subject =~ /×ÊÔ´3P/ +describe CN_SUBJECT_515 Subject contains "×ÊÔ´3P" +score CN_SUBJECT_515 0.600 + +header CN_SUBJECT_516 Subject =~ /3Pϵͳ/ +describe CN_SUBJECT_516 Subject contains "3Pϵͳ" +score CN_SUBJECT_516 0.600 + +header CN_SUBJECT_517 Subject =~ /´ú·¢Óʼþ/ +describe CN_SUBJECT_517 Subject contains "´ú·¢Óʼþ" +score CN_SUBJECT_517 0.600 + +header CN_SUBJECT_518 Subject =~ /Ô±¹¤/ +describe CN_SUBJECT_518 Subject contains "Ô±¹¤" +score CN_SUBJECT_518 0.438 + +header CN_SUBJECT_519 Subject =~ /±¨¼Û/ +describe CN_SUBJECT_519 Subject contains "±¨¼Û" +score CN_SUBJECT_519 0.456 + +header CN_SUBJECT_523 Subject =~ /³ê±ö/ +describe CN_SUBJECT_523 Subject contains "³ê±ö" +score CN_SUBJECT_523 0.540 + +header CN_SUBJECT_525 Subject =~ /°ïÄãÕÒ/ +describe CN_SUBJECT_525 Subject contains "°ïÄãÕÒ" +score CN_SUBJECT_525 0.646 + +header CN_SUBJECT_531 Subject =~ /×£Äú/ +describe CN_SUBJECT_531 Subject contains "×£Äú" +score CN_SUBJECT_531 0.780 + +header CN_SUBJECT_533 Subject =~ /¼¨Ð§/ +describe CN_SUBJECT_533 Subject contains "¼¨Ð§" +score CN_SUBJECT_533 0.600 + +header CN_SUBJECT_536 Subject =~ /ÆÀ¹À˵Ã÷/ +describe CN_SUBJECT_536 Subject contains "ÆÀ¹À˵Ã÷" +score CN_SUBJECT_536 0.323 + +header CN_SUBJECT_537 Subject =~ /£©´òÓ¡»ú/ +describe CN_SUBJECT_537 Subject contains "£©´òÓ¡»ú" +score CN_SUBJECT_537 0.323 + +header CN_SUBJECT_540 Subject =~ /ÌõÐÎÂë/ +describe CN_SUBJECT_540 Subject contains "ÌõÐÎÂë" +score CN_SUBJECT_540 0.323 + +header CN_SUBJECT_542 Subject =~ /ͶÈëÆÀ¹À/ +describe CN_SUBJECT_542 Subject contains "ͶÈëÆÀ¹À" +score CN_SUBJECT_542 0.323 + +header CN_SUBJECT_548 Subject =~ /Åä¶Ôϵͳ/ +describe CN_SUBJECT_548 Subject contains "Åä¶Ôϵͳ" +score CN_SUBJECT_548 0.364 + +header CN_SUBJECT_549 Subject =~ /×Ô¶¯ÕÒ/ +describe CN_SUBJECT_549 Subject contains "×Ô¶¯ÕÒ" +score CN_SUBJECT_549 0.364 + +header CN_SUBJECT_551 Subject =~ /Òµ¼¨/ +describe CN_SUBJECT_551 Subject contains "Òµ¼¨" +score CN_SUBJECT_551 0.004 + +header CN_SUBJECT_552 Subject =~ /¶¥¼â/ +describe CN_SUBJECT_552 Subject contains "¶¥¼â" +score CN_SUBJECT_552 0.540 + +header CN_SUBJECT_559 Subject =~ /·ÀÉí/ +describe CN_SUBJECT_559 Subject contains "·ÀÉí" +score CN_SUBJECT_559 0.660 + +header CN_SUBJECT_560 Subject =~ /ÀñÒÇ/ +describe CN_SUBJECT_560 Subject contains "ÀñÒÇ" +score CN_SUBJECT_560 0.409 + +header CN_SUBJECT_563 Subject =~ /Æ÷²Ä/ +describe CN_SUBJECT_563 Subject contains "Æ÷²Ä" +score CN_SUBJECT_563 0.505 + +header CN_SUBJECT_564 Subject =~ /½»ÓÑ/ +describe CN_SUBJECT_564 Subject contains "½»ÓÑ" +score CN_SUBJECT_564 0.540 + +header CN_SUBJECT_569 Subject =~ /µÍË°µã´ú/ +describe CN_SUBJECT_569 Subject contains "µÍË°µã´ú" +score CN_SUBJECT_569 0.235 + +header CN_SUBJECT_572 Subject =~ /¼à¿Ø/ +describe CN_SUBJECT_572 Subject contains "¼à¿Ø" +score CN_SUBJECT_572 0.420 + +header CN_SUBJECT_574 Subject =~ /¹ÜÀíÄÑÌâ/ +describe CN_SUBJECT_574 Subject contains "¹ÜÀíÄÑÌâ" +score CN_SUBJECT_574 0.540 + +header CN_SUBJECT_575 Subject =~ /¹ËÎÊ/ +describe CN_SUBJECT_575 Subject contains "¹ËÎÊ" +score CN_SUBJECT_575 0.540 + +header CN_SUBJECT_576 Subject =~ /ÑÐÌÖ»á/ +describe CN_SUBJECT_576 Subject contains "ÑÐÌÖ»á" +score CN_SUBJECT_576 0.328 + +header CN_SUBJECT_577 Subject =~ /½ø¿Ú/ +describe CN_SUBJECT_577 Subject contains "½ø¿Ú" +score CN_SUBJECT_577 0.540 + +header CN_SUBJECT_578 Subject =~ /ºÃÏûÏ¢/ +describe CN_SUBJECT_578 Subject contains "ºÃÏûÏ¢" +score CN_SUBJECT_578 0.420 + +header CN_SUBJECT_579 Subject =~ /²Ö´¢/ +describe CN_SUBJECT_579 Subject contains "²Ö´¢" +score CN_SUBJECT_579 0.540 + +header CN_SUBJECT_582 Subject =~ /О´Çë/ +describe CN_SUBJECT_582 Subject contains "О´Çë" +score CN_SUBJECT_582 0.540 + +header CN_SUBJECT_583 Subject =~ /Ó°Ïñ/ +describe CN_SUBJECT_583 Subject contains "Ó°Ïñ" +score CN_SUBJECT_583 0.540 + +header CN_SUBJECT_584 Subject =~ /ÍøÂçµç»°/ +describe CN_SUBJECT_584 Subject contains "ÍøÂçµç»°" +score CN_SUBJECT_584 0.480 + +header CN_SUBJECT_587 Subject =~ /µçÄÔ°æ/ +describe CN_SUBJECT_587 Subject contains "µçÄÔ°æ" +score CN_SUBJECT_587 0.686 + +header CN_SUBJECT_589 Subject =~ /»úÆ÷ÈË/ +describe CN_SUBJECT_589 Subject contains "»úÆ÷ÈË" +score CN_SUBJECT_589 0.480 + +header CN_SUBJECT_596 Subject =~ /±Ø±¸/ +describe CN_SUBJECT_596 Subject contains "±Ø±¸" +score CN_SUBJECT_596 0.480 + +header CN_SUBJECT_597 Subject =~ /Å·ÃÀ/ +describe CN_SUBJECT_597 Subject contains "Å·ÃÀ" +score CN_SUBJECT_597 0.540 + +header CN_SUBJECT_598 Subject =~ /ÍŶÓ/ +describe CN_SUBJECT_598 Subject contains "ÍŶÓ" +score CN_SUBJECT_598 0.022 + +header CN_SUBJECT_599 Subject =~ /ÍøÂçÈÕ¼Ç/ +describe CN_SUBJECT_599 Subject contains "ÍøÂçÈÕ¼Ç" +score CN_SUBJECT_599 0.540 + +header CN_SUBJECT_604 Subject =~ /רҵ´úÀí/ +describe CN_SUBJECT_604 Subject contains "רҵ´úÀí" +score CN_SUBJECT_604 0.480 + +header CN_SUBJECT_606 Subject =~ /Э»áÈ«Ì×/ +describe CN_SUBJECT_606 Subject contains "Э»áÈ«Ì×" +score CN_SUBJECT_606 0.202 + +header CN_SUBJECT_615 Subject =~ /ÔË×÷/ +describe CN_SUBJECT_615 Subject contains "ÔË×÷" +score CN_SUBJECT_615 0.350 + +header CN_SUBJECT_619 Subject =~ /¹¤×÷Óʼþ/ +describe CN_SUBJECT_619 Subject contains "¹¤×÷Óʼþ" +score CN_SUBJECT_619 0.480 + +header CN_SUBJECT_623 Subject =~ /¶©»õ/ +describe CN_SUBJECT_623 Subject contains "¶©»õ" +score CN_SUBJECT_623 0.480 + +header CN_SUBJECT_624 Subject =~ /Ó¡Ë¢/ +describe CN_SUBJECT_624 Subject contains "Ó¡Ë¢" +score CN_SUBJECT_624 0.480 + +header CN_SUBJECT_628 Subject =~ /Æó¹Ü/ +describe CN_SUBJECT_628 Subject contains "Æó¹Ü" +score CN_SUBJECT_628 0.480 + +header CN_SUBJECT_630 Subject =~ /Ö»Ðè500/ +describe CN_SUBJECT_630 Subject contains "Ö»Ðè500" +score CN_SUBJECT_630 0.477 + +header CN_SUBJECT_632 Subject =~ /ÉÌ»ú/ +describe CN_SUBJECT_632 Subject contains "ÉÌ»ú" +score CN_SUBJECT_632 1.260 + +header CN_SUBJECT_634 Subject =~ /»¶Ó­Äú/ +describe CN_SUBJECT_634 Subject contains "»¶Ó­Äú" +score CN_SUBJECT_634 1.080 + +header CN_SUBJECT_636 Subject =~ /Ñо¿±¨¸æ/ +describe CN_SUBJECT_636 Subject contains "Ñо¿±¨¸æ" +score CN_SUBJECT_636 0.480 + +header CN_SUBJECT_637 Subject =~ /ÄúºÃ/ +describe CN_SUBJECT_637 Subject contains "ÄúºÃ" +score CN_SUBJECT_637 1.440 + +header CN_SUBJECT_640 Subject =~ /ÉîÛÚ\)/ +describe CN_SUBJECT_640 Subject contains "ÉîÛÚ\)" +score CN_SUBJECT_640 0.480 + +header CN_SUBJECT_645 Subject =~ /³ÉÈË/ +describe CN_SUBJECT_645 Subject contains "³ÉÈË" +score CN_SUBJECT_645 0.353 + +header CN_SUBJECT_646 Subject =~ /ÉãÏñ»ú/ +describe CN_SUBJECT_646 Subject contains "ÉãÏñ»ú" +score CN_SUBJECT_646 0.330 + +header CN_SUBJECT_650 Subject =~ /ÏîÄ¿£¨/ +describe CN_SUBJECT_650 Subject contains "ÏîÄ¿£¨" +score CN_SUBJECT_650 0.457 + +header CN_SUBJECT_654 Subject =~ /×ÊѶ/ +describe CN_SUBJECT_654 Subject contains "×ÊѶ" +score CN_SUBJECT_654 0.420 + +header CN_SUBJECT_655 Subject =~ /²ÙÅÌ/ +describe CN_SUBJECT_655 Subject contains "²ÙÅÌ" +score CN_SUBJECT_655 0.508 + +header CN_SUBJECT_659 Subject =~ /°ÝÄê/ +describe CN_SUBJECT_659 Subject contains "°ÝÄê" +score CN_SUBJECT_659 0.420 + +header CN_SUBJECT_660 Subject =~ /¡¾ÍøÂç/ +describe CN_SUBJECT_660 Subject contains "¡¾ÍøÂç" +score CN_SUBJECT_660 0.480 + +header CN_SUBJECT_663 Subject =~ /°ïÄú/ +describe CN_SUBJECT_663 Subject contains "°ïÄú" +score CN_SUBJECT_663 1.020 + +header CN_SUBJECT_667 Subject =~ /KR-GÐÍÎÂ/ +describe CN_SUBJECT_667 Subject contains "KR-GÐÍÎÂ" +score CN_SUBJECT_667 0.540 + +header CN_SUBJECT_670 Subject =~ /ÐéÄâÖ÷»ú/ +describe CN_SUBJECT_670 Subject contains "ÐéÄâÖ÷»ú" +score CN_SUBJECT_670 0.480 + +header CN_SUBJECT_671 Subject =~ /¶ÌÆÚ/ +describe CN_SUBJECT_671 Subject contains "¶ÌÆÚ" +score CN_SUBJECT_671 0.300 + +header CN_SUBJECT_674 Subject =~ /Ô˼Û/ +describe CN_SUBJECT_674 Subject contains "Ô˼Û" +score CN_SUBJECT_674 0.540 + +header CN_SUBJECT_675 Subject =~ /¼°×î/ +describe CN_SUBJECT_675 Subject contains "¼°×î" +score CN_SUBJECT_675 0.420 + +header CN_SUBJECT_681 Subject =~ /¿Õµ÷/ +describe CN_SUBJECT_681 Subject contains "¿Õµ÷" +score CN_SUBJECT_681 0.300 + +header CN_SUBJECT_689 Subject =~ /ÓÉÎÒÃÇ/ +describe CN_SUBJECT_689 Subject contains "ÓÉÎÒÃÇ" +score CN_SUBJECT_689 0.420 + +header CN_SUBJECT_690 Subject =~ /¡¶ÍøÂç/ +describe CN_SUBJECT_690 Subject contains "¡¶ÍøÂç" +score CN_SUBJECT_690 0.333 + +header CN_SUBJECT_692 Subject =~ /ÇÔÌý/ +describe CN_SUBJECT_692 Subject contains "ÇÔÌý" +score CN_SUBJECT_692 0.360 + +header CN_SUBJECT_693 Subject =~ /ÉÌÇé/ +describe CN_SUBJECT_693 Subject contains "ÉÌÇé" +score CN_SUBJECT_693 0.420 + +header CN_SUBJECT_694 Subject =~ /ÐÐÒµÑо¿/ +describe CN_SUBJECT_694 Subject contains "ÐÐÒµÑо¿" +score CN_SUBJECT_694 0.420 + +header CN_SUBJECT_698 Subject =~ /ÂþÓÎ/ +describe CN_SUBJECT_698 Subject contains "ÂþÓÎ" +score CN_SUBJECT_698 0.405 + +header CN_SUBJECT_705 Subject =~ /ÇáÇá/ +describe CN_SUBJECT_705 Subject contains "ÇáÇá" +score CN_SUBJECT_705 0.300 + +header CN_SUBJECT_709 Subject =~ /»ð±¬/ +describe CN_SUBJECT_709 Subject contains "»ð±¬" +score CN_SUBJECT_709 0.348 + +header CN_SUBJECT_711 Subject =~ /»úÓö/ +describe CN_SUBJECT_711 Subject contains "»úÓö" +score CN_SUBJECT_711 0.300 + +header CN_SUBJECT_718 Subject =~ /ÕæƱ/ +describe CN_SUBJECT_718 Subject contains "ÕæƱ" +score CN_SUBJECT_718 0.175 + +header CN_SUBJECT_719 Subject =~ /¹¤³§/ +describe CN_SUBJECT_719 Subject contains "¹¤³§" +score CN_SUBJECT_719 0.415 + +header CN_SUBJECT_723 Subject =~ /¼Ç¼¹ÜÀí/ +describe CN_SUBJECT_723 Subject contains "¼Ç¼¹ÜÀí" +score CN_SUBJECT_723 0.420 + +header CN_SUBJECT_728 Subject =~ /Á¢¼´/ +describe CN_SUBJECT_728 Subject contains "Á¢¼´" +score CN_SUBJECT_728 0.360 + +header CN_SUBJECT_732 Subject =~ /ÉúÒâ/ +describe CN_SUBJECT_732 Subject contains "ÉúÒâ" +score CN_SUBJECT_732 0.600 + +header CN_SUBJECT_736 Subject =~ /ÌØ»Ý/ +describe CN_SUBJECT_736 Subject contains "ÌØ»Ý" +score CN_SUBJECT_736 0.420 + +header CN_SUBJECT_738 Subject =~ /»Ø¸´£¡/ +describe CN_SUBJECT_738 Subject contains "»Ø¸´£¡" +score CN_SUBJECT_738 0.420 + +header CN_SUBJECT_743 Subject =~ /»¥»Ý/ +describe CN_SUBJECT_743 Subject contains "»¥»Ý" +score CN_SUBJECT_743 0.420 + +header CN_SUBJECT_746 Subject =~ /¸åÔ¼/ +describe CN_SUBJECT_746 Subject contains "¸åÔ¼" +score CN_SUBJECT_746 0.420 + +header CN_SUBJECT_751 Subject =~ /¡·V2005/ +describe CN_SUBJECT_751 Subject contains "¡·V2005" +score CN_SUBJECT_751 0.262 + +header CN_SUBJECT_752 Subject =~ /ÉÌó/ +describe CN_SUBJECT_752 Subject contains "ÉÌó" +score CN_SUBJECT_752 0.420 + +header CN_SUBJECT_756 Subject =~ /ÁãÊÛ/ +describe CN_SUBJECT_756 Subject contains "ÁãÊÛ" +score CN_SUBJECT_756 0.420 + +header CN_SUBJECT_757 Subject =~ /\[ͬ־/ +describe CN_SUBJECT_757 Subject contains "\[ͬ־" +score CN_SUBJECT_757 0.420 + +header CN_SUBJECT_759 Subject =~ /\]ÃǺã¬/ +describe CN_SUBJECT_759 Subject contains "\]ÃǺã¬" +score CN_SUBJECT_759 0.420 + +header CN_SUBJECT_761 Subject =~ /»î¶¯Å¶/ +describe CN_SUBJECT_761 Subject contains "»î¶¯Å¶" +score CN_SUBJECT_761 0.420 + +header CN_SUBJECT_762 Subject =~ /µç»°Â¼Òô/ +describe CN_SUBJECT_762 Subject contains "µç»°Â¼Òô" +score CN_SUBJECT_762 0.420 + +header CN_SUBJECT_764 Subject =~ /Õ÷ ¸å/ +describe CN_SUBJECT_764 Subject contains "Õ÷ ¸å" +score CN_SUBJECT_764 0.480 + +header CN_SUBJECT_769 Subject =~ /̸̸Âð\?/ +describe CN_SUBJECT_769 Subject contains "̸̸Âð\?" +score CN_SUBJECT_769 0.139 + +header CN_SUBJECT_771 Subject =~ /¼ÎöÎ/ +describe CN_SUBJECT_771 Subject contains "¼ÎöÎ" +score CN_SUBJECT_771 0.057 + +header CN_SUBJECT_774 Subject =~ /ʱ¼ä£¬/ +describe CN_SUBJECT_774 Subject contains "ʱ¼ä£¬" +score CN_SUBJECT_774 0.300 + +header CN_SUBJECT_778 Subject =~ /×îÐÂÍƼö/ +describe CN_SUBJECT_778 Subject contains "×îÐÂÍƼö" +score CN_SUBJECT_778 0.333 + +header CN_SUBJECT_781 Subject =~ /\.°üÕæ¡¢/ +describe CN_SUBJECT_781 Subject contains "\.°üÕæ¡¢" +score CN_SUBJECT_781 0.409 + +header CN_SUBJECT_783 Subject =~ /ËÉËÉд/ +describe CN_SUBJECT_783 Subject contains "ËÉËÉд" +score CN_SUBJECT_783 0.360 + +header CN_SUBJECT_784 Subject =~ /Ô¿¯/ +describe CN_SUBJECT_784 Subject contains "Ô¿¯" +score CN_SUBJECT_784 0.351 + +header CN_SUBJECT_785 Subject =~ /ÍøÕ¾ÓÐÈË/ +describe CN_SUBJECT_785 Subject contains "ÍøÕ¾ÓÐÈË" +score CN_SUBJECT_785 0.360 + +header CN_SUBJECT_790 Subject =~ /Âð\?Óʼþ/ +describe CN_SUBJECT_790 Subject contains "Âð\?Óʼþ" +score CN_SUBJECT_790 0.360 + +header CN_SUBJECT_792 Subject =~ /µÇ½Âð\?/ +describe CN_SUBJECT_792 Subject contains "µÇ½Âð\?" +score CN_SUBJECT_792 0.360 + +header CN_SUBJECT_794 Subject =~ /ÓÐÈ˵ǽ/ +describe CN_SUBJECT_794 Subject contains "ÓÐÈ˵ǽ" +score CN_SUBJECT_794 0.360 + +header CN_SUBJECT_802 Subject =~ /ÐèÒª!/ +describe CN_SUBJECT_802 Subject contains "ÐèÒª!" +score CN_SUBJECT_802 0.289 + +header CN_SUBJECT_803 Subject =~ /¸ü»»/ +describe CN_SUBJECT_803 Subject contains "¸ü»»" +score CN_SUBJECT_803 0.284 + +header CN_SUBJECT_804 Subject =~ /¿§·ÈµÄ/ +describe CN_SUBJECT_804 Subject contains "¿§·ÈµÄ" +score CN_SUBJECT_804 0.360 + +header CN_SUBJECT_805 Subject =~ /¿ÆѧÑо¿/ +describe CN_SUBJECT_805 Subject contains "¿ÆѧÑо¿" +score CN_SUBJECT_805 0.001 + +header CN_SUBJECT_806 Subject =~ /±¦µä£¡/ +describe CN_SUBJECT_806 Subject contains "±¦µä£¡" +score CN_SUBJECT_806 0.273 + +header CN_SUBJECT_810 Subject =~ /ÍƼö / +describe CN_SUBJECT_810 Subject contains "ÍƼö " +score CN_SUBJECT_810 0.273 + +header CN_SUBJECT_812 Subject =~ /Ⱥ·¢/ +describe CN_SUBJECT_812 Subject contains "Ⱥ·¢" +score CN_SUBJECT_812 1.140 + +header CN_SUBJECT_813 Subject =~ /ÄÉË°/ +describe CN_SUBJECT_813 Subject contains "ÄÉË°" +score CN_SUBJECT_813 0.360 + +header CN_SUBJECT_814 Subject =~ / ³¬¼¶/ +describe CN_SUBJECT_814 Subject contains " ³¬¼¶" +score CN_SUBJECT_814 0.273 + +header CN_SUBJECT_824 Subject =~ /Ƶ·±/ +describe CN_SUBJECT_824 Subject contains "Ƶ·±" +score CN_SUBJECT_824 0.291 + +header CN_SUBJECT_829 Subject =~ /Íæ¾ß/ +describe CN_SUBJECT_829 Subject contains "Íæ¾ß" +score CN_SUBJECT_829 0.282 + +header CN_SUBJECT_839 Subject =~ /Ò»¾ø/ +describe CN_SUBJECT_839 Subject contains "Ò»¾ø" +score CN_SUBJECT_839 0.240 + +header CN_SUBJECT_844 Subject =~ /ËûÈË¿ìÀÖ/ +describe CN_SUBJECT_844 Subject contains "ËûÈË¿ìÀÖ" +score CN_SUBJECT_844 0.360 + +header CN_SUBJECT_849 Subject =~ /¸øËûÈË/ +describe CN_SUBJECT_849 Subject contains "¸øËûÈË" +score CN_SUBJECT_849 0.360 + +header CN_SUBJECT_850 Subject =~ /¿ìÀÖΪ/ +describe CN_SUBJECT_850 Subject contains "¿ìÀÖΪ" +score CN_SUBJECT_850 0.360 + +header CN_SUBJECT_855 Subject =~ /ʵÎñ/ +describe CN_SUBJECT_855 Subject contains "ʵÎñ" +score CN_SUBJECT_855 0.480 + +header CN_SUBJECT_859 Subject =~ /µØַרÂô/ +describe CN_SUBJECT_859 Subject contains "µØַרÂô" +score CN_SUBJECT_859 0.360 + +header CN_SUBJECT_865 Subject =~ /ÀÏͬѧ/ +describe CN_SUBJECT_865 Subject contains "ÀÏͬѧ" +score CN_SUBJECT_865 0.300 + +header CN_SUBJECT_868 Subject =~ /´ÊÆð/ +describe CN_SUBJECT_868 Subject contains "´ÊÆð" +score CN_SUBJECT_868 0.259 + +header CN_SUBJECT_875 Subject =~ /½»Ò×/ +describe CN_SUBJECT_875 Subject contains "½»Ò×" +score CN_SUBJECT_875 0.360 + +header CN_SUBJECT_876 Subject =~ /Öвã/ +describe CN_SUBJECT_876 Subject contains "Öвã" +score CN_SUBJECT_876 0.339 + +header CN_SUBJECT_877 Subject =~ /²Ö¿â/ +describe CN_SUBJECT_877 Subject contains "²Ö¿â" +score CN_SUBJECT_877 0.360 + +header CN_SUBJECT_878 Subject =~ /Îʺò!/ +describe CN_SUBJECT_878 Subject contains "Îʺò!" +score CN_SUBJECT_878 0.360 + +header CN_SUBJECT_893 Subject =~ /´ºÌìÎʺò/ +describe CN_SUBJECT_893 Subject contains "´ºÌìÎʺò" +score CN_SUBJECT_893 0.300 + +header CN_SUBJECT_894 Subject =~ /»Û´Ï/ +describe CN_SUBJECT_894 Subject contains "»Û´Ï" +score CN_SUBJECT_894 0.300 + +header CN_SUBJECT_897 Subject =~ />Èí¼þ/ +describe CN_SUBJECT_897 Subject contains ">Èí¼þ" +score CN_SUBJECT_897 0.360 + +header CN_SUBJECT_902 Subject =~ /³ÏÕÐ/ +describe CN_SUBJECT_902 Subject contains "³ÏÕÐ" +score CN_SUBJECT_902 0.900 + +header CN_SUBJECT_905 Subject =~ /µçÂë/ +describe CN_SUBJECT_905 Subject contains "µçÂë" +score CN_SUBJECT_905 0.300 + +header CN_SUBJECT_909 Subject =~ /¹ÜÀí×ÊÁÏ/ +describe CN_SUBJECT_909 Subject contains "¹ÜÀí×ÊÁÏ" +score CN_SUBJECT_909 0.300 + +header CN_SUBJECT_911 Subject =~ /¹úÄÚ³¤Í¾/ +describe CN_SUBJECT_911 Subject contains "¹úÄÚ³¤Í¾" +score CN_SUBJECT_911 0.300 + +header CN_SUBJECT_912 Subject =~ /ÓÊÖ·3ÒÚ/ +describe CN_SUBJECT_912 Subject contains "ÓÊÖ·3ÒÚ" +score CN_SUBJECT_912 0.300 + +header CN_SUBJECT_917 Subject =~ /»§Íâ/ +describe CN_SUBJECT_917 Subject contains "»§Íâ" +score CN_SUBJECT_917 0.300 + +header CN_SUBJECT_918 Subject =~ /»¯×±Æ·/ +describe CN_SUBJECT_918 Subject contains "»¯×±Æ·" +score CN_SUBJECT_918 0.240 + +header CN_SUBJECT_920 Subject =~ /£¬Ñéºó/ +describe CN_SUBJECT_920 Subject contains "£¬Ñéºó" +score CN_SUBJECT_920 0.305 + +header CN_SUBJECT_923 Subject =~ /¸É²¿¹ÜÀí/ +describe CN_SUBJECT_923 Subject contains "¸É²¿¹ÜÀí" +score CN_SUBJECT_923 0.218 + +header CN_SUBJECT_930 Subject =~ /ÐÅÓùÜÀí/ +describe CN_SUBJECT_930 Subject contains "ÐÅÓùÜÀí" +score CN_SUBJECT_930 0.300 + +header CN_SUBJECT_932 Subject =~ /·­Òë·þÎñ/ +describe CN_SUBJECT_932 Subject contains "·­Òë·þÎñ" +score CN_SUBJECT_932 0.300 + +header CN_SUBJECT_934 Subject =~ /·Ä»ú/ +describe CN_SUBJECT_934 Subject contains "·Ä»ú" +score CN_SUBJECT_934 0.300 + +header CN_SUBJECT_935 Subject =~ /Åä¼þ/ +describe CN_SUBJECT_935 Subject contains "Åä¼þ" +score CN_SUBJECT_935 0.214 + +header CN_SUBJECT_942 Subject =~ /µÏ»ù/ +describe CN_SUBJECT_942 Subject contains "µÏ»ù" +score CN_SUBJECT_942 0.097 + +header CN_SUBJECT_944 Subject =~ /ºè·¢/ +describe CN_SUBJECT_944 Subject contains "ºè·¢" +score CN_SUBJECT_944 0.360 + +header CN_SUBJECT_945 Subject =~ /ÈռDZ¾£¬/ +describe CN_SUBJECT_945 Subject contains "ÈռDZ¾£¬" +score CN_SUBJECT_945 0.300 + +header CN_SUBJECT_946 Subject =~ /ºóÃÅ/ +describe CN_SUBJECT_946 Subject contains "ºóÃÅ" +score CN_SUBJECT_946 0.300 + +header CN_SUBJECT_950 Subject =~ /¿ìÀÖ!/ +describe CN_SUBJECT_950 Subject contains "¿ìÀÖ!" +score CN_SUBJECT_950 0.360 + +header CN_SUBJECT_952 Subject =~ /¸ÐȾµÄ/ +describe CN_SUBJECT_952 Subject contains "¸ÐȾµÄ" +score CN_SUBJECT_952 0.300 + +header CN_SUBJECT_953 Subject =~ /³É±¾½µµÍ/ +describe CN_SUBJECT_953 Subject contains "³É±¾½µµÍ" +score CN_SUBJECT_953 0.300 + +header CN_SUBJECT_955 Subject =~ /Ô¶³Ì½ÌÓý/ +describe CN_SUBJECT_955 Subject contains "Ô¶³Ì½ÌÓý" +score CN_SUBJECT_955 0.300 + +header CN_SUBJECT_956 Subject =~ /Ö¸»/ +describe CN_SUBJECT_956 Subject contains "Ö¸»" +score CN_SUBJECT_956 0.216 + +header CN_SUBJECT_963 Subject =~ /»ò±»Èä³æ/ +describe CN_SUBJECT_963 Subject contains "»ò±»Èä³æ" +score CN_SUBJECT_963 0.300 + +header CN_SUBJECT_968 Subject =~ /Éè¼Æʦ/ +describe CN_SUBJECT_968 Subject contains "Éè¼Æʦ" +score CN_SUBJECT_968 0.300 + +header CN_SUBJECT_970 Subject =~ /³ÏÒâ/ +describe CN_SUBJECT_970 Subject contains "³ÏÒâ" +score CN_SUBJECT_970 0.240 + +header CN_SUBJECT_971 Subject =~ /ºÚÂí/ +describe CN_SUBJECT_971 Subject contains "ºÚÂí" +score CN_SUBJECT_971 0.300 + +header CN_SUBJECT_973 Subject =~ /¿¼ºË/ +describe CN_SUBJECT_973 Subject contains "¿¼ºË" +score CN_SUBJECT_973 0.291 + +header CN_SUBJECT_978 Subject =~ /·ÀµÁ/ +describe CN_SUBJECT_978 Subject contains "·ÀµÁ" +score CN_SUBJECT_978 0.240 + +header CN_SUBJECT_982 Subject =~ /É̹ÜÀí/ +describe CN_SUBJECT_982 Subject contains "É̹ÜÀí" +score CN_SUBJECT_982 0.291 + +header CN_SUBJECT_983 Subject =~ /»»¹ã¸æ/ +describe CN_SUBJECT_983 Subject contains "»»¹ã¸æ" +score CN_SUBJECT_983 0.300 + +header CN_SUBJECT_985 Subject =~ /×Ê·Ñ/ +describe CN_SUBJECT_985 Subject contains "×Ê·Ñ" +score CN_SUBJECT_985 0.240 + +header CN_SUBJECT_986 Subject =~ /×°±¸/ +describe CN_SUBJECT_986 Subject contains "×°±¸" +score CN_SUBJECT_986 0.286 + +header CN_SUBJECT_989 Subject =~ /Ö»Ðè800/ +describe CN_SUBJECT_989 Subject contains "Ö»Ðè800" +score CN_SUBJECT_989 0.300 + +header CN_SUBJECT_991 Subject =~ /ÄúÐèÒª/ +describe CN_SUBJECT_991 Subject contains "ÄúÐèÒª" +score CN_SUBJECT_991 0.780 + +header CN_SUBJECT_994 Subject =~ /Íø¹Ø/ +describe CN_SUBJECT_994 Subject contains "Íø¹Ø" +score CN_SUBJECT_994 0.300 + +header CN_SUBJECT_996 Subject =~ /ÓÐÏÞ/ +describe CN_SUBJECT_996 Subject contains "ÓÐÏÞ" +score CN_SUBJECT_996 0.009 + +header CN_SUBJECT_998 Subject =~ /ÊÂÒË/ +describe CN_SUBJECT_998 Subject contains "ÊÂÒË" +score CN_SUBJECT_998 0.015 + +header CN_SUBJECT_999 Subject =~ /¹¤Ã³/ +describe CN_SUBJECT_999 Subject contains "¹¤Ã³" +score CN_SUBJECT_999 0.300 + +body CN_BODY_1 /¹«Ë¾/ +describe CN_BODY_1 Body contains "¹«Ë¾" +score CN_BODY_1 0.004 + +body CN_BODY_4 /ÐÅÏ¢/ +describe CN_BODY_4 Body contains "ÐÅÏ¢" +score CN_BODY_4 0.008 + +body CN_BODY_7 /·þÎñ/ +describe CN_BODY_7 Body contains "·þÎñ" +score CN_BODY_7 0.016 + +body CN_BODY_8 /ÏúÊÛ/ +describe CN_BODY_8 Body contains "ÏúÊÛ" +score CN_BODY_8 0.008 + +body CN_BODY_10 /ÓÅ»Ý/ +describe CN_BODY_10 Body contains "ÓÅ»Ý" +score CN_BODY_10 0.091 + +body CN_BODY_18 /ÁªÏµÈË/ +describe CN_BODY_18 Body contains "ÁªÏµÈË" +score CN_BODY_18 2.010 + +body CN_BODY_19 /¸ù¾Ý/ +describe CN_BODY_19 Body contains "¸ù¾Ý" +score CN_BODY_19 0.016 + +body CN_BODY_21 /ÉÌÆ·/ +describe CN_BODY_21 Body contains "ÉÌÆ·" +score CN_BODY_21 0.003 + +body CN_BODY_22 /¹ã¸æ/ +describe CN_BODY_22 Body contains "¹ã¸æ" +score CN_BODY_22 0.106 + +body CN_BODY_23 /ÓÐЧ/ +describe CN_BODY_23 Body contains "ÓÐЧ" +score CN_BODY_23 0.018 + +body CN_BODY_30 /ÏêÇé/ +describe CN_BODY_30 Body contains "ÏêÇé" +score CN_BODY_30 1.778 + +body CN_BODY_33 /³Ðŵ/ +describe CN_BODY_33 Body contains "³Ðŵ" +score CN_BODY_33 0.001 + +body CN_BODY_34 /ÉÏÍø/ +describe CN_BODY_34 Body contains "ÉÏÍø" +score CN_BODY_34 0.018 + +body CN_BODY_35 /ÆóÒµ/ +describe CN_BODY_35 Body contains "ÆóÒµ" +score CN_BODY_35 0.011 + +body CN_BODY_37 /»¶Ó­/ +describe CN_BODY_37 Body contains "»¶Ó­" +score CN_BODY_37 0.132 + +body CN_BODY_38 /½øÏî/ +describe CN_BODY_38 Body contains "½øÏî" +score CN_BODY_38 1.147 + +body CN_BODY_43 /Ôöֵ˰/ +describe CN_BODY_43 Body contains "Ôöֵ˰" +score CN_BODY_43 0.957 + +body CN_BODY_44 /ÊýÁ¿/ +describe CN_BODY_44 Body contains "ÊýÁ¿" +score CN_BODY_44 0.016 + +body CN_BODY_48 /Íê³É/ +describe CN_BODY_48 Body contains "Íê³É" +score CN_BODY_48 0.008 + +body CN_BODY_51 /Óʼþ/ +describe CN_BODY_51 Body contains "Óʼþ" +score CN_BODY_51 0.282 + +body CN_BODY_53 /ʵÁ¦/ +describe CN_BODY_53 Body contains "ʵÁ¦" +score CN_BODY_53 0.044 + +body CN_BODY_56 /µãÊý/ +describe CN_BODY_56 Body contains "µãÊý" +score CN_BODY_56 0.804 + +body CN_BODY_60 /²úÆ·/ +describe CN_BODY_60 Body contains "²úÆ·" +score CN_BODY_60 0.141 + +body CN_BODY_62 /¿Í»§/ +describe CN_BODY_62 Body contains "¿Í»§" +score CN_BODY_62 0.356 + +body CN_BODY_66 /ÐÛºñ/ +describe CN_BODY_66 Body contains "ÐÛºñ" +score CN_BODY_66 0.055 + +body CN_BODY_67 /Çëµç/ +describe CN_BODY_67 Body contains "Çëµç" +score CN_BODY_67 0.915 + +body CN_BODY_69 /µØÖ·/ +describe CN_BODY_69 Body contains "µØÖ·" +score CN_BODY_69 0.021 + +body CN_BODY_72 /Á¼ºÃ/ +describe CN_BODY_72 Body contains "Á¼ºÃ" +score CN_BODY_72 0.018 + +body CN_BODY_87 /ËùÓÃ/ +describe CN_BODY_87 Body contains "ËùÓÃ" +score CN_BODY_87 0.007 + +body CN_BODY_89 /µØË°/ +describe CN_BODY_89 Body contains "µØË°" +score CN_BODY_89 0.300 + +body CN_BODY_90 /ÓÀ¾Ã/ +describe CN_BODY_90 Body contains "ÓÀ¾Ã" +score CN_BODY_90 0.001 + +body CN_BODY_92 /Éç»á¹Øϵ/ +describe CN_BODY_92 Body contains "Éç»á¹Øϵ" +score CN_BODY_92 0.005 + +body CN_BODY_97 /µÖ¿Û/ +describe CN_BODY_97 Body contains "µÖ¿Û" +score CN_BODY_97 1.593 + +body CN_BODY_111 /´«Õæ/ +describe CN_BODY_111 Body contains "´«Õæ" +score CN_BODY_111 1.147 + +body CN_BODY_116 /Ç¢ÉÌ/ +describe CN_BODY_116 Body contains "Ç¢ÉÌ" +score CN_BODY_116 0.638 + +body CN_BODY_124 /ÓÊÏä/ +describe CN_BODY_124 Body contains "ÓÊÏä" +score CN_BODY_124 0.095 + +body CN_BODY_134 /»òµ£ÐÄ/ +describe CN_BODY_134 Body contains "»òµ£ÐÄ" +score CN_BODY_134 0.306 + +body CN_BODY_144 /´ú¿ª»ò/ +describe CN_BODY_144 Body contains "´ú¿ª»ò" +score CN_BODY_144 1.483 + +body CN_BODY_146 /³ÉÁ¢/ +describe CN_BODY_146 Body contains "³ÉÁ¢" +score CN_BODY_146 0.018 + +body CN_BODY_151 /¶«Ý¸/ +describe CN_BODY_151 Body contains "¶«Ý¸" +score CN_BODY_151 0.419 + +body CN_BODY_154 /ÈÈÏß/ +describe CN_BODY_154 Body contains "ÈÈÏß" +score CN_BODY_154 0.162 + +body CN_BODY_156 /µ£ÐÄ£¬¿É/ +describe CN_BODY_156 Body contains "µ£ÐÄ£¬¿É" +score CN_BODY_156 0.202 + +body CN_BODY_157 /»áÓë¹ó˾/ +describe CN_BODY_157 Body contains "»áÓë¹ó˾" +score CN_BODY_157 1.372 + +body CN_BODY_160 /£¬±Ø³É/ +describe CN_BODY_160 Body contains "£¬±Ø³É" +score CN_BODY_160 0.004 + +body CN_BODY_173 /ÁªÏµµç»°/ +describe CN_BODY_173 Body contains "ÁªÏµµç»°" +score CN_BODY_173 0.788 + +body CN_BODY_177 /ÍøÖ·/ +describe CN_BODY_177 Body contains "ÍøÖ·" +score CN_BODY_177 0.272 + +body CN_BODY_179 /½Ï¶àÏÖ/ +describe CN_BODY_179 Body contains "½Ï¶àÏÖ" +score CN_BODY_179 0.914 + +body CN_BODY_182 /¿ª·¢/ +describe CN_BODY_182 Body contains "¿ª·¢" +score CN_BODY_182 0.045 + +body CN_BODY_187 /²éѯ/ +describe CN_BODY_187 Body contains "²éѯ" +score CN_BODY_187 0.403 + +body CN_BODY_190 /Óë¹ó˾ȥ/ +describe CN_BODY_190 Body contains "Óë¹ó˾ȥ" +score CN_BODY_190 0.698 + +body CN_BODY_208 /ÐÐÒµ/ +describe CN_BODY_208 Body contains "ÐÐÒµ" +score CN_BODY_208 0.097 + +body CN_BODY_229 /ÄúµÄ/ +describe CN_BODY_229 Body contains "ÄúµÄ" +score CN_BODY_229 0.414 + +body CN_BODY_236 /ÉÌÎñ/ +describe CN_BODY_236 Body contains "ÉÌÎñ" +score CN_BODY_236 0.738 + +body CN_BODY_237 /¸¶¿î/ +describe CN_BODY_237 Body contains "¸¶¿î" +score CN_BODY_237 0.861 + +body CN_BODY_245 /´úÀí/ +describe CN_BODY_245 Body contains "´úÀí" +score CN_BODY_245 0.018 + +body CN_BODY_267 /×óÓÒ£©/ +describe CN_BODY_267 Body contains "×óÓÒ£©" +score CN_BODY_267 0.015 + +body CN_BODY_269 /»áÔ±/ +describe CN_BODY_269 Body contains "»áÔ±" +score CN_BODY_269 0.449 + +body CN_BODY_276 /ÑéÖ¤/ +describe CN_BODY_276 Body contains "ÑéÖ¤" +score CN_BODY_276 0.026 + +body CN_BODY_277 /µã»÷/ +describe CN_BODY_277 Body contains "µã»÷" +score CN_BODY_277 0.271 + +body CN_BODY_291 /רÓÃ/ +describe CN_BODY_291 Body contains "רÓÃ" +score CN_BODY_291 0.009 + +body CN_BODY_293 /ÓªÏú/ +describe CN_BODY_293 Body contains "ÓªÏú" +score CN_BODY_293 0.509 + +body CN_BODY_317 /Ê÷Á¢/ +describe CN_BODY_317 Body contains "Ê÷Á¢" +score CN_BODY_317 0.003 + +body CN_BODY_324 /´òÈÅ/ +describe CN_BODY_324 Body contains "´òÈÅ" +score CN_BODY_324 0.585 + +body CN_BODY_326 /Ʊ¾Ý/ +describe CN_BODY_326 Body contains "Ʊ¾Ý" +score CN_BODY_326 0.023 + +body CN_BODY_330 /·¢ËÍ/ +describe CN_BODY_330 Body contains "·¢ËÍ" +score CN_BODY_330 0.120 + +body CN_BODY_335 /½ÏµÍ¡£»¹/ +describe CN_BODY_335 Body contains "½ÏµÍ¡£»¹" +score CN_BODY_335 0.202 + +body CN_BODY_348 /¸÷Àà/ +describe CN_BODY_348 Body contains "¸÷Àà" +score CN_BODY_348 0.108 + +body CN_BODY_356 /½É¿î/ +describe CN_BODY_356 Body contains "½É¿î" +score CN_BODY_356 1.694 + +body CN_BODY_375 /ƽ̨/ +describe CN_BODY_375 Body contains "ƽ̨" +score CN_BODY_375 0.063 + +body CN_BODY_389 /2%×óÓÒ/ +describe CN_BODY_389 Body contains "2%×óÓÒ" +score CN_BODY_389 0.001 + +body CN_BODY_394 /À´µç/ +describe CN_BODY_394 Body contains "À´µç" +score CN_BODY_394 0.013 + +body CN_BODY_395 /È«¹ú¸÷µØ/ +describe CN_BODY_395 Body contains "È«¹ú¸÷µØ" +score CN_BODY_395 0.036 + +body CN_BODY_400 /ÖÐÐÄ×÷Ϊ/ +describe CN_BODY_400 Body contains "ÖÐÐÄ×÷Ϊ" +score CN_BODY_400 1.373 + +body CN_BODY_412 /ÉèÓÐ/ +describe CN_BODY_412 Body contains "ÉèÓÐ" +score CN_BODY_412 0.032 + +body CN_BODY_418 /Ó¦ÓÃ/ +describe CN_BODY_418 Body contains "Ó¦ÓÃ" +score CN_BODY_418 0.011 + +body CN_BODY_419 /¾´Çë/ +describe CN_BODY_419 Body contains "¾´Çë" +score CN_BODY_419 0.510 + +body CN_BODY_426 /µÈÊÐÓÐ/ +describe CN_BODY_426 Body contains "µÈÊÐÓÐ" +score CN_BODY_426 1.103 + +body CN_BODY_436 /×öµ½¡°/ +describe CN_BODY_436 Body contains "×öµ½¡°" +score CN_BODY_436 0.012 + +body CN_BODY_472 /ÔùËÍ/ +describe CN_BODY_472 Body contains "ÔùËÍ" +score CN_BODY_472 0.037 + +body CN_BODY_489 /\(24Сʱ/ +describe CN_BODY_489 Body contains "\(24Сʱ" +score CN_BODY_489 1.551 + +body CN_BODY_492 /Ǣ̸/ +describe CN_BODY_492 Body contains "Ǣ̸" +score CN_BODY_492 0.590 + +body CN_BODY_494 /×ð¾´µÄ/ +describe CN_BODY_494 Body contains "×ð¾´µÄ" +score CN_BODY_494 0.479 + +body CN_BODY_495 /¡¢±Ø³É/ +describe CN_BODY_495 Body contains "¡¢±Ø³É" +score CN_BODY_495 0.270 + +body CN_BODY_503 /Ö÷°ì/ +describe CN_BODY_503 Body contains "Ö÷°ì" +score CN_BODY_503 0.003 + +body CN_BODY_512 /´óÏÃ/ +describe CN_BODY_512 Body contains "´óÏÃ" +score CN_BODY_512 0.048 + +body CN_BODY_532 /Á÷³Ì/ +describe CN_BODY_532 Body contains "Á÷³Ì" +score CN_BODY_532 0.018 + +body CN_BODY_537 /Óʱà/ +describe CN_BODY_537 Body contains "Óʱà" +score CN_BODY_537 0.175 + +body CN_BODY_545 /ÀíÄî/ +describe CN_BODY_545 Body contains "ÀíÄî" +score CN_BODY_545 0.020 + +body CN_BODY_553 /ÓòÃû/ +describe CN_BODY_553 Body contains "ÓòÃû" +score CN_BODY_553 0.955 + +body CN_BODY_556 /²É¹º/ +describe CN_BODY_556 Body contains "²É¹º" +score CN_BODY_556 0.032 + +body CN_BODY_579 /ѧԱ/ +describe CN_BODY_579 Body contains "ѧԱ" +score CN_BODY_579 0.002 + +body CN_BODY_583 /µÄÍøÕ¾/ +describe CN_BODY_583 Body contains "µÄÍøÕ¾" +score CN_BODY_583 0.047 + +body CN_BODY_606 /¹ÜÀí¡¢/ +describe CN_BODY_606 Body contains "¹ÜÀí¡¢" +score CN_BODY_606 0.029 + +body CN_BODY_628 /ʵս/ +describe CN_BODY_628 Body contains "ʵս" +score CN_BODY_628 0.136 + +body CN_BODY_660 /ÐË¡/ +describe CN_BODY_660 Body contains "ÐË¡" +score CN_BODY_660 0.259 + +body CN_BODY_668 /ÎïÁ÷/ +describe CN_BODY_668 Body contains "ÎïÁ÷" +score CN_BODY_668 0.679 + +body CN_BODY_669 /Îç²Í/ +describe CN_BODY_669 Body contains "Îç²Í" +score CN_BODY_669 0.045 + +body CN_BODY_682 /¸ßЧ/ +describe CN_BODY_682 Body contains "¸ßЧ" +score CN_BODY_682 0.125 + +body CN_BODY_684 /£¨¹úË°¡¢/ +describe CN_BODY_684 Body contains "£¨¹úË°¡¢" +score CN_BODY_684 0.984 + +body CN_BODY_685 /¹úÄÚÍâ/ +describe CN_BODY_685 Body contains "¹úÄÚÍâ" +score CN_BODY_685 0.234 + +body CN_BODY_692 /²ßÂÔ/ +describe CN_BODY_692 Body contains "²ßÂÔ" +score CN_BODY_692 0.015 + +body CN_BODY_725 /½ÏµÍ£¬»¹/ +describe CN_BODY_725 Body contains "½ÏµÍ£¬»¹" +score CN_BODY_725 0.955 + +body CN_BODY_727 /»¥¶¯/ +describe CN_BODY_727 Body contains "»¥¶¯" +score CN_BODY_727 0.007 + +body CN_BODY_729 /¹ÜÀíÈË/ +describe CN_BODY_729 Body contains "¹ÜÀíÈË" +score CN_BODY_729 0.002 + +body CN_BODY_765 /ÐÅÓþ/ +describe CN_BODY_765 Body contains "ÐÅÓþ" +score CN_BODY_765 0.009 + +body CN_BODY_777 /ÉÆÒâ/ +describe CN_BODY_777 Body contains "ÉÆÒâ" +score CN_BODY_777 0.096 + +body CN_BODY_793 /ʵÓÃ/ +describe CN_BODY_793 Body contains "ʵÓÃ" +score CN_BODY_793 0.008 + +body CN_BODY_795 /ÀñÆ·/ +describe CN_BODY_795 Body contains "ÀñÆ·" +score CN_BODY_795 0.365 + +body CN_BODY_800 /ºÚÌå/ +describe CN_BODY_800 Body contains "ºÚÌå" +score CN_BODY_800 1.407 + +body CN_BODY_833 /µçÆ÷/ +describe CN_BODY_833 Body contains "µçÆ÷" +score CN_BODY_833 0.038 + +body CN_BODY_840 /£¨6%/ +describe CN_BODY_840 Body contains "£¨6%" +score CN_BODY_840 1.187 + +body CN_BODY_843 /Êý¾Ý¿â/ +describe CN_BODY_843 Body contains "Êý¾Ý¿â" +score CN_BODY_843 0.171 + +body CN_BODY_858 /ÎÞÐè/ +describe CN_BODY_858 Body contains "ÎÞÐè" +score CN_BODY_858 0.019 + +body CN_BODY_863 /¼¼ÄÜ/ +describe CN_BODY_863 Body contains "¼¼ÄÜ" +score CN_BODY_863 0.025 + +body CN_BODY_868 /¼¨Ð§/ +describe CN_BODY_868 Body contains "¼¨Ð§" +score CN_BODY_868 0.722 + +body CN_BODY_872 /ÐÎÏó¡¢/ +describe CN_BODY_872 Body contains "ÐÎÏó¡¢" +score CN_BODY_872 0.129 + +body CN_BODY_874 /²ß»®/ +describe CN_BODY_874 Body contains "²ß»®" +score CN_BODY_874 0.011 + +body CN_BODY_895 /»ã¿î/ +describe CN_BODY_895 Body contains "»ã¿î" +score CN_BODY_895 0.035 + +body CN_BODY_898 /ÊÚ¿Î/ +describe CN_BODY_898 Body contains "ÊÚ¿Î" +score CN_BODY_898 0.025 + +body CN_BODY_907 /ËæÊÖ/ +describe CN_BODY_907 Body contains "ËæÊÖ" +score CN_BODY_907 0.208 + +body CN_BODY_912 /Îĵµ/ +describe CN_BODY_912 Body contains "Îĵµ" +score CN_BODY_912 0.104 + +body CN_BODY_916 /¡£ÎÒ˾/ +describe CN_BODY_916 Body contains "¡£ÎÒ˾" +score CN_BODY_916 2.160 + +body CN_BODY_920 /¡¢µç»°/ +describe CN_BODY_920 Body contains "¡¢µç»°" +score CN_BODY_920 0.005 + +body CN_BODY_927 /ÊÕÒæ/ +describe CN_BODY_927 Body contains "ÊÕÒæ" +score CN_BODY_927 0.014 + +body CN_BODY_930 /Ìîд/ +describe CN_BODY_930 Body contains "Ìîд" +score CN_BODY_930 0.033 + +body CN_BODY_945 /ΪÄú/ +describe CN_BODY_945 Body contains "ΪÄú" +score CN_BODY_945 0.715 + +body CN_BODY_947 /¶©µ¥/ +describe CN_BODY_947 Body contains "¶©µ¥" +score CN_BODY_947 0.012 + +body CN_BODY_955 /ÁªÏµÎÒÃÇ/ +describe CN_BODY_955 Body contains "ÁªÏµÎÒÃÇ" +score CN_BODY_955 1.308 + +body CN_BODY_981 /£¨5%/ +describe CN_BODY_981 Body contains "£¨5%" +score CN_BODY_981 1.014 + +body CN_BODY_994 /ÎÒÃǽ«/ +describe CN_BODY_994 Body contains "ÎÒÃǽ«" +score CN_BODY_994 0.006 + +body CN_BODY_995 /¼ÓÃË/ +describe CN_BODY_995 Body contains "¼ÓÃË" +score CN_BODY_995 0.202 + +body CN_BODY_999 /·Ñ¡¢/ +describe CN_BODY_999 Body contains "·Ñ¡¢" +score CN_BODY_999 0.021 diff --git a/common/common_rbl b/common/common_rbl new file mode 100644 index 0000000..229d836 --- /dev/null +++ b/common/common_rbl @@ -0,0 +1,19 @@ +# blarson 2004-11-20 +header RCVD_IN_SBLXBL eval:check_rbl('SBLXBL', 'sbl-xbl.spamhaus.org') +describe RCVD_IN_SBLXBL listed in spamhaus.org sbl-xbl +# blarson 2005-01-28 see which return part 2005-02-26 ajust scores +score RCVD_IN_SBLXBL 1 +header RCVD_IN_SBLXBL_SBL eval:check_rbl_sub('SBLXBL', '127.0.0.2') +score RCVD_IN_SBLXBL_SBL 2 +header RCVD_IN_SBLXBL_CBL eval:check_rbl_sub('SBLXBL', '127.0.0.4') +score RCVD_IN_SBLXBL_CBL 1 +header RCVD_IN_SBLXBL_5 eval:check_rbl_sub('SBLXBL', '127.0.0.5') +score RCVD_IN_SBLXBL_5 1 +header RCVD_IN_SBLXBL_OPM eval:check_rbl_sub('SBLXBL', '127.0.0.6') +score RCVD_IN_SBLXBL_OPM 1 + +header RCVD_IN_NIX1 eval:check_rbl('NiX', 'ix.dnsbl.manitu.net.') +describe RCVD_IN_NIX1 Received in NiX filter http://www.ix.de/nixspam/dnsbl/ +tflags RCVD_IN_NIX1 net +score RCVD_IN_NIX1 1.5 + diff --git a/common/common_spam b/common/common_spam new file mode 100644 index 0000000..508efa2 --- /dev/null +++ b/common/common_spam @@ -0,0 +1,22 @@ +# this file includes rules that are common which have been split out +# into separate files in this directory. + +include drug_spam + +include pron_spam + +include phrase_spam + +include misc_spam + +include money_spam + +meta DIGEST_MULTIPLE RAZOR2_CHECK + PYZOR_CHECK > 1 +describe DIGEST_MULTIPLE Message hits more than one network digest check +tflags DIGEST_MULTIPLE net +#reuse DIGEST_MULTIPLE +score DIGEST_MULTIPLE 0 + + + + diff --git a/common/debian_specific b/common/debian_specific new file mode 100644 index 0000000..1041489 --- /dev/null +++ b/common/debian_specific @@ -0,0 +1,25 @@ +# this contains headers and such which are Debian specific + +# cord, 20050811 +header HEADER_X_KATIE exists:X-Katie +describe HEADER_X_KATIE X-Katie-Mailheader present +score HEADER_X_KATIE -2 + +header RCVD_FROM_SPOHR Received =~ /^from spohr.debian.org \(spohr.debian.org \[140.211.166.43\]\)/ +describe RCVD_FROM_SPOHR Mail comes from Spohr +score RCVD_FROM_SPOHR -2 + +# Added by cord 2004/10/24 (to let Release-critical Bugreport through) +whitelist_from_rcvd bugscan@debian.org debian.org +whitelist_from_rcvd webmaster@debian.org debian.org +whitelist_from bugscan@debian.org +header MURPHY_DEBIAN_MESSAGE exists:X-Debian-Message +describe MURPHY_DEBIAN_MESSAGE Found Debian-Header. +# yea. this sucks. if a spammer finds out this... +score MURPHY_DEBIAN_MESSAGE -10 + +# joy, 2003-08-17 +header OUR_MTA_MSGID Message-Id =~ /\@(master|murphy|gluck)\.debian\.org/ +describe OUR_MTA_MSGID Sounds like a msgid autogenerated by our MTAs +score OUR_MTA_MSGID 2 + diff --git a/common/disabled_rules b/common/disabled_rules new file mode 100644 index 0000000..e648cd6 --- /dev/null +++ b/common/disabled_rules @@ -0,0 +1,18 @@ +# The rule graveyard + +# don 2007-04-25 +#body GOTBODY /.{21}/ +#score GOTBODY 0 + +#meta NOBODY ! GOTBODY +#describe NOBODY No Body; probably spam +#score NOBODY 0 + +#header CONTROLSUB Received =~ /control|request|(?:(?:un)?subscribe|subhelp|help|ignore|(?:sub(?:yes|approve|reject)|unsubyes|bounce|probe|approve|reject|setlistyes|setlistsilentyes))/i +#describe CONTROLSUB Message to control, request or subscription +#score CONTROLSUB 0 + +#meta NOBODYNOTCONT NOBODY && ! CONTROLSUB +#describe NOBODYNOTCONT No body, and not a message that should have no body +#score NOBODYNOTCONT 4 + diff --git a/common/drug_spam b/common/drug_spam new file mode 100644 index 0000000..4a2af62 --- /dev/null +++ b/common/drug_spam @@ -0,0 +1,205 @@ +# various drugs match these rules + +# blarson, 2004-05-10 -> lists --pasc 04/05/11 +body DRUGSPAM /(\b|_)(c.?(i|\?|\=ed|\xed).?a.?l.?[ig].?s|v.?(i|1|=ed|\xed).?[\a@].?g.?r.?a|v.?i.?c.?o.?d.?i.?n|h.?y.?d.?r.?o.?c.?o.?d.?o.?n.?e|[xz].?a.?n.?a.\?x|p.?r.?o.?z.?a.?c|rx|hgh)(\b|_)/i +describe DRUGSPAM drug spam +score DRUGSPAM 3 + +# blarson, 2004-05-10 -> lists --pasc 04/05/11 +header DRUGSPAM2 subject =~ /(\b|_)(c.?(i|\?|\=ed|\xed).?a.?l.?[ig].?s|v\.?(i|1|=ed).?[a@].?g.?r.?a|v.?i.?c.?o.?d.?i.?n|h.?y.?d.?r.?o.?c.?o.?d.?o.?n.?e|\[xz].?a.?n.?a.?x|p.?r.?o.?z.?a.?c|rx|hgh)(\b|_)/i +describe DRUGSPAM2 more drug spam +score DRUGSPAM2 3 + +# More drugs! --pasc 2003-05-13 +body DRUGSPAM3 /(v.?i.?o.?x|x.?a.?n.?(a|@).?x|p.?h.?e.?n.?t.?r.?e.?m.?i.?n.?e|v.?i.?a.?g.?r.?a)/i +describe DRUGSPAM3 yet more drugs +score DRUGSPAM3 1 + +body MURPHY_DRUGS1 /v.?i.?a.?g.?r.?a/i +describe MURPHY_DRUGS1 Viagra +score MURPHY_DRUGS1 0.5 + +body MURPHY_DRUGS2 /v.?i.?o.?x/i +describe MURPHY_DRUGS2 Viox +score MURPHY_DRUGS2 0.5 + +body MURPHY_DRUGS3 /F.?i.?o.?r.?i.?c.?e.?e.?t/i +describe MURPHY_DRUGS3 Fioriceet +score MURPHY_DRUGS3 0.5 + +body MURPHY_DRUGS4 /P.?h.?e.?n.?t.?(r.?e|e.?r).?m.?i.?n.?e/i +describe MURPHY_DRUGS4 Phentremine +score MURPHY_DRUGS4 0.5 + +body MURPHY_DRUGS5 /v.?a.?l.?i.?u.?m/i +describe MURPHY_DRUGS5 Valium +score MURPHY_DRUGS5 0.5 + +body MURPHY_DRUGS6 /x.?(a|@).?n.?a.?x/i +describe MURPHY_DRUGS6 Xanax +score MURPHY_DRUGS6 0.5 + +body MURPHY_DRUGS7 /v.?i.?c.?o.?d.?i.?n/i +describe MURPHY_DRUGS7 Vicodin +score MURPHY_DRUGS7 0.5 + +body MURPHY_DRUGS8 /h.?y.?d.?r.?o.?c.?o.?d.?o.?n.?e/i +describe MURPHY_DRUGS8 Hydrocodone +score MURPHY_DRUGS8 0.5 + +body MURPHY_DRUGS_REL1 /medication/i +score MURPHY_DRUGS_REL1 0.5 + +body MURPHY_DRUGS_REL2 /P.?r.?e.?s.?c.?r.?i.?p.?t.?i.?o.?n/i +score MURPHY_DRUGS_REL2 0.5 + +body MURPHY_DRUGS_REL3 /health product/i +score MURPHY_DRUGS_REL3 0.5 + +body MURPHY_DRUGS_REL4 /drug.*expensive/i +score MURPHY_DRUGS_REL4 0.5 + +body MURPHY_DRUGS_REL5 /p.?h.?a.?r.?m.?a.?c.?e.?u.?t.?i.?c.?a.?l/i +score MURPHY_DRUGS_REL5 0.5 + +body MURPHY_DRUGS_REL6 /formula/i +score MURPHY_DRUGS_REL6 0.2 + +body MURPHY_DRUGS_REL7 /dosing/i +score MURPHY_DRUGS_REL7 0.2 + +body MURPHY_DRUGS_REL8 /patch/i +score MURPHY_DRUGS_REL8 0.02 + +body MURPHY_DRUGS_REL9 /pill/i +score MURPHY_DRUGS_REL9 0.2 + +body MURPHY_DRUGS_REL10 /bacteria/i +score MURPHY_DRUGS_REL10 0.1 + +body MURPHY_DRUGS_REL11 /antidote/i +score MURPHY_DRUGS_REL11 0.1 + +meta MURPHY_DRUGS_META1 (MURPHY_DRUGS1 + MURPHY_DRUGS2 + MURPHY_DRUGS3 + MURPHY_DRUGS4 + MURPHY_DRUGS5 + MURPHY_DRUGS6 + MURPHY_DRUGS7 + MURPHY_DRUGS8 + MURPHY_DRUGS_REL1 + MURPHY_DRUGS_REL2 + MURPHY_DRUGS_REL3 + MURPHY_DRUGS_REL4 + MURPHY_DRUGS_REL5 + MURPHY_DRUGS_REL9 + MURPHY_DRUGS_REL10 + MURPHY_DRUGS_REL11) > 1 +score MURPHY_DRUGS_META1 3.0 + +meta MURPHY_DRUGS_META2 (MURPHY_DRUGS1 + MURPHY_DRUGS2 + MURPHY_DRUGS3 + MURPHY_DRUGS4 + MURPHY_DRUGS5 + MURPHY_DRUGS6 + MURPHY_DRUGS7 + MURPHY_DRUGS8 + MURPHY_DRUGS_REL1 + MURPHY_DRUGS_REL2 + MURPHY_DRUGS_REL3 + MURPHY_DRUGS_REL4 + MURPHY_DRUGS_REL5 + MURPHY_DRUGS_REL11 + MURPHY_DRUGS_REL10 + MURPHY_DRUGS_REL9) > 2 +score MURPHY_DRUGS_META2 4.0 + + +meta MURPHY_DRUGS_META3 (MURPHY_DRUGS_REL6 + MURPHY_DRUGS_REL7 + MURPHY_DRUGS_REL8 + MURPHY_DRUGS_REL9) > 1 +score MURPHY_DRUGS_META3 2.0 + +meta DRUGS_STOCK_MIMEOLE (__MIMEOLE_1106 && __MAILER_OL_5510) +header __MIMEOLE_1106 X-MimeOLE =~ /^Produced By Microsoft MimeOLE V6.00.2800.1106$/ +header __MAILER_OL_5510 X-Mailer =~ /^Microsoft Office Outlook, Build 11.0.5510$/ +describe DRUGS_STOCK_MIMEOLE Stock-spam forged headers found (5510) +score DRUGS_STOCK_MIMEOLE 3 + +# More penis enlargement --pasc 061012 +body M_BIGGER1 /gain \d inches/i +score M_BIGGER1 5 + +# cjwatson, 2003/02/26 +body AMAZINGHEALTHGROUP /www\.amazinghealthgroup\.com/ +describe AMAZINGHEALTHGROUP Amazing Spam Group +score AMAZINGHEALTHGROUP 4.0 + +# joy, 2003-09-16 +body PHARMACYSPAM1 /http:\/\/www.pharmacy[^\.]+.biz/i +describe PHARMACYSPAM1 pharmacy spam 1 +score PHARMACYSPAM1 4 + +header PHARMACYSPAM2 Subject =~ /Best Discount Online Drugs/i +describe PHARMACYSPAM2 pharmacy spam 2 +score PHARMACYSPAM2 4 + +# joy, 2003-11-09 +body PRESCRIPTION /prescription/i +describe PRESCRIPTION pharmacy spam +score PRESCRIPTION 2 + +body PHARMACY /pharmacy/i +describe PHARMACY pharmacy spam +score PHARMACY 1 + +body FDAAPPROVEDB /(USA?|FDA)( official)?[ -]approved/ +describe FDAAPPROVEDB US FDA approved pharmacy spam +score FDAAPPROVEDB 2 + +header FDAAPPROVEDS Subject =~ /(USA?|FDA)( official)?[ -]approved/ +describe FDAAPPROVEDS US FDA approved pharmacy spam +score FDAAPPROVEDS 3 + +# cjwatson, 2004-01-16 +body MYPILLSOURCE /mypillsource\.com/ +describe MYPILLSOURCE mypillsource.com spam +score MYPILLSOURCE 4 + +# cjwatson, 2004-02-18 +body HGH_PROVEN /HGH is proven to help/ +describe HGH_PROVEN Yeah, sure +score HGH_PROVEN 3 + +# cjwatson, 2004-02-22 +header CIALGS Subject =~ /sug?per viagrga/ +describe CIALGS Viagra derivative spam +score CIALGS 4 + +# cjwatson, 2004-03-01, 2004-03-05 +body LAY_THE_PIPE /the next (chick|girl) you (screw|bang)/ +describe LAY_THE_PIPE Viagra spam +score LAY_THE_PIPE 4 + +# blarson 2004-04-13 +body SPERM /\bsperm/i +describe SPERM fertility spam +score SPERM 3 + +# blarson 2005-06-04 +header MED subject =~ /\b(?:doctor|health|medic(?:al|ine))$/ +describe MED medical spam +score MED 2 + +# blarson 2006-09-25 +body HOODIA /\bh.?oodia/i +describe HOODIA weight loss scam +score HOODIA 3 + +# dla 2007-02-27 +header PHARRMACY subject =~ /Can+adian\s+Fami+ly\s+Phar+macy/i +describe PHARRMACY pharrmacy can't spell +score PHARRMACY 3 + +# don 2007-05-20 +body MALEENHANCE /male\s+enhan[c\(]e/i +describe MALEENHANCE Enhanced males +score MALEENHANCE 2 + +# blarson 2007-05-20 +body SIZEMAT /\b(?:Does Size|size does) Matter\b/i +describe SIZEMAT size matters spam +score SIZEMAT 2 + +# blarson 2007-08-30 +body SIZEMAT /\bsizematters\.cn\b/i +describe SIZEMAT size matters +score SIZEMAT 4 + +# blarson 2007-06-19 +body ENLARGEPL /\benlargeplus\b/ +describe ENLARGEPL more penis spam +score ENLARGEPL 3 + +# blarson 2007-07-19 +body PHYSCONS /^After this we will require a physician consultation/ +describe PHYSCONS more php spam +score PHYSCONS 3 + + +# blarson 2007-08-12 +body GETABIG /\bwww\.getabiggercock\.net\b/i +describe GETABIG cock spam +score GETABIG 4 + + diff --git a/common/list_specific b/common/list_specific new file mode 100644 index 0000000..a5726c2 --- /dev/null +++ b/common/list_specific @@ -0,0 +1,72 @@ +# This configuration file contains lists.debian.org specific rulessets + +# our MTAs fix up headers for a slew of spams, so mark these as suspicious +# -- joy, 2003-06-28 +header OUR_MTA_MSGID Message-Id =~ /\@(murphy|master|gluck)\.debian\.org/ +describe OUR_MTA_MSGID Sounds like a MsgId autogenerated by our MTAs +score OUR_MTA_MSGID 1 + +# -- joy, 2003-08-15 +header SENDER_FOR_US From =~ /\@(murphy|master|gluck|lists)\.debian\.org/ +describe SENDER_FOR_US Sounds like a mail aimed at tricking our MTAs +score SENDER_FOR_US 2 + +# exception... --joy, 2003-07-12 +header WEBSUBS X-Remote-IP =~ /./ +describe WEBSUBS Sounds like a subscription request from the web +score WEBSUBS -2 + +# another exception... --joy, 2003-07-27 +header SUBSCONFIRM Subject =~ /CONFIRM [su]\d+/ +describe SUBSCONFIRM Sounds like a subscription request confirmation +score SUBSCONFIRM -2 + +# some valid autogenerated mail of ours +# -- joy, 2003-07-09 +header OUR_SCRIPTS_1 Orig-From =~ /.+\@debian\.org \(.+ as listmaster\)/ +describe OUR_SCRIPTS_1 Mail likely generated by .bin/mladmin +score OUR_SCRIPTS_1 -5 + +# our daily un/subscription report gets ~8 SA points ! +# lower it to 3 +# -- zobel, 2006-12-10 +header _OUR_UNSUB_CHANGES1 Subject =~ /Daily un\/subscription report/ +meta OUR_UNSUB_CHANGES (_OUR_UNSUB_CHANGES1 && OUR_MTA_MSGID) +describe OUR_UNSUB_CHANGES Daily mail sent to listmaster about un/subscriptions +score OUR_UNSUB_CHANGES -5 + +# exception... --joy, 2003-08-15 +body MDOMOSUBS /^Request forwarded.$/ +describe MDOMOSUBS Sounds like a subscription request via majorsmart +score MDOMOSUBS -2 + +# another exception --joy, 2004-05-27 +#body OURCRONMAILS Subject =~ /^Cron \ 1) +describe FVGT_m_MULTI_ODD FVGT - contains multiple odd letter combinations +score FVGT_m_MULTI_ODD 0.02 + +# joy, 2003-07-20 +header NEPEYO From =~ /nepeyo\@catlover/ +describe NEPEYO spamvertizers +score NEPEYO 4 + +# cjwatson, 2003/07/28 +header MP3_PLAYERS Subject =~ /New mp3 player,usb flash drive/ +describe MP3_PLAYERS Spam from "HY Tech" +score MP3_PLAYERS 4 + +# joy, 2003-08-15 +header UOSJUNK Subject =~ /UOS online Degree Programme/i +describe UOSJUNK Spam from UOS +score UOSJUNK 4 + +# cjwatson, 2004-02-27 +body GAS_MILEAGE /This amazing, revolutionary device|www\.mrev\.biz/ +describe GAS_MILEAGE Fuel-saving snake oil +score GAS_MILEAGE 3 + +# blarson, 2004-03-31 +body FUELSAVER /fuel.?saver/i +describe FUELSAVER Fuel Saver spam +score FUELSAVER 3 + +# blarson, 2004-04-03 +body CABLEFILTERZ /cablefilterz/ +describe CABLEFILTERZ cablefilterz spam +score CABLEFILTERZ 4 + +# blarson 2004-04-15 +header PARENNUM subject =~ /^\(\s*([0-9\/]+\)|\%RND)/ +describe PARENNUM paren number in subject +score PARENNUM 3 + +# blarson 2004-04-25 +# bounces our bounces.... (had negitive score) +header COVADRT X-RT-Loop-Prevention =~ /^Covad$/ +describe COVADRT Covad request tracker bounces +score COVADRT 8 + +# blarson 2005-03-02 +header ROBERTOJIMENOCA from =~ /ROBERTOJIMENOCA\@terra\.es/ +describe ROBERTOJIMENOCA ROBERTOJIMENOCA sends spammy looking messages +score ROBERTOJIMENOCA -2 + +# blarson 2005-07-10 +header TURBOPRO subject =~ /\bturbonet pro\b/i +describe TURBOPRO dialup accelerator spam +score TURBOPRO 3 + +# blarson 2006-04-28 +header RESUBJECT subject =~ /\sRe(?:\[\d+\])?:\s*$/i +describe RESUBJECT re nothing +score RESUBJECT 2 + +# blarson 2004-10-22 2007-07-18 up score +header NOSUBJECT subject =~ /^\s*$/ +describe NOSUBJECT No subject +score NOSUBJECT 2.5 + +# blarson 2006-10-17 +full NEXTPART /\-\=\_NextPart\_000\_/ +describe NEXTPART spammer mime separator +score NEXTPART 2.5 + +# blarson 2006-10-17 +full CT_IMAGE /Content\-Type\:\s*image/i +describe CT_IMAGE Picture attached +score CT_IMAGE 1 + +# blarson 2006-12-01 (score so low since it will also hit CT_IMAGE) +header CT_IMAGE_HEAD content-type =~ /image/ +describe CT_IMAGE_HEAD entire message is image +score CT_IMAGE_HEAD 2.5 + + +# don 2006-10-25 +header THREADINDEX Thread-Index =~ /A-Z/ +describe THREADINDEX thread-index header on spam +score THREADINDEX 1.5 + +# blarson 2006-10-30 +header FORDASH subject =~ /\bFor \- \d+/ +describe FORDASH for dash +score FORDASH 3 + +# blarson 2006-11-01 +header KOREAN subject =~ /\=\?koi8\-r/ +describe KOREAN Korean Character set spam +score KOREAN 2 + +# blarson 2006-12-04 +header FWDNAME subject =~ /fwd\: \w+\s*$/ +describe FWDNAME fwd: name spam +score FWDNAME 3 + +# blarson 2006-12-06 +body NUMONLY /^\s*\d+\s*$/ +describe NUMONLY number only body +score NUMONLY 1 + +# blarson 2007-04-24 +header THUNDERB User-Agent =~ /^Thunderbird 1\.5\.0\.10/ +describe THUNDERB spam missing content +score THUNDERB 2 + + +# blarson 2007-06-15 +header FAILNOTE subject =~ /Failure notice\:/ +describe FAILNOTE bounced spam +score FAILNOTE 2 + +# blarson 2007-06-28 +rawbody CTINLINE /^Content\-Disposition\: inline\;\b/ +describe CTINLINE Inline attachment +score CTINLINE 1 + +# blarson 2007-07-07 +body BOXTRAPPER /^This message is a reply to a boxtrapper verifcation message\./ +describe BOXTRAPPER boxtrapper spam +score BOXTRAPPER 9 + +# blarson 2007-07-09 +body PROMOCODE /^promo code\:/i +describe PROMOCODE promo code +score PROMOCODE 3 + +# blarson 2007-07-11 +body XLMAN /\bwww\.xl\-man\.net\b/ +describe XLMAN xl-man spam +score XLMAN 3 + +# blarson 2007-07-12 +body COSTUMER /^Dear costumer\b/ +describe COSTUMER paypal scam +score COSTUMER 3 + +# blarson 2007-07-13 +body PRIVATE /^Your private and confidential message is attached\./ +describe PRIVATE private message +score PRIVATE 4 + +# don 2007-07-15 +header AUTOGENERATE auto-submitted =~ /auto/i +describe AUTOGENERATE auto generated crap +score AUTOGENERATE 3 + +# blarson 2007-07-15 +body PRIVPDF /^All our private messages are in pdf format/ +describe PRIVPDF private pdf +score PRIVPDF 4 + +# don 2007-07-19 +header AUTORESPOND X-Autorespond =~ /./ +describe AUTORESPOND Automatic response +score AUTORESPOND 4 + +header AUTOMAILER X-Mailer =~ /autors/ +describe AUTOMAILER Auto response mailer +score AUTOMAILER 3 + +# blarson 2007-07-22 +header OUTOFOFFICE_SUB subject =~ /Out_of_Office/ +describe OUTOFOFFICE_SUB broken autoresponder +score OUTOFOFFICE_SUB 6 + +body OUTOFOFFICE /out of the office/i +describe OUTOFOFFICE Out of the office +score OUTOFOFFICE 3 + +# blarson 2007-08-01 \w was too broad 2007-08-12 add dash, at least 3 digits +header SUBENDNUM subject =~ /[a-zA-Z!]-?\d{3,}$/ +describe SUBENDNUM Subject ends in word989 +score SUBENDNUM 2 + +# blarson 2007-07-27 +body PRIVMES /^You have been sent a private message/ +describe PRIVMES more pdf spam +score PRIVMES 3 + +# blarson 2007-07-27 +header MIXEDBDN Content-Type =~ /multipart\/mixed\;.*boundary\=\"\-{4,}\d{4,}\"/ +describe MIXEDBDN more pdf spam +score MIXEDBDN 3 + +# blarson 2007-07-28 +header DOTZIP subject =~ /\d\.zip\b/ +describe DOTZIP zip spam +score DOTZIP 3 + +# blarson 2007-07-30 +header MIXED2 Content-Type =~ /multipart\/mixed\;charset\=iso\-8859\-1\;.*boundary\=\"\-\-\-\-\=\_\d{8,}\_\d{4,}\"/ +describe MIXED2 more pdf spam +score MIXED2 2.5 + +# blarson 2007-07-31 +header KEYENCE From =~ /KEYENCE CORPORATION/ +describe KEYENCE opt out spam +score KEYENCE 10 + +# blarson 2007-08-02 +header NOSUB subject =~ /\(No Subject\)$/i +describe NOSUB explicity no subject +score NOSUB 1 + +# blarson 2007-08-07 +header CTPDF Content-Type =~ /\bapplication\/pdf\;/i +describe CTPDF more pdf spam +score CTPDF 4 + +# blarson 2007-06-12 +header JAPSUB subject =~ /\=\?iso\-2022\-jp/i +describe JAPSUB subject in japanese +score JAPSUB 3 + +# blarson 2007-08-24 +header XMSATT X-MS-Has-Attach =~ /yes/i +describe XMSATT more pdf spam +score XMSATT 2 + + diff --git a/common/money_spam b/common/money_spam new file mode 100644 index 0000000..199e2df --- /dev/null +++ b/common/money_spam @@ -0,0 +1,245 @@ +# Spam dealing with selling stuff, stocks, etc. is matched by these +# rules + +# Financial/mortage spam --pasc 04/05/12 +# Added the _L set --pasc 04/05/14 +body MURPHY_FINANCE1 /m.?(o|\?).?r.?t.?g.?a.?g.?e.?a.?p.?p.?l.?i.?c.?a.?t.?(i|\?).?o.?n/ +score MURPHY_FINANCE1 0.1 + +body MURPHY_FINANCE2 /b.?a.?d.?c.?r.?(e|\?).?d.?i.?t/ +score MURPHY_FINANCE2 0.1 + +body MURPHY_FINANCE3 /lowest fixed rate/ +score MURPHY_FINANCE3 0.1 + +body MURPHY_FINANCE4 /application (is )?accepted/i +score MURPHY_FINANCE4 0.1 + +body MURPHY_FINANCE5 /loan/i +score MURPHY_FINANCE5 0.1 + +body MURPHY_FINANCE6 /payment/i +score MURPHY_FINANCE6 1.7 + +body MURPHY_FINANCE7 /re.?finance/i +score MURPHY_FINANCE7 0.1 + +body MURPHY_FINANCE8 /interest.?rate/i +score MURPHY_FINANCE8 0.1 +# YEs I know about MURPHY_FINANCE1 +body MURPHY_FINANCE9 /m.?(o|\?).?r.?t.?g.?a.?g.?e/i +score MURPHY_FINANCE9 0.1 + +body MURPHY_FINANCE10 /borrow/i +score MURPHY_FINANCE10 0.5 + +body MURPHY_FINANCE11 /pre.?approved/i +score MURPHY_FINANCE11 1.0 + +body MURPHY_FINANCE_L1 /app(l|1)y/i +score MURPHY_FINANCE_L1 0.0 + +body MURPHY_FINANCE_L2 /bil(l|1)/i +score MURPHY_FINANCE_L2 0.0 + +body MURPHY_FINANCE_L3 /budget/i +score MURPHY_FINANCE_L3 0.0 + +body MURPHY_FINANCE_L4 /home value/i +score MURPHY_FINANCE_L4 0.0 + +body MURPHY_FINANCE_L5 /quote/i +score MURPHY_FINANCE_L5 0.0 + +body MURPHY_FINANCE_L6 /income verification/i +score MURPHY_FINANCE_L6 0.0 + + +# meta MURPHY_FINANCE_LOW (MURPHY_FINANCE_L1 + MURPHY_FINANCE_L2 + MURPHY_FINANCE_L3 + MURPHY_FINANCE_L4 + MURPHY_FINANCE_L5 + MURPHY_FINANCE_L6) > 1 +# score MURPHY_FINANCE_LOW 1.0 + +# meta MURPHY_FINANCE_META1 (MURPHY_FINANCE_LOW + MURPHY_FINANCE1 + MURPHY_FINANCE2 + MURPHY_FINANCE3 + MURPHY_FINANCE4 + MURPHY_FINANCE5 + MURPHY_FINANCE6 + MURPHY_FINANCE7 + MURPHY_FINANCE8 + MURPHY_FINANCE9 + MURPHY_FINANCE10 + MURPHY_FINANCE11) > 1 +# score MURPHY_FINANCE_META1 3.0 + +# Try and catch some of this new spam --pasc 06/10/12 +body M_CASH1 /(prompt|instant|immediate)(aneous)? (cash|funds|capital|finances)/i +score M_CASH1 5 + +# Make money fast --pasc 061016 +body M_CASH2 /(Learn|Find out) how to (make|generate).*k (daily|(a|per) day) from (your )?(home|house)/ +score M_CASH2 5 + +#Stock market scam --pasc 061016 +body M_CASH3 /this symbol will experience (phenomenal|fantastic|amazing) (growth|increase)/i +score M_CASH3 5 + +# cjwatson, 2004-01-14 +header STOCK_MARKET Subject =~ /STOCK MARKET ALERT/ +describe STOCK_MARKET stock market spam +score STOCK_MARKET 4 + +# cjwatson, 2004-02-12 +body GOLDMINE /GOLD MINE SWEEPSTAKES LOTTERY/ +describe GOLDMINE You have won a prize! Sure. +score GOLDMINE 3 + +# blarson, 2004-03-18 +body CASINO /casino/i +describe CASINO Casino spam +score CASINO 2 + +# blarson, 2005-09-21 +body MORTGAGE /m\s*[o0]\s*r\s*t?\s*g\s*a\s*g+\s*e/i +describe MORTGAGE Mortgage spam +score MORTGAGE 2 + +# blarson 2004-04-27 +body CORELDRAW /Corel Draw (graphics suite)?11/i +describe CORELDRAW Corel sales spam +score CORELDRAW 3 + +# blarson 2004-04-10 +body FREESHIPPING /\bf.?r.?e.?e.?\s+s.?h.?[il1].?p.?p.?[il1].?n.?g\b/i +describe FREESHIPPING free shipping +score FREESHIPPING 3 + +# blarson 2004-04-27 +body STOK /\b(OSSI|AMTK|LETH|QIIIF)\b/ +describe STOK stock spam +score STOK 3 + +# blarson 2004-04-18 +body BANNEDCD /(banned|underground)\s*cd/i +describe BANNEDCD banned cd spam +score BANNEDCD 3 + +# cjwatson, 2003/10/09 +body TIMESHARE /Would you like to sell or rent your Timeshare for a profit\?/ +describe TIMESHARE Oddly enough, bugs don't own timeshares +score TIMESHARE 4 + +# blarson 2004-05-02 +body AUTOWAR /\b(auto|car)\s*warr?[ae]nt(y|ee|ie)/i +describe AUTOWAR auto warrenty spam +score AUTOWAR 3 + +# blarson 2004-05-02 +body FORONLY /for\s+only\s+\$/i +describe FORONLY sales spam +score FORONLY 2 + +# blarson 2005-04-15 +body ROLEX /\br[o0a][l1w][l1]?[ea][xzc]/i +describe ROLEX Rolex +score ROLEX 3 + +# blarson 2005-04-15 +header HANDCLOCK subject =~ /\bhand\s*-?clock/i +describe HANDCLOCK Hand Clock +score HANDCLOCK 3 + +# blarson 2004-10-29 +header REPLICAWATCH subject =~ /replica\s*watch/i +describe REPLICAWATCH Replica Watch +score REPLICAWATCH 2 + +# blarson 2004-10-29 +body HANDBAG /hand\s*-?bag/i +describe HANDBAG Handbag +score HANDBAG 2 + +# blarson 2004-11-11 +header ECONOBETTER subject =~ /Economy is much better/i +describe ECONOBETTER Economy is much better +score ECONOBETTER 3 + +# blarson 2004-11-11 +header MRG subject =~ /\bmrg\b/i +describe MRG mrg mortgage spammer +score MRG 2 + +# blarson 2004-11-08 +body CITIBANK /\bciti.?bank\b/i +describe CITIBANK citibank scam +score CITIBANK 2 + +# blarson 2005-01-14 +body HOMEOWNER /home.?owner/i +describe HOMEOWNER home owner +score HOMEOWNER 2 + +# blarson 2005-03-09 +body THOUSANDZ /\bTHOUSANDZ\b/ +describe THOUSANDZ loan spam +score THOUSANDZ 3 + +# blarson 2005-04-15 +header EBAY subject =~ /\bebay\s+account\b/i +describe EBAY ebay account +score EBAY 3 + +# don 2006-10-19 +body INVESTOR_ALERT /an\s*investor\s*alert/i +describe INVESTOR_ALERT stock spam +score INVESTOR_ALERT 2 + +# don 2006-10-19 +body STOCK_ALERT /stock.+press\s*release.+stock/i +describe STOCK_ALERT stock scam +score STOCK_ALERT 2 + +# blarson 2006-10-25 +header NEWSOFTWARE subject =~ /\bNew software uploaded by\b/i +describe NEWSOFTWARE new software spam +score NEWSOFTWARE 4 + +# blarson 2006-11-13 +body REFI /\bhome re-fi\b/i +describe REFI mortgage spam +score REFI 3 + +# don 2006-11-25 +full COMPANYSYMBOLPRICE /((company|symbol|price|marke?t|schlusskurs)\:.+){3,}/si +describe COMPANYSYMBOLPRICE Stock scam +score COMPANYSYMBOLPRICE 3 + +# blarson 2007-04-09 +body PRETTYRUS /\b(pretty|cute) russian (girl|woman)\b/i +describe PRETTYRUS pretty russian spam +score PRETTYRUS 3.5 + +# blarson 2007-04-17 +header INVESTORS subject =~ /\b(investors?|portfolio|radar)\b/i +describe INVESTORS stock spam +score INVESTORS 2 + +# blarson 2007-04-20 +body ANALLE /\bAN ALLE FINANZINVESTOREN\b/ +describe ANALLE stock spam in german +score ANALLE 3 + +# blarson 2007-06-17 +body REPWATCH2 /\breplica watch/i +describe REPWATCH still pushing fake watches +score REPWATCH2 2 + +# blarson 2007-07-19 +header WEEKLYNEWS subject =~ /\bWeekly (:?Sales? )(Newsletter|Special)\b/i +describe WEEKLYNEWS weekly spam +score WEEKLYNEWS 3 + +# blarson 2007-07-23 +body COSTWATCH /\b(dollar|costly|valuable|pricey|expensive)\s+watch\b/i +describe COSTWATCH watch spam +score COSTWATCH 4 + +# don 2007-07-26 +body LEADINGPROVIDER /leading\s+providers?.*consult/i +describe LEADINGPROVIDER Leading provider of consulting +score LEADINGPROVIDER 2 + +# blarson 2007-07-31 +body REFI /\bRe-Fi\b/i +describe REFI mortgage spam +score REFI 2 + diff --git a/common/phrase_spam b/common/phrase_spam new file mode 100644 index 0000000..552fdbb --- /dev/null +++ b/common/phrase_spam @@ -0,0 +1,414 @@ +# Added some rules from Rule du Jour that I've been testing for a while + +#Monotone (from airmax.cf) +body MONOTONE_WORDS_2_15 /^([a-z]{2,20}[\s\.]+){15}/ +describe MONOTONE_WORDS_2_15 Lines with many (long) lowercase words (15+ words, 2+ letters) +body MONOTONE_WORDS_2_30 /^([a-z]{2,20}[\s\.]+){30}/ +describe MONOTONE_WORDS_2_30 Lines with many (long) lowercase words (30+ words, 2+ letters) +body MONOTONE_WORDS_3_20 /^([a-z]{3,20}[\s\.]+){20}/ +describe MONOTONE_WORDS_3_20 Lines with many (long) lowercase words (20+ words, 3+ letters) +body MONOTONE_WORDS_5_8 /^([a-z]{5,20}[\s\.]+){8}/ +describe MONOTONE_WORDS_5_8 Lines with many (long) lowercase words (8+ words, 5+ letters) +body MONOTONE_WORDS_5_12 /^([a-z]{5,20}[\s\.]+){12}/ +describe MONOTONE_WORDS_5_12 Lines with many (long) lowercase words (12+ words, 5+ letters) +body MONOTONE_WORDS_5_20 /^([a-z]{5,20}[\s\.]+){20}/ +describe MONOTONE_WORDS_5_20 Lines with many (long) lowercase words (20+ words, 5+ letters) + +# Lots of auto-responders seem to have this +body MDO_AUTORESP1 /online form/i +score MDO_AUTORESP1 0.1 + +body MDO_AUTORESP2 /large amount of (spam|virus)/i +score MDO_AUTORESP2 0.1 + +body MDO_AUTORESP3 /(electronically|automatically) (generated|created) (email|ack)/i +score MDO_AUTORESP3 0.1 + +body MDO_AUTORESP4 /(respond|answer) your enquiry/i +score MDO_AUTORESP4 0.1 + +body MDO_AUTORESP5 /(email|enquiry) has been received/i +score MDO_AUTORESP5 0.1 + +body MDO_AUTORESP6 /will be answered within/i +score MDO_AUTORESP6 0.1 + +body MDO_AUTORESP7 /the e-mail address to which you have written does not support incoming messages/i +score MDO_AUTORESP7 0.1 + +meta MDO_AUTORESP_META1 (MDO_AUTORESP1 + MDO_AUTORESP2 + MDO_AUTORESP3 + MDO_AUTORESP4 + MDO_AUTORESP5 + MDO_AUTORESP6 + MDO_AUTORESP7) > 1 +score MDO_AUTORESP_META1 2.0 + +body MURPHY_DIPLOMA /Diploma/ +describe MURPHY_DIPLOMA No Diploma +score MURPHY_DIPLOMA 1 + +body MURPHY_CALORIES /calories/ +describe MURPHY_CALORIES No Calories +score MURPHY_CALORIES 1 + +header MURPHY_CONTENT_GIF Content-Type =~ /image\/gif/ +describe MURPHY_CONTENT_GIF Content contains image/gif +score MURPHY_CONTENT_GIF 1 + +# cable tv spam -- pasc 04/05/11-12 +body MDO_CABLE_TV1 /pay.?per.?view/i +score MDO_CABLE_TV1 0.5 + +body MDO_CABLE_TV2 /mature.?channel/i +score MDO_CABLE_TV2 0.5 + +body MDO_CABLE_TV3 /c(\@|a)ble/i +score MDO_CABLE_TV3 0.5 + +body MDO_CABLE_TV4 /rem(o|0)te.?control/i +score MDO_CABLE_TV4 0.5 + +meta MDO_CABLE_META1 (MDO_CABLE_TV1 || MDO_CABLE_TV2 || MDO_CABLE_TV4) && (MDO_CABLE_TV3) +describe MDO_CABLE_META1 Too much cable stuff +score MDO_CABLE_META1 3 + +header MDO_TAGSPAM1 Subject =~ /Unknown Tag *free* Please Fix/ +score MDO_TAGSPAM1 4 + +body MDO_BAD_WORD1 /PORTFOLIO/i +score MDO_BAD_WORD1 2.8 + +# blarson, 2004-04-30 -> lists --pasc 04/05/11 +body AFFILIATEID /affiliate.?id/i +describe AFFILIATEID affiliate id +score AFFILIATEID 3 + +# joy, 2003-08-30, 2003-09-21 +header FW Subject =~ /^Fw: / +describe FW Sounds like a Fw: spam +score FW 3 + +# blarson 2007-07-13 +header REFWD subject =~ /\b(?:RE|FWD)\:\s*$/i +describe REFWD re or fwd nothing +score REFWD 3 + +# blarson 2005-11-11 +header ONEWORD subject =~ /^(?:Fw:|re:)?\s*\w+\s*$/i +describe ONEWORD one word subject +score ONEWORD 1 + +# robot101, 2003-09-22 +header CROSSWALK X-UnityUser =~ /^Crosswalk.com, Inc/ +describe CROSSWALK Crosswalk bible mailing list +score CROSSWALK 3 + +header CROSSWALK_SPAM From =~ /Crosswalk/ +describe CROSSWALK_SPAM Crosswalk Spam +score CROSSWALK_SPAM 1 + +# -- joy, 2003-06-28 +header BOMDIA Subject =~ /Bom dia / +describe BOMDIA Bom dia, usually some Romanic language spam +score BOMDIA 2 + +header RCVD_FROM_UNCONF_HOST Received =~ /^from localhost.localdomain/ +describe RCVD_FROM_UNCONF_HOST Mail comes from a host with unconfigured mailer daemon +score RCVD_FROM_UNCONF_HOST 2 + +# joy, 2003/01/25 +body ECOSPAM /Corridas de Toros para los turistas Ingleses en Barcelona/ +describe ECOSPAM Eco-spam all right +score ECOSPAM 5.0 + +# cjwatson, 2003/02/24 +body SPANISH_FORM_CGI /Este formulario fue enviado por/ +describe SPANISH_FORM_CGI "Below is the result of your feedback form", eh? +score SPANISH_FORM_CGI 4.0 + +# joy, 2003-06-18 +body TRAFFICMAGNET /Become a TrafficMagnet Reseller/ +describe TRAFFICMAGNET SpamMagnet +score TRAFFICMAGNET 4 + +# joy, 2003-06-27 +header BKR Subject =~ /^bkr/ +describe BKR bkr spam +score BKR 4 + +# joy, 2003-06-27 +header RISEANDSHINE Subject =~ /^Rise and Shine in 15 minutes/ +describe RISEANDSHINE Rise and Shine in 15 minutes spam +score RISEANDSHINE 4 + +# joy, 2003-09-20 +header UNIVDIP Subject =~ /U N I V E R S I T Y . D I P L O M A S/i +describe UNIVDIP university diplomas spam +score UNIVDIP 4 + +# joy, 2003-09-21 +header YOUTHERE Subject =~ /^(Re: )?You/i +describe YOUTHERE Who, me? Likely spam +score YOUTHERE 2 + +# cjwatson, 2003-11-20 +header HOUSECLEANING Subject =~ /^Affordable Housecleaning Service/ +describe HOUSECLEANING let's clean out the spam instead +score HOUSECLEANING 3 + +# cjwatson, 2003-12-11 +header OTC_FIRST Subject =~ /OTC FIRST ALERT/ +describe OTC_FIRST OTC spam +score OTC_FIRST 3 + +# joy, 2004-01-03 +body AVAILABLENOW /available now/i +describe AVAILABLENOW must be selling some shit +score AVAILABLENOW 1 + +# cjwatson, 2004-01-16 +body TEDIOUS_WITTER /If not i included it below so let me know if you like it/ +describe TEDIOUS_WITTER annoying wittering spam, mypillsource.com I think +score TEDIOUS_WITTER 2 + +# cjwatson, 2004-03-12 +# blarson 2004-06-09 +header UNI_DIPLOMA Subject =~ /\b(university|college)\s+(diploma|cert|degree)/i +describe UNI_DIPLOMA Got one, thanks +score UNI_DIPLOMA 4 + +# blarson 2004-04-27 +body UNI2 /university\s+(diploma|cert|degree)/i +describe UNI2 Got one, thanks +score UNI2 4 + +# cjwatson, 2004-03-12 +header JOB_CONFIRM Subject =~ /Job confirmation/ +describe JOB_CONFIRM Got one of these too, thanks +score JOB_CONFIRM 3 + +# blarson 2005-09-20 +header MESSAGESUB subject =~ /^\s*\(?message\s*(subject)?\)?$/i +describe MESSAGESUB really descriptive subject +score MESSAGESUB 3 + +# blarson 2006-03-16 2007-08-28 +body DEARDIGIT /^(?:well\s+)?(?:Dear|Hey|H[ea]y?ll?.?o|To|Attention|Hi+|Hey+a?|Bonjorno|Yo|(?:g[o0]+d\s*)?(?:d?ay|morning|evening?|afternoon)|what.?i?s\s+up|greetings|Salutations|(Mail|News)\s+to|how.?s?\s*(?:(?:it)?\s*going|have\s+you\s+been|are you).?\s*(?:there|to\s+you)?)\,?\s+(?:Account\s+\#?|\=?3d|)\d{3,}/i +describe DEARDIGIT Dear number +score DEARDIGIT 3.9 + +# blarson 2004-11-08 +header SIZEMATTERS subject =~ /^S.ze matters$/i +describe SIZEMATTERS Size matters spammer +score SIZEMATTERS 3 + +# cjwatson 2005-01-02 +header RNDMX subject =~ /^ 1 +score MURPHY_SEX_L_META1 2.0 + +meta MURPHY_SEX_META1 (MURPHY_SEX1 + MURPHY_SEX2 + MURPHY_SEX3 + MURPHY_SEX4 + MURPHY_SEX5 + MURPHY_SEX6 + MURPHY_SEX7 + MURPHY_SEX_L_META1) > 1 +score MURPHY_SEX_META1 3.0 + +body MDO_DATING2 /l(o|0)ve/i +describe MDO_DATING2 Don't look for love on debian lists +score MDO_DATING2 0.1 + +body MDO_DATING3 /bar.?hopping/i +describe MDO_DATING3 Bar hopping (looking for dates?) +score MDO_DATING3 0.1 + +body MDO_DATING4 /(meet|find)(ing)?.?(a|the)?.?(perfect|right|new)?.?(stranger|people|partner|person|friend)/i +describe MDO_DATING4 You don't want to pickup a DD +score MDO_DATING4 1.5 + +body MDO_DATING5 /blind.?date/i +score MDO_DATING5 0.1 + +body MDO_DATING7 /hooked you up on a date/i +score MDO_DATING7 0.1 + +body MDO_DATING8 /sex life/i +score MDO_DATING8 0.1 + +body MDO_DATING9 /pleasure your partner/i +score MDO_DATING9 0.1 + +body MDO_DATING10 /sweety/i +score MDO_DATING10 0.1 + +body MDO_DATING11 /personals/i +score MDO_DATING11 0.1 + +body MDO_DATING12 /check out my site/i +score MDO_DATING12 0.1 + +body MDO_DATING13 /see .*pics/i +score MDO_DATING13 0.1 + +body MDO_DATING14 /baby/i +score MDO_DATING14 0.1 + +# cjwatson, 2003/01/31 +body SEXYADULTPAGES /sexyadultpages\.net/ +describe SEXYADULTPAGES Porn spam +score SEXYADULTPAGES 4.0 + +# cjwatson, 2003/02/13 +body FREE_MEMBERS_ACCESS /entry codes.*100% FREE MEMBERS ACCESS/ +describe FREE_MEMBERS_ACCESS Porn spam +score FREE_MEMBERS_ACCESS 4.0 + +# cjwatson, 2003/06/17 +header SAW_PROFILE Subject =~ /\d+.*, I saw your profile/ +describe SAW_PROFILE People keep thinking bugs are cute +score SAW_PROFILE 4.0 + +# cjwatson, 2003/01/07 +body FREELIVECAMGIRLS /www\.freelive(?:camgirls\.net|webcamteens\.com)/ +describe FREELIVECAMGIRLS And they all use Debian! +score FREELIVECAMGIRLS 4.0 + +# cjwatson, 2003/01/28 +header REALLY_CUTE Subject =~ /you're really cute/ +describe REALLY_CUTE It's a *bug*, dammit ... +score REALLY_CUTE 4.0 + +# joy, 2003-07-20 +# this is also pretty generic +rawbody PENISACCENT /pen(í|i)s/i +describe PENISACCENT mentioning penis, esp. with an acute +score PENISACCENT 3 + +# joy, 2003-08-15 +header RAPE_1 Subject =~ /\brape\b/i +describe RAPE_1 Mentions rape, likely porn spam +score RAPE_1 1 +body RAPE_2 /\brape\b/i +describe RAPE_2 Mentions rape, likely porn spam +score RAPE_2 1 + +# joy, 2003-07-20 +header NIGHTHOBBY Subject =~ /many gir.s as they can/ +describe NIGHTHOBBY www.nighthobby.com spamvertizers +score NIGHTHOBBY 4 + +# joy, 2003-11-01 +body ONLINEDATE /online date/i +describe ONLINEDATE offline date +score ONLINEDATE 3 + +# blarson 2005-02-05 add \b +body DATING /\bdating\b/i +describe DATING inundating with spam +score DATING 1 + +# cjwatson, 2003-12-11 +header GIRLS_EJAC Subject =~ /girls ejaculating/ +describe GIRLS_EJAC porn spam, go away +score GIRLS_EJAC 4 + +# cjwatson, 2004-03-25 +# fixed blarson 2004-03-30 +header ZOOPHILS Subject =~ /Z[O0][O0]fils/i +describe ZOOPHILS Ewww. Bestiality spam. +score ZOOPHILS 4 + +# blarson, 2004-03-28 +# fixed blarson 2004-03-30 +header WIVESONIINE Subject =~ /wives\s+[o0]n\s+[il]ine/i +describe WIVESONIINE Wives on Iine +score WIVESONIINE 4 + +# blarson 2004-04-13 +body BLINDDATE /\bblind\s+date\b/i +describe BLINDDATE dating spam +score BLINDDATE 3 + +# blarson 2004-04-26 +body SWINGERCLUB /swingers?\s+club/i +describe SWINGERCLUB swinger club spam +score SWINGERCLUB 3 + +# blarson 2005-02-08 +body HUSBAND /\bhusband\b/i +describe HUSBAND husbanding a bug +score HUSBAND 1 + +# blarson 2004-05-13 +body ADULTDVD /adult\s+dvd/i +describe ADULTDVD adult dvd +score ADULTDVD 3 + +# blarson 2005-01-07 2005-01-30 trollwife submits bugs +body WIFE /(? 1 +score MURPHY_SCAM_META1 3.0 + +header RESPOND Subject =~ /^Respond/ +describe RESPOND respond 419 scam spam +score REPSOND 2 + +# cjwatson, 2003/10/18 +header NIGERIAN_XIAN Subject =~ /^DONATION FOR THE LORD/ +describe NIGERIAN_XIAN The 419 scam with a Christian twist +score NIGERIAN_XIAN 4 + +# cjwatson, 2004-02-10 +header BIZ_PROP Subject =~ /Business Proposition:Respond ASAP/i +describe BIZ_PROP 419 variant +score BIZ_PROP 4 + +# cjwatson, 2004-03-05 +header NEW_PUB_COMP Subject =~ /NEW PUBLIC COMPNAY ALERT/ +describe NEW_PUB_COMP Filesharing spam +score NEW_PUB_COMP 3 + diff --git a/common/scores b/common/scores new file mode 100644 index 0000000..28f4059 --- /dev/null +++ b/common/scores @@ -0,0 +1,110 @@ +# This configuration file alters scores of different tests + +# use newer score and rules, but don't override our own scores +# which is why the scores are divided with a hundred, duh --joy, 2004-05-27 +score CHARSET_FARAWAY 0.03 +# score CHARSET_FARAWAY_HEADERS 0.02 +score CHARSET_FARAWAY_HEADER 0.02 +score HTML_CHARSET_FARAWAY 0.005 +score MIME_CHARSET_FARAWAY 0.02 +# score UNDESIRED_LANGUAGE_BODY 0.03 +score UNWANTED_LANGUAGE_BODY 0.03 +#score BODY_8BITS 1.500 +# give it another shot with a low score. +score USER_IN_WHITELIST -1 +score LDOSUBSCRIBER -6 +score FROM_AND_TO_SAME 4.097 3.826 4.197 3.464 +# score MASS_EMAIL 2.0 2.0 2.0 2.482 +# score BASE64_ENC_TEXT 4.354 3.643 3.544 3.768 +score HTML_WEB_BUGS 2.542 2.100 2.100 2.100 +score EXCUSE_10 2.069 2.0 2.0 2.0 +score MIME_HTML_ONLY 4 +# score CLICK_BELOW 2.489 2.101 2.100 2 +score CLICK_BELOW_CAPS 2.639 2.500 2.100 2.500 +score NORMAL_HTTP_TO_IP 2.3 +# score HTML_LINK_CLICK_HERE 2.100 +# score HTML_JAVASCRIPT 2 2 2 2.230 +score MAILTO_TO_REMOVE 1.274 1.299 1.092 1.273 +score MISSING_MIMEOLE 1.501 1.501 1.241 1.100 +score HTTP_EXCESSIVE_ESCAPES 2.101 2.566 2.208 2.918 +# score MICROSOFT_EXECUTABLE 1.1 +score MIME_SUSPECT_NAME 1.1 +score HTML_MESSAGE 1.112 1.101 1.100 1.0 +# score HTML_WIN_OPEN 1.500 1.501 1.501 1.578 +# score JAVASCRIPT_URI 1.0 1.017 1.0 1.0 +score MAILTO_TO_SPAM_ADDR 1.606 1.377 1.795 1.676 +# score HTML_FONT_COLOR_UNSAFE 1 +# score HTML_FONT_COLOR_RED 1 +# score HTML_FONT_COLOR_BLUE 1 +# score HTML_FONT_COLOR_GREEN 1 +# score HTML_FONT_COLOR_GRAY 1 +# score UNSUB_PAGE 1 +# score MAILTO_WITH_SUBJ_REMOVE 2.101 1.500 2.100 1.500 +# score REMOVE_FROM_LIST 1 +# score REMOVE_IN_QUOTES 1.001 1.197 1.001 1.301 +score REMOVE_PAGE 1.313 1.265 1.675 1.401 +# score EARN_MONEY 1.950 2.018 1.379 1.949 +score EARN_PER_WEEK 1 +score DNS_FROM_RFC_DSN 4 +score DNS_FROM_RFC_BOGUSMX 2.5 +score DNS_FROM_RFC_POST 2.44 +# score RCVD_IN_DYNABLOCK 0 +score RCVD_IN_NJABL_DUL 0 +score FORGED_MUA_OUTLOOK 3.717 3.476 3.850 2.173 +score RAZOR2_CHECK 1 +# score RAZOR2_CF_RANGE_11_50 4 +score RAZOR2_CF_RANGE_51_100 4 +score PYZOR_CHECK 2 +score BAYES_00 0 0 -2 -2 +# score BAYES_01 0 0 -2 -2 +# score BAYES_10 0 0 -1 -1 +score BAYES_20 0 0 -1 -1 +# score BAYES_30 0 0 -1 -1 +score BAYES_40 0 +# score BAYES_44 0 +score BAYES_50 0 +# score BAYES_56 0 +score BAYES_60 0 0 1 1 +# score BAYES_70 0 0 1 1 +score BAYES_80 0 0 1 1 +# score BAYES_90 0 0 2 2 +# score BAYES_99 0 0 3 3 +score BAYES_99 4 + +# don't trust RBLs so much, esp. not dialup lists, moved them towards 0 +# --joy, 2003-07-19 +score RCVD_IN_RFCI 0.0 0.1 0.0 0.092 +score RCVD_IN_ORBS 0.0 0.0 0.0 0.114 +score RCVD_IN_UNCONFIRMED_DSBL 0.0 0.012 0.0 0.0 +score RCVD_IN_NJABL 0.0 0.053 0.0 0.344 +# relays.osirusoft.com is gone --joy, 2003-08-27 +# score RCVD_IN_OSIRUSOFT_COM 0 +score RCVD_IN_SORBS 0.2 +# sometimes kills off valid excite etc users, and doesn't detect much spam +# so -1 point from 2.55 default --joy, 2003-07-19 +score RCVD_FAKE_HELO_DOTCOM 0.791 1.606 1.264 2.434 +# score RCVD_FAKE_HELO_DOTCOM_2 1.335 1.404 0.221 1.799 + +# Upped some rules which only seem to happen in spam. Suggestion from Santiago +# --pasc 2004-05-23 + +score HTML_FONT_BIG 3.0 +# score HTML_IMAGE_ONLY 3.0 +score MIME_MISSING_BOUNDARY 3.0 +score MIME_HTML_MOSTLY 3.0 +# score DATE_IN_FUTURE 3.0 +score INVALID_DATE_TZ_ABSURD 3.0 +score MSGID_FROM_MTA_HEADER 3.0 + +# This only seems to happen in spam as well +score HTML_FONT_FACE_BAD 3.0 + +# score RCVD_IN_OSIRUSOFT_COM 0 +score RCVD_IN_SORBS 0.2 +score RCVD_FAKE_HELO_DOTCOM 0.791 1.606 1.264 2.434 +# score RCVD_FAKE_HELO_DOTCOM_2 1.335 1.404 0.221 1.799 +score HTML_FONT_BIG 3.0 +# score HTML_IMAGE_ONLY 3.0 +score MIME_MISSING_BOUNDARY 3.0 +score MIME_HTML_MOSTLY 3.0 +# score DATE_IN_FUTURE 3.0 diff --git a/common/url_spam b/common/url_spam new file mode 100644 index 0000000..57c233b --- /dev/null +++ b/common/url_spam @@ -0,0 +1,137 @@ +# joy, 2003-06-29 +body ORIENTSKY /orient-sky\.com/ +describe ORIENTSKY Japanese spam +score ORIENTSKY 4 + +# joy, 2003-07-06 +body PACHETES /www\.pachetes\.com/ +describe PACHETES Spanish spam +score PACHETES 4 + +# cjwatson, 2003/07/12 +body NO_MORE_ACCENT /www\.no-more-accent\.com/ +describe NO_MORE_ACCENT No More Accent spam +score NO_MORE_ACCENT 4 + +# joy, 2003-08-15 +header FETHARD Subject =~ /fethard.biz/i +describe FETHARD Spam from Fethard.biz +score FETHARD 4 + +# joy, 2003-10-21, 2003-10-31 +body PHARMACYSPAM3 /http:\/\/www\.rx(salenow|ville)\.biz/i +describe PHARMACYSPAM3 pharmacy spam 3 +score PHARMACYSPAM3 4 + +# cjwatson, 2004-01-13 +# blarson, any number 2004-04-01 +# blarson, more ajustmets 2004-04-03 +body HREF_NNNN /www\.\d{3,5}hosting\.com/ +describe HREF_NNNN www.NNNNhosting.com spam +score HREF_NNNN 3 + +# cjwatson, 2004-02-16 +body SOCCER_MOMS /www\.soccer-moms\.biz/ +describe SOCCER_MOMS Porn spam +score SOCCER_MOMS 4 + +# cjwatson, 2004-02-22 +body MRSM_TILO /mrsm-tilo\.com/ +describe MRSM_TILO Medical spam +score MRSM_TILO 4 + +# cjwatson, 2004-02-27 +body FAST_ACTING /fast-acting\.com/ +describe FAST_ACTING Viagra spam +score FAST_ACTING 4 + +# blarson 2004-04-04 +body COMCLICKPH /com-click\.com\.ph/ +describe COMCLICKPH PH spam gang +score COMCLICKPH 4 + +# blarson 2004-05-01 +body MEDS675 /(675meds|medsarergreat)\.com/i +describe MEDS675 More drug spam +score MEDS675 3 + +# blarson 2004-04-30 +body ERHOME /erhome\.com/i +describe ERHOME loan spammer +score ERHOME 3 + +# blarson 2005-04-27 +body CANDYHOS /\.(?:candyhos\.com|(?:mycountry|polty|make4u)\.cc|puchiphoto\.org|purepure\.org)\//i +describe CANDYHOS spams from korea, hosts in japan +score CANDYHOS 5 + +# blarson 2005-12-08 +body GEOCITIES /http\:\/\/.*geocities/i +describe GEOCITIES geocities url +score GEOCITIES 1.6 + +# blarson 2005-12-24 +body EMPTYURL /\bhttp:\/\/(?:www\.)?$/i +describe EMPTYURL empty URL +score EMPTYURL 1.5 + +# blarson 2006-02-06 +body AMPRO /www\.amateurprovideo\.info/i +describe AMPRO bug submitting spammer +score AMPRO 5 + +# blarson 2007-04-03 +body IMAGESHACK /\/img\d+\.imageshack\.us\//i +describe IMAGESHACK shack attack +score IMAGESHACK 3.5 + + +# dla 2007-04-03 +header MSOUTLOOK x-mailer =~ /Microsoft\s+Outlook/i +describe MSOUTLOOK Microsoft Outlook +score MSOUTLOOK 0 + +meta SHACKOUTLOOK IMAGESHACK && MSOUTLOOK +describe SHACKOUTLOOK shack'ed to outlook +score SHACKOUTLOOK 2 + +# blarson 2007-04-09 +body UNSUBG /\bwww\.guiaartistica\.com\.ar\b/ +describe UNSUBG spamming bts with unsubscribe messages +score UNSUBG 14 + +# blarson 2007-05-14 +body IMGCLOSET /\bhttp\:\/\/.*\b((image(closet|thrust|hosting)|mypicshare|tinypic|fileanchor|imgspot)\.com|bilder-hosting\.de|saunalahti\.fi|upload2\.net|imagehost\.ro)\b/i +describe IMGCLOSET closet spammer +score IMGCLOSET 3.5 + +# blarson 2007-05-17 +body TROUBLEDE /\bhttp\:\/\/www\.TroubleAgent\.de\b/ +describe TROUBLEDE troubleagent.de spam +score TROUBLEDE 3.5 + +# don 2007-05-24 +body BESTLOANS /www.bestmortloans.com/i +describe BESTLOANS Best loans url +score BESTLOANS 2 + +# blarson 2007-07-22 +body PENPRO /\@penmailpro\.info\b/i +describe PENPRO penmailpro spam +score PENPRO 3.5 + +# blarson 2007-09-05 +body WWWCN /\bwww\.\w+\.cn\b/i +describe WWWCN chinese web site +score WWWCN 3 + +# cjwatson, 2002/04/04 +body EMAILOFFER /www\.emailoffer\.us/ +describe EMAILOFFER Gibberish HTML spammers +score EMAILOFFER 4.0 + +# cjwatson, 2002/04/08 +body JUSTYAK /www\.JustYak\.com/ +describe JUSTYAK JustSpam +score JUSTYAK 4.0 + diff --git a/common/virus_spam b/common/virus_spam new file mode 100644 index 0000000..c9686d2 --- /dev/null +++ b/common/virus_spam @@ -0,0 +1,80 @@ +# joy, 2003-08-15 +rawbody PIC_GIF /^Content-ID: /i +describe PIC_GIF pic*.gif in attachment, common spam/virus +score PIC_GIF 3 + +header POSSIBLEVIRUS Subject =~ /\{Virus\?\} / +describe POSSIBLEVIRUS possible or cleaned virus tag found in Subject +score POSSIBLEVIRUS 2 + +# cjwatson, 2003/09/22 2003/10/02 +header AV_SCAN Subject =~ /AntiVirus scan results/ +describe AV_SCAN virus fallout +score AV_SCAN 4 + +# cjwatson, 2003/09/24 +body CORREO_TERRA /Antivirus de Correo de Terra/ +describe CORREO_TERRA virus fallout +score CORREO_TERRA 2 + +# cjwatson, 2003/09/24 +body WEBSHIELD /Network Associates WebShield SMTP.*detected virus/ +describe WEBSHIELD virus fallout +score WEBSHIELD 3 + +# cjwatson, 2003/09/25, joy 2003-10-01 +header AV_ALERT Subject =~ /^(Anti)?Virus Alert/ +describe AV_ALERT virus fallout +score AV_ALERT 4.5 + +# cjwatson, 2003/09/29 +body INFECTED_OBJ /because contains an infected object/ +describe INFECTED_OBJ virus fallout +score INFECTED_OBJ 4 + +# joy, 2003-10-01 +header AV_RESULTS Subject =~ /AntiVirus scan results/i +describe AV_ALERT anti-virus spam +score AV_ALERT 4 + +# cjwatson, 2004-01-27 +header IOL_ALERTA Subject =~ /IOL - ALERTA de Virus/ +describe IOL_ALERTA misdirected antivirus +score IOL_ALERTA 4 + +# blarson 2004-04-10 +rawbody ZIPCOMPRESSED /application\/x-zip-compressed/i +describe ZIPCOMPRESSED zip compressed attachment +score ZIPCOMPRESSED 2 + +# blarson 2005-04-29 +header MICROVIRUS subject =~ /(?:Current|Latest|Newest|New) (?:Microsoft|Internet|Net) (?:Security|Critical)? ?(?:Patch|Pack|Update|Upgrade)/i +describe MICROVIRUS microsoft email virus +score MICROVIRUS 4 + +# blarson 2006-11-21 +rawbody AVGMAIL /\b\-\-\=\=\=\=\=\=\=AVGMAIL/ +describe AVGMAIL avg virus claim +score AVGMAIL 3 + +# don 2007-06-25 blarson 2007-06-28 +# This is %PDF-1.1 base64 encoded +full PDFATTACH /JVBERi0xLjE/ +describe PDFATTACH PDF Attachment +score PDFATTACH 2 + +# blarson 2007-06-29 +header PDFNAME subject =~ /\w\.pdf\b/i +describe PDFNAME pdf spam +score PDFNAME 3.5 + +# blarson 2007-07-18 +rawbody APPPDF /\bContent-Type\:\s+application\/pdf/i +describe APPPDF pdf attachment +score APPPDF 2 + +# blarson 2007-09-01 +body NOVIR /^No virus found in this incoming message\./ +describe NOVIR bogus no virus +score NOVIR 1 + diff --git a/lists/user_prefs b/lists/user_prefs new file mode 100644 index 0000000..48a7430 --- /dev/null +++ b/lists/user_prefs @@ -0,0 +1,85 @@ +# SpamAssassin user preferences file. See 'man Mail::SpamAssassin::Conf' for +# details of what can be tweaked. +########################################################################### + +# XXX update the date in the version tag whenever you make changes! +# version_tag lists.debian.org-2007-04-23-01 + +required_hits 4.0 +# use_terse_report 0 +# check_mx_attempts 2 +#rbl_timeout 5 +# dns_available yes +skip_rbl_checks 0 +dns_available test: gluck.debian.org master.debian.org klecker.debian.org + +# use newer score and rules, but don't override our own scores +include /var/list/.spamassassin/newer-rules/50_scores.cf + +internal_networks 70.103.162.31/32 127.0.0.1/32 +trusted_networks 70.103.162.0/24 127.0.0.1/32 192.25.206.10/32 + +# No unnecessary crap --liiwi 2004-08-29 +report_safe 0 + +# Making this explicit --pasc, 2004-02-22 +use_razor2 1 + +# This should work now -- pasc, 2005-07-19 +use_pyzor 1 + +# testing only --joy, 2003-09-05 +# we have non english lists on lists.d.o --rmurray, 2003-12-03 +# which is why the scores are divided with a hundred, duh --joy, 2004-05-27 +ok_locales en +# ok_languages en + +# good idea, should have been taken further, but preemptively +# commented out by Joy after the 2003-06-27 debacle where the +# 10 MB bayesian database caused spamds to consume gobs of memory +#bayes_expiry_scan_count 20000 + +# we don't train the Bayesian classifier so don't give it full weight +# cf. bug #188703 --joy, 2003-04-12, 2003-04-28 +# +# set more realistic settings, so bayes is not automatic poisoned any more +# -- zobel, 2207-01-13 +bayes_auto_learn_threshold_nonspam -5 +bayes_auto_learn_threshold_spam 27 + + +################################################################ +# SARE-rules (http://www.rulesemporium.com/rules.htm) +################################################################ + +include /var/list/.spamassassin/sare-rules/70_sare_adult.cf +include /var/list/.spamassassin/sare-rules/70_sare_header0.cf +include /var/list/.spamassassin/sare-rules/70_sare_header1.cf +include /var/list/.spamassassin/sare-rules/70_sare_html0.cf +include /var/list/.spamassassin/sare-rules/70_sare_html1.cf +include /var/list/.spamassassin/sare-rules/70_sare_oem.cf +include /var/list/.spamassassin/sare-rules/70_sare_specific.cf +include /var/list/.spamassassin/sare-rules/70_sare_stocks.cf +include /var/list/.spamassassin/sare-rules/72_sare_bml_post25x.cf +include /var/list/.spamassassin/sare-rules/75_black_uri_list.cf +include /var/list/.spamassassin/sare-rules/99_sare_fraud_post25x.cf + + +################################################################ +# newer rules which aren't in /usr/share/spamassassin +################################################################ + +include /var/list/.spamassassin/newer-rules/20_dnsbl_tests.cf +include /var/list/.spamassassin/newer-rules/20_head_tests.cf +include /var/list/.spamassassin/newer-rules/20_ratware.cf +include /var/list/.spamassassin/newer-rules/20_uri_tests.cf +include /var/list/.spamassassin/newer-rules/25_uribl.cf +include /var/list/.spamassassin/newer-rules/60_whitelist_dk.cf +include /var/list/.spamassassin/newer-rules/70_iadb.cf +include /var/list/.spamassassin/newer-rules/80_additional.cf + +# Include common spam stuff + +include common/common_spam +include common/list_specific +include common/score -- 2.39.2