# Specifically give extra points for email to abuse@
header __ABUSE1       To =~ /abuse\@/i
header __ABUSE2       Cc =~ /abuse\@/i
meta ABUSE_TO (__ABUSE1 || __ABUSE2)
score ABUSE_TO        -10.0
describe ABUSE_TO     Give score headroom for legitimate abuse emails

# Bulk Mailers
body __BULKMAILER1    /emailappenders.net/
body __BULKMAILER2    /best way to promote your online opportunity/
meta BULKMAILER0 (__BULKMAILER1 || __BULKMAILER2 || __BULKMAILER3 || __BULKMAILER4 || __BULKMAILER5 || __BULKMAILER6 || __BULKMAILER7 || __BULKMAILER8 || __BULKMAILER9 || __BULKMAILER10)
score BULKMAILER0     12.0
describe BULKMAILER0  Spammers advertising their capabilities, Group 0

#Illegal cable descramblers
body __CABLE1         /\bcablefilterz?\b/i
body __CABLE2         /receive.+all.+(the)?.+channels\b/i
body __CABLE3         /ufredbx/
body __CABLE4         /opencer\.com/i
body __CABLE5         /[a-z]feedbx\./
body __CABLE6         /(bre|dot|chk|ghw|hay|isd|loe|mee|nie|pre|ray)otechs.com/
body __CABLE7         /cable.*adapt[eo]rs.*unlimited/
body __CABLE8         /cable.*plugs.*unlimited.*payperview/
body __CABLE9         /haynetsv.com/
body __CABLE10        /jqyx.org/
body __CABLE11        /1click(great|gallery).info/
body __CABLE12        /tveasynow.com/
meta CABLEFILTER0 (__CABLE1 || __CABLE2 || __CABLE3 || __CABLE4 || __CABLE5 || __CABLE6 || __CABLE7 || __CABLE8 || __CABLE9 || __CABLE10)
meta CABLEFILTER1 (__CABLE11 || __CABLE12 || __CABLE13 || __CABLE14 || __CABLE15 || __CABLE16 || __CABLE17 || __CABLE18 || __CABLE19 || __CABLE20)
score CABLEFILTER0    12.0
score CABLEFILTER1    12.0
describe CABLEFILTER0 Selling illegal cable equipment, Group 0
describe CABLEFILTER1 Selling illegal cable equipment, Group 1

#Diets
body __DIETS1         /[s§]o[uùû]th.+bea[cç]h.+d[iíïÎ]et\b/i
body __DIETS2         /\blosing.+w[eè][iíïÎ]ght\b/i
body __DIETS3         /\b[Áaá]tk[iíïÎ]ns\b/i
body __DIETS4         /\b[Áaá]pp[eë]t[iíïÎ]t[eè].+s[uùû]ppr[eè]ss[Áaá]nt\b/i
meta DIETS (__DIETS1 || __DIETS2 || __DIETS3 || __DIETS4)
score DIETS           10.0
describe DIETS        Hawking diet plans

# Domain name ends in numbers
body DOMAIN_ENDS_IN_NUM     /http:\/\/[^\s]+\d+\.(net|com|org|info|us|ws)/
describe DOMAIN_ENDS_IN_NUM Domain name ends with numbers
score DOMAIN_ENDS_IN_NUM    1.0

#Ivenue emails
header __EMAILLOCAL1    Message-Id =~ /\@tethys/
body __EMAILLOCAL2      /Below\sis\sthe\sresult\sof\syour\sfeedback\sform\./
meta EMAIL_LOCAL1a (__EMAILLOCAL1 && __EMAILLOCAL2)
describe EMAIL_LOCAL1a  Local originating email, never block
score EMAIL_LOCAL1a     -10.0

#Get a degree
body __DEGREE1        /\bget.+your.+university.+degree\b/i
body __DEGREE2        /\bdiploma.+slip.+away\b/i
body __DEGREE3        /\bbachelor.+master.+Doctorate.+\b/i
body __DEGREE4        /928-832-5344/
body __DEGREE5        /aboot\.biz/i
body __DEGREE6        /212-330-8202/
body __DEGREE7        /Martin\s+Kirk/
body __DEGREE8        /worlduniversityonline\.com/
body __DEGREE9        /Maggie\s+Seymour/
body __DEGREE10       /[_\W]{0,3}g[_\W]{0,3}e[_\W]{0,3}t.*d[_\W]{0,3}i[_\W]{0,3}p[_\W]{0,3}l[_\W]{0,3}o[_\W]{0,3}m[_\W]{0,3}a\b/i
body __DEGREE11       /kabula.info/
body __DEGREE12       /BS\/M\sBA\/Ph\sD/
body __DEGREE13       /univm.com/
body __DEGREE14       /oxxFORD.info/i
body __DEGREE15       /obtain\san\sOfficial\sDegree\sfrom.*universit/i
body __DEGREE16       /In just 2 years you can have a masters degree from a national university/
body __DEGREE17       /Want the degree but can't find the time/
header __DEGREE18     Subject =~ /acheelor/
header __DEGREE19     Subject =~ /MasteerMBA/
header __DEGREE20     Subject =~ /Good Pay Job/i
meta GET_DEGREE0 (__DEGREE1 || __DEGREE2 || __DEGREE3 || __DEGREE4 || __DEGREE5 || __DEGREE6 || __DEGREE7 || __DEGREE8 || __DEGREE9 || __DEGREE10)
meta GET_DEGREE1 (__DEGREE11 || __DEGREE12 || __DEGREE13 || __DEGREE14 || __DEGREE15 || __DEGREE16 || __DEGREE17 || __DEGREE18 || __DEGREE19 || __DEGREE20)
score GET_DEGREE0     12.0
score GET_DEGREE1     12.0
describe GET_DEGREE0  Want you to get a Degree, Group 0
describe GET_DEGREE1  Want you to get a Degree, Group 1

# Software
body __HAWKSOFTWARE1     /Great\s+prices.+OEM.+Software/i
body __HAWKSOFTWARE2     /software.+unbelievably.*low.*price/i
body __HAWKSOFTWARE3     /transfersp\.com/
body __HAWKSOFTWARE4     /buy-oemware\.biz/
body __HAWKSOFTWARE5     /Super\s+C+H+E+A+P+\s+Software/i
body __HAWKSOFTWARE7     /kanguru\.com/
body __HAWKSOFTWARE8     /bestsoftware\.com/
body __HAWKSOFTWARE9     /(extra|mx|allthe)soft/
body __HAWKSOFTWARE10    /wowink\.biz/
body __HAWKSOFTWARE11    /foryoufromme\.org/
body __HAWKSOFTWARE12    /netsuite\.com/
body __HAWKSOFTWARE13    /4andtwenty\.com/
body __HAWKSOFTWARE14    /fiicllan\.info/
body __HAWKSOFTWARE15    /Buy OEM Software/
body __HAWKSOFTWARE16    /Windows\s+XP\s+Pro.*\$[0-9][0-9]/
body __HAWKSOFTWARE17    /mibhgkcb/
body __HAWKSOFTWARE18    /low.+priced.+software/i
body __HAWKSOFTWARE19    /mibhgkcb/
body __HAWKSOFTWARE20    /freeipod/i
header __HAWKSOFTWARE21  Subject =~ /S0FT ware/
body __HAWKSOFTWARE22    /Downloadable Software \(DS\) is a rapidly growing company/
meta HAWK_SOFTWARE0 (__HAWKSOFTWARE1 || __HAWKSOFTWARE2 || __HAWKSOFTWARE3 || __HAWKSOFTWARE4 || __HAWKSOFTWARE5 || __HAWKSOFTWARE7 || __HAWKSOFTWARE8 || __HAWKSOFTWARE9 || __HAWKSOFTWARE10)
meta HAWK_SOFTWARE1 (__HAWKSOFTWARE11 || __HAWKSOFTWARE12 || __HAWKSOFTWARE13 || __HAWKSOFTWARE14 || __HAWKSOFTWARE15 || __HAWKSOFTWARE16 || __HAWKSOFTWARE17 || __HAWKSOFTWARE18 || __HAWKSOFTWARE19 || __HAWKSOFTWARE20)
meta HAWK_SOFTWARE2 (__HAWKSOFTWARE21 || __HAWKSOFTWARE22 || __HAWKSOFTWARE23 || __HAWKSOFTWARE24 || __HAWKSOFTWARE25 || __HAWKSOFTWARE26 || __HAWKSOFTWARE27 || __HAWKSOFTWARE28 || __HAWKSOFTWARE29 || __HAWKSOFTWARE30)
score HAWK_SOFTWARE0     12.0
score HAWK_SOFTWARE1     12.0
score HAWK_SOFTWARE2     12.0
describe HAWK_SOFTWARE0  Want you to buy software, Group 0
describe HAWK_SOFTWARE1  Want you to buy software, Group 1
describe HAWK_SOFTWARE2  Want you to buy software, Group 2

#Stocks
body __HOTSTOCK1      /Hot\s+stock/i
body __HOTSTOCK2      /our\s+stock.*hot/i
body __HOTSTOCK3      /\bhot.*trading.*alert\b/i
body __HOTSTOCK7      /premiumdiscounts\.net/
#body __HOTSTOCK8      /OTC/
body __HOTSTOCK9      /RyanBeck\.com/i
body __HOTSTOCK10     /Major\s+Breaking.*NEWS/i
body __HOTSTOCK11     /VoIP\stechno\|ogy/i
body __HOTSTOCK12     /Now\sthat\sOi[l|]\sand\sGas\shas\sentered\sa\s[l|]ong-term\sbu[|l]l\smarket/
body __HOTSTOCK13     /\bSymbo\|\b/
body __HOTSTOCK14     /\bOi[|]\b/
body __HOTSTOCK15     /Montana\sOi[l|]\sand\sGas,\sInc/
body __HOTSTOCK16     /Environmenta\|/
body __HOTSTOCK17     /Yap\sInternational,\sInc/
body __HOTSTOCK18     /Itec Environmental Gr[Oo0]up/
body __HOTSTOCK19     /st0ck/i
body __HOTSTOCK20     /trading\sprofits\sfor\sLDTI/
body __HOTSTOCK21     /This\sreport\sis\sfor\sentertainment\s(and\sadvertising\s)?purposes.*(and\sshou.d\snot\sbe\sused\sas\s|This\sis\not\s)investment\sadvice/
body __HOTSTOCK22     /\bNVESTORS\b/
body __HOTSTOCK23     /First Thing Today\s+?\,?!?\r?\n?This Is Going To Explode/si
body __HOTSTOCK24     /OUR LATEST PICK IS /
body __HOTSTOCK25     /This Is Going To Explode!/
body __HOTSTOCK26     /Homerun Stock of the Year/
body __HOTSTOCK27     /TRADER AND INVESTOR ALERT/
body __HOTSTOCK28     /reliable facts showing this stock will hit it big/
body __HOTSTOCK29     /with our expert advice and insider information/
body __HOTSTOCK30     /ATTENTION ALL DAY TRADERS AND INVESTORS/
body __HOTSTOCK31     /(TRAD|INVEST) .RS WATCH OUT/
body __HOTSTOCK32     /Ever.Glory International/
body __HOTSTOCK33     /Yesterday, market forces caused our top pick (....) to close/
body __HOTSTOCK34     /Results from (....)'s latest drilling/
body __HOTSTOCK4a     /Symbol: [A-Z]+/
body __HOTSTOCK4b     /Price: \$?[0-9.]+/i
meta HOTSTOCKGEN (__HOTSTOCK4a && __HOTSTOCK4b)
body HOTSTOCKGEN2     /EXCLUSIVE Penny Stocks Alert Advisory Service/
body __HOTSTOCK4c     /Feature:/
body __HOTSTOCK4d     /Currently:/
body __HOTSTOCK4e     /Projected:/
meta HOTSTOCKGEN3 (__HOTSTOCK4c && __HOTSTOCK4d && __HOTSTOCK4e)
body __HOTSTOCK4f     /Company:/
body __HOTSTOCK4g     /Symbol:/
body __HOTSTOCK4h     /Expected .rice:/
meta HOTSTOCKGEN4 (__HOTSTOCK4f && __HOTSTOCK4b && __HOTSTOCK4h)
meta HOTSTOCKGEN5 (__HOTSTOCK4f && __HOTSTOCK4g && __HOTSTOCK4b)
body __HOTSTOCK35     /Harris Exploration Strikes Gold/
body __HOTSTOCK36     /MHII.OB/
body __HOTSTOCK37     /CAON Launches R.D Program to Further Production/
body __HOTSTOCK38     /CAON Now Holds 12 Environmental Patents/
body __HOTSTOCK39     /CAON UP \d+% In The Last Week/
body __HOTSTOCK40     /Solanex/
meta HOTSTOCK0 (__HOTSTOCK1 || __HOTSTOCK2 || __HOTSTOCK3 || __HOTSTOCK4 || __HOTSTOCK5 || __HOTSTOCK6 || __HOTSTOCK7 || __HOTSTOCK8 || __HOTSTOCK9 || __HOTSTOCK10)
meta HOTSTOCK1 (__HOTSTOCK11 || __HOTSTOCK12 || __HOTSTOCK13 || __HOTSTOCK14 || __HOTSTOCK15 || __HOTSTOCK16 || __HOTSTOCK17 || __HOTSTOCK18 || __HOTSTOCK19 || __HOTSTOCK20)
meta HOTSTOCK2 (__HOTSTOCK21 || __HOTSTOCK22 || __HOTSTOCK23 || __HOTSTOCK24 || __HOTSTOCK25 || __HOTSTOCK26 || __HOTSTOCK27 || __HOTSTOCK28 || __HOTSTOCK29 || __HOTSTOCK30)
meta HOTSTOCK3 (__HOTSTOCK31 || __HOTSTOCK32 || __HOTSTOCK33 || __HOTSTOCK34 || __HOTSTOCK35 || __HOTSTOCK36 || __HOTSTOCK37 || __HOTSTOCK38 || __HOTSTOCK39 || __HOTSTOCK40)
score HOTSTOCK0        12.0
score HOTSTOCK1        12.0
score HOTSTOCK2        12.0
score HOTSTOCK3        12.0
score HOTSTOCKGEN      12.0
score HOTSTOCKGEN2     12.0
score HOTSTOCKGEN3     12.0
score HOTSTOCKGEN4     12.0
score HOTSTOCKGEN5     12.0
describe HOTSTOCK0     Want you to buy their stock, Group 0
describe HOTSTOCK1     Want you to buy their stock, Group 1
describe HOTSTOCK2     Want you to buy their stock, Group 2
describe HOTSTOCK3     Want you to buy their stock, Group 3
describe HOTSTOCKGEN   Want you to buy their stock, Generic
describe HOTSTOCKGEN2  Want you to buy their stock, Generic 2
describe HOTSTOCKGEN3  Want you to buy their stock, Generic 3
describe HOTSTOCKGEN4  Want you to buy their stock, Generic 4
describe HOTSTOCKGEN5  Want you to buy their stock, Generic 5

#Low mortgage
body __MORTGAGELOW1    /\bmore.+than.+\..+%\b/i
body __MORTGAGELOW3    /\bLOWEST.+RATES\b/i
body __MORTGAGELOW4    /\bCREDIT.+HISTORY\b/i
body __MORTGAGELOW5    /\bat.+record.+low\b/i
body __MORTGAGELOW6    /\bm.ortgage.application\b/i
body __MORTGAGELOW7    /refihome.info/
body __MORTGAGELOW8    /on-cash\.com/
body __MORTGAGELOW9    /infostead\.biz/
body __MORTGAGELOW10   /Your\s(mtg|mortgage)\s?(app[lI]ication|process)\sis\s(pre)?[a4]pproved/i
body __MORTGAGELOW11   /aokmwenks\.com/
body __MORTGAGELOW12   /christianmortgageusa.com/
body __MORTGAGELOW13   /olmaretad.com/
body __MORTGAGELOW14   /Ioan/
body __MORTGAGELOW15   /firstgpg/
body __MORTGAGELOW16   /We\s+sent\s+you\s+an\s+email.*you.*qualify\s+for/i
body __MORTGAGELOW17   /mor\s?t\s?g\s?age/
body __MORTGAGELOW18   /can\ssave\syou\sthousands\sof\sdollars/
body __MORTGAGELOW19   /[\W]Mortgage[\W]rates[\W]/i
body __MORTGAGELOW20   /m\so\srtga\sg\se/
body __MORTGAGELOW21   /notified\sthat\stwo\s+l\se\snders/
body __MORTGAGELOW22   /FREE\s30\sSec\sMotgage\sQuote/i
body __MORTGAGELOW23   /morta\(ge/
body __MORTGAGELOW24   /Cancel debts and never make another payment/
body __MORTGAGELOW25   /have been competing for your mortgage/
body __MORTGAGELOW26   /We tried contacting you awhile ago about your low interest/
meta MORTGAGE_LOW0 (__MORTGAGELOW1 || __MORTGAGELOW3 || __MORTGAGELOW4 || __MORTGAGELOW5 || __MORTGAGELOW6 || __MORTGAGELOW7 || __MORTGAGELOW8 || __MORTGAGELOW9)
meta MORTGAGE_LOW1 (__MORTGAGELOW10 || __MORTGAGELOW11 || __MORTGAGELOW12 || __MORTGAGELOW13 || __MORTGAGELOW14 || __MORTGAGELOW15 || __MORTGAGELOW16 || __MORTGAGELOW18 || __MORTGAGELOW19)
meta MORTGAGE_LOW1a (__MORTGAGELOW17)
meta MORTGAGE_LOW2 (__MORTGAGELOW20 || __MORTGAGELOW21 || __MORTGAGELOW22 || __MORTGAGELOW23 || __MORTGAGELOW24 || __MORTGAGELOW25 || __MORTGAGELOW26 || __MORTGAGELOW28 || __MORTGAGELOW29)
score MORTGAGE_LOW0    4.0
score MORTGAGE_LOW1    12.0
score MORTGAGE_LOW1a   1.0
score MORTGAGE_LOW2    12.0
describe MORTGAGE_LOW0 Advertising lower mortgages, Group 0
describe MORTGAGE_LOW1 Advertising lower mortgages, Group 1
describe MORTGAGE_LOW1a Mentioned the word mortgage.
describe MORTGAGE_LOW2 Advertising lower mortgages, Group 2

#Multipart emails, specific cases
header __MULTIPART1a  Content-Type =~ /multipart.related/
header __MULTIPART2a  Content-Type =~ /multipart.alternative/
header __MULTIPART2b  X-Mailer =~ /Outlook/
meta MULTIPART1 (__MULTIPART1a)
meta MULTIPART2 (__MULTIPART2a && __MULTIPART2b)
score MULTIPART1      2.0
score MULTIPART2      2.0
describe MULTIPART1   Has multipart/related headers
describe MULTIPART2   Has multipart/alternative headers from Outlook

# Nigerian crap
body __NIGERIANLOCAL1    /diplomatic\s+documents/i
body __NIGERIANLOCAL2    /Carlisle\s+Richard/i
body __NIGERIANLOCAL3    /Nigeria/i
body __NIGERIANLOCAL4    /(master|visa)[\s]*card/i
body __NIGERIANLOCAL5    /Allen\s+Scott/i
body __NIGERIANLOCAL6    /Helen\s+Savimbi/i
body __NIGERIANLOCAL7    /INTERNATIONAL\sPROMOTIONS\/PRIZE\sAWARD\sDEPARTMENT/i
body __NIGERIANLOCAL8    /Barrister\s+williams\s+David/i
body __NIGERIANLOCAL9    /INTERNATIONAL\sPROMOTION\sPROGRAM/
body __NIGERIANLOCAL10   /you\s+a\s+beneficiary\s+to\s+his\s+will/i
body __NIGERIANLOCAL11   /drumgame\.biz/i
body __NIGERIANLOCAL12   /If\syou\sare\sinterested\sin\ssending\sstuff/i
body __NIGERIANLOCAL13   /ATTENTION.*CHIEF\s?EXECUTIVE\sOFFICERS/
body __NIGERIANLOCAL14   /texascrossroads/i
body __NIGERIANLOCAL15   /Barrister\sGraham\sDouglas/
body __NIGERIANLOCAL16   /PRINCESS\sHELEN\sRAO/i
body __NIGERIANLOCAL17   /who\sdied\swithout\sa\swritten\sor\soral/
body __NIGERIANLOCAL18   /co-?operation.*secure\s+an\s+opportunity.*invest/
body __NIGERIANLOCAL19   /detnews.com/
body __NIGERIANLOCAL20   /General\sIbrahim\sMoussa\sdid\snot\sdeclare\sany\snext\sof\skin/
body __NIGERIANLOCAL21   /OFFICE\sOF\sTHE\sLOTTERY\sCOORDINATOR/i
body __NIGERIANLOCAL22   /relatives\sand\sfriends\shave\splundered\sso\smuch\sof\smy\swealth\ssince/
body __NIGERIANLOCAL23   /FROM THE DESK OF THE LOTTERY DIRECTOR PROMOTIONS/i
body __NIGERIANLOCAL24   /one million five hundred thousand united state dollar/i
meta NIGERIAN_LOCAL0 (__NIGERIANLOCAL1 || __NIGERIANLOCAL2 || __NIGERIANLOCAL5 || __NIGERIANLOCAL6 || __NIGERIANLOCAL7 || __NIGERIANLOCAL8 || __NIGERIANLOCAL9 || __NIGERIANLOCAL10)
meta NIGERIAN_LOCAL0B (__NIGERIANLOCAL3)
meta NIGERIAN_LOCAL1 (__NIGERIANLOCAL11 || __NIGERIANLOCAL12 || __NIGERIANLOCAL13 || __NIGERIANLOCAL14 || __NIGERIANLOCAL15 || __NIGERIANLOCAL16 || __NIGERIANLOCAL17 || NIGERIANLOCAL18 || __NIGERIANLOCAL19 || __NIGERIANLOCAL20)
meta NIGERIAN_LOCAL2 (__NIGERIANLOCAL21 || __NIGERIANLOCAL22 || __NIGERIANLOCAL23 || __NIGERIANLOCAL24 || __NIGERIANLOCAL25 || __NIGERIANLOCAL26 || __NIGERIANLOCAL27 || NIGERIANLOCAL28 || __NIGERIANLOCAL29 || __NIGERIANLOCAL30)
score NIGERIAN_LOCAL0     12.0
score NIGERIAN_LOCAL0B    3.0
score NIGERIAN_LOCAL1     12.0
score NIGERIAN_LOCAL2     12.0
describe NIGERIAN_LOCAL0  People asking for money in a Nigerian scam
describe NIGERIAN_LOCAL0B Mentioning the word Nigeria is a BAD thing.
describe NIGERIAN_LOCAL1  Another form of the Nigerian scam, Group 1
describe NIGERIAN_LOCAL2  Another form of the Nigerian scam, Group 2

#Penis
body __PENIS_BIGGER1  /penis\s+enlargement/i
body __PENIS_BIGGER2  /big(ger)?\s+cock/i
body __PENIS_BIGGER3  /My girlfriend loves the results, but she doesn't know what I do/i
body __PENIS_BIGGER4  /Are\syou\ssmall\sin\sthe\spants/
body __PENIS_BIGGER5  /become a champion in bed/
full __PENIS_BIGGER6  /Achieve astounding results in bed/
body __PENIS_BIGGER7  /Make other men envy you and girls worship you/
full __PENIS_BIGGER8  /impress them with your power and stamina in bed/
body __PENIS_BIGGER9  /Make your girlfriend or wife speechless/
body __PENIS_BIGGER10 /several times more semen/
body __PENIS_BIGGER21 /Achieve astounding results in bed/
body __PENIS_BIGGER22 /Have you ever wanted to impress your girl/
body __PENIS_BIGGER23 /Do you wish to increase your volume by up to/
body __PENIS_BIGGER24 /eople judge your dick size by your shoes size/
body __PENIS_BIGGER25 /www.abirtes.com/
body __PENIS_BIGGER26 /You crave to shoot like a film star/
body __PENIS_BIGGER27 /newarml.com/
body __PENIS_BIGGER28 /You have small peniis/
body __PENIS_BIGGER29 /Stop disappointing your partner/
body __PENIS_BIGGER30 /www.hoopcc.com/
body __PENIS_BIGGER31 /www.kyklopescf.com/
body __PENIS_BIGGER32 /Prolong your ssex/
body __PENIS_BIGGER33 /Click link to see sample flyer - it really works/
body __PENIS_BIGGER34 /changinglifeways.com/
body __PENIS_BIGGER35 /Extra-Time/
body __PENIS_BIGGER36 /Use this tab regularly and you/
body __PENIS_BIGGER37 /Penis Enlarge Patch/
body __PENIS_BIGGER38 /unimagnable plea?sure to her/
body __PENIS_BIGGER39 /If you thought getting more size and girth was impossible/
body __PENIS_BIGGER40 /Thousands of men notice huge differences in the way they operate/
body __PENIS_BIGGER41 /P\.E\.P\. /
header __PENIS_BIGGER42 Subject =~ /Don't be the \"little guy\"/
header __PENIS_BIGGER43 From =~ /VIAGRA/
meta PENIS_BIGGER0 (__PENIS_BIGGER1 || __PENIS_BIGGER2 || __PENIS_BIGGER3 || __PENIS_BIGGER4 || __PENIS_BIGGER5 || __PENIS_BIGGER6 || __PENIS_BIGGER7 || __PENIS_BIGGER_8 || __PENIS_BIGGER9 || __PENIS_BIGGER10)
meta PENIS_BIGGER2 (__PENIS_BIGGER21 || __PENIS_BIGGER22 || __PENIS_BIGGER23 || __PENIS_BIGGER24 || __PENIS_BIGGER25 || __PENIS_BIGGER26 || __PENIS_BIGGER27 || __PENIS_BIGGER28 || __PENIS_BIGGER29 || __PENIS_BIGGER30)
meta PENIS_BIGGER3 (__PENIS_BIGGER31 || __PENIS_BIGGER32 || __PENIS_BIGGER33 || __PENIS_BIGGER34 || __PENIS_BIGGER35 || __PENIS_BIGGER36 || __PENIS_BIGGER37 || __PENIS_BIGGER38 || __PENIS_BIGGER39 || __PENIS_BIGGER40)
meta PENIS_BIGGER4 (__PENIS_BIGGER41 || __PENIS_BIGGER42 || __PENIS_BIGGER43 || __PENIS_BIGGER44 || __PENIS_BIGGER45 || __PENIS_BIGGER46 || __PENIS_BIGGER47 || __PENIS_BIGGER48 || __PENIS_BIGGER49 || __PENIS_BIGGER50)
score PENIS_BIGGER0    12.0
score PENIS_BIGGER2    12.0
score PENIS_BIGGER3    12.0
score PENIS_BIGGER4    12.0
describe PENIS_BIGGER0 Want to make your penis larger, group 0
describe PENIS_BIGGER2 Want to make your penis larger, group 2
describe PENIS_BIGGER3 Want to make your penis larger, group 3
describe PENIS_BIGGER4 Want to make your penis larger, group 4

#template for characters between letters
#/(?:\b|\s)[_\W]{0,3}(?:\\\/|V)[_\W]{0,3}[i1|lïî¡ì][_\W]{0,3}[a4@áâ][_\W]{0,3}g[_\W]{0,3}r[_\W]{0,3}[a4@áâ][_\W]{0,3}x?[_\W]{0,3}(?:\b|\s)/i

# Sex URLs
body __PORNURL1       /celebritylustflicks.biz/
body __PORNURL2       /niggerdaisyquartodeciman.com/
body __PORNURL3       /osakimyst.com/
body __PORNURL4       /drezdop.com/
body __PORNURL5       /bangingbroads.info/
body __PORNURL6       /getherbalnow.info/
body __PORNURL7       /vytu.info/
body __PORNURL8       /aesculusunrefinement.com/
body __PORNURL9       /rxonlinesale.com/
body __PORNURL10      /meetup(satur|nowa)days?.com/
body __PORNURL11      /hoookup.com/
body __PORNURL12      /amazedhardwood.com/
body __PORNURL13      /zoo\d+.com/
body __PORNURL14      /mangeton.com/
body __PORNURL15      /23jd.info/
body __PORNURL16      /getagreatdate.com/
body __PORNURL17      /holmiabn.com/
body __PORNURL18      /onlinemeetandcheat.biz/
body __PORNURL19      /madformorgan.com/
body __PORNURL20      /myabsinth.com/
body __PORNURL21      /kloppy.biz/
body __PORNURL22      /matrosovgl.com/
body __PORNURL23      /ustinovtb.com/
body __PORNURL24      /harelru.com/
body __PORNURL25      /wvs4fkin.com/
body __PORNURL26      /kogko.com/
body __PORNURL27      /greatpneumatic.com/
body __PORNURL28      /levtolstojdg.net/
body __PORNURL29      /funtimedate.com/
body __PORNURL30      /\b(s-ex|f-uck)/
body __PORNURL31      /I have always worried about the size of my penis/
body __PORNURL32      /I joined this amazing dat\.ing portal/
body __PORNURL33      /I am tired this evening. I am 25 y.o. girl that would like to chat/
body __PORNURL34      /\bMegaDik Pills\b/
body __PORNURL35      /g+i+r+l+f+r+i+e+n+d+s+ .*THIS/
body __PORNURL36      /ARE .*g+i+r+l+f+r+i+e+n+d+s+/
meta PORN_URL0 (__PORNURL1 || __PORNURL2 || __PORNURL3 || __PORNURL4 || __PORNURL5 || __PORNURL6 || __PORNURL7 || __PORNURL8 || __PORNURL9 || __PORNURL10)
meta PORN_URL1 (__PORNURL11 || __PORNURL12 || __PORNURL13 || __PORNURL14 || __PORNURL15 || __PORNURL16 || __PORNURL17 || __PORNURL18 || __PORNURL19 || __PORNURL20)
meta PORN_URL2 (__PORNURL21 || __PORNURL22 || __PORNURL23 || __PORNURL24 || __PORNURL25 || __PORNURL26 || __PORNURL27 || __PORNURL28 || __PORNURL29 || __PORNURL30)
meta PORN_URL3 (__PORNURL31 || __PORNURL32 || __PORNURL33 || __PORNURL34 || __PORNURL35 || __PORNURL36 || __PORNURL37 || __PORNURL38 || __PORNURL39 || __PORNURL40)
meta PORN_URL4 (__PORNURL41 || __PORNURL42 || __PORNURL43 || __PORNURL44 || __PORNURL45 || __PORNURL46 || __PORNURL47 || __PORNURL48 || __PORNURL49 || __PORNURL50)
score PORN_URL0       12.0
score PORN_URL1       12.0
score PORN_URL2       12.0
score PORN_URL3       12.0
score PORN_URL4       12.0
describe PORN_URL0    URLs for porn and meet-a-date, Group 0
describe PORN_URL1    URLs for porn and meet-a-date, Group 1
describe PORN_URL2    URLs for porn and meet-a-date, Group 2
describe PORN_URL3    URLs for porn and meet-a-date, Group 3
describe PORN_URL4    URLs for porn and meet-a-date, Group 4

# Pyramid scheme
body __PYRAMIDSCHEME1   /KJ\sEnterprises/i
body __PYRAMIDSCHEME2   /NetBizProxy\.com/i
body __PYRAMIDSCHEME3   /emarketing-us/
body __PYRAMIDSCHEME4   /clickbank/
body __PYRAMIDSCHEME5   /InstantBuzz.com/
body __PYRAMIDSCHEME6   /mp-publicaccess.com/
body __PYRAMIDSCHEME7   /specialpowerproduct.com/
body __PYRAMIDSCHEME8   /perfectitemsite.com/
body __PYRAMIDSCHEME9   /perfectproductchart.com/
body __PYRAMIDSCHEME10  /Its very hard to thank you enough for starting  ?me in this new profession/
body __PYRAMIDSCHEME11  /I found you just in time because I was  ?let go from a job I held for/
body __PYRAMIDSCHEME12  /Before I joined you I found myself let go from my employment I held for/
body __PYRAMIDSCHEME13  /end this e-newsletter to a friend and you could win/
body __PYRAMIDSCHEME14  /Department of Health value your privacy/
meta PYRAMID_SCHEME0 (__PYRAMIDSCHEME1 || __PYRAMIDSCHEME2 || __PYRAMIDSCHEME3 || __PYRAMIDSCHEME4 || __PYRAMIDSCHEME5 || __PYRAMIDSCHEME6 || __PYRAMIDSCHEME7 || __PYRAMIDSCHEME8 || __PYRAMIDSCHEME9 || __PYRAMIDSCHEME10)
meta PYRAMID_SCHEME1 (__PYRAMIDSCHEME11 || __PYRAMIDSCHEME12 || __PYRAMIDSCHEME13 || __PYRAMIDSCHEME14 || __PYRAMIDSCHEME15 || __PYRAMIDSCHEME16 || __PYRAMIDSCHEME17 || __PYRAMIDSCHEME18 || __PYRAMIDSCHEME19 || __PYRAMIDSCHEME20)
score PYRAMID_SCHEME0    12.0
score PYRAMID_SCHEME1    12.0
describe PYRAMID_SCHEME0 Illegal Pyramid Scheme pitches, group 0
describe PYRAMID_SCHEME1 Illegal Pyramid Scheme pitches, group 1

#Refinancing
#body __REFI1           /\bb[_\W]{0,3}ad\s+cr[_\W]{0,3}edit\b/i
#body __REFI2           /\brefi[_\W]{0,3}nance.+home\b/i
#body __REFI3           /\bea[_\W]{0,3}sy\s+appli[_\W]{0,3}cation\b/i
body __REFI4           /\bre.?finance\b/i
body __REFI5           /\bbad.+credit\b/i
body __REFI6           /\bapplication.+pre-?approv/i
body __REFI8           /pre-?approved\s+for.*rates?/i
body __REFI9           /As a business you have been preapproved to receive/
#body __REFI10          /approved/
body __REFI11          /lowrefinancerates/
body __REFI12          /flnanclng/
body __REFI13          /RE-FlNANCE/i
body __REFI14          /wealthhotchallenge.com/
body __REFI15          /REFlNANCE/
body __REFI16          /For\sthe\srest\sof\sthe\sstory.*destroying\sdebt.*visit\sus/
body __REFI17          /Thanks to a private nomination, there are potentialy three deals that will be offered to you/
body __REFI18          /h1gh[3e]r/
body __REFI19          /If you are paying more than .*\% on your mortgage/
body __REFI20          /\?Best Financing Facilitation/
body __REFI21          /Eliminate all you owe not even sending another dollar/
body __REFI22          /all you are indebted for with ?out (paying|mailing) another cent/
body __REFI23          /Do away with all you owe without mailing another dollar/
body __REFI24          /Abolish all you owe with out paying another dollar/
body __REFI25          /Don't worry about approval, your cre ?dit will not disqualify you/
meta REFI_BAD_CREDIT1 (__REFI4 && __REFI5)
meta REFI_PLEASE0a (__REFI6 || __REFI8 || __REFI11)
meta REFI_PLEASE1b (__REFI12 || __REFI13 || __REFI14 || __REFI15 || __REFI16 || __REFI17 || __REFI18 || __REFI19 || __REFI20)
meta REFI_PLEASE2 (__REFI20 || __REFI21 || __REFI22 || __REFI23 || __REFI24 || __REFI25 || __REFI26 || __REFI27 || __REFI28 || __REFI29 || __REFI30)
score REFI_BAD_CREDIT1 12.0
score REFI_PLEASE0a    12.0
score REFI_PLEASE1b    12.0
score REFI_PLEASE2     12.0
describe REFI_BAD_CREDIT1 Refinance due to Bad Credit variant 1
describe REFI_PLEASE0a  Refinance is pre-approved
describe REFI_PLEASE1b  Refinance whatever you owe
describe REFI_PLEASE2   Refinance whatever you owe

# Rolex watches
body __ROLEX1           /ro[lI1]ex/i
body __ROLEX2           /rep[lI1][i1]ca/i
body __ROLEX3           /want\s+a\s+(cheap)?\s*(watch|rolex)/i
body __ROLEX4           /reproduction.*wrist-watches/i
body __ROLEX5           /rep[l1]icas.(com|info)/
body __ROLEX6           /ltalian.net/
body __ROLEX7           /nbikgebj.info/
body __ROLEX8           /jkseavyja.com/
body __ROLEX9           /\/rep\/razor\//
body __ROLEX10          /tomtempofunny.com/
body __ROLEX11          /tomcompendiumcool.com/
body __ROLEX12          /boytadpolefunny.com/
body __ROLEX13          /replicca bags/
body __ROLEX14          /Our watches have excellence written all over them/
body __ROLEX15          /Our company is delighted to supply the greatest look alike chronometers/
body __ROLEX16          /Our shop is the first choice in Internet-based watch selling/
body __ROLEX17          /Our store.?s reproduction watches stand for style and quality/
body __ROLEX18          /Our wristwatch shop is the home of/
body __ROLEX19          /Real Swiss-made watches at a fraction of of the retail price/
body __ROLEX20          /Our webpage.?s chronometers are evaluated highly in value and appearance/
meta ROLEX0a (__ROLEX1 && __ROLEX2)
meta ROLEX0b (__ROLEX1)
meta ROLEX0 (__ROLEX3 || __ROLEX4 || __ROLEX5 || __ROLEX6 || __ROLEX7 || __ROLEX8 || __ROLEX9 || __ROLEX10)
meta ROLEX1 (__ROLEX11 || __ROLEX12 || __ROLEX13 || __ROLEX14 || __ROLEX15 || __ROLEX16 || __ROLEX17 || __ROLEX18 || __ROLEX19 || __ROLEX20)
describe ROLEX0a        Want to sell you Rolex replicas, Group 0a
describe ROLEX0b        Mentioning the word Rolex (or misspelled variant)
describe ROLEX0         Want to sell you Rolex replicas, Group 0
describe ROLEX1         Want to sell you Rolex replicas, Group 0
score ROLEX0a           12.0
score ROLEX0b           4.0
score ROLEX0            12.0
score ROLEX1            12.0

# Sex terms
body __SEX_TERM1      /\blesbian\b/i
body __SEX_TERM2      /\bdildo/i
body __SEX_TERM3      /\bhardcore\b/i
body __SEX_TERM4      /\bnaked\b/i
body __SEX_TERM5      /\bsex\b/i
body __SEX_TERM6      /\banal (sex)?\b/i
body __SEX_TERM7      /\bslut/i
body __SEX_TERM8      /\bgangbang\b/i
body __SEX_TERM9      /\bbutts?\b/i
body __SEX_TERM10     /\bmilf\b/i
body __SEX_TERM11     /\bcum\b/i
body __SEX_TERM12     /\bfuck/i
body __SEX_TERM13     /\btitt(y|ies)\b/i
body __SEX_TERM14     /\bsexy\b/i
body __SEX_TERM15     /\bfinger(ing|ed)\b/i
meta SEX_TERMS_20     (__SEX_TERM1 + __SEX_TERM2 + __SEX_TERM3 + __SEX_TERM4 + __SEX_TERM5 + __SEX_TERM6 + __SEX_TERM7 + __SEX_TERM8 + __SEX_TERM9 + __SEX_TERM10 + __SEX_TERM11 + __SEX_TERM12 + __SEX_TERM13 + __SEX_TERM14 + __SEX_TERM15) > 2
meta SEX_TERMS_40     (__SEX_TERM1 + __SEX_TERM2 + __SEX_TERM3 + __SEX_TERM4 + __SEX_TERM5 + __SEX_TERM6 + __SEX_TERM7 + __SEX_TERM8 + __SEX_TERM9 + __SEX_TERM10 + __SEX_TERM11 + __SEX_TERM12 + __SEX_TERM13 + __SEX_TERM14 + __SEX_TERM15) > 4
meta SEX_TERMS_60     (__SEX_TERM1 + __SEX_TERM2 + __SEX_TERM3 + __SEX_TERM4 + __SEX_TERM5 + __SEX_TERM6 + __SEX_TERM7 + __SEX_TERM8 + __SEX_TERM9 + __SEX_TERM10 + __SEX_TERM11 + __SEX_TERM12 + __SEX_TERM13 + __SEX_TERM14 + __SEX_TERM15) > 6
meta SEX_TERMS_80     (__SEX_TERM1 + __SEX_TERM2 + __SEX_TERM3 + __SEX_TERM4 + __SEX_TERM5 + __SEX_TERM6 + __SEX_TERM7 + __SEX_TERM8 + __SEX_TERM9 + __SEX_TERM10 + __SEX_TERM11 + __SEX_TERM12 + __SEX_TERM13 + __SEX_TERM14 + __SEX_TERM15) > 8
meta SEX_TERMS_100     (__SEX_TERM1 + __SEX_TERM2 + __SEX_TERM3 + __SEX_TERM4 + __SEX_TERM5 + __SEX_TERM6 + __SEX_TERM7 + __SEX_TERM8 + __SEX_TERM9 + __SEX_TERM10 + __SEX_TERM11 + __SEX_TERM12 + __SEX_TERM13 + __SEX_TERM14 + __SEX_TERM15) > 10
score SEX_TERMS_20      1.0
score SEX_TERMS_40      4.0
score SEX_TERMS_60      6.0
score SEX_TERMS_80      10.0
score SEX_TERMS_100     20.0
describe SEX_TERMS_20   20% chance email is bad
describe SEX_TERMS_40   40% chance email is bad
describe SEX_TERMS_60   60% chance email is bad
describe SEX_TERMS_80   80% chance email is bad
describe SEX_TERMS_100  100% chance email is bad

# Shopping
body __SHOPPING1        /Mystery Shopper/
header __SHOPPING2      Subject =~ /Mystery Secret Shopper/
meta SHOPPING1          (__SHOPPING1 || __SHOPPING2)
score SHOPPING1         10.0
describe SHOPPING1      Looking for shoppers, group 1

# Unsubscribe/Removal URL's
body __UNSUBURL1       /removal.htm[l]?/i
body __UNSUBURL2       /unsubscribe(.htm[l]?)?/i
body __UNSUBURL3       /click\s+here\s+to\s+unsubscribe/i
body __UNSUBURL4       /To\sbe\sremoved\sfrom\sour/i
body __UNSUBURL5       /remove\s+yourself/i
body __UNSUBURL6       /\/unsub/
meta UNSUB_URL (__UNSUBURL1 || __UNSUBURL2 || __UNSUBURL3 || __UNSUBURL4 || __UNSUBURL5 || __UNSUBURL6)
score UNSUB_URL         2.0
describe UNSUB_URL      Link to unsubscribe from wherever this came from

# Work from Home
body __WORKHOME1        /Work\s+from.*house/i
body __WORKHOME2        /skyquestcom/
body __WORKHOME3        /turboreply/
body __WORKHOME4        /royalitynewsproduct/
body __WORKHOME5        /alldaysproduct.com/
body __WORKHOME6        /fullcustomerwealth.com/
body __WORKHOME7        /premiumwebbusiness.com/
body __WORKHOME8        /royalproductbusiness.com/
body __WORKHOME9        /clubroyalitemshop.com/
body __WORKHOME10       /Work\s+from.*home/i
body __WORKHOME11       /totalproductshop.com/
body __WORKHOME12       /successuniversity.com/
body __WORKHOME13       /1clickunlimited.info/
body __WORKHOME14       /c0meh3re.(com|net)/
meta WORK_HOME0 (__WORKHOME1 || __WORKHOME2 || __WORKHOME3 || __WORKHOME4 || __WORKHOME5 || __WORKHOME6 || __WORKHOME7 || __WORKHOME8 || __WORKHOME9)
meta WORK_HOME0a (__WORKHOME10)
meta WORK_HOME1 (__WORKHOME11 || __WORKHOME12 || __WORKHOME13 || __WORKHOME14 || __WORKHOME15 || __WORKHOME16 || __WORKHOME17 || __WORKHOME18 || __WORKHOME19 || __WORKHOME20)
score WORK_HOME0        12.0
score WORK_HOME0a       1.0
score WORK_HOME1        12.0
describe WORK_HOME0     Make money or success working from home, Group 0
describe WORK_HOME0a    Work at home
describe WORK_HOME1     Make money or success working from home, Group 1

# override some scores, giving it extra weight
score FREE_PORN 4.0
score LIVE_PORN 4.0

# Blacklist specific senders
blacklist_from		pisces3191982@aol.com
blacklist_from		pbvjohn@hotmail.com