# SpamAssassin rules file
#
# Please don't modify this file as your changes will be overwritten with
# the next update. Use @@LOCAL_RULES_DIR@@/local.cf instead.
# See 'perldoc Mail::SpamAssassin::Conf' for details.
#
# <@LICENSE>
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to you under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at:
# 
#     http://www.apache.org/licenses/LICENSE-2.0
# 
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# </@LICENSE>
#
###########################################################################

require_version @@VERSION@@

##{ ADVANCE_FEE_2_NEW_FORM

meta      ADVANCE_FEE_2_NEW_FORM    __ADVANCE_FEE_2_NEW_FORM && !__COMMENT_EXISTS && !__THREADED && !__HTML_LINK_IMAGE && !__HDRS_LCASE
describe  ADVANCE_FEE_2_NEW_FORM    Advance Fee fraud and a form
tflags    ADVANCE_FEE_2_NEW_FORM     publish
##} ADVANCE_FEE_2_NEW_FORM

##{ ADVANCE_FEE_2_NEW_FRM_MNY

meta      ADVANCE_FEE_2_NEW_FRM_MNY    __ADVANCE_FEE_2_NEW_FRM_MNY && !__HTML_LINK_IMAGE && !__HDRS_LCASE
describe  ADVANCE_FEE_2_NEW_FRM_MNY    Advance Fee fraud form and lots of money
##} ADVANCE_FEE_2_NEW_FRM_MNY

##{ ADVANCE_FEE_2_NEW_MONEY

meta      ADVANCE_FEE_2_NEW_MONEY    __ADVANCE_FEE_2_NEW_MONEY && !__DOS_HAS_LIST_UNSUB && !__TAG_EXISTS_CENTER && !__LYRIS_EZLM_REMAILER && !__COMMENT_EXISTS && !__UNSUB_LINK && !__VIA_ML && !__HTML_LINK_IMAGE && !__HDRS_LCASE && !__NAME_EQ_EMAIL
describe  ADVANCE_FEE_2_NEW_MONEY    Advance Fee fraud and lots of money
tflags    ADVANCE_FEE_2_NEW_MONEY    publish
##} ADVANCE_FEE_2_NEW_MONEY

##{ ADVANCE_FEE_3_NEW

meta      ADVANCE_FEE_3_NEW  __ADVANCE_FEE_3_NEW && !__HTML_LINK_IMAGE && !__TAG_EXISTS_CENTER && !__COMMENT_EXISTS && !__VIA_ML && !__THREADED && !__UNSUB_LINK
describe  ADVANCE_FEE_3_NEW  Appears to be advance fee fraud (Nigerian 419)
tflags    ADVANCE_FEE_3_NEW          publish
##} ADVANCE_FEE_3_NEW

##{ ADVANCE_FEE_3_NEW_FORM

meta      ADVANCE_FEE_3_NEW_FORM    __ADVANCE_FEE_3_NEW_FORM && !__HTML_LINK_IMAGE
describe  ADVANCE_FEE_3_NEW_FORM    Advance Fee fraud and a form
tflags    ADVANCE_FEE_3_NEW_FORM     publish
##} ADVANCE_FEE_3_NEW_FORM

##{ ADVANCE_FEE_3_NEW_FRM_MNY

meta      ADVANCE_FEE_3_NEW_FRM_MNY    __ADVANCE_FEE_3_NEW_FRM_MNY && !__HTML_LINK_IMAGE
describe  ADVANCE_FEE_3_NEW_FRM_MNY    Advance Fee fraud form and lots of money
##} ADVANCE_FEE_3_NEW_FRM_MNY

##{ ADVANCE_FEE_3_NEW_MONEY

meta      ADVANCE_FEE_3_NEW_MONEY    __ADVANCE_FEE_3_NEW_MONEY && !__HTML_LINK_IMAGE
describe  ADVANCE_FEE_3_NEW_MONEY    Advance Fee fraud and lots of money
tflags    ADVANCE_FEE_3_NEW_MONEY    publish
##} ADVANCE_FEE_3_NEW_MONEY

##{ ADVANCE_FEE_4_NEW

meta      ADVANCE_FEE_4_NEW  __ADVANCE_FEE_4_NEW
describe  ADVANCE_FEE_4_NEW  Appears to be advance fee fraud (Nigerian 419)
tflags    ADVANCE_FEE_4_NEW          publish
##} ADVANCE_FEE_4_NEW

##{ ADVANCE_FEE_4_NEW_FORM

meta      ADVANCE_FEE_4_NEW_FORM    __ADVANCE_FEE_4_NEW_FORM
describe  ADVANCE_FEE_4_NEW_FORM    Advance Fee fraud and a form
##} ADVANCE_FEE_4_NEW_FORM

##{ ADVANCE_FEE_4_NEW_FRM_MNY

meta      ADVANCE_FEE_4_NEW_FRM_MNY    __ADVANCE_FEE_4_NEW_FRM_MNY
describe  ADVANCE_FEE_4_NEW_FRM_MNY    Advance Fee fraud form and lots of money
##} ADVANCE_FEE_4_NEW_FRM_MNY

##{ ADVANCE_FEE_4_NEW_MONEY

meta      ADVANCE_FEE_4_NEW_MONEY    __ADVANCE_FEE_4_NEW_MONEY && !__HTML_LINK_IMAGE && !__TAG_EXISTS_CENTER
describe  ADVANCE_FEE_4_NEW_MONEY    Advance Fee fraud and lots of money
##} ADVANCE_FEE_4_NEW_MONEY

##{ ADVANCE_FEE_5_NEW

meta      ADVANCE_FEE_5_NEW  __ADVANCE_FEE_5_NEW
describe  ADVANCE_FEE_5_NEW  Appears to be advance fee fraud (Nigerian 419)
##} ADVANCE_FEE_5_NEW

##{ ADVANCE_FEE_5_NEW_FORM

meta      ADVANCE_FEE_5_NEW_FORM    __ADVANCE_FEE_5_NEW_FORM
describe  ADVANCE_FEE_5_NEW_FORM    Advance Fee fraud and a form
##} ADVANCE_FEE_5_NEW_FORM

##{ ADVANCE_FEE_5_NEW_FRM_MNY

meta      ADVANCE_FEE_5_NEW_FRM_MNY    __ADVANCE_FEE_5_NEW_FRM_MNY
describe  ADVANCE_FEE_5_NEW_FRM_MNY    Advance Fee fraud form and lots of money
##} ADVANCE_FEE_5_NEW_FRM_MNY

##{ ADVANCE_FEE_5_NEW_MONEY

meta      ADVANCE_FEE_5_NEW_MONEY    __ADVANCE_FEE_5_NEW_MONEY
describe  ADVANCE_FEE_5_NEW_MONEY    Advance Fee fraud and lots of money
##} ADVANCE_FEE_5_NEW_MONEY

##{ APOSTROPHE_FROM

header		APOSTROPHE_FROM	From:addr =~ /'/
describe	APOSTROPHE_FROM	From address contains an apostrophe
##} APOSTROPHE_FROM

##{ AXB_HELO_HOME_UN

header          AXB_HELO_HOME_UN        X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\w+\.(lan|home) /i
describe        AXB_HELO_HOME_UN        HELO from home  - untrusted
##} AXB_HELO_HOME_UN

##{ AXB_XMID_1212

header          AXB_XMID_1212                   Message-Id =~ /^<[0-9]{12}\.[0-9]{12}\@/
describe        AXB_XMID_1212                   Barbera Fingerprint
##} AXB_XMID_1212

##{ AXB_XMID_1510

header          AXB_XMID_1510                   Message-Id =~ /<[0-9A-F]{15}\.[0-9A-F]{10}\@/
describe        AXB_XMID_1510                   Brunello Fingerprint
##} AXB_XMID_1510

##{ AXB_XMID_OEGOESNULL

header          AXB_XMID_OEGOESNULL             Message-ID =~ /^<[0-9-a-f]{12}\$[0-9-a-f]{8}\$[0]{8}\@/
describe        AXB_XMID_OEGOESNULL             Amarone Fingerprint
##} AXB_XMID_OEGOESNULL

##{ AXB_XM_SENDMAIL_NOT

header          AXB_XM_SENDMAIL_NOT             Received =~ /\([123456790]{1,2}\.[0-9]{1,2}\.[0-9]{1}\/[0-9]{1,2}\.[0-9]{2}\.[0-9]{1}\)/
describe        AXB_XM_SENDMAIL_NOT             Nebbiolo fingerprint
##} AXB_XM_SENDMAIL_NOT

##{ AXB_XR_STULDAP

header  AXB_XR_STULDAP     Received =~ /\(8\.12\.3 da nor stuldap\/8\.12\.3\)/
##} AXB_XR_STULDAP

##{ BANKING_LAWS

body		BANKING_LAWS	/banking laws/i
describe	BANKING_LAWS	Talks about banking laws
##} BANKING_LAWS

##{ BASE64_LENGTH_78_79 ifplugin Mail::SpamAssassin::Plugin::MIMEEval

ifplugin Mail::SpamAssassin::Plugin::MIMEEval
body BASE64_LENGTH_78_79	eval:check_base64_length('78','79')
endif
##} BASE64_LENGTH_78_79 ifplugin Mail::SpamAssassin::Plugin::MIMEEval

##{ BASE64_LENGTH_79_INF ifplugin Mail::SpamAssassin::Plugin::MIMEEval

ifplugin Mail::SpamAssassin::Plugin::MIMEEval
body BASE64_LENGTH_79_INF	eval:check_base64_length('79')
endif
##} BASE64_LENGTH_79_INF ifplugin Mail::SpamAssassin::Plugin::MIMEEval

##{ BUG6152_INVALID_DATE_TZ_ABSURD

header BUG6152_INVALID_DATE_TZ_ABSURD   Date =~ /[-+](?!(?:0\d|1[0-4])(?:[03]0|[14]5))\d{4}/
##} BUG6152_INVALID_DATE_TZ_ABSURD

##{ CN_B2B_SPAMMER

body        CN_B2B_SPAMMER         /We are a China[-\s]based/i
describe    CN_B2B_SPAMMER         Chinese company introducing itself
##} CN_B2B_SPAMMER

##{ CORRUPT_FROM_LINE_IN_HDRS

meta CORRUPT_FROM_LINE_IN_HDRS (MISSING_HEADERS && __BODY_STARTS_WITH_FROM_LINE && MISSING_DATE && NO_RELAYS)
describe CORRUPT_FROM_LINE_IN_HDRS Informational: message is corrupt, with a From line in its headers
tflags CORRUPT_FROM_LINE_IN_HDRS userconf publish
#score CORRUPT_FROM_LINE_IN_HDRS 0.001
##} CORRUPT_FROM_LINE_IN_HDRS

##{ CTYPE_001C_A

meta CTYPE_001C_A  (0)      # obsolete
##} CTYPE_001C_A

##{ CTYPE_001C_B

header CTYPE_001C_B Content-Type =~ /multipart.{0,200}boundary=\"----=_NextPart_000_0000_01C[0-9A-F]{5}\.[0-9A-F]{7}0\"/
##} CTYPE_001C_B

##{ CTYPE_8SPACE_GIF ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader CTYPE_8SPACE_GIF Content-Type:raw =~ /^image\/gif;\n {8}name=\".+?\"$/s
describe CTYPE_8SPACE_GIF   Stock spam image part 'Content-Type' found (8 spc)
endif
##} CTYPE_8SPACE_GIF ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ CURR_PRICE

body CURR_PRICE         /\bCurrent Price:/
##} CURR_PRICE

##{ DATE_IN_FUTURE_96_Q ifplugin Mail::SpamAssassin::Plugin::HeaderEval

ifplugin Mail::SpamAssassin::Plugin::HeaderEval
header	 DATE_IN_FUTURE_96_Q	eval:check_for_shifted_date('96', '2920')
describe DATE_IN_FUTURE_96_Q	Date: is 4 days to 4 months after Received: date
endif
##} DATE_IN_FUTURE_96_Q ifplugin Mail::SpamAssassin::Plugin::HeaderEval

##{ DATE_IN_FUTURE_Q_PLUS ifplugin Mail::SpamAssassin::Plugin::HeaderEval

ifplugin Mail::SpamAssassin::Plugin::HeaderEval
header	 DATE_IN_FUTURE_Q_PLUS	eval:check_for_shifted_date('2920', 'undef')
describe DATE_IN_FUTURE_Q_PLUS	Date: is over 4 months after Received: date
endif
##} DATE_IN_FUTURE_Q_PLUS ifplugin Mail::SpamAssassin::Plugin::HeaderEval

##{ DEAR_BENEFICIARY

body     DEAR_BENEFICIARY         /^\s?(?:Dear\s|At+(?:ention|n):?\s?)(?:\S+\s)?Ben[ei]ficiary\b/i
describe DEAR_BENEFICIARY         Dear Beneficiary:
#score    DEAR_BENEFICIARY         2.0
##} DEAR_BENEFICIARY

##{ DEAR_EMAIL

body	 DEAR_EMAIL	/^\s*Dear\b.{0,70}\w\@\w/i
describe DEAR_EMAIL	Message contains Dear email address
#score    DEAR_EMAIL	1.5 # 20090424
##} DEAR_EMAIL

##{ DEAR_WINNER

body DEAR_WINNER /\bdear.{1,20}winner/i
##} DEAR_WINNER

##{ DOS_ANAL_SPAM_MAILER

header DOS_ANAL_SPAM_MAILER	X-mailer =~ /^[A-Z][a-z]{6}e \d\.\d{2}$/
describe DOS_ANAL_SPAM_MAILER	X-mailer pattern common to anal porn site spam
tflags DOS_ANAL_SPAM_MAILER	publish
##} DOS_ANAL_SPAM_MAILER

##{ DOS_FIX_MY_URI

meta DOS_FIX_MY_URI             __MIMEOLE_1106 && __DOS_HAS_ANY_URI && __DOS_SINGLE_EXT_RELAY && __DOS_HI && __DOS_LINK
describe DOS_FIX_MY_URI         Looks like a "fix my obfu'd URI please" spam
##} DOS_FIX_MY_URI

##{ DOS_HIGH_BAT_TO_MX

meta DOS_HIGH_BAT_TO_MX		__DOS_DIRECT_TO_MX && __HIGHBITS && __LAST_UNTRUSTED_RELAY_NO_AUTH && __THEBAT_MUA
describe DOS_HIGH_BAT_TO_MX	The Bat! Direct to MX with High Bits
##} DOS_HIGH_BAT_TO_MX

##{ DOS_LET_GO_JOB

meta DOS_LET_GO_JOB	__DOS_LET_GO_JOB && __DOS_MY_OLD_JOB && __DOS_I_DRIVE_A && __DOS_TAKING_HOME
describe DOS_LET_GO_JOB	Let go from their job and now makes lots of dough!
##} DOS_LET_GO_JOB

##{ DOS_OE_TO_MX

meta DOS_OE_TO_MX		__OE_MUA && __DOS_DIRECT_TO_MX && !DOS_OE_TO_MX_IMAGE
describe DOS_OE_TO_MX		Delivered direct to MX with OE headers
##} DOS_OE_TO_MX

##{ DOS_OE_TO_MX_IMAGE

meta DOS_OE_TO_MX_IMAGE		__OE_MUA && __DOS_DIRECT_TO_MX && __ANY_IMAGE_ATTACH
describe DOS_OE_TO_MX_IMAGE	Direct to MX with OE headers and an image
##} DOS_OE_TO_MX_IMAGE

##{ DOS_OUTLOOK_TO_MX

meta DOS_OUTLOOK_TO_MX		__ANY_OUTLOOK_MUA && !__OE_MUA && __DOS_DIRECT_TO_MX && !T_DOS_OUTLOOK_TO_MX_IMAGE
describe DOS_OUTLOOK_TO_MX	Delivered direct to MX with Outlook headers
##} DOS_OUTLOOK_TO_MX

##{ DOS_RCVD_IP_TWICE_B

header DOS_RCVD_IP_TWICE_B	X-Spam-Relays-External =~ /^\s*\[ ip=(?!127)([\d.]+) [^\[]*\[ ip=\1 [^\]]*\]\s*$/
describe DOS_RCVD_IP_TWICE_B	Received from the same IP twice in a row (only one external relay)
##} DOS_RCVD_IP_TWICE_B

##{ DOS_RCVD_IP_TWICE_C

header DOS_RCVD_IP_TWICE_C	X-Spam-Relays-External =~ /^\s*\[ ip=(?!127)([\d.]+) [^\[]*\bhelo=(?:![\d.]{7,15}!)? [^\[]*\[ ip=\1 [^\]]*\]\s*$/
describe DOS_RCVD_IP_TWICE_C	Received from the same IP twice in a row (only one external relay; empty or IP helo)
##} DOS_RCVD_IP_TWICE_C

##{ DOS_STOCK_BAT

meta		DOS_STOCK_BAT		__THEBAT_MUA && (__DOS_BODY_STOCK || __DOS_BODY_TICKER) && (__DOS_REF_TODAY || __DOS_REF_NEXT_WK_DAY || __DOS_REF_2_WK_DAYS)
describe	DOS_STOCK_BAT		Probable pump and dump stock spam
##} DOS_STOCK_BAT

##{ DOS_STOCK_BAT2

meta		DOS_STOCK_BAT2		DOS_STOCK_BAT && (__DOS_FIN_ADVANTAGE + __DOS_STRONG_CF + __DOS_STEADY_COURSE > 2)
##} DOS_STOCK_BAT2

##{ DOS_URI_ASTERISK

uri DOS_URI_ASTERISK    m{^[Hh][Tt]{2}[Pp][Ss]?://[^/:]+(?:\*[A-Za-z0-9-]*\.|\*)[A-Za-z]{2,3}(?:\.[A-Za-z]{2})?(?:$|:|/)}
describe DOS_URI_ASTERISK       Found an asterisk in a URI
##} DOS_URI_ASTERISK

##{ DOS_YOUR_PLACE

meta	DOS_YOUR_PLACE	(__DOS_COMING_TO_YOUR_PLACE && __DOS_MEET_EACH_OTHER && (__DOS_DROP_ME_A_LINE || __DOS_CORRESPOND_EMAIL || __DOS_EMAIL_DIRECTLY || __DOS_I_AM_25 || __DOS_WRITE_ME_AT || __DOS_PERSONAL_EMAIL))
describe	DOS_YOUR_PLACE		Russian dating spam
##} DOS_YOUR_PLACE

##{ DRUGS_HDIA

header DRUGS_HDIA	Subject =~ /\bhoodia\b/i
##} DRUGS_HDIA

##{ DRUGS_STOCK_MIMEOLE

meta DRUGS_STOCK_MIMEOLE (__MIMEOLE_1106 && __MAILER_OL_5510)
describe DRUGS_STOCK_MIMEOLE Stock-spam forged headers found (5510)
##} DRUGS_STOCK_MIMEOLE

##{ DYN_RDNS_AND_INLINE_IMAGE

meta DYN_RDNS_AND_INLINE_IMAGE     (RDNS_DYNAMIC && __ANY_IMAGE_ATTACH)
describe DYN_RDNS_AND_INLINE_IMAGE Contains image, and was sent by dynamic rDNS
##} DYN_RDNS_AND_INLINE_IMAGE

##{ DYN_RDNS_SHORT_HELO_HTML

meta DYN_RDNS_SHORT_HELO_HTML      (__HELO_NO_DOMAIN && RDNS_DYNAMIC && HTML_MESSAGE)
describe DYN_RDNS_SHORT_HELO_HTML  Sent by dynamic rDNS, short HELO, and HTML
##} DYN_RDNS_SHORT_HELO_HTML

##{ DYN_RDNS_SHORT_HELO_IMAGE

meta DYN_RDNS_SHORT_HELO_IMAGE       (__HELO_NO_DOMAIN && RDNS_DYNAMIC && __ANY_IMAGE_ATTACH)
describe DYN_RDNS_SHORT_HELO_IMAGE    Short HELO string, dynamic rDNS, inline image
##} DYN_RDNS_SHORT_HELO_IMAGE

##{ END_FUTURE_EMAILS

body           END_FUTURE_EMAILS   /\bend future (?:email|alert)s?\b/i
describe       END_FUTURE_EMAILS   Pump-and-dump unsubscribe
##} END_FUTURE_EMAILS

##{ FAKE_REPLY_C

meta     FAKE_REPLY_C		(__SUBJ_RE && __MISSING_REF && __NO_INR_YES_REF)
##} FAKE_REPLY_C

##{ FB_ADD_INCHES

body     FB_ADD_INCHES          /(?:add|gain) inches/i
describe FB_ADD_INCHES          Add / Gain inches
##} FB_ADD_INCHES

##{ FB_ALMOST_SEX

body     FB_ALMOST_SEX          /\b[b-z]sex+\b/i
describe FB_ALMOST_SEX          It's almost sex, but not!
##} FB_ALMOST_SEX

##{ FB_ANA_TRIM

body     FB_ANA_TRIM            /Ana[^a-z]trim/i
describe FB_ANA_TRIM            Broken AnaTrim phrase.
##} FB_ANA_TRIM

##{ FB_ANUI

body     FB_ANUI                /A[-_\.]U[-_\.]N[-_\.]I/i
describe FB_ANUI                Phrase: A_U_N_I
##} FB_ANUI

##{ FB_BILLI0N

body      FB_BILLI0N            /[BM][I1]LL[I1]0N/i
describe  FB_BILLI0N            Phrase: [BM]Illi0n
##} FB_BILLI0N

##{ FB_C0MPANY

body     FB_C0MPANY             /c0mpany/i
describe FB_C0MPANY             Phrase: C0mpany
##} FB_C0MPANY

##{ FB_CAN_LONGER

body     FB_CAN_LONGER          /can last longer/i
describe FB_CAN_LONGER          Phrase: can last longer
##} FB_CAN_LONGER

##{ FB_CIALIS_LEO3

body     FB_CIALIS_LEO3         /\bC(?!IALIS|eibal|laim|laritas)\s?[a-z]?\s?[Iitl1\\\/]\s?[a-z]?\s?[Aa]\s?[a-z]?\s?[LIl1\\\/]\s?[a-z]?\s?[ilIt1\\\/]\s?[a-z]?\s?[Ss]\b/
describe FB_CIALIS_LEO3         Uses a mis-spelled version of cialis.
##} FB_CIALIS_LEO3

##{ FB_DOUBLE_0WORDS

body     FB_DOUBLE_0WORDS       /\b[a-z]{1,5}0[a-z]{3,9}\s[a-z]{1,5}0[a-z]{3,9}\b/i
describe FB_DOUBLE_0WORDS       Looks like double 0 words
##} FB_DOUBLE_0WORDS

##{ FB_EMAIL_HIER

body     FB_EMAIL_HIER          /email hier/i
describe FB_EMAIL_HIER          Phrase: email hier
##} FB_EMAIL_HIER

##{ FB_EXTRA_INCHES

body     FB_EXTRA_INCHES        /extra inches/
describe FB_EXTRA_INCHES        Phrase: extra inches
##} FB_EXTRA_INCHES

##{ FB_FAKE_NUMBERS

body     FB_FAKE_NUMBERS        /\$\d\d?O\s*[MBT]/i
describe FB_FAKE_NUMBERS        Looks like numbers with O's insted of 0's
##} FB_FAKE_NUMBERS

##{ FB_FAKE_NUMS4

body     FB_FAKE_NUMS4          /(?:\b|\b\d)\d,?\d,?OO(?:\b|\d\b)/
describe FB_FAKE_NUMS4          Looks like fake numbers (4)
##} FB_FAKE_NUMS4

##{ FB_FHARMACY

body     FB_FHARMACY            /Fharmacy/i
describe FB_FHARMACY            Phrase: Farmacy
##} FB_FHARMACY

##{ FB_FORWARD_LOOK

body     FB_FORWARD_LOOK        /(?!forward look)f[o0]rward l[0o][0o]k/i
describe FB_FORWARD_LOOK        Phrase: forward look with 0's
##} FB_FORWARD_LOOK

##{ FB_GAPPY_ADDRESS

body     FB_GAPPY_ADDRESS       /(?:[a-z] ){8}, (?:[a-z0-9] ){4}/i
describe FB_GAPPY_ADDRESS       Too much spacing in Address
##} FB_GAPPY_ADDRESS

##{ FB_GET_MEDS

body     FB_GET_MEDS            /(?:place f[o0]r|[0o]rder|get\s?(?:y[o0]ur)?|online|quality).{1,7}med[isz][^a]/i
describe FB_GET_MEDS            Looks like trying to sell meds
##} FB_GET_MEDS

##{ FB_GREAT_BEST_SEX

body     FB_GREAT_BEST_SEX      /(?:greater|best|Improved) sex/i
describe FB_GREAT_BEST_SEX      Phrase: greater, best, improved sex
##} FB_GREAT_BEST_SEX

##{ FB_GVR

body     FB_GVR                 /(?:pef-rx|vigrex-ds|gsc-100|vp-rx|gv-promax|phentermine|adipex|xenical)/i
describe FB_GVR                 Looks like generic viagra
##} FB_GVR

##{ FB_HEY_BRO_COMMA

body     FB_HEY_BRO_COMMA       /Hey bro, /
describe FB_HEY_BRO_COMMA       Phrase hey bro,
##} FB_HEY_BRO_COMMA

##{ FB_HG_H_CAP

body     FB_HG_H_CAP            /\bHGH\b/
describe FB_HG_H_CAP            Phrase: HGH
##} FB_HG_H_CAP

##{ FB_HOMELOAN

body     FB_HOMELOAN            /\$\d{3},\d{3} home loan/i
describe FB_HOMELOAN            Phrase $x home loan
##} FB_HOMELOAN

##{ FB_IMPRESS_GIRL

body     FB_IMPRESS_GIRL        /\bimpress .{0,5}girl\b/
describe FB_IMPRESS_GIRL        Phrase: impress ... girl
##} FB_IMPRESS_GIRL

##{ FB_INCREASE_YOUR

body     FB_INCREASE_YOUR       /Increase your energy/i
describe FB_INCREASE_YOUR       Phrase: Increase your energy
##} FB_INCREASE_YOUR

##{ FB_INDEPEND_RWD

body     FB_INDEPEND_RWD        /independent reward/i
describe FB_INDEPEND_RWD        Phrase: independent reward
##} FB_INDEPEND_RWD

##{ FB_L0AN

body     FB_L0AN                /\bl0ans?\b/i
describe FB_L0AN                Phrase: L0an
##} FB_L0AN

##{ FB_LETTERS_21B

body     FB_LETTERS_21B         /-- [a-z]{21}/
describe FB_LETTERS_21B         Special people leave special signs!
##} FB_LETTERS_21B

##{ FB_LOSE_WEIGHT_CAP

body     FB_LOSE_WEIGHT_CAP     /LOSE WEIGHT/
describe FB_LOSE_WEIGHT_CAP     Phrase: LOSE WEIGHT
##} FB_LOSE_WEIGHT_CAP

##{ FB_LOWER_PAYM

body     FB_LOWER_PAYM          /lower your monthly payments/i
describe FB_LOWER_PAYM          Phrase: lower your monthly payments
##} FB_LOWER_PAYM

##{ FB_MORE_SIZE

body     FB_MORE_SIZE           /\bmore size\b/
describe FB_MORE_SIZE           Phrase: more size
##} FB_MORE_SIZE

##{ FB_NOT_PHONE_NUM1

body     FB_NOT_PHONE_NUM1      /(?!\d{3})8(?:66|77|88|[0o][0o])[-\.\s\)]{1,3}[OIL0-9]{3}[-\.\s]/i
describe FB_NOT_PHONE_NUM1      Looks like a fake phone number (1)
##} FB_NOT_PHONE_NUM1

##{ FB_NOT_PHONE_NUM3

body     FB_NOT_PHONE_NUM3      /8(?:66|77|88|[0o][0o])[-\.\s\)]{1,3}[OIL0-9]{3}[-\.\s]{1,3}(?!\d{4})[OIL0-9]{4}/i
describe FB_NOT_PHONE_NUM3      Looks like a fake phone number (3)
##} FB_NOT_PHONE_NUM3

##{ FB_NOT_SCHOOL

body     FB_NOT_SCHOOL          /(?!school)[\$s5]ch[o0][o0][il1\|]/i
describe FB_NOT_SCHOOL          Looks like school but it's not!
##} FB_NOT_SCHOOL

##{ FB_NUMYO

body     FB_NUMYO               /1[0-9][\s\.]?y[\s\.]?o[\s\.]?\b/i
describe FB_NUMYO               Speaks of teenager.
##} FB_NUMYO

##{ FB_NUMYO2

body     FB_NUMYO2              /2[0-9][\s\.]?y[\s\.]?o[\s\.]?\b/i
describe FB_NUMYO2              Speaks of 20+ year old.
##} FB_NUMYO2

##{ FB_ODD_SPACED_MONEY

body     FB_ODD_SPACED_MONEY    /\$\d\s,\s\d\d/
describe FB_ODD_SPACED_MONEY    Looks like money but has odd spacing.
##} FB_ODD_SPACED_MONEY

##{ FB_ONIINE

body     FB_ONIINE              /oniine/i
describe FB_ONIINE              Mis-spelled online
##} FB_ONIINE

##{ FB_P1LL

body     FB_P1LL                /\bp1ll/i
describe FB_P1LL                Phrase: p1ll
##} FB_P1LL

##{ FB_PENIS_GROWTH

body     FB_PENIS_GROWTH        /pen[i1]s grow(?:th)?/i
describe FB_PENIS_GROWTH        Phrase: penis growth
##} FB_PENIS_GROWTH

##{ FB_PIPEDOLLAR

body     FB_PIPEDOLLAR          /(?!dollar)d[o0][1|li][1|li]ar/i
describe FB_PIPEDOLLAR          Phrase: Dollar, with pipes or 0's.
##} FB_PIPEDOLLAR

##{ FB_PIPE_ILLION

body     FB_PIPE_ILLION         /(?!illion)i[l|][l|][i|][o0]n/i
describe FB_PIPE_ILLION         Looks like illion, but it's not
##} FB_PIPE_ILLION

##{ FB_PROLONGED_HARD

body     FB_PROLONGED_HARD      /(?:prolonged|increased) hardness/i
describe FB_PROLONGED_HARD      Talks about prolonged hardness
##} FB_PROLONGED_HARD

##{ FB_QUALITY_REPLICA

body     FB_QUALITY_REPLICA     /quality replica/i
describe FB_QUALITY_REPLICA     Phrase: quality replica
##} FB_QUALITY_REPLICA

##{ FB_REF_CODE_SPACE

body     FB_REF_CODE_SPACE      /r e f c o d e/i
describe FB_REF_CODE_SPACE      Refcode with spacing
##} FB_REF_CODE_SPACE

##{ FB_REPLICA_ROLEX

body     FB_REPLICA_ROLEX       /replica rolex/i
describe FB_REPLICA_ROLEX       Phrase: Replica Rolex
##} FB_REPLICA_ROLEX

##{ FB_REPLIC_CAP

body     FB_REPLIC_CAP          /REPLICAS?\b/
describe FB_REPLIC_CAP          Phrase: REPLICA
##} FB_REPLIC_CAP

##{ FB_RE_FI

body     FB_RE_FI               /\bre[^a-z]fi\b/
describe FB_RE_FI               Looks like refi.
##} FB_RE_FI

##{ FB_ROLLER_IS_T

body     FB_ROLLER_IS_T         /Roller is th/i
describe FB_ROLLER_IS_T         Phrase: Roller is th
##} FB_ROLLER_IS_T

##{ FB_ROLX

body     FB_ROLX                /\brolx\b/i
describe FB_ROLX                Phrase: rolx
##} FB_ROLX

##{ FB_SAVE_PERSC

body     FB_SAVE_PERSC          /sav(?:e|ing).{1,45}p[re][re]scr[i1]pt[i1][o0]n/i
describe FB_SAVE_PERSC          Phrase: save ... prescription.
##} FB_SAVE_PERSC

##{ FB_SOFTTABS

body     FB_SOFTTABS            /\bsoft\s?t?abs\b/i
describe FB_SOFTTABS            Phrase: Softabs
##} FB_SOFTTABS

##{ FB_SPACED_FREE

body     FB_SPACED_FREE         /F R E E/i
describe FB_SPACED_FREE         Phrase: F R E E
##} FB_SPACED_FREE

##{ FB_SPACED_PHN_3B

body     FB_SPACED_PHN_3B       /\d\d\d--\d\d\d--?\d\d\d\d/
describe FB_SPACED_PHN_3B       Phone number with -- spacing. (B)
##} FB_SPACED_PHN_3B

##{ FB_SPACEY_ZIP

body     FB_SPACEY_ZIP          /\s\d\s\d\s\d\s\d\s\d\s-\s\d\s\d\s\d\s\d/
describe FB_SPACEY_ZIP          Looks like a  s p a c e d zipcode.
##} FB_SPACEY_ZIP

##{ FB_SPUR_M

body     FB_SPUR_M              /\bSPUR-M\b/i
describe FB_SPUR_M              Phrase: SPUR-M
##} FB_SPUR_M

##{ FB_SSEX

body     FB_SSEX                /\bssex\b/
describe FB_SSEX                Phrase: ssex
##} FB_SSEX

##{ FB_STOCK_EXPLODE

body     FB_STOCK_EXPLODE        /st[0o]ck\b.{4,10}expl[o0]de/i
describe FB_STOCK_EXPLODE       Looks like stocks exploding.
##} FB_STOCK_EXPLODE

##{ FB_SYMBLO

body     FB_SYMBLO              /\bSymblo\b/i
describe FB_SYMBLO              Mis-spelled symbol.
##} FB_SYMBLO

##{ FB_THIS_ADVERT

body     FB_THIS_ADVERT         /this advertiser/i
describe FB_THIS_ADVERT         Phrase: this advertiser
##} FB_THIS_ADVERT

##{ FB_THOUS_PERSONAL

body     FB_THOUS_PERSONAL      /thousand personal/i
describe FB_THOUS_PERSONAL      Phrase: thousand personal
##} FB_THOUS_PERSONAL

##{ FB_TO_STOP_DISTRO

body     FB_TO_STOP_DISTRO      /To (?:(?:stop further|longer get) distribution|stop (?:receiving )?announcements)/i
describe FB_TO_STOP_DISTRO      Phrase: to stop further distribution
##} FB_TO_STOP_DISTRO

##{ FB_ULTRA_ALLURE

body     FB_ULTRA_ALLURE        /Ultra Allure/i
describe FB_ULTRA_ALLURE        Phrase: Ultra Allure
##} FB_ULTRA_ALLURE

##{ FB_UNLOCK_YOUR_G

body     FB_UNLOCK_YOUR_G       /lock ?(?:to ?)? your girlfriend/i
describe FB_UNLOCK_YOUR_G       Phrase: lock to your girlfriend
##} FB_UNLOCK_YOUR_G

##{ FB_UNRESOLV_PROV

body     FB_UNRESOLV_PROV       /\{PROV_\d_\d\}/
describe FB_UNRESOLV_PROV       Pattern Replacement PROV_D
##} FB_UNRESOLV_PROV

##{ FB_YOURSELF_MASTER

body     FB_YOURSELF_MASTER     /yourself master/i
describe FB_YOURSELF_MASTER     Phrase: yourself master
##} FB_YOURSELF_MASTER

##{ FB_YOUR_REFI

body     FB_YOUR_REFI           /Your refi/i
describe FB_YOUR_REFI           Phrase: Your refi
##} FB_YOUR_REFI

##{ FH_BAD_OEV1441

header   FH_BAD_OEV1441         X-Mailer =~ /^Microsoft Outlook Express 6\.00\.2800\.1441$/
describe FH_BAD_OEV1441         Bad X-Mailer version
##} FH_BAD_OEV1441

##{ FH_DATE_IS_19XX

header   FH_DATE_IS_19XX        Date =~ /19[789][0-9]/ [if-unset: 2006]
describe FH_DATE_IS_19XX        The date is not 19xx.
##} FH_DATE_IS_19XX

##{ FH_FAKE_RCVD_LINE

header   FH_FAKE_RCVD_LINE      Received =~ /from\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s*by\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3};\s*[SMTWF].{2},\s*\d{1,2}\s*[JFMASOND].{2,5}\s*\d{4}\s*\d{2}:\d{2}:\d{2}\s*[-+]\d{4}/
describe FH_FAKE_RCVD_LINE      RCVD line looks faked (A)
##} FH_FAKE_RCVD_LINE

##{ FH_FAKE_RCVD_LINE_B

header   FH_FAKE_RCVD_LINE_B    Received =~ /from\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s*by\s*[a-z0-9.]{4,24}\.[a-z0-9.]{4,36}\.(?:com|net|org|biz);\s*[SMTWF].{2},\s*\d{1,2}\s*[JFMASOND].{2,5}\s*\d{4}\s*\d{2}:\d{2}:\d{2}\s*[-+]\d{4}/i
describe FH_FAKE_RCVD_LINE_B    RCVD line looks faked (B)
##} FH_FAKE_RCVD_LINE_B

##{ FH_FROMEML_NOTLD

header   FH_FROMEML_NOTLD       From:addr !~ /\./ [if-unset: foo@bar.com]
describe FH_FROMEML_NOTLD       E-mail address doesn't have TLD (.com, etc.)
##} FH_FROMEML_NOTLD

##{ FH_FROM_CASH

header   FH_FROM_CASH           From:name =~ /\bcash\b/i
describe FH_FROM_CASH           From name has "cash"
##} FH_FROM_CASH

##{ FH_FROM_GET_NAME

header   FH_FROM_GET_NAME       From:name =~ /\bGet\b/i
describe FH_FROM_GET_NAME       From name says Get
##} FH_FROM_GET_NAME

##{ FH_FROM_GIVEAWAY

header   FH_FROM_GIVEAWAY       From =~ /Giveaway/i
describe FH_FROM_GIVEAWAY       From name is giveaway.
##} FH_FROM_GIVEAWAY

##{ FH_FROM_HOODIA

header   FH_FROM_HOODIA         From =~ /Hoodia/i
describe FH_FROM_HOODIA         From has Hoodia!!?
##} FH_FROM_HOODIA

##{ FH_HAS_XAIMC

header   FH_HAS_XAIMC           exists:X-AIMC-AUTH
describe FH_HAS_XAIMC           Has X-AIMC-AUTH header
##} FH_HAS_XAIMC

##{ FH_HAS_XID

header   FH_HAS_XID             exists:X-ID
describe FH_HAS_XID             Has X-ID
##} FH_HAS_XID

##{ FH_HELO_ALMOST_IP

header   FH_HELO_ALMOST_IP      X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+[a-z][-.]\d{1,3}[-.]\d{1,3}[-.]\d{1,3}[-.][a-z][^ ]+ /i
describe FH_HELO_ALMOST_IP      Helo is almost an IP addr.
##} FH_HELO_ALMOST_IP

##{ FH_HELO_ENDS_DOT

header   FH_HELO_ENDS_DOT       X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+\. by=/
describe FH_HELO_ENDS_DOT       Helo ends with a dot.
##} FH_HELO_ENDS_DOT

##{ FH_HELO_EQ_610HEX

header   FH_HELO_EQ_610HEX      X-Spam-Relays-External =~ /^[^\]]+ helo=-?[A-F0-9]{6,10} /
describe FH_HELO_EQ_610HEX      Helo is 6-10 hex chr's.
##} FH_HELO_EQ_610HEX

##{ FH_HELO_EQ_CHARTER

header   FH_HELO_EQ_CHARTER     X-Spam-Relays-External =~ /^[^\]]+ helo=\d{2,3}-\d{1,3}-\d{1,3}-\d{1,3}.{5,20}\.charter\.com /i
describe FH_HELO_EQ_CHARTER     Helo is d-d-d-d charter.com
##} FH_HELO_EQ_CHARTER

##{ FH_HELO_EQ_D_D_D_D

header   FH_HELO_EQ_D_D_D_D     X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]{0,15}\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3}/
describe FH_HELO_EQ_D_D_D_D     Helo is d-d-d-d
##} FH_HELO_EQ_D_D_D_D

##{ FH_HELO_GMAILSMTP

header   FH_HELO_GMAILSMTP      Received =~ /HELO gmail-smtp-in/
describe FH_HELO_GMAILSMTP      Faked helo of gmail-smtp-in
##} FH_HELO_GMAILSMTP

##{ FH_HOST_EQ_DYNAMICIP

header   FH_HOST_EQ_DYNAMICIP   X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]{0,25}[dD][yY][nN][aA][mM][iI][cC][iI][pP][^ ]{5,25} helo=/
describe FH_HOST_EQ_DYNAMICIP   Host is dynamicip
##} FH_HOST_EQ_DYNAMICIP

##{ FH_HOST_EQ_PACBELL_D

header   FH_HOST_EQ_PACBELL_D   X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.dsl\.\w{2,10}\.pacbell\.net /
describe FH_HOST_EQ_PACBELL_D   Host is pacbell.net dsl
##} FH_HOST_EQ_PACBELL_D

##{ FH_HOST_EQ_VERIZON_P

header   FH_HOST_EQ_VERIZON_P   X-Spam-Relays-External =~ /^[^\]]+ rdns=pool-\d.{5,30}\.verizon\.net/
describe FH_HOST_EQ_VERIZON_P   Host is pool-.+verizon.net
##} FH_HOST_EQ_VERIZON_P

##{ FH_HOST_IN_ADDRARPA

header   FH_HOST_IN_ADDRARPA    X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]{0,25}\.in-addr\.arpa /
describe FH_HOST_IN_ADDRARPA    HOST dns says "in-addr.arpa"
##} FH_HOST_IN_ADDRARPA

##{ FH_MSGID_000000

header   FH_MSGID_000000        MESSAGEID =~ /\$00000000\@/
describe FH_MSGID_000000        Special MSGID
##} FH_MSGID_000000

##{ FH_MSGID_01C67

header   FH_MSGID_01C67         Message-ID =~ /^<000001c[67]/
describe FH_MSGID_01C67         Special MSGID
##} FH_MSGID_01C67

##{ FH_MSGID_01C70XXX

header   FH_MSGID_01C70XXX      MESSAGEID =~ /^<01c70[a-f][a-f0-9]{2}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[a-zA-Z0-9-]+>$/
describe FH_MSGID_01C70XXX      MESSAGE ID seen often!!!
##} FH_MSGID_01C70XXX

##{ FH_MSGID_REPLACE

header   FH_MSGID_REPLACE       MESSAGEID =~ /^<%MSGID/
describe FH_MSGID_REPLACE       Broken Replace Template
##} FH_MSGID_REPLACE

##{ FH_MSGID_XXBLAH

header   FH_MSGID_XXBLAH        MESSAGEID =~ /6c822ecf/
describe FH_MSGID_XXBLAH        Common sign in msg-id's 12/21/2006
##} FH_MSGID_XXBLAH

##{ FH_MSGID_XXX

header   FH_MSGID_XXX           MESSAGEID =~ /\@xxx/i
describe FH_MSGID_XXX           Message-Id = @xxx
##} FH_MSGID_XXX

##{ FH_RE_NEW_DDD

header   FH_RE_NEW_DDD          Subject =~ /^Re: new\s?\d{0,3}$/i
describe FH_RE_NEW_DDD          Subject is Re: new \d\d\d
##} FH_RE_NEW_DDD

##{ FH_XMAIL_REPLACE

header   FH_XMAIL_REPLACE       X-Mailer =~ /%XMAILER/
describe FH_XMAIL_REPLACE       Broken Replace Template
##} FH_XMAIL_REPLACE

##{ FILL_THIS_FORM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  meta     FILL_THIS_FORM                 __FILL_THIS_FORM && !__THREADED && !__FB_TOUR && !__VIA_ML
  describe FILL_THIS_FORM                 Fill in a form with personal information
  tflags   FILL_THIS_FORM                 publish
endif
##} FILL_THIS_FORM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FILL_THIS_FORM_FRAUD_PHISH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  meta     FILL_THIS_FORM_FRAUD_PHISH     __FILL_THIS_FORM_FRAUD_PHISH && !__UNSUB_LINK && !__SPOOFED_URL && !__DOS_LINK && !__CAN_HELP && !__VIA_ML
  describe FILL_THIS_FORM_FRAUD_PHISH     Answer suspicious question(s)
#  score    FILL_THIS_FORM_FRAUD_PHISH     1.50
endif
##} FILL_THIS_FORM_FRAUD_PHISH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FILL_THIS_FORM_LOAN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  meta     FILL_THIS_FORM_LOAN            __FILL_THIS_FORM_LOAN && !__COMMENT_EXISTS && !__HTML_LINK_IMAGE
  describe FILL_THIS_FORM_LOAN            Answer loan question(s)
#  score    FILL_THIS_FORM_LOAN            0.50
endif
##} FILL_THIS_FORM_LOAN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FILL_THIS_FORM_LONG ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  meta     FILL_THIS_FORM_LONG            __FILL_THIS_FORM_LONG && !__VIA_ML && !__DOS_HAS_LIST_UNSUB && !__THREADED
  describe FILL_THIS_FORM_LONG            Fill in a form with personal information
#  score    FILL_THIS_FORM_LONG            1.00
endif
##} FILL_THIS_FORM_LONG ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FM_DOESNT_SAY_STOCK

meta     FM_DOESNT_SAY_STOCK    (__FB_S_SYMBOL && __FM_MY_PRICE && !__FB_S_STOCK && !__FS_S_TRADE)
describe FM_DOESNT_SAY_STOCK    It's a stock spam but doesn't say stock
##} FM_DOESNT_SAY_STOCK

##{ FM_FAKE_53COM_SPOOF

meta     FM_FAKE_53COM_SPOOF    (__FH_FRM_53 && !__FH_MSG_53 && !__FH_RCV_53)
describe FM_FAKE_53COM_SPOOF    Spoof mail from 53.com?
##} FM_FAKE_53COM_SPOOF

##{ FM_FAKE_HELO_HOTMAIL

meta     FM_FAKE_HELO_HOTMAIL   (__HOTMAILCOM && !__HOST_HOTMAIL)
describe FM_FAKE_HELO_HOTMAIL   Looks like a fake hotmail.com helo.
##} FM_FAKE_HELO_HOTMAIL

##{ FM_FAKE_HELO_VERIZON

meta     FM_FAKE_HELO_VERIZON   (__FHELO_VERIZON && !__FHOST_VERIZON)
describe FM_FAKE_HELO_VERIZON   Looks like a fake verizon.net helo.
##} FM_FAKE_HELO_VERIZON

##{ FM_FRM_RN_L_BRACK

meta     FM_FRM_RN_L_BRACK      (__FROM_RIGH_BRACK && !__FROM_LEFT_BRACK && !__FROM_ISO_2022_JP)
describe FM_FRM_RN_L_BRACK      From name has > but not <
##} FM_FRM_RN_L_BRACK

##{ FM_IS_IT_OUR_ACCOUNT

meta     FM_IS_IT_OUR_ACCOUNT   (__YOUR_ACCOUNT && __MANY_RECIPS)
describe FM_IS_IT_OUR_ACCOUNT   Is it our account?
##} FM_IS_IT_OUR_ACCOUNT

##{ FM_LIKE_STOCKS

meta     FM_LIKE_STOCKS         (__FM_STOCK_WORDS && !__FB_S_STOCK && __FB_S_SYMBOL)
describe FM_LIKE_STOCKS         It looks like a duck, it's a duck!
##} FM_LIKE_STOCKS

##{ FM_LOTTO_YOU_WON

meta     FM_LOTTO_YOU_WON       (__FM_LARGE_MONEY && __FM_NAT_LOTTERY && __YOU_WON_SOMTIN)
describe FM_LOTTO_YOU_WON       Talks about lotto and you won!
##} FM_LOTTO_YOU_WON

##{ FM_LUX_GIFTS_REDUCED

meta     FM_LUX_GIFTS_REDUCED   (__FB_LUX_GIFTS && __FB_NUM_PERCNT)
describe FM_LUX_GIFTS_REDUCED   Luxury Gifts with dd%
##} FM_LUX_GIFTS_REDUCED

##{ FM_MANY_DRUG_WORDS

meta     FM_MANY_DRUG_WORDS     (__VA_WORD && __CS_WORD && __VM_WORD)
describe FM_MANY_DRUG_WORDS     Lot's of almost drug words
##} FM_MANY_DRUG_WORDS

##{ FM_MORTGAGE5PLUS

meta     FM_MORTGAGE5PLUS       (__FM_MORTGAGE5PLUS && !__FM_MORTGAGE6PLUS)
describe FM_MORTGAGE5PLUS       Looks like a mortgage spam (5+)
##} FM_MORTGAGE5PLUS

##{ FM_MORTGAGE6PLUS

meta     FM_MORTGAGE6PLUS       (__FM_MORTGAGE6PLUS)
describe FM_MORTGAGE6PLUS       Looks like a mortgage spam (6+)
##} FM_MORTGAGE6PLUS

##{ FM_MULTI_LUX_GIFTS

meta     FM_MULTI_LUX_GIFTS     ((__FB_BRAND_NAME + __FB_TIMEPIECE + __FB_WALLETS + __FB_HANDBAGS + __FB_DESIGNER + __FB_LUX_GIFTS + __FB_NUM_PERCNT + __FB_INK_PEN) > 3)
describe FM_MULTI_LUX_GIFTS     Talks about variety of luxury gifts
##} FM_MULTI_LUX_GIFTS

##{ FM_PHN_NODNS

meta     FM_PHN_NODNS           (FB_SPACED_PHN_3B && RDNS_NONE)
describe FM_PHN_NODNS           Phone spacing + no dns
##} FM_PHN_NODNS

##{ FM_RATSIGN_1106

meta     FM_RATSIGN_1106        (__MSGID_VGA && __DATE_700)
describe FM_RATSIGN_1106        Fingerprint seen in lots of spam. 11/2006
##} FM_RATSIGN_1106

##{ FM_RE_HELLO_SPAM

meta     FM_RE_HELLO_SPAM       (__FH_MSGID_01C7 && __FH_HAS_XMSMAIL && __FH_HAS_XPRIORITY && __FS_SUBJ_RE)
describe FM_RE_HELLO_SPAM       Re: Hello / hi
##} FM_RE_HELLO_SPAM

##{ FM_ROLEX_ADS

meta     FM_ROLEX_ADS           (__FB_ROLEX_MEN && __FB_ROLEX_WMEN && __FB_OMEGA && __FB_GLASHUTE)
describe FM_ROLEX_ADS           Looks like Rolex spams.
##} FM_ROLEX_ADS

##{ FM_SCHOOLING

meta     FM_SCHOOLING           ((__BACHELORS + __MASTERS + __MBA + __PHD) > 2)
describe FM_SCHOOLING           Meta Combo Phrase for Schooling (2)
##} FM_SCHOOLING

##{ FM_SCHOOL_DIPLOMA

meta     FM_SCHOOL_DIPLOMA      (FM_SCHOOLING && __DIPLOMA)
describe FM_SCHOOL_DIPLOMA      Meta for Schooling + Diploma.
##} FM_SCHOOL_DIPLOMA

##{ FM_SCHOOL_TYPES

meta     FM_SCHOOL_TYPES        (__FB_BA && __FB_BCs && __FB_MA && __FB_MBA)
describe FM_SCHOOL_TYPES        Meta Combo Phrase for Schooling
##} FM_SCHOOL_TYPES

##{ FM_SEX_HELODDDD

meta     FM_SEX_HELODDDD        (__SEX_WRDS && FH_HELO_EQ_D_D_D_D)
describe FM_SEX_HELODDDD        Sex words + helo = dddd
##} FM_SEX_HELODDDD

##{ FM_SUBJ_APPROVE

meta     FM_SUBJ_APPROVE        (__EXCLAIM_SUBJ && __SUBJ_APPROVE)
describe FM_SUBJ_APPROVE        Subject has Approve and !
##} FM_SUBJ_APPROVE

##{ FM_TRUE_LOV_ALL_N

meta     FM_TRUE_LOV_ALL_N      (__FB_P_TRUELOVE && __FB_P_ALLNIGHT)
describe FM_TRUE_LOV_ALL_N      True Love all Night!
##} FM_TRUE_LOV_ALL_N

##{ FM_VEGAS_CASINO

meta     FM_VEGAS_CASINO        ((__FROM_VEGAS + __SUBJ_3DIGIT + __SUBJ_VEGAS + __FB_GAME) > 2)
describe FM_VEGAS_CASINO        Looks like vega casino spam
##} FM_VEGAS_CASINO

##{ FM_XMAIL_F_OUT

header   FM_XMAIL_F_OUT         X-Mailer =~ /Microsoft Outlook Express V6.00.2900.2180/
describe FM_XMAIL_F_OUT         Looks like Fake Outlook?
##} FM_XMAIL_F_OUT

##{ FORGED_RELAY_MUA_TO_MX

header FORGED_RELAY_MUA_TO_MX         X-Spam-Relays-External =~ /^\[ ip=(?!127)([\d.]+) [^\[]*\[ ip=\1 [^\[]+ helo=(!(?!(?:10|127|169\.254|172\.(?:1[6-9]|2[0-9]|3[01])|192\.168)\.)| )[^\[]+$/
##} FORGED_RELAY_MUA_TO_MX

##{ FORM_FRAUD_3

meta     FORM_FRAUD_3    __FORM_FRAUD_3 && !__DOS_HAS_LIST_UNSUB && !__THREADED && !__HAS_THREAD_INDEX && !__VIA_ML && !__HTML_LINK_IMAGE && !__MIME_QP
describe FORM_FRAUD_3    Fill a form and several fraud phrases
tflags   FORM_FRAUD_3    publish
##} FORM_FRAUD_3

##{ FORM_FRAUD_5

meta     FORM_FRAUD_5    __FORM_FRAUD_5 && !__DOS_HAS_LIST_UNSUB && !__THREADED && !__HAS_THREAD_INDEX && !__VIA_ML
describe FORM_FRAUD_5    Fill a form and many fraud phrases
tflags   FORM_FRAUD_5    publish
##} FORM_FRAUD_5

##{ FROM_12LTRDOM

meta           FROM_12LTRDOM       __FROM_12LTRDOM_1 && !__VIA_ML && !__TO___LOWER && !__FS_SUBJ_RE && !__RCD_RDNS_MAIL_MESSY && !__freemail_safe && !__RCVD_IN_DNSWL && !__UNSUB_LINK && !NO_RELAYS && !__UNUSABLE_MSGID && !DATE_IN_PAST_96_XX && !ALL_TRUSTED && !__MSGID_APPLEMAIL && !__RCD_RDNS_SMTP_MESSY && !__FB_NATIONAL && !__MAIL_LINK && !__NAME_EMAIL_DIFF && !__RCD_RDNS_MX_MESSY && !__RCD_RDNS_MX && !__SENDER_BOT && !__IMS_MSGID && !__HS_SUBJ_RE_FW
describe       FROM_12LTRDOM       From a 12-letter domain
##} FROM_12LTRDOM

##{ FROM_IN_TO_AND_SUBJ

meta           FROM_IN_TO_AND_SUBJ  (__TO_EQ_FROM && __SUBJ_HAS_FROM_1)
describe       FROM_IN_TO_AND_SUBJ  From address is in To and Subject
tflags         FROM_IN_TO_AND_SUBJ  publish
##} FROM_IN_TO_AND_SUBJ

##{ FROM_MISSPACED

meta           FROM_MISSPACED        __FROM_MISSPACED && !__RCD_RDNS_MTA_MESSY && !__CTYPE_MULTIPART_ALT && !__REPTO_QUOTE && !__MIME_QP && !__UNSUB_LINK && !__TO___LOWER && !__BUGGED_IMG && !__DOS_HAS_LIST_UNSUB && !__TO_EQ_FROM_DOM && !__MAIL_LINK
describe       FROM_MISSPACED        From: missing whitespace
##} FROM_MISSPACED

##{ FROM_MISSP_DKIM

meta           FROM_MISSP_DKIM       (__FROM_RUNON && __DKIM_DEPENDABLE)
describe       FROM_MISSP_DKIM       From misspaced, DKIM dependable
tflags         FROM_MISSP_DKIM       net
##} FROM_MISSP_DKIM

##{ FROM_MISSP_DYNIP

meta           FROM_MISSP_DYNIP      __FROM_RUNON && RDNS_DYNAMIC
describe       FROM_MISSP_DYNIP      From misspaced + dynamic rDNS
#score          FROM_MISSP_DYNIP      2.0
##} FROM_MISSP_DYNIP

##{ FROM_MISSP_EH_MATCH

meta           FROM_MISSP_EH_MATCH   __FROM_MISSP_EH_MATCH && !__RCD_RDNS_MTA_MESSY && !__UNSUB_LINK && !__COMMENT_EXISTS && !__TO___LOWER && !__MIME_QP && !__TO_EQ_FROM_DOM && !__BUGGED_IMG && !__DKIM_EXISTS
describe       FROM_MISSP_EH_MATCH   From misspaced, matches envelope
##} FROM_MISSP_EH_MATCH

##{ FROM_MISSP_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
  meta         FROM_MISSP_FREEMAIL   __FROM_RUNON && (FREEMAIL_FROM || FREEMAIL_REPLYTO)
  describe     FROM_MISSP_FREEMAIL   From misspaced + freemail provider
#  score        FROM_MISSP_FREEMAIL   2.0
endif
##} FROM_MISSP_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ FROM_MISSP_MSFT

meta           FROM_MISSP_MSFT       __FROM_RUNON && (__ANY_OUTLOOK_MUA || __HAS_MIMEOLE || __MIMEOLE_MS)
describe       FROM_MISSP_MSFT       From misspaced + supposed Microsoft tool
#score          FROM_MISSP_MSFT       3.5
##} FROM_MISSP_MSFT

##{ FROM_MISSP_NO_TO

meta           FROM_MISSP_NO_TO      (__FROM_RUNON && MISSING_HEADERS)
describe       FROM_MISSP_NO_TO      From misspaced, To missing
##} FROM_MISSP_NO_TO

##{ FROM_MISSP_REPLYTO

meta           FROM_MISSP_REPLYTO    __FROM_MISSP_REPLYTO && !__NOT_SPOOFED && !__RCD_RDNS_MTA_MESSY && !__TO___LOWER && !__COMMENT_EXISTS && !__UNSUB_LINK && !__MIME_QP && !__CTYPE_MULTIPART_ALT && !__JM_REACTOR_DATE && !__PLING_QUERY
describe       FROM_MISSP_REPLYTO    From misspaced, has Reply-To
##} FROM_MISSP_REPLYTO

##{ FROM_MISSP_SPF_FAIL

meta           FROM_MISSP_SPF_FAIL  (__FROM_RUNON && SPF_FAIL)
tflags         FROM_MISSP_SPF_FAIL  net
##} FROM_MISSP_SPF_FAIL

##{ FROM_MISSP_TO_UNDISC

meta           FROM_MISSP_TO_UNDISC  (__FROM_RUNON && __TO_UNDISCLOSED)
describe       FROM_MISSP_TO_UNDISC  From misspaced, To undisclosed
##} FROM_MISSP_TO_UNDISC

##{ FROM_MISSP_URI

meta           FROM_MISSP_URI        __FROM_MISSP_URI && !__NOT_SPOOFED && !__RCD_RDNS_MTA_MESSY && !MISSING_MIMEOLE && !__COMMENT_EXISTS && !__REPTO_QUOTE && !__UNSUB_LINK && !__TO___LOWER && !__MSGID_OK_HEX && !__MAIL_LINK && !__MIME_QP && !__BUGGED_IMG && !MIME_BASE64_TEXT
describe       FROM_MISSP_URI        From misspaced, has URI
##} FROM_MISSP_URI

##{ FROM_MISSP_USER

meta           FROM_MISSP_USER       (__FROM_RUNON && NSL_RCVD_FROM_USER)
describe       FROM_MISSP_USER       From misspaced, from "User"
##} FROM_MISSP_USER

##{ FROM_ONE_CHAR

header      FROM_ONE_CHAR          From =~ /^\s*"[^"]"\s*</
describe    FROM_ONE_CHAR          Bogus FROM name
##} FROM_ONE_CHAR

##{ FRT_ADOBE2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_ADOBE2             /<inter W0><post P2>\b(?!adobe)<A><D><O><B><E>\b/i
describe FRT_ADOBE2             ReplaceTags: Adobe
endif
##} FRT_ADOBE2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_APPROV ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_APPROV             /<inter sP2><post P2>\b(?!approu?v)<A><P><P><R><O><V>/i
describe FRT_APPROV             ReplaceTags: Approve
endif
##} FRT_APPROV ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_BIGGERMEM1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_BIGGERMEM1         /<inter SP2><post P2>(?:<B><IX><GX><GX><E><R>|<L><A><R><GX><E><R>).{1,8}(?:<P><E><N><IX><SX>|<B><R><E><A><SX><TX>|<M><E><M><B><E><R>)/i
describe FRT_BIGGERMEM1         ReplaceTags: Bigger / Larger, Penis / Member
endif
##} FRT_BIGGERMEM1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_DIPLOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_DIPLOMA            /<inter SP2><post P2>\b(?!d[iy]pl[o\xe2\xc2]m)<D><IX><P><L><O><M><A>/i
describe FRT_DIPLOMA            ReplaceTags: Diploma
endif
##} FRT_DIPLOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_DISCOUNT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_DISCOUNT           /<inter SP2><post P2>\b(?!discount)<D><IX><SX><C><O><U><N><TX>/i
describe FRT_DISCOUNT           ReplaceTags: Discount
endif
##} FRT_DISCOUNT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_DOLLAR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_DOLLAR             /<inter SP2><post P2>\b(?!dollar)<D><O><L><L><A><R>/i
describe FRT_DOLLAR             ReplaceTags: Dollar
endif
##} FRT_DOLLAR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_ESTABLISH2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_ESTABLISH2         /<inter W0><post P2>\b(?!estabi?lish)<E><SX><TX><A><B><L><IX><SX><H>/i
describe FRT_ESTABLISH2         ReplaceTags: Establish (2)
endif
##} FRT_ESTABLISH2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_FUCK2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_FUCK2              /<inter W0><post P2>\b(?!fuck)<F><U><C><K>/i
describe FRT_FUCK2              ReplaceTags: Fuck (2)
endif
##} FRT_FUCK2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_GUARANTEE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_GUARANTEE1         /<inter SP2><post P2>(?!guarantee)<GX><U><A><R><A><N><TX><E><E>/i
describe FRT_GUARANTEE1         ReplaceTags: Guarantee (1)
endif
##} FRT_GUARANTEE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_INVESTOR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_INVESTOR           /<inter SP2><post P2>\b(?!investor)<IX><N><V><E><SX><TX><O><R>/i
describe FRT_INVESTOR           ReplaceTags: Investor
endif
##} FRT_INVESTOR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_LEVITRA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_LEVITRA            /<inter W0><post P2>(?!levitra)<L><E><V><IX><TX><R><A>/i
describe FRT_LEVITRA            ReplaceTags: Levitra
endif
##} FRT_LEVITRA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_MEETING ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_MEETING            /<inter SP2><post P2>\b(?!meeting)<M><E><E><TX><IX><N><GX>\b/i
describe FRT_MEETING            ReplaceTags: Meeting
endif
##} FRT_MEETING ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_OFFER2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_OFFER2             /<inter W0><post P2>\b(?!offer)<O><F><F><E><R>/i
describe FRT_OFFER2             ReplaceTags: Offer (2)
endif
##} FRT_OFFER2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_OPPORTUN2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_OPPORTUN2          /<inter W0><post P2>(?!opportun)<O><P><P><O><R><TX><U><N>/i
describe FRT_OPPORTUN2          ReplaceTags: Oppertun (2)
endif
##} FRT_OPPORTUN2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_PENIS1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_PENIS1             /<inter SP2><post P2>\b(?!pen\s?(?:ie?s|ny[ ']?s))<P><E><N><IX><SX>\b/i
describe FRT_PENIS1             ReplaceTags: Penis
endif
##} FRT_PENIS1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_PRICE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_PRICE              /<inter SP2><post P2>\b(?!price)<P><R><IX><C><E>\b/i
describe FRT_PRICE              ReplaceTags: Price
endif
##} FRT_PRICE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_REFINANCE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_REFINANCE1         /<inter SP2><post P2>\b(?!refinanc)<R><E><F><IX><N><A><N><C>/i
describe FRT_REFINANCE1         ReplaceTags: Refinance (1)
endif
##} FRT_REFINANCE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_ROLEX ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_ROLEX              /<inter SP2><post P2>\b(?!rolex)<R><O><L><E><X>/i
describe FRT_ROLEX              ReplaceTags: Rolex
endif
##} FRT_ROLEX ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_SEXUAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_SEXUAL             /<inter SP2><post P2>\b(?!sexual)<SX><E><X><U><A><L>/i
describe FRT_SEXUAL             ReplaceTags: Sexual
endif
##} FRT_SEXUAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_SOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_SOMA               /<post P2>\b(?!soma|500mg)<SX><O><M><A>\b/i
describe FRT_SOMA               ReplaceTags: Soma
endif
##} FRT_SOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_SOMA2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_SOMA2              /<inter SP2><post P2>\b(?!soma|500? ?mg)<SX><O><M><A>\b/i
describe FRT_SOMA2              ReplaceTags: Soma (2)
endif
##} FRT_SOMA2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_STRONG1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_STRONG1            /<inter SP2><post P2>\b(?!stro\s?ng)<SX><TX><R><O><N><GX>\b/i
describe FRT_STRONG1            ReplaceTags: Strong (1)
endif
##} FRT_STRONG1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_STRONG2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_STRONG2            /<inter W0><post P2>\b(?!strong)<SX><TX><R><O><N><GX>\b/i
describe FRT_STRONG2            ReplaceTags: Strong (2)
endif
##} FRT_STRONG2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_SYMBOL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_SYMBOL             /<inter SP2><post P2>\b(?!symbol)<SX><Y><M><B><O><L>/i
describe FRT_SYMBOL             ReplaceTags: Symbol
endif
##} FRT_SYMBOL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_TODAY2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_TODAY2             /<inter W0><post P2>\b(?!today)<TX><O><D><A><Y>/i
describe FRT_TODAY2             ReplaceTags: Today (2)
endif
##} FRT_TODAY2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_VALIUM1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_VALIUM1 /<inter W0><post P2>\b(?!valium|verifiquem|volturno|vollum)<V><A><L><I><U><M>\b/i
describe FRT_VALIUM1            ReplaceTags: Valium
endif
##} FRT_VALIUM1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_VALIUM2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_VALIUM2 /<inter SP2><post P2>\b(?!valium|verifiquem|volturno|vollum)<V><A><L><I><U><M>\b/i
describe FRT_VALIUM2            ReplaceTags: Valium (2)
endif
##} FRT_VALIUM2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_WEIGHT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_WEIGHT2            /<inter W0><post P2>\b(?!weight)<WX><E><IX><GX><H><TX>/i
describe FRT_WEIGHT2            ReplaceTags: Weight (2)
endif
##} FRT_WEIGHT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_XANAX1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_XANAX1             /<inter W0><post P2>\b(?!xanax)<X><A><N><A><X>\b/i
describe FRT_XANAX1             ReplaceTags: Xanax (1)
endif
##} FRT_XANAX1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_XANAX2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_XANAX2             /<inter SP2><post P2>\b(?!xanax)<X><A><N><A><X>\b/i
describe FRT_XANAX2             ReplaceTags: Xanax (2)
endif
##} FRT_XANAX2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FR_3TAG_3TAG

rawbody  FR_3TAG_3TAG           m'<[abcefghijklmnoqstuvwxz]{3}></[abcefghijklmnoqstuvwxz]{3}>'i
describe FR_3TAG_3TAG           Looks like 3 <e> small tags.
##} FR_3TAG_3TAG

##{ FR_ALMOST_VIAG2

rawbody  FR_ALMOST_VIAG2        /[^a-z](?!viagra)v?ia.?g.?ra/i
describe FR_ALMOST_VIAG2        Almost looks like viagra.
##} FR_ALMOST_VIAG2

##{ FR_CANTSEETEXT

rawbody  FR_CANTSEETEXT         /class="?cantseetext/i
describe FR_CANTSEETEXT         Phrase class=cantseetext
##} FR_CANTSEETEXT

##{ FR_DOT_FEVER_5

rawbody  FR_DOT_FEVER_5         /(?:[a-z ']{2,35}\s[.,]\s){5}/
describe FR_DOT_FEVER_5         Lots of dots inbetween letters.
##} FR_DOT_FEVER_5

##{ FR_MIDER

rawbody  FR_MIDER               m'http[^ ]{5,30}/gall?/'
describe FR_MIDER               Sign often seen in spams
##} FR_MIDER

##{ FR_TITLE_NUMS

rawbody  FR_TITLE_NUMS          m'<title>\d+</title>'i
describe FR_TITLE_NUMS          HTML Title is only numbers
##} FR_TITLE_NUMS

##{ FR_WATCHES_HTTP

rawbody  FR_WATCHES_HTTP        m'watches\s(?:\w+)?\s?http://'i
describe FR_WATCHES_HTTP        Watches http://
##} FR_WATCHES_HTTP

##{ FSL_CTYPE_WIN1251

header   FSL_CTYPE_WIN1251   Content-Type =~ /charset="Windows-1251"/
describe FSL_CTYPE_WIN1251   Content-Type only seen in 419 spam
#score    FSL_CTYPE_WIN1251   2.0
##} FSL_CTYPE_WIN1251

##{ FSL_FAKE_GMAIL_RCVD

header	FSL_FAKE_GMAIL_RCVD	X-Spam-Relays-External =~ /gmail-smtp-in\.l\.google\.com/
#score	FSL_FAKE_GMAIL_RCVD	0.001
##} FSL_FAKE_GMAIL_RCVD

##{ FSL_FAKE_HOTMAIL_RVCD

header	FSL_FAKE_HOTMAIL_RVCD	X-Spam-Relays-External =~ /mx[1234]\.hotmail\.com/
##} FSL_FAKE_HOTMAIL_RVCD

##{ FSL_GEO_ABUSE

uri FSL_GEO_ABUSE /\/geocities\.com\/\S+$/
#score FSL_GEO_ABUSE 3.0
##} FSL_GEO_ABUSE

##{ FSL_HELO_BARE_IP_1

header  FSL_HELO_BARE_IP_1      X-Spam-Relays-External =~ /^[^\]]+ helo=\d+\.\d+\.\d+\.\d+ /i
#score   FSL_HELO_BARE_IP_1      0.001
##} FSL_HELO_BARE_IP_1

##{ FSL_HELO_DEVICE

header	FSL_HELO_DEVICE		X-Spam-Relays-External =~ /\bhelo=(?:(?:dsl)?device|speedtouch)\.lan\b/i
#score	FSL_HELO_DEVICE		0.001
##} FSL_HELO_DEVICE

##{ FSL_HELO_NON_FQDN_1

header  FSL_HELO_NON_FQDN_1     X-Spam-Relays-External =~ /^[^\]]+ helo=[a-zA-Z0-9-_]+ /i
#score   FSL_HELO_NON_FQDN_1     0.001
##} FSL_HELO_NON_FQDN_1

##{ FSL_HELO_SETUP

header	FSL_HELO_SETUP		X-Spam-Relays-External =~ /\bhelo=\S+\.setup\b/i
#score	FSL_HELO_SETUP		0.001
##} FSL_HELO_SETUP

##{ FSL_INTERIA_ABUSE

uri FSL_INTERIA_ABUSE /\/\S+\.(?:w|eu|fm)\.interia\.pl/
#score FSL_INTERIA_ABUSE 15.0 
##} FSL_INTERIA_ABUSE

##{ FSL_MID_419

header   FSL_MID_419   MESSAGE-ID =~ /\@User>$/
describe FSL_MID_419   Spam signature in Message-ID
#score    FSL_MID_419   2.0
##} FSL_MID_419

##{ FSL_UA

meta FSL_UA (__FSL_UA_1 || __FSL_UA_2)
#score FSL_UA 3.0
##} FSL_UA

##{ FSL_XM_419

header   FSL_XM_419   X-Mailer =~ /\s+6\.00\.2600\.0000$/
describe FSL_XM_419   Old OE version in X-Mailer only seen in 419 spam
#score    FSL_XM_419   2.0
##} FSL_XM_419

##{ FSL_YG_ABUSE

uri FSL_YG_ABUSE /\/groups\.yahoo\.com\/group\/\S+\/message\/1$/
#score FSL_YG_ABUSE 15.0
##} FSL_YG_ABUSE

##{ FS_ABIGGER

header   FS_ABIGGER     Subject =~ /a bigger/i
describe FS_ABIGGER     Subject has "a bigger"
##} FS_ABIGGER

##{ FS_APPROVE_YOU

header   FS_APPROVE_YOU         Subject =~ /approve you/i
describe FS_APPROVE_YOU         Subject says approve you
##} FS_APPROVE_YOU

##{ FS_AT_NO_COST

header   FS_AT_NO_COST          Subject =~ /\bat no cost/i
describe FS_AT_NO_COST          Subject says "At No Cost"
##} FS_AT_NO_COST

##{ FS_CHEAP_CAP

header   FS_CHEAP_CAP           Subject =~ /CHEAP/
describe FS_CHEAP_CAP           Phrase: Cheap in Caps in Subject.
##} FS_CHEAP_CAP

##{ FS_DOLLAR_BONUS

header   FS_DOLLAR_BONUS        Subject =~ /\$\d\d\d?\.?\d?\d? bonus/i
describe FS_DOLLAR_BONUS        Subject talks about money bonus!
##} FS_DOLLAR_BONUS

##{ FS_EJACULA

header   FS_EJACULA             Subject =~ /ejaculat(?:[io01][o0i1]n|e)/i
describe FS_EJACULA             Phrase: ejaculation in subject.
##} FS_EJACULA

##{ FS_ERECTION

header   FS_ERECTION            Subject =~ / erection /i
describe FS_ERECTION            Phrase: erection in subject.
##} FS_ERECTION

##{ FS_GET_LAID

header   FS_GET_LAID            Subject =~ /get la[i1]d/i
describe FS_GET_LAID            Phrase: get laid in subj.
##} FS_GET_LAID

##{ FS_HUGECOCK

header   FS_HUGECOCK            Subject =~ /(?:huge|tiny|small) (?:c[o0]ck|d[i1]ck|p[e3]n[1i]s)/i
describe FS_HUGECOCK            Phrase: Huge Cock
##} FS_HUGECOCK

##{ FS_LARGE_PERCENT2

header   FS_LARGE_PERCENT2      Subject =~ /(?!100%)\d[0-9oi][0-9oi]%/i
describe FS_LARGE_PERCENT2      Larger than 100% in subj.
##} FS_LARGE_PERCENT2

##{ FS_LOW_RATES

header   FS_LOW_RATES           Subject =~ / low rates/i
describe FS_LOW_RATES           Subject says low rates
##} FS_LOW_RATES

##{ FS_MAKE_MONEY

header   FS_MAKE_MONEY          Subject =~ /make money/i
describe FS_MAKE_MONEY          Subject says "make money"
##} FS_MAKE_MONEY

##{ FS_NEW_SOFT_UPLOAD

header   FS_NEW_SOFT_UPLOAD     Subject =~ /^New software uploaded by/
describe FS_NEW_SOFT_UPLOAD     Subj starts with New software uploaded
##} FS_NEW_SOFT_UPLOAD

##{ FS_NEW_XXX

header   FS_NEW_XXX             Subject =~ /^Re: news? [a-z]{1,5}$/
describe FS_NEW_XXX             Subject looks like Fharmacy spams.
##} FS_NEW_XXX

##{ FS_NO_SCRIP

header   FS_NO_SCRIP            Subject =~ /n[o0O] p[reRE][erER]scr[i1I]pt[i1I][o0O]n/i
describe FS_NO_SCRIP            Subject almost says No prescription
##} FS_NO_SCRIP

##{ FS_NUDE

header   FS_NUDE                Subject =~ /\bnude\b/i
describe FS_NUDE                Subject says Nude
##} FS_NUDE

##{ FS_OBFU_PRMCY

header   FS_OBFU_PRMCY          Subject =~ /\b(?!(?:pharmacy|primacy))p[ph]{0,4}\S{1,3}r\S{0,2}m\S{0,3}c\S{0,2}y\b/i
describe FS_OBFU_PRMCY          what could this word be?
##} FS_OBFU_PRMCY

##{ FS_PERSCRIPTION

header   FS_PERSCRIPTION        Subject =~ /perscr[i1]pt[i1][o0]n/i
describe FS_PERSCRIPTION        Subject mis-spelled prescription
##} FS_PERSCRIPTION

##{ FS_PHARMASUB2

header   FS_PHARMASUB2          Subject =~ /PH[A-Za-z]{2,7}MA/
describe FS_PHARMASUB2          Looks like Phramacy subject.
##} FS_PHARMASUB2

##{ FS_RAMROD

header   FS_RAMROD              Subject =~ /ramrod/i
describe FS_RAMROD              Subject says Ramrod
##} FS_RAMROD

##{ FS_REPLICA

header   FS_REPLICA             Subject =~ /replica/i
describe FS_REPLICA             Subject says "replica"
##} FS_REPLICA

##{ FS_REPLICAWATCH

header   FS_REPLICAWATCH        Subject =~ /replica watch/i
describe FS_REPLICAWATCH        Subject says Replica watch
##} FS_REPLICAWATCH

##{ FS_RE_APPROV

header   FS_RE_APPROV           Subject =~ /re approved/i
describe FS_RE_APPROV           Phrase: re approved
##} FS_RE_APPROV

##{ FS_START_DOYOU2

header   FS_START_DOYOU2        Subject =~ /^Do you (?:dream|have|want|love|like|wanna)/i
describe FS_START_DOYOU2        Subject starts with Do you dream,have,want,love, etc.
##} FS_START_DOYOU2

##{ FS_START_LOSE

header   FS_START_LOSE          Subject =~ /^Lose /i
describe FS_START_LOSE          Subject starts with Lose
##} FS_START_LOSE

##{ FS_TEEN_BAD

header   FS_TEEN_BAD            Subject =~ /teen.{1,15}(?:pussy|sex|slut|ass|fuck|rape)/i
describe FS_TEEN_BAD            Subject says something bad about teens
##} FS_TEEN_BAD

##{ FS_TIP_DDD

header   FS_TIP_DDD             Subject =~ /(?:tip|good) \d\d\d?\d?/i
describe FS_TIP_DDD             Phrase: subject = tip ddd
##} FS_TIP_DDD

##{ FS_WEIGHT_LOSS

header   FS_WEIGHT_LOSS         Subject =~ /weight loss/i
describe FS_WEIGHT_LOSS         Subject says Weight Loss
##} FS_WEIGHT_LOSS

##{ FS_WILL_HELP

header   FS_WILL_HELP           Subject =~ /will help/
describe FS_WILL_HELP           Subject says will help
##} FS_WILL_HELP

##{ FS_WITH_SMALL

header   FS_WITH_SMALL          Subject =~ /with (?:\w+\s)?(?:small|short)/i
describe FS_WITH_SMALL          Subject says With ... small
##} FS_WITH_SMALL

##{ FUZZY_MERIDIA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FUZZY_MERIDIA	/<inter W3><post P2>\b(?!meridia)<M><E><R><I><D><I><A>\b/i
endif
##} FUZZY_MERIDIA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FU_COMMON_SUBS2

uri      FU_COMMON_SUBS2        m'/(?:[2w]m|7d|b|ee|lj|j|o|u)/[,.]?$'
describe FU_COMMON_SUBS2        Sub-dir seen often in spam (2).
##} FU_COMMON_SUBS2

##{ FU_ENDS_NUMS_DOTS_CLK

uri      FU_ENDS_NUMS_DOTS_CLK  m'(?:clk|uns)/\d+\.\d+\.\d+'i
describe FU_ENDS_NUMS_DOTS_CLK  Ends with clk/d+.d+.d+
##} FU_ENDS_NUMS_DOTS_CLK

##{ FU_END_ET

uri      FU_END_ET              m'/et/$'i
describe FU_END_ET              ET Phone Home?
##} FU_END_ET

##{ FU_HOODIA

uri      FU_HOODIA              /hoodia/i
describe FU_HOODIA              URL has hoodia in it.
##} FU_HOODIA

##{ FU_LONG_QUERY3

uri      FU_LONG_QUERY3         m'[A-F0-9]{30}\.aspx'
describe FU_LONG_QUERY3         URL has a long file name with .aspx extension.
##} FU_LONG_QUERY3

##{ FU_MIDER

uri      FU_MIDER               m'/gall?/'
describe FU_MIDER               URL has /gal/
##} FU_MIDER

##{ FU_UKGEOCITIES

uri      FU_UKGEOCITIES         /\b[a-z]{2}\.geocities\.com/i
describe FU_UKGEOCITIES         URL with [a-z]{2}.geocities.com
##} FU_UKGEOCITIES

##{ FU_URI_TRACKER_T

uri      FU_URI_TRACKER_T       m'/[yi]/(?:sp|et|vm|xl2)/'i
describe FU_URI_TRACKER_T       URI style tracker (T)
##} FU_URI_TRACKER_T

##{ GAPPY_HTML

meta        GAPPY_HTML             __GAPPY_HTML && !__UNSUB_LINK
describe    GAPPY_HTML             HTML body with much useless whitespace
##} GAPPY_HTML

##{ GAPPY_PHONE_NA

meta        GAPPY_PHONE_NA         __GAPPY_PHONE_NA
describe    GAPPY_PHONE_NA         Phone number with lots of spaces
##} GAPPY_PHONE_NA

##{ GEO_QUERY_STRING

uri	GEO_QUERY_STRING	/^http:\/\/(?:\w{2,4}\.)?geocities\.com(?::\d*)?\/.+?\/\?/i
##} GEO_QUERY_STRING

##{ HDRS_LCASE_1K

meta           HDRS_LCASE_1K         __HDRS_LCASE_1K && !__VIA_ML
describe       HDRS_LCASE_1K         Odd capitalization of message headers + long header
##} HDRS_LCASE_1K

##{ HDR_ORDER_FTSDMCXX_001C

meta HDR_ORDER_FTSDMCXX_001C  (__HDR_ORDER_FTSDMCXXXX && __MID_START_001C)
describe HDR_ORDER_FTSDMCXX_001C  Header order similar to spam (FTSDMCXX/MID variant)
##} HDR_ORDER_FTSDMCXX_001C

##{ HDR_ORDER_FTSDMCXX_BAT

meta HDR_ORDER_FTSDMCXX_BAT   (__HDR_ORDER_FTSDMCXXXX && __BAT_BOUNDARY)
describe HDR_ORDER_FTSDMCXX_BAT   Header order similar to spam (FTSDMCXX/boundary variant)
##} HDR_ORDER_FTSDMCXX_BAT

##{ HEADER_COUNT_SUBJECT ifplugin Mail::SpamAssassin::Plugin::HeaderEval

ifplugin Mail::SpamAssassin::Plugin::HeaderEval
header HEADER_COUNT_SUBJECT	eval:check_header_count_range('Subject','2','999')
describe HEADER_COUNT_SUBJECT	Multiple Subject headers found
endif
##} HEADER_COUNT_SUBJECT ifplugin Mail::SpamAssassin::Plugin::HeaderEval

##{ HELO_FRIEND

header HELO_FRIEND  X-Spam-Relays-External =~ /^[^\]]+ helo=friend /i
##} HELO_FRIEND

##{ HELO_LH_HOME

header HELO_LH_HOME X-Spam-Relays-External =~ /^[^\]]+ helo=\S+\.(?:home|lan) /i
##} HELO_LH_HOME

##{ HELO_LH_LD

header HELO_LH_LD   X-Spam-Relays-External =~ /^[^\]]+ helo=localhost\.localdomain /i
##} HELO_LH_LD

##{ HELO_LOCALHOST

header HELO_LOCALHOST   X-Spam-Relays-External =~ /^[^\]]+ helo=localhost /i
##} HELO_LOCALHOST

##{ HELO_NO_DOMAIN

meta     HELO_NO_DOMAIN	__HELO_NO_DOMAIN && !HELO_LOCALHOST
describe HELO_NO_DOMAIN	Relay reports its domain incorrectly
##} HELO_NO_DOMAIN

##{ HELO_OEM

header HELO_OEM  X-Spam-Relays-External =~ /^[^\]]+ helo=(?:pc|oem\S*) /i
##} HELO_OEM

##{ HK_FAKENAME_EBAY ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM

ifplugin Mail::SpamAssassin::Plugin::SPF
ifplugin Mail::SpamAssassin::Plugin::DKIM
meta		HK_FAKENAME_EBAY	__HK_NAME_EBAY && !__HK_HELO_EBAY && !SPF_PASS && !DKIM_VALID_AU
describe	HK_FAKENAME_EBAY	From name mentions eBay, but not relayed from there
endif
endif
##} HK_FAKENAME_EBAY ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM

##{ HK_LOTTO

meta		HK_LOTTO		__HK_LOTTO_1 || __HK_LOTTO_2 || __HK_LOTTO_JACKPOT || __HK_LOTTO_STAATS || __HK_LOTTO_BALLOT
##} HK_LOTTO

##{ HK_NAME_DRUGS

header		HK_NAME_DRUGS		From:name =~ /(viagra|\bcialis|cialis\b)/mi
describe	HK_NAME_DRUGS		From name contains drugs
##} HK_NAME_DRUGS

##{ HK_PNIS

body		HK_PNIS			/\bpenis\b/i
##} HK_PNIS

##{ HK_RANDOM_ENVFROM

header		HK_RANDOM_ENVFROM	EnvelopeFrom =~ /^(?!(?:mail|bounce)[_.-]|[^@]*(?:[+=^~\#]|mcgr|kpmg|nlpbr|ndqv|lcgc|cplpr|-mailer@)|[^@]{20})[^@]*(?:[bcdfgjklmnpqrtvwxz]{5}|[aeiouy]{5}|([a-z]{1,2})(?:\1){3})/mi
describe	HK_RANDOM_ENVFROM	Envelope sender username looks random
##} HK_RANDOM_ENVFROM

##{ HK_RANDOM_FROM

header		HK_RANDOM_FROM		From:addr =~ /^(?!(?:mail|bounce)[_.-]|[^@]*(?:[+=^~\#]|mcgr|kpmg|nlpbr|ndqv|lcgc|cplpr|-mailer@)|[^@]{26}|.*?@.{0,20}\bcmp-info\.com$)[^@]*(?:[bcdfgjklmnpqrtvwxz]{5}|[aeiouy]{5}|([a-z]{1,2})(?:\1){3})/mi
describe	HK_RANDOM_FROM		From username looks random
##} HK_RANDOM_FROM

##{ HK_SCAM_N2

body		HK_SCAM_N2		/\bnext of kin\b/i
##} HK_SCAM_N2

##{ HK_SCAM_N8

body		HK_SCAM_N8		/\byour compensation\b/i
##} HK_SCAM_N8

##{ HS_BOBAX_MID_2

header HS_BOBAX_MID_2 Message-Id =~ /^<\dIX\d{3}EJXVWDA\d{3}\@[a-z\-]+\.[a-z]+>/
describe HS_BOBAX_MID_2 Bobax? Message-Id: <0IX000EJXVWDA000@example.com>
##} HS_BOBAX_MID_2

##{ HS_BODY_UPLOADED_SOFTWARE

body HS_BODY_UPLOADED_SOFTWARE /^\w+ has uploaded some new software/
describe HS_BODY_UPLOADED_SOFTWARE Somebody has uploaded some new software for you
##} HS_BODY_UPLOADED_SOFTWARE

##{ HS_DRUG_DOLLAR_1

body HS_DRUG_DOLLAR_1 m'^[a-z]+[glrt][a-z]?[eir][a-z]?[asx](?: -|:)? \$[\d.]+$'i
describe HS_DRUG_DOLLAR_1 Contains a drug and price-like pattern.
##} HS_DRUG_DOLLAR_1

##{ HS_DRUG_DOLLAR_2

body HS_DRUG_DOLLAR_2 m'^[a-z]+[lmor][a-z]?[aex][a-z]?[mx](?: -|:)? \$[\d.]+$'i
describe HS_DRUG_DOLLAR_2 Contains a drug and price-like pattern.
##} HS_DRUG_DOLLAR_2

##{ HS_DRUG_DOLLAR_3

body HS_DRUG_DOLLAR_3 m'^[a-z]+[dino][a-z]?[aimu][a-z]?[amx](?: -|:)? \$[\d.]+$'i
describe HS_DRUG_DOLLAR_3 Contains a drug and price-like pattern.
##} HS_DRUG_DOLLAR_3

##{ HS_DRUG_DOLLAR_MANY

meta HS_DRUG_DOLLAR_MANY HS_DRUG_DOLLAR_1 + HS_DRUG_DOLLAR_2 + HS_DRUG_DOLLAR_3 >= 2
describe HS_DRUG_DOLLAR_MANY Contains several drug and dollar-like patterns.
##} HS_DRUG_DOLLAR_MANY

##{ HS_FORGED_OE_FW

meta HS_FORGED_OE_FW __HS_SUBJ_UC_FW && __OE_MUA
describe HS_FORGED_OE_FW Outlook does not prefix forwards with "FW:"
##} HS_FORGED_OE_FW

##{ HS_GETMEOFF

uri HS_GETMEOFF m'/get(?:me)?off\.php(?:$|[\#?])'
describe HS_GETMEOFF Links to common unsubscribe script: 'getmeoff.php'
##} HS_GETMEOFF

##{ HS_INDEX_PARAM

uri HS_INDEX_PARAM m'^https?:/*([^/]*/)+(?:index.(?:cgi|html?|php)|default.(?:asp|jsp))?\?(?!(?-i:[A-Z][a-z]{2,}){2,}$)\w+={0,2}$'i
describe HS_INDEX_PARAM Link contains a common tracker pattern.
##} HS_INDEX_PARAM

##{ HS_MEETUP_FOR_SEX

body HS_MEETUP_FOR_SEX m'(?:meet ?up|see eachother|get together) for (?:some )?(?:action|sex)'i
describe HS_MEETUP_FOR_SEX Talks about meeting up for sex.
##} HS_MEETUP_FOR_SEX

##{ HS_SUBJ_NEW_SOFTWARE

header HS_SUBJ_NEW_SOFTWARE Subject =~ /^New software uploaded by/
describe HS_SUBJ_NEW_SOFTWARE Subject starts with 'New software uploaded by'
##} HS_SUBJ_NEW_SOFTWARE

##{ HS_SUBJ_ONLINE_PHARMACEUTICAL

header HS_SUBJ_ONLINE_PHARMACEUTICAL Subject =~ /\bOnline Pharmaceutical/i
describe HS_SUBJ_ONLINE_PHARMACEUTICAL Subject contains the phrase 'Online pharmaceutical'
##} HS_SUBJ_ONLINE_PHARMACEUTICAL

##{ HS_VPXL

body HS_VPXL /\bVPXL\b/i
describe HS_VPXL Contains VPXL, yet the recommended dose is only 2 tablets.
##} HS_VPXL

##{ HTTPS_HTTP_MISMATCH ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch

ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch
body  HTTPS_HTTP_MISMATCH eval:check_https_http_mismatch('1','10')
endif
##} HTTPS_HTTP_MISMATCH ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch

##{ JM_FAKE_PSMTP_RCVD

header JM_FAKE_PSMTP_RCVD   Received =~ /^from \[\d+\.\d+\.\d+\.\d+\] by \S+\.\S+\.psmtp\.com; /m
##} JM_FAKE_PSMTP_RCVD

##{ JM_I_FEEL_LUCKY

uri JM_I_FEEL_LUCKY         /(?:\&|\?)btnI=ec(?:$|\&)/
tflags JM_I_FEEL_LUCKY  publish     # low hitrate, but always a good sign
##} JM_I_FEEL_LUCKY

##{ JM_RCVD_QMAILV1

header JM_RCVD_QMAILV1     Received =~ /by \S+ \(Qmailv1\) with ESMTP/
##} JM_RCVD_QMAILV1

##{ JM_SOUGHT_FRAUD_1

meta JM_SOUGHT_FRAUD_1   (0)
#score JM_SOUGHT_FRAUD_1  0
describe JM_SOUGHT_FRAUD_1  Body contains frequently-spammed text patterns
##} JM_SOUGHT_FRAUD_1

##{ JM_SOUGHT_FRAUD_2

meta JM_SOUGHT_FRAUD_2   (__SEEK_FRAUD_TPKDA7 || __SEEK_FRAUD_XJPS4J || __SEEK_FRAUD_ZZVKMO || __SEEK_FRAUD_GRYB_A || __SEEK_FRAUD_4KBBOJ)
#score JM_SOUGHT_FRAUD_2  3.0
describe JM_SOUGHT_FRAUD_2  Body contains frequently-spammed text patterns
##} JM_SOUGHT_FRAUD_2

##{ JM_SOUGHT_FRAUD_3

meta JM_SOUGHT_FRAUD_3   (__SEEK_FRAUD_QU7ENV || __SEEK_FRAUD_DA_SPN || __SEEK_FRAUD_Y6I2KV || __SEEK_FRAUD_HWMBYB || __SEEK_FRAUD_ZA0FLG || __SEEK_FRAUD_Z9HI0T || __SEEK_FRAUD_QJE0YJ || __SEEK_FRAUD_1OMKY9 || __SEEK_FRAUD_UDD6SD || __SEEK_FRAUD_LHMFUQ || __SEEK_FRAUD_0KBZGH || __SEEK_FRAUD_XD3U8U || __SEEK_FRAUD__3AQGB || __SEEK_FRAUD_1YKNCJ || __SEEK_FRAUD_0OPFLV || __SEEK_FRAUD_IGL8BZ || __SEEK_FRAUD_27TPNC || __SEEK_FRAUD_IRYH8O || __SEEK_FRAUD_PXHWDT || __SEEK_FRAUD___VYVJ || __SEEK_FRAUD_55WLGY || __SEEK_FRAUD_AZUWPQ || __SEEK_FRAUD_AUHBXT || __SEEK_FRAUD_MY06YR || __SEEK_FRAUD_SLAG8H || __SEEK_FRAUD_MA4WWH || __SEEK_FRAUD_YKISUY || __SEEK_FRAUD_UV2ATY || __SEEK_FRAUD_ZBJZVN || __SEEK_FRAUD_OVKMST || __SEEK_FRAUD_O3_VB8 || __SEEK_FRAUD_M8ZJ86 || __SEEK_FRAUD_ZMITTF || __SEEK_FRAUD_MZ4KU4 || __SEEK_FRAUD_6OI8QG || __SEEK_FRAUD_AITBFD || __SEEK_FRAUD_VQGIG6 || __SEEK_FRAUD_M8T_DX || __SEEK_FRAUD_MOT82J || __SEEK_FRAUD_UVOSIY || __SEEK_FRAUD_BEAOXU || __SEEK_FRAUD_17TGPW || __SEEK_FRAUD_UJZKNM || __SEEK_FRAUD_KEP1L_ || __SEEK_FRAUD_V3CKGD || __SEEK_FRAUD_0YTF3I || __SEEK_FRAUD_1_DZIV || __SEEK_FRAUD_59PL1E || __SEEK_FRAUD_9TSKUH || __SEEK_FRAUD_AKYCPN || __SEEK_FRAUD_XL24FM || __SEEK_FRAUD_JGGLPC || __SEEK_FRAUD_49FI4O || __SEEK_FRAUD_Y1JTCA || __SEEK_FRAUD_E2_QDF || __SEEK_FRAUD_CTPNAE || __SEEK_FRAUD__JQVGM || __SEEK_FRAUD_F2OR8H || __SEEK_FRAUD_N7NCI8 || __SEEK_FRAUD_GHC0LN || __SEEK_FRAUD_YELH8F || __SEEK_FRAUD_TKBHOI || __SEEK_FRAUD_3WUO8K || __SEEK_FRAUD_CJPQV1 || __SEEK_FRAUD_BRNKW7 || __SEEK_FRAUD_WAAEJ8 || __SEEK_FRAUD__8R822 || __SEEK_FRAUD__SGKIK || __SEEK_FRAUD_0ENSZN || __SEEK_FRAUD_XMTGXX || __SEEK_FRAUD_LUOISR || __SEEK_FRAUD_LTD1IZ || __SEEK_FRAUD_XNCCWK || __SEEK_FRAUD_MEFC9A || __SEEK_FRAUD_VNERKN || __SEEK_FRAUD_US_OFW || __SEEK_FRAUD_R8MXKM || __SEEK_FRAUD__J8HKJ || __SEEK_FRAUD_75EPGH || __SEEK_FRAUD_L2F6_R || __SEEK_FRAUD_WJ_B8R || __SEEK_FRAUD_BOG4XB || __SEEK_FRAUD_ZIZCXR || __SEEK_FRAUD_4YVO5B || __SEEK_FRAUD__2H_ZF || __SEEK_FRAUD_XY_KVM || __SEEK_FRAUD_SUGRCM || __SEEK_FRAUD_JH0IMU || __SEEK_FRAUD_D0SCQY || __SEEK_FRAUD_6SNWNT || __SEEK_FRAUD_S2TCCV || __SEEK_FRAUD_YGQR5E || __SEEK_FRAUD_ZTOV4F || __SEEK_FRAUD_45YXI4 || __SEEK_FRAUD_S4QI3T || __SEEK_FRAUD_MHDF0X || __SEEK_FRAUD_EFJ5G0 || __SEEK_FRAUD_P8F86E || __SEEK_FRAUD_LC7TDH || __SEEK_FRAUD_Y6P5MJ || __SEEK_FRAUD_X1E2EB || __SEEK_FRAUD_J1D82S || __SEEK_FRAUD_SMTAYP || __SEEK_FRAUD_K1G7F9 || __SEEK_FRAUD_H78OXL || __SEEK_FRAUD_LHZDJ_ || __SEEK_FRAUD_MPY_VV || __SEEK_FRAUD_DXLGXY || __SEEK_FRAUD_1LWG1E || __SEEK_FRAUD_UVUS_Y || __SEEK_FRAUD_EBEPD_ || __SEEK_FRAUD_EFET6T || __SEEK_FRAUD_DE87LA || __SEEK_FRAUD_QYJ0F_ || __SEEK_FRAUD_CKWDC_ || __SEEK_FRAUD_SRT80U || __SEEK_FRAUD_ETTPUF || __SEEK_FRAUD_XVM0G_ || __SEEK_FRAUD_CHLODJ || __SEEK_FRAUD_S0K3GF || __SEEK_FRAUD_XOG2QH || __SEEK_FRAUD_AKAEF9 || __SEEK_FRAUD_0XNFH_ || __SEEK_FRAUD_MSZKFU || __SEEK_FRAUD_B5_Q5F || __SEEK_FRAUD__2JC4J || __SEEK_FRAUD_EYJYD5 || __SEEK_FRAUD_JJQFVB || __SEEK_FRAUD_SWKNYQ || __SEEK_FRAUD_NEZYJA || __SEEK_FRAUD_ZGRQSU || __SEEK_FRAUD_EVIVRH || __SEEK_FRAUD_UD45OB || __SEEK_FRAUD_QNKQRV || __SEEK_FRAUD_1MXKDB || __SEEK_FRAUD_TTMYIZ || __SEEK_FRAUD_V5HTKT || __SEEK_FRAUD_I19BXK || __SEEK_FRAUD_CIXFCH || __SEEK_FRAUD_TK7ZE5 || __SEEK_FRAUD_KJCQBN || __SEEK_FRAUD_SF0AZL || __SEEK_FRAUD_B9GHRP || __SEEK_FRAUD_32EE0G || __SEEK_FRAUD_PBZBDQ || __SEEK_FRAUD_CEXPEV || __SEEK_FRAUD_AZ117T || __SEEK_FRAUD_MFX2AC || __SEEK_FRAUD_OW6PZN || __SEEK_FRAUD_KKQM9L || __SEEK_FRAUD_YGGJHJ || __SEEK_FRAUD_YMNO86 || __SEEK_FRAUD_S8_5Y8 || __SEEK_FRAUD_EDORBJ || __SEEK_FRAUD_FKRVOS || __SEEK_FRAUD_DE3CNN || __SEEK_FRAUD_IR89IB || __SEEK_FRAUD_EXFYTU || __SEEK_FRAUD_XBDIGO || __SEEK_FRAUD_FMJP2L || __SEEK_FRAUD_POSXKO || __SEEK_FRAUD_LYNJ8F || __SEEK_FRAUD_AZ58ZB || __SEEK_FRAUD_GGXKDC || __SEEK_FRAUD_2C0NY6 || __SEEK_FRAUD__GBFFZ || __SEEK_FRAUD_JJTCEC || __SEEK_FRAUD__EWXDD || __SEEK_FRAUD_F8VGZN || __SEEK_FRAUD_GTSAAF || __SEEK_FRAUD_ZMFYMV || __SEEK_FRAUD_LHPW8G || __SEEK_FRAUD_3MBUTP || __SEEK_FRAUD_JGFD5P || __SEEK_FRAUD_87YD7W || __SEEK_FRAUD_NV1HR9 || __SEEK_FRAUD_RQRFPM || __SEEK_FRAUD_7SASLI || __SEEK_FRAUD_DIIRM8 || __SEEK_FRAUD_KB6SDS || __SEEK_FRAUD__VYNLD || __SEEK_FRAUD_H9VQEI || __SEEK_FRAUD_BJUJI4 || __SEEK_FRAUD_JHIYQX || __SEEK_FRAUD_4HH4OS || __SEEK_FRAUD_NEK_SA || __SEEK_FRAUD_MHAKVX || __SEEK_FRAUD_8802C6 || __SEEK_FRAUD_JMEGUU || __SEEK_FRAUD_I3HLDY || __SEEK_FRAUD_JTD4OO || __SEEK_FRAUD_6RGTYS || __SEEK_FRAUD_EAHFYY || __SEEK_FRAUD_7MKYRR || __SEEK_FRAUD_UVARBX || __SEEK_FRAUD_IQHXRD || __SEEK_FRAUD_XKEW24 || __SEEK_FRAUD_LXBIXJ || __SEEK_FRAUD_O9Z_CI || __SEEK_FRAUD_UF2Q_4 || __SEEK_FRAUD_8LRGPA || __SEEK_FRAUD_SOMTJG || __SEEK_FRAUD_DI5SMP || __SEEK_FRAUD_3ZEWKC || __SEEK_FRAUD_UKLYHN || __SEEK_FRAUD_OZ6FMP || __SEEK_FRAUD_E96NSG || __SEEK_FRAUD__9IDPT || __SEEK_FRAUD_OSPVFG || __SEEK_FRAUD_BSX___ || __SEEK_FRAUD_FE742Q || __SEEK_FRAUD_TFENYE || __SEEK_FRAUD_ALAIKE || __SEEK_FRAUD_OHRGMW || __SEEK_FRAUD_KXDZWV || __SEEK_FRAUD_UMXZKW || __SEEK_FRAUD_CCF1EW || __SEEK_FRAUD_VMKU09 || __SEEK_FRAUD_1HLDVM || __SEEK_FRAUD_HXXOMT || __SEEK_FRAUD_PLK7HH || __SEEK_FRAUD_OPAU37 || __SEEK_FRAUD_SBLZOX || __SEEK_FRAUD_NZYXPO || __SEEK_FRAUD_NR_I4S || __SEEK_FRAUD_CN2CTT || __SEEK_FRAUD_QRRCLD || __SEEK_FRAUD_6XGKRW || __SEEK_FRAUD_68YEDU || __SEEK_FRAUD_ZXVMN_ || __SEEK_FRAUD_JNQAA1 || __SEEK_FRAUD_EJM0XB || __SEEK_FRAUD_MWUIJQ || __SEEK_FRAUD_LOG1TG || __SEEK_FRAUD_V51UD0 || __SEEK_FRAUD_E1MR3Z || __SEEK_FRAUD_ORHOZJ || __SEEK_FRAUD_SIYSH8 || __SEEK_FRAUD_FNYQLN || __SEEK_FRAUD_JOFPVK || __SEEK_FRAUD_4O7OHH || __SEEK_FRAUD_OWUEYF || __SEEK_FRAUD_3OPYSM || __SEEK_FRAUD_MLFHRU || __SEEK_FRAUD_OUKYFQ || __SEEK_FRAUD_QHXUIZ || __SEEK_FRAUD_XV0VCM || __SEEK_FRAUD_5INAZF || __SEEK_FRAUD_U5YTAO || __SEEK_FRAUD_P8ZIB5 || __SEEK_FRAUD__39VBB || __SEEK_FRAUD__KYBSV || __SEEK_FRAUD_MCEI6K || __SEEK_FRAUD_VBHSSM || __SEEK_FRAUD_LV_HB6 || __SEEK_FRAUD_BERTMT || __SEEK_FRAUD_SNZJVQ || __SEEK_FRAUD_FDV82D || __SEEK_FRAUD_9OJUVS || __SEEK_FRAUD_XNFRMH || __SEEK_FRAUD_PWBOPK || __SEEK_FRAUD_P8Y20W || __SEEK_FRAUD_NZYMII || __SEEK_FRAUD__OPQTY || __SEEK_FRAUD_THHLIU || __SEEK_FRAUD_YXZMUG || __SEEK_FRAUD_RGENNC || __SEEK_FRAUD_ZLALWU || __SEEK_FRAUD_8RBU5C || __SEEK_FRAUD_BGXWIY || __SEEK_FRAUD_RZTEYR || __SEEK_FRAUD_ZARJER || __SEEK_FRAUD_PURFZB || __SEEK_FRAUD_Q3UEYG || __SEEK_FRAUD_R_Y6KV || __SEEK_FRAUD_QILOIM || __SEEK_FRAUD_R3R2VE || __SEEK_FRAUD_OHDPXP || __SEEK_FRAUD_PDDLNK || __SEEK_FRAUD_ZWACFE || __SEEK_FRAUD_TGDRMF || __SEEK_FRAUD_GMUT_1 || __SEEK_FRAUD_WOZDRE || __SEEK_FRAUD_FD5IJO || __SEEK_FRAUD_PPIYVM || __SEEK_FRAUD_DWEVNF || __SEEK_FRAUD_OBKXT3 || __SEEK_FRAUD_ZG_66A || __SEEK_FRAUD_ZG9WSB || __SEEK_FRAUD_4NIRPA || __SEEK_FRAUD_1Z81CI || __SEEK_FRAUD_EHVE3Y || __SEEK_FRAUD_BPT9ZD || __SEEK_FRAUD_LYS3UM || __SEEK_FRAUD_EQOQFJ || __SEEK_FRAUD_RERCVT || __SEEK_FRAUD_QJAXMZ || __SEEK_FRAUD_JGKWCZ || __SEEK_FRAUD_JYBGOP || __SEEK_FRAUD_43CX5K || __SEEK_FRAUD_RDGS_R || __SEEK_FRAUD__7JU9T || __SEEK_FRAUD_QXDEYO || __SEEK_FRAUD_HW7ENB || __SEEK_FRAUD_SIBZHA || __SEEK_FRAUD__BQIMV || __SEEK_FRAUD_BUW_FJ || __SEEK_FRAUD_6EGJH6 || __SEEK_FRAUD_BBKOZZ || __SEEK_FRAUD_XDLBLQ || __SEEK_FRAUD_RXQMYQ || __SEEK_FRAUD_75NRBF || __SEEK_FRAUD_LFNI27 || __SEEK_FRAUD_U1G4IL || __SEEK_FRAUD_WC2DJX || __SEEK_FRAUD_YRLEBH || __SEEK_FRAUD_D_URQY || __SEEK_FRAUD__Y9XPU || __SEEK_FRAUD_EYYR3G || __SEEK_FRAUD_VW0Z64 || __SEEK_FRAUD_8AR9FD || __SEEK_FRAUD_VSMRB_ || __SEEK_FRAUD_WYVOGD || __SEEK_FRAUD_CVF7N_ || __SEEK_FRAUD_ECCV28 || __SEEK_FRAUD_XEKWPO || __SEEK_FRAUD_1Q42RI || __SEEK_FRAUD_58TQIN || __SEEK_FRAUD_UBE1VZ || __SEEK_FRAUD_VKZHQG || __SEEK_FRAUD_QA7MN5 || __SEEK_FRAUD_XI2Y6Z || __SEEK_FRAUD_KM_YXP || __SEEK_FRAUD_9Q29S6 || __SEEK_FRAUD_P8JJBS || __SEEK_FRAUD_OS7__X || __SEEK_FRAUD__IHT37 || __SEEK_FRAUD_AQGCND || __SEEK_FRAUD_IBW3KJ || __SEEK_FRAUD_NS3JMI || __SEEK_FRAUD_RF_LD1 || __SEEK_FRAUD_LP_GQ9 || __SEEK_FRAUD_ETY7LT || __SEEK_FRAUD_KAXALL || __SEEK_FRAUD_VWUGC4 || __SEEK_FRAUD_OO8I_O || __SEEK_FRAUD_DIPNHU || __SEEK_FRAUD_IUMOXY || __SEEK_FRAUD_TCEBVN || __SEEK_FRAUD_YJCYR4 || __SEEK_FRAUD_K0Z_G7 || __SEEK_FRAUD_AM2BHX || __SEEK_FRAUD_XJUWAF || __SEEK_FRAUD_ALSZID || __SEEK_FRAUD_XXKDNE || __SEEK_FRAUD_GWIW5T || __SEEK_FRAUD_9HWDUP || __SEEK_FRAUD_NLVNRE || __SEEK_FRAUD_MXSTN1 || __SEEK_FRAUD__R9RUV || __SEEK_FRAUD_LPKLJU || __SEEK_FRAUD_ZZZGAR || __SEEK_FRAUD_ZMC3N_ || __SEEK_FRAUD_AJIUNF || __SEEK_FRAUD_RBMZ20 || __SEEK_FRAUD_OCO1GZ || __SEEK_FRAUD_NBYKUF || __SEEK_FRAUD_EBL4QT || __SEEK_FRAUD_FLVC7O || __SEEK_FRAUD_6VUONK || __SEEK_FRAUD_QNKXRT || __SEEK_FRAUD_DNXWDS || __SEEK_FRAUD_ZYDQF_ || __SEEK_FRAUD_WX939W || __SEEK_FRAUD_MVD_UL || __SEEK_FRAUD_8IOTQL || __SEEK_FRAUD_GKQDW6 || __SEEK_FRAUD_MHMBRT || __SEEK_FRAUD_BHWNBP || __SEEK_FRAUD_Y6WUAZ || __SEEK_FRAUD_A8CING || __SEEK_FRAUD_JZFBVG || __SEEK_FRAUD_BORYCZ || __SEEK_FRAUD_VBQ9JO || __SEEK_FRAUD_2PPL8T || __SEEK_FRAUD_WZCO5O || __SEEK_FRAUD_PKVKI1 || __SEEK_FRAUD_U5U5GZ || __SEEK_FRAUD_S5PJZQ || __SEEK_FRAUD_QR3CL9 || __SEEK_FRAUD_IG_EAL || __SEEK_FRAUD_LUSJPG || __SEEK_FRAUD_FIWDJB || __SEEK_FRAUD_DV9GWF || __SEEK_FRAUD_FNGZ_9 || __SEEK_FRAUD_R2403I || __SEEK_FRAUD_F5RHSQ || __SEEK_FRAUD_XGEQEE || __SEEK_FRAUD_DDU0Y_ || __SEEK_FRAUD_JAUOV6 || __SEEK_FRAUD_3NIFMV || __SEEK_FRAUD_YY0T6P || __SEEK_FRAUD_GVTOJY || __SEEK_FRAUD_BLDS9E || __SEEK_FRAUD_A_IQTC || __SEEK_FRAUD_EFYHRC || __SEEK_FRAUD_AMZ2AH || __SEEK_FRAUD_6BI3C9 || __SEEK_FRAUD_HDNX7F || __SEEK_FRAUD_UCSJVN || __SEEK_FRAUD_GFNFIK || __SEEK_FRAUD_FUHSU6 || __SEEK_FRAUD_PIVB38 || __SEEK_FRAUD_CO9T0G || __SEEK_FRAUD_FCF_6I || __SEEK_FRAUD_2BLGLA || __SEEK_FRAUD_2DOBJR || __SEEK_FRAUD__KUHHN || __SEEK_FRAUD_CPHODZ || __SEEK_FRAUD_PTJZLE || __SEEK_FRAUD_TZ3TUV || __SEEK_FRAUD_MOD_74 || __SEEK_FRAUD_AXS4G6 || __SEEK_FRAUD_WGFD9Y || __SEEK_FRAUD_UL0ICM || __SEEK_FRAUD_ZNPZ7V || __SEEK_FRAUD_BPS76O || __SEEK_FRAUD_MUHJKV || __SEEK_FRAUD_CYOVLC || __SEEK_FRAUD_C3BRTD || __SEEK_FRAUD_6KHCDD || __SEEK_FRAUD_65IS8I || __SEEK_FRAUD_ZOHUL3 || __SEEK_FRAUD_NM1G_Z || __SEEK_FRAUD_G4RKKF || __SEEK_FRAUD_Q4PFFF || __SEEK_FRAUD_EZFEDE || __SEEK_FRAUD_NRTQUK || __SEEK_FRAUD_2YLAPH || __SEEK_FRAUD_D04MXN || __SEEK_FRAUD_84RQ6W || __SEEK_FRAUD_BOGJJR || __SEEK_FRAUD_MIDFZQ || __SEEK_FRAUD_WPB12A || __SEEK_FRAUD__ERENB || __SEEK_FRAUD_QDBCS4 || __SEEK_FRAUD_MCWOGJ || __SEEK_FRAUD_IBU0WA || __SEEK_FRAUD_8FUQE6 || __SEEK_FRAUD_5PW27G || __SEEK_FRAUD_XLYR4B || __SEEK_FRAUD_8_YZA0 || __SEEK_FRAUD_F6ZEVO || __SEEK_FRAUD_HWE2G1 || __SEEK_FRAUD_6AN_A8 || __SEEK_FRAUD_JSGI1K || __SEEK_FRAUD_XNGIGX || __SEEK_FRAUD_ZFT05W || __SEEK_FRAUD_JQSWAX || __SEEK_FRAUD_AK5MDQ || __SEEK_FRAUD_HDEE2F)
#score JM_SOUGHT_FRAUD_3  3.0
describe JM_SOUGHT_FRAUD_3  Body contains frequently-spammed text patterns
##} JM_SOUGHT_FRAUD_3

##{ JM_TORA_XM

meta JM_TORA_XM     (__MAILER_OL_6626 && __MOLE_2962 && __NAKED_TO)
##} JM_TORA_XM

##{ KAM_LOTTO1

meta            KAM_LOTTO1      (__KAM_LOTTO1 + __KAM_LOTTO2 + __KAM_LOTTO3 + __KAM_LOTTO4 + __KAM_LOTTO5 + __KAM_LOTTO6 + __KAM_LOTTO7 >= 3)
describe        KAM_LOTTO1      Likely to be a e-Lotto Scam Email
#score           KAM_LOTTO1      0.5
##} KAM_LOTTO1

##{ KAM_LOTTO2

meta            KAM_LOTTO2      (__KAM_LOTTO1 + __KAM_LOTTO2 + __KAM_LOTTO3 + __KAM_LOTTO4 + __KAM_LOTTO5 + __KAM_LOTTO6 + __KAM_LOTTO7 >= 4)
describe        KAM_LOTTO2      Highly Likely to be a e-Lotto Scam Email
#score           KAM_LOTTO2      1.0
##} KAM_LOTTO2

##{ KAM_STOCKOTC

meta KAM_STOCKOTC       (0)
tflags KAM_STOCKOTC     publish
##} KAM_STOCKOTC

##{ KAM_STOCKTIP15

meta KAM_STOCKTIP15     (0)
tflags KAM_STOCKTIP15   publish
##} KAM_STOCKTIP15

##{ KAM_STOCKTIP20

meta KAM_STOCKTIP20     (0)
tflags KAM_STOCKTIP20   publish
##} KAM_STOCKTIP20

##{ KAM_STOCKTIP21

meta KAM_STOCKTIP21     (0)
tflags KAM_STOCKTIP21   publish
##} KAM_STOCKTIP21

##{ KAM_STOCKTIP4

meta KAM_STOCKTIP4      (0)
tflags KAM_STOCKTIP4    publish
##} KAM_STOCKTIP4

##{ KAM_STOCKTIP6

meta KAM_STOCKTIP6      (0)
tflags KAM_STOCKTIP6    publish
##} KAM_STOCKTIP6

##{ KB_DATE_CONTAINS_TAB

header   KB_DATE_CONTAINS_TAB  Date:raw =~ /^\t/
##} KB_DATE_CONTAINS_TAB

##{ KB_FAKED_THE_BAT

meta     KB_FAKED_THE_BAT      (__THEBAT_MUA && KB_DATE_CONTAINS_TAB)
##} KB_FAKED_THE_BAT

##{ KB_FORGED_MOZ4

header   KB_FORGED_MOZ4   User-Agent =~ /\bMozilla 4/
describe KB_FORGED_MOZ4   Mozilla 4 uses X-Mailer
##} KB_FORGED_MOZ4

##{ KB_RATWARE_BOUNDARY

meta   KB_RATWARE_BOUNDARY   __RATWARE_BOUND_A || __RATWARE_BOUND_B
##} KB_RATWARE_BOUNDARY

##{ KB_RATWARE_MSGID

meta   KB_RATWARE_MSGID        (__KB_MSGID_OUTLOOK_888 && __ANY_OUTLOOK_MUA)
##} KB_RATWARE_MSGID

##{ KB_RATWARE_OUTLOOK_08

header  KB_RATWARE_OUTLOOK_08  ALL =~ /^Message-Id: <....([0-9a-f]{8})\$[0-9a-f]{8}\$.{100,400}boundary="----=_NextPart_000_...._\1\./msi  # "
##} KB_RATWARE_OUTLOOK_08

##{ KB_RATWARE_OUTLOOK_12

header  KB_RATWARE_OUTLOOK_12  ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{4})[0-9a-f]{4}\$.{100,400}boundary="----=_NextPart_000_...._\1\.\2/msi  # "
##} KB_RATWARE_OUTLOOK_12

##{ KB_RATWARE_OUTLOOK_16

header  KB_RATWARE_OUTLOOK_16  ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{8})\$.{100,400}boundary="----=_NextPart_000_...._\1\.\2/msi  # "
##} KB_RATWARE_OUTLOOK_16

##{ KB_RATWARE_OUTLOOK_MID

header  KB_RATWARE_OUTLOOK_MID  ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{8})\$[0-9a-f]{8}\@.{100,400}boundary="----=_NextPart_000_...._\1\.\2"/msi
##} KB_RATWARE_OUTLOOK_MID

##{ LIVEFILESTORE

uri  LIVEFILESTORE       m~livefilestore.com/~
##} LIVEFILESTORE

##{ LONG_TERM_PRICE

body LONG_TERM_PRICE  /long\W+term\W+(target|projected)(\W+price)?/i
##} LONG_TERM_PRICE

##{ LOOPHOLE_1

body		LOOPHOLE_1	/loop-?hole in the banking/i
describe	LOOPHOLE_1	A loop hole in the banking laws?
##} LOOPHOLE_1

##{ LOTS_OF_MONEY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  meta     LOTS_OF_MONEY    (__LOTSA_MONEY_00 || __LOTSA_MONEY_01 || __LOTSA_MONEY_02 || __LOTSA_MONEY_03 || __LOTSA_MONEY_04 || __LOTSA_MONEY_05)
  describe LOTS_OF_MONEY    Huge... sums of money
#  score    LOTS_OF_MONEY    0.01
  tflags   LOTS_OF_MONEY    publish
endif
##} LOTS_OF_MONEY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ LOTTERY_1

meta LOTTERY_1      (__DBLCLAIM && __CASHPRZ)
##} LOTTERY_1

##{ LOTTERY_PH_004470

meta LOTTERY_PH_004470  (__AFF_004470_NUMBER && __AFF_LOTTERY)
##} LOTTERY_PH_004470

##{ LOTTO_AGENT

body     LOTTO_AGENT      /\b(?:claim(?:s|ing)?(?:\sprocessing)?|fiducia\w+|reimbursement|(?:prize|international|intl|foreign|win+ing)(?:[\s,.]+(?:rem+it+ance|settlement|payment|award|transfer))+|payment|immunity|grants?)\s?(?:agent|manager|officer|secretary|director|mgr\b)/i
describe LOTTO_AGENT      Claims Agent
#score    LOTTO_AGENT      0.50
##} LOTTO_AGENT

##{ L_SPAM_TOOL_13

header L_SPAM_TOOL_13   Date =~ /\s[+-]\d(?![2358]45)\d[124-9]\d$/
##} L_SPAM_TOOL_13

##{ MANY_PILL_PRICE if can(Mail::SpamAssassin::Conf::feature_bug6558_free)

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  meta        MANY_PILL_PRICE        (__PILL_PRICE_01 + __PILL_PRICE_02) > 2
  describe    MANY_PILL_PRICE        Prices for pills
endif
##} MANY_PILL_PRICE if can(Mail::SpamAssassin::Conf::feature_bug6558_free)

##{ MANY_SPAN_IN_TEXT

meta           MANY_SPAN_IN_TEXT   __MANY_SPAN_IN_TEXT && !__VIA_ML
describe       MANY_SPAN_IN_TEXT   Many <SPAN> tags embedded within text
tflags         MANY_SPAN_IN_TEXT   publish
#score          MANY_SPAN_IN_TEXT   2.50
##} MANY_SPAN_IN_TEXT

##{ MANY_SUBDOM

meta           MANY_SUBDOM         __MANY_SUBDOM && !__JM_REACTOR_DATE && !__UNSUB_LINK && !__VIA_ML && !NO_RELAYS && !__UPPERCASE_URI && !__MIME_QP
describe       MANY_SUBDOM         Lots and lots of subdomain parts in a URI
##} MANY_SUBDOM

##{ MID_DEGREES

header MID_DEGREES  Message-ID =~ /^<\d{14}\.[A-F0-9]{10}\@[A-Z0-9]+>$/
##} MID_DEGREES

##{ MIME_BOUND_EQ_REL

header MIME_BOUND_EQ_REL    Content-Type =~ /boundary="=====================_\d+==\.REL"/s
##} MIME_BOUND_EQ_REL

##{ MIME_PHP_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  meta        MIME_PHP_NO_TEXT  (T_MIME_NO_TEXT && __XM_PHP)
#  score       MIME_PHP_NO_TEXT  2.00
  describe    MIME_PHP_NO_TEXT  No text body parts, X-Mailer: PHP
endif
##} MIME_PHP_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ MONEY_ATM_CARD

meta     MONEY_ATM_CARD   LOTS_OF_MONEY && __ATM_CARD
describe MONEY_ATM_CARD   Lots of money on an ATM card
##} MONEY_ATM_CARD

##{ MONEY_FRAUD_3

meta     MONEY_FRAUD_3    __MONEY_FRAUD_3 && !__COMMENT_EXISTS && !__TAG_EXISTS_CENTER && !__IS_EXCH && !__VIA_ML && !__HAS_THREAD_INDEX && !__UNSUB_LINK && !__DOS_HAS_LIST_UNSUB && !__HTML_LINK_IMAGE
describe MONEY_FRAUD_3    Lots of money and several fraud phrases
tflags   MONEY_FRAUD_3    publish
##} MONEY_FRAUD_3

##{ MONEY_FRAUD_5

meta     MONEY_FRAUD_5    __MONEY_FRAUD_5 && !__VIA_ML && !__HAS_THREAD_INDEX && !__COMMENT_EXISTS && !__UNSUB_LINK && !__TAG_EXISTS_CENTER
describe MONEY_FRAUD_5    Lots of money and many fraud phrases
tflags   MONEY_FRAUD_5    publish
##} MONEY_FRAUD_5

##{ MONEY_FRAUD_8

meta     MONEY_FRAUD_8    __MONEY_FRAUD_8 && !__VIA_ML && !__HAS_THREAD_INDEX
describe MONEY_FRAUD_8    Lots of money and very many fraud phrases
tflags   MONEY_FRAUD_8    publish
##} MONEY_FRAUD_8

##{ MONEY_FROM_MISSP

meta     MONEY_FROM_MISSP   LOTS_OF_MONEY && __FROM_MISSPACED && !__MIME_QP
describe MONEY_FROM_MISSP   Lots of money and misspaced From
#score    MONEY_FROM_MISSP   1.5
##} MONEY_FROM_MISSP

##{ MONEY_LOTTERY

meta     MONEY_LOTTERY    LOTS_OF_MONEY && (__LOTTO_WINNINGS + __LOTTO_WIN_01 + __YOU_WON + LOTTO_AGENT + T_LOTTO_DEPT + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __LOTTO_ADMITS + __LOTTO_RELATED + DEAR_WINNER + __LOTTO_VERIFY > 1) && !__CAN_HELP && !__HTML_LINK_IMAGE && !__DOS_HAS_LIST_UNSUB
describe MONEY_LOTTERY    Lots of money from a lottery
#score    MONEY_LOTTERY    1.5
##} MONEY_LOTTERY

##{ MSOE_MID_WRONG_CASE

meta MSOE_MID_WRONG_CASE  (__XM_OUTLOOK_EXPRESS && __MSOE_MID_WRONG_CASE && !__MIMEOLE_1106)
##} MSOE_MID_WRONG_CASE

##{ NSL_RCVD_FROM_USER

header         NSL_RCVD_FROM_USER       Received =~ /from User [\[\(]/
describe       NSL_RCVD_FROM_USER       Received from User
##} NSL_RCVD_FROM_USER

##{ NULL_IN_BODY

full NULL_IN_BODY	/\x00/
describe NULL_IN_BODY   Message has NUL (ASCII 0) byte in message
##} NULL_IN_BODY

##{ OBFU_ATTACH_MISSP ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  meta         OBFU_ATTACH_MISSP   __FROM_RUNON && (T_OBFU_HTML_ATTACH || OBFU_TEXT_ATTACH || T_OBFU_DOC_ATTACH || T_OBFU_PDF_ATTACH || T_OBFU_JPG_ATTACH || T_OBFU_GIF_ATTACH)
  describe     OBFU_ATTACH_MISSP   Obfuscated attachment type and misspaced From
endif
##} OBFU_ATTACH_MISSP ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ OBFU_JVSCR_ESC

rawbody     OBFU_JVSCR_ESC         /document\.write\(unescape\("(?:%[0-9a-f]{2}){10}/i
describe    OBFU_JVSCR_ESC         Injects content using obfuscated javascript
#score       OBFU_JVSCR_ESC         2.75
tflags      OBFU_JVSCR_ESC         publish
##} OBFU_JVSCR_ESC

##{ OBFU_TEXT_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   OBFU_TEXT_ATTACH    Content-Type =~ m,application/octet-stream;.+\.txt\b,i
  describe     OBFU_TEXT_ATTACH    Text attachment with non-text MIME type
#  score        OBFU_TEXT_ATTACH    2.5
  tflags       OBFU_TEXT_ATTACH    publish
endif
##} OBFU_TEXT_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ PART_CID_STOCK ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
meta PART_CID_STOCK      (__ANY_IMAGE_ATTACH&&__PART_STOCK_CID&&!__PART_STOCK_CL&&!__PART_STOCK_CD_F)
describe PART_CID_STOCK  Has a spammy image attachment (by Content-ID)
endif
##} PART_CID_STOCK ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ PART_CID_STOCK_LESS ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
meta PART_CID_STOCK_LESS (__ANY_IMAGE_ATTACH&&__PART_CID_STOCK_LESS)
describe PART_CID_STOCK_LESS Has a spammy image attachment (by Content-ID, more specific)
endif
##} PART_CID_STOCK_LESS ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ RCVD_BAD_ID

header RCVD_BAD_ID      Received =~ /\bid\s+[a-zA-Z0-9_+\/\\,-]+(?:[!"\#\$\%&'()*<=>?\@\[\]^\`{|}~]|;\S)/
##} RCVD_BAD_ID

##{ RCVD_FORGED_WROTE

header RCVD_FORGED_WROTE    Received =~ / by \S+ with esmtp \([^a-z ]{6,} [^a-z ]{3,}\) id/
describe RCVD_FORGED_WROTE  Forged 'Received' header found ('wrote:' spam)
##} RCVD_FORGED_WROTE

##{ RCVD_FORGED_WROTE2

header RCVD_FORGED_WROTE2 Received =~ /from [0-9.]+ \(HELO \S+[A-Za-z]+\) by (\S+) with esmtp \(\S+\s\S+\) id \S{6}-\S{6}-\S\S for \S+@\1;/s
##} RCVD_FORGED_WROTE2

##{ RCVD_IN_BRBL_LASTEXT ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_BRBL_LASTEXT   eval:check_rbl('brbl-lastexternal','bb.barracudacentral.org')
tflags RCVD_IN_BRBL_LASTEXT   net
endif
##} RCVD_IN_BRBL_LASTEXT ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_CSS

header RCVD_IN_CSS              eval:check_rbl_sub('zen', '127.0.0.3')
describe RCVD_IN_CSS            Received via a relay in Spamhaus CSS
tflags RCVD_IN_CSS              net
##} RCVD_IN_CSS

##{ RCVD_IN_DNSWL_HI ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header	RCVD_IN_DNSWL_HI	eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.\d+\.3$')
describe RCVD_IN_DNSWL_HI	Sender listed at http://www.dnswl.org/, high trust
tflags RCVD_IN_DNSWL_HI		nice net
endif
##} RCVD_IN_DNSWL_HI ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_DNSWL_LOW ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header	RCVD_IN_DNSWL_LOW	eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.\d+\.1$')
describe RCVD_IN_DNSWL_LOW	Sender listed at http://www.dnswl.org/, low trust
tflags RCVD_IN_DNSWL_LOW	nice net
endif
##} RCVD_IN_DNSWL_LOW ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_DNSWL_MED ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header	RCVD_IN_DNSWL_MED	eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.\d+\.2$')
describe RCVD_IN_DNSWL_MED	Sender listed at http://www.dnswl.org/, medium trust
tflags RCVD_IN_DNSWL_MED	nice net
endif
##} RCVD_IN_DNSWL_MED ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_DNSWL_NONE ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header	RCVD_IN_DNSWL_NONE	eval:check_rbl_sub('dnswl-firsttrusted', '^127\.0\.\d+\.0$')
describe RCVD_IN_DNSWL_NONE	Sender listed at http://www.dnswl.org/, no trust
tflags RCVD_IN_DNSWL_NONE	nice net
endif
##} RCVD_IN_DNSWL_NONE ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_DK ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_DK			eval:check_rbl_sub('iadb-firsttrusted', '127.2.255.3')
describe RCVD_IN_IADB_DK		IADB: Sender publishes Domain Keys record
tflags RCVD_IN_IADB_DK			net nice
endif
##} RCVD_IN_IADB_DK ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_DOPTIN		eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.10')
describe RCVD_IN_IADB_DOPTIN		IADB: All mailing list mail is confirmed opt-in
tflags RCVD_IN_IADB_DOPTIN		net nice
endif
##} RCVD_IN_IADB_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_DOPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_DOPTIN_GT50		eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.9')
describe RCVD_IN_IADB_DOPTIN_GT50	IADB: Confirmed opt-in used more than 50% of the time
tflags RCVD_IN_IADB_DOPTIN_GT50		net nice
endif
##} RCVD_IN_IADB_DOPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_DOPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_DOPTIN_LT50		eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.8')
describe RCVD_IN_IADB_DOPTIN_LT50	IADB: Confirmed opt-in used less than 50% of the time
tflags RCVD_IN_IADB_DOPTIN_LT50		net nice
endif
##} RCVD_IN_IADB_DOPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_EDDB ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_EDDB		eval:check_rbl_sub('iadb-firsttrusted', '127.0.2.1')
describe RCVD_IN_IADB_EDDB		IADB: Participates in Email Deliverability Database
tflags RCVD_IN_IADB_EDDB		net nice
endif
##} RCVD_IN_IADB_EDDB ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_EPIA ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_EPIA		eval:check_rbl_sub('iadb-firsttrusted', '127.0.2.2')
describe RCVD_IN_IADB_EPIA		IADB: Member of Email Processing Industry Alliance
tflags RCVD_IN_IADB_EPIA		net nice
endif
##} RCVD_IN_IADB_EPIA ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_GOODMAIL ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_GOODMAIL		eval:check_rbl_sub('iadb-firsttrusted', '127.2.255.103')
describe RCVD_IN_IADB_GOODMAIL		IADB: Sender has been certified by GoodMail
tflags RCVD_IN_IADB_GOODMAIL 		net nice
endif
##} RCVD_IN_IADB_GOODMAIL ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_LISTED ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_LISTED		eval:check_rbl_sub('iadb-firsttrusted', '^127\.0\.0\.[12]$')
describe RCVD_IN_IADB_LISTED		Participates in the IADB system
tflags RCVD_IN_IADB_LISTED		net nice
endif
##} RCVD_IN_IADB_LISTED ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_LOOSE ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_LOOSE		eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.4')
describe RCVD_IN_IADB_LOOSE		IADB: Adds relationship addrs w/out opt-in
tflags RCVD_IN_IADB_LOOSE		net nice
endif
##} RCVD_IN_IADB_LOOSE ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_MI_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_MI_CPEAR		eval:check_rbl_sub('iadb-firsttrusted', '127.101.1.10')
describe RCVD_IN_IADB_MI_CPEAR		IADB: Complies with Michigan's CPEAR law
tflags RCVD_IN_IADB_MI_CPEAR		net nice
endif
##} RCVD_IN_IADB_MI_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_MI_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_MI_CPR_30		eval:check_rbl_sub('iadb-firsttrusted', '127.101.101.10')
describe RCVD_IN_IADB_MI_CPR_30		IADB: Checked lists against Michigan's CPR within 30 days
tflags RCVD_IN_IADB_MI_CPR_30		net nice
endif
##} RCVD_IN_IADB_MI_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_MI_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_MI_CPR_MAT		eval:check_rbl_sub('iadb-firsttrusted', '127.101.201.10')
describe RCVD_IN_IADB_MI_CPR_MAT	IADB: Sends no material under Michigan's CPR
tflags RCVD_IN_IADB_MI_CPR_MAT		net nice
endif
##} RCVD_IN_IADB_MI_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_ML_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_ML_DOPTIN		eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.100')
describe RCVD_IN_IADB_ML_DOPTIN		IADB: Mailing list email only, confirmed opt-in
tflags RCVD_IN_IADB_ML_DOPTIN		net nice
endif
##} RCVD_IN_IADB_ML_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_NOCONTROL ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_NOCONTROL		eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.0')
describe RCVD_IN_IADB_NOCONTROL		IADB: Has absolutely no mailing controls in place
tflags RCVD_IN_IADB_NOCONTROL		net nice
endif
##} RCVD_IN_IADB_NOCONTROL ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_OOO ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_OOO			eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.200')
describe RCVD_IN_IADB_OOO		IADB: One-to-one/transactional email only
tflags RCVD_IN_IADB_OOO			net nice
endif
##} RCVD_IN_IADB_OOO ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_OPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_OPTIN		eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.7')
describe RCVD_IN_IADB_OPTIN		IADB: All mailing list mail is opt-in
tflags RCVD_IN_IADB_OPTIN		net nice
endif
##} RCVD_IN_IADB_OPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_OPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_OPTIN_GT50		eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.6')
describe RCVD_IN_IADB_OPTIN_GT50	IADB: Opt-in used more than 50% of the time
tflags RCVD_IN_IADB_OPTIN_GT50		net nice
endif
##} RCVD_IN_IADB_OPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_OPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_OPTIN_LT50		eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.5')
describe RCVD_IN_IADB_OPTIN_LT50	IADB: Opt-in used less than 50% of the time
tflags RCVD_IN_IADB_OPTIN_LT50		net nice
endif
##} RCVD_IN_IADB_OPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_OPTOUTONLY ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_OPTOUTONLY		eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.1')
describe RCVD_IN_IADB_OPTOUTONLY 	IADB: Scrapes addresses, pure opt-out only
tflags RCVD_IN_IADB_OPTOUTONLY		net nice
endif
##} RCVD_IN_IADB_OPTOUTONLY ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_RDNS ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_RDNS		eval:check_rbl_sub('iadb-firsttrusted', '127.2.255.4')
describe RCVD_IN_IADB_RDNS		IADB: Sender has reverse DNS record
tflags RCVD_IN_IADB_RDNS		net nice
endif
##} RCVD_IN_IADB_RDNS ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_SENDERID ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_SENDERID		eval:check_rbl_sub('iadb-firsttrusted', '127.2.255.2')
describe RCVD_IN_IADB_SENDERID		IADB: Sender publishes Sender ID record
tflags RCVD_IN_IADB_SENDERID		net nice
endif
##} RCVD_IN_IADB_SENDERID ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_SPF ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_SPF			eval:check_rbl_sub('iadb-firsttrusted', '127.2.255.1')
describe RCVD_IN_IADB_SPF		IADB: Sender publishes SPF record
tflags RCVD_IN_IADB_SPF			net nice
endif
##} RCVD_IN_IADB_SPF ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_UNVERIFIED_1 ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_UNVERIFIED_1	eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.2')
describe RCVD_IN_IADB_UNVERIFIED_1	IADB: Accepts unverified sign-ups
tflags RCVD_IN_IADB_UNVERIFIED_1	net nice
endif
##} RCVD_IN_IADB_UNVERIFIED_1 ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_UNVERIFIED_2 ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_UNVERIFIED_2	eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.3')
describe RCVD_IN_IADB_UNVERIFIED_2	IADB: Accepts unverified sign-ups, gives chance to opt out
tflags RCVD_IN_IADB_UNVERIFIED_2	net nice
endif
##} RCVD_IN_IADB_UNVERIFIED_2 ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_UT_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_UT_CPEAR		eval:check_rbl_sub('iadb-firsttrusted', '127.101.2.10')
describe RCVD_IN_IADB_UT_CPEAR		IADB: Complies with Utah's CPEAR law
tflags RCVD_IN_IADB_UT_CPEAR		net nice
endif
##} RCVD_IN_IADB_UT_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_UT_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_UT_CPR_30		eval:check_rbl_sub('iadb-firsttrusted', '127.101.102.10')
describe RCVD_IN_IADB_UT_CPR_30		IADB: Checked lists against Utah's CPR within 30 days
tflags RCVD_IN_IADB_UT_CPR_30		net nice
endif
##} RCVD_IN_IADB_UT_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_UT_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_UT_CPR_MAT		eval:check_rbl_sub('iadb-firsttrusted', '127.101.202.10')
describe RCVD_IN_IADB_UT_CPR_MAT	IADB: Sends no material under Utah's CPR
tflags RCVD_IN_IADB_UT_CPR_MAT		net nice
endif
##} RCVD_IN_IADB_UT_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_PSBL

header   RCVD_IN_PSBL  eval:check_rbl('psbl-lastexternal', 'psbl.surriel.com.')
describe RCVD_IN_PSBL  Received via a relay in PSBL
tflags   RCVD_IN_PSBL  net
##} RCVD_IN_PSBL

##{ RCVD_IN_RP_CERTIFIED

header RCVD_IN_RP_CERTIFIED     eval:check_rbl_txt('ssc-firsttrusted', 'sa-trusted.bondedsender.org.')
describe RCVD_IN_RP_CERTIFIED   Sender is in Return Path Certified (trusted relay)
tflags RCVD_IN_RP_CERTIFIED     net nice
##} RCVD_IN_RP_CERTIFIED

##{ RCVD_IN_RP_RNBL

header RCVD_IN_RP_RNBL         eval:check_rbl('rnbl-lastexternal','bl.score.senderscore.com.')
describe RCVD_IN_RP_RNBL       Relay in RNBL, https://senderscore.org/blacklistlookup/
tflags RCVD_IN_RP_RNBL         net
##} RCVD_IN_RP_RNBL

##{ RCVD_IN_RP_SAFE

header RCVD_IN_RP_SAFE     eval:check_rbl_txt('ssc-firsttrusted','sa-accredit.habeas.com.')
describe RCVD_IN_RP_SAFE   Sender is in Return Path Safe (trusted relay)
tflags RCVD_IN_RP_SAFE     net nice
##} RCVD_IN_RP_SAFE

##{ RCVD_MAIL_COM

header RCVD_MAIL_COM        Received =~ /[\s\(\[](?:post|mail)\.com[\s\)\]]/is
describe RCVD_MAIL_COM      Forged Received header (contains post.com or mail.com)
##} RCVD_MAIL_COM

##{ RDNS_LOCALHOST

header         RDNS_LOCALHOST  X-Spam-Relays-External =~ /^\[ ip=(?!127)\d+\.\d+\.\d+\.\d+ rdns=localhost(?:\.localdomain)? /i
describe       RDNS_LOCALHOST  Sender's public rDNS is "localhost"
##} RDNS_LOCALHOST

##{ REPLYTO_WITHOUT_TO_CC

meta REPLYTO_WITHOUT_TO_CC     (__REPLYTO_EXISTS && !__TOCC_EXISTS)
##} REPLYTO_WITHOUT_TO_CC

##{ RISK_FREE

meta     RISK_FREE      __FRAUD_IOV && !__UNSUB_LINK && !__VIA_ML && !__HTML_LINK_IMAGE && !__SUBSCRIPTION_INFO && !__HS_SUBJ_RE_FW
describe RISK_FREE      No risk!
##} RISK_FREE

##{ RP_8BIT

header   RP_8BIT	Return-Path:raw =~ /[^\000-\177]/
describe RP_8BIT	Return-Path contains 8-bit characters with high bit on
##} RP_8BIT

##{ S25R_4

describe S25R_4 T_S25R: Bottom of rDNS ends w/ num, next lvl has num-num
meta	 S25R_4 __S25R_4 && !(__S25R_1||__S25R_2||__S25R_3||__S25R_5||__S25R_6 || __NOT_SPOOFED || __GREYLISTING)
##} S25R_4

##{ SB_GIF_AND_NO_URIS

meta SB_GIF_AND_NO_URIS (__GIF_ATTACH&&!__HAS_ANY_URI&&!__HAS_ANY_EMAIL)
##} SB_GIF_AND_NO_URIS

##{ SHORT_HELO_AND_INLINE_IMAGE

meta SHORT_HELO_AND_INLINE_IMAGE     (__HELO_NO_DOMAIN && __ANY_IMAGE_ATTACH)
describe SHORT_HELO_AND_INLINE_IMAGE    Short HELO string, with inline image
##} SHORT_HELO_AND_INLINE_IMAGE

##{ SHORT_TERM_PRICE

body SHORT_TERM_PRICE /short\W+term\W+(target|projected)(\W+price)?/i
##} SHORT_TERM_PRICE

##{ SINGLE_HEADER_2K

header   SINGLE_HEADER_2K	ALL:raw =~ /(?-xim:(?=(?:^|\n)[^\s\n]+:(?:.(?!\n\S)){2048,3071}.(?:\n\S|$)))/s
describe SINGLE_HEADER_2K	A single header contains 2K-3K characters
##} SINGLE_HEADER_2K

##{ SINGLE_HEADER_3K

header   SINGLE_HEADER_3K	ALL:raw =~ /(?-xim:(?=(?:^|\n)[^\s\n]+:(?:.(?!\n\S)){3072,4095}.(?:\n\S|$)))/s
describe SINGLE_HEADER_3K	A single header contains 3K-4K characters
##} SINGLE_HEADER_3K

##{ SINGLE_HEADER_4K

header   SINGLE_HEADER_4K	ALL:raw =~ /(?-xim:(?=(?:^|\n)[^\s\n]+:(?:.(?!\n\S)){4096,5119}.(?:\n\S|$)))/s
describe SINGLE_HEADER_4K	A single header contains 4K-5K characters
##} SINGLE_HEADER_4K

##{ SPAMMY_XMAILER

meta SPAMMY_XMAILER (__XM_OL_28001441||__XM_OL_48072300||__XM_OL_28004682||__XM_OL_10_0_4115||__XM_OL_4_72_2106_4)
describe SPAMMY_XMAILER X-Mailer string is common in spam and not in ham
##} SPAMMY_XMAILER

##{ STOCK_IMG_CTYPE

meta STOCK_IMG_CTYPE (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__CTYPE_ONETAB_GIF&&__HTML_IMG_ONLY)
describe STOCK_IMG_CTYPE  Stock spam image part, with distinctive Content-Type header
##} STOCK_IMG_CTYPE

##{ STOCK_IMG_HDR_FROM

meta STOCK_IMG_HDR_FROM  (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__TVD_FW_GRAPHIC_ID1&&__HTML_IMG_ONLY)
describe STOCK_IMG_HDR_FROM Stock spam image part, with distinctive From line
##} STOCK_IMG_HDR_FROM

##{ STOCK_IMG_HTML

meta STOCK_IMG_HTML  (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__PART_STOCK_CID&&__HTML_IMG_ONLY)
describe STOCK_IMG_HTML   Stock spam image part, with distinctive HTML
##} STOCK_IMG_HTML

##{ STOCK_IMG_OUTLOOK

meta STOCK_IMG_OUTLOOK  (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__XM_MS_IN_GENERAL&&__HTML_LENGTH_1536_2048)
describe STOCK_IMG_OUTLOOK  Stock spam image part, with Outlook-like features
##} STOCK_IMG_OUTLOOK

##{ STOCK_PRICES

meta STOCK_PRICES (SHORT_TERM_PRICE && LONG_TERM_PRICE)
##} STOCK_PRICES

##{ STOX_AND_PRICE

meta STOX_AND_PRICE     CURR_PRICE && STOX_REPLY_TYPE
##} STOX_AND_PRICE

##{ STOX_REPLY_TYPE

header STOX_REPLY_TYPE  Content-Type =~ /text\/plain; .* reply-type=original/
##} STOX_REPLY_TYPE

##{ STOX_REPLY_TYPE_WITHOUT_QUOTES

meta STOX_REPLY_TYPE_WITHOUT_QUOTES (STOX_REPLY_TYPE && !(__HS_SUBJ_RE_FW || __HS_QUOTE))
##} STOX_REPLY_TYPE_WITHOUT_QUOTES

##{ STYLE_GIBBERISH

meta           STYLE_GIBBERISH          __STYLE_GIBBERISH && !__THREADED && !__MIME_QP && !__RCD_RDNS_MAIL_MESSY && !MPART_ALT_DIFF
##} STYLE_GIBBERISH

##{ SUBJECT_NEEDS_ENCODING

meta SUBJECT_NEEDS_ENCODING    (!__SUBJECT_ENCODED_B64 && !__SUBJECT_ENCODED_QP) && __SUBJECT_NEEDS_MIME
##} SUBJECT_NEEDS_ENCODING

##{ TAB_IN_FROM

header		TAB_IN_FROM		From:raw =~ /^\t/s
describe	TAB_IN_FROM		From starts with a tab
##} TAB_IN_FROM

##{ TBIRD_SUSP_MIME_BDRY

meta           TBIRD_SUSP_MIME_BDRY  __MUA_TBIRD && __TB_MIME_BDRY_NO_Z
describe       TBIRD_SUSP_MIME_BDRY  Unlikely Thunderbird MIME boundary
##} TBIRD_SUSP_MIME_BDRY

##{ THEBAT_UNREG

header  THEBAT_UNREG  X-Mailer =~ /^The Bat! .{0,20} UNREG$/
##} THEBAT_UNREG

##{ TINY_FLOAT

rawbody        TINY_FLOAT         /\bstyle\s*=\s*"[^"]{0,40}?(?:(?:FONT-SIZE\s*:\s+\dpx|FLOAT\s*:\s+(?:right|left))(?:;\s+)?(?:(?!(?:FONT-SIZE|FLOAT))\w+:\s+\w+;?\s*)*){2}/i
describe       TINY_FLOAT         Has small-font floating HTML - text obfuscation?
#score          TINY_FLOAT         2.00
##} TINY_FLOAT

##{ TO_EQ_FM_DIRECT_MX

meta           TO_EQ_FM_DIRECT_MX   __TO_EQ_FM_DIRECT_MX && !__THREAD_INDEX_GOOD && !__IS_EXCH
describe       TO_EQ_FM_DIRECT_MX   To == From and direct-to-MX
##} TO_EQ_FM_DIRECT_MX

##{ TO_EQ_FM_DOM_HTML_IMG

meta           TO_EQ_FM_DOM_HTML_IMG    __TO_EQ_FM_DOM_HTML_IMG && !__CTYPE_MULTIPART_ALT && !ALL_TRUSTED && !__MIME_QP && !__IS_EXCH && !__BUGGED_IMG && !__UNSUB_LINK && !__COMMENT_EXISTS && !__FM_TO_ALL_NUMS
describe       TO_EQ_FM_DOM_HTML_IMG    To domain == From domain and HTML image link
##} TO_EQ_FM_DOM_HTML_IMG

##{ TO_EQ_FM_DOM_HTML_ONLY

meta           TO_EQ_FM_DOM_HTML_ONLY   __TO_EQ_FM_DOM_HTML_ONLY && !__CTYPE_MULTIPART_ALT && !HTML_MIME_NO_HTML_TAG && !ALL_TRUSTED && !__MIME_QP && !__IS_EXCH && !__MSGID_BEFORE_RECEIVED && !__RCD_RDNS_MAIL_MESSY && !__FM_TO_ALL_NUMS
describe       TO_EQ_FM_DOM_HTML_ONLY   To domain == From domain and HTML only
##} TO_EQ_FM_DOM_HTML_ONLY

##{ TO_EQ_FM_DOM_SPF_FAIL

meta           TO_EQ_FM_DOM_SPF_FAIL    __TO_EQ_FM_DOM_SPF_FAIL && !__THREADED && !ALL_TRUSTED
describe       TO_EQ_FM_DOM_SPF_FAIL    To domain == From domain and external SPF failed
tflags         TO_EQ_FM_DOM_SPF_FAIL    net
##} TO_EQ_FM_DOM_SPF_FAIL

##{ TO_EQ_FM_HTML_DIRECT

meta           TO_EQ_FM_HTML_DIRECT  __TO_EQ_FM_HTML_DIRECT && !__HUSH_HUSH
describe       TO_EQ_FM_HTML_DIRECT  To == From and HTML only, direct-to-MX
##} TO_EQ_FM_HTML_DIRECT

##{ TO_EQ_FM_HTML_ONLY

meta           TO_EQ_FM_HTML_ONLY   __TO_EQ_FM_HTML_ONLY && !ALL_TRUSTED && !__RCD_RDNS_MAIL_MESSY && !__DOS_LINK && !__NOT_SPOOFED && !__DKIM_EXISTS
describe       TO_EQ_FM_HTML_ONLY   To == From and HTML only
##} TO_EQ_FM_HTML_ONLY

##{ TO_EQ_FM_SPF_FAIL

meta           TO_EQ_FM_SPF_FAIL    __TO_EQ_FM_SPF_FAIL && !__THREADED && !ALL_TRUSTED
describe       TO_EQ_FM_SPF_FAIL    To == From and external SPF failed
tflags         TO_EQ_FM_SPF_FAIL    net
##} TO_EQ_FM_SPF_FAIL

##{ TO_IN_SUBJ

meta           TO_IN_SUBJ           __SUBJ_HAS_TO_1 && !__VIA_ML && !MISSING_MIMEOLE && !__THREAD_INDEX_GOOD
describe       TO_IN_SUBJ           To address is in Subject
##} TO_IN_SUBJ

##{ TO_NO_BRKTS_DYNIP

meta       TO_NO_BRKTS_DYNIP       __TO_NO_BRKTS_DYNIP && !__NAME_IS_EMAIL && !__MSGID_OK_HEX && !__UNSUB_LINK && !__THREADED && !__RCD_RDNS_MX_MESSY && !__COMMENT_EXISTS && !__MUA_TBIRD && !__CD && !__ML1 && !__RP_MATCHES_RCVD
describe   TO_NO_BRKTS_DYNIP       To: misformatted and dynamic rDNS
##} TO_NO_BRKTS_DYNIP

##{ TO_NO_BRKTS_FROM_MSSP

meta       TO_NO_BRKTS_FROM_MSSP     __TO_NO_BRKTS_FROM_MSSP && !__RCD_RDNS_MTA_MESSY && !__CTYPE_MULTIPART_ALT && !__REPTO_QUOTE && !__MIME_QP && !__TO___LOWER && !__BUGGED_IMG && !__SUBJECT_ENCODED_QP && !__VIA_ML && !__FR_SPACING_8 && !__TAG_EXISTS_CENTER
#score      TO_NO_BRKTS_FROM_MSSP     1.00
describe   TO_NO_BRKTS_FROM_MSSP     Multiple formatting errors
##} TO_NO_BRKTS_FROM_MSSP

##{ TO_NO_BRKTS_HTML_ONLY

meta       TO_NO_BRKTS_HTML_ONLY   __TO_NO_BRKTS_HTML_ONLY && !__MIME_QP && !__MSGID_JAVAMAIL && !__CTYPE_CHARSET_QUOTED && !__SUBJECT_ENCODED_B64 && !__VIA_ML && !__MSGID_BEFORE_RECEIVED && !__MIME_BASE64 && !__RCD_RDNS_MAIL_MESSY && !__COMMENT_EXISTS && !LOTS_OF_MONEY && !__TAG_EXISTS_CENTER && !__UPPERCASE_URI && !__UNSUB_LINK && !__RCD_RDNS_MX_MESSY && !__DKIM_EXISTS && !__BUGGED_IMG && !__FM_TO_ALL_NUMS && !__URI_12LTRDOM && !__RDNS_NO_SUBDOM && !__HDRS_LCASE
#score      TO_NO_BRKTS_HTML_ONLY   0.20
describe   TO_NO_BRKTS_HTML_ONLY   To: misformatted and HTML only
##} TO_NO_BRKTS_HTML_ONLY

##{ TO_NO_BRKTS_MSFT

meta       TO_NO_BRKTS_MSFT         __TO_NO_BRKTS_MSFT && !__VIA_ML && !__LYRIS_EZLM_REMAILER && !__THREAD_INDEX_GOOD && !__IS_EXCH && !__UNSUB_LINK && !__NOT_SPOOFED && !__DOS_HAS_LIST_UNSUB && !__NAME_EQ_EMAIL
describe   TO_NO_BRKTS_MSFT         To: misformatted and supposed Microsoft tool
#score      TO_NO_BRKTS_MSFT         0.20
##} TO_NO_BRKTS_MSFT

##{ TO_NO_BRKTS_NORDNS

meta       TO_NO_BRKTS_NORDNS      __TO_NO_BRKTS_NORDNS && !__MANY_RECIPS && !__FROM_RUNON && !__VIA_ML && !__TO___LOWER && !ALL_TRUSTED && !__COMMENT_EXISTS && !__DOS_HAS_LIST_UNSUB && !__OE_MSGID_1
#score      TO_NO_BRKTS_NORDNS      0.20
describe   TO_NO_BRKTS_NORDNS      To: misformatted and no rDNS
##} TO_NO_BRKTS_NORDNS

##{ TO_NO_BRKTS_NORDNS_HTML

meta       TO_NO_BRKTS_NORDNS_HTML      __TO_NO_BRKTS_NORDNS_HTML && !ALL_TRUSTED && !__MSGID_JAVAMAIL && !__MSGID_BEFORE_RECEIVED && !__VIA_ML && !__UA_MUTT && !__FROM_FREEMAIL && !__COMMENT_EXISTS && !__HTML_LENGTH_384 && !__MIME_BASE64 && !__UPPERCASE_URI && !__TO___LOWER && !__BUGGED_IMG && !__TAG_EXISTS_CENTER
#score      TO_NO_BRKTS_NORDNS_HTML      0.20
describe   TO_NO_BRKTS_NORDNS_HTML      To: misformatted and no rDNS and HTML only
##} TO_NO_BRKTS_NORDNS_HTML

##{ TT_MSGID_TRUNC

header TT_MSGID_TRUNC   Message-Id =~ /^\s*<?[^<>\s]+\[\d+$/
describe TT_MSGID_TRUNC Scora: Message-Id ends after left-bracket + digits
##} TT_MSGID_TRUNC

##{ TT_OBSCURED_VALIUM

meta TT_OBSCURED_VALIUM         ( __TT_BROKEN_VALIUM || __TT_OBSCURED_VALIUM ) && ! __TT_VALIUM
describe TT_OBSCURED_VALIUM     Scora: obscured "VALIUM" in subject
##} TT_OBSCURED_VALIUM

##{ TT_OBSCURED_VIAGRA

meta TT_OBSCURED_VIAGRA         ( __TT_BROKEN_VIAGRA || __TT_OBSCURED_VIAGRA ) && ! __TT_VIAGRA
describe TT_OBSCURED_VIAGRA     Scora: obscured "VIAGRA" in subject
##} TT_OBSCURED_VIAGRA

##{ TVD_ACT_193

body TVD_ACT_193		/\bact of (?:193|nineteen thirty)/i
##} TVD_ACT_193

##{ TVD_APPROVED

body TVD_APPROVED		/you.{1,2}re .{0,20}approved/i
##} TVD_APPROVED

##{ TVD_DEAR_HOMEOWNER

body TVD_DEAR_HOMEOWNER		/^dear homeowner/i
##} TVD_DEAR_HOMEOWNER

##{ TVD_DOLLARS_US

body TVD_DOLLARS_US /\s\d[\d.,]+US/
##} TVD_DOLLARS_US

##{ TVD_EB_PHISH

meta TVD_EB_PHISH	__FROM_EBAY && NORMAL_HTTP_TO_IP
##} TVD_EB_PHISH

##{ TVD_ENVFROM_APOST

header TVD_ENVFROM_APOST	EnvelopeFrom =~ /\'/
##} TVD_ENVFROM_APOST

##{ TVD_FINGER_02

header TVD_FINGER_02	Content-Type =~ /^text\/plain(?:; (?:format=flowed|charset="Windows-1252"|reply-type=original)){3}/i
##} TVD_FINGER_02

##{ TVD_FLOAT_GENERAL

rawbody TVD_FLOAT_GENERAL	/\bstyle\s*=\s*"[^"]*\bfloat\s*:\s*[a-z]+\s*">\s*[a-zA-Z]+\s*</i
##} TVD_FLOAT_GENERAL

##{ TVD_FROM_1

header TVD_FROM_1	From:addr =~ /[^\@0-9]{2}\d{3}\.(?:com|net|org|info|biz)$/i
##} TVD_FROM_1

##{ TVD_FUZZY_DEGREE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body TVD_FUZZY_DEGREE	/<inter W1><post P1>\b(?!degree)<D><E><G><R><E><E>\b/i
endif
##} TVD_FUZZY_DEGREE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ TVD_FUZZY_FINANCE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body TVD_FUZZY_FINANCE	/(?!finance)<F><I><N><A><N><C><E>/i
endif
##} TVD_FUZZY_FINANCE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ TVD_FUZZY_FIXED_RATE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body TVD_FUZZY_FIXED_RATE	/<inter W2><post P2>(?!fixed rate)<F><I><X><E><D>\s+<R><A><T><E>/i
endif
##} TVD_FUZZY_FIXED_RATE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ TVD_FUZZY_MICROCAP ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body TVD_FUZZY_MICROCAP	/<inter W2><post P2>(?!microcap)(?!micro-cap)<M><I><C><R><O>-?<C><A><P>/i
endif
##} TVD_FUZZY_MICROCAP ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ TVD_FUZZY_PHARMACEUTICAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body TVD_FUZZY_PHARMACEUTICAL	/<inter W2><post P2>(?!pharmaceutical)<P><H><A><R><M><A><C><E><U><T><I><C><A><L>/i
endif
##} TVD_FUZZY_PHARMACEUTICAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ TVD_FUZZY_SYMBOL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body TVD_FUZZY_SYMBOL	/<inter W2><post P2>(?!symbol)<S><Y><M><B><O><L>/i
endif
##} TVD_FUZZY_SYMBOL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ TVD_FW_GRAPHIC_NAME_LONG ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader TVD_FW_GRAPHIC_NAME_LONG	Content-Type =~ /\bname="[a-z]{8,}\.gif/
endif
##} TVD_FW_GRAPHIC_NAME_LONG ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ TVD_FW_GRAPHIC_NAME_MID ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader TVD_FW_GRAPHIC_NAME_MID	Content-Type =~ /\bname="[a-z]{6,7}\.gif/
endif
##} TVD_FW_GRAPHIC_NAME_MID ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ TVD_INCREASE_SIZE

body TVD_INCREASE_SIZE		/\bsize of .{1,20}(?:penis|dick|manhood)/i
##} TVD_INCREASE_SIZE

##{ TVD_LINK_SAVE

body TVD_LINK_SAVE		/\blink to save\b/i
##} TVD_LINK_SAVE

##{ TVD_PH_BODY_ACCOUNTS_PRE

body TVD_PH_BODY_ACCOUNTS_PRE	/\baccounts? (?:[a-z_,-]+ )+?(?:record[a-z]*|suspen[a-z]+|notif(?:y|ication)|updated|verifications?|credited)\b/i
##} TVD_PH_BODY_ACCOUNTS_PRE

##{ TVD_PH_BODY_META

meta TVD_PH_BODY_META		__TVD_PH_BODY_01 || __TVD_PH_BODY_02 || __TVD_PH_BODY_03 || __TVD_PH_BODY_04 || __TVD_PH_BODY_05 || __TVD_PH_BODY_06 || __TVD_PH_BODY_07 || __TVD_PH_BODY_08
##} TVD_PH_BODY_META

##{ TVD_PH_REC

body TVD_PH_REC		/\byour .{0,40}account .{0,40}record/i
describe TVD_PH_REC	Message has a phrase standard for phishing mails
##} TVD_PH_REC

##{ TVD_PH_SEC

body TVD_PH_SEC		/\byour .{0,40}account .{0,40}security/i
describe TVD_PH_SEC	Message has a phrase standard for phishing mails
##} TVD_PH_SEC

##{ TVD_PH_SUBJ_ACCOUNTS_POST

header TVD_PH_SUBJ_ACCOUNTS_POST	Subject =~ /\b(?:(?:re-?)?activat[a-z]*|secure|verify|restore|flagged|limited|unusual|update|report|notif(?:y|ication)|suspen(?:d|ded|sion)|co(?:n|m)firm[a-z]*) (?:[a-z_,-]+ )*?accounts?\b/i
##} TVD_PH_SUBJ_ACCOUNTS_POST

##{ TVD_PH_SUBJ_SEC_MEASURES

header TVD_PH_SUBJ_SEC_MEASURES		Subject =~ /\bsecurity (?:[a-z_,-]+ )*?measures?\b/i
##} TVD_PH_SUBJ_SEC_MEASURES

##{ TVD_PH_SUBJ_URGENT

header TVD_PH_SUBJ_URGENT		Subject =~ /^urgent(?:[\s\W]*$|.{1,40}(?:alert|response|assistance|proposal|reply|warning|noti(?:ce|fication)|greeting|matter))/i
##} TVD_PH_SUBJ_URGENT

##{ TVD_PP_PHISH

meta TVD_PP_PHISH	__FROM_PAYPAL && NORMAL_HTTP_TO_IP
##} TVD_PP_PHISH

##{ TVD_QUAL_MEDS

body TVD_QUAL_MEDS		/\bquality med(?:ication)?s\b/i
##} TVD_QUAL_MEDS

##{ TVD_RATWARE_CB

header TVD_RATWARE_CB		Content-Type =~ /\bboundary\b.{1,40}qzsoft_directmail_seperator/i
##} TVD_RATWARE_CB

##{ TVD_RATWARE_CB_2

header TVD_RATWARE_CB_2		Content-Type =~ /\bboundary\s*=\s*"?-+\d+=+\.MRA/
##} TVD_RATWARE_CB_2

##{ TVD_RATWARE_MSGID_02

header TVD_RATWARE_MSGID_02	Message-ID =~ /^[^<]*<[a-z]+\@/
##} TVD_RATWARE_MSGID_02

##{ TVD_RCVD_IP

header TVD_RCVD_IP  Received =~ /^from\s+(?:\d+[^0-9a-zA-Z\s]){3}\d+[.\s]/
##} TVD_RCVD_IP

##{ TVD_RCVD_IP4

header TVD_RCVD_IP4 Received =~ /^from\s+(?:\d+\.){3}\d+\s/
##} TVD_RCVD_IP4

##{ TVD_RCVD_SINGLE

header TVD_RCVD_SINGLE Received =~ /^from\s+(?!localhost)[^\s.a-z0-9-]+\s/
##} TVD_RCVD_SINGLE

##{ TVD_RCVD_SPACE_BRACKET

header TVD_RCVD_SPACE_BRACKET Received =~ /\(\[(?!UNIX:)[^\[\]]*\s/
##} TVD_RCVD_SPACE_BRACKET

##{ TVD_SECTION

body TVD_SECTION		/\bSection (?:27A|21B)/i
##} TVD_SECTION

##{ TVD_SILLY_URI_OBFU

body TVD_SILLY_URI_OBFU		m!https?://[a-z0-9-]+\.[a-z0-9-]*\.?[^a-z0-9.:/\s"'\@?\)>-]+[a-z0-9.-]*[a-z]{3}(?:\s|$)!i
##} TVD_SILLY_URI_OBFU

##{ TVD_SPACED_SUBJECT_WORD3

header TVD_SPACED_SUBJECT_WORD3	Subject =~ /^(?:(?:Re|Fw)[^:]{0,5}: )?[A-Z]+[a-z]+[A-Z]+$/
##} TVD_SPACED_SUBJECT_WORD3

##{ TVD_STOCK1 ifplugin Mail::SpamAssassin::Plugin::BodyEval

ifplugin Mail::SpamAssassin::Plugin::BodyEval
body TVD_STOCK1    eval:check_stock_info('2')
endif
##} TVD_STOCK1 ifplugin Mail::SpamAssassin::Plugin::BodyEval

##{ TVD_SUBJ_ACC_NUM

header	TVD_SUBJ_ACC_NUM	Subject =~ /\b[a-zA-Z]+ [\#\s]{1,4}\d+[A-Z]+/
describe TVD_SUBJ_ACC_NUM	Subject has spammy looking monetary reference
##} TVD_SUBJ_ACC_NUM

##{ TVD_SUBJ_FINGER_03

header TVD_SUBJ_FINGER_03	Subject =~ /^\s*\*\s+(?:\w+\W+)+\*\s*$/
##} TVD_SUBJ_FINGER_03

##{ TVD_SUBJ_OWE

header TVD_SUBJ_OWE Subject =~ /^\s*(?:\w+\s+)+you\s+(?:\w+\s+)*(?:owe|indebted)\s+(?:\w+\s+)+an\s*other/i
##} TVD_SUBJ_OWE

##{ TVD_SUBJ_WIPE_DEBT

header TVD_SUBJ_WIPE_DEBT	Subject =~ /(?:wipe out|remove|get (?:rid|out) of|eradicate) .{0,20}(?:owe|debt|obligation)/i
##} TVD_SUBJ_WIPE_DEBT

##{ TVD_VISIT_PHARMA

body TVD_VISIT_PHARMA		/Online Ph.rmacy/i
##} TVD_VISIT_PHARMA

##{ TVD_VIS_HIDDEN

rawbody TVD_VIS_HIDDEN /<TEXTAREA[^>]+style\s*=\s*"visibility:\s*hidden\b/i
##} TVD_VIS_HIDDEN

##{ T_AXB_MIME_IMG830 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader      T_AXB_MIME_IMG830                 Content-ID =~ /^<[0-9a-f]{30}\@/
describe        T_AXB_MIME_IMG830                 Valpolicella Fingerprint
endif
##} T_AXB_MIME_IMG830 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_DKIM_INVALID ifplugin Mail::SpamAssassin::Plugin::DKIM

ifplugin Mail::SpamAssassin::Plugin::DKIM
  meta	   T_DKIM_INVALID	__DKIM_EXISTS && !DKIM_VALID
  describe T_DKIM_INVALID	DKIM-Signature header exists but is not valid
endif
##} T_DKIM_INVALID ifplugin Mail::SpamAssassin::Plugin::DKIM

##{ T_DOS_OUTLOOK_TO_MX_IMAGE

meta T_DOS_OUTLOOK_TO_MX_IMAGE		__ANY_OUTLOOK_MUA && !__OE_MUA && __DOS_DIRECT_TO_MX && __ANY_IMAGE_ATTACH
describe T_DOS_OUTLOOK_TO_MX_IMAGE	Direct to MX with Outlook headers and an image
##} T_DOS_OUTLOOK_TO_MX_IMAGE

##{ T_DOS_ZIP_HARDCORE ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader    T_DOS_ZIP_HARDCORE        Content-Type =~ /^application\/zip;\sname="hardcore\.zip"$/
  describe      T_DOS_ZIP_HARDCORE        hardcore.zip file attached; quite certainly a virus
#  score         T_DOS_ZIP_HARDCORE        2.5
endif
##} T_DOS_ZIP_HARDCORE ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_DSCL4_PNG ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
  mimeheader T_DSCL4_PNG    Content-Type =~ /name\=\"DS[CL]\d{4,5}\.(?:png|PNG)\"/
  describe   T_DSCL4_PNG		Digital camera filename is PNG
#  score      T_DSCL4_PNG		0.9 # 1.6->0.9 20091019 no recent hits
endif
##} T_DSCL4_PNG ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {

##{ T_EMRCP

body     T_EMRCP            /\bExcess Maximum Return Capital Profit\b/i
describe T_EMRCP            "Excess Maximum Return Capital Profit" Fidelity scam
##} T_EMRCP

##{ T_FILL_THIS_FORM_SHORT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  meta     T_FILL_THIS_FORM_SHORT           __FILL_THIS_FORM_SHORT && !__VIA_ML && !__MSGID_JAVAMAIL
  describe T_FILL_THIS_FORM_SHORT           Fill in a short form with personal information
#  score    T_FILL_THIS_FORM_SHORT           0.25
endif
##} T_FILL_THIS_FORM_SHORT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FORGED_TBIRD_IMG_SIZE ifplugin Mail::SpamAssassin::Plugin::ImageInfo

ifplugin Mail::SpamAssassin::Plugin::ImageInfo
  meta       T_FORGED_TBIRD_IMG_SIZE   __FORGED_TBIRD_IMG && __ONE_IMG && __IMG_LE_300K
  describe   T_FORGED_TBIRD_IMG_SIZE   Likely forged Thunderbird image spam
#  score      T_FORGED_TBIRD_IMG_SIZE   0.8
endif
##} T_FORGED_TBIRD_IMG_SIZE ifplugin Mail::SpamAssassin::Plugin::ImageInfo

##{ T_FREEMAIL_DOC_PDF ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
  meta         T_FREEMAIL_DOC_PDF     (__DOC_ATTACH || __PDF_ATTACH) && (FREEMAIL_FROM || FREEMAIL_REPLYTO)
  describe     T_FREEMAIL_DOC_PDF     MS document or PDF attachment, from freemail
endif
##} T_FREEMAIL_DOC_PDF ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ T_FREEMAIL_RVW_ATTCH ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
  meta         T_FREEMAIL_RVW_ATTCH   (__PLS_REVIEW || __DLND_ATTACH) && T_FREEMAIL_DOC_PDF
  describe     T_FREEMAIL_RVW_ATTCH   Please review attached document, from freemail
endif
##} T_FREEMAIL_RVW_ATTCH ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ T_FRM_SILVER_GOLD ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
meta     T_FRM_SILVER_GOLD        (__FRT_SILVER && __FRT_GOLD)
describe T_FRM_SILVER_GOLD        ReplaceTags: Silver & Gold
endif
##} T_FRM_SILVER_GOLD ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_ABSOLUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_ABSOLUT            /<inter SP2><post P2>\b(?!absolutely)<A><B><SX><O><L><U><TX><E><L><Y>/i
describe T_FRT_ABSOLUT            ReplaceTags: Absolutely
endif
##} T_FRT_ABSOLUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_ADULT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_ADULT2             /<inter W0><post P2>\b(?!adult)<A><D><UX><L><TX>/i
describe T_FRT_ADULT2             ReplaceTags: Adult
endif
##} T_FRT_ADULT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_BEFORE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_BEFORE             /<inter SP2><post P2>\b(?!before)<B><E><F><O><R><E>\b/i
describe T_FRT_BEFORE             ReplaceTags: Before
endif
##} T_FRT_BEFORE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_BELOW2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_BELOW2             /<inter W0><post P2>\b(?!below)<B><E><L><O><WX>\b/i
describe T_FRT_BELOW2             ReplaceTags: Below (2)
endif
##} T_FRT_BELOW2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_CANSPAM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_CANSPAM            /<inter SP2><post P2>\b(?!CAN<SP>SPAM)<C><A><N><SP><SX><P><A><M>/i
describe T_FRT_CANSPAM            ReplaceTags: Can Spam
endif
##} T_FRT_CANSPAM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_CLICK ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_CLICK              /<post P2>\b(?!click)<C><L><IX><C><K>\b/i
describe T_FRT_CLICK              ReplaceTags: Click
endif
##} T_FRT_CLICK ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_COCK ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_COCK               /<inter SP2><post P2>\b(?![cs]ock)<C><O><C><K>/i
describe T_FRT_COCK               ReplaceTags: Cock
endif
##} T_FRT_COCK ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_CONTACT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_CONTACT            /<inter SP2><post P2>\b(?!contr?act)<C><O><N><TX><A><C><TX>/i
describe T_FRT_CONTACT            ReplaceTags: Contact
endif
##} T_FRT_CONTACT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_ERECTION ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_ERECTION           /<inter SP2><post P2>(?!erection)<E><R><E><C><TX><IX><O><N>/i
describe T_FRT_ERECTION           ReplaceTags: Erection
endif
##} T_FRT_ERECTION ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_ESTABLISH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_ESTABLISH          /<inter SP2><post P2>\b(?!estabi?lish)<E><SX><TX><A><B><L><IX><SX><H>/i
describe T_FRT_ESTABLISH          ReplaceTags: Establish
endif
##} T_FRT_ESTABLISH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_EXPERIENCE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_EXPERIENCE         /<inter SP2><post P2>\b(?!exp[e\xe9\xc9]rience)<E><X><P><E><R><IX><E><N><C><E>\b/i
describe T_FRT_EXPERIENCE         ReplaceTags: Experience
endif
##} T_FRT_EXPERIENCE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_FOLLOW1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_FOLLOW1            /<inter SP2><post P2>\b(?!follow)<F><O><L><L><O><WX>/i
describe T_FRT_FOLLOW1            ReplaceTags: Follow
endif
##} T_FRT_FOLLOW1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_FOLLOW2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_FOLLOW2            /<inter W0><post P2>\b(?!follow)<F><O><L><L><O><WX>/i
describe T_FRT_FOLLOW2            ReplaceTags: Follow (2)
endif
##} T_FRT_FOLLOW2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_FREE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_FREE               /<inter SP2><post P2>\b(?!free)<F><R><E><E>\b/i
describe T_FRT_FREE               ReplaceTags: Free
endif
##} T_FRT_FREE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_FRIEND ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_FRIEND             /<inter SP2><post P2>\b(?!friend)<F><R><IX><E><N><D>/i
describe T_FRT_FRIEND             ReplaceTags: Friend
endif
##} T_FRT_FRIEND ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_FUCK1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_FUCK1              /<inter SP2><post P2>\b(?!fuck)<F><U><C><K>/i
describe T_FRT_FUCK1              ReplaceTags: Fuck (1)
endif
##} T_FRT_FUCK1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_HEALTH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_HEALTH             /<inter SP2><post P2>\b(?!health)<H><E><A><L><TX><H>\b/i
describe T_FRT_HEALTH             ReplaceTags: Health
endif
##} T_FRT_HEALTH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_HOUR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_HOUR               /<inter SP2><post P2>\b(?!hour)<H><O><U><R>\b/i
describe T_FRT_HOUR               ReplaceTags: Hour
endif
##} T_FRT_HOUR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_INCOME ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_INCOME             /<inter SP2><post P2>\b(?!income)<IX><N><C><O><M><E>\b/i
describe T_FRT_INCOME             ReplaceTags: Income
endif
##} T_FRT_INCOME ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_INTEREST ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_INTEREST           /<inter SP2><post P2>\b(?!interest)<IX><N><TX><E><R><E><SX><TX>\b/i
describe T_FRT_INTEREST           ReplaceTags: Interest
endif
##} T_FRT_INTEREST ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_LITTLE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_LITTLE             /<inter SP2><post P2>\b(?!little)<L><IX><TX><TX><L><E>/i
describe T_FRT_LITTLE             ReplaceTags: Little
endif
##} T_FRT_LITTLE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_LOLITA1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_LOLITA1            /<inter SP2><post P2>\b(?!lolita)<L><O><L><IX><TX><A>/i
describe T_FRT_LOLITA1            ReplaceTags: Lolita (1)
endif
##} T_FRT_LOLITA1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_OPPORTUN1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_OPPORTUN1          /<inter SP2><post P2>(?!opportun)<O><P><P><O><R><TX><U><N>/i
describe T_FRT_OPPORTUN1          ReplaceTags: Oppertun (1)
endif
##} T_FRT_OPPORTUN1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_PACKAGE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_PACKAGE            /<inter SP2><post P2>\b(?!package)<P><A><C><K><A><GX><E>/i
describe T_FRT_PACKAGE            ReplaceTags: Package
endif
##} T_FRT_PACKAGE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_PAYMENT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_PAYMENT            /<inter W0>\b(?!payment)<P><A><Y><M><E><N><TX>/i
describe T_FRT_PAYMENT            ReplaceTags: Payment
endif
##} T_FRT_PAYMENT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_PHARMAC ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_PHARMAC            /<inter W0><post P2>(?!pharma[c\@])<P><H><A><R><M><A><C>/i
describe T_FRT_PHARMAC            ReplaceTags: Pharmac
endif
##} T_FRT_PHARMAC ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_POSSIBLE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_POSSIBLE           /<inter SP2><post P2>\b(?!possible)<P><O><SX><SX><IX><B><L><E>\b/i
describe T_FRT_POSSIBLE           ReplaceTags: Possible
endif
##} T_FRT_POSSIBLE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_PROFILE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_PROFILE1           /<inter SP2><post P2>\b(?!profile)<P><R><O><F><IX><L><E>/i
describe T_FRT_PROFILE1           ReplaceTags: Profile (1)
endif
##} T_FRT_PROFILE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_PROFILE2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_PROFILE2           /<inter W0><post P2>\b(?!profile)<P><R><O><F><IX><L><E>/i
describe T_FRT_PROFILE2           ReplaceTags: Profile (2)
endif
##} T_FRT_PROFILE2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_PROFIT1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_PROFIT1            /<inter SP2><post P2>\b(?!profit)<P><R><O><F><IX><TX>/i
describe T_FRT_PROFIT1            ReplaceTags: Profit (1)
endif
##} T_FRT_PROFIT1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_PROFIT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_PROFIT2            /<inter W0><post P2>\b(?!profit)<P><R><O><F><IX><TX>/i
describe T_FRT_PROFIT2            ReplaceTags: Profit (2)
endif
##} T_FRT_PROFIT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_PUSSY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_PUSSY              /<inter SP2><post P2>\b(?!pussy)<P><U><SX><SX><Y>/i
describe T_FRT_PUSSY              ReplaceTags: Pussy
endif
##} T_FRT_PUSSY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_SLUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_SLUT               /<inter SP2><post P2>\b(?!slut)<SX><L><U><TX>/
describe T_FRT_SLUT               ReplaceTags: Slut
endif
##} T_FRT_SLUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_STOCK1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_STOCK1             /<inter SP2><post P2>\b(?!stock)<SX><TX><O><C><K>/i
describe T_FRT_STOCK1             ReplaceTags: Stock (1)
endif
##} T_FRT_STOCK1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_STOCK2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_STOCK2             /<inter W0><post P2>\b(?!stor?ck)<SX><TX><O><C><K>/i
describe T_FRT_STOCK2             ReplaceTags: Stock (2)
endif
##} T_FRT_STOCK2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_VIRGIN1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_VIRGIN1            /<inter SP2><post P2>(?!virgin)<V><IX><R><GX><IX><N><SX>?\b/i
describe T_FRT_VIRGIN1            ReplaceTags: Virgin (1)
endif
##} T_FRT_VIRGIN1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FSL_FAKE_HOTMAIL_RCVD

#score	T_FSL_FAKE_HOTMAIL_RCVD	0.001
##} T_FSL_FAKE_HOTMAIL_RCVD

##{ T_FUZZY_OPTOUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body           T_FUZZY_OPTOUT             /\b(?!opt.?out)<O><P><T>.?<O><U><T>\b/i
  describe       T_FUZZY_OPTOUT             Obfuscated opt-out text
endif
##} T_FUZZY_OPTOUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FUZZY_SPRM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FUZZY_SPRM	/<inter W1><post P2><S><P><U><R><M>/i
endif
##} T_FUZZY_SPRM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_HK_FAKENAME_MICROSOFT ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM

ifplugin Mail::SpamAssassin::Plugin::SPF
ifplugin Mail::SpamAssassin::Plugin::DKIM
meta		T_HK_FAKENAME_MICROSOFT	__HK_NAME_MICROSOFT && !__HK_HELO_MICROSOFT && !SPF_PASS && !DKIM_VALID_AU
describe	T_HK_FAKENAME_MICROSOFT	From name mentions Microsoft, but not relayed from there
endif
endif
##} T_HK_FAKENAME_MICROSOFT ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM

##{ T_HK_FAKENAME_PAYPAL ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM

ifplugin Mail::SpamAssassin::Plugin::SPF
ifplugin Mail::SpamAssassin::Plugin::DKIM
meta		T_HK_FAKENAME_PAYPAL	__HK_NAME_PAYPAL && !__HK_HELO_PAYPAL && !SPF_PASS && !DKIM_VALID_AU
describe	T_HK_FAKENAME_PAYPAL	From name mentions PayPal, but not relayed from there
endif
endif
##} T_HK_FAKENAME_PAYPAL ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM

##{ T_HK_FAKENAME_YAHOO ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM

ifplugin Mail::SpamAssassin::Plugin::SPF
ifplugin Mail::SpamAssassin::Plugin::DKIM
meta		T_HK_FAKENAME_YAHOO	__HK_NAME_YAHOO && !__HK_HELO_YAHOO && !SPF_PASS && !DKIM_VALID_AU
describe	T_HK_FAKENAME_YAHOO	From name mentions Yahoo, but not relayed from there
endif
endif
##} T_HK_FAKENAME_YAHOO ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::DKIM

##{ T_HK_NAME_DR ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta		T_HK_NAME_DR		__HK_NAME_DR && !FREEMAIL_FROM
endif
##} T_HK_NAME_DR ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ T_HK_NAME_FM_DR ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta		T_HK_NAME_FM_DR		__HK_NAME_DR && FREEMAIL_FROM
endif
##} T_HK_NAME_FM_DR ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ T_HK_NAME_FM_FROM ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta		T_HK_NAME_FM_FROM		__HK_NAME_FROM && FREEMAIL_FROM
endif
##} T_HK_NAME_FM_FROM ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ T_HK_NAME_FM_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta		T_HK_NAME_FM_MR_MRS	__HK_NAME_MR_MRS && FREEMAIL_FROM
endif
##} T_HK_NAME_FM_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ T_HK_NAME_FROM ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta		T_HK_NAME_FROM		__HK_NAME_FROM && !FREEMAIL_FROM
endif
##} T_HK_NAME_FROM ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ T_HK_NAME_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta		T_HK_NAME_MR_MRS		__HK_NAME_MR_MRS && !FREEMAIL_FROM
endif
##} T_HK_NAME_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ T_HK_SPAMMY_FILENAME ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
meta		T_HK_SPAMMY_FILENAME	__HK_SPAMMY_CTFN || __HK_SPAMMY_CDFN
endif
##} T_HK_SPAMMY_FILENAME ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   T_HTML_ATTACH    Content-Type =~ m,text/html;.+\.html?\b,i
  describe     T_HTML_ATTACH    HTML attachment to bypass scanning?
endif
##} T_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_IMAGE_MISMATCH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # { ifplugin Mail::SpamAssassin::Plugin::ImageInfo

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
  ifplugin Mail::SpamAssassin::Plugin::ImageInfo
    meta	T_IMAGE_MISMATCH	(__GIF_ATTACH && !__GIF_EXISTS) || (__PNG_ATTACH && !__PNG_EXISTS) || (__JPEG_ATTACH && !__JPEG_EXISTS)
    describe	T_IMAGE_MISMATCH	Contains wrong image format for MIME header
endif
endif
##} T_IMAGE_MISMATCH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # { ifplugin Mail::SpamAssassin::Plugin::ImageInfo

##{ T_KHOP_FOREIGN_CLICK if ! plugin (Mail::SpamAssassin::Plugin::URIDetail)

if ! plugin (Mail::SpamAssassin::Plugin::URIDetail)
  rawbody    T_KHOP_FOREIGN_CLICK	m{\bhref=[^>]{9,199}>[^<]{0,80}(?:<(?!/a\b)[^>]{0,299}>[^<]{0,80}){0,9}[^<]{0,80}\b(?:cli(?:quez\W|ck\Wa)ici\b|cli(?:cca\W|c\Wa|que\Wa)qu[^<.,a ]|klie?k(?:\Whi?er|ni(?:j|nite)\Wtu[tk]aj)\b)}si
endif
##} T_KHOP_FOREIGN_CLICK if ! plugin (Mail::SpamAssassin::Plugin::URIDetail)

##{ T_LFUZ_PWRMALE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_LFUZ_PWRMALE       /<inter W1><post P2><P><O><W><E><R><M><A><L><E>/i
endif
##} T_LFUZ_PWRMALE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_LOTTO_AGENT_FM

header   T_LOTTO_AGENT_FM   From =~ /(?:claim(?:s|ing)?(?:[\s_.]processing)?|fiducia\w+|dispatch|reimbursement|prize[\s_.]transfer|(?:international|foreign|win+ing)[\s_.]rem+it+ance)[\s_.]?(?:agent|manager|officer|secretary|director|department|dept)/i
describe T_LOTTO_AGENT_FM   Claims Agent
#score    T_LOTTO_AGENT_FM   0.50
##} T_LOTTO_AGENT_FM

##{ T_LOTTO_AGENT_RPLY

header   T_LOTTO_AGENT_RPLY Reply-To =~ /(?:claim(?:s|ing)?(?:[\s_.]processing)?|fiducia\w+|dispatch|reimbursement|prize\stransfer|(?:international|foreign|win+ing)[\s_.]rem+it+ance)[\s_.]?(?:agent|manager|officer|secretary|director|department|dept)/i
describe T_LOTTO_AGENT_RPLY Claims Agent
#score    T_LOTTO_AGENT_RPLY 0.50
##} T_LOTTO_AGENT_RPLY

##{ T_LOTTO_DEPT

body     T_LOTTO_DEPT       /\b(?:claim(?:s|ing)?(?:\sprocessing)?|fiducia\w+|reimbursement|(?:international|foreign|win+ing)(?:\s(?:rem+it+ance|settlement|payment|award))+|payment|award|compensation|lot+ery)(?:\s\w+)?\s?(?:department|dept|unit|group|committee|bureau)/i
describe T_LOTTO_DEPT       Claims Department
#score    T_LOTTO_DEPT       0.50
##} T_LOTTO_DEPT

##{ T_LOTTO_URI

uri      T_LOTTO_URI       /(?:claim(?:s|ing)?(?:[-_]?processing)?|fiducia\w+|reimbursement|(?:international|foreign|win+ing)?[-_]?rem+it+ance|award)[-_]?(?:department|dept|unit|group|committee|office|agent|manager|secretary)/i
describe T_LOTTO_URI       Claims Department
#score    T_LOTTO_URI       0.50
##} T_LOTTO_URI

##{ T_MANY_BIG_LISTS if can(Mail::SpamAssassin::Conf::feature_bug6558_free)

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  meta            T_MANY_BIG_LISTS          __MANY_BIG_LISTS && !HTML_MESSAGE && !__CTYPE_MULTIPART_ANY && !__HS_SUBJ_RE_FW && !__HAS_THREAD_INDEX
  describe        T_MANY_BIG_LISTS          Lots of mailing lists / databases available!
endif
##} T_MANY_BIG_LISTS if can(Mail::SpamAssassin::Conf::feature_bug6558_free)

##{ T_MIME_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  meta        T_MIME_NO_TEXT  (__CTYPE_MULTIPART_ANY && !__ANY_TEXT_ATTACH)
#  score       T_MIME_NO_TEXT  1.00
  describe    T_MIME_NO_TEXT  No text body parts
endif
##} T_MIME_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_MONEY_PERCENT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  meta     T_MONEY_PERCENT    LOTS_OF_MONEY && (__PCT_FOR_YOU || __PCT_OF_PMTS || __FIFTY_FIFTY)
  describe T_MONEY_PERCENT    X% of a lot of money for you
endif
##} T_MONEY_PERCENT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_OBFU_DOC_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   T_OBFU_DOC_ATTACH     Content-Type =~ m,application/octet-stream;.+\.(?:doc|rtf)\b,i
  describe     T_OBFU_DOC_ATTACH     MS Document attachment with generic MIME type
#  score        T_OBFU_DOC_ATTACH     0.25
endif
##} T_OBFU_DOC_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_OBFU_GIF_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   T_OBFU_GIF_ATTACH     Content-Type =~ m,application/octet-stream;.+\.gif\b,i
  describe     T_OBFU_GIF_ATTACH     GIF attachment with generic MIME type
#  score        T_OBFU_GIF_ATTACH     1.50
endif
##} T_OBFU_GIF_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_OBFU_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   T_OBFU_HTML_ATTACH    Content-Type =~ m,application/octet-stream;.+\.html?\b,i
  describe     T_OBFU_HTML_ATTACH    HTML attachment with non-text MIME type
endif
##} T_OBFU_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_OBFU_JPG_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   T_OBFU_JPG_ATTACH     Content-Type =~ m,application/octet-stream;.+\.jpe?g\b,i
  describe     T_OBFU_JPG_ATTACH     JPG attachment with generic MIME type
#  score        T_OBFU_JPG_ATTACH     1.50
endif
##} T_OBFU_JPG_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_OBFU_PDF_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   T_OBFU_PDF_ATTACH     Content-Type =~ m,application/octet-stream;.+\.pdf\b,i
  describe     T_OBFU_PDF_ATTACH     PDF attachment with generic MIME type
#  score        T_OBFU_PDF_ATTACH     0.25
endif
##} T_OBFU_PDF_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_RCVD_IN_SEMBLACK ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header    T_RCVD_IN_SEMBLACK    eval:check_rbl('semblack-lastexternal', 'bl.spameatingmonkey.net')
tflags    T_RCVD_IN_SEMBLACK    net
describe  T_RCVD_IN_SEMBLACK    Received from an IP listed in bl.spameatingmonkey.net
#score     T_RCVD_IN_SEMBLACK    0.1
endif
##} T_RCVD_IN_SEMBLACK ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ T_REMOTE_IMAGE ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
  meta	T_REMOTE_IMAGE	(__HTML_IMG_ONLY || __HTML_LINK_IMAGE) && !(__SUBSCRIPTION_INFO || __VIA_ML || __SENDER_BOT || __ANY_IMAGE_ATTACH)
  describe T_REMOTE_IMAGE	Message contains an external image
endif
##} T_REMOTE_IMAGE ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {

##{ T_RP_MATCHES_RCVD if version >= 3.003000 ifplugin Mail::SpamAssassin::Plugin::WLBLEval

if version >= 3.003000
ifplugin Mail::SpamAssassin::Plugin::WLBLEval
header   T_RP_MATCHES_RCVD  eval:check_mailfrom_matches_rcvd()
describe T_RP_MATCHES_RCVD  Envelope sender domain matches handover relay domain
tflags   T_RP_MATCHES_RCVD  nice
endif
endif
##} T_RP_MATCHES_RCVD if version >= 3.003000 ifplugin Mail::SpamAssassin::Plugin::WLBLEval

##{ T_SHARE_50_50

meta     T_SHARE_50_50     (__SHARE_IT || __AGREED_RATIO) && __FIFTY_FIFTY
describe T_SHARE_50_50     Share the money 50/50
##} T_SHARE_50_50

##{ T_SURBL_MULTI1 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
meta T_SURBL_MULTI1   ((URIBL_JP_SURBL + URIBL_SC_SURBL + URIBL_AB_SURBL + URIBL_OB_SURBL + URIBL_WS_SURBL) > 1)
endif
##} T_SURBL_MULTI1 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

##{ T_SURBL_MULTI2 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
meta T_SURBL_MULTI2   ((URIBL_JP_SURBL + URIBL_SC_SURBL + URIBL_AB_SURBL + URIBL_OB_SURBL + URIBL_WS_SURBL) > 2)
endif
##} T_SURBL_MULTI2 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

##{ T_SURBL_MULTI3 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
meta T_SURBL_MULTI3   ((URIBL_JP_SURBL + URIBL_SC_SURBL + URIBL_AB_SURBL + URIBL_OB_SURBL + URIBL_WS_SURBL) > 3)
endif
##} T_SURBL_MULTI3 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

##{ T_SURBL_MULTI4 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
meta T_SURBL_MULTI4   ((URIBL_JP_SURBL + URIBL_SC_SURBL + URIBL_AB_SURBL + URIBL_OB_SURBL + URIBL_WS_SURBL) > 4)
endif
##} T_SURBL_MULTI4 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

##{ T_TO_NO_BRKTS_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
  meta       T_TO_NO_BRKTS_FREEMAIL    __TO_NO_ARROWS_R && (FREEMAIL_FROM || FREEMAIL_REPLYTO)
#  score      T_TO_NO_BRKTS_FREEMAIL    0.20
endif
##} T_TO_NO_BRKTS_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ T_TVD_FUZZY_SECTOR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_TVD_FUZZY_SECTOR	/(?!sector)<S><E><C><T><O><R>/i
endif
##} T_TVD_FUZZY_SECTOR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_TVD_FUZZY_SECURITIES ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_TVD_FUZZY_SECURITIES	/<inter W2><post P2>(?!securities)<S><E><C><U><R><I><T><I><E><S>/i
endif
##} T_TVD_FUZZY_SECURITIES ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_TVD_FW_GRAPHIC_ID2 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader T_TVD_FW_GRAPHIC_ID2	Content-Id =~ /<(?:[0-9A-F]{8}\.){3}[0-9A-F]{8}/
endif
##} T_TVD_FW_GRAPHIC_ID2 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_TVD_MIME_EPI ifplugin Mail::SpamAssassin::Plugin::MIMEEval

ifplugin Mail::SpamAssassin::Plugin::MIMEEval
body T_TVD_MIME_EPI		eval:check_msg_parse_flags('mime_epilogue_exists')
endif
##} T_TVD_MIME_EPI ifplugin Mail::SpamAssassin::Plugin::MIMEEval

##{ T_TVD_MIME_NO_HEADERS ifplugin Mail::SpamAssassin::Plugin::MIMEEval

ifplugin Mail::SpamAssassin::Plugin::MIMEEval
body T_TVD_MIME_NO_HEADERS	eval:check_msg_parse_flags('missing_mime_headers')
endif
##} T_TVD_MIME_NO_HEADERS ifplugin Mail::SpamAssassin::Plugin::MIMEEval

##{ T_URIBL_BLACK_OVERLAP ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
meta T_URIBL_BLACK_OVERLAP (URIBL_BLACK && (URIBL_AB_SURBL || URIBL_JP_SURBL || URIBL_OB_SURBL || URIBL_WS_SURBL || URIBL_SC_SURBL))
endif
##} T_URIBL_BLACK_OVERLAP ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

##{ T_URIBL_SEM ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
urirhssub T_URIBL_SEM          uribl.spameatingmonkey.net. A 2
body      T_URIBL_SEM          eval:check_uridnsbl('T_URIBL_SEM')
describe  T_URIBL_SEM          Contains a URI listed in uribl.spameatingmonkey.net
tflags    T_URIBL_SEM          net
#score     T_URIBL_SEM          0.1
endif
##} T_URIBL_SEM ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

##{ T_URIBL_SEM_FRESH ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
urirhssub T_URIBL_SEM_FRESH    fresh.spameatingmonkey.net. A 2
body      T_URIBL_SEM_FRESH    eval:check_uridnsbl('T_URIBL_SEM_FRESH')
describe  T_URIBL_SEM_FRESH    Contains a domain registered less than 5 days ago
tflags    T_URIBL_SEM_FRESH    net
#score     T_URIBL_SEM_FRESH    0.1
endif
##} T_URIBL_SEM_FRESH ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

##{ T_URIBL_SEM_FRESH_10 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
urirhssub T_URIBL_SEM_FRESH_10 fresh10.spameatingmonkey.net. A 2
body      T_URIBL_SEM_FRESH_10 eval:check_uridnsbl('T_URIBL_SEM_FRESH_10')
describe  T_URIBL_SEM_FRESH_10 Contains a domain registered less than 10 days ago
tflags    T_URIBL_SEM_FRESH_10 net
#score     T_URIBL_SEM_FRESH_10 0.1
endif
##} T_URIBL_SEM_FRESH_10 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

##{ T_URIBL_SEM_FRESH_15 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
urirhssub T_URIBL_SEM_FRESH_15 fresh15.spameatingmonkey.net. A 2
body      T_URIBL_SEM_FRESH_15 eval:check_uridnsbl('T_URIBL_SEM_FRESH_15')
describe  T_URIBL_SEM_FRESH_15 Contains a domain registered less than 15 days ago
tflags    T_URIBL_SEM_FRESH_15 net
#score     T_URIBL_SEM_FRESH_15 0.1
endif
##} T_URIBL_SEM_FRESH_15 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

##{ T_URIBL_SEM_RED ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
urirhssub T_URIBL_SEM_RED      urired.spameatingmonkey.net. A 2
body      T_URIBL_SEM_RED      eval:check_uridnsbl('T_URIBL_SEM_RED')
describe  T_URIBL_SEM_RED      Contains a URI listed in urired.spameatingmonkey.net
tflags    T_URIBL_SEM_RED      net
#score     T_URIBL_SEM_RED      0.1
endif
##} T_URIBL_SEM_RED ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

##{ URIBL_RHS_DOB ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
urirhssub URIBL_RHS_DOB         dob.sibl.support-intelligence.net  A   2
body URIBL_RHS_DOB              eval:check_uridnsbl('URIBL_RHS_DOB')
describe URIBL_RHS_DOB          Contains an URI of a new domain (Day Old Bread)
tflags URIBL_RHS_DOB            net
endif
##} URIBL_RHS_DOB ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

##{ URI_OBFU_DOM

meta            URI_OBFU_DOM            __URI_OBFU_DOM && !__VIA_ML
describe        URI_OBFU_DOM            URI pretending to be different domain
##} URI_OBFU_DOM

##{ URI_OBFU_TLD

meta          URI_OBFU_TLD      __URI_OBFU_TLD && !__MSGID_OK_HOST
describe      URI_OBFU_TLD      URI top-level domain with space obfuscation
##} URI_OBFU_TLD

##{ URI_OBFU_WWW ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body          URI_OBFU_WWW  /(?<!http:\/\/)\b_*w{2,3}(?!\.[-\w]+\.(?:com|net|org|biz|info))[^[:alnum:]]{1,3}(?:<D><O><T>+[^[:alnum:]]{1,3})?[[:alnum:]][-\w]{1,20}[[:alnum:]][^[:alnum:]]{1,3}(?:<D><O><T>+[^[:alnum:]]{1,3})?(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g|b\s?i\s?z|i\s?n\s?f\s?o)_*\b/i
describe      URI_OBFU_WWW  Obfuscated URI
endif
##} URI_OBFU_WWW ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ VANITY

meta VANITY		(__V_KNOWN_VANITY && (__V_NO_COST + __V_INFORM_YOU + __V_INNERCIRCLE + __V_SHMUCK + __V_EXECS_PROS + __V_PUB_DEADLINE + __V_REGISTRY + __V_NOMINATION + __V_BIOGRAPHY + __V_ACCOLADES + __V_RECOGNITION + __V_DISTINGUISHED + __V_EXCELLENCE + __V_ACHIEVEMENT > 3)) || (__V_BESTOFAWARD && (__V_SBCAVANITY || __V_USCAVANITY))
describe VANITY Vanity or fake awards
#score VANITY 2.3
##} VANITY

##{ XMAILER_MIMEOLE_OL_015D5

meta XMAILER_MIMEOLE_OL_015D5  (__XM_OL_015D5 && __MO_OL_015D5)
##} XMAILER_MIMEOLE_OL_015D5

##{ XMAILER_MIMEOLE_OL_07794

meta XMAILER_MIMEOLE_OL_07794  (__XM_OL_07794 && __MO_OL_07794)
##} XMAILER_MIMEOLE_OL_07794

##{ XMAILER_MIMEOLE_OL_09BB4

meta XMAILER_MIMEOLE_OL_09BB4  (__XM_OL_09BB4 && __MO_OL_09BB4)
##} XMAILER_MIMEOLE_OL_09BB4

##{ XMAILER_MIMEOLE_OL_1ECD5

meta XMAILER_MIMEOLE_OL_1ECD5  (__XM_OL_1ECD5 && __MO_OL_1ECD5)
##} XMAILER_MIMEOLE_OL_1ECD5

##{ XMAILER_MIMEOLE_OL_20C99

meta XMAILER_MIMEOLE_OL_20C99  (__XM_OL_20C99 && __MO_OL_20C99)
##} XMAILER_MIMEOLE_OL_20C99

##{ XMAILER_MIMEOLE_OL_22B61

meta XMAILER_MIMEOLE_OL_22B61  (__XM_OL_22B61 && __MO_OL_22B61)
##} XMAILER_MIMEOLE_OL_22B61

##{ XMAILER_MIMEOLE_OL_25340

meta XMAILER_MIMEOLE_OL_25340  (__XM_OL_25340 && __MO_OL_25340)
##} XMAILER_MIMEOLE_OL_25340

##{ XMAILER_MIMEOLE_OL_32D97

meta XMAILER_MIMEOLE_OL_32D97  (__XM_OL_32D97 && __MO_OL_32D97)
##} XMAILER_MIMEOLE_OL_32D97

##{ XMAILER_MIMEOLE_OL_3857F

meta XMAILER_MIMEOLE_OL_3857F  (__XM_OL_3857F && __MO_OL_3857F)
##} XMAILER_MIMEOLE_OL_3857F

##{ XMAILER_MIMEOLE_OL_3AC1D

meta XMAILER_MIMEOLE_OL_3AC1D  (__XM_OL_3AC1D && __MO_OL_3AC1D)
##} XMAILER_MIMEOLE_OL_3AC1D

##{ XMAILER_MIMEOLE_OL_3D61D

meta XMAILER_MIMEOLE_OL_3D61D  (__XM_OL_3D61D && __MO_OL_3D61D)
##} XMAILER_MIMEOLE_OL_3D61D

##{ XMAILER_MIMEOLE_OL_465CD

meta XMAILER_MIMEOLE_OL_465CD  (__XM_OL_465CD && __MO_OL_465CD)
##} XMAILER_MIMEOLE_OL_465CD

##{ XMAILER_MIMEOLE_OL_4B815

meta XMAILER_MIMEOLE_OL_4B815  (__XM_OL_4B815 && __MO_OL_4B815)
##} XMAILER_MIMEOLE_OL_4B815

##{ XMAILER_MIMEOLE_OL_4BF4C

meta XMAILER_MIMEOLE_OL_4BF4C  (__XM_OL_4BF4C && __MO_OL_4BF4C)
##} XMAILER_MIMEOLE_OL_4BF4C

##{ XMAILER_MIMEOLE_OL_4EEDB

meta XMAILER_MIMEOLE_OL_4EEDB  (__XM_OL_4EEDB && __MO_OL_4EEDB)
##} XMAILER_MIMEOLE_OL_4EEDB

##{ XMAILER_MIMEOLE_OL_4F240

meta XMAILER_MIMEOLE_OL_4F240  (__XM_OL_4F240 && __MO_OL_4F240)
##} XMAILER_MIMEOLE_OL_4F240

##{ XMAILER_MIMEOLE_OL_58CB5

meta XMAILER_MIMEOLE_OL_58CB5  (__XM_OL_58CB5 && __MO_OL_58CB5)
##} XMAILER_MIMEOLE_OL_58CB5

##{ XMAILER_MIMEOLE_OL_5B79A

meta XMAILER_MIMEOLE_OL_5B79A  (__XM_OL_5B79A && __MO_OL_5B79A)
##} XMAILER_MIMEOLE_OL_5B79A

##{ XMAILER_MIMEOLE_OL_6554A

meta XMAILER_MIMEOLE_OL_6554A  (__XM_OL_6554A && __MO_OL_6554A)
##} XMAILER_MIMEOLE_OL_6554A

##{ XMAILER_MIMEOLE_OL_72641

meta XMAILER_MIMEOLE_OL_72641  (__XM_OL_72641 && __MO_OL_72641)
##} XMAILER_MIMEOLE_OL_72641

##{ XMAILER_MIMEOLE_OL_7533E

meta XMAILER_MIMEOLE_OL_7533E  (__XM_OL_7533E && __MO_OL_7533E)
##} XMAILER_MIMEOLE_OL_7533E

##{ XMAILER_MIMEOLE_OL_812FF

meta XMAILER_MIMEOLE_OL_812FF  (__XM_OL_812FF && __MO_OL_812FF)
##} XMAILER_MIMEOLE_OL_812FF

##{ XMAILER_MIMEOLE_OL_83BF7

meta XMAILER_MIMEOLE_OL_83BF7  (__XM_OL_83BF7 && __MO_OL_83BF7)
##} XMAILER_MIMEOLE_OL_83BF7

##{ XMAILER_MIMEOLE_OL_8627E

meta XMAILER_MIMEOLE_OL_8627E  (__XM_OL_8627E && __MO_OL_8627E)
##} XMAILER_MIMEOLE_OL_8627E

##{ XMAILER_MIMEOLE_OL_8E893

meta XMAILER_MIMEOLE_OL_8E893  (__XM_OL_8E893 && __MO_OL_8E893)
##} XMAILER_MIMEOLE_OL_8E893

##{ XMAILER_MIMEOLE_OL_91287

meta XMAILER_MIMEOLE_OL_91287  (__XM_OL_91287 && __MO_OL_91287)
##} XMAILER_MIMEOLE_OL_91287

##{ XMAILER_MIMEOLE_OL_9B90B

meta XMAILER_MIMEOLE_OL_9B90B  (__XM_OL_9B90B && __MO_OL_9B90B)
##} XMAILER_MIMEOLE_OL_9B90B

##{ XMAILER_MIMEOLE_OL_A50F8

meta XMAILER_MIMEOLE_OL_A50F8  (__XM_OL_A50F8 && __MO_OL_A50F8)
##} XMAILER_MIMEOLE_OL_A50F8

##{ XMAILER_MIMEOLE_OL_A842E

meta XMAILER_MIMEOLE_OL_A842E  (__XM_OL_A842E && __MO_OL_A842E)
##} XMAILER_MIMEOLE_OL_A842E

##{ XMAILER_MIMEOLE_OL_ADFF7

meta XMAILER_MIMEOLE_OL_ADFF7  (__XM_OL_ADFF7 && __MO_OL_ADFF7)
##} XMAILER_MIMEOLE_OL_ADFF7

##{ XMAILER_MIMEOLE_OL_B30D1

meta XMAILER_MIMEOLE_OL_B30D1  (__XM_OL_B30D1 && __MO_OL_B30D1)
##} XMAILER_MIMEOLE_OL_B30D1

##{ XMAILER_MIMEOLE_OL_B4B40

meta XMAILER_MIMEOLE_OL_B4B40  (__XM_OL_B4B40 && __MO_OL_B4B40)
##} XMAILER_MIMEOLE_OL_B4B40

##{ XMAILER_MIMEOLE_OL_B9B11

meta XMAILER_MIMEOLE_OL_B9B11  (__XM_OL_B9B11 && __MO_OL_B9B11)
##} XMAILER_MIMEOLE_OL_B9B11

##{ XMAILER_MIMEOLE_OL_BC7E6

meta XMAILER_MIMEOLE_OL_BC7E6  (__XM_OL_BC7E6 && __MO_OL_BC7E6)
##} XMAILER_MIMEOLE_OL_BC7E6

##{ XMAILER_MIMEOLE_OL_C65FA

meta XMAILER_MIMEOLE_OL_C65FA  (__XM_OL_C65FA && __MO_OL_C65FA)
##} XMAILER_MIMEOLE_OL_C65FA

##{ XMAILER_MIMEOLE_OL_CAC8F

meta XMAILER_MIMEOLE_OL_CAC8F  (__XM_OL_CAC8F && __MO_OL_CAC8F)
##} XMAILER_MIMEOLE_OL_CAC8F

##{ XMAILER_MIMEOLE_OL_CF0C0

meta XMAILER_MIMEOLE_OL_CF0C0  (__XM_OL_CF0C0 && __MO_OL_CF0C0)
##} XMAILER_MIMEOLE_OL_CF0C0

##{ XMAILER_MIMEOLE_OL_EF20B

meta XMAILER_MIMEOLE_OL_EF20B  (__XM_OL_EF20B && __MO_OL_EF20B)
##} XMAILER_MIMEOLE_OL_EF20B

##{ XMAILER_MIMEOLE_OL_EF222

meta XMAILER_MIMEOLE_OL_EF222  (__XM_OL_EF222 && __MO_OL_EF222)
##} XMAILER_MIMEOLE_OL_EF222

##{ XMAILER_MIMEOLE_OL_F3B05

meta XMAILER_MIMEOLE_OL_F3B05  (__XM_OL_F3B05 && __MO_OL_F3B05)
##} XMAILER_MIMEOLE_OL_F3B05

##{ XMAILER_MIMEOLE_OL_F475E

meta XMAILER_MIMEOLE_OL_F475E  (__XM_OL_F475E && __MO_OL_F475E)
##} XMAILER_MIMEOLE_OL_F475E

##{ XMAILER_MIMEOLE_OL_F6D01

meta XMAILER_MIMEOLE_OL_F6D01  (__XM_OL_F6D01 && __MO_OL_F6D01)
##} XMAILER_MIMEOLE_OL_F6D01

##{ XMAILER_MIMEOLE_OL_FF5C8

meta XMAILER_MIMEOLE_OL_FF5C8  (__XM_OL_FF5C8 && __MO_OL_FF5C8)
##} XMAILER_MIMEOLE_OL_FF5C8

##{ X_MAILER_CME_6543_MSN

header X_MAILER_CME_6543_MSN	X-Mailer =~ /^CME-V6\.5\.4\.3; MSN\s*$/
##} X_MAILER_CME_6543_MSN

##{ if !(! plugin (Mail::SpamAssassin::Plugin::URIDetail))_sandbox

if !(! plugin (Mail::SpamAssassin::Plugin::URIDetail))
  uri_detail T_KHOP_FOREIGN_CLICK	text =~ /\b(?:cli(?:quez\W|ck\Wa)ici\b|cli(?:cca\W|c\Wa|que\Wa)qu[^<.,a ]|klie?k(?:\Whi?er|ni(?:j|nite)\Wtu[tk]aj)\b)/i
endif
##} if !(! plugin (Mail::SpamAssassin::Plugin::URIDetail))_sandbox

##{ ifplugin Mail::SpamAssassin::Plugin::DNSEval_sandbox

ifplugin Mail::SpamAssassin::Plugin::DNSEval
reuse   __RCVD_IN_DNSWL
reuse  RCVD_IN_DNSWL_NONE
reuse  RCVD_IN_DNSWL_LOW
reuse  RCVD_IN_DNSWL_MED
reuse  RCVD_IN_DNSWL_HI
reuse  RCVD_IN_IADB_LISTED
reuse  RCVD_IN_IADB_EDDB
reuse  RCVD_IN_IADB_EPIA
reuse  RCVD_IN_IADB_SPF
reuse  RCVD_IN_IADB_SENDERID
reuse  RCVD_IN_IADB_DK
reuse  RCVD_IN_IADB_RDNS
reuse  RCVD_IN_IADB_GOODMAIL
reuse  RCVD_IN_IADB_NOCONTROL
reuse  RCVD_IN_IADB_OPTOUTONLY
reuse  RCVD_IN_IADB_UNVERIFIED_1
reuse  RCVD_IN_IADB_UNVERIFIED_2
reuse  RCVD_IN_IADB_LOOSE
reuse  RCVD_IN_IADB_OPTIN_LT50
reuse  RCVD_IN_IADB_OPTIN_GT50
reuse  RCVD_IN_IADB_OPTIN
reuse  RCVD_IN_IADB_DOPTIN_LT50
reuse  RCVD_IN_IADB_DOPTIN_GT50
reuse  RCVD_IN_IADB_DOPTIN
reuse  RCVD_IN_IADB_ML_DOPTIN
reuse  RCVD_IN_IADB_OOO
reuse  RCVD_IN_IADB_MI_CPEAR
reuse  RCVD_IN_IADB_UT_CPEAR
reuse  RCVD_IN_IADB_MI_CPR_30
reuse  RCVD_IN_IADB_UT_CPR_30
reuse  RCVD_IN_IADB_MI_CPR_MAT
reuse  RCVD_IN_IADB_UT_CPR_MAT
endif
##} ifplugin Mail::SpamAssassin::Plugin::DNSEval_sandbox

##{ ifplugin Mail::SpamAssassin::Plugin::ReplaceTags_sandbox

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
replace_rules __FRT_GOLD
replace_rules __FRT_SILVER
replace_inter W0 \w?
replace_inter SP2 [\s\d_*\$\%(),.:;?!}{\[\]|\/?^\#~\xa1`'+-]?
replace_tag   GX  [gk6]
replace_tag   IX  [ilt|!1y?\xcc\xcd\xce\xcf\xec\xed\xee\xef]
replace_tag   SX  [sz5\xa6\xa7]
replace_tag   TX  [t|]
replace_tag   UX [u\xb5\xd9\xda\xdb\xdc\xfc\xfb\xfa\xf9\xfd]
replace_tag   WX  (?:[wv]|vv)
replace_rules T_FRT_ABSOLUT
replace_rules FRT_ADOBE2
replace_rules T_FRT_ADULT2
replace_rules FRT_APPROV
replace_rules T_FRT_BEFORE
replace_rules T_FRT_BELOW2
replace_rules FRT_BIGGERMEM1
replace_rules T_FRT_CANSPAM
replace_rules T_FRT_CLICK
replace_rules T_FRT_COCK
replace_rules T_FRT_CONTACT
replace_rules FRT_DIPLOMA
replace_rules FRT_DISCOUNT
replace_rules FRT_DOLLAR
replace_rules T_FRT_ERECTION
replace_rules T_FRT_ESTABLISH
replace_rules FRT_ESTABLISH2
replace_rules T_FRT_EXPERIENCE
replace_rules T_FRT_FOLLOW1
replace_rules T_FRT_FOLLOW2
replace_rules T_FRT_FREE
replace_rules T_FRT_FRIEND
replace_rules T_FRT_FUCK1
replace_rules FRT_FUCK2
replace_rules FRT_GUARANTEE1
replace_rules T_FRT_HEALTH
replace_rules T_FRT_HOUR
replace_rules T_FRT_INCOME
replace_rules T_FRT_INTEREST
replace_rules FRT_INVESTOR
replace_rules FRT_LEVITRA
replace_rules T_FRT_LITTLE
replace_rules T_FRT_LOLITA1
replace_rules FRT_MEETING
replace_rules FRT_OFFER2
replace_rules T_FRT_OPPORTUN1
replace_rules FRT_OPPORTUN2
replace_rules T_FRT_PACKAGE
replace_rules T_FRT_PAYMENT
replace_rules FRT_PENIS1
replace_rules T_FRT_PHARMAC
replace_rules T_FRT_POSSIBLE
replace_rules FRT_PRICE
replace_rules T_FRT_PROFILE1
replace_rules T_FRT_PROFILE2
replace_rules T_FRT_PROFIT1
replace_rules T_FRT_PROFIT2
replace_rules T_FRT_PUSSY
replace_rules FRT_REFINANCE1
replace_rules FRT_ROLEX
replace_rules FRT_SEXUAL
replace_rules T_FRT_SLUT
replace_rules FRT_SOMA
replace_rules FRT_SOMA2
replace_rules T_FRT_STOCK1
replace_rules T_FRT_STOCK2
replace_rules FRT_STRONG1
replace_rules FRT_STRONG2
replace_rules FRT_SYMBOL
replace_rules FRT_TODAY2
replace_rules FRT_VALIUM1
replace_rules FRT_VALIUM2
replace_rules T_FRT_VIRGIN1
replace_rules FRT_WEIGHT2
replace_rules FRT_XANAX1
replace_rules FRT_XANAX2
replace_rules T_FUZZY_SPRM
replace_rules FUZZY_MERIDIA
replace_rules TVD_FUZZY_PHARMACEUTICAL
replace_rules TVD_FUZZY_SYMBOL
replace_rules T_TVD_FUZZY_SECURITIES
replace_rules TVD_FUZZY_FINANCE
replace_rules TVD_FUZZY_FIXED_RATE
replace_rules TVD_FUZZY_MICROCAP
replace_rules T_TVD_FUZZY_SECTOR
replace_rules TVD_FUZZY_DEGREE
  replace_tag FF_LNNO   (?:(?:\d{1,3}(?:[)}\]:.,]{1,80}|(?:st|nd|rd|th)[)}\]:.,]{0,3})|\W?\([\div]{1,5}\)|\W?\{\d{1,3}\}|\[\d{1,3}\]|\*{1,5}|\#{1,5}|\(?[A-K][)}\]:.,]{1,3})\s?)
  replace_tag FF_YOUR   (?:a?\s?copy\sof\s)?(?:(?:your|din)[\s,:]{1,5})?(?:present\s|c[uo]rrent\s|full(?:st[\xe4]ndigt)?\s?|complete\s|direct\s|private?\s|valid\s|personal\s|nuvarande\s|vollst[\xe4]ndige\s|aktuelle\s){0,3}
  replace_tag ANDOR     (?:\s?[\/&+,]\s?|\sor\s|\sand?\s)
  replace_tag NUMBER    (?:(?:ruf)?num(?:[bm]er)?s?|nos?\.|no\b|\#s?|nbrs?\.?)
  replace_tag FF_SUFFIX (?:\sin\s(?:full|words))?:?(?:\s?[({][^)}]{1,30}[)}])?
  replace_tag FF_BLANK1 (?:[\s:;]{0,4}(?:(?:[-=_.,:;*\s]|&\#\d{1,3};){3,100}))
  replace_tag FF_BLANK2 (?:[^-=_.,:;*\w]{0,3}(?:[-=_.,:;*\s]|&\#\d{1,3};){1,100})
  replace_tag FF_A1 (?:(?:countr?y|city|province|ter+itory|(?:zip|postal)(?:\s?code)?|st?ates?|ad+res+e?)<ANDOR>?){1,3}(?:\sof\s(?:residence|birth|employment|citizenship|origin))?
  replace_tag FF_A2 (?:(?:contact|full|house|home|resident[ia]+l|busines+|mailing|work|delivery|ship+ing|post(?:al)?|of+ice|e-?mail|bostads|wohn)<ANDOR>?){0,3}\s?(?:ad+res+[es]{0,2}|location)(?:\sline)?(?:\s[0-9])?
  replace_tag FF_N1 (?:company|first|last|all|busines+|legal|ben[ei]ficiary|vollstaendigen)?\s?(?:name?[sn]?|navne)(?:<ANDOR>ad+res+)?
  replace_tag FF_P1 (?:(?:(?:busines+|contact|fax|voice|house|home|mobile?|cel+(?:ular)?|of+ice|tel+e?(?:\s?(?:ph|f)one?)?|(?:ph|f)one|private)(?:\s(?:ph|f)one)?<ANDOR>?){1,3}(?:\s?<NUMBER>)?<ANDOR>?){1,3}
  replace_tag FF_M1 (?:(?:age|marital\s?statu[se]|sex|gender|male\sor\sfemale|(?:date\sof\s)?birth|religion|nationality|email|next\sof\skin|alter|staatsangehoerigkeit|nationalitet)<ANDOR>?){1,3}
  replace_tag FF_L1 (?:(?:previous\s)?work(?:ing)\s?experience|employment|position|profes+ion|(?:monthly|an+ual)?\s?income|purpose\sof\sl(?:oa|ao)n|an+ual\sturn\s?over|l(?:oa|ao)n\sduration|oc+up[ae]tion(?:\/position)?|(?:l(?:oa|ao)n\s|the\s)?amount(?:\sneed(ed)?|\sdesired)?(?:\s(?:as|of)\sloan)?|beruf)
  replace_tag FF_F1 (?:(?:bank|beneficiary|billing|acc(?:oun)?t|rout(?:ing)?|swift|receiver|user)<ANDOR>?){1,3}\s(?:(?:name|ad+res+(?:es)?|location|code|details|a\/c|<NUMBER>)<ANDOR>?){1,3}
  replace_tag FF_F2 (?:(?:(?:international\s)?driver'?s?\sli[sc]+(:?en[sc]e)?|pas+\s?port|id\scard|[ia]d(?:entification|entity)(?:\s(?:card|<NUMBER>|papers?))?)<ANDOR>?){1,3}(?:\s<NUMBER>)?
  replace_tag FF_F3 (?:picture|test\squestion|answer|amount\swon|(?:inheritance\s)?funds?\svalue|(?:e-?mail\s)?pas+word|e-?mai?l\sid|amount\s[\w\s]{0,30}lost[\w\s]{0,15})
  replace_tag FF_F4 (?:log[-\s]?in|(?:e-?mail\s)?user)\s?names?
  replace_tag FF_F5 (?:ref(?:erence)?|batch|win+ing|award|billet)[-\s]?<NUMBER>
  replace_tag FF_ALL (?:<FF_A1>|<FF_A2>|<FF_N1>|<FF_P1>|<FF_M1>|<FF_F1>|<FF_F2>|<FF_F3>|<FF_F4>|<FF_F5>|<FF_L1>)
  replace_rules   __FILL_THIS_FORM_LONG1
  replace_rules   __FILL_THIS_FORM_LONG2
  replace_rules   __FILL_THIS_FORM_PARTIAL
  replace_rules   __FILL_THIS_FORM_PARTIAL_RAW
  replace_rules   __FILL_THIS_FORM_SHORT1
  replace_rules   __FILL_THIS_FORM_SHORT2
  replace_rules   __FILL_THIS_FORM_LOAN1
  replace_rules   __FILL_THIS_FORM_FRAUD_PHISH1
  replace_tag  CURRENCY   [\(\[]?(?:\bUS[D\$]{0,2}|\$(?:US)?|usd|GBP|=[Aa][34]|\xa3|&\#16[34];|(?i:pounds\ssterling)|\xa4|EUR(?:OS)?|[Ee]uro?s?|(?i:eur)\sde|CHF|FCFA)[\]\)]?
  replace_tag  GB_UK      \b(?:U\.?K\.?|(?:Great\s)?Brit(?:ain|ish)|G\.?B\.?)\b
  replace_rules   __LOTSA_MONEY_00 __LOTSA_MONEY_01 __LOTSA_MONEY_02 __LOTSA_MONEY_03 __LOTSA_MONEY_04
  replace_tag  PERCENT      \b(?:\d\d|ten|[a-z]+teen|(?:twen|thir|fou?r|fif)ty(?:-?[a-z]+)?)\s?(?:%|percent)
  replace_rules  __PCT_FOR_YOU_1 __PCT_FOR_YOU_2 __PCT_FOR_YOU_3 __PCT_OF_PMTS
  replace_rules  T_FUZZY_OPTOUT
replace_rules URI_OBFU_WWW
replace_rules T_LFUZ_PWRMALE
endif
##} ifplugin Mail::SpamAssassin::Plugin::ReplaceTags_sandbox

##{ ifplugin Mail::SpamAssassin::Plugin::URIDNSBL_sandbox

ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
reuse	  T_URIBL_SEM_FRESH 
reuse     T_URIBL_SEM_FRESH_10
reuse     T_URIBL_SEM_FRESH_15
endif
##} ifplugin Mail::SpamAssassin::Plugin::URIDNSBL_sandbox

##{ redirector_pattern_sandbox

redirector_pattern m'/(?:index.php)?\?.*(?<=[?&])URL=(.*?)(?:$|[&\#])'i
redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/url\?.*?(?<=[?&])q=(.*?)(?:$|[&\#])'i
redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/search\?.*?(?<=[?&])q=[^&]*?(?<=%20|..[=+\s])(?:site|inurl):(.*?)(?:$|%20|[\s+&\#])'i
redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/search\?.*?(?<=[?&])q=[^&]*?(?<=%20|..[=+\s])(?:"|%22)(.*?)(?:$|%22|["\s+&\#])'i
redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/translate\?.*?(?<=[?&])u=(.*?)(?:$|[&\#])'i
redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/pagead/iclk\?.*?(?<=[?&])adurl=(.*?)(?:$|[&\#])'i
redirector_pattern m'^http:/*(?:\w+\.)?aol\.com/redir\.adp\?.*(?<=[?&])_url=(.*?)(?:$|[&\#])'i
redirector_pattern m'^https?/*(?:\w+\.)?facebook\.com/l/;(.*)'i
##} redirector_pattern_sandbox

##{ reuse_sandbox

reuse    RCVD_IN_PSBL
reuse	 T_RCVD_IN_NIX_SPAM
##} reuse_sandbox


meta      __ADVANCE_FEE_2_NEW  (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH +  __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + T_LOTTO_AGENT_RPLY + T_LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET + __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT +  UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOU_WON > 1) && !__THREAD_INDEX_GOOD

meta      __ADVANCE_FEE_2_NEW_FORM  __FILL_THIS_FORM && __ADVANCE_FEE_2_NEW

meta      __ADVANCE_FEE_2_NEW_FRM_MNY  __FILL_THIS_FORM && LOTS_OF_MONEY && __ADVANCE_FEE_2_NEW

meta      __ADVANCE_FEE_2_NEW_MONEY  LOTS_OF_MONEY && __ADVANCE_FEE_2_NEW

meta      __ADVANCE_FEE_3_NEW  (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH +  __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + T_LOTTO_AGENT_RPLY + T_LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET + __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT +  UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOU_WON > 2) && !__THREAD_INDEX_GOOD

meta      __ADVANCE_FEE_3_NEW_FORM  __FILL_THIS_FORM && __ADVANCE_FEE_3_NEW

meta      __ADVANCE_FEE_3_NEW_FRM_MNY  __FILL_THIS_FORM && LOTS_OF_MONEY && __ADVANCE_FEE_3_NEW

meta      __ADVANCE_FEE_3_NEW_MONEY  LOTS_OF_MONEY && __ADVANCE_FEE_3_NEW

meta      __ADVANCE_FEE_4_NEW  (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH +  __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + T_LOTTO_AGENT_RPLY + T_LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET + __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT +  UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOU_WON > 3) && !__THREAD_INDEX_GOOD

meta      __ADVANCE_FEE_4_NEW_FORM  __FILL_THIS_FORM && __ADVANCE_FEE_4_NEW

meta      __ADVANCE_FEE_4_NEW_FRM_MNY  __FILL_THIS_FORM && LOTS_OF_MONEY && __ADVANCE_FEE_4_NEW

meta      __ADVANCE_FEE_4_NEW_MONEY  LOTS_OF_MONEY && __ADVANCE_FEE_4_NEW

meta      __ADVANCE_FEE_5_NEW  (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH +  __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + T_LOTTO_AGENT_RPLY + T_LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET + __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT +  UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOU_WON > 4) && !__THREAD_INDEX_GOOD

meta      __ADVANCE_FEE_5_NEW_FORM  __FILL_THIS_FORM && __ADVANCE_FEE_5_NEW

meta      __ADVANCE_FEE_5_NEW_FRM_MNY  __FILL_THIS_FORM && LOTS_OF_MONEY && __ADVANCE_FEE_5_NEW

meta      __ADVANCE_FEE_5_NEW_MONEY  LOTS_OF_MONEY && __ADVANCE_FEE_5_NEW

body __AFF_004470_NUMBER  /(?:\+|00|011)\W{0,3}44\W{0,3}0?\W{0,3}70/

body __AFF_LOTTERY        /(?:lottery|winner)/i

meta     __AFRICAN_STATE  (__NIGERIA || __IVORY_COAST || __BURKINA_FASO || __GHANA || __BENIN || __AFR_UNION)

body     __AFR_UNION      /\bafrican\sunion\b/i

body     __AGREED_RATIO   /\b(?:agreed|sharing)\s(?:ratios?|percent\w+)\b/i

body     __AM_DYING       /\bam\s(?:\S+\s)?dying\b/i

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __ANY_IMAGE_ATTACH Content-Type =~ /image\/(?:gif|jpeg|png)/
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader  __ANY_TEXT_ATTACH Content-Type =~ /text\/\w+/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __ANY_TEXT_ATTACH_DOC     Content-Type =~ /text\/\w+/i
endif

body     __APPROVALFVGT         /approval/i

body     __ATM_CARD       /\b(?:your|the|this|through|via)\s(?:atm|debit|(?:money[\s-]?gram\s)?fast\scash)(?:\smaster|swift)?\scard/i

body     __BACHELORS            /Bachelor/i

body     __BACK_SCRATCH   /\bmutual+y?\s(?:benefi(?:t|cial)|interest)\b/i

body     __BANK_DRAFT     /\bbank\sdraft/i

body     __BARRISTER      /\b(?:barrister|solicitor at law|barr\.)/i

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
  full	__BASE64_MDAW	/^(?:MDAw){12}/
endif

body     __BENEFICIARY    /\bb(?:[e\xe9]n[e\xe9]|[\xc3][\xa9]n[\xc3][\xa9])fi(?:c|sh)i?ai?r(?:y|ies|es?)/i

body     __BENIN          /\bb(?:[e\xe9]|[\xc3][\xa9])nin\b/i

body     __BIGDOLLARSFVGT       /\$\d{2,3},\d{3}/

body __BODY_STARTS_WITH_FROM_LINE /^From \S+ \S\S\S \S\S\S .. ..:..:.. \S+\s+\S+\: /s

rawbody  __BUGGED_IMG	m{<img\b[^>]{0,100}\ssrc=.?https?://[^>]{6,80}(?:\?[^>]{8}|[^a-z](?![a-f]{3}|20\d\d[01]\d[0-3]\d)[0-9a-f]{8})}i

body     __BURKINA_FASO   /\bburkina\s?faso\b/i

body     __CAN_HELP             /can help/

body __CASHPRZ      /cash prize of/

body     __CHARITY        /\bcharit(?:y|[ai]ble)\b/i

body     __COMPENSATION   /\b(?:compensat(?:e|ion)|recompensed?|ausgleich)\b/i

body     __CONTACT_ATTY   /\bcontact\smy\s(?:barrister|attou?rney)\b/i

body     __CONTACT_YOU    /\b(?:contact(?:ing)\syou|vous\scontacter)\b/i

body     __COURIER        /\bcourier\s(?:company|service)\b/i

body     __CS_WORD              /\bC[A-Za-z]{2,4}IS\b/

header  __CTYPE_MULTIPART_ANY Content-Type =~ /multipart\/\w+/i

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __CTYPE_ONETAB_GIF Content-Type:raw =~ /^image\/gif;\n\tname=\".+?\"$/s
endif

header   __DATE_700             Date =~ /-0700/

body __DBLCLAIM     /avoid double claiming/

body     __DEAD_PARENT    /\bmy\s(?:deceased|dead)\s(?:father|mother)/i

body     __DEAL           /\b(?:business|financial|this|the|mutual|die(?:se)?r?|cette|profitable)\s(?:deal|transa[ck]tion|proposal|offer|venture|suggestion|partnership)/i

body     __DECEASED       /\b(?:the|my|der|du|le)\s(?:deceased|late|verstorbenen|d[\xe9]funt|d[\xc3][\xa9]nt)\b/i

body     __DESTROY_ME     /\b(?:destroy|hunt)\sm[ey]\b/i

body     __DIED_IN        /\bdied\sin\b/i

body     __DIPLOMA              /diploma/i

body     __DIPLOMATIC     /\bdiplomatic\b/i

header	 __DKIM_EXISTS	exists:DKIM-Signature
tflags	 __DKIM_EXISTS	nice

body           __DLND_ATTACH      /\bdownload\sthe\sattach(?:ed|ment)\b/i

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  meta         __DOC_ATTACH       (__DOC_ATTACH_MT || __DOC_ATTACH_FN1 || __DOC_ATTACH_FN2)
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   __DOC_ATTACH_FN1   Content-Type =~ /="[^"]+\.(?:docx?|rtf)"/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   __DOC_ATTACH_FN2   Content-Disposition =~ /="[^"]+\.(?:docx?|rtf)"/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   __DOC_ATTACH_MT    Content-Type =~ m,\bapplication/(?:msword|rtf|vnd\.ms-word|vnd\.openxmlformats-officedocument\.wordprocessingml\.document)\b,i
endif

body     __DORMANT_ACCT   /\b(?:(?:dormant|abandoned|left\s?over)\s(?:account|fund|transaction|sum|deposit)|fonds\sdorment)/i

body	__DOS_BODY_FRI	/\bfri(?:day)?\b/i

body	__DOS_BODY_MON	/\bmon(?:day)?\b/i

body	__DOS_BODY_SAT	/\bsat(?:day)?\b/i

body		__DOS_BODY_STOCK	/\bstock\b/i

body	__DOS_BODY_SUN	/\bsun(?:day)?\b/i

body	__DOS_BODY_THU	/\bthu(?:r(?:s(?:day)?)?)?\b/i

body		__DOS_BODY_TICKER	/\b[A-Z]{4}\.(?:OB|PK)\b/

body	__DOS_BODY_TUE	/\btue(?:s(?:day)?)?\b/i

body	__DOS_BODY_WED	/\bwed(?:nesday)?\b/i

body	__DOS_COMING_TO_YOUR_PLACE	/I (?:am|might(?: be)?) c[a-z]?o[a-z]?m[a-z]?(?:i[a-z]?n[a-z]?g[a-z]{0,2}|e down) to y[!a-z]{2,4}r (?:city|place[a-z]{0,2}|co[a-z]?u[a-z]?n[a-z]?t[a-z]?ry) in (?:f[a-z]?e[a-z]?w|\d{1,2}) (?:day|week)s/

body	__DOS_CORRESPOND_EMAIL		/correspond with me using my email/

meta __DOS_DIRECT_TO_MX		__DOS_SINGLE_EXT_RELAY && !__DOS_HAS_LIST_ID && !__DOS_HAS_LIST_UNSUB && !__DOS_HAS_MAILING_LIST && !__DOS_RELAYED_EXT

body	__DOS_DROP_ME_A_LINE		/Drop me a line at/

body	__DOS_EMAIL_DIRECTLY		/(?:Email m[a-z]?e|address) direc(?:tl|lt)y at/

body		__DOS_FIN_ADVANTAGE	/\bfinancial advantage/i

uri __DOS_HAS_ANY_URI		/./

header __DOS_HAS_LIST_ID	exists:List-ID

header __DOS_HAS_LIST_UNSUB	exists:List-Unsubscribe

header __DOS_HAS_MAILING_LIST	exists:Mailing-List

body __DOS_HI                   /^Hi,$/

body	__DOS_I_AM_25			/I a.?m 25/

body __DOS_I_DRIVE_A	/I drive a/

body __DOS_LET_GO_JOB	/I was (?:let go|fired|layed off|dismissed) from a job I h(?:el|a)d for (?:2\d years|\d{3} months)/

body __DOS_LINK                 /\blink\b/

body	__DOS_MEET_EACH_OTHER		/(?:meet each other|[Mm]ay ?be we can meet)/

body __DOS_MY_OLD_JOB	/my old job/

body	__DOS_PERSONAL_EMAIL		/personal email at/

header	__DOS_RCVD_FRI	Received =~ / Fri, /

header	__DOS_RCVD_MON	Received =~ / Mon, /

header	__DOS_RCVD_SAT	Received =~ / Sat, /

header	__DOS_RCVD_SUN	Received =~ / Sun, /

header	__DOS_RCVD_THU	Received =~ / Thu, /

header	__DOS_RCVD_TUE	Received =~ / Tue, /

header	__DOS_RCVD_WED	Received =~ / Wed, /

meta	__DOS_REF_2_WK_DAYS	(__DOS_RCVD_MON && __DOS_BODY_WED) || (__DOS_RCVD_TUE && __DOS_BODY_THU) || (__DOS_RCVD_WED && __DOS_BODY_FRI) || (__DOS_RCVD_THU && __DOS_BODY_MON) || (__DOS_RCVD_FRI && __DOS_BODY_TUE) || (__DOS_RCVD_SAT && __DOS_BODY_TUE) || (__DOS_RCVD_SUN && __DOS_BODY_TUE)

meta	__DOS_REF_NEXT_WK_DAY	(__DOS_RCVD_MON && __DOS_BODY_TUE) || (__DOS_RCVD_TUE && __DOS_BODY_WED) || (__DOS_RCVD_WED && __DOS_BODY_THU) || (__DOS_RCVD_THU && __DOS_BODY_FRI) || (__DOS_RCVD_FRI && __DOS_BODY_MON) || (__DOS_RCVD_SAT && __DOS_BODY_MON) || (__DOS_RCVD_SUN && __DOS_BODY_MON)

meta	__DOS_REF_TODAY		(__DOS_RCVD_MON && __DOS_BODY_MON) || (__DOS_RCVD_TUE && __DOS_BODY_TUE) || (__DOS_RCVD_WED && __DOS_BODY_WED) || (__DOS_RCVD_THU && __DOS_BODY_THU) || (__DOS_RCVD_FRI && __DOS_BODY_FRI) || (__DOS_RCVD_SAT && __DOS_BODY_SAT) || (__DOS_RCVD_SUN && __DOS_BODY_SUN)

header __DOS_RELAYED_EXT	ALL-EXTERNAL =~ /(?:^|\n)[Rr][eE][cC][eE][iI][vV][eE][dD]:\s.+\n[Rr][eE][cC][eE][iI][vV][eE][dD]:\s/s

header __DOS_SINGLE_EXT_RELAY   X-Spam-Relays-External =~ /^\[ [^\]]+ \]$/

body		__DOS_STEADY_COURSE	/\bsteady (?:and increasing )?course\b/i

body		__DOS_STRONG_CF		/\bstrong cash flow/i

body __DOS_TAKING_HOME	/Taking home \d (?:digit level|figures) in \d{1,2} months/

body	__DOS_WRITE_ME_AT		/[Ww].?r.?i.?t.?e me at/

body     __EARLY_DEMISE   /\buntimely\sdeath\b/i

header   __EXCLAIM_SUBJ         Subject =~ /\!/

body     __EX_CUSTOMER    /\b(?:(?:dead|deceased|late|verstorbenen)\s(?:[ck]lient|customer|ac+ount|invest[eo]r|beneficiary|mr\.|kunde|engr?\.?)|titulaire\sdu\scompte\sest\s(?:d[\xe9]c[\xe9]d[\xe9]|d[\xc3][\xa9]c[\xc3][\xa9]d[\xc3][\xa9])|invest[eo]r\sdied|[\xe9]tranger\sd[\xe9]c[\xe9]d[\xe9]|(?:[ck]lient|customer|ac+ount|invest[eo]r|beneficiary|mr\.|kunde|engr?\.?)\s(?:[a-z]{1,10}\s)?(?:dead|deceased|verstorbenen))/i

body     __FB_BA                /\bBA\b/

body     __FB_BCs               /\bBSc\b/

body     __FB_BRAND_NAME        /brand name/i

body     __FB_CONGRADS          /Congratulations/i

body     __FB_DESIGNER          /designer/i

body     __FB_GAME              /game/i

body     __FB_GLASHUTE          /Glashute/

body     __FB_HANDBAGS          /handbags/i

body     __FB_HOTTEST           /hottest/i

body     __FB_INK_PEN           /ink pen/i

body     __FB_LOTTERY           /lottery/i

body     __FB_LUX_GIFTS         /Luxury (?:\w+\s)?Gifts/i

body     __FB_MA                /\bMA\b/

body     __FB_MBA               /\bMBA\b/

body     __FB_NATIONAL          /national/i

body     __FB_NUM_PERCNT        /\d\s?\%/

body     __FB_OMEGA             /Omega/i

body     __FB_PICK              /\bpick\b/i

body     __FB_PROJECTED         /projected/i

body     __FB_P_ALLNIGHT        /all night!/i

body     __FB_P_TRUELOVE        /true love/i

body     __FB_ROLEX_MEN         /Rolex Men/i

body     __FB_ROLEX_WMEN        /Rolex Lady/i

body     __FB_S_PRICE           /Pri{1,2}c[a-z]?e/i

body     __FB_S_STOCK           /Stock/i

body     __FB_S_SYMBOL          /Symb?o?l?:\s?[A-Z_,\.-]{4,8}/i

body     __FB_TIMEPIECE         /timepiece/i

body      __FB_TOUR             /\btour/i

body     __FB_WALLETS           /wallets/i

body     __FEES           /\b(?:security|safe\w*|courier|registration|pay|paid|up-?front|processing|delivery|transfer)[\s\w]{0,15}\s(?:fee|charge)s?\b/i 

header   __FHELO_VERIZON        X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+verizon\.net /i

header   __FHOST_VERIZON        X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+verizon\.net /i

header   __FH_FRM_53            From =~ /\@53\.com/i

header   __FH_HAS_XMSMAIL       exists:X-MSMail-Priority

header   __FH_HAS_XPRIORITY     exists:X-Priority

header   __FH_MSGID_01C7        MESSAGEID =~ /^<0{1,5}1c7/

header   __FH_MSG_53            MESSAGEID =~ /\@53\.com/i

header   __FH_RCV_53            Received =~ /\.53\.com/i

body     __FIFTY_FIFTY    /\b(?:50|fifty)(?:%?[\/:]50%?|%|\spercent)\b/

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  meta     __FILL_THIS_FORM               (__FILL_THIS_FORM_LONG || __FILL_THIS_FORM_PARTIAL > 4 || __FILL_THIS_FORM_PARTIAL_RAW > 4)
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  meta     __FILL_THIS_FORM_FRAUD_PHISH   (__FILL_THIS_FORM || __FILL_THIS_FORM_SHORT) && __FILL_THIS_FORM_FRAUD_PHISH1
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __FILL_THIS_FORM_FRAUD_PHISH1   /<FF_YOUR>(?:<FF_F1>|<FF_F2>|<FF_F3>|<FF_F4>|<FF_F5>)<FF_SUFFIX>(?:<FF_BLANK1>|<FF_BLANK2>$)/i
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  meta     __FILL_THIS_FORM_LOAN          __FILL_THIS_FORM && __FILL_THIS_FORM_LOAN1
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __FILL_THIS_FORM_LOAN1         /<FF_YOUR><FF_L1><FF_SUFFIX>(?:<FF_BLANK1>|<FF_BLANK2>$)/i
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  meta     __FILL_THIS_FORM_LONG          __FILL_THIS_FORM_LONG1 || __FILL_THIS_FORM_LONG2
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __FILL_THIS_FORM_LONG1         /(?:<FF_LNNO><FF_YOUR><FF_ALL><FF_SUFFIX>(?:<FF_BLANK2>(?:P[a-z\.\s]{10,30})?|<ANDOR>)){5}/i
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __FILL_THIS_FORM_LONG2         /(?:<FF_YOUR><FF_ALL><FF_SUFFIX>(?:<FF_BLANK2>(?:P[a-z\.\s]{10,30})?|<ANDOR>)){5}/i
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __FILL_THIS_FORM_PARTIAL       /^\s*<FF_LNNO>?<FF_YOUR>(?:<FF_ALL><ANDOR>?){1,3}<FF_SUFFIX>(?:<FF_BLANK1>|(?:[-=_.,:;*\s]|=20){1,4}$)/im
  tflags   __FILL_THIS_FORM_PARTIAL multiple
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  rawbody  __FILL_THIS_FORM_PARTIAL_RAW   /^\s*<FF_LNNO>?<FF_YOUR>(?:<FF_ALL><ANDOR>?){1,3}<FF_SUFFIX>(?:<FF_BLANK1>|(?:[-=_.,:;*\s]|=20|&nbsp;|<\/\w+>){0,4}$)/im
  tflags   __FILL_THIS_FORM_PARTIAL_RAW multiple
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  meta     __FILL_THIS_FORM_SHORT         !__FILL_THIS_FORM && (__FILL_THIS_FORM_SHORT1 || __FILL_THIS_FORM_SHORT2 || __FILL_THIS_FORM_PARTIAL > 2 || __FILL_THIS_FORM_PARTIAL_RAW > 2)
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __FILL_THIS_FORM_SHORT1        /(?:<FF_LNNO><FF_YOUR><FF_ALL><FF_SUFFIX>(?:<FF_BLANK2>|<ANDOR>)){3}/i
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __FILL_THIS_FORM_SHORT2        /(?:<FF_YOUR><FF_ALL><FF_SUFFIX>(?:<FF_BLANK2>|<ANDOR>)){3}/i
endif

body     __FIXED_RATEFVGT       /fixed rate/i

meta     __FM_LARGE_MONEY       (__F_LARGE_MONEY || __F_LARGE_MONEY_2)

meta     __FM_MORTGAGE5PLUS     ((__PREAPPROVEDFVGT + __FIXED_RATEFVGT + __YOUR_CREDITFVGT + __HOMELOANFVGT + __APPROVALFVGT + __BIGDOLLARSFVGT + __LOANURIFVGT + __MORTURIFVGT) > 4)

meta     __FM_MORTGAGE6PLUS     ((__PREAPPROVEDFVGT + __FIXED_RATEFVGT + __YOUR_CREDITFVGT + __HOMELOANFVGT + __APPROVALFVGT + __BIGDOLLARSFVGT + __LOANURIFVGT + __MORTURIFVGT) > 5)

meta     __FM_MY_PRICE          (__FB_S_PRICE || FRT_PRICE)

meta     __FM_NAT_LOTTERY       (__FB_NATIONAL && __FB_LOTTERY)

meta     __FM_STOCK_WORDS       (__FB_HOTTEST || __FB_PICK || __FB_PROJECTED)

meta           __FM_TO_ALL_NUMS     __FROM_ALL_NUMS && __TO_ALL_NUMS  

meta       __FORGED_TBIRD_IMG      __MUA_TBIRD && __JPEG_ATTACH && __MIME_BDRY_0D0D
describe   __FORGED_TBIRD_IMG      Possibly forged Thunderbird image spam

meta     __FORM_FRAUD_3  (__FILL_THIS_FORM || __FILL_THIS_FORM_SHORT) && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH +  __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + T_LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX +  __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 3)

meta     __FORM_FRAUD_5  (__FILL_THIS_FORM || __FILL_THIS_FORM_SHORT) && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH +  __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + T_LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX +  __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 5)

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  body        __FOR_SALE_LTP            /00\.? (?:less 10%|LTP)/i
  tflags      __FOR_SALE_LTP            multiple
endif

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  meta        __FOR_SALE_LTP_MANY       __FOR_SALE_LTP > 10
endif

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  body        __FOR_SALE_NET            /00\.? NET/i
  tflags      __FOR_SALE_NET            multiple
endif

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  meta        __FOR_SALE_NET_MANY       __FOR_SALE_NET > 10
endif

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  body        __FOR_SALE_OBO            /\bor best offer\b/i
  tflags      __FOR_SALE_OBO            multiple
endif

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  meta        __FOR_SALE_OBO_MANY       __FOR_SALE_OBO > 5
endif

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  body        __FOR_SALE_PRC_100K       /\bprice:? \$\d\d\d,\d\d\d/i
  tflags      __FOR_SALE_PRC_100K       multiple
endif

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  meta        __FOR_SALE_PRC_100K_MANY  __FOR_SALE_PRC_100K > 5
endif

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  body        __FOR_SALE_PRC_10K        /\bprice:? \$\d\d,\d\d\d/i
  tflags      __FOR_SALE_PRC_10K        multiple
endif

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  meta        __FOR_SALE_PRC_10K_MANY   __FOR_SALE_PRC_10K > 10
endif

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  body        __FOR_SALE_PRC_1K         /\bprice:? \$\d,?\d\d\d[.\s]/i
  tflags      __FOR_SALE_PRC_1K         multiple
endif

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  meta        __FOR_SALE_PRC_1K_MANY    __FOR_SALE_PRC_1K > 10
endif

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  rawbody     __FOR_SALE_PRC_EOL        /\s\$\d{1,3},\d00(?:\.00)?$/m
  tflags      __FOR_SALE_PRC_EOL        multiple
endif

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  meta        __FOR_SALE_PRC_EOL_MANY   __FOR_SALE_PRC_EOL > 10
endif

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  meta        __FOR_SALE_PRC_MANY       (__FOR_SALE_PRC_1K + __FOR_SALE_PRC_10K + __FOR_SALE_PRC_100K) > 20
endif

body     __FOUND_YOU      /\b(?:I|we)\sfound\syour?\b/i

body     __FRAUD          /\b(?:de)?fraud/i

body __FRAUD_IOV	/\b(?:no risks?|risk-? *free|free of risks?|100% safe|v.llig Risikofrei ist)\b/i

body __FRAUD_PTX	/\b(?:ass?ass?inat(?:ed|ion)|murder(?:e?d)?|poison(?:e?d)?|kill(?:ed|ing)\b[^.]{0,99}\b(?:war veterans|rebels?))\b/i

body __FRAUD_XWW	/\b(?:honest(?:ly)?\sco(?:-?operat(?:e|ion)|llaborat(?:e|ion))|ehrliche\szusammenarbeit)\b/i

header         __FROM_12LTRDOM_1   From =~ /\@[a-z]{12}\./

ifplugin Mail::SpamAssassin::Plugin::FreeMail
  meta         __FROM_41_FREEMAIL         (__NSL_ORIG_FROM_41 || __NSL_RCVD_FROM_41) && (FREEMAIL_FROM || FREEMAIL_REPLYTO)
  describe     __FROM_41_FREEMAIL         Sent from Africa + freemail provider
endif

header         __FROM_ALL_NUMS      From:addr =~ /^\d+@/

header __FROM_EBAY	From:addr =~ /\@ebay\.com$/i

header	__FROM_FREEMAIL	From =~ /\@(?:googlemail|gmail|yahoo|hotmail|msn|aol|aim)\./

header   __FROM_ISO_2022_JP     From:raw =~ /=\?ISO-2022-JP\?/

header   __FROM_LEFT_BRACK      From:name =~ /</

header         __FROM_MISSPACED      From =~ /^\s*"[^"]*"</

meta           __FROM_MISSP_EH_MATCH __FROM_RUNON && __ENV_AND_HDR_FROM_MATCH

meta           __FROM_MISSP_REPLYTO  __FROM_RUNON && __REPLYTO_EXISTS

meta           __FROM_MISSP_URI      __FROM_RUNON && __HAS_ANY_URI

header __FROM_PAYPAL	From:addr =~ /\@paypal\.com$/i

header   __FROM_RIGH_BRACK      From:name =~ />/

header         __FROM_RUNON          From =~ /\S+<\w+/

header   __FROM_VEGAS           From =~ /Vegas/i

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     __FRT_GOLD             /<inter SP2><post P2>\b(?!gold)<G><O><L><D>\b/i
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     __FRT_SILVER           /<inter SP2><post P2>\b(?!s[il][li]ver)<S><I><L><V><E><R>\b/i
endif

rawbody  __FR_SPACING_8         /[a-z0-9]{6}\s{8}[a-z0-9]{5}/i

header __FSL_UA_1 User-Agent =~ /6\.00\.2600\.000/

header __FSL_UA_2 X-Mailer =~ /6\.00\.2600\.000/

header   __FS_SUBJ_RE           Subject =~ /^Re: /

header   __FS_S_TRADE           Subject =~ /\btrade\b/i

body     __F_LARGE_MONEY        /\d\d\d,\d\d\d/

body     __F_LARGE_MONEY_2      /\d\d?\s?(?:thousand|(?:m|b|tr)illion)/i

meta        __GAPPY_HTML           __GAPPY_HTML_01 || __GAPPY_HTML_02

rawbody     __GAPPY_HTML_01        m;</?[a-z]{1,6}(?:\s[^>]{0,40})?>\s{0,80}(?:(?!\d)[\w'()\#,.:!]{1,15}\s{4,80}){7}\S;

rawbody     __GAPPY_HTML_02        m;\S(?:\s{4,80}(?!\d)[\w'()\#,.:!]{1,15}){7}\s{0,5}</?[a-z]{1,6}/?>;

body        __GAPPY_PHONE_NA       /1 - \d \d \d - \d \d \d - \d \d \d \d/

body     __GHANA          /\bghana\b/i

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __GIF_ATTACH Content-Type =~ /^image\/gif\b/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
  ifplugin Mail::SpamAssassin::Plugin::ImageInfo
    body	__GIF_EXISTS	eval:image_count('gif',1)
endif
endif

header	 __GREYLISTING	ALL =~ /(?:^|\n)X-(?:Scam-Grey|Greylist(?:ing)?):\s/m

body __HAS_ANY_EMAIL /\w@\S+\.\w/

uri __HAS_ANY_URI   /./

header __HAS_THREAD_INDEX  exists:Thread-Index

body     __HAS_WON_01    /\bque ha ganado\b/i

header         __HDRS_LCASE          ALL =~ /\n(?:Message-id|Content-type|X-MSMail-priority|from|subject|to|cc|Disposition-notification-to):/sm
tflags         __HDRS_LCASE          multiple

meta           __HDRS_LCASE_1K       __HDRS_LCASE && __SINGLE_HEADER_1K

header __HDR_ORDER_FTSDMCXXXX ALL =~ /\nFrom: .{1,80}?\nTo: .{1,80}?\nSubject: .{1,200}?\nDate: .{1,40}?\nMIME-Version: .{1,40}?\nContent-Type: .{1,120}?\nX-Priority: .{1,40}?\nX-MSMail-Priority: .{1,40}?\nX-Mailer: .{1,80}?\nX-MimeOLE:/s

header __HELO_NO_DOMAIN   X-Spam-Relays-External =~ /^[^\]]+ helo=[^\.]+ /

ifplugin Mail::SpamAssassin::Plugin::SPF
ifplugin Mail::SpamAssassin::Plugin::DKIM
header		__HK_HELO_EBAY		X-Spam-Relays-External =~ / helo=[^ ]+\.(?:ebay|emarsys)\b/
endif
endif

ifplugin Mail::SpamAssassin::Plugin::SPF
ifplugin Mail::SpamAssassin::Plugin::DKIM
header		__HK_HELO_MICROSOFT	X-Spam-Relays-External =~ / helo=\S+\.(?:microsoft(?:email)?|msn)\.com /
endif
endif

ifplugin Mail::SpamAssassin::Plugin::SPF
ifplugin Mail::SpamAssassin::Plugin::DKIM
header		__HK_HELO_PAYPAL	X-Spam-Relays-External =~ / helo=[^ ]+\.paypal\b/
endif
endif

ifplugin Mail::SpamAssassin::Plugin::SPF
ifplugin Mail::SpamAssassin::Plugin::DKIM
header		__HK_HELO_YAHOO		X-Spam-Relays-External =~ / helo=[^ ]+\.yahoo\.com /
endif
endif

body		__HK_LOTTO_1		/\b(?:(?:inter)?national|foundation|mercato|univers|euro ?million|e-?mail|euro-pw|bill ?gates|swiss|prestige|cristal|am.ricaine|coca.?cola|fiduciary|department) ?lot(?:eri[ej]|t(?:ery|o))/i

body		__HK_LOTTO_2		/\blot(?:eri[ej]|t(?:ery|o)) ?(?:(?:inter)?national|foundation|mercato|univers|euro ?million|e-?mail|euro-pw|bill ?gates|swiss|prestige|cristal|am.ricaine|coca.?cola|fiduciary|department)/i

body		__HK_LOTTO_BALLOT	/\b(?:promotional|on.?line|computer|internet|e-?mail|fran.aise) (?:ballot|draw|sweepstake)/i

body		__HK_LOTTO_JACKPOT	/\bmega jackpot\b/i

body		__HK_LOTTO_STAATS	/\bstaatsloteri/i

ifplugin Mail::SpamAssassin::Plugin::FreeMail
header		__HK_NAME_DR		From:name =~ /^DR\b/mi
endif

ifplugin Mail::SpamAssassin::Plugin::SPF
ifplugin Mail::SpamAssassin::Plugin::DKIM
header		__HK_NAME_EBAY		From:name =~ /\bebay\b/i
endif
endif

ifplugin Mail::SpamAssassin::Plugin::FreeMail
header		__HK_NAME_FROM		From:name =~ /^FROM\b/mi
endif

ifplugin Mail::SpamAssassin::Plugin::SPF
ifplugin Mail::SpamAssassin::Plugin::DKIM
header		__HK_NAME_MICROSOFT	From:name =~ /(microsoft|\bmsn\b)/i
endif
endif

ifplugin Mail::SpamAssassin::Plugin::FreeMail
header		__HK_NAME_MR_MRS	From:name =~ /^M(?:RS?|ISS)\b/mi
endif

ifplugin Mail::SpamAssassin::Plugin::SPF
ifplugin Mail::SpamAssassin::Plugin::DKIM
header		__HK_NAME_PAYPAL	From:name =~ /\bpaypal\b/i
endif
endif

ifplugin Mail::SpamAssassin::Plugin::SPF
ifplugin Mail::SpamAssassin::Plugin::DKIM
header		__HK_NAME_YAHOO		From:name =~ /\byahoo\b/i
endif
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader	__HK_SPAMMY_CDFN	Content-Disposition =~ /name=.*?(?:lot(?:eri[ej]|t(?:ery|o))|award|prize|winn(?:er|ing)|microsoft|congrat|urgent)/mi
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader	__HK_SPAMMY_CTFN	Content-Type =~ /name=.*?(?:lot(?:eri[ej]|t(?:ery|o))|award|prize|winn(?:er|ing)|microsoft|congrat|urgent)/mi
endif

body     __HOMELOANFVGT         /home loan/i

header   __HOST_HOTMAIL         X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.hotmail\.com /

header   __HOTMAILCOM           X-Spam-Relays-External =~ /^[^\]]+ helo=hotmail\.com /i

rawbody __HS_QUOTE /^> /

header __HS_SUBJ_RE_FW Subject =~ /^(?i:re|fw):/

header __HS_SUBJ_UC_FW Subject =~ /^FW:/

body     __HUSH_HUSH      /\b(?:confiden[tc]i[ae]l(?:\b|ity\b|it(?:[\xe9]|[\xc3][\xa9]))|private\b|secr[e\xe8](?:te?|cy)\b|sensitive\b|concealed\b|obscured?\b|discre(?:et|tion)\b|vertraulich(?:en)?\b|geheim\b|priv(?:[\xe9]|[\xc3][\xa9]))/i

ifplugin Mail::SpamAssassin::Plugin::ImageInfo
  body       __IMG_LE_300K           eval:pixel_coverage('all',62500,300000)
endif

body     __INHERIT_PMT    /\binheritance\spayment\s/i

body     __INTL_BANK      /\b(?:international\s(?:\w+\s)?bank|banque\sinternationale)\b/i

body     __INVEST_COUNTRY /\binvest\sin\syour?\scountry\b/i

body     __INVEST_MONEY   /\binvest\sthis\smoney\b/i

body     __IS_LEGAL       /\b(?:this\s(?:deal|offer|transaction|proposal|exchange|arrangement|work)|it)?\sis\s(?:(?:guaranteed|completely|absolutely|perfectly|100%|very|fully)\s)?(?:legal|hitch-free)\b/i

body     __IVORY_COAST    /\b(?:Cote\s?D.Ivoire|Ivory\s?Coast)\b/i

body     __I_INHERIT      /\bI\s[a-z\s]{0,30}inherited\b/i

body     __I_WILL_YOU     /\bwill(?:ed)?\s(?:[a-z\s]{0,20}\s(?:fortune|money)\s)?to\syou\b/i

header __JM_REACTOR_DATE    Date =~ / \+0000$/

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader __JPEG_ATTACH           Content-Type =~ /image\/jpeg/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
  ifplugin Mail::SpamAssassin::Plugin::ImageInfo
    body	__JPEG_EXISTS	eval:image_count('jpeg',1)
endif
endif

body            __KAM_LOTTO1    /(e-?mail address (have emerged a winner|has won|attached to (ticket|reference)|was one of the ten winners)|random selection in our computerized email selection system)/is       

body            __KAM_LOTTO2    /((ticket|serial|lucky) number|secret pin ?code|batch number|reference number|promotion date)/is

body            __KAM_LOTTO3    /(won|claim|cash prize|pounds? sterling)/is

body            __KAM_LOTTO4    /(claims (officer|agent)|lottery coordinator|fiduciary (officer|agent)|fiduaciary claims)/is

body            __KAM_LOTTO5    /(freelotto group|Royal Heritage Lottery|UK National (Online)? Lottery|U\.?K\.? Grand Promotions|Lottery Department UK|Euromillion Loteria|Luckyday International Lottery|International Lottery)/is

body            __KAM_LOTTO6    /(Dear Lucky Winner|Winning Notification|Attention:Winner|Dear Winner)/is

header          __KAM_LOTTO7    Subject =~ /(Your Lucky Day|(Attention:|ONLINE) WINNER)/i

header __KB_MSGID_OUTLOOK_888  Message-Id =~ /^<[0-9a-f]{8}(?:\$[0-9a-f]{8}){2}\@/

if ! plugin (Mail::SpamAssassin::Plugin::OpenPGP)
  body     __KHOP_PGP_I1	/-----BEGIN PGP (?:SIGNATURE|MESSAGE|PUBLIC|PRIVATE)(?:, PART [0-9]{1,4}\/[0-9]{1,4}| KEY BLOCK)?-----/
  tflags   __KHOP_PGP_I1	nice
endif

if ! plugin (Mail::SpamAssassin::Plugin::OpenPGP)
  body     __KHOP_PGP_I2	/-----END PGP/
  tflags   __KHOP_PGP_I2	nice
endif

uri      __LOANURIFVGT          /\bloa.?ns?\b/i

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __LOTSA_MONEY_00   /<CURRENCY>[\s\.]?\d[\dO][,\.][\dO]{3}(?:(?!\d)|\b)/
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __LOTSA_MONEY_01   /(?:(?i:sum\sof\s)[\(\[]?|<CURRENCY>\s?)[\s\.]?\d[\d.,\sO]{5,20}[\dO]/
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __LOTSA_MONEY_02   /\d[\d.,\sO]{5,20}[\dO][\)\]\(]?\s?(?:<CURRENCY>|Pounds|(?i:dollars?|bucks))\b/
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __LOTSA_MONEY_03   /(?:(?i:sum\sof\s)[\(\[]?|<CURRENCY>\s?)\d(?:[\d.,\sO]{0,5})?[\)\]]?\s?(?i:M(?i:il)?\b|mil+(?i:io|<O>)n|hund?[re]+a?[dt]|thousand|tausend)/
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __LOTSA_MONEY_04   /(?:\d[\d\.]{0,4}M|million(?!s)|mill<O>n|hund?rea?d(?!s)[^\.]{1,25}thousand(?!s)|cents?[^\.]{1,25}mille|hundert[^\.]{1,30}tausend|ientos?[^\.]{1,20}mil|cent[a-z\s]{1,20}mil\s[a-z]{1,20}centos)[^\.\$]{0,50}(?:(?:U\.?\s?S\.?\s?(?:A\.?\s?)?|united\s?states?|canad(?:ian|a)\s)?dollars?|bucks|USD|GBP|<GB_UK>\spounds?|(?:<GB_UK>\s)?pounds?\ssterling|pounds(?!\sof)|(?:d'\s?)?euros?|francs?)\b/i
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __LOTSA_MONEY_05   /(?:(?:sum|value|amount)\sof\s)\d[\d.,\sO]{7,20}[\dO\.][\)\]\(\s]{0,3}(?:pounds?|dollars?|euros?|bucks)\b/i
endif

meta     __LOTTO_ADMITS     __LOTTO_ADMITS_1 || __LOTTO_ADMITS_2 || __LOTTO_ADMITS_3

body     __LOTTO_ADMITS_1 /\b(?:on-?line|e-?mail|ballot|(?:inter)?national|state|(?:UK|euro)[- ]?(?:mil+ions?|PW)|Canada|Microsoft|MSN|internet|mega|jackpot|Royal Heritage|foundation|mercato|univers|staatsloterij|bill\s?gates|swiss|this|esta)(?:\s\w+)?\s?(?:lot(?:to|tery|eri[ea])|sweepstake|promotion|promocao|promocion)/i

body     __LOTTO_ADMITS_2 /\b(?:free)?(?:lot(?:to|tery|erie)|sweepstakes)\s(?:(?:inter)?na[tz]ional|department|bureau|group|award)/i

uri      __LOTTO_ADMITS_3 /lottery/i

body     __LOTTO_RELATED    /\b(?:lott(?:o|ery)|sweepstakes)\s(?:prize|draw(?:s|ing)?|(?:ge)?win(?:n?er|n?ing)?|jackpot|award|fund|com+it+e+|com+is+ion|guild|promotion|promocao|program|day|online|company|(?:in)?corporat|agent|co[-,]?ordinator|team)/i

body     __LOTTO_VERIFY     /\bpromo\sverification/i

body     __LOTTO_WINNINGS   /(?:claim|process(?:ing)?|transfert?(?:\s\w+)?|redeem|payment|virement|zahlung|reivindicar|demandar)\s(?:(?:[a-z]{1,5}\s)?(?:your|of|the|this|de|ihrer|seu|tu)\s)+(?:win+ings?|money|(?:cash\s)?prize|award|f[ou]nds?|grant|gewinne|premio)/i

body     __LOTTO_WIN_01     /\bwin+ing\s(?:prize|number|notification|draw|check|cheque|details|information|payment)/i

body     __LUCKY_WINNER   /\b(?:lucky|gl.cklich(?:en)?|afortunados)\s(?:(?:ge)?win+ers?|ganador(?:es)?)\b/i

body     __LUCRATIVE      /\b(?:lucrative|profitable|tr[\xe8]s\ssalutaire)\b/i

header __MAILER_OL_5510 X-Mailer =~ /^Microsoft Office Outlook, Build 11.0.5510$/

header __MAILER_OL_6626 X-Mailer =~ /^Microsoft Outlook, Build 10\.0\.6626$/

uri	 __MAIL_LINK	/\?.{0,200}\w\@[\w-]{1,20}.\w\w\w?\b/i

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  meta            __MANY_BIG_LISTS        (__MANY_RECORDS_1 + __MANY_RECORDS_2 + __MANY_RECORDS_3) > 15
endif

header   __MANY_RECIPS          ToCc =~ /(?:\@[^@]{5,30}){3}/

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  body            __MANY_RECORDS_1        /\s[A-Z][a-z]{1,30}s(?:\sDatabase)?[-:\s]{2,5}(?i:1\smillion\s|\d[\d,.]{1,8}[Kk]?\s(?i:thousand\s|million\s)?)(?i:total\s|full\sdata\s)?(?i:email|record)s/
  tflags          __MANY_RECORDS_1        multiple
endif

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  body            __MANY_RECORDS_2        /\W{1,4}\s(?:[a-z\/]{1,20}\s){0,4}(?:doctor|physician|provider|therapist|counselor|dentist|veterinarian|clinic|hospital|agent|chiropractor|psychologist|companie|supplier)s/i
  tflags          __MANY_RECORDS_2        multiple
endif

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  body            __MANY_RECORDS_3        /\W{1,4}\s(?:(?:[A-Z]{1,2}[a-z\/]{0,20}|and)\s){0,4}[A-Z][a-z]{1,20}s Database/
  tflags          __MANY_RECORDS_3        multiple
endif

meta           __MANY_SPAN_IN_TEXT   (__SPAN_BEG_TEXT > 4) && (__SPAN_END_TEXT > 4)

uri            __MANY_SUBDOM       m;^https?://(?:[^\./]{1,30}\.){6};

body     __MASTERS              /Masters/i

body     __MBA                  /MBA/i

header __MID_START_001C   Message-ID =~ /^<000001c/

body     __MILLIONS       /\bmillions\sof\s(?:dollar|euro|pound)/i

header __MIMEOLE_1106   X-MimeOLE =~ /^Produced By Microsoft MimeOLE V6.00.2800.1106$/

header     __MIME_BDRY_0D0D        Content-Type =~ /boundary="-{12}(?:0[1-9]){12}/

header   __MISSING_REF		References =~ /^UNSET$/ [if-unset: UNSET]

header   __MISSING_REPLY	In-Reply-To =~ /^UNSET$/ [if-unset: UNSET]

header __MOLE_2962  X-MimeOLE =~ /^Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2962$/

meta     __MONEY_FRAUD_3  LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH +  __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + T_LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS +  __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX +  __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 3)

meta     __MONEY_FRAUD_5  LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH +  __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + T_LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS +  __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX +  __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 5)

meta     __MONEY_FRAUD_8  LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH +  __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + T_LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS +  __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX +  __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 8)

uri      __MORTURIFVGT          /\bmor.?t\b/i

body     __MOVE_MONEY     /\b(?:(?:receive|re-?profile|repatriate|rapatrier|secure|r[\xe9]clamation|possession|virer)\s(?:th(?:e|is)|das|sur ce|de ces|cet)|re-?profiling)\s(?:proceeds|funds?|money|balance|account|geld|compte|fonds|argent)\b/i

header __MO_OL_015D5  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2905/

header __MO_OL_07794  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1437/

header __MO_OL_09BB4  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.72\.3155\.0/

header __MO_OL_1ECD5  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1081/

header __MO_OL_20C99  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.72\.3338\.1/

header __MO_OL_22B61  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1158/

header __MO_OL_25340  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4963\.1700/

header __MO_OL_32D97  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V9\.0\.2416/

header __MO_OL_3857F  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1409/

header __MO_OL_3AC1D  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.00\.2919\.6700/

header __MO_OL_3D61D  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.71\.2244\.8/

header __MO_OL_465CD  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1506/

header __MO_OL_4B815  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.71\.2730\.2/

header __MO_OL_4BF4C  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4522\.1200/

header __MO_OL_4EEDB  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4963\.1700/

header __MO_OL_4F240  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1158/

header __MO_OL_58CB5  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4133\.2400/

header __MO_OL_5B79A  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.3790\.1830/

header __MO_OL_6554A  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2905/

header __MO_OL_72641  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1441/

header __MO_OL_7533E  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4963\.1700/

header __MO_OL_812FF  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4927\.1200/

header __MO_OL_83BF7  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.72\.3110\.3/

header __MO_OL_8627E  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1437/

header __MO_OL_8E893  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V10\.0\.2616/

header __MO_OL_91287  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.2300/

header __MO_OL_9B90B  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.1700/

header __MO_OL_A50F8  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4922\.1500/

header __MO_OL_A842E  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1441/

header __MO_OL_ADFF7  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1158/

header __MO_OL_B30D1  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.2300/

header __MO_OL_B4B40  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4133\.2400/

header __MO_OL_B9B11  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2462\.0000/

header __MO_OL_BC7E6  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4927\.1200/

header __MO_OL_C65FA  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.1700/

header __MO_OL_CAC8F  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.71\.1712\.3/

header __MO_OL_CF0C0  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.2300/

header __MO_OL_EF20B  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2180/

header __MO_OL_EF222  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2873/

header __MO_OL_F3B05  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1437/

header __MO_OL_F475E  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2741\.2600/

header __MO_OL_F6D01  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4522\.1200/

header __MO_OL_FF5C8  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2741\.2600/

header __MSGID_JAVAMAIL	Message-ID =~ /\.JavaMail\./
tflags __MSGID_JAVAMAIL	nice

header   __MSGID_VGA            Message-ID =~ /^<000001c[67]/

header __MSOE_MID_WRONG_CASE   ALL =~ /\nMessage-Id: /

header     __MUA_TBIRD             User-Agent =~ /Thunderbird/

body     __MY_FORTUNE     /\b(?:my|his|her)\s(?:fortune|heritage)\b/i

header __NAKED_TO   To =~ /^[^\s<>]+\@[^\s<>]+$/

meta           __NAME_EMAIL_DIFF   __NAME_IS_EMAIL && ! __NAME_EQ_EMAIL

header __NAME_EQ_EMAIL	From:raw =~ /([\w+.-]+\@[\w.-]+\.\w\w+)["'`\s]*<\s*\1>/

header __NAME_IS_EMAIL	From:raw =~ /\w\@[\w.-]+\.\w\w+["'`]*\s*<\w+\@\w/

body     __NEXT_OF_KIN    /\bnext[-\s]of[-\s]kin\b/i

body     __NIGERIA        /\bnigeria\b/i

body     __NOT_DEAD_YET   /\bwill\sinherit\b/i

body     __NOT_SCAM       /\bnot\sa\sscam\b/i

tflags	   __NOT_SPOOFED	nice

if ! plugin (Mail::SpamAssassin::Plugin::DKIM)
if !plugin(Mail::SpamAssassin::Plugin::SPF)
   meta __NOT_SPOOFED  __DKIM_EXISTS || !__LAST_EXTERNAL_RELAY_NO_AUTH || ALL_TRUSTED	# no DKIM, no SPF.
endif
endif

if ! plugin (Mail::SpamAssassin::Plugin::DKIM)
 ifplugin Mail::SpamAssassin::Plugin::SPF
   meta __NOT_SPOOFED  SPF_PASS || __DKIM_EXISTS || !__LAST_EXTERNAL_RELAY_NO_AUTH || ALL_TRUSTED	# no DKIM, yes SPF
endif
endif

if !(! plugin (Mail::SpamAssassin::Plugin::DKIM))
if !plugin(Mail::SpamAssassin::Plugin::SPF)
  meta __NOT_SPOOFED  DKIM_VALID || !__LAST_EXTERNAL_RELAY_NO_AUTH || ALL_TRUSTED	# yes DKIM, no SPF
endif
endif

if !(! plugin (Mail::SpamAssassin::Plugin::DKIM))
 ifplugin Mail::SpamAssassin::Plugin::SPF
  meta __NOT_SPOOFED  SPF_PASS || DKIM_VALID || !__LAST_EXTERNAL_RELAY_NO_AUTH || ALL_TRUSTED	# yes DKIM, yes SPF
endif
endif

meta     __NO_INR_YES_REF	(__XM_GNUS || __XM_MSOE5 || __XM_MSOE6 || __XM_MOZ4 || __XM_SKYRI || __XM_WWWMAIL || __UA_GNUS || __UA_KNODE || __UA_MUTT || __UA_PAN || __UA_XNEWS)

header          __NSL_ORIG_FROM_41        X-Originating-IP =~ /^(?:.+\[)?41\./
describe        __NSL_ORIG_FROM_41        Originates from 41.0.0.0/8

header          __NSL_RCVD_FROM_41        Received =~ /\[41\./
describe        __NSL_RCVD_FROM_41        Received from 41.0.0.0/8

ifplugin Mail::SpamAssassin::Plugin::ImageInfo
  body       __ONE_IMG               eval:image_count('all',1,1)
endif

body     __OUR_BEHALF     /\bon\s(?:my|our)\sbehalf\b/i

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __PART_CID_STOCK_LESS    Content-ID =~ /^<00[a-f0-9]{10}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[A-Za-z]+>$/
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __PART_STOCK_CD_F Content-Disposition =~ /filename/
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __PART_STOCK_CID Content-ID =~ /^<[a-f0-9]{12}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[^\s\.]+>$/
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __PART_STOCK_CL Content-Location =~ /./
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  meta     __PCT_FOR_YOU    __PCT_FOR_YOU_1 || __PCT_FOR_YOU_2 || __PCT_FOR_YOU_3 || T_SHARE_50_50
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __PCT_FOR_YOU_1  /<PERCENT>[\s)]{0,3}(?:of\s[\w\s]{0,35}?)?(?:for|to|as)\syour?/i
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __PCT_FOR_YOU_2  /\b(?:(?:give|offer)\syou|vous\saurez\sdroit\s[\xe0]|ihnen)\s<PERCENT>/i
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __PCT_FOR_YOU_3  /\byour?\s(?!can)[\w\s]{6,20}?(?:(?:share|entitle|assist|comp[ea]nsate|reward|renumerate|paid|deduct|account|tage|keep)[\w\s]{1,25}?)?\s(?<!by\s)(?<!up\sto\s)<PERCENT>/i
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __PCT_OF_PMTS    /<PERCENT>[\s)]+(?:of\s[\w\s]{0,35}?)?of\s(?:the\s)?(?:payments?|rem+it+ances?|chec(?:k|que)s?)/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  meta         __PDF_ATTACH       (__PDF_ATTACH_MT || __PDF_ATTACH_FN1 || __PDF_ATTACH_FN2)
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   __PDF_ATTACH_FN1   Content-Type =~ /="[^"]+\.pdf"/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   __PDF_ATTACH_FN2   Content-Disposition =~ /="[^"]+\.pdf"/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   __PDF_ATTACH_MT    Content-Type =~ m,\bapplication/pdf\b,i
endif

if ! plugin (Mail::SpamAssassin::Plugin::OpenPGP)
  meta     __PGP_INLINE 	( __KHOP_PGP_I1 && __KHOP_PGP_I2 )
  tflags   __PGP_INLINE	nice noautolearn
endif

if ! plugin (Mail::SpamAssassin::Plugin::OpenPGP)
  header   __PGP_SIGNED	Content-Type =~ /multipart\/signed;.*\/pgp-signature/s
  tflags   __PGP_SIGNED	nice noautolearn
endif

body     __PHD                  /PhD/i

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  body        __PILL_PRICE_01        m;(?=[\d .f])(?:free|[\d .]{3}(?:/|per|each)) ?(?=[ptc])(?:pill|tablet|cap(?:sule|let))s?\b;i
  tflags      __PILL_PRICE_01        multiple
endif

if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
  body        __PILL_PRICE_02        /(?=[ptc])(?:pill|tablet|cap(?:sule|let))s[ :-]{1,5}\$?[\d .]{3}/i
  tflags      __PILL_PRICE_02        multiple
endif

body           __PLS_REVIEW       /\b(?:please|kindly)\s(?:(?:re)?view|see)(?:\s\w+)?\sattach(?:ed|ment)\b/i

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
  ifplugin Mail::SpamAssassin::Plugin::ImageInfo
    mimeheader	__PNG_ATTACH	Content-Type =~ /^image\/png\b/i
endif
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
  ifplugin Mail::SpamAssassin::Plugin::ImageInfo
    body	__PNG_EXISTS	eval:image_count('png',1)
endif
endif

body     __PREAPPROVEDFVGT      /pre-approved/i

body     __RANDOM_PICK    /\b(?:random(?:ly)?\s(?:\w+\s)?(?:select(?:ion|ed)|pick(?:ed)?|computer)|(?:select|pick)ed\s(?:at\s)?random(?:ly)?|(?:esco(?:g|lh)idos|seleccion) (?:aleatoria(?:mente)?|al azar))\b/i

header __RATWARE_BOUND_A  ALL =~ /^Message-Id: <....([0-9a-f]{8})\$[0-9a-f]{8}\$.{10,400}boundary="----=_NextPart_000_...._\1\./msi # "

header __RATWARE_BOUND_B  ALL =~ /boundary="----=_NextPart_000_...._([0-9a-f]{8})\..{10,400}^Message-Id: <....\1\$[0-9a-f]{8}\$/msi # "

header __RCD_RDNS_MAIL_MESSY X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*mail/i

header __RCD_RDNS_MTA_MESSY X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*mta/i

header __RCD_RDNS_MX X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*\bmx[^a-z]/i

header __RCD_RDNS_MX_MESSY X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*mx/

header __RCD_RDNS_SMTP_MESSY X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*smtp/

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header __RCVD_IN_BRBL   eval:check_rbl('brbl','bb.barracudacentral.org')
tflags __RCVD_IN_BRBL   net
endif

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header	__RCVD_IN_DNSWL		eval:check_rbl('dnswl-firsttrusted', 'list.dnswl.org.')
tflags	__RCVD_IN_DNSWL		nice net
endif

header __RDNS_NO_SUBDOM	X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\.\w+ /

header __REPLYTO_EXISTS             exists:Reply-To

if version >= 3.003000
ifplugin Mail::SpamAssassin::Plugin::WLBLEval
  header      __RP_MATCHES_RCVD      eval:check_mailfrom_matches_rcvd()
endif
endif

header __S25R_1 X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\d[^0-9. ]+\d\S*\./

header __S25R_2 X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\d{5}/

header __S25R_3 X-Spam-Relays-External =~ /^[^\]]+ rdns=(?:[^. ]+\.)?\d[^. ]*\.[^. ]+\.\S+\.[a-z]/

header __S25R_4 X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\d\.[^. ]*\d-\d/

header __S25R_5 X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\d\.[^. ]*\d\.[^. ]+\.\S+\./

header __S25R_6 X-Spam-Relays-External =~ /^[^\]]+ rdns=(?:dhcp|dialup|ppp|[achrsvx]?dsl)[^. ]*\d/

body     __SCAM           /\bscam(?:m?e[dr])?s?\b/i

body __SEEK_FRAUD_0ENSZN  / within the next ten official working days/

body __SEEK_FRAUD_0KBZGH  / I believe everyone will die someday\. My name is /

body __SEEK_FRAUD_0OPFLV  / this money will be used in an ungodly .a/

body __SEEK_FRAUD_0XNFH_  / to keep this information confidential from the public until your claim /

body __SEEK_FRAUD_0YTF3I  /ll email addresses entered for th.{0,3} promotional draws were randomly /

body __SEEK_FRAUD_17TGPW  /for the passed 7 months which ended . days ago/

body __SEEK_FRAUD_1HLDVM  / in Europe, America, Africa and Asia .acific. /

body __SEEK_FRAUD_1LWG1E  /M depository made by a foreign investor /

body __SEEK_FRAUD_1MXKDB  /amily to close one of my accounts and distribute the money .hich/

body __SEEK_FRAUD_1OMKY9  / to be merciful to me and accept my soul/

body __SEEK_FRAUD_1Q42RI  /requirements, statutory obligations, verification/

body __SEEK_FRAUD_1YKNCJ  /On behalf of the Trustees and Executor of the .state of Late /

body __SEEK_FRAUD_1Z81CI  / MASTERPIECE POLICY HOLDER OWNERSHIP CLAIM/

body __SEEK_FRAUD_1_DZIV  /led man, he must have been in contact with you in the past/

body __SEEK_FRAUD_27TPNC  / as this is an illegal act and will have to stop if you /

body __SEEK_FRAUD_2BLGLA  /siness project from our bank worth US\$..\.5/

body __SEEK_FRAUD_2C0NY6  /nfortunately we learnt that all his supposed next/

body __SEEK_FRAUD_2DOBJR  /in this regard because of my health hence /

body __SEEK_FRAUD_2PPL8T  /If you accept this offer, I will appreciate your timely response/

body __SEEK_FRAUD_2YLAPH  / take out a moment of your very busy .chedule to/

body __SEEK_FRAUD_32EE0G  /his mail might come to you as a surprise /

body __SEEK_FRAUD_3MBUTP  / of registered software and domain users/

body __SEEK_FRAUD_3NIFMV  /confidential until you claim your prize\./

body __SEEK_FRAUD_3OPYSM  /remium and Clearance Certificate Fee of the /

body __SEEK_FRAUD_3WUO8K  / through our SWIFT CARD PAYMENT CENT.. in Europe, America/

body __SEEK_FRAUD_3ZEWKC  / contact me at once to indicate your .nterest/

body __SEEK_FRAUD_43CX5K  / to the ownership of the Hong Kong Government if nobody /

body __SEEK_FRAUD_45YXI4  /s after you have made the payment for shipping\./

body __SEEK_FRAUD_49FI4O  /ants to serve the Lord must serve him in /

body __SEEK_FRAUD_4HH4OS  / by anybody to pay any other money except /

body __SEEK_FRAUD_4KBBOJ  /ow are you today\? Hope all is well with you and /

body __SEEK_FRAUD_4NIRPA  / processed and your prize released to you\./

body __SEEK_FRAUD_4O7OHH  /elephone number\/your correct mailing address where you want /

body __SEEK_FRAUD_4YVO5B  /ed by an advanced automated random computer /

body __SEEK_FRAUD_55WLGY  /dvantage of you and they will dry you up until you have nothing\./

body __SEEK_FRAUD_58TQIN  /Remember, all prize money must be claimed /

body __SEEK_FRAUD_59PL1E  /Below are few list of tracking numbers you can track /

body __SEEK_FRAUD_5INAZF  / will let you know how far I have gone with the arrangement\. /

body __SEEK_FRAUD_5PW27G  / in Bulgaria and Pakistan, they .efused and kept the money to them/

body __SEEK_FRAUD_65IS8I  / into your bank account\. I intend to part /

body __SEEK_FRAUD_68YEDU  /e, because, I believe everyone will die someday\./

body __SEEK_FRAUD_6AN_A8  / to issue you international certified bank draft/

body __SEEK_FRAUD_6BI3C9  / payment center has been mandated to issue out /

body __SEEK_FRAUD_6EGJH6  / the way I am going to instruct herein\./

body __SEEK_FRAUD_6KHCDD  / and they will never know of this Excess\./

body __SEEK_FRAUD_6OI8QG  /atrimonial home which the Bible is against\./

body __SEEK_FRAUD_6RGTYS  /I have distributed ..n.. to some charity .rganizations in /

body __SEEK_FRAUD_6SNWNT  / your country for disbursement according t/

body __SEEK_FRAUD_6VUONK  /to avoid any further delay and remember to pay the/

body __SEEK_FRAUD_6XGKRW  / by non-participant or unofficial personnel\./

body __SEEK_FRAUD_75EPGH  /now that there is more to life than just wanting to have or make all the .oney in the world\./

body __SEEK_FRAUD_75NRBF  /But the whole process is simple and we must keep a low profile at all times\./

body __SEEK_FRAUD_7MKYRR  / we are giving you a 100\% money back guarantee if you do not receive /

body __SEEK_FRAUD_7SASLI  /international passport or drivers license/

body __SEEK_FRAUD_84RQ6W  /Let me repeat again, try to contact them /

body __SEEK_FRAUD_87YD7W  /is heart condition was due to the death of /

body __SEEK_FRAUD_8802C6  / unnecessary delay in the receipt of your fund/

body __SEEK_FRAUD_8AR9FD  /\. I AM WRITING IN RESPECT OF A FOREIGN CLIENT \[MASTERPIECE POLICYHOLDER\] OF THE ABOVE NAMED INSURANCE COMPANY \[ENGR\.WILLIAM F\. ABRAHAMSON OF AMERICA\] WHO PERISHED IN THE U\.S 9\/11\/2001,TERRORIST ATTACK WITH OTHER PASSENGERS ABOARD AS YOU ARE AWARE OF THIS FACT OR CAN CONFIRM IT YOURSELF\./

body __SEEK_FRAUD_8FUQE6  / About me, im just a very loving and caring girl and i want someone who is very honest and loving/

body __SEEK_FRAUD_8IOTQL  /his and other reasons .{0,40} prompted me to reach out for help/

body __SEEK_FRAUD_8LRGPA  / your Approval Slip which contains details o. /

body __SEEK_FRAUD_8RBU5C  / paid that but they said no because they do/

body __SEEK_FRAUD_8_YZA0  / you about the present arrangement to pay you/

body __SEEK_FRAUD_9HWDUP  /So you are hereby strongly advised once more to keep your winnings strictly/

body __SEEK_FRAUD_9OJUVS  /If your are interested,I have the sum of \$.{0,20}ollars created aside that I intended to invest in your country profitable\. So if you are capable to handle this transaction kindly get back to me to enable us discuss and workout the modalities\./

body __SEEK_FRAUD_9Q29S6  / stopped further payment through bank to bank transfer/

body __SEEK_FRAUD_9TSKUH  /sion of your ATM CARD, you are hereby advi.e/

body __SEEK_FRAUD_A8CING  / as part of our international promotions .rogram which .. conduct/

body __SEEK_FRAUD_AITBFD  /ed to him by one of his numerous friends /

body __SEEK_FRAUD_AJIUNF  /\. Your own part of this deal is to find a safe place /

body __SEEK_FRAUD_AK5MDQ  / we were both born again Christians\. Since /

body __SEEK_FRAUD_AKAEF9  /e said whoever is contacting us through emails .r/

body __SEEK_FRAUD_AKYCPN  /t want them to know about this development\./

body __SEEK_FRAUD_ALAIKE  / including taxes, custom paper and clearance duty/

body __SEEK_FRAUD_ALSZID  / for their requirements to proceed and procure your Approval Slip on your behalf whi.. /

body __SEEK_FRAUD_AM2BHX  / foreign partner in a country of my choice where . w..l/

body __SEEK_FRAUD_AMZ2AH  /About me if you want to know i just like honest people and i am a very loving girl /

body __SEEK_FRAUD_AQGCND  /secured medium of communication\. However, this correspondence is /

body __SEEK_FRAUD_AUHBXT  / lack of co-operation and not fulfilling the obligations giving to you in respect to your /

body __SEEK_FRAUD_AXS4G6  /implore you to exercise the utmost indulgence to keep this matter extraordinary confidential. /

body __SEEK_FRAUD_AZ117T  / to boost the exercise of clearing all foreign debts owed to .{0,40}s and organizations who have been found not to have receive/

body __SEEK_FRAUD_AZ58ZB  / because of impostors, we hereby issued you our/

body __SEEK_FRAUD_AZUWPQ  / CARD PAYMENT CENTRE in Europe, America,/

body __SEEK_FRAUD_A_IQTC  /DIRECTORATE OF INTERNATIONAL PAYMENT AND TRANSFER/

body __SEEK_FRAUD_B5_Q5F  / and whereby you are not interested; please indicate in your reply so that I can seek for the assistance of someone else\./

body __SEEK_FRAUD_B9GHRP  /t want you to feel sorry for me, because,/

body __SEEK_FRAUD_BBKOZZ  / that any double claim discovered by the/

body __SEEK_FRAUD_BEAOXU  / and assets to my immediate and .xtended family members /

body __SEEK_FRAUD_BERTMT  / due to the death of all the members of his family /

body __SEEK_FRAUD_BGXWIY  / as soon as you receive this important message/

body __SEEK_FRAUD_BHWNBP  / barrels with piles of weapons and ammunition/

body __SEEK_FRAUD_BJUJI4  / was capable of assisting me in this great venture/

body __SEEK_FRAUD_BLDS9E  / am delighted to inform you that the contract panel/

body __SEEK_FRAUD_BOG4XB  /I hereby attempt to reach you again by this .ame email address /

body __SEEK_FRAUD_BOGJJR  /MY DATA: MY NAME: MISS NICHOLA ANDREA BUDHAN/

body __SEEK_FRAUD_BORYCZ  /Courier Delivery Of your Certified Winning Cheque Name and other /

body __SEEK_FRAUD_BPS76O  / Christians\. Since his death I decided not to r/

body __SEEK_FRAUD_BPT9ZD  /should there be any change of address do .nform /

body __SEEK_FRAUD_BRNKW7  /f this business proposition offends your moral /

body __SEEK_FRAUD_BSX___  / you at this stage is for you to provide me with your /

body __SEEK_FRAUD_BUW_FJ  / social responsibility to the citizens in the communities where they have operational base/

body __SEEK_FRAUD_C3BRTD  / 30\% of this fund to you while 70\% shall be for me\. /

body __SEEK_FRAUD_CCF1EW  /\. This panel was primarily delegated .. /

body __SEEK_FRAUD_CEXPEV  / have successfully passed a mandate to the current /

body __SEEK_FRAUD_CHLODJ  / to enable us seeing this deal through\. I guarantee /

body __SEEK_FRAUD_CIXFCH  / your information you have to stop any further .ommunication with any/

body __SEEK_FRAUD_CJPQV1  /othing ventured is nothing gained and that success and riches never come easy or on a platter of gold/

body __SEEK_FRAUD_CKWDC_  /nd Monitory Crime Division\. Federal Bureau .f Investigation\./

body __SEEK_FRAUD_CN2CTT  /All we require from you henceforth is an update /

body __SEEK_FRAUD_CO9T0G  / contact immediately the real office of /

body __SEEK_FRAUD_CPHODZ  / from my private banking clients\. Do not betray/

body __SEEK_FRAUD_CTPNAE  / trying to get my payment all to no avail\./

body __SEEK_FRAUD_CVF7N_  / fax numbers and a forwarding address to enable .. file /

body __SEEK_FRAUD_CYOVLC  /pon your response, I shall then provide you with /

body __SEEK_FRAUD_D04MXN  / that will back you up as the next of kin /

body __SEEK_FRAUD_D0SCQY  /I contacted him and he explained everything to me/

body __SEEK_FRAUD_DA_SPN  / to all the people that have been scammed in /

body __SEEK_FRAUD_DDU0Y_  /e more to keep your winnings strictly confidential until/

body __SEEK_FRAUD_DE3CNN  / Any prize not claimed within this period /

body __SEEK_FRAUD_DE87LA  /I will want you to help me collect this deposit and .i/

body __SEEK_FRAUD_DI5SMP  /maintained\. The Bible made us to understand that /

body __SEEK_FRAUD_DIIRM8  /With God all things are possible\. As soon as I /

body __SEEK_FRAUD_DIPNHU  /To file for your claim, please contact our fiduciary agent:/

body __SEEK_FRAUD_DNXWDS  / has discovered a huge number of double claims due to ..n/

body __SEEK_FRAUD_DV9GWF  /I have urgent and very confidential business propos/

body __SEEK_FRAUD_DWEVNF  /ou for being part of our promotional lottery program/

body __SEEK_FRAUD_DXLGXY  /If this proposal is acceptable by you, I expect that you will not take undue advantage of the trust I Will bestow .n you/

body __SEEK_FRAUD_D_URQY  /MY HIGHEST CONSIDERATIONS AND REGARDS AS I AWAIT YOUR URGENT RESPONSE\./

body __SEEK_FRAUD_E1MR3Z  / came to our bank to engage in business discussions with /

body __SEEK_FRAUD_E2_QDF  /I need your urgent assistance in transferring the /

body __SEEK_FRAUD_E96NSG  / representative in Nigeria, contact h.. /

body __SEEK_FRAUD_EAHFYY  /I would respectfully request that you keep the contents of this mail /

body __SEEK_FRAUD_EBEPD_  /Please if I reach you as I am hopeful, endeavo/

body __SEEK_FRAUD_EBL4QT  /\. I,m a single female medical\. I come from /

body __SEEK_FRAUD_ECCV28  / processing and eventual payment of the above prize to you/

body __SEEK_FRAUD_EDORBJ  / who almost held the fund to themselves for their selfish reason/

body __SEEK_FRAUD_EFET6T  / for this same purpose\. Please assure me that you will act according/

body __SEEK_FRAUD_EFJ5G0  / will be effected to your designated home address without any further delay/

body __SEEK_FRAUD_EFYHRC  / the bank, I cannot be directly connected to this money thus I am /

body __SEEK_FRAUD_EHVE3Y  / PERSONAL INSURANCE CASH ACCUMULATION MASTERPIECE POLICY/

body __SEEK_FRAUD_EJM0XB  / with him at the plane crash leaving nobody behind .o/

body __SEEK_FRAUD_EQOQFJ  / to his forwarding address but got no reply/

body __SEEK_FRAUD_ETTPUF  / presence of my husband\'s relatives around me /

body __SEEK_FRAUD_ETY7LT  /s I never really cared for anyone\(not even myself\)/

body __SEEK_FRAUD_EVIVRH  / was a very dedicated .hristian who loved to /

body __SEEK_FRAUD_EXFYTU  /ynthetic nylon seal and padded with machine/

body __SEEK_FRAUD_EYJYD5  /I will appreciate your early reply for commencement of business\./

body __SEEK_FRAUD_EYYR3G  /SINCE THE DEMISE OF ENGR\.WILLIAM F\. ABRAHAMSON,/

body __SEEK_FRAUD_EZFEDE  /: Telephone\/Fax number: Nationality: Age: Occupation:/

body __SEEK_FRAUD_F2OR8H  / with the help of our Intelligence Monitoring Network System /

body __SEEK_FRAUD_F5RHSQ  / from my private banking clients. .o not betray/

body __SEEK_FRAUD_F6ZEVO  / is not mandatory nor will I in any manner compel you to hono/

body __SEEK_FRAUD_F8VGZN  /more, as they seem not to be contended with what I have /

body __SEEK_FRAUD_FCF_6I  /his is part of an instruction\/mandate passed by the /

body __SEEK_FRAUD_FD5IJO  /elvin Young of HSBC, Ben of FedEx, Ibrahim Sule,/

body __SEEK_FRAUD_FDV82D  / I have the intention to invest in your home town but I don\'t know anybody that can help me to execute this plan when I come over to your country ,This is the simple reason I/

body __SEEK_FRAUD_FE742Q  / be executed under legitimate arrangement that will protect you from any breach of /

body __SEEK_FRAUD_FIWDJB  /e do await your response so we can move on with /

body __SEEK_FRAUD_FKRVOS  /they refused and kept the money to themselves\./

body __SEEK_FRAUD_FLVC7O  /mail address emerged as one of the online Winning emails in the /

body __SEEK_FRAUD_FMJP2L  / to charity organizations, as I want this to be one of the last good deeds I /

body __SEEK_FRAUD_FNGZ_9  /used by unbelievers\. I don.t want a situation where this money will be used in/

body __SEEK_FRAUD_FNYQLN  /He informed us that he had a financial portfolio .. /

body __SEEK_FRAUD_FUHSU6  / years in our Bank here without any body coming for it\./

body __SEEK_FRAUD_G4RKKF  / I want to inform you that I have successfully transferred the /

body __SEEK_FRAUD_GFNFIK  / that if such money remained unclaimed after /

body __SEEK_FRAUD_GGXKDC  / and confidentiality please contact me on my personal email address/

body __SEEK_FRAUD_GHC0LN  / and subsequent disbursement since nobody /

body __SEEK_FRAUD_GKQDW6  / Customers Service Hours \/ Monday To Saturday /

body __SEEK_FRAUD_GMUT_1  /e informed that you are not allowed to correspond /

body __SEEK_FRAUD_GRYB_A  /t need any telephone communication in this /

body __SEEK_FRAUD_GTSAAF  / while in the US, trying to get my payment /

body __SEEK_FRAUD_GVTOJY  /propagating the word of God and to endeavor that the house of God is /

body __SEEK_FRAUD_GWIW5T  /contacting the card center by using it as your subject/

body __SEEK_FRAUD_H78OXL  /ould live my life a different way from how . have .ived/

body __SEEK_FRAUD_H9VQEI  / evidencing your claim purported to have been signed personally by you /

body __SEEK_FRAUD_HDEE2F  / to go into our Bank treasury as an abandoned fund. .o this is the reason why . contacted you, so that /

body __SEEK_FRAUD_HDNX7F  /used by unbelievers\. I don\'t want a situation where this money will be used in/

body __SEEK_FRAUD_HW7ENB  /ssue a letter of authorization to somebody to receive it on my behalf /

body __SEEK_FRAUD_HWE2G1  / and it was agreed by all party present t/

body __SEEK_FRAUD_HWMBYB  / that failed due to Government problems /

body __SEEK_FRAUD_HXXOMT  /Therefore, we have contacted the Federal Ministry .f Finance /

body __SEEK_FRAUD_I19BXK  /his message might meet you in utmost .urprise/

body __SEEK_FRAUD_I3HLDY  /m one of those that took part in the Compensation in /

body __SEEK_FRAUD_IBU0WA  /REMITTANCE OF US\$15,200,000\.00 CONFIDENTIAL IS THE CASE\./

body __SEEK_FRAUD_IBW3KJ  / Drug Money or meant to sponsor Terroris. attack in your Country/

body __SEEK_FRAUD_IGL8BZ  / part of our precautionary measure to avoid /

body __SEEK_FRAUD_IG_EAL  / Jonathan to boost the exercise of clearing all foreign debts owed to /

body __SEEK_FRAUD_IQHXRD  / any atom of fear as all required arrangements have been made for the /

body __SEEK_FRAUD_IR89IB  /e spun the money around various opportunities and made attractive margins for our first months of operation. /

body __SEEK_FRAUD_IRYH8O  / details and relevant documents that will help you /

body __SEEK_FRAUD_IUMOXY  /I was able to get the package out to a safe /

body __SEEK_FRAUD_J1D82S  / private, and it should be treated as such\./

body __SEEK_FRAUD_JAUOV6  /we noticed that the reason why you have not received your payment is because you have not fulfilled your .inancial .bligation given to you in respect of your .ontract/

body __SEEK_FRAUD_JGFD5P  /This is a reward program for the patronage of internet services.? and all email addresses entered for th/

body __SEEK_FRAUD_JGGLPC  /hey are not with your fund, .hey are only /

body __SEEK_FRAUD_JGKWCZ  /anel was primarily delegated to investigate /

body __SEEK_FRAUD_JH0IMU  /econd chance to come to this world I .ould live my life/

body __SEEK_FRAUD_JHIYQX  / any member of his family hence I contacted you\./

body __SEEK_FRAUD_JJQFVB  /I know within me that nothing ventured is /

body __SEEK_FRAUD_JJTCEC  /, none officials of Oceanic Bank, Zenith Banks, /

body __SEEK_FRAUD_JMEGUU  /e that no one except me knew of his deposit in my .ank\./

body __SEEK_FRAUD_JNQAA1  /contacting you, this have been agreed upon and have been signed\./

body __SEEK_FRAUD_JOFPVK  / you without your prior consent and writing through this /

body __SEEK_FRAUD_JQSWAX  /I am seeking your assistance to evacuate the sum of/

body __SEEK_FRAUD_JSGI1K  / now I seek your consent to present you as the/

body __SEEK_FRAUD_JTD4OO  /Monday To Saturday Office Hours Monday .o Saturday/

body __SEEK_FRAUD_JYBGOP  / showed at the course of the transaction I /

body __SEEK_FRAUD_JZFBVG  / at once with all the claims requirements /

body __SEEK_FRAUD_K0Z_G7  / sent a routine notification to his forward/

body __SEEK_FRAUD_K1G7F9  /I believe when God gives me a .econd chance/

body __SEEK_FRAUD_KAXALL  / agent will immediately commence the process to facilitate the release of your /

body __SEEK_FRAUD_KB6SDS  /ontact the processing office immediately upon receipt of this message/

body __SEEK_FRAUD_KEP1L_  /ed all forms of medical treatment, and right now I have only about a few months to live. /

body __SEEK_FRAUD_KJCQBN  /our identity such as, international .assport or driver/

body __SEEK_FRAUD_KKQM9L  /choose to reach you through it because it /

body __SEEK_FRAUD_KM_YXP  / have the opportunity of transferring the left over .unds/

body __SEEK_FRAUD_KXDZWV  /ntelligence Monitoring Network System that you /

body __SEEK_FRAUD_L2F6_R  / will put you in place as the next of kin\. The Attorney will draft and /

body __SEEK_FRAUD_LC7TDH  /man on earth because I have received my /

body __SEEK_FRAUD_LFNI27  /15,860 000\.00 \[FIFTEEN MILLION EIGHT HUNDRED AND SIXTY THOUSAND POUNDS STERLING\] ONLY, EXITING WITH THE INSURANCE COMPANY WHEN ADDED UP THE FOLLOWING BONUS: BASIC ALLOWANCE, WAIVER PREMIUM AND ACCIDENTAL INDEMNITY, WHICH HAS BEEN WITH THE INSURANCE COMPANY FOR A VERY LONG TIME UNCLAIMED\./

body __SEEK_FRAUD_LHMFUQ  /their contract sum, and people that have had an/

body __SEEK_FRAUD_LHPW8G  / as part of their social responsibility /

body __SEEK_FRAUD_LHZDJ_  / that has remained dormant for years now\. /

body __SEEK_FRAUD_LOG1TG  / in this matter until the task is accomplish/

body __SEEK_FRAUD_LPKLJU  / no body came forward all these years\. I/

body __SEEK_FRAUD_LP_GQ9  /The above figure was given to me as my share/

body __SEEK_FRAUD_LTD1IZ  / did not declare any next of kin in his official papers including the paper/

body __SEEK_FRAUD_LUOISR  / was a member of the Helicopter Society and the Institute of Electronic \& Electrical Engineers/

body __SEEK_FRAUD_LUSJPG  / and make sure your ATM SWIFT CARD gets to you\./

body __SEEK_FRAUD_LV_HB6  / or rather issue a letter of .uthorization to some.o.. /

body __SEEK_FRAUD_LXBIXJ  /is WILL is now ready for execution\. According to him this money is to /

body __SEEK_FRAUD_LYNJ8F  / was conducted from an exclusive list of /

body __SEEK_FRAUD_LYS3UM  /I want you and the church to always pray for me/

body __SEEK_FRAUD_M8T_DX  / so we could act upon and commence investigation\./

body __SEEK_FRAUD_M8ZJ86  /who will accompany the boxes to your house /

body __SEEK_FRAUD_MA4WWH  / people that are active online, among the millions that subscribed to /

body __SEEK_FRAUD_MCEI6K  / from public notice until your claim has been /

body __SEEK_FRAUD_MCWOGJ  / of the Google search engine and the Google ancillary/

body __SEEK_FRAUD_MEFC9A  /ue to your lack of co-operation and not fulfilling the /

body __SEEK_FRAUD_MFX2AC  /The National Central Bureau of Interpol enhanced by the U/

body __SEEK_FRAUD_MHAKVX  / and some individuals who have taken advantage of your fund all in an attempt to swindle your fund which has led to /

body __SEEK_FRAUD_MHDF0X  /e took me to the paying bank for the claim of my Compensation payment/

body __SEEK_FRAUD_MHMBRT  / of your fiscal activity, we have determined that you are eligible to receive a tax refund/

body __SEEK_FRAUD_MIDFZQ  / declared to them as the contents is Sensitive Photographic Film Material. /

body __SEEK_FRAUD_MLFHRU  / COMPENSATION UNIT, IN AFFILIATION WITH /

body __SEEK_FRAUD_MOD_74  /Thanks and God bless you and your family\. Hoping to hear from you as..o/

body __SEEK_FRAUD_MOT82J  /Anti-Terrorist And Monitory Crime Division\./

body __SEEK_FRAUD_MPY_VV  /, but can only be approved to a foreigner\. If you will stand as next of kin to the fund, it will be shared 50\%\/50\%/

body __SEEK_FRAUD_MSZKFU  /ed to stop dealing with some non-officials in the bank/

body __SEEK_FRAUD_MUHJKV  /t is my duty to write and reach out to you/

body __SEEK_FRAUD_MVD_UL  / and your Certificate of Merit Payment No/

body __SEEK_FRAUD_MWUIJQ  / confidential till your claims is processed and your /

body __SEEK_FRAUD_MXSTN1  / Development Bank of Singapore \(DBS\)\. . /

body __SEEK_FRAUD_MY06YR  /the lord will fight my case and I shall hold my peace/

body __SEEK_FRAUD_MZ4KU4  / prepare the necessary documents and affidavit/

body __SEEK_FRAUD_N7NCI8  / unnecessary delays and complications, please /

body __SEEK_FRAUD_NBYKUF  / transaction of this magnitude will make any/

body __SEEK_FRAUD_NEK_SA  /I have already submitted an approved end/

body __SEEK_FRAUD_NEZYJA  / and his WILL is now ready for execution/

body __SEEK_FRAUD_NLVNRE  /u and then you and me can share the money/

body __SEEK_FRAUD_NM1G_Z  / you because you bear the surname identity /

body __SEEK_FRAUD_NRTQUK  / and to conceal this kind of money became a problem for me, so with the help of a /

body __SEEK_FRAUD_NR_I4S  / already been worked out even before you were contacted.{0,20} note that we will be monitoring all your ..a/

body __SEEK_FRAUD_NS3JMI  /by warned not to communicate or duplicate this message to /

body __SEEK_FRAUD_NV1HR9  /My dear friend I will like you to contact /

body __SEEK_FRAUD_NZYMII  / and show my gratitude to you with the sum /

body __SEEK_FRAUD_NZYXPO  / Insurance premium and Clearance Certificate/

body __SEEK_FRAUD_O3_VB8  / electronic balloting .ystem without the winner/

body __SEEK_FRAUD_O9Z_CI  / relation died alongside with him .. the plane crash leaving nobody behind .o/

body __SEEK_FRAUD_OBKXT3  / own direction as I never knew you before nor have we meet in any where before but may God.? name be praised for his ways are not like the ways of men, for he is perfect and never miss leads his loved ones\./

body __SEEK_FRAUD_OCO1GZ  /s that will help you understand the transaction\. I need your assistance and co-operation to this reality/

body __SEEK_FRAUD_OHDPXP  /ly lost their lives\. Since then I have made several/

body __SEEK_FRAUD_OHRGMW  /or example submitting invalid records or applying after /

body __SEEK_FRAUD_OO8I_O  / surprise to receive this message from complete stranger /

body __SEEK_FRAUD_OPAU37  /d over-invoiced payment as the effect has eaten deep into the economy of our /

body __SEEK_FRAUD_ORHOZJ  /Due to your effort, sincerity, courage and trust/

body __SEEK_FRAUD_OS7__X  /y from any ATM MACHINE CENTER anywhere in the world/

body __SEEK_FRAUD_OSPVFG  / will be executed and also note that you will /

body __SEEK_FRAUD_OUKYFQ  /corporate bodies picked by an advanced automated/

body __SEEK_FRAUD_OVKMST  /isregard any email you get from any impostors or offices claiming to be in posses/

body __SEEK_FRAUD_OW6PZN  / this medium \(Internet\) has been greatly abused, I/

body __SEEK_FRAUD_OWUEYF  / within our European booklet representative/

body __SEEK_FRAUD_OZ6FMP  / to avoid any hitches in receiving your /

body __SEEK_FRAUD_P8F86E  /Economic and Financial Crimes Commission/

body __SEEK_FRAUD_P8JJBS  / category and therefore attracted a cash award of /

body __SEEK_FRAUD_P8Y20W  /This Lottery was promoted and sponsored by /

body __SEEK_FRAUD_P8ZIB5  /fficially inform you that it has come to our notice and we have /

body __SEEK_FRAUD_PBZBDQ  /I must use this opportunity to implore you to exercise the utmost indulgence to keep this matter extraordinar/

body __SEEK_FRAUD_PDDLNK  /sure that this fund is not wasted or end/

body __SEEK_FRAUD_PIVB38  /e sickness\. Having known my condition I decided to /

body __SEEK_FRAUD_PKVKI1  /I send you this mail not without a measure of fear as to /

body __SEEK_FRAUD_PLK7HH  / life of my family at stake with this venture\. Although nothing ventured /

body __SEEK_FRAUD_POSXKO  / bank account\. The ATM card comes with a handbook or manual to enlighten you about how to use it\./

body __SEEK_FRAUD_PPIYVM  /after the war another notification was sent and still no response came from/

body __SEEK_FRAUD_PTJZLE  /As a result of this, these friends try to claim/

body __SEEK_FRAUD_PURFZB  /I am writing to solicit your assistance .. /

body __SEEK_FRAUD_PWBOPK  /am contacting you to know if you can be able to assist me in championing this venture to the best of our benefit\./

body __SEEK_FRAUD_PXHWDT  /he UNITED NATIONS have agreed to compensate them /

body __SEEK_FRAUD_Q3UEYG  /After the last annual calculations of your fiscal activity/

body __SEEK_FRAUD_Q4PFFF  / law and guideline here stipulates that if such money .emain/

body __SEEK_FRAUD_QA7MN5  /information confidential till your claim/

body __SEEK_FRAUD_QDBCS4  /I did not declare money to them please\. If they call you and .sk you the contents please tell them the same thing/

body __SEEK_FRAUD_QHXUIZ  / Pacific, which is the instruction given by /

body __SEEK_FRAUD_QILOIM  /e necessary documentations evidencing your claim purported to have been signed /

body __SEEK_FRAUD_QJAXMZ  / your full house address and your identity such as,/

body __SEEK_FRAUD_QJE0YJ  /and people that have had an unfinished transaction or/

body __SEEK_FRAUD_QNKQRV  /divine wish and accept it with a deep sense of humility/

body __SEEK_FRAUD_QNKXRT  /\*This message was transferred with a trial version of CommuniGate\(/

body __SEEK_FRAUD_QR3CL9  /PRINCIPAL PARTNERS: Barrister Aidan Walsh\.Esq M/

body __SEEK_FRAUD_QRRCLD  / successfully transferred into your account, /

body __SEEK_FRAUD_QU7ENV  / is your honest co-operation to enable us see/

body __SEEK_FRAUD_QXDEYO  /As a matter of fact, you are required to Deal and Communicate only /

body __SEEK_FRAUD_QYJ0F_  / understand that blessed is the hand that /

body __SEEK_FRAUD_R2403I  / health and because of the presence of my /

body __SEEK_FRAUD_R3R2VE  /gger made you a beneficiary to his WILL\. He left the sum of Thirty Million, One Hundred Thousand Dollars \(USD\$30, 100\.000\.00\) to you in the Codicil and last testament to his WILL\./

body __SEEK_FRAUD_R8MXKM  /I was always hostile to people and only focused on my business as that was the only thing I cared for/

body __SEEK_FRAUD_RBMZ20  / As this is a TWO-man business deal transaction\./

body __SEEK_FRAUD_RDGS_R  / in all his official documents, including his .ank .eposit paper/

body __SEEK_FRAUD_RERCVT  / is still reflecting .n our .entral .omputer/

body __SEEK_FRAUD_RF_LD1  / and to conceal this kind of money became a problem for me.{0,40} contact working /

body __SEEK_FRAUD_RGENNC  /A winning .heque will be issued in your name /

body __SEEK_FRAUD_RQRFPM  / which you will use to withdraw up to \$.{0,40} per day from any ATM machine that has the ..s/

body __SEEK_FRAUD_RXQMYQ  /Hence we do believe with your winning prize, you/

body __SEEK_FRAUD_RZTEYR  /of one of my bank clients who died .long with his entire family .. /

body __SEEK_FRAUD_R_Y6KV  / talk and my doctors have told me that I have /

body __SEEK_FRAUD_S0K3GF  /s and organizations who have been found not to have receive their Contract/

body __SEEK_FRAUD_S2TCCV  / that you are having an illegal Transaction with /

body __SEEK_FRAUD_S4QI3T  / respect the integrity of the information you come by as a result of this /

body __SEEK_FRAUD_S5PJZQ  /fter further investigation it was also discovered that /

body __SEEK_FRAUD_S8_5Y8  / that you will not expose or betray this trust and confident that . am about to /

body __SEEK_FRAUD_SBLZOX  /o you via our accredited shipping company /

body __SEEK_FRAUD_SF0AZL  / on your behalf and they have brought a solution to your problem by co/

body __SEEK_FRAUD_SIBZHA  / for the collection of this international .ertified .ank /

body __SEEK_FRAUD_SIYSH8  / to always pray for me because the lord is my /

body __SEEK_FRAUD_SLAG8H  /I once again try to notify you as my earlier letter/

body __SEEK_FRAUD_SMTAYP  / the full information of those that are yet to receive their payments and I saw your /

body __SEEK_FRAUD_SNZJVQ  / be liquidated because he needed to make an urgent investment requiring cash payments/

body __SEEK_FRAUD_SOMTJG  /, this correspondence is purely private,/

body __SEEK_FRAUD_SRT80U  / to you as the nearest person to our deceased customer/

body __SEEK_FRAUD_SUGRCM  /now I have only about a few months to live, according to medical experts\./

body __SEEK_FRAUD_SWKNYQ  / to confirm people like you who have received their /

body __SEEK_FRAUD_TCEBVN  / further contact with them in your best interest and /

body __SEEK_FRAUD_TFENYE  /I know that I am going to be in the bosom of the Lord\. Exodus/

body __SEEK_FRAUD_TGDRMF  /\. Please I will like you to accept this token with good faith as this is from the bottom of my heart/

body __SEEK_FRAUD_THHLIU  /Winners shall be paid in accordance with /

body __SEEK_FRAUD_TK7ZE5  /usiness as that was the only thing I cared for\. But .ow I regret all this as I /

body __SEEK_FRAUD_TKBHOI  /urther communication with anybody or office/

body __SEEK_FRAUD_TPKDA7  / to avoid double claiming and unwarranted /

body __SEEK_FRAUD_TTMYIZ  /istributed money to some charity .rganizations in /

body __SEEK_FRAUD_TZ3TUV  /ny delay in your reply will give me room in sourcing another/

body __SEEK_FRAUD_U1G4IL  /FORGIVE MY INDIGNATION IF THIS MESSAGE COMES TO YOU AS A SURPRISE AND MAY OFFEND YOUR PERSONALITY FOR CONTACTING YOU WITHOUT YOUR PRIOR CONSENT AND/

body __SEEK_FRAUD_U5U5GZ  /s was mentioned by one of the .yndicates/

body __SEEK_FRAUD_U5YTAO  /Against this backdrop, my suggestion to you is that . w..l/

body __SEEK_FRAUD_UBE1VZ  /ve 40\% of the above mentioned amount if you agree to help me execute this /

body __SEEK_FRAUD_UCSJVN  / from his account unless someone applies for/

body __SEEK_FRAUD_UD45OB  / might come to you as a surprise and the temptation to/

body __SEEK_FRAUD_UDD6SD  /you are hereby advice only to be in contact with /

body __SEEK_FRAUD_UF2Q_4  /election process was carried out through /

body __SEEK_FRAUD_UJZKNM  /I will like you to provide immediately your full .ame/

body __SEEK_FRAUD_UKLYHN  /00 per day from any ATM machine that has the Master Card Logo on it/

body __SEEK_FRAUD_UL0ICM  /e were also made to understand that a lady /

body __SEEK_FRAUD_UMXZKW  / if this message comes to you as a surprise /

body __SEEK_FRAUD_US_OFW  /hilanthropy earned him numerous awards during his life/

body __SEEK_FRAUD_UV2ATY  /I have set aside 25\% for you and for your time/

body __SEEK_FRAUD_UVARBX  / in Nigeria many years ago and they refused to pay me. I had paid /

body __SEEK_FRAUD_UVOSIY  /r to get back to me as soon as possible to enable me conclude my job/

body __SEEK_FRAUD_UVUS_Y  /Please submit the tax refund request and allow /

body __SEEK_FRAUD_V3CKGD  /documents and letter of probate\/administration in your favo/

body __SEEK_FRAUD_V51UD0  / will appreciate your utmost confidentiality .n/

body __SEEK_FRAUD_V5HTKT  / family to close one of my accounts and /

body __SEEK_FRAUD_VBHSSM  /claims due to .{0,20}s informing close friends /

body __SEEK_FRAUD_VBQ9JO  /this, these friends try to claim the lottery on behalf of the real/

body __SEEK_FRAUD_VKZHQG  /aving received these vital payment number/

body __SEEK_FRAUD_VMKU09  / has called me, I have willed and given .ost of my propert/

body __SEEK_FRAUD_VNERKN  /I was never generous, I was always hostile to people and only focus/

body __SEEK_FRAUD_VQGIG6  / includes every foreign contractors that may/

body __SEEK_FRAUD_VSMRB_  /http:\/\/news\.bbc\.co\.uk\/2\/hi\/middle_east\/2988455\.stm/

body __SEEK_FRAUD_VW0Z64  /WRITING THROUGH THIS CHANNEL\.I GOT YOUR CONTACT FROM A PROFESSIONAL DATABASE FOUND ON THE INTERNET WHILE SEARCHING FOR A RELIABLE AND HONEST PERSON THAT WILL ASSIST ME TO SAFE GUARD/

body __SEEK_FRAUD_VWUGC4  / Canada, Australia, United States, Asia, Europe, Middle East, /

body __SEEK_FRAUD_WAAEJ8  /s your moral values, do accept my apology/

body __SEEK_FRAUD_WC2DJX  /I PERSONALLY HAVE WATCHED WITH KEEN INTEREST TO SEE THE BENEFICIARY TO HIS MASTERPIECE POLICYHOLDER, BUT ALL HAS PROVED ABORTIVE AS NO ONE HAS REPORTED TO CLAIM HIS BENEFIT OF \[PERSONAL INSURANCE CASH ACCUMULATION MASTERPIECE POLICYHOLDER OWNERSHIP\] OF TOTAL SUM AMOUNTING TO /

body __SEEK_FRAUD_WGFD9Y  /I will appreciate your timely response\./

body __SEEK_FRAUD_WJ_B8R  / PAYMENT and forward any emails you get from /

body __SEEK_FRAUD_WOZDRE  /iplomatic immunity clearance .ertificate/

body __SEEK_FRAUD_WPB12A  / does not know the original contents of the boxes\./

body __SEEK_FRAUD_WX939W  /Congratulations from the Staffs \& Members of the /

body __SEEK_FRAUD_WYVOGD  / and is organized to encourage the use of the Internet /

body __SEEK_FRAUD_WZCO5O  / file letter of claim to the appropriate/

body __SEEK_FRAUD_X1E2EB  / to come over and claim his money because we can/

body __SEEK_FRAUD_XBDIGO  /ot trust them anymore, as they seem not to be .onte/

body __SEEK_FRAUD_XD3U8U  / disbursement according to .he percentage/

body __SEEK_FRAUD_XDLBLQ  / Please forgive this unusual manner .. contact/

body __SEEK_FRAUD_XEKWPO  /ank deposit\. And he also confided in me the last time he was .. my..f/

body __SEEK_FRAUD_XGEQEE  / relation or next of kin .. the deceased/

body __SEEK_FRAUD_XI2Y6Z  /FEDERAL BUREAU OF INVESTIGATION FBI\.WASHINGTON D/

body __SEEK_FRAUD_XJPS4J  /ssure me that you will act accordingly as I /

body __SEEK_FRAUD_XJUWAF  /The request of foreigner as next of kin in this /

body __SEEK_FRAUD_XKEW24  / that will protect you and I from any breach of the law\./

body __SEEK_FRAUD_XL24FM  / FEDERAL BUREAU OF INVESTIGATION UNITED STATES DEPARTMENT OF JUSTICE WASHINGTON, D\.C\. 20535/

body __SEEK_FRAUD_XLYR4B  /if you want me to forward you my picture or facebook id please mail me at my direct personal id /

body __SEEK_FRAUD_XMTGXX  /It is understandable that you might be a little bit apprehensive because you do not know me/

body __SEEK_FRAUD_XNCCWK  / activities and to help the poor and the needy in our society\./

body __SEEK_FRAUD_XNFRMH  /\(2\) Address where you want the payment cent.. to send your ATM CARD/

body __SEEK_FRAUD_XNGIGX  / I have been diagnosed with Esophageal cancer \./

body __SEEK_FRAUD_XOG2QH  / you should not entertain any atom of fear a. /

body __SEEK_FRAUD_XV0VCM  / contains details of the agent who will process your transaction/

body __SEEK_FRAUD_XVM0G_  /ill make any one apprehensive and worried, but I/

body __SEEK_FRAUD_XXKDNE  /During our Investigation, we noticed that the reason why you have not received your payment is because you /

body __SEEK_FRAUD_XY_KVM  / will be safe in your care until I complete my service here/

body __SEEK_FRAUD_Y1JTCA  /hat my health has deteriorated so badly,/

body __SEEK_FRAUD_Y6I2KV  / to observe utmost discretion in all matters concerning this ..s/

body __SEEK_FRAUD_Y6P5MJ  / contacting us through emails are fake\./

body __SEEK_FRAUD_Y6WUAZ  /ourt probate division for the release of this .u/

body __SEEK_FRAUD_YELH8F  / were selected randomly from World Wide /

body __SEEK_FRAUD_YGGJHJ  / and promote computer literacy worldwide\./

body __SEEK_FRAUD_YGQR5E  / keep your winning information confidential /

body __SEEK_FRAUD_YJCYR4  / next of kin in this business is occasioned by the fact that the /

body __SEEK_FRAUD_YKISUY  / foreign partner that made me to contact you/

body __SEEK_FRAUD_YMNO86  / to themselves\. Hence, I do not trust them any/

body __SEEK_FRAUD_YRLEBH  /INSPIRED TO PICK YOUR NAME AMONG ALL OTHER NAMES FOUND IN THE DATABASE\./

body __SEEK_FRAUD_YXZMUG  / remains the fastest, surest and most secured medium of communication\./

body __SEEK_FRAUD_YY0T6P  / I am impelled to request for your assistance to receive this ..n.. into your bank account/

body __SEEK_FRAUD_Z9HI0T  / and forward any emails you get from impostors to /

body __SEEK_FRAUD_ZA0FLG  /Do Not Reply to this Email\. We do not reply to text inquiries, and our server will reject all response traffic\. We apologize for any inconvenience this may have caused you\./

body __SEEK_FRAUD_ZARJER  / to avoid unnecessary delay and complications/

body __SEEK_FRAUD_ZBJZVN  / who is the rightful person to deal with in regards to your /

body __SEEK_FRAUD_ZFT05W  /We wish to congratulate you once again on this note, for being part of our/

body __SEEK_FRAUD_ZG9WSB  / of your fiscal activity we have determined that you are eligible to receive a tax re/

body __SEEK_FRAUD_ZGRQSU  / need you to assist me in executing a business project from /

body __SEEK_FRAUD_ZG_66A  /lmighty that connects people and makes out of them whatsoever he desires, and this my having to write you in the first place regarding this /

body __SEEK_FRAUD_ZIZCXR  /he explained everything to me\. He said whoever is/

body __SEEK_FRAUD_ZLALWU  / per transaction\. So, if you like to receive your fund this way,/

body __SEEK_FRAUD_ZMC3N_  /A foreigner with thesame last name as yours, died here in Singapore, twelve years ago leaving behind an estate\/capital \(US\$31\.8M/

body __SEEK_FRAUD_ZMFYMV  /Furthermore, should there be any change .. /

body __SEEK_FRAUD_ZMITTF  /This may sound strange and unbelievable to you/

body __SEEK_FRAUD_ZNPZ7V  /Winners are advised to keep their winning /

body __SEEK_FRAUD_ZOHUL3  / need to stress that there are practically no risk involved in this\. It is going to be a bank-to-bank transfer to your nominated bank account anywhere you feel /

body __SEEK_FRAUD_ZTOV4F  / COPY OF YOUR INT\'L PASSPORT\/DRIVERS LICENSE/

body __SEEK_FRAUD_ZWACFE  /ou have to be rest assured for this is 100\% risk free it is our duty to protect /

body __SEEK_FRAUD_ZXVMN_  /wait your prompt response\. Yours in Service/

body __SEEK_FRAUD_ZYDQF_  / to contact the ATM CARD CENTER via email /

body __SEEK_FRAUD_ZZVKMO  /international businesses that failed due to/

body __SEEK_FRAUD_ZZZGAR  / your FULL NAME, DATE OF BIRTH, TELEPHONE NUMBER, FAX NUMBER/

body __SEEK_FRAUD__2H_ZF  /I have not particularly lived my life so well,/

body __SEEK_FRAUD__2JC4J  / as I have done my Home-work and fine tune the best way to create you as the beneficiary of the fund\. My position as the branch manager of the bank will be used to advance this deal\./

body __SEEK_FRAUD__39VBB  /ur foreign customer who died along .i.. /

body __SEEK_FRAUD__3AQGB  /, we have resolved in .inding a solution to /

body __SEEK_FRAUD__7JU9T  / humanitarian activities and to help the poor and the needy in /

body __SEEK_FRAUD__8R822  /nce I know where I am going\. I know that I am going to be in the bosom of /

body __SEEK_FRAUD__9IDPT  /hall be paid in accordance with his\/her Settlement Cent..\. /

body __SEEK_FRAUD__BQIMV  /hat disturbs me most is my stroke sickness\./

body __SEEK_FRAUD__ERENB  /Confirm the receipt of this message and send the requirements to me immediately /

body __SEEK_FRAUD__EWXDD  /Since the Federal Bureau of Investigation /

body __SEEK_FRAUD__GBFFZ  / of the Central Bank Of Nigeria, Mr\. Patrick Aziza, /

body __SEEK_FRAUD__IHT37  /t release it unless somebody applie. for it/

body __SEEK_FRAUD__J8HKJ  /This promotion was set-up to encourage the/

body __SEEK_FRAUD__JQVGM  /For security reasons, you are advised to keep your /

body __SEEK_FRAUD__KUHHN  / the way I am going to instruct here in\./

body __SEEK_FRAUD__KYBSV  / the cancer stage has gotten to a very bad stage\./

body __SEEK_FRAUD__OPQTY  / have recently been informed through our .lobal intelligence monitoring network that you/

body __SEEK_FRAUD__R9RUV  / I, working with you can secure the funds in the account for us instead of allowing /

body __SEEK_FRAUD__SGKIK  /as I want this to be one of the last good deeds I do on earth\./

body __SEEK_FRAUD__VYNLD  / through random selection .n .ur .omputerized/

body __SEEK_FRAUD__Y9XPU  /ON THIS VERY NOTE; AS NO ONE HAS COME TO PUT UP ANY CLAIM REPORT TO OUR OFFICE AS REGARDS TO THE BENEFICIARY TO THE MASTERPIECE POLICYHOLDER OWNERSHIP AND THE INSURANCE ETHIC HERE IN THE UK, REGULATED BY THE FINANCIAL SERVICE AUTHORITY \(FSA\) RULES FOR THE CONDUCT OF UK BUSINESS, INSURANCE CODE AND BUSINESS INSURANCE CODE STANDARDS OF WHICH CHUBB INSURANCE COMPANY IS A MEMB.?ER OF THE FINANCIAL OMBUDSMAN SCHEME\. DOES NOT ALLOW SUCH CLAIM TO STAY FOR OVER MORE THAN MANY YEARS, BECAUSE THE COMPANY SHALL HAVE POWER AFTER TEN GOOD YEARS TO DISCONTINUE THE POLICY AND TERMINATE THE INSURED MASTERPIECE POLICYHOLDER OWNERSHIP BENEFITS\./

body __SEEK_FRAUD___VYVJ  /You really have to stop dealing with those people that are contacting you and telling you that your fund is with them/

header	 __SENDER_BOT	ALL =~ /(?:not?\W?repl[yi]|bounce|contact|daemon|subscri|report|respon[ds]e?r?s?\b|\b(?:root|news|nobody|agent|(?:post|web)?master|manag|send(?:er|ing)?|out|(?:bot|web|www)\b))[^\@ >]{0,5}s?\@\w/i
tflags	 __SENDER_BOT	nice

meta     __SEX_WRDS             (__WORD_SEX || __WORD_CUM || __WORD_SPERM || __WORD_SLUTS || __WORD_RAPED)

body     __SHARE_IT       /\b(?:(?:share|allocate|teilen|parteger(?:ez|ons)?|partage)\s(?:th(?:e|is)|das|les?|des)\s(?:proceeds|funds?|money|balance|account|geld|compte|fonds)|partager(?:ez|ons)? (?:avec (?:vous|moi)|ratio|suivant un pourcentage))\b/i

header      __SINGLE_HEADER_1K     ALL:raw =~ /(?-xim:(?=(?!X-Spam|X-MailScan)(?:^|\n)[^\s\n]+:(?:.(?!\n\S)){1024,2047}.(?:\n\S|$)))/s 

rawbody        __SPAN_BEG_TEXT     /[a-z]{2}<(?i:span)\s/
tflags         __SPAN_BEG_TEXT     multiple

rawbody        __SPAN_END_TEXT     /[^;>]<\/(?i:span)>[a-z]{3}/
tflags         __SPAN_END_TEXT     multiple

meta            __SPF_FULL_PASS         (SPF_PASS && SPF_HELO_PASS)
tflags          __SPF_FULL_PASS         net

rawbody  __SPOOFED_URL	m/<a\s[^>]{0,99}\bhref=(?:3D)?.?(https?:[^>"' ]{8,30})[^>]{0,99}>(?:[^<]{0,99}<(?!\/a)[^>]{1,99}>)*(?!\1)https?:\/\/[^<]{5}/i

rawbody        __STYLE_GIBBERISH        /<style[^>]{0,30}>(?:\s{0,80}[^\s:;<]){150}/im

header   __SUBJ_3DIGIT          Subject =~ /\b\d{3}[^0-9]/

header   __SUBJ_APPROVE         Subject =~ /Approve/i

header         __SUBJ_HAS_FROM_1    ALL =~ /\nFrom:\s+(?:[^\n<]{0,80}<)?([^\n\s>]+)>?\n(?:[^\n]{1,100}\n)*Subject:\s+[^\n]{0,100}\1[>,\s\n]/ism

header         __SUBJ_HAS_TO_1      ALL =~ /\nTo:\s+(?:[^\n<]{0,80}<)?([^\n\s>,]+)>?\n(?:[^\n]{1,100}\n)*Subject:\s+[^\n]{0,100}\1[>,\s\n]/ism

header   __SUBJ_RE		Subject =~ /^R[eE]:/

header   __SUBJ_VEGAS           Subject =~ /(?:Vegas|Casino)/i

body	 __SUBSCRIPTION_INFO	/\b(?:e?newsletters?|(?:un)?(?:subscrib|register)|you(?:r| are) subscri(?:b|ption)|opt(?:.|ing)?out\b|further info|you do ?n[o']t w(?:ish|ant)|remov\w{1,3}.{1,9}\blists?\b|to your white.?list)/i

body     __SUM_OF_FUND      /\b(?:sum|release|freigabe)\s(?:of|der)\s(?:amount|fund|investment|mittel)\b/i

body     __SURVIVORS      /\b(?:widow|son|daughter|husband|wife|brother|sister|attorney)\s(?:of|to)\s(?:the\s)?late\s\w+\b/i

header         __TB_MIME_BDRY_NO_Z   Content-Type =~ /boundary="-{8,}(?:[1-9]){16}/

body     __THEY_INHERIT   /\binherit\sth(?:e|is)\smoney\b/i

meta	 __THREADED	(!__MISSING_REPLY && !__NO_INR_YES_REF) || (__MISSING_REPLY && !__MISSING_REF)
tflags	 __THREADED	nice

header __THREAD_INDEX_GOOD  Thread-Index =~ m,^A[a-z0-9][A-Za-z0-9+/]{27}(?:[A-Za-z0-9+/]{20})?(?:[AQgw]==|[A-Za-z0-9+/]{7}|[A-Za-z0-9+/]{13}[AEIMQUYcgkosw048]=)$,

header         __TO_ALL_NUMS        To:addr =~ /^\d+@/

meta           __TO_EQ_FM_DIRECT_MX __TO_EQ_FROM && __DOS_DIRECT_TO_MX

meta           __TO_EQ_FM_DOM_HTML_IMG  __TO_EQ_FROM_DOM && __HTML_LINK_IMAGE

meta           __TO_EQ_FM_DOM_HTML_ONLY __TO_EQ_FROM_DOM && MIME_HTML_ONLY

meta           __TO_EQ_FM_DOM_SPF_FAIL  __TO_EQ_FROM_DOM && SPF_FAIL
tflags         __TO_EQ_FM_DOM_SPF_FAIL  net

meta           __TO_EQ_FM_HTML_DIRECT __TO_EQ_FM_DIRECT_MX && MIME_HTML_ONLY

meta           __TO_EQ_FM_HTML_ONLY __TO_EQ_FROM && MIME_HTML_ONLY

meta           __TO_EQ_FM_SPF_FAIL  __TO_EQ_FROM && SPF_FAIL
tflags         __TO_EQ_FM_SPF_FAIL  net

meta           __TO_EQ_FROM         (__TO_EQ_FROM_1 || __TO_EQ_FROM_2)
describe       __TO_EQ_FROM         To: same as From:

header         __TO_EQ_FROM_1       ALL =~ /\nFrom:\s+(?:[^\n<]{0,80}<)?([^\n\s>]+)>?\n(?:[^\n]{1,100}\n)*To:\s+(?:[^\n]{0,80}<)?\1[>,\s\n]/ism

header         __TO_EQ_FROM_2       ALL =~ /\nTo:\s+(?:[^\n<]{0,80}<)?([^\n\s>]+)>?\n(?:[^\n]{1,100}\n)*From:\s+(?:[^\n]{0,80}<)?\1[>,\s\n]/ism

meta           __TO_EQ_FROM_DOM     (__TO_EQ_FROM_DOM_1 || __TO_EQ_FROM_DOM_2)
describe       __TO_EQ_FROM_DOM     To: domain same as From: domain

header         __TO_EQ_FROM_DOM_1   ALL =~ /\nFrom:\s+[^\n@]{0,80}@([^\n\s>]+)>?\n(?:[^\n]{1,100}\n)*To:\s+[^\n]+@\1[>,\s\n]/ism

header         __TO_EQ_FROM_DOM_2   ALL =~ /\nTo:\s+[^\n@]{0,80}@([^\n\s>]+)>?\n(?:[^\n]{1,100}\n)*From:\s+[^\n]+@\1[>,\s\n]/ism

header     __TO_NO_ARROWS_R        To !~ /(?:>$|>,)/

meta       __TO_NO_BRKTS_DYNIP     __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && RDNS_DYNAMIC

meta       __TO_NO_BRKTS_FROM_MSSP   __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && __FROM_MISSPACED

meta       __TO_NO_BRKTS_HTML_ONLY __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && MIME_HTML_ONLY

meta       __TO_NO_BRKTS_MSFT       __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && (__ANY_OUTLOOK_MUA || __HAS_MIMEOLE || __MIMEOLE_MS)

meta       __TO_NO_BRKTS_NORDNS    __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && RDNS_NONE

meta       __TO_NO_BRKTS_NORDNS_HTML    __TO_NO_BRKTS_HTML_ONLY && RDNS_NONE

header     __TO_UNDISCLOSED        To =~ /(?:undisclosed-recipients|destinataires inconnus):/i

header   __TO___LOWER           ALL =~ /to:\s\S{5}/

body     __TRTMT_DEFILED  /\bdefiled\sall\s(?:forms\sof\s)?(?:medical\s)treatments?\b/i

body     __TRUNK_BOX      /\b(?:(?:trunk|metallic|proof|security|consignment)\sbox(?:es)?|sealed\ssafe)\b/i

body     __TRUSTED_CHECK  /\b(?:cashier'?s?|certified)\sche(?:ck|que)/i

header __TT_BROKEN_VALIUM       Subject =~ /V[:^."%()*\[\\]?A[:^."%()*\[\\]?L[:^."%()*\[\\]?I[:^."%()*\[\\]?U[:^."%()*\[\\]?M/i

header __TT_BROKEN_VIAGRA       Subject =~ /V[:^."%()*\[\\]?I[:^."%()*\[\\]?A[:^."%()*\[\\]?G[:^."%()*\[\\]?R[:^."%()*\[\\]?A/i

header __TT_OBSCURED_VALIUM     Subject =~ /(v|V|\\\/)(a|A|\(a\)|4|@)(l|L|\|)(i|I|1|\xef|\|)(u|U|\(u\))(m|M)/

header __TT_OBSCURED_VIAGRA     Subject =~ /(v|V|\\\/)(i|I|1|\xef|\|)(a|A|\(a\)|4|@)(g|G)(r|R)(a|A|\(a\)|4|@)/

header __TT_VALIUM              Subject =~ /VALIUM/i

header __TT_VIAGRA              Subject =~ /VIAGRA/i

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __TVD_FW_GRAPHIC_ID1	Content-Id =~ /<[0-9a-f]{12}(?:\$[0-9a-f]{8}){2}\@/
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEEval
mimeheader __TVD_MIME_ATT_AOPDF	Content-Type =~ /^application\/octet-stream.*\.pdf/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEEval
mimeheader __TVD_MIME_ATT_AP	Content-Type =~ /^application\/pdf/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEEval
mimeheader __TVD_MIME_ATT_TP	Content-Type =~ /^text\/plain/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __TVD_OUTLOOK_IMG	Content-Id =~ /<image\d+\.(?:gif|jpe?g|png)\@/
endif

body __TVD_PH_BODY_01		/\baccount .{0,20}placed? [io]n restricted status/i

body __TVD_PH_BODY_02		/\brecords (?:[a-z_,-]+ )+?(?:feature|(?:a|re)ward)/i

body __TVD_PH_BODY_03		/\byou(?:'ve| have) been (?:[a-z_,-]+ )+?payment/i

body __TVD_PH_BODY_04		/\bfunds? (?!transfer from)(?!from)(?!in)(?!via)(?:[a-z_,-]+ )+?to your (?:[a-z_,-]+ )*?account/i

body __TVD_PH_BODY_05		/\bthis is (?:[a-z_,-]+ )+?protect (?:[a-z_,-]+ )+?your/i

body __TVD_PH_BODY_06		/Dear [a-z]+ bank (?:member|customer)/i

body __TVD_PH_BODY_07		/\bguarantee the safety of your (?:[a-z_,-]+ )*?account/i

body __TVD_PH_BODY_08		/\bmultiple password failures/i

header   __UA_GNUS		User-Agent =~ /^Gnus/

header   __UA_KNODE		User-Agent =~ /^KNode/

header   __UA_MUTT		User-Agent =~ /^Mutt/

header   __UA_PAN		User-Agent =~ /^Pan/

header   __UA_XNEWS		User-Agent =~ /^Xnews/

body     __UN             /\bunited\snations?\b/i

uri	 __UNSUB_LINK	/\b(?:(?:un)?subscri(?:ber?|ptions?)|abuses?|opt(?:ing)?.?out)\b/i
tflags	 __UNSUB_LINK	nice

uri         __UPPERCASE_URI        /^[^:A-Z]+[A-Z]/

uri            __URI_12LTRDOM      m,://(?:[^./]+\.)*[a-z]{12}\.[^./]+/,

uri             __URI_OBFU_DOM          /:\/\/(?:\w+\.)+(?:com|gov|net|org)(?:\.\w+){3,}\//i

body          __URI_OBFU_TLD    /\.\s(?:c\so\sm|n\se\st|o\sr\sg|b\si\sz|i\sn\sf\so)/i

body     __VA_WORD              /\bV[A-Za-z]{2,4}RA\b/

body     __VM_WORD              /\bV[A-Za-z]{2,5}UM\b/

body __V_ACCOLADES	/\baccolades?\b/i

body __V_ACHIEVEMENT	/\bbenchmark of achievement\b/i

body __V_BESTOFAWARD	/\bBest of \w+ Award/

body __V_BIOGRAPHY	/\b(?:biography|biographies|biographical)\b/i

body __V_CBNVANITY	/\bContinental Broadcasting Network\b/

body __V_DISTINGUISHED	/\bdistinguished\b/i

body __V_DPHPVANITY	/\bDistinguished Professionals Hardcover Publication\b/

body __V_EXCELLENCE	/\b(?:demonstrated|commitment to) excellence\b/i

body __V_EXECS_PROS	/\bexecutives? (?:and|&) professionals?\b/i

body __V_HONOR_SOCIETY /\bHonor Society\b/

body __V_INFORM_YOU	/\b(?:pleased?|pleasure) to inform you\b/

body __V_INNERCIRCLE	/\bInner Circle\b/

meta __V_KNOWN_VANITY	__V_PRINCETONPRE || __V_WHOSWHO || __V_DPHPVANITY || __V_CBNVANITY || __V_HONOR_SOCIETY

body __V_NOMINATION	/\b(?:nominated|nomination|potential candidate)\b/i

body __V_NO_COST		/\b(?:no costs?|cost-? *free|free of costs?|no fees?|neither cost nor obligation)\b/i

body __V_PRINCETONPRE	/\bPrinceton Premier/

body __V_PUB_DEADLINE	/\bpublication deadlines?\b/i

body __V_RECOGNITION	/\brecognition\b/i

body __V_REGISTRY	/\bregistry\b/i

body __V_SBCAVANITY	/\bSmall Business Commerce Association/

body __V_SHMUCK		/\b(?:accomplished|distinguished|exceptional|talented|calibre of) +(?:professionals?|individuals?)\b/i

body __V_USCAVANITY	/\bUS Commerce Association/

body __V_WHOSWHO		/\bWho.s Who\b/

body     __WIDOW          /\bwidow(?:e[rd])'?s?\b/i

body     __WILL_LEGAL     /\b(?:codicil|last\stestament|probate|executor|intestate|bequest|mandamus)\b/i

body     __WIRE_XFR       /\b(?:wire|telegraph(?:ic)?|bank)\s?transfer/i

body     __WORD_CUM             /\bcum\b/i

body     __WORD_RAPED           /\braped?\b/i

body     __WORD_SEX             /\bsex(?:iest|y)?\b/i

body     __WORD_SLUTS           /\bsluts?\b/i

body     __WORD_SPERM           /\bsperm\b/i

meta     __XFER_MONEY     (__WIRE_XFR || __TRUSTED_CHECK || __BANK_DRAFT || __MOVE_MONEY)

header   __XM_GNUS		X-Mailer =~ /^Gnus v/

header   __XM_MOZ4		X-Mailer =~ /^Mozilla 4/

header   __XM_MSOE5		X-Mailer =~ /^Microsoft Outlook Express 5/

header   __XM_MSOE6		X-Mailer =~ /^Microsoft Outlook Express 6/

header __XM_MS_IN_GENERAL     X-Mailer =~ /\bMSCRM\b|Microsoft (?:CDO|Outlook|Office Outlook)\b/

header __XM_OL_015D5  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OL_07794  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_09BB4  X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.72\.3155\.0/

header __XM_OL_10_0_4115    X-Mailer =~ /^Microsoft Outlook, Build 10.0.4115$/

header __XM_OL_1ECD5  X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1081/

header __XM_OL_20C99  X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.72\.3338\.1/

header __XM_OL_22B61  X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1158/

header __XM_OL_25340  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_28001441    X-Mailer =~ /^Microsoft Outlook Express 6.00.2800.1441$/

header __XM_OL_28004682    X-Mailer =~ /^Microsoft Outlook Express 6.00.2800.4682$/

header __XM_OL_32D97  X-Mailer =~ /Microsoft\ Outlook\ IMO\,\ Build\ 9\.0\.2416\ \(9\.0\.2910\.0\)/

header __XM_OL_3857F  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_3AC1D  X-Mailer =~ /Microsoft\ Outlook\ Express\ 5\.00\.2919\.6700/

header __XM_OL_3D61D  X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.71\.2244\.8/

header __XM_OL_465CD  X-Mailer =~ /Microsoft\ Outlook\,\ Build\ 10\.0\.3416/

header __XM_OL_48072300    X-Mailer =~ /^Microsoft Outlook Express 5.50.4807.2300$/

header __XM_OL_4B815  X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.71\.2730\.2/

header __XM_OL_4BF4C  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OL_4EEDB  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OL_4F240  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_4_72_2106_4  X-Mailer =~ /^Microsoft Outlook Express 4.72.2106.4$/

header __XM_OL_58CB5  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_5B79A  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OL_6554A  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_72641  X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1441/

header __XM_OL_7533E  X-Mailer =~ /Microsoft\ Outlook\ Express\ 5\.50\.4963\.1700/

header __XM_OL_812FF  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_83BF7  X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.72\.3110\.3/

header __XM_OL_8627E  X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1437/

header __XM_OL_8E893  X-Mailer =~ /Microsoft\ Outlook\,\ Build\ 10\.0\.2616/

header __XM_OL_91287  X-Mailer =~ /Microsoft\ Outlook\ Express\ 5\.50\.4807\.2300/

header __XM_OL_9B90B  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OL_A50F8  X-Mailer =~ /Microsoft\ Outlook\ Express\ 5\.50\.4922\.1500/

header __XM_OL_A842E  X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1158/

header __XM_OL_ADFF7  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OL_B30D1  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OL_B4B40  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OL_B9B11  X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2462\.0000/

header __XM_OL_BC7E6  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OL_C65FA  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_CAC8F  X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.71\.1712\.3/

header __XM_OL_CF0C0  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_EF20B  X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1478/

header __XM_OL_EF222  X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2900\.2873/

header __XM_OL_F3B05  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OL_F475E  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_F6D01  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_FF5C8  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OUTLOOK_EXPRESS    X-Mailer =~ /^Microsoft Outlook Express \d/

header  __XM_PHP  X-Mailer =~ /^PHP\s?v?\/?\d\./

header   __XM_SKYRI		X-Mailer =~ /^SKYRiXgreen/

header   __XM_WWWMAIL		X-Mailer =~ /^WWW-Mail \d/

body     __YOUR_ACCOUNT         /your account/i

body     __YOUR_BANK      /\byour?\s(?:full\s)?bank(?:ing)?\sinformations?\b/i

body     __YOUR_CREDITFVGT      /your credit/i

body     __YOUR_FUND      /\b(?:your|ihr)\s(?:unpaid\s|win+ing\s|ap+roved\s|foreign\s|overdue\s|outstanding\s|nicht\sausbezahlten\s){0,3}(?:fund|payment|geld)\b/i

body     __YOUR_PERM      /\byour\spermission\b/i

body     __YOUR_PROFIT    /\byour?\sprofit/i

body     __YOU_ASSIST     /\byour\sassistance\b/i

body     __YOU_HAVE_WON         /you(?: \w+)? won/i

body     __YOU_INHERIT    /\byour\s[a-z\s]{0,30}inherit+ance\b/i

meta     __YOU_WON       __YOU_WON_01 || __YOU_WON_02 || __YOU_WON_03 || __HAS_WON_01

body     __YOU_WON_01    /\byou(?:r|'re|'ve|'ll|\shave|\sdid)?\s(?:e-?mail\s)?(?:\w+\s){0,2}(?:a\s)?w[io]n+(?:er|ing)?(?!'t)\b/i

body     __YOU_WON_02    /\bw[io]n\s(?:(?:for|by)\s)?your?\b/i

body     __YOU_WON_03    /\b(?:your?|win+ing|win+ers?|beneficiaries|participants?|individuals?|address(?:es)?)(?:\s[-a-z\s]{4,40})?\s(?:w(?:ere|as)|ha(?:ve|s) be(?:en)?)\s(?:automatically\s)?(?:(?:randomly|raffly)\s(?:selected|cho+sen|cho+sing|picked)|(?:selected|cho+sen|cho+sing|picked)\s(?:[a-z\s]{2,40}?\srandom|randomly|online|lottery|computer\s(?:ballot|wahlgang)))/i 

meta     __YOU_WON_SOMTIN       (__YOU_HAVE_WON || __FB_CONGRADS)
