# SARE "General Subject" Ruleset for SpamAssassin - File 0 # Version: 01.03.09 # Created: 2004-09-13 # Modified: 2005-06-13 # Usage instructions and documentation are found in 70_sare_genlsubj0.cf #@@# Revision History: Full Revision History stored in 70_sare_genlsubj.log #@@# 01.03.09: June 13 2005 #@@# Minor score updates based on additional mass-check #@@# Added file 0: SARE_SUBJ_MED_USE #@@# Added file 0: SARE_SUBJ_SINCERE #@@# Moved file 0 to file 1: SARE_SUB_WHILE_U_CAN #@@# Moved file 0 to file 2: SARE_SUB_LOSE_PCT1 and SARE_SUB_LOSE_PCT2 # License: Artistic - see http://www.rulesemporium.com/license.txt # Current Maintainer: Bob Menschel - genlsubj@rulesemporium.com # Current Home: http://www.rulesemporium.com/rules/70_sare_genlsubj0.cf # # Usage: This family of files, 70_sare_genlsubj*.cf, contain rules that test the Subject header of rules. # # File 0: 70_sare_genlsubj0.cf -- These are subject rules that hit at least 10 spam and no ham. # While SARE cannot guarantee they never will hit ham, they have not hit ham in any SARE mass-check, against tens of thousands of ham. # This is a rules file we expect any/all email systems using SpamAssassin to benefit from. # # File 1: 70_sare_genlsubj1.cf -- These are subject rules that meet one of the follow criteria: # a) Rules that do, or in the past have hit ham during SARE mass-check tests # b) Rules that hit no ham and currently do not hit more than 10 spam in any single mass-check run. # If the rules hit ham, they hit at last 10 spam to each 1 ham. # With few exceptions these rules score significantly less than the rules in file 0. # Systems which are very sensitive to false positives and/or need to be very careful about resource use may want to exclude this ruleset, # pick and choose among its rules, or lower their scores. # Systems that use this file 1 should ALSO use file 0. # # File 2: 70_sare_genlsubj2.cf -- These subject rules hit no spam at this time, but they are considered "safe" rules that should never hit ham. # These are primarily obfuscation rules, which should never hit non-obfuscated words. # Systems which are very sensitive to SpamAssassin overhead may want to exclude this ruleset file to avoid its regex overhead, # but systems with plenty of resources that want to be aggressive against spam may benefit from this ruleset file. # # File 3: 70_sare_genlsubj3.cf -- These are subject rules that hit a significant amount of ham during SARE mass-check tests. # Systems which are very sensitive to false positives or to SA resource usage should NOT install this ruleset. # # File 4: 70_sare_genlsubj4.cf -- These are subject rules that hit over 100 ham during SARE mass-check tests, but still hit enough spam # to be worth while to aggressively anti-spam systems. # Again, systems which are very sensitive to false positives or to SA resource usage should NOT install this ruleset. # # eng: 70_sare_genlsubj_eng.cf -- These are subject rules which work well within the English language, but are liable to cause false # positives in other languages. They include rules which test for letter combinations and encoded subject headers. Systems that # receive ham in languages other than English should NOT use this file. # # x30: 70_sare_genlsubj_x30.cf -- These are subject rules which have been incorporated into SpamAssassin 3.0.x, # or which duplicate or greatly overlap 3.0.x rules. # Systems which have installed SpamAssassin 3.0.x should therefore NOT use this file. # # arc: 70_sare_genlsubj_arc.cf -- These are subject rules that once were published in other files, but which have since lost all value. # They either hit too much ham (without hitting enough spam to make it worth while), or they don't hit any spam. # SARE regularly runs mass-checks on these rules to see if any of them are worth reviving, but # we expect that nobody will be running these rules in any production system. # # Rules to be wary of: # # Financial and investment companies will want to lower some scores in the Business section. # Credit, mortgage, and similar companies will want to lower some scores in the Credit section. # Schools will want to lower some scores in the Education section. # Insurance companies will want to lower some scores in the Insurance section. # Marketing companies and services will want to lower some scores in the Marketing section. # Medical professionals and companies will want to lower some scores in the Medical section. # Real estate companies may want to lower some scores in the Real Estate section. # Software companies may want to lower scores in the Software section ######## ###################### ################################################## # Rule definitions to avoid --lint errors on archived/moved rules. ######## ###################### ################################################## meta SARE_SUB_MSGSUB 0 meta SARE_SUB_INC_ONLINE 0 meta SARE_SUB_6_FIG_INC 0 meta SARE_SUB_GAPPY_5 0 meta SARE_SUB_GAPPY_6 0 meta SARE_SUB_DBL_MEDICTN 0 meta SARE_SUB_LOSE_OB 0 meta SARE_SUB_HARD_OB 0 meta SARE_SUB_BOOST 0 meta SARE_SUB_DOWNLOAD_OB 0 meta SARE_SUB_MEDICAL_NEWS 0 meta SARE_SUB_CASINO_OB 0 meta SARE_SUB_PORN_WORD05 0 meta SARE_SUB_PORN_WORD11 0 meta SARE_SUB_FIRE_BOSS 0 meta SARE_SUB_GET_PAID 0 meta SARE_SUB_SMART_PRICE 0 meta SARE_SUB_DOLLARS 0 meta SARE_SUB_DASH_ONLY 0 meta SARE_SUB_YOUR_LISTING 0 meta SARE_SUB_PENIS_OB 0 meta SARE_SUB_PERS_KNOW 0 meta SARE_SUB_INEXPEN 0 meta SARE_SUB_BUY_OB 0 meta SARE_SUB_SEX_EXP_GAP 0 meta SARE_SUB_ASSIST 0 meta SARE_SUB_PROTECT_FAM 0 meta SARE_SUB_IMPROVE 0 meta SARE_SUB_SYSTEMWORKS 0 meta SARE_SUB_WP_OFFICE 0 meta SARE_SUB_ATTRACT 0 meta SARE_SUB_BETTER_OB2 0 meta SARE_SUB_MORTGAGE_OB 0 meta SARE_SUB_DBL_PHARM 0 meta SARE_SUB_ORIG_SOFT_OB 0 meta SARE_SUB_BUY_OB1 0 meta SARE_SUB_CHEAP_OB 0 meta SARE_SUB_ONLINE_OB 0 meta SARE_SUB_LOSE_PCT1 0 meta SARE_SUB_LOSE_PCT2 0 meta SARE_SUB_WHILE_U_CAN 0 ######## ###################### ################################################## # Category: __rules used by primary rules below ######## ###################### ################################################## # Attempt to identify simple subject obfuscation by character insertion header __SARE_SUB_OBFU_ASTER Subject =~ /[a-zA-Z0]\*[a-zA-Z]/ header __SARE_SUB_OBFU_CARAT Subject =~ /[a-zA-Z0]\^[a-zA-Z]/ header __SARE_SUB_OBFU_COLON Subject =~ /[a-zA-Z0]:[a-zA-Z]/ header __SARE_SUB_OBFU_COMMA Subject =~ /[a-zA-Z0],[a-zA-Z]/ header __SARE_SUB_OBFU_SLASH Subject =~ /[a-zA-Z0]\/[a-zA-Z]/ header __SARE_SUB_OBFU_LQUOT Subject =~ /[a-zA-Z0]`[a-zA-Z]/ header __SARE_SUB_OBFU_PERIOD Subject =~ /[a-zA-Z0]\.[a-zA-Z]/ header __SARE_SUB_OBFU_2PER Subject =~ /[a-zA-Z0]\.\.[a-zA-Z]/ header __SARE_SUB_OBFU_PIPE Subject =~ /[a-zA-Z0]\|[a-zA-Z]/ header __SARE_SUB_OBFU_PLUS Subject =~ /[a-zA-Z0]\+[a-zA-Z]/ header __SARE_SUB_OBFU_QUOTE Subject =~ /[a-zA-Z0]"[a-zA-Z]/ header __SARE_SUB_OBFU_SCOLON Subject =~ /[a-zA-Z0];[a-zA-Z]/ header __SARE_SUB_OBFU_USCORE Subject =~ /[a-zA-Z0]_[a-zA-Z]/ header __SARE_SUB_OBFU_HTTP Subject =~ m*http://*i ######## ###################### ################################################## # Category: Adult/Porn ######## ###################### ################################################## header SARE_SUB_PORN_WORD08 Subject =~ /\bMILF\b/i describe SARE_SUB_PORN_WORD08 Adult spammer words score SARE_SUB_PORN_WORD08 0.794 #hist SARE_SUB_PORN_WORD08 Richard Gray, Feb 21 2005 #counts SARE_SUB_PORN_WORD08 9s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_PORN_WORD08 33s/0h of 400345 corpus (178117s/222228h RM) 03/31/05 #counts SARE_SUB_PORN_WORD08 0s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_PORN_WORD08 1s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_PORN_WORD08 8s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_PORN_WORD08 1s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 ######## ###################### ################################################## # Category: Black market items, services, activities, scams, frauds ######## ###################### ################################################## header SARE_SUB_FREE_PPV Subject =~ /(?:(?:f.?r.?e.?e+|pay(?:ing)?.for(?:.your)?|unlimited).?(?:PPV|p[a\@]y.?per.?view)|(?:PPV|p[a\@]y.?per.?view).{0,30}free|ppv\'s)/i describe SARE_SUB_FREE_PPV Spammer subject - black market or scam score SARE_SUB_FREE_PPV 1.556 #counts SARE_SUB_FREE_PPV 38s/0h of 260874 corpus (115834s/145040h RM) 05/24/05 #max SARE_SUB_FREE_PPV 155s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_FREE_PPV 4s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_FREE_PPV 7s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_FREE_PPV 6s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_FREE_PPV 14s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_FREE_PPV 4s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header __SARE_SUB_INC_ONLINE Subject =~ /income online/i header __SARE_SUB_6_FIG_INC Subject =~ /(?:\d|six|seven) Figure Income/i meta SARE_SUB_INC_ONLINE2 __SARE_SUB_INC_ONLINE && __SARE_SUB_6_FIG_INC describe SARE_SUB_INC_ONLINE2 Subject contains apparent spammer phrasing score SARE_SUB_INC_ONLINE2 1.666 #stype SARE_SUB_INC_ONLINE2 spamg #counts SARE_SUB_INC_ONLINE2 3s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_INC_ONLINE2 63s/0h of 400345 corpus (178117s/222228h RM) 03/31/05 #counts SARE_SUB_INC_ONLINE2 0s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_INC_ONLINE2 24s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_INC_ONLINE2 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_NAME_STAR Subject =~ /Name\W*A\W*Star/i describe SARE_SUB_NAME_STAR Spammer subject - black market or scam score SARE_SUB_NAME_STAR 1.111 #stype SARE_SUB_NAME_STAR spamp #counts SARE_SUB_NAME_STAR 8s/0h of 271461 corpus (129860s/141601h RM) 06/12/05 #max SARE_SUB_NAME_STAR 12s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_NAME_STAR 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_NAME_STAR 3s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_NAME_STAR 23s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_NAME_STAR 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_REPRESENT_REQ Subject =~ /Representative (?:Required|Needed)/i describe SARE_SUB_REPRESENT_REQ Possible phishing subject score SARE_SUB_REPRESENT_REQ 1.322 #counts SARE_SUB_REPRESENT_REQ 124s/0h of 271461 corpus (129860s/141601h RM) 06/12/05 #counts SARE_SUB_REPRESENT_REQ 11s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_REPRESENT_REQ 12s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_REPRESENT_REQ 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_REPRESENT_REQ 2s/0h of 5648 corpus (1019s/4629h ft) 06/04/05 #counts SARE_SUB_REPRESENT_REQ 0s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 header SARE_SUBJ_SINCERE Subject =~ /(?:sincere (?:associate|demand|request)|be sincere\?|please be sincere)/i describe SARE_SUBJ_SINCERE Spam topic found in subject score SARE_SUBJ_SINCERE 1.111 #stype SARE_SUBJ_SINCERE spamp #hist SARE_SUBJ_SINCERE Bob Menschel, May 14 2005 #counts SARE_SUBJ_SINCERE 30s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUBJ_SINCERE 1s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #counts SARE_SUBJ_SINCERE 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUBJ_SINCERE 0s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 ######## ###################### ################################################## # Category: Credit, debt, lending, mortgage, borrowing, investment, financing ######## ###################### ################################################## header SARE_SUB_GRANT Subject =~ /(?:(?:cash|collect\W*your|dollar|free(?:dom)?|get\W*a|government|gov't|qualify\W*for\W*a|taxes\W*paid\W*for\W*these)\W*grants?|grant\W*money\W*for\W*you|grants.{1,30}paid\W*for\W*with\W*your\W*taxes)/i describe SARE_SUB_GRANT Spammer subject - credit or money score SARE_SUB_GRANT 1.139 #counts SARE_SUB_GRANT 43s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_GRANT 85s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_GRANT 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_GRANT 2s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_GRANT 14s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_GRANT 17s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_GRANT 1s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 header SARE_SUB_NEW_CREDIT Subject =~ /(?:(?:all|any)\W*(?:credit.(?:accepted|.{0,30}loan)|loan.{1,30}credit)|\b(?:easy|EZ)\W*(credit|home\W*loan|mortgage)|(?:best|get.{0,30}|right)\W*creditvcard|get\W*cash\W*out|(?:home|m.?[o0].?r.?t.?g.?[a\@].?g.?e)\W*loan.{1,30}credit|lines?\W*of\W*credit|(?:new|your.{0,30})\W*credit\W*line)/i describe SARE_SUB_NEW_CREDIT Spammer subject - credit or money score SARE_SUB_NEW_CREDIT 1.666 #counts SARE_SUB_NEW_CREDIT 39s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_NEW_CREDIT 141s/0h of 113393 corpus (92421s/20972h RM) 04/18/04 #counts SARE_SUB_NEW_CREDIT 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_NEW_CREDIT 11s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_NEW_CREDIT 41s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_NEW_CREDIT 83s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_NEW_CREDIT 9s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_WIPE_CLEAN Subject =~ /\bwiped? clean/i describe SARE_SUB_WIPE_CLEAN Subject will wipe something clean score SARE_SUB_WIPE_CLEAN 0.683 #counts SARE_SUB_WIPE_CLEAN 5s/0h of 260874 corpus (115834s/145040h RM) 05/24/05 #max SARE_SUB_WIPE_CLEAN 14s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_WIPE_CLEAN 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_WIPE_CLEAN 3s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_WIPE_CLEAN 4s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #counts SARE_SUB_WIPE_CLEAN 0s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_WIPE_CLEAN 5s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Gambling, Lotto, Sweepstakes, Winnings, Losses ######## ###################### ################################################## header SARE_SUB_CASINO_BONUS Subject =~ /bonus.+casino/i describe SARE_SUB_CASINO_BONUS Spammer subject - casinos score SARE_SUB_CASINO_BONUS 1.666 #hist SARE_SUB_CASION_BONUS Created by Bob Menschel, July 24 2004, from suggestion by Loren Wilton #counts SARE_SUB_CASINO_BONUS 1s/0h of 260874 corpus (115834s/145040h RM) 05/24/05 #max SARE_SUB_CASINO_BONUS 780s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_CASINO_BONUS 55s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_CASINO_BONUS 63s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_CASINO_BONUS 21s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_CASINO_BONUS 47s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_CASINO_BONUS 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Insurance ######## ###################### ################################################## header SARE_SUB_TERM_LIFE Subject =~ /Term\W*Life/i describe SARE_SUB_TERM_LIFE Spammer subject - insurance score SARE_SUB_TERM_LIFE 1.666 #counts SARE_SUB_TERM_LIFE 31s/0h of 281078 corpus (109729s/171349h RM) 05/05/05 #max SARE_SUB_TERM_LIFE 219s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_TERM_LIFE 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_TERM_LIFE 21s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_TERM_LIFE 25s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_TERM_LIFE 3s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 ######## ###################### ################################################## # Category: Marketing, Pricing, Selling, Buying ######## ###################### ################################################## header SARE_SUB_OEMS Subject =~ m'(?:\b(?:c[o0]rel|n[o0]rt[o0]n|ad[o0]be|m[i1]cr[o0]s[o0]ft|symanntec|macr[o0]med[i1]a)\b.*){3}'i describe SARE_SUB_OEMS Spammer subject - multiple software vendors score SARE_SUB_OEMS 1.467 #hist SARE_SUB_OEMS Robert Brooks, Feb 22 2005 #counts SARE_SUB_OEMS 42s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_OEMS 122s/0h of 291031 corpus (121442s/169589h RM) 04/22/05 #counts SARE_SUB_OEMS 37s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #counts SARE_SUB_OEMS 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #counts SARE_SUB_OEMS 1s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_OEMS 5s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Medical ######## ###################### ################################################## header SARE_SUB_24HOUR_SALE Subject =~ /24 hour sale online/i describe SARE_SUB_24HOUR_SALE Common spammer subject header -- sales score SARE_SUB_24HOUR_SALE 0.733 #hist SARE_SUB_24HOUR_SALE Created by Bob Menschel Apr 28 2004 #counts SARE_SUB_24HOUR_SALE 7s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_24HOUR_SALE 26s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_24HOUR_SALE 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_24HOUR_SALE 3s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04 #counts SARE_SUB_24HOUR_SALE 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_24HOUR_SALE 2s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_24HOUR_SALE 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_24HOUR_SALE 1s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_AM_MED_DICT Subject =~ /American Medical Directory/i describe SARE_SUB_AM_MED_DICT Spammer subject - medical score SARE_SUB_AM_MED_DICT 1.039 #counts SARE_SUB_AM_MED_DICT 0s/0h of 271461 corpus (129860s/141601h RM) 06/12/05 #max SARE_SUB_AM_MED_DICT 68s/0h of 85797 corpus (63598s/22199h RM) 06/04/04 #counts SARE_SUB_AM_MED_DICT 0s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_AM_MED_DICT 3s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_AM_MED_DICT 19s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_AM_MED_DICT 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_BUY_MEDS subject =~ /(?:b[uv]y|p.?[uv].?r.?c.?h.?[a\@].?s.?e|get)\W*(?:[a\@]ll\W*)(?:y[o0\@][uv]r\W*)?(?:c.?h.?e.?[a\@].?p\W*)?(?:[a\@].?[l|].?p.?r.?[a\@].?z.?[o0\@].?[l|]|B.?[o0\@].?n.?t.?r.?i.?[l|]|c.?i.?[a\@].?[l|].?i.?s|C.?[o0\@].?d.?e.?i.?n.?e|D.?i.?d.?r.?e.?x|d.?i.?e.?t|F.?[l|].?e.?x.?e.?r.?i.?[l|]|g.?e.?n.?e.?r.?i.?c|h.?g.?h|H.?y.?d.?r.?[o0\@].?c.?[o0\@].?d.?[o0\@].?n.?e|[l|].?e.?v.?i.?t.?r.?[a\@]|m.?e.?d.?(?:i.?c.?[a\@].?t.?i.?[o0\@].?n.?)?s|M.?[uv].?s.?c.?[l|].?e.?R.?e.?[l|].?[a\@].?x.?[a\@].?n.?t.?s?|p.?[a\@].?i.?n|P.?[a\@].?x.?i.?[l|]|P.?h.?e.?n.?t.?e.?r.?m.?i.?n.?e|P.?r.?e.?s.?c.?r.?i.?p.?t.?i.?[o0\@].?n.?s?|P.?r.?[o0\@].?z.?[a\@].?c|S.?i.?[l|].?d.?e.?n.?[a\@].?f.?i.?[l|]|S.?k.?e.?[l|].?[a\@].?x.?i.?n|s.?[l|].?e.?e.?p.?i.?n.?g|s.?[o0\@].?m.?[a\@]|T.?r.?[a\@].?m.?[a\@].?d.?[o0\@].?[l|]|v.?[a\@].?[l|].?i.?[uv].?m|v.?i.?[a\@].?g.?r.?[a\@]|V.?i.?c.?[o0\@].?d.?i.?n|V.?i.?[o0\@].?x.?x|x.?[a\@].?n.?[a\@].?x|Z.?[o0\@].?[l|].?[o0\@].?f.?t)\b/i describe SARE_SUB_BUY_MEDS Spammer subject - medical score SARE_SUB_BUY_MEDS 1.578 #hist SARE_SUB_BUY_MEDS Created by Bob Menschel April 24 2004 #counts SARE_SUB_BUY_MEDS 2s/0h of 280564 corpus (109285s/171279h RM) 05/03/05 #max SARE_SUB_BUY_MEDS 127s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_BUY_MEDS 8s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #max SARE_SUB_BUY_MEDS 26s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_BUY_MEDS 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_BUY_MEDS 31s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_BUY_MEDS 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_FORGET_DOC subject =~ /(?:forget|skip|(?:why go|no visit|no need to go) to) the doctor/i describe SARE_SUB_FORGET_DOC Spammer subject - medical score SARE_SUB_FORGET_DOC 1.272 #hist SARE_SUB_FORGET_DOC Created by Bob Menschel Oct 03 2004 #counts SARE_SUB_FORGET_DOC 2s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_FORGET_DOC 82s/0h of 115424 corpus (81069s/34355h RM) 01/16/05 #counts SARE_SUB_FORGET_DOC 17s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_FORGET_DOC 21s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_FORGET_DOC 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_FORGET_DOC 9s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_FORGET_DOC 1s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_FORGET_DOC 7s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_FREE_PRES Subject =~ /(?!free press)free pres./i describe SARE_SUB_FREE_PRES subject has likely spammer phrase or word score SARE_SUB_FREE_PRES 1.322 #ham SARE_SUB_FREE_PRES "free press" www.freepress.net #hist SARE_SUB_FREE_PRES From 88_FVGT_subject.cf FS_FREE_PRES May 1 2004 #counts SARE_SUB_FREE_PRES 12s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_FREE_PRES 99s/0h of 115449 corpus (94274s/21175h RM) 05/01/04 #counts SARE_SUB_FREE_PRES 19s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_FREE_PRES 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_FREE_PRES 8s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_FREE_PRES 1s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_FREE_PRES 12s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_GIVE_SMILE Subject =~ /Give her something to smile about/i describe SARE_SUB_GIVE_SMILE Common spammer subject score SARE_SUB_GIVE_SMILE 0.706 #hist SARE_SUB_GIVE_SMILE Created by Bob Menschel Nov 07 2004 #counts SARE_SUB_GIVE_SMILE 8s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_GIVE_SMILE 15s/0h of 102867 corpus (66500s/36367h RM) 12/07/04 #counts SARE_SUB_GIVE_SMILE 1s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_GIVE_SMILE 9s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_GIVE_SMILE 2s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 header __SARE_SUB_INET_PHARM Subject =~ /(?!Pharmacy selection)(?:(?:American|best|(?:by|from)\W*(?:a\W*_?US|cheap|cyber|discreet|\e-|FDA|free|generic|genuine|Internet|low\W*cost|new|off\W*shore|on\W*line(?:.{1,5}USA)?|overnight|perfect|smart|super|US\W*doctors\W*US)|(?:discreet|no\W*doctor).{1,30})\W*Pharmacy|Pharmacy.{1,30}(?:deals|sale|online|prices?|related\W*drugs|selection|verification)|your\W*pharmacy\W*order)/i describe __SARE_SUB_INET_PHARM Common spammer subject header -- Medical #hist __SARE_SUB_INET_PHARM Created by Bob Menschel Apr 09 2004 #hist __SARE_SUB_INET_PHARM Merged SARE_SUB_PHARM_ONLINE from From 88_FVGT_subject.cf FS_PHARMAC_OLINE into this rule July 24 2004 #ham __SARE_SUB_INET_PHARM "Pharmacy selection" in email discussing employee's health benefits meta SARE_SUB_INET_PHARM __SARE_SUB_INET_PHARM && !ONLINE_PHARMACY describe SARE_SUB_INET_PHARM Common spammer subject header -- Medical score SARE_SUB_INET_PHARM 1.666 #overlap SARE_SUB_INET_PHARM SARE rule overlaps distribution rule, but does not duplicate it. #overlap SARE_SUB_INET_PHARM It is very possible for the SARE rule to hit but not the distribution rule. #hist SARE_SUB_INET_PHARM Created Aug 10 2004 by Bob Menschel to avoid double-scoring on overlap #counts SARE_SUB_INET_PHARM 54s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_INET_PHARM 484s/0h of 291031 corpus (121442s/169589h RM) 04/22/05 #counts SARE_SUB_INET_PHARM 52s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #max SARE_SUB_INET_PHARM 109s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_INET_PHARM 8s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_INET_PHARM 29s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_INET_PHARM 9s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_INET_PHARM 11s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SUBJECT_DIET Subject =~ /\bLose .*(?:pounds|lbs|weight)/i #distrib SUBJECT_DIET Copied from 3.0.2 to enable following meta tests in mass-checks header SARE_SUB_MALE_MUSCLE Subject =~ /Male muscle/i describe SARE_SUB_MALE_MUSCLE Spammer subject - medical score SARE_SUB_MALE_MUSCLE 0.689 #counts SARE_SUB_MALE_MUSCLE 12s/0h of 281078 corpus (109729s/171349h RM) 05/05/05 #max SARE_SUB_MALE_MUSCLE 15s/0h of 61007 corpus (36343s/24664h RM) 08/27/04 #counts SARE_SUB_MALE_MUSCLE 2s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_MALE_MUSCLE 4s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_MALE_MUSCLE 3s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUBJ_MED_USE Subject =~ /\w{3}\sused .+ (?:along with|combin|manage|prevent|relieve|symptom|treat)/i describe SARE_SUBJ_MED_USE Spam topic found in subject score SARE_SUBJ_MED_USE 1.666 #stype SARE_SUBJ_MED_USE spamp #hist SARE_SUBJ_MED_USE Bob Menschel, May 14 2005 #counts SARE_SUBJ_MED_USE 208s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUBJ_MED_USE 253s/0h of 275081 corpus (134226s/140855h RM) 05/30/05 #counts SARE_SUBJ_MED_USE 2s/0h of 5648 corpus (1019s/4629h ft) 06/04/05 #counts SARE_SUBJ_MED_USE 0s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #counts SARE_SUBJ_MED_USE 108s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUBJ_MED_USE 1s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_NO_RX Subject =~ /(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\W_]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95) (?:(?:[p\xDE]|\xCE\xA1|\xCF\x81|\xD0\xA0|\xD1\x80)[\W_]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93)[\W_]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\W_]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)[\W_]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93) )?(?:[p\xDE]|\xCE\xA1|\xCF\x81|\xD0\xA0|\xD1\x80)[\W_]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93)[\W_]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)[\W_]?(?:[s5\$\xA7]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F)[\W_]?(?:[c\*\xC7\xE7\xA2\xA9]|\xC4[\x86-\x8D]|\xD0\xA1|\xD1\x81)[\W_]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93)[\W_]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\W_]?(?:[p\xDE]|\xCE\xA1|\xCF\x81|\xD0\xA0|\xD1\x80)[\W_]?(?:[t\+]|\xC5[\xA2-\xA7]|\xCE\xA4|\xCF\x84|\xD0\xA2|\xD1\x82)[\W_]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\W_]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)[\W_]?(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\W_]?(?:[s5\$\xA7]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F)? (?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\W_]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)[\W_]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)[\W_]?(?:[d\xD0]|\xC4[\x8E-\x91])[\W_]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)[\W_]?(?:[d\xD0]|\xC4[\x8E-\x91])/i score SARE_SUB_NO_RX 1.666 describe SARE_SUB_NO_RX no prescription needed #hist SARE_SUB_NO_RX Created by Bob Menschel Aug 7 2004 #counts SARE_SUB_NO_RX 116s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_NO_RX 291s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_NO_RX 86s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_NO_RX 88s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_NO_RX 7s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_NO_RX 29s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_NO_RX 8s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 header SARE_SUB_NUM_PILLS Subject =~ /\d.pills/i describe SARE_SUB_NUM_PILLS Common spammer subject header -- medical score SARE_SUB_NUM_PILLS 1.111 #stype SARE_SUB_NUM_PILLS spamp #hist SARE_SUB_NUM_PILLS Created by Bob Menschel Apr 28 2004 #counts SARE_SUB_NUM_PILLS 13s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_NUM_PILLS 37s/0h of 400345 corpus (178117s/222228h RM) 03/31/05 #counts SARE_SUB_NUM_PILLS 4s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_NUM_PILLS 9s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04 #counts SARE_SUB_NUM_PILLS 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_NUM_PILLS 3s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_NUM_PILLS 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_ONLINE_DRUG Subject =~ /Online drugs/i describe SARE_SUB_ONLINE_DRUG Common spammer subject score SARE_SUB_ONLINE_DRUG 1.666 #hist SARE_SUB_ONLINE_DRUG Created by Bob Menschel Apr 07 2004 #counts SARE_SUB_ONLINE_DRUG 16s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_ONLINE_DRUG 315s/0h of 400345 corpus (178117s/222228h RM) 03/31/05 #counts SARE_SUB_ONLINE_DRUG 14s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_ONLINE_DRUG 18s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04 #counts SARE_SUB_ONLINE_DRUG 7s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_ONLINE_DRUG 13s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_ONLINE_DRUG 1s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_ONLINE_DRUG 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_REFILL_RX Subject =~ /\b(?:refill rx|rx refill)\b/i describe SARE_SUB_REFILL_RX Common spammer subject - medical score SARE_SUB_REFILL_RX 0.867 #hist SARE_SUB_REFILL_RX Created by Bob Menschel Sep 10 2004 #counts SARE_SUB_REFILL_RX 1s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_REFILL_RX 23s/0h of 400345 corpus (178117s/222228h RM) 03/31/05 #counts SARE_SUB_REFILL_RX 0s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_REFILL_RX 33s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_REFILL_RX 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_RENEW_VITAL Subject =~ /(?:feel|improve|increase|renew).*vitality/i describe SARE_SUB_RENEW_VITAL Common spammer subject score SARE_SUB_RENEW_VITAL 1.111 #stype SARE_SUB_RENEW_VITAL spamp #hist SARE_SUB_RENEW_VITAL Created by Bob Menschel Nov 20 2004 #counts SARE_SUB_RENEW_VITAL 8s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_RENEW_VITAL 15s/0h of 102867 corpus (66500s/36367h RM) 12/07/04 #counts SARE_SUB_RENEW_VITAL 6s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_RENEW_VITAL 5s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_RENEW_VITAL 5s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_RENEW_VITAL 3s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 ######## ###################### ################################################## # Category: Real Estate ######## ###################### ################################################## header SARE_SUB_FORECLOSURE Subject =~ /Foreclosure/i describe SARE_SUB_FORECLOSURE Spammer subject - real estate score SARE_SUB_FORECLOSURE 1.666 #counts SARE_SUB_FORECLOSURE 148s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_FORECLOSURE 1s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_FORECLOSURE 8s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_FORECLOSURE 104s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_FORECLOSURE 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Religious, including religious scams ######## ###################### ################################################## header SARE_SUB_LEGAL_ORDIN Subject =~ /(?:(?:LEGAL|online)\W*ORDINATION|proceed\W*with.{1,30}ordination)/i describe SARE_SUB_LEGAL_ORDIN Spammer subject - religion score SARE_SUB_LEGAL_ORDIN 0.700 #counts SARE_SUB_LEGAL_ORDIN 0s/0h of 280564 corpus (109285s/171279h RM) 05/03/05 #max SARE_SUB_LEGAL_ORDIN 15s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_LEGAL_ORDIN 0s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_LEGAL_ORDIN 2s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_LEGAL_ORDIN 3s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_LEGAL_ORDIN 9s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_LEGAL_ORDIN 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Software ######## ###################### ################################################## header SARE_SUB_ORIG_SOFT Subject =~ /\boriginal softwares?\b/i describe SARE_SUB_ORIG_SOFT subject has a spammer subject - Software score SARE_SUB_ORIG_SOFT 1.078 #hist SARE_SUB_ORIG_SOFT Created by Bob Menschel Jul 31 2004 #hist SARE_SUB_ORIG_SOFT Bound \b Jan 27 2005 to avoid overlap with SARE_SUB_ORIG_SOFT_OB #counts SARE_SUB_ORIG_SOFT 0s/0h of 196667 corpus (96194s/100473h RM) 02/21/05 #max SARE_SUB_ORIG_SOFT 65s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_ORIG_SOFT 14s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_ORIG_SOFT 19s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_ORIG_SOFT 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_ORIG_SOFT 10s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_ORIG_SOFT 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Spamming ######## ###################### ################################################## ######## ###################### ################################################## # Category: Generic words and phrases ######## ###################### ################################################## header SARE_SUB_BUY_CHEAP subject =~ /\bb[uv]\Wy cheap\b/i describe SARE_SUB_BUY_CHEAP Spammer subject - medical score SARE_SUB_BUY_CHEAP 2.222 #hist SARE_SUB_BUY_CHEAP Created by Bob Menschel Aug 11 2004 #hist SARE_SUB_BUY_CHEAP Bugzilla submission 3860, Oct 03 2004 #hist SARE_SUB_BUY_CHEAP Added some obfuscation, Bob Menschel, May 5 2005 #counts SARE_SUB_BUY_CHEAP 0s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_BUY_CHEAP 1306s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_BUY_CHEAP 0s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_BUY_CHEAP 136s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_BUY_CHEAP 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_BUY_CHEAP 35s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_BUY_CHEAP 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_BUY_CHEAP 5s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_CHEAP Subject =~ /^Cheap(?:est)\s\w/i describe SARE_SUB_CHEAP Subject matches common spam pattern score SARE_SUB_CHEAP 1.666 #hist SARE_SUB_CHEAP LW_CHEAP_SUB, Aug 16 2004, Loren Wilton #counts SARE_SUB_CHEAP 30s/0h of 280564 corpus (109285s/171279h RM) 05/03/05 #max SARE_SUB_CHEAP 124s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_CHEAP 42s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #counts SARE_SUB_CHEAP 3s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_CHEAP 25s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_CHEAP 3s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_MSG_SUBJ Subject =~ /(?!message\n)^\W*(?:message\W+(?:subject|notification)|(?:new\W+)?(?:private\W+)?message)\W*$/i describe SARE_SUB_MSG_SUBJ subject is generic/default spammer subject score SARE_SUB_MSG_SUBJ 1.666 #stype SARE_SUB_MSG_SUBJ spamp #hist SARE_SUB_MSG_SUBJ Created by Bob Menschel Aug 10 2004, enhanced Aug 12 2004 #counts SARE_SUB_MSG_SUBJ 177s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_MSG_SUBJ 216s/0h of 280564 corpus (109285s/171279h RM) 05/03/05 #counts SARE_SUB_MSG_SUBJ 27s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #counts SARE_SUB_MSG_SUBJ 13s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_MSG_SUBJ 28s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_MSG_SUBJ 10s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_MSG_SUBJ 11s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_PAYMENT Subject =~ /(?:payment|report) .{0,35}\b[PN]\d{7,25}\s*$/i describe SARE_SUB_PAYMENT Subject matches common spam pattern score SARE_SUB_PAYMENT 1.666 #hist SARE_SUB_PAYMENT LW_PMNT_SUB, Aug 16 2004, Loren Wilton #counts SARE_SUB_PAYMENT 197s/0h of 275081 corpus (134226s/140855h RM) 05/30/05 #counts SARE_SUB_PAYMENT 26s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_PAYMENT 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_PAYMENT 8s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_PAYMENT 11s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_PAYMENT 17s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Technical spamsign ######## ###################### ################################################## header SARE_SUB_COMMA_FIRST Subject =~ /^,/ describe SARE_SUB_COMMA_FIRST Subject starts with a Comma. score SARE_SUB_COMMA_FIRST 1.200 #counts SARE_SUB_COMMA_FIRST 34s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_COMMA_FIRST 87s/0h of 283414 corpus (129902s/153512h RM) 03/08/05 #counts SARE_SUB_COMMA_FIRST 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_COMMA_FIRST 24s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_COMMA_FIRST 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_VIRUSQ Subject =~ /^\s*\WVirus\?\W / describe SARE_SUB_VIRUSQ Subject indicates this is a virus bounce score SARE_SUB_VIRUSQ 2.444 #hist SARE_SUB_VIRUSQ Created by Bob Menschel Jul 23 2004 #counts SARE_SUB_VIRUSQ 1s/0h of 280564 corpus (109285s/171279h RM) 05/03/05 #max SARE_SUB_VIRUSQ 3687s/0h of 69842 corpus (42682s/27160h RM) 09/26/04 #counts SARE_SUB_VIRUSQ 0s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_VIRUSQ 0s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_VIRUSQ 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 # EOF # SARE "General Subject" Ruleset for SpamAssassin - File 1 # Version: 01.03.09 # Created: 2004-09-13 # Modified: 2005-06-13 # Usage instructions and documentation are found in 70_sare_genlsubj0.cf #@@# Revision History: Full Revision History stored in 70_sare_genlsubj.log #@@# 01.03.09: June 13 2005 #@@# Minor score updates based on additional mass-check #@@# Moved file 0 to file 1: SARE_SUB_WHILE_U_CAN #@@# Moved file 1 to file 3: SARE_SUB_NEXT_DOOR #@@# Moved file 1 to file 3: SARE_SUB_INVESTMENTS #@@# Moved file 1 to file 3: SARE_SUB_AS_LOW_AS ######## ###################### ################################################## # Rule definitions to avoid --lint errors on archived/moved rules. ######## ###################### ################################################## meta SARE_SUB_2UNDERSCORES 0 meta SARE_SUB_ACCT_UPD 0 meta SARE_SUB_ADV_SEARCH 0 meta SARE_SUB_CHANGE_LIFE 0 meta SARE_SUB_CHARGE_OB 0 meta SARE_SUB_COMM_MAILERS 0 meta SARE_SUB_EBAY_OB 0 meta SARE_SUB_EXPIRED 0 meta SARE_SUB_GAPPY_3 0 meta SARE_SUB_GAPPY_4 0 meta SARE_SUB_LEAD_PUNCT 0 meta SARE_SUB_LONG_SUBJ_140 0 meta SARE_SUB_LONG_SUBJ_170 0 meta SARE_SUB_LOTS_PUNC_21 0 meta SARE_SUB_LOTS_PUNC_26 0 meta SARE_SUB_MENS_HEALTH 0 meta SARE_SUB_PERFECTLY 0 meta SARE_SUB_RAND_UC 0 meta SARE_SUB_STRETCH_MARK 0 meta SARE_SUB_TAXES 0 meta SARE_SUB_DOWNLOAD_OB 0 meta SARE_SUB_PENIS_OB 0 meta SARE_SUB_ACTION_OB 0 meta SARE_SUB_BETTER_OB2 0 meta SARE_SUB_BIGGER_OB 0 meta SARE_SUB_BOOST_OB 0 meta SARE_SUB_BREAKTHRU_OB 0 meta SARE_SUB_BUY_OB 0 meta SARE_SUB_CONSULTN_OB 0 meta SARE_SUB_HARD_OB 0 meta SARE_SUB_HOMEOWNER_OB 0 meta SARE_SUB_INKJET_OB 0 meta SARE_SUB_LOSE_OB 0 meta SARE_SUB_MOVE_OB 0 meta SARE_SUB_PHOTOS_OB 0 meta SARE_SUB_PHYSICIAN_OB 0 meta SARE_SUB_PLEASE_OB 0 meta SARE_SUB_REAL_OB 0 meta SARE_SUB_STRONG_OB 0 meta SARE_SUB_VIDEO_OB 0 meta SARE_SUB_YOUNGER_OB 0 meta SARE_SUB_SION_OB 0 meta SARE_SUB_TION_OB 0 meta SARE_SUB_AGING 0 meta SARE_SUB_BETTER_DEAL 0 meta SARE_SUB_BIGGER 0 meta SARE_SUB_BREAKTHRU 0 meta SARE_SUB_CALL_NOW 0 meta SARE_SUB_CAR_INSURANCE 0 meta SARE_SUB_CONSULTATION 0 meta SARE_SUB_DEBT 0 meta SARE_SUB_DEBTS_COURT 0 meta SARE_SUB_FOR_WOMEN 0 meta SARE_SUB_GROW_BUSINESS 0 meta SARE_SUB_INCHES 0 meta SARE_SUB_INKJET 0 meta SARE_SUB_INVESTORS 0 meta SARE_SUB_JOB 0 meta SARE_SUB_MEDICAL_NEWS 0 meta SARE_SUB_NEXT_DOOR 0 meta SARE_SUB_PAREN_NUM2 0 meta SARE_SUB_PHYSICIAN 0 meta SARE_SUB_STRONG 0 meta SARE_SUB_TONER 0 meta SARE_SUB_WINNER 0 meta SARE_SUB_YOUR_WOMAN 0 meta SARE_SUB_MISC_1 0 meta SARE_SUB_NEXT_DOOR 0 meta SARE_SUB_INVESTMENTS 0 meta SARE_SUB_AS_LOW_AS 0 ######## ###################### ################################################## # Category: __rules used by primary rules below ######## ###################### ################################################## # Attempt to identify simple subject obfuscation by character insertion header __SARE_SUB_OBFU_ASTER Subject =~ /[a-zA-Z0]\*[a-zA-Z]/ header __SARE_SUB_OBFU_CARAT Subject =~ /[a-zA-Z0]\^[a-zA-Z]/ header __SARE_SUB_OBFU_COLON Subject =~ /[a-zA-Z0]:[a-zA-Z]/ header __SARE_SUB_OBFU_COMMA Subject =~ /[a-zA-Z0],[a-zA-Z]/ header __SARE_SUB_OBFU_SLASH Subject =~ /[a-zA-Z0]\/[a-zA-Z]/ header __SARE_SUB_OBFU_LQUOT Subject =~ /[a-zA-Z0]`[a-zA-Z]/ header __SARE_SUB_OBFU_PERIOD Subject =~ /[a-zA-Z0]\.[a-zA-Z]/ header __SARE_SUB_OBFU_2PER Subject =~ /[a-zA-Z0]\.\.[a-zA-Z]/ header __SARE_SUB_OBFU_PIPE Subject =~ /[a-zA-Z0]\|[a-zA-Z]/ header __SARE_SUB_OBFU_PLUS Subject =~ /[a-zA-Z0]\+[a-zA-Z]/ header __SARE_SUB_OBFU_QUOTE Subject =~ /[a-zA-Z0]"[a-zA-Z]/ header __SARE_SUB_OBFU_SCOLON Subject =~ /[a-zA-Z0];[a-zA-Z]/ header __SARE_SUB_OBFU_USCORE Subject =~ /[a-zA-Z0]_[a-zA-Z]/ header __SARE_SUB_OBFU_HTTP Subject =~ m*http://*i ######## ###################### ################################################## # Category: Adult/Porn ######## ###################### ################################################## header SARE_SUB_PORN_WORD02 Subject =~ /puss(?:y|ies)/i describe SARE_SUB_PORN_WORD02 Adult spammer words score SARE_SUB_PORN_WORD02 0.776 #hist SARE_SUB_PORN_WORD02 Richard Gray, Feb 21 2005 #counts SARE_SUB_PORN_WORD02 79s/2h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_PORN_WORD02 125s/2h of 280895 corpus (109565s/171330h RM) 05/03/05 #counts SARE_SUB_PORN_WORD02 18s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_PORN_WORD02 21s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_PORN_WORD02 16s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_PORN_WORD02 4s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_PORN_WORD02 10s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_PORN_WORD02 2s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_PORN_WORD05 Subject =~ /\bh(?:orn|onr|nro|nor|ron|rno)y\b/i describe SARE_SUB_PORN_WORD05 Adult spammer words score SARE_SUB_PORN_WORD05 1.244 #hist SARE_SUB_PORN_WORD05 Richard Gray, Feb 21 2005 #ham SARE_SUB_PORN_WORD05 verified (1) #counts SARE_SUB_PORN_WORD05 89s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_PORN_WORD05 9s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_PORN_WORD05 15s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_PORN_WORD05 21s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_PORN_WORD05 4s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_PORN_WORD05 1s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_PORN_WORD06 Subject =~ /f(?:ucke|ucek|ukce|ukec|ueck|uekc|cuek|cuke|ckue|ckeu|ceku|ceuk|kuce|kuec|kcue|kceu|kecu|keuc|euck|eukc|ecuk|ecku|ekcu|ekuc)d/i describe SARE_SUB_PORN_WORD06 Adult spammer words score SARE_SUB_PORN_WORD06 0.781 #ham SARE_SUB_PORN_WORD06 verified (1) #hist SARE_SUB_PORN_WORD06 Richard Gray, Feb 21 2005 #counts SARE_SUB_PORN_WORD06 97s/3h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_PORN_WORD06 117s/1h of 280895 corpus (109565s/171330h RM) 05/03/05 #counts SARE_SUB_PORN_WORD06 4s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_PORN_WORD06 56s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_PORN_WORD06 3s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_PORN_WORD06 2s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_PORN_WORD10 Subject =~ /\b(?:hstoett|o(?:the|teh|het|hte|eht|eth)r|stpuid|stupid|disgusting|shy|married|brand new|dirty|average|amateur|amatuer|amtauer|real|beautiful|hot|sexy|sxey|n(?:ast|ats|tas|tsa|sta|sat)y|wet|cute).{1,3}(?:(?:step|grand)?[\-_]?(?:mo|om)ms?|house[\-_]?wi[fvr]es?|(?:cow)?girls?|moms?|w(?:om[ae]|o[ae]m|[ae]om|[ae]mo|m[ae]o|mo[ae])n|neigbhour|neighbour|neighbuor|(?:teen|tnee)(?:ager|agre|arge)?s?|s(?:lu|ul)ts?|bitehcs|bitches)\b/i describe SARE_SUB_PORN_WORD10 Adult spammer words score SARE_SUB_PORN_WORD10 0.687 #ham SARE_SUB_PORN_WORD10 verified (many) #hist SARE_SUB_PORN_WORD10 Richard Gray, Feb 21 2005 #hist SARE_SUB_PORN_WORD10 Bob Menschel, Jun 12 2005 -- Added word boundaries #counts SARE_SUB_PORN_WORD10 176s/2h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_PORN_WORD10 18s/10h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_PORN_WORD10 25s/10h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_PORN_WORD10 14s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #counts SARE_SUB_PORN_WORD10 95s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_PORN_WORD10 5s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_PORN_WORD11 Subject =~ /\bcum(?:shot)?\b/i describe SARE_SUB_PORN_WORD11 Adult spammer words score SARE_SUB_PORN_WORD11 1.478 #ham SARE_SUB_PORN_WORD11 verified (1), possible (several) #hist SARE_SUB_PORN_WORD11 Richard Gray, Feb 21 2005 #counts SARE_SUB_PORN_WORD11 247s/1h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_PORN_WORD11 1059s/1h of 283414 corpus (129902s/153512h RM) 03/08/05 #counts SARE_SUB_PORN_WORD11 60s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_PORN_WORD11 23s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_PORN_WORD11 19s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #counts SARE_SUB_PORN_WORD11 2s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_SEX_EXP_GAP Subject =~ m'sexually - explicit'i describe SARE_SUB_SEX_EXP_GAP CANSPAM variation score SARE_SUB_SEX_EXP_GAP 1.000 #stype SARE_SUB_SEX_EXP_GAP spamg #counts SARE_SUB_SEX_EXP_GAP 0s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_SEX_EXP_GAP 6s/0h of 196667 corpus (96194s/100473h RM) 02/21/05 #counts SARE_SUB_SEX_EXP_GAP 0s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_SEX_EXP_GAP 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #counts SARE_SUB_SEX_EXP_GAP 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Black market items, services, activities, scams, frauds ######## ###################### ################################################## header SARE_SUB_ASSIST Subject =~ /^\s*Assistance\s*$/i describe SARE_SUB_ASSIST Subject contains spammer subject - fraud/scam score SARE_SUB_ASSIST 0.678 #hist SARE_SUB_ASSIST Created by Bob Menschel Jul 23 2004 #counts SARE_SUB_ASSIST 13s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_ASSIST 21s/0h of 400345 corpus (178117s/222228h RM) 03/31/05 #counts SARE_SUB_ASSIST 1s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_ASSIST 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_ASSIST 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_CARD_BILLED Subject =~ /(?:account|card).{1,30}(?:billed|charged)/i describe SARE_SUB_CARD_BILLED Spammer subject - black market or scam score SARE_SUB_CARD_BILLED 1.111 #stype SARE_SUB_CARD_BILLED spamp #counts SARE_SUB_CARD_BILLED 0s/0h of 56906 corpus (32313s/24593h RM) 07/25/04 #max SARE_SUB_CARD_BILLED 23s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_CARD_BILLED 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_CARD_BILLED 1s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_CARD_BILLED 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_CARD_BILLED 2s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_CARD_BILLED 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_FIRE_BOSS Subject =~ /Fire your boss/i describe SARE_SUB_FIRE_BOSS Spammer subject - black market or scam score SARE_SUB_FIRE_BOSS 0.711 #hist SARE_SUB_FIRE_BOSS From Loren Wilton, July 22 2004 #counts SARE_SUB_FIRE_BOSS 0s/0h of 291031 corpus (121442s/169589h RM) 04/22/05 #max SARE_SUB_FIRE_BOSS 22s/0h of 60310 corpus (35337s/24973h RM) 08/10/04 #counts SARE_SUB_FIRE_BOSS 0s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_FIRE_BOSS 4s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_FIRE_BOSS 6s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_FIRE_BOSS 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_FIRE_BOSS 2s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_GET_PAID Subject =~ /get paid/i describe SARE_SUB_GET_PAID Subject mentions getting paid for something score SARE_SUB_GET_PAID 1.247 #hist SARE_SUB_GET_PAID RM_spc_GetPaid #counts SARE_SUB_GET_PAID 92s/1h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_GET_PAID 107s/2h of 280895 corpus (109565s/171330h RM) 05/03/05 #counts SARE_SUB_GET_PAID 2s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_GET_PAID 146s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_GET_PAID 167s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_GET_PAID 5s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_GET_PAID 4s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_NAME_MILBEN From:name =~ /Military Benefits/i describe SARE_SUB_NAME_MILBEN Might be military benefits scam score SARE_SUB_NAME_MILBEN 0.794 #hist SARE_SUB_NAME_MILBEN Matt Yackley, Apr 15 2005 #counts SARE_SUB_NAME_MILBEN 8s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_NAME_MILBEN 35s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_NAME_MILBEN 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_NAME_MILBEN 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 header SARE_SUB_NEED_REPLY Subject =~ /(?:(?:(?:appreciate|a?waiting(?:\W*for)?)\W*your|request|urgent)\W*(?:answer|assist|PROPOSITION|reply|response)|(?:answer|assist|PROPOSITION|reply|response)\W*(?:needed|urgent))/i describe SARE_SUB_NEED_REPLY Spammer subject - black market or scam score SARE_SUB_NEED_REPLY 0.701 #ham SARE_SUB_NEED_REPLY verified (14) #hist SARE_SUB_NEED_REPLY Expanded by Bob Menschel, Sep 24 2004 #counts SARE_SUB_NEED_REPLY 395s/14h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_NEED_REPLY 14s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_NEED_REPLY 7s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_NEED_REPLY 11s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_NEED_REPLY 4s/1h of 11269 corpus (6578s/4691h CT) 06/11/05 header __SARE_SUB_WINNING_NOT Subject =~ /(?:(?:Final|WINNING)(?:.award)?\s*NOTIFICATION|^NOTIFICATION\s*$|(?:auction|lucky).winning|notification.of.(?:an.instant|bequest|intent|unclaimed|multi.?item|promotion|winning)|notification.{1,30}final.notice|contrat.{1,30}winning.{1,30}promotion)/i header __SARE_SUB_WINNING_R1 Received =~ /from .{4,15}\.paypal.com/ header __SARE_SUB_WINNING_M1 Message-Id =~ /\@paypal\.com/ meta SARE_SUB_WINNING_NOT __SARE_SUB_WINNING_NOT && !__SARE_SUB_WINNING_R1 && !__SARE_SUB_WINNING_M1 describe SARE_SUB_WINNING_NOT Spammer subject - black market or scam score SARE_SUB_WINNING_NOT 0.770 #ham SARE_SUB_WINNING_NOT eBay: Notification of an Instant Payment Received from [userid] #counts SARE_SUB_WINNING_NOT 657s/14h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_WINNING_NOT 15s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_WINNING_NOT 24s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_WINNING_NOT 21s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_WINNING_NOT 31s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_WINNING_NOT 2s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #counts SARE_SUB_WINNING_NOT 0s/3h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_WORTH_CASH Subject =~ /\b(?:Worth|Win|take|extra|earn|dollars|Short|need|claim|free|get|opinions?|surveys?)\b.{0,15}(?:fast)?(?:C[a\@]sh|M[0o]ney)\b/i describe SARE_SUB_WORTH_CASH Subject mentions something is worth cash score SARE_SUB_WORTH_CASH 0.884 #hist SARE_SUB_WORTH_CASH RM_spc_WorthCash #ham SARE_SUB_WORTH_CASH CasinoGames.com newsletter to subscriber #ham SARE_SUB_WORTH_CASH exchange between NPO and contributor #counts SARE_SUB_WORTH_CASH 171s/5h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_WORTH_CASH 9s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_WORTH_CASH 73s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04 #counts SARE_SUB_WORTH_CASH 201s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_WORTH_CASH 33s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #counts SARE_SUB_WORTH_CASH 0s/1h of 5906 corpus (1036s/4870h ft) 06/11/05 ######## ###################### ################################################## # Category: Credit, debt, lending, mortgage, borrowing, investment, financing ######## ###################### ################################################## header SARE_SUB_ACCEPT_CCARDS Subject =~ /(?!processing credit card)(?:(?:Accept(?:ing)?|Process.{0,20})\W*credit\W*c[aâ\@]rds?|credit\W*card\W*(chargebacks?|terminals?|vendor))/i describe SARE_SUB_ACCEPT_CCARDS Spammer subject - credit or money score SARE_SUB_ACCEPT_CCARDS 0.625 #ham SARE_SUB_ACCEPT_CCARDS verified (1) -- paypal upgrade confirmation #counts SARE_SUB_ACCEPT_CCARDS 16s/1h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_ACCEPT_CCARDS 19s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_ACCEPT_CCARDS 6s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_ACCEPT_CCARDS 12s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_ACCEPT_CCARDS 2s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_ACCEPT_CCARDS 4s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_ACCEPT_CCARDS 1s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 header SARE_SUB_FINAN_OBLIG Subject =~ /\b(?:financial|monetary) obligations/i describe SARE_SUB_FINAN_OBLIG Subject mentions financial obligations score SARE_SUB_FINAN_OBLIG 0.617 #counts SARE_SUB_FINAN_OBLIG 1s/0h of 291031 corpus (121442s/169589h RM) 04/22/05 #max SARE_SUB_FINAN_OBLIG 9s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_FINAN_OBLIG 2s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_FINAN_OBLIG 2s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_FINAN_OBLIG 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_FINAN_OBLIG 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_HIGH_RATES Subject =~ /\bhigh(?:er|est)?\b.{1,15}\brates\b/i describe SARE_SUB_HIGH_RATES subject has likely spammer phrase or word score SARE_SUB_HIGH_RATES 0.761 #hist SARE_SUB_HIGH_RATES From 88_FVGT_subject.cf FS_HIGH_RATES May 1 2004 #hist SARE_SUB_HIGH_RATES Jan 2005: Moved from archive back to file 1 #hist SARE_SUB_HIGH_RATES Added bounds to avoid ham: Highway 61 Celebrates #counts SARE_SUB_HIGH_RATES 29s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_HIGH_RATES 6s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_HIGH_RATES 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_HIGH_RATES 1s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_MORTGAGE Subject =~ /(?:(?:\%|2nd|best|competitive|easy|EZ|fixed|for\W*your|great|home|instant|loans\W*and|lowest|\bno|online|rate|second)..?mortgage|mortgages?\W*(?:broker|gone|hunt|interest|lead|loan|notif(?:ication|y)|quote|r.?[a\@].?t.?e.?s?|refinanc(?:e|ing)|shopping|too\W*high|verification)|mortgage.{1,30}reduced|(?:\$\d|compete|find|pay(ing|ment)|qualify|search|shopping).{1,30}mortgage)/i describe SARE_SUB_MORTGAGE Spammer subject - credit or money score SARE_SUB_MORTGAGE 0.863 #hist SARE_SUB_MORTGAGE removed "mortgage manager", used in email from user's bank #ham SARE_SUB_MORTGAGE Mortgage Rates #counts SARE_SUB_MORTGAGE 222s/3h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_MORTGAGE 152s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_MORTGAGE 17s/3h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_MORTGAGE 31s/3h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_MORTGAGE 12s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_MORTGAGE 1s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_OTC Subject =~ /^OTC:[A-Z]{4}/ describe SARE_SUB_OTC Appears to be OTC stock market spam score SARE_SUB_OTC 1.006 #hist SARE_SUB_OTC Created by Bob Menschel, April 15 2005 #counts SARE_SUB_OTC 14s/0h of 280895 corpus (109565s/171330h RM) 05/03/05 #max SARE_SUB_OTC 17s/0h of 291031 corpus (121442s/169589h RM) 04/22/05 #counts SARE_SUB_OTC 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_OTC 64s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_OTC 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 header SARE_SUB_POOR_CREDIT Subject =~ /(?!credit card (?:bill|declined))(?:(?:bad|poor|less\W*than\W*perfect|fix\W*your)\W*cr[eé]d[iï]t|cr[eé]d[iï]t.{1,20}declined|declined.{1,20}cr[eé]d[iï]t|cr[eé]d[iï]t\W*(?:bad|can\W*be\W*fix|card\W*(?:balances?|bills?|debt|elimination)|Counseling|profiles?|rating)|no\W*cr[eé]d[iï]t.check)/i describe SARE_SUB_POOR_CREDIT Spammer subject - credit or money score SARE_SUB_POOR_CREDIT 0.787 #ham SARE_SUB_POOR_CREDIT SFO credit rating upgraded from "negative" to "stable", January 31, 2005, in the San Francisco Examiner #counts SARE_SUB_POOR_CREDIT 114s/4h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_POOR_CREDIT 358s/0h of 113393 corpus (92421s/20972h RM) 04/18/04 #counts SARE_SUB_POOR_CREDIT 9s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_POOR_CREDIT 26s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_POOR_CREDIT 68s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_POOR_CREDIT 17s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_REFINANCE Subject =~ /re-?finance/i describe SARE_SUB_REFINANCE Spammer subject - credit or money score SARE_SUB_REFINANCE 1.418 #counts SARE_SUB_REFINANCE 369s/2h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_REFINANCE 566s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_REFINANCE 205s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_REFINANCE 26s/1h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_REFINANCE 41s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_REFINANCE 21s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 ######## ###################### ################################################## # Category: Gambling, Lotto, Sweepstakes, Winnings, Losses ######## ###################### ################################################## ######## ###################### ################################################## # Category: Insurance ######## ###################### ################################################## header __SARE_SUB_INSURANCE Subject =~ /(?:(?:aff[o0]rdable|cheap(?:est)?|free|good\W*news|l[o0]w\W*c[o0]st|(?:over)?pay(?:ing)?\W*t[o0][o0]\W*much|reduce|save|sell).{1,30}insurance|insurance.{1,30}(?:available|everyone|f[o0]r\W*less|leads|[o0]ffers|[o0]pti[o0]ns?|qu[o0]tes?)|(?:FYI:?|new|special|sub|update(?:\W*sub)?)\W*construction\W*insurance|new\W*insurnace\W*product)/i meta SARE_SUB_INSURANCE __SARE_SUB_INSURANCE && !SARE_SUB_CAR_INSURANCE describe SARE_SUB_INSURANCE Spammer subject - insurance score SARE_SUB_INSURANCE 0.897 #ham SARE_SUB_INSURANCE adv in subcribed opt-in newsletter (1, same ham as SARE_SUB_CAR_INSURANCE) #hist SARE_SUB_INSURANCE Converted to meta to avoid overlap with SARE_SUB_CAR_INSURANCE, Apr 22 2005 #note SARE_SUB_INSURANCE "insurance coverage" hits too much ham #note SARE_SUB_INSURANCE "term life" covered by SARE_SUB_TERM_LIFE #counts SARE_SUB_INSURANCE 76s/1h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_INSURANCE 511s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_INSURANCE 2s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_INSURANCE 31s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_INSURANCE 41s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_INSURANCE 59s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_INSURANCE 4s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_PROTECT_FAM Subject =~ /(?:Protect\W*your\W*famil(?:y|ies)|protect(?:ion)?(?:\W*for)?\W*your\W*(?:vehicle|car)|secure\W*your\W*future|protect.{1,10}from.{1,10}repair\W*bills?|extended\W*warranty\W*protection)/i describe SARE_SUB_PROTECT_FAM Spammer subject - insurance score SARE_SUB_PROTECT_FAM 1.100 #ham SARE_SUB_PROTECT_FAM verified (1) #counts SARE_SUB_PROTECT_FAM 32s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_PROTECT_FAM 93s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_PROTECT_FAM 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_PROTECT_FAM 6s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_PROTECT_FAM 63s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_PROTECT_FAM 3s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_REPAIR_BILLS Subject =~ /(?:large\W*repair\W*bills|(?:(?:costly|major)\W*auto|m[o0]ney\W*for|pay(?:ing)?\W*for|save\b.{1,30}\bon)\W*repairs?)/i describe SARE_SUB_REPAIR_BILLS Spammer subject - insurance score SARE_SUB_REPAIR_BILLS 0.950 #hist SARE_SUB_REPAIR_BILLS Created by Bob Menschel Mar 22 2004 #counts SARE_SUB_REPAIR_BILLS 0s/0h of 196665 corpus (96196s/100469h RM) 02/21/05 #max SARE_SUB_REPAIR_BILLS 58s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_REPAIR_BILLS 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_REPAIR_BILLS 8s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_REPAIR_BILLS 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_REPAIR_BILLS 4s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_REPAIR_BILLS 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Marketing, Pricing, Selling, Buying ######## ###################### ################################################## header SARE_SUB_ANIM_LOGO Subject =~ /(?!flash.*dimage)(?:(?:Animated|custom|flash|high[- ]impact|impressive|special|unique).{1,15}(?:image|Logo)|Logo Animation)/i describe SARE_SUB_ANIM_LOGO Common spammer subject score SARE_SUB_ANIM_LOGO 0.714 #hist SARE_SUB_ANIM_LOGO RM_spc_AnimatedLogo #hist SARE_SUB_ANIM_LOGO June 1 2004: Added some additional test words #ham SARE_SUB_ANIM_LOGO From shirt company: Special Offer: Logo Polos Just $9.95 With Your Embroidered Logo! #counts SARE_SUB_ANIM_LOGO 40s/1h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_ANIM_LOGO 6s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_ANIM_LOGO 7s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_ANIM_LOGO 2s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_ANIM_LOGO 2s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_HOT_PROFITS Subject =~ /Hot Profits/i describe SARE_SUB_HOT_PROFITS Subject contains apparent spammer phrasing score SARE_SUB_HOT_PROFITS 0.389 #hist SARE_SUB_HOT_PROFITS Created by Bob Menschel May 31 2004 #counts SARE_SUB_HOT_PROFITS 0s/0h of 291031 corpus (121442s/169589h RM) 04/22/05 #max SARE_SUB_HOT_PROFITS 3s/0h of 58648 corpus (33783s/24865h RM) 08/03/04 #counts SARE_SUB_HOT_PROFITS 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_HOT_PROFITS 2s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_HOT_PROFITS 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_HOT_PROFITS 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_HOT_PROFITS 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_HOT_PROFITS 1s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_INCOME Subject =~ /(?:incredible income|income opportunity)/i describe SARE_SUB_INCOME Subject contains common spammer phrasing score SARE_SUB_INCOME 0.500 #hist SARE_SUB_INCOME RM_spc_income #counts SARE_SUB_INCOME 0s/0h of 196665 corpus (96196s/100469h RM) 02/21/05 #max SARE_SUB_INCOME 3s/0h of 115925 corpus (94616s/21309h RM) 05/01/04 #counts SARE_SUB_INCOME 0s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_INCOME 6s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_INCOME 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Medical ######## ###################### ################################################## header SARE_SUB_AGING_OB Subject =~ /(?!Age?ing)(?!arguing)(?!A going)\b(?:A.?g.?i.?n.?g|(?:[a4]|(?:[\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0))[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[g6]|\xC4[\x9C-\xA3]])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[g6]\b|(?:\xC4[\x9C-\xA3])))\b/i describe SARE_SUB_AGING_OB subject has obfuscated spammer topic score SARE_SUB_AGING_OB 1.666 #stype SARE_SUB_AGING_OB obfu #hist SARE_SUB_AGING_OB Feb 2005: Added exlcusion for misspelling seen only in ham at this time #hist SARE_SUB_AGING_OB Added another exclusion #counts SARE_SUB_AGING_OB 0s/0h of 280895 corpus (109565s/171330h RM) 05/03/05 #max SARE_SUB_AGING_OB 1s/0h of 69717 corpus (42681s/27036h RM) 09/26/04 #counts SARE_SUB_AGING_OB 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_AGING_OB 1s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_AGING_OB 0s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_AGING_OB 0s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_AGING_OB 1s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_FREE_SAMPLE Subject =~ /\bf.?r.?e.?e.?\s+s.?a.?m.?p.?l.?e/i describe SARE_SUB_FREE_SAMPLE Common spammer subject header -- Medical score SARE_SUB_FREE_SAMPLE 0.633 #hist SARE_SUB_FREE_SAMPLE Created by Bob Menschel Aug 20 2004 #counts SARE_SUB_FREE_SAMPLE 11s/1h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_FREE_SAMPLE 20s/1h of 291031 corpus (121442s/169589h RM) 04/22/05 #counts SARE_SUB_FREE_SAMPLE 1s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #max SARE_SUB_FREE_SAMPLE 10s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04 #counts SARE_SUB_FREE_SAMPLE 12s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_FREE_SAMPLE 13s/0h of 31513 corpus (27912s/3601h MY) 03/09/05 #counts SARE_SUB_FREE_SAMPLE 4s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_IMPROVE Subject =~ /(?:improve|maximize).{1,30}(?:cell\W*phone|cholesterol|credit|desire|English|hair|health|home|kisser|love\W*life|memory|performance|possibilities|self\W*image|sex(?:\W*life|ual\W*(?:endurance|health))|signal|sleep|stamina|stock\W*market|vision)/i describe SARE_SUB_IMPROVE Spammer subject - medical score SARE_SUB_IMPROVE 0.701 #ham SARE_SUB_IMPROVE tech list: Improve sleep code of (software module), newspaper headline #counts SARE_SUB_IMPROVE 65s/3h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_IMPROVE 165s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_IMPROVE 7s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_IMPROVE 16s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_IMPROVE 24s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_IMPROVE 38s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_IMPROVE 9s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_MEDS Subject =~ /(?:meds (?:che[a\@]p|fr[o0]m C[a\@]n[a\@]d[a\@]|[o0]n[l1|][i1|]ne|[o0]n the net|sh[i1|]p|.*(?:[a\@]ppr[o0]ved|che[a\@]p|c[o0]st|de[a\@][l1|]|de[l1|][i1|]ver|d[i1|]screet|d[i1|]sc[o0]unt|expens[i1|]ve|f[a\@]st|f[i1|]nd|f[i1|]ngert[i1|]ps|get|gre[a\@]t|[i1\|]nternet|[l1|][o0][o0]k[i1|]ng|[l1|][o0]w.*(?:c[o0]st|pr[i1|]ce)|need|[o0]bt[a\@][i1|]n|[o0]n[l1|][i1|]ne|[o0]rder|[o0]vern[i1|]ght|percent|p[o0]pu[l1|][a\@]r|purch[a\@]se|qu[i1|]ck|rx|s[a\@]v(?:e|ing)|se[l1|]ecti[o0]n|ship|s[o0][l1|]d|s[o0]urce|speci[a\@][l1|]|v[a\@][l1|]ue|wh[o0][l1|]es[a\@][l1|]e))|(?:[a\@]ppr[o0]ved|che[a\@]p|c[o0]st|de[a\@][l1|]|de[l1|]iver|discreet|disc[o0]unt|expensive|f[a\@]st|find|fingertips|get|gre[a\@]t|[i1\|]nternet|[l1|][o0][o0]k[i1|]ng|[l1|][o0]w.*(?:c[o0]st|pr[i1|]ce)|need|[o0]bt[a\@][i1|]n|[o0]n[l1|][i1|]ne|[o0]rder|[o0]vern[i1|]ght|percent|p[o0]pu[l1|][a\@]r|purch[a\@]se|qu[i1|]ck|rx|s[a\@]v(?:e|[i1|]ng)|se[l1|]ect[i1|][o0]n|sh[i1|]p|s[o0][l1|]d|s[o0]urce|spec[i1|][a\@][l1|]|v[a\@][l1|]ue|wh[o0][l1|]es[a\@][l1|]e).*meds|e-meds)/i describe SARE_SUB_MEDS Common spammer subject header -- Medical score SARE_SUB_MEDS 1.666 #ham SARE_SUB_MEDS verified (1) #hist SARE_SUB_MEDS Created by Bob Menschel Jan 22 2005 #counts SARE_SUB_MEDS 195s/1h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_MEDS 867s/1h of 117867 corpus (81073s/36794h RM) 01/23/05 #counts SARE_SUB_MEDS 117s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_MEDS 136s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_MEDS 35s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_MEDS 51s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_MEDS 266s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_MEDS 302s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 header SARE_SUB_PENIS Subject =~ /\bpenis\b/i describe SARE_SUB_PENIS subject has likely spammer phrase or word score SARE_SUB_PENIS 1.666 #ham SARE_SUB_PENIS confirmed (1), questionable (1) #counts SARE_SUB_PENIS 340s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_PENIS 44s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_PENIS 1s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_PENIS 30s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_PENIS 11s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_PENIS 16s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_SMART_PRICE Subject =~ /(?:best|Smart|specials?).?(?:Prices|prcies)/i describe SARE_SUB_SMART_PRICE Common spammer subject header -- Medical score SARE_SUB_SMART_PRICE 0.622 #hist SARE_SUB_SMART_PRICE Created by Bob Menschel Apr 09 2004 #hist SARE_SUB_SMART_PRICE Added special prices and "prcies" Apr 28 2004 #hist SARE_SUB_SMART_PRICE Added "best" prices Jan 22 2005 #counts SARE_SUB_SMART_PRICE 46s/7h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_SMART_PRICE 217s/0h of 117867 corpus (81073s/36794h RM) 01/23/05 #counts SARE_SUB_SMART_PRICE 10s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_SMART_PRICE 53s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04 #counts SARE_SUB_SMART_PRICE 35s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_SMART_PRICE 5s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_SMART_PRICE 10s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_WEIGHTLOSS Subject =~ /weightloss/i describe SARE_SUB_WEIGHTLOSS mentions weight loss as one word score SARE_SUB_WEIGHTLOSS 0.617 #hist SARE_SUB_WEIGHTLOSS RM_swm_weightloss #v300 SARE_SUB_WEIGHTLOSS adds to 3.0 body rule DIET_1 #counts SARE_SUB_WEIGHTLOSS 4s/1h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_WEIGHTLOSS 1721s/1h of 69717 corpus (42681s/27036h RM) 09/26/04 #counts SARE_SUB_WEIGHTLOSS 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_WEIGHTLOSS 68s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_WEIGHTLOSS 18s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_WEIGHTLOSS 144s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04 #counts SARE_SUB_WEIGHTLOSS 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_YOUNGER Subject =~ /\bYOUNGER\b/i describe SARE_SUB_YOUNGER Spammer subject - medical score SARE_SUB_YOUNGER 0.894 #ham SARE_SUB_YOUNGER confirmed (5) #counts SARE_SUB_YOUNGER 27s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_YOUNGER 190s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_YOUNGER 5s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_YOUNGER 10s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_YOUNGER 29s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_YOUNGER 54s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_YOUNGER 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Politial ######## ###################### ################################################## header SARE_SUB_EMILYS_LIST Subject =~ /EMILY's LIst/i describe SARE_SUB_EMILYS_LIST Political spammer score SARE_SUB_EMILYS_LIST 0.555 #stype SARE_SUB_EMILYS_LIST spamp #hist SARE_SUB_EMILYS_LIST Created by Bob Menschel Oct 01 2004 #counts SARE_SUB_EMILYS_LIST 3s/0h of 291031 corpus (121442s/169589h RM) 04/22/05 #max SARE_SUB_EMILYS_LIST 6s/0h of 238420 corpus (112480s/125940h RM) 02/28/05 #counts SARE_SUB_EMILYS_LIST 0s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_EMILYS_LIST 0s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_EMILYS_LIST 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Real Estate ######## ###################### ################################################## header SARE_SUB_HOMEOWNER Subject =~ /homeowner/i describe SARE_SUB_HOMEOWNER Spammer subject - real estate score SARE_SUB_HOMEOWNER 0.686 #ham SARE_SUB_HOMEOWNER confirmed (2) #counts SARE_SUB_HOMEOWNER 94s/6h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_HOMEOWNER 115s/1h of 280895 corpus (109565s/171330h RM) 05/03/05 #counts SARE_SUB_HOMEOWNER 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_HOMEOWNER 12s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_HOMEOWNER 49s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_HOMEOWNER 20s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_TIMESHARE Subject =~ /timeshare/i describe SARE_SUB_TIMESHARE Spammer subject - real estate score SARE_SUB_TIMESHARE 0.861 #hist SARE_SUB_TIMESHARE Jan 2005: Moved from archive back to file 1 #counts SARE_SUB_TIMESHARE 25s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_TIMESHARE 30s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_TIMESHARE 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_TIMESHARE 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Software ######## ###################### ################################################## header SARE_SUB_CHEAP_SW Subject =~ /(?:(?:bargain|bucks|C.?h.?e.?a.?p|discount|expensive|p.?r.?i.?c.?e|s.?a.?v.?e|special\W*offer|spend).{1,30}software|s.?o.?f.?t.?w.?a.?r.?e.{1,30}(?:\%.off|at\W*only|bargain|bucks|c.?h.?e.?a.?p|deal|loww?.c.?o.?s.?t|price))/i describe SARE_SUB_CHEAP_SW Spammer subject - software score SARE_SUB_CHEAP_SW 1.666 #hist SARE_SUB_CHEAP_SW Created by Bob Menschel Apr 09 2004 #counts SARE_SUB_CHEAP_SW 488s/2h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_CHEAP_SW 527s/1h of 291031 corpus (121442s/169589h RM) 04/22/05 #max SARE_SUB_CHEAP_SW 797s/0h of 92315 corpus (67942s/24373h RM) 07/24/04 #counts SARE_SUB_CHEAP_SW 33s/1h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_CHEAP_SW 226s/1h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_CHEAP_SW 186s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_CHEAP_SW 221s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_CHEAP_SW 29s/1h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_SW_ON_CD Subject =~ /software\W*(?:on\W*)CD/i describe SARE_SUB_SW_ON_CD Spammer subject - software score SARE_SUB_SW_ON_CD 0.628 #hist SARE_SUB_SW_ON_CD Created by Bob Menschel Apr 09 2004 #counts SARE_SUB_SW_ON_CD 0s/0h of 196665 corpus (96196s/100469h RM) 02/21/05 #max SARE_SUB_SW_ON_CD 7s/0h of 92315 corpus (67942s/24373h RM) 07/24/04 #counts SARE_SUB_SW_ON_CD 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_SW_ON_CD 3s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_SW_ON_CD 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_SW_ON_CD 3s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_SW_ON_CD 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_SWTYPES Subject =~ /(?:hate\W*typing|it\W*types|never\W*type|no\W*typing\W*required|Talk\W*It\W*Type\W*It|voice\W*recognition)/i describe SARE_SUB_SWTYPES subject has a spammer subject - Software score SARE_SUB_SWTYPES 0.519 #note SARE_SUB_SWTYPES beware: "attachment type" in virus bounce subject headings. #counts SARE_SUB_SWTYPES 14s/2h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_SWTYPES 0s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_SWTYPES 6s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_SWTYPES 16s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_SWTYPES 6s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #counts SARE_SUB_SWTYPES 2s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_SYSTEMWORKS Subject =~ /(?:get|sav(?:e|ing)).{1,30}system\W*works/i describe SARE_SUB_SYSTEMWORKS subject has a spammer subject - Software score SARE_SUB_SYSTEMWORKS 0.728 #counts SARE_SUB_SYSTEMWORKS 0s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_SYSTEMWORKS 12s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_SYSTEMWORKS 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_SYSTEMWORKS 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_SYSTEMWORKS 18s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_SYSTEMWORKS 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_WP_OFFICE Subject =~ /(?:\%|Sav(?:e|ing)).{1,30}(?:Corel|WordPerfect).{1,30}Office/i describe SARE_SUB_WP_OFFICE Spammer subject - software score SARE_SUB_WP_OFFICE 0.777 #counts SARE_SUB_WP_OFFICE 0s/0h of 280564 corpus (109285s/171279h RM) 05/03/05 #max SARE_SUB_WP_OFFICE 22s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_WP_OFFICE 0s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_WP_OFFICE 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_WP_OFFICE 18s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_WP_OFFICE 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Spamming and Spammers ######## ###################### ################################################## header SARE_SUB_ADV_DB Subject =~ /(?:(?:Advertisers|comprehensive|webmaster) Database|(?:emails|Database) of.{0,20}(?:Advertisers|Business|bidders|ebay)|email *database)/i describe SARE_SUB_ADV_DB Common spammer subject score SARE_SUB_ADV_DB 1.111 #stype SARE_SUB_ADV_DB spamg #hist SARE_SUB_ADV_DB 04/01/04 -- added "webmaster database" option #hist SARE_SUB_ADV_DB 03/28/04 -- added "email database" option #hist SARE_SUB_ADV_DB 02/17/04 -- added ebay #hist SARE_SUB_ADV_DB 08/23/03 -- Created #counts SARE_SUB_ADV_DB 0s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_ADV_DB 9s/0h of 115925 corpus (94616s/21309h RM) 05/01/04 #counts SARE_SUB_ADV_DB 0s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_ADV_DB 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_ADV_DB 2s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_ADV_DB 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_BULK_EMAIL Subject =~ /(?:(?:junk|bulk)\W*(?:e\W*mail|fax\W*numbers)|fax\W*bulk\W*numbers)/i describe SARE_SUB_BULK_EMAIL Spammer subject - spamming score SARE_SUB_BULK_EMAIL 0.697 #ham SARE_SUB_BULK_EMAIL junk email discussion on non-spam mailing list. #counts SARE_SUB_BULK_EMAIL 175s/5h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_BULK_EMAIL 183s/8h of 281078 corpus (109729s/171349h RM) 05/05/05 #counts SARE_SUB_BULK_EMAIL 2s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_BULK_EMAIL 6s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_BULK_EMAIL 1s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_BULK_EMAIL 5s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_BULK_EMAIL 0s/1h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_HEAD_ORG_ELITEACT Organization =~ /Elite Activity/i describe SARE_HEAD_ORG_ELITEACT Spam sign in Organization header score SARE_HEAD_ORG_ELITEACT 0.111 #hist SARE_HEAD_ORG_ELITEACT Bob Menschel, Feb 27 2005 #counts SARE_HEAD_ORG_ELITEACT 2s/0h of 400644 corpus (178197s/222447h RM) 04/02/05 #counts SARE_HEAD_ORG_ELITEACT 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_HEAD_ORG_ELITEACT 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 header SARE_SUB_INET_CONN Subject =~ /(?:internet\W*connection\W*problem|(?:frequent|slow)\W*internet\W*connection)/i describe SARE_SUB_INET_CONN Spammer subject - spamming score SARE_SUB_INET_CONN 0.722 #counts SARE_SUB_INET_CONN 0s/0h of 56906 corpus (32313s/24593h RM) 07/25/04 #max SARE_SUB_INET_CONN 22s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_INET_CONN 2s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_INET_CONN 4s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_INET_CONN 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_INET_CONN 3s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_INET_CONN 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_INET_CONN 1s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Generic words and phrases ######## ###################### ################################################## header SARE_SUB_ALL_LEAD Subject =~ /^All\s/ # no /i describe SARE_SUB_ALL_LEAD Subject matches common spam pattern score SARE_SUB_ALL_LEAD 0.626 #hist SARE_SUB_ALL_LEAD LW_ALL_SUB, Aug 16 2004, Loren Wilton #counts SARE_SUB_ALL_LEAD 230s/19h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_ALL_LEAD 38s/2h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_ALL_LEAD 50s/2h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_ALL_LEAD 23s/2h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_ALL_LEAD 12s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_ALL_LEAD 18s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 header SARE_SUB_ATTRACT Subject =~ /^Attract the /i describe SARE_SUB_ATTRACT Subject matches common spam pattern score SARE_SUB_ATTRACT 0.878 #hist SARE_SUB_ATTRACT LW_ATTR_SUB, Aug 16 2004, Loren Wilton #overlap SARE_SUB_ATTRACT strong overlap with FREE_PORN, SEDUCTION #counts SARE_SUB_ATTRACT 0s/0h of 196667 corpus (96194s/100473h RM) 02/21/05 #max SARE_SUB_ATTRACT 50s/0h of 61007 corpus (36343s/24664h RM) 08/27/04 #counts SARE_SUB_ATTRACT 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_ATTRACT 6s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_ATTRACT 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_ATTRACT 2s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_ATTRACT 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_BOOST Subject =~ /(?:boost.{1,20}(?:(?:cable|PC).{1,10}speed|confidence|in\W*bed|(?:love|se.?x)\W*life|mileage|size|stamina)|(?:manhood|muscle|sex|super).{0,30}boost)/i describe SARE_SUB_BOOST subject has likely spammer phrase or word score SARE_SUB_BOOST 1.666 #counts SARE_SUB_BOOST 24s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_BOOST 244s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_BOOST 6s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_BOOST 17s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_BOOST 4s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_BOOST 17s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_BOOST 3s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_CONFIDENTIAL Subject =~ /(?:confidential.+\b(?:assist|assured|brand|business|delivery|discreet|embarrass|info|med(?:icine)?|offer|opportunity|orders|prescription|shopping|stock)|(?:assistance|business|mutual|priv(?:at)?e|relationship|strict?ly|urgent).+confiden[tc]ial|\bconfidant\b|can i confide|Fwd: Confidential)/i describe SARE_SUB_CONFIDENTIAL subject has likely spammer phrase or word score SARE_SUB_CONFIDENTIAL 1.100 #hist SARE_SUB_CONFIDENTIAL SARE_SUB_CONFID_P and SARE_SUB_CONF_INFO merged and renamed July 24 2004 #ham SARE_SUB_CONFIDENTIAL organization's emails flagged: "- confidential" #counts SARE_SUB_CONFIDENTIAL 92s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_CONFIDENTIAL 107s/1h of 280895 corpus (109565s/171330h RM) 05/03/05 #counts SARE_SUB_CONFIDENTIAL 2s/1h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_CONFIDENTIAL 8s/1h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_CONFIDENTIAL 2s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_CONFIDENTIAL 3s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_CONFIDENTIAL 1s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_CONFIDENTIAL 1s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_CONFID_OB Subject =~ /(?!confidential)(?:c.?o.?n.?f.?i.?d.?e.?n.?t.?i.?a.?l|(?:[c\*\xC7\xE7\xA2\xA9]|\xC4[\x86-\x8D]|\xD0\xA1|\xD1\x81)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:f|\xC5\xBF|\xC6\x92|\xD2[\x92-\x93]])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[d\xD0]|\xC4[\x8E-\x91])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|\xC5[\xA2-\xA7]|\xCE\xA4|\xCF\x84|\xD0\xA2|\xD1\x82)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[l1I\|\xA3]|(?:\xC5[\x80-\x82]|\xC4[\xB9-\xBF])))/i describe SARE_SUB_CONFID_OB subject has obfuscated spammer topic score SARE_SUB_CONFID_OB 1.666 #ham SARE_SUB_CONFID_OB space accidentally inserted into word #hist SARE_SUB_CONFID_OB Jan 2005: Moved from file 2 back to file 1 #counts SARE_SUB_CONFID_OB 0s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_CONFID_OB 2s/0h of 91714 corpus (74113s/17601h RM) 01/23/04 #counts SARE_SUB_CONFID_OB 0s/0h of 16895 corpus (14482s/2413h MY) 07/26/04 #counts SARE_SUB_CONFID_OB 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_CONFID_OB 3s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_CONFID_OB 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_FOR_OB Subject =~ /(?!For)\bf[\W_]?(?:\[\]|\(\)|[o0\*\xD2-\xD6\xF2-\xF6])[\W_]?[r\xAE]\b/i describe SARE_SUB_FOR_OB subject has obfuscated spammer topic score SARE_SUB_FOR_OB 1.666 #stype SARE_SUB_FOR_OB obfu #ham SARE_SUB_FOR_OB typo ("xxxx fo r xxxx") #counts SARE_SUB_FOR_OB 18s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_FOR_OB 52s/1h of 291031 corpus (121442s/169589h RM) 04/22/05 #counts SARE_SUB_FOR_OB 7s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_FOR_OB 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_FOR_OB 13s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_FOR_OB 14s/2h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_FOR_OB 15s/2h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_FOREVER Subject =~ /for\W*?ever\b/i describe SARE_SUB_FOREVER subject has likely spammer phrase or word score SARE_SUB_FOREVER 0.286 #counts SARE_SUB_FOREVER 36s/10h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_FOREVER 98s/0h of 96861 corpus (75465s/21396h) 05/08/04 #counts SARE_SUB_FOREVER 50s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_FOREVER 15s/10h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_FOREVER 7s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_FOREVER 8s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_GOOD_DAY Subject =~ /\bgood day\b/i describe SARE_SUB_GOOD_DAY Contains spammer phrasing score SARE_SUB_GOOD_DAY 0.758 #ham SARE_SUB_GOOD_DAY Today Is Not a Good Day for War, from Nuclear Age Peace Foundation #hist SARE_SUB_GOOD_DAY Created by Bob Menschel Aug 29 2004 #counts SARE_SUB_GOOD_DAY 270s/7h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_GOOD_DAY 8s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_GOOD_DAY 13s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_GOOD_DAY 10s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_GOOD_DAY 10s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_GOOD_DAY 2s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_GOOD_DAY 1s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_LET Subject =~ /^Let (?:us|your|the banks?) /i describe SARE_SUB_LET Subject matches common spam pattern score SARE_SUB_LET 0.782 #ham SARE_SUB_LET Let your headings reset numbers (web page creation instruction) #hist SARE_SUB_LET LW_LET_SUB, Aug 16 2004, Loren Wilton #counts SARE_SUB_LET 87s/3h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_LET 27s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_LET 33s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_LET 15s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #counts SARE_SUB_LET 1s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_LIKE_YOU Subject =~ /(?:(?:singles(?: just)?|(?:looking(?: for)?|(?:need|surprise)) someone|who might) like you|like you (?:have )?never seen)/i describe SARE_SUB_LIKE_YOU subject has likely spammer phrase or word score SARE_SUB_LIKE_YOU 0.639 #counts SARE_SUB_LIKE_YOU 3s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_LIKE_YOU 8s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_LIKE_YOU 3s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_LIKE_YOU 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_LIKE_YOU 2s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_LIKE_YOU 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_MINUTES Subject =~ /\d.?minutes/i describe SARE_SUB_MINUTES subject has likely spammer phrase or word score SARE_SUB_MINUTES 0.616 #ham SARE_SUB_MINUTES confirmed #counts SARE_SUB_MINUTES 219s/25h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_MINUTES 278s/19h of 291031 corpus (121442s/169589h RM) 04/22/05 #counts SARE_SUB_MINUTES 66s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_MINUTES 80s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_MINUTES 50s/2h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_MINUTES 23s/2h of 11269 corpus (6578s/4691h CT) 06/11/05 #counts SARE_SUB_MINUTES 1s/3h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_SEXY Subject =~ /\bsexy\b/i describe SARE_SUB_SEXY subject has likely spammer phrase or word score SARE_SUB_SEXY 0.617 #counts SARE_SUB_SEXY 119s/12h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_SEXY 11s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_SEXY 15s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_SEXY 22s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_SEXY 2s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 #counts SARE_SUB_SEXY 10s/1h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 header SARE_SUB_MONEY Subject =~ /(?:(?:)(?:save|make)[ -].{0,30}money[ -](?:in|on|with)|(?:easy|free|grant|saving|with our|worth|(?:claim|keep) your) money|money machine|(?:money|earn).+secret|secret.+(?:money|earn))/i describe SARE_SUB_MONEY subject has likely spammer phrase or word score SARE_SUB_MONEY 0.293 #ham SARE_SUB_MONEY business email #hist SARE_SUB_MONEY Bob Menschel added some alternatives, Aug 28 2004, Sep 28 #counts SARE_SUB_MONEY 76s/31h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_MONEY 87s/6h of 238420 corpus (112480s/125940h RM) 02/28/05 #counts SARE_SUB_MONEY 63s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_MONEY 21s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_MONEY 9s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #counts SARE_SUB_MONEY 0s/1h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_NO Subject =~ /^no (?:appoint|more |need|pres|prior|stress home)/i describe SARE_SUB_NO Subject matches common spam pattern score SARE_SUB_NO 0.761 #hist SARE_SUB_NO LW_NO_SUB, Aug 16 2004, Loren Wilton #counts SARE_SUB_NO 106s/10h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_NO 224s/5h of 283414 corpus (129902s/153512h RM) 03/08/05 #counts SARE_SUB_NO 192s/0h of 238420 corpus (112480s/125940h RM) 02/28/05 #max SARE_SUB_NO 236s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_NO 43s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_NO 61s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_NO 46s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_NO 58s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_NO 19s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_NO 35s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_NO 1s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_NOW_TIME Subject =~ /Now is the time/i describe SARE_SUB_NOW_TIME common spammer phrasing score SARE_SUB_NOW_TIME 0.481 #ham SARE_SUB_NOW_TIME confirmed (1) #hist SARE_SUB_NOW_TIME Created by Bob Menschel Nov 13 2004 #counts SARE_SUB_NOW_TIME 10s/2h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_NOW_TIME 22s/1h of 281078 corpus (109729s/171349h RM) 05/05/05 #counts SARE_SUB_NOW_TIME 4s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_NOW_TIME 6s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_NOW_TIME 12s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_NOW_TIME 14s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_NOW_TIME 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_PERS_KNOW Subject =~ /Person you know/i describe SARE_SUB_PERS_KNOW common spammer phrasing score SARE_SUB_PERS_KNOW 0.711 #hist SARE_SUB_PERS_KNOW Created by Bob Menschel Oct 25 2004 #counts SARE_SUB_PERS_KNOW 0s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_PERS_KNOW 20s/0h of 196667 corpus (96194s/100473h RM) 02/21/05 #counts SARE_SUB_PERS_KNOW 4s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_PERS_KNOW 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_PERS_KNOW 2s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_PERS_KNOW 1s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_PERS_KNOW 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_PROVEN Subject =~ /\bproven\b/i describe SARE_SUB_PROVEN subject has likely spammer phrase or word score SARE_SUB_PROVEN 0.619 #ham SARE_SUB_PROVEN confirmed (2) #counts SARE_SUB_PROVEN 61s/8h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_PROVEN 117s/8h of 280895 corpus (109565s/171330h RM) 05/03/05 #counts SARE_SUB_PROVEN 9s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_PROVEN 20s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_PROVEN 26s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_PROVEN 30s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_PROVEN 6s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_PROVEN 8s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_WHILE_U_CAN Subject =~ /While (?:U|You) Can/i describe SARE_SUB_WHILE_U_CAN Subject contains apparent spammer phrasing score SARE_SUB_WHILE_U_CAN 0.500 #ham SARE_SUB_WHILE_U_CAN verified (1) #hist SARE_SUB_WHILE_U_CAN Created by Bob Menschel Sep 4 2004 #counts SARE_SUB_WHILE_U_CAN 3s/1h of 271461 corpus (129860s/141601h RM) 06/12/05 #counts SARE_SUB_WHILE_U_CAN 4s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_WHILE_U_CAN 12s/0h of 115424 corpus (81069s/34355h RM) 01/16/05 #counts SARE_SUB_WHILE_U_CAN 0s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_WHILE_U_CAN 1s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_WHILE_U_CAN 11s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_WHILE_U_CAN 23s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_WHILE_U_CAN 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_YOUR_LISTING Subject =~ /^\s*your listing (?:at|on) /i describe SARE_SUB_YOUR_LISTING subject has a spammer subject - Listings score SARE_SUB_YOUR_LISTING 0.617 #hist SARE_SUB_YOUR_LISTING Created by Bob Menschel Jul 31 2004 #counts SARE_SUB_YOUR_LISTING 0s/0h of 238420 corpus (112480s/125940h RM) 02/28/05 #max SARE_SUB_YOUR_LISTING 10s/0h of 114228 corpus (81069s/33159h RM) 01/15/05 #counts SARE_SUB_YOUR_LISTING 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_YOUR_LISTING 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_YOUR_LISTING 0s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_YOUR_LISTING 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Technical spamsign ######## ###################### ################################################## header SARE_SUB_2PIPES Subject =~ /\|\|/i describe SARE_SUB_2PIPES Subject contains unlikely character string score SARE_SUB_2PIPES 0.612 #stype SARE_SUB_2PIPES spamg #ham SARE_SUB_2PIPES confirmed (1) #hist SARE_SUB_2PIPES Created by Bob Menschel Jul 27 2004 #counts SARE_SUB_2PIPES 20s/5h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_2PIPES 70s/5h of 291031 corpus (121442s/169589h RM) 04/22/05 #counts SARE_SUB_2PIPES 16s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_2PIPES 5s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_2PIPES 15s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_2PIPES 20s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_2PIPES 33s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_CASH_CHAR Subject =~ /[a-zA-Z]\$[a-zA-Z]/ describe SARE_SUB_CASH_CHAR Subject has letter then $ then letter score SARE_SUB_CASH_CHAR 1.323 #ham SARE_SUB_CASH_CHAR WAR$HEEP #counts SARE_SUB_CASH_CHAR 732s/5h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_CASH_CHAR 1034s/3h of 283414 corpus (129902s/153512h RM) 03/08/05 #counts SARE_SUB_CASH_CHAR 49s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_CASH_CHAR 1s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_CASH_CHAR 20s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_CASH_CHAR 47s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_DASH_ONLY Subject =~ /^\s*-\s*$/ describe SARE_SUB_DASH_ONLY one non-alphanum in subject; no words score SARE_SUB_DASH_ONLY 2.500 #stype SARE_SUB_DASH_ONLY spamg #hist SARE_SUB_DASH_ONLY Created by Bob Menschel May 31 2004 #counts SARE_SUB_DASH_ONLY 14s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_DASH_ONLY 19s/0h of 67058 corpus (41838s/25220h RM) 09/04/04 #counts SARE_SUB_DASH_ONLY 6s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_DASH_ONLY 0s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_DASH_ONLY 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_DDCC Subject =~ /^\d\d\s+-\s+[A-Z]{2}\s/ describe SARE_SUB_DDCC subject has obvious spamsign score SARE_SUB_DDCC 1.111 #stype SARE_SUB_DDCC spamp #hist SARE_SUB_DDCC Created by Bob Menschel Aug 12 2004 #counts SARE_SUB_DDCC 0s/0h of 196667 corpus (96194s/100473h RM) 02/21/05 #max SARE_SUB_DDCC 41s/0h of 69842 corpus (42682s/27160h RM) 09/26/04 #counts SARE_SUB_DDCC 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_DDCC 8s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_DDCC 0s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_DDCC 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_DOLLARS Subject =~ /^\s*(?:\w+ )?(?:\w+: )?\$\d+\s*$/ describe SARE_SUB_DOLLARS Short dollar amount subject score SARE_SUB_DOLLARS 4.000 #stype SARE_SUB_DOLLARS spamg #hist SARE_SUB_DOLLARS Created by Bob Menschel Jul 17 2004 #hist SARE_SUB_DOLLARS Added optional Make to front of string Jul 19 2004 #hist SARE_SUB_DOLLARS Added optional Account: to front of string Aug 1 2004 #hist SARE_SUB_DOLLARS Generalized to 0/1/2 words Aug 10 2004 #hist SARE_SUB_DOLLARS Bugzilla submission 3645, Jul 28 2004 #counts SARE_SUB_DOLLARS 1s/2h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_DOLLARS 1503s/0h of 70699 corpus (43133s/27566h RM) 10/02/04 #counts SARE_SUB_DOLLARS 36s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_DOLLARS 75s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_DOLLARS 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_DOLLARS 65s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_DOLLARS 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_MCFWD Subject =~ /FwD:/ describe SARE_SUB_MCFWD apparent spam/virus sign in subject score SARE_SUB_MCFWD 1.111 #stype SARE_SUB_MCFWD spamp #hist SARE_SUB_MCFWD Created by Bob Menschel May 27 2004 #counts SARE_SUB_MCFWD 5s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_MCFWD 10s/0h of 92315 corpus (67942s/24373h RM) 07/24/04 #counts SARE_SUB_MCFWD 1s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_MCFWD 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_MCFWD 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_PCT_LETTER Subject =~ /%[A-Z]\b/i describe SARE_SUB_PCT_LETTER subject has random-text spamsign score SARE_SUB_PCT_LETTER 1.152 #hist SARE_SUB_PCT_LETTER Feb 2005: added bound, forcing match to solo letter. #counts SARE_SUB_PCT_LETTER 282s/2h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_PCT_LETTER 651s/0h of 238420 corpus (112480s/125940h RM) 02/28/05 #counts SARE_SUB_PCT_LETTER 1s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_PCT_LETTER 43s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_PCT_LETTER 9s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_PCT_LETTER 69s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_PCT_LETTER 30s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 # EOF # SARE "General Subject" Ruleset for SpamAssassin - File 2 # Version: 01.03.09 # Created: 2004-09-13 # Modified: 2005-06-13 # Usage instructions and documentation are found in 70_sare_genlsubj0.cf #@@# Revision History: Full Revision History stored in 70_sare_genlsubj.log #@@# 01.03.09: June 13 2005 #@@# Minor score updates based on additional mass-check #@@# Moved file 0 to file 2: SARE_SUB_LOSE_PCT1 and SARE_SUB_LOSE_PCT2 ######## ###################### ################################################## # Category: __rules used by primary rules below ######## ###################### ################################################## # Attempt to identify simple subject obfuscation by character insertion header __SARE_SUB_OBFU_ASTER Subject =~ /[a-zA-Z0]\*[a-zA-Z]/ header __SARE_SUB_OBFU_CARAT Subject =~ /[a-zA-Z0]\^[a-zA-Z]/ header __SARE_SUB_OBFU_COLON Subject =~ /[a-zA-Z0]:[a-zA-Z]/ header __SARE_SUB_OBFU_COMMA Subject =~ /[a-zA-Z0],[a-zA-Z]/ header __SARE_SUB_OBFU_SLASH Subject =~ /[a-zA-Z0]\/[a-zA-Z]/ header __SARE_SUB_OBFU_LQUOT Subject =~ /[a-zA-Z0]`[a-zA-Z]/ header __SARE_SUB_OBFU_PERIOD Subject =~ /[a-zA-Z0]\.[a-zA-Z]/ header __SARE_SUB_OBFU_2PER Subject =~ /[a-zA-Z0]\.\.[a-zA-Z]/ header __SARE_SUB_OBFU_PIPE Subject =~ /[a-zA-Z0]\|[a-zA-Z]/ header __SARE_SUB_OBFU_PLUS Subject =~ /[a-zA-Z0]\+[a-zA-Z]/ header __SARE_SUB_OBFU_QUOTE Subject =~ /[a-zA-Z0]"[a-zA-Z]/ header __SARE_SUB_OBFU_SCOLON Subject =~ /[a-zA-Z0];[a-zA-Z]/ header __SARE_SUB_OBFU_USCORE Subject =~ /[a-zA-Z0]_[a-zA-Z]/ header __SARE_SUB_OBFU_HTTP Subject =~ m*http://*i ######## ###################### ################################################## # Rule definitions to avoid --lint errors on archived/moved rules. ######## ###################### ################################################## meta SARE_SUB_CARTRIDGE_OB 0 meta SARE_SUB_EXCL_OB 0 meta SARE_SUB_GAPPY_7 0 meta SARE_SUB_GAPPY_8 0 meta SARE_SUB_PASSION_OB 0 meta SARE_SUB_PRINTER_OB 0 meta SARE_SUB_PROVEN_OB 0 meta SARE_SUB_TONER_OB 0 ######## ###################### ################################################## # Category: Credit, debt, lending, mortgage, borrowing, investment, financing ######## ###################### ################################################## #@@# Moved file 3 to file 2: SARE_SUB_VISA_CARD header SARE_SUB_VISA_CARD Subject =~ /Visa\W*(?:card\W*easy|approve\W*all)/i describe SARE_SUB_VISA_CARD Spammer subject - credit or money score SARE_SUB_VISA_CARD 0.277 #hist SARE_SUB_VISA_CARD Created by Bob Menschel Mar 30 2004 #counts SARE_SUB_VISA_CARD 0s/0h of 238420 corpus (112480s/125940h RM) 02/28/05 #max SARE_SUB_VISA_CARD 4s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_VISA_CARD 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_VISA_CARD 1s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_VISA_CARD 0s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_VISA_CARD 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Medical ######## ###################### ################################################## header __SARE_SUB_LOSE_PCT Subject =~ /lose.{1,20}(?:\d+\%.{1,25}weight|weight.{1,40}\d+\%)/i meta SARE_SUB_LOSE_PCT1 __SARE_SUB_LOSE_PCT && !SUBJECT_DIET describe SARE_SUB_LOSE_PCT1 Common spammer subject header -- Medical score SARE_SUB_LOSE_PCT1 1.666 #hist SARE_SUB_LOSE_PCT1 Created by Bob Menschel from suggested by Loren Wilton, July 24 2004 #hist SARE_SUB_LOSE_PCT1 Bugzilla entry 3863, Oct 03 2004 #v300 SARE_SUB_LOSE_PCT1 Strong overlap with 3.0 subject rule SUBJECT_DIET, though SUBJECT_DIET does not test for "%" #counts SARE_SUB_LOSE_PCT1 0s/0h of 115424 corpus (81069s/34355h RM) 01/16/05 #counts SARE_SUB_LOSE_PCT1 0s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_LOSE_PCT1 150s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #alone SARE_SUB_LOSE_PCT1 106s/0h of 196667 corpus (96194s/100473h RM) 02/21/05 #counts SARE_SUB_LOSE_PCT1 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_LOSE_PCT1 24s/0h of 16895 corpus (14482s/2413h MY) 07/26/04 #counts SARE_SUB_LOSE_PCT1 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 meta SARE_SUB_LOSE_PCT2 __SARE_SUB_LOSE_PCT && SUBJECT_DIET describe SARE_SUB_LOSE_PCT2 Common spammer subject header -- Medical score SARE_SUB_LOSE_PCT2 0.311 0.943 1.607 1.400 #adds to SARE_SUB_LOSE_PCT2 score SUBJECT_DIET 1.355 0.723 0.059 0.266 to result in 1.666 #hist SARE_SUB_LOSE_PCT2 Created by Bob Menschel to avoid over-scoring overlap with new 3.0 rule #v300 SARE_SUB_LOSE_PCT2 Strong overlap with 3.0 subject rule SUBJECT_DIET, though SUBJECT_DIET does not test for "%" #counts SARE_SUB_LOSE_PCT2 0s/0h of 280564 corpus (109285s/171279h RM) 05/03/05 #alone SARE_SUB_LOSE_PCT2 1679s/0h of 115424 corpus (81069s/34355h RM) 01/16/05 #counts SARE_SUB_LOSE_PCT2 114s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #counts SARE_SUB_LOSE_PCT2 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_LOSE_PCT2 51s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_LOSE_PCT2 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Generic words and phrases ######## ###################### ################################################## ######## ###################### ################################################## # Category: Technical rules ######## ###################### ################################################## # EOF # SARE "General Subject" Ruleset for SpamAssassin - File 3 # Version: 01.03.09 # Created: 2004-09-13 # Modified: 2005-06-13 # Usage instructions and documentation are found in 70_sare_genlsubj0.cf #@@# Revision History: Full Revision History stored in 70_sare_genlsubj.log #@@# 01.03.09: June 13 2005 #@@# Minor score updates based on additional mass-check #@@# Moved file 1 to file 3: SARE_SUB_NEXT_DOOR #@@# Archived from file 3: SARE_SUB_KICKBACK #@@# Archived from file 3: SARE_SUB_DEBTS_COURT #@@# Moved file 1 to file 3: SARE_SUB_INVESTMENTS #@@# Archived from file 3: SARE_SUB_ACQUISITION #@@# Moved file 3 to file 2: SARE_SUB_VISA_CARD #@@# Moved file 1 to file 3: SARE_SUB_AS_LOW_AS #@@# Archived from file 3: SARE_SUB_FOR_WOMEN ######## ###################### ################################################## # Rule definitions to avoid --lint errors on archived/moved rules. ######## ###################### ################################################## meta SARE_SUB_WEBMASTER2 0 meta SARE_SUB_LAST_CHANCE 0 meta SARE_SUB_THOU_CLI 0 meta SARE_SUB_BETTER 0 meta SARE_SUB_BRKING_NEWS 0 meta SARE_SUB_CHRISTIAN 0 meta SARE_SUB_COMMA_LEAD 0 meta SARE_SUB_FREE 0 meta SARE_SUB_SAVE_UP_TO 0 meta SARE_SUB_WIN 0 meta SARE_SUB_KICKBACK 0 meta SARE_SUB_DEBTS_COURT 0 meta SARE_SUB_ACQUISITION 0 meta SARE_SUB_FOR_WOMEN 0 ######## ###################### ################################################## # Category: __rules used by primary rules below ######## ###################### ################################################## # Attempt to identify simple subject obfuscation by character insertion header __SARE_SUB_OBFU_ASTER Subject =~ /[a-zA-Z0]\*[a-zA-Z]/ header __SARE_SUB_OBFU_CARAT Subject =~ /[a-zA-Z0]\^[a-zA-Z]/ header __SARE_SUB_OBFU_COLON Subject =~ /[a-zA-Z0]:[a-zA-Z]/ header __SARE_SUB_OBFU_COMMA Subject =~ /[a-zA-Z0],[a-zA-Z]/ header __SARE_SUB_OBFU_SLASH Subject =~ /[a-zA-Z0]\/[a-zA-Z]/ header __SARE_SUB_OBFU_LQUOT Subject =~ /[a-zA-Z0]`[a-zA-Z]/ header __SARE_SUB_OBFU_PERIOD Subject =~ /[a-zA-Z0]\.[a-zA-Z]/ header __SARE_SUB_OBFU_2PER Subject =~ /[a-zA-Z0]\.\.[a-zA-Z]/ header __SARE_SUB_OBFU_PIPE Subject =~ /[a-zA-Z0]\|[a-zA-Z]/ header __SARE_SUB_OBFU_PLUS Subject =~ /[a-zA-Z0]\+[a-zA-Z]/ header __SARE_SUB_OBFU_QUOTE Subject =~ /[a-zA-Z0]"[a-zA-Z]/ header __SARE_SUB_OBFU_SCOLON Subject =~ /[a-zA-Z0];[a-zA-Z]/ header __SARE_SUB_OBFU_USCORE Subject =~ /[a-zA-Z0]_[a-zA-Z]/ header __SARE_SUB_OBFU_HTTP Subject =~ m*http://*i ######## ###################### ################################################## # Category: Adult/Porn ######## ###################### ################################################## header SARE_SUB_NEXT_DOOR Subject =~ /n(?:ex|xe)t door/i describe SARE_SUB_NEXT_DOOR Adult spammer phrasing score SARE_SUB_NEXT_DOOR 0.333 #hist SARE_SUB_NEXT_DOOR Richard Gray, Feb 21 2005 #counts SARE_SUB_NEXT_DOOR 8s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_NEXT_DOOR 12s/0h of 238420 corpus (112480s/125940h RM) 02/28/05 #counts SARE_SUB_NEXT_DOOR 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_NEXT_DOOR 4s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_NEXT_DOOR 10s/2h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_NEXT_DOOR 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_NEXT_DOOR 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Black market items, services, activities, scams, frauds ######## ###################### ################################################## header SARE_SUB_COPYDVD Subject =~ /(?:(?:burn|c[o0]py).{0,30}dvd|dvd.{0,30}c[o0]p(?:y|ier)|dvd magic)/i describe SARE_SUB_COPYDVD Spammer subject - black market or scam score SARE_SUB_COPYDVD 0.115 #ham SARE_SUB_COPYDVD verified (47). Several news articles. Some business email from professional DVD copying service. #counts SARE_SUB_COPYDVD 41s/35h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_COPYDVD 47s/0h of 115478 corpus (94289s/21189h) 04/24/04 #counts SARE_SUB_COPYDVD 45s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_COPYDVD 46s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_COPYDVD 0s/9h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_COPYDVD 7s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 ######## ###################### ################################################## # Category: Credit, debt, lending, mortgage, borrowing, investment, financing ######## ###################### ################################################## header SARE_SUB_DEBT Subject =~ /\bdebt\b/i describe SARE_SUB_DEBT Spammer subject - credit or money score SARE_SUB_DEBT 0.433 #ham SARE_SUB_DEBT "Asians on Tsunami Relief: Drop the Debt" and related, social issues newsletters #counts SARE_SUB_DEBT 128s/28h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_DEBT 7s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_DEBT 73s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_DEBT 74s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_DEBT 216s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_DEBT 17s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_INVESTMENTS Subject =~ /(?:(?:invest(?:ing|ments?|or)|promotion|stock\W*market).(?:alert|assistance|bulletin|data|forecast|funds|insight|knowledge|like|member|news|opp|option|profile|program|proposal|rewards|surprise|update|workshop)|(?:\$\d+.{0,10}|better.{0,30}|business|easy|fund.{0,30}|joint|make\W*an|proven|real\W*estate|secrets?.{0,30}|secured|smart|stock|time\W*to|your|zero)\W*invest(?:ing|ments?)|help.{1,10}invest)/i describe SARE_SUB_INVESTMENTS Spammer subject - credit or money score SARE_SUB_INVESTMENTS 0.456 #ham SARE_SUB_INVESTMENTS "A short survey about your investments" from valid survey company, to survey member #counts SARE_SUB_INVESTMENTS 139s/19h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_INVESTMENTS 16s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_INVESTMENTS 28s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_INVESTMENTS 5s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_INVESTMENTS 38s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_INVESTMENTS 4s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 header SARE_SUB_INVESTORS Subject =~ /investors/i describe SARE_SUB_INVESTORS Spammer subject - credit or money score SARE_SUB_INVESTORS 0.752 #ham SARE_SUB_INVESTORS Washington Post newsletter #counts SARE_SUB_INVESTORS 125s/5h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_INVESTORS 143s/32h of 281078 corpus (109729s/171349h RM) 05/05/05 #counts SARE_SUB_INVESTORS 38s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_INVESTORS 20s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_INVESTORS 27s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_INVESTORS 2s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 ######## ###################### ################################################## # Category: Gambling, Lotto, Sweepstakes, Winnings, Losses ######## ###################### ################################################## header SARE_SUB_CASINO Subject =~ /\bc[a\@]sin[o0]/i describe SARE_SUB_CASINO Spammer subject - gambling score SARE_SUB_CASINO 0.341 #stype SARE_SUB_CASINO max:0.555 #hist SARE_SUB_CASINO score max set to 0.555 to keep in line with other rules with similar hit rates #counts SARE_SUB_CASINO 105s/25h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_CASINO 50s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_CASINO 75s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_CASINO 21s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_CASINO 80s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_CASINO 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_CASINO 0s/3h of 5906 corpus (1036s/4870h ft) 06/11/05 ######## ###################### ################################################## # Category: Insurance ######## ###################### ################################################## header SARE_SUB_CAR_INSURANCE Subject =~ /(?:car|auto(?:mobile)?) insurance/i describe SARE_SUB_CAR_INSURANCE Spammer subject - insurance score SARE_SUB_CAR_INSURANCE 0.369 #ham SARE_SUB_CAR_INSURANCE adv in subcribed opt-in newsletter (1) #counts SARE_SUB_CAR_INSURANCE 48s/12h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_CAR_INSURANCE 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_CAR_INSURANCE 2s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_CAR_INSURANCE 45s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_CAR_INSURANCE 0s/1h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Marketing, Pricing, Selling, Buying ######## ###################### ################################################## header SARE_SUB_AS_LOW_AS Subject =~ /as low as/i describe SARE_SUB_AS_LOW_AS Subject contains apparent spammer phrasing score SARE_SUB_AS_LOW_AS 0.342 #hist SARE_SUB_AS_LOW_AS RM_spc_AsLowAs #counts SARE_SUB_AS_LOW_AS 157s/32h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_AS_LOW_AS 29s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_AS_LOW_AS 164s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_AS_LOW_AS 16s/1h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_AS_LOW_AS 19s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04 #counts SARE_SUB_AS_LOW_AS 7s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_BETTER_DEAL Subject =~ /better deal/i describe SARE_SUB_BETTER_DEAL common spammer phrasing score SARE_SUB_BETTER_DEAL 0.111 #hist SARE_SUB_BETTER_DEAL Created by Bob Menschel Apr 04 2004 #ham SARE_SUB_BETTER_DEAL Washington Post email newsletter #counts SARE_SUB_BETTER_DEAL 0s/1h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_BETTER_DEAL 10s/1h of 102867 corpus (66500s/36367h RM) 12/07/04 #counts SARE_SUB_BETTER_DEAL 3s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_BETTER_DEAL 8s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_BETTER_DEAL 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_BETTER_DEAL 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_FREE_BANG Subject =~ /\bFree\!/i describe SARE_SUB_FREE_BANG Spammer subject - marketing score SARE_SUB_FREE_BANG 0.725 #stype SARE_SUB_FREE_BANG max:1.0 #ham SARE_SUB_FREE_BANG Dell, Visicom Media #counts SARE_SUB_FREE_BANG 164s/9h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_FREE_BANG 133s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_FREE_BANG 32s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_FREE_BANG 47s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_FREE_BANG 6s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_FREE_BANG 16s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_FREE_BANG 0s/1h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_GROW_BUSINESS Subject =~ /Grow.+business/i describe SARE_SUB_GROW_BUSINESS Subject contains apparent spammer phrasing score SARE_SUB_GROW_BUSINESS 0.256 #ham SARE_SUB_GROW_BUSINESS ComputerWorld: Shark Tank: Technically, Support Is A Growing Business Too #hist SARE_SUB_GROW_BUSINESS Created by Bob Menschel Aug 23 2004 #counts SARE_SUB_GROW_BUSINESS 18s/4h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_GROW_BUSINESS 5s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_GROW_BUSINESS 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_GROW_BUSINESS 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_SAVE_PCT Subject =~ /save.{1,5}\%/i describe SARE_SUB_SAVE_PCT subject has likely spammer phrase or word score SARE_SUB_SAVE_PCT 0.070 #hist SARE_SUB_SAVE_PCT From 88_FVGT_subject.cf FS_SAVE_PERCENT May 1 2004 #counts SARE_SUB_SAVE_PCT 177s/78h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_SAVE_PCT 218s/12h of 238420 corpus (112480s/125940h RM) 02/28/05 #counts SARE_SUB_SAVE_PCT 40s/1h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_SAVE_PCT 50s/10h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_SAVE_PCT 7s/1h of 11269 corpus (6578s/4691h CT) 06/11/05 ######## ###################### ################################################## # Category: Medical ######## ###################### ################################################## header SARE_SUB_AGING Subject =~ /\bAging\b/i describe SARE_SUB_AGING Spammer subject - medical score SARE_SUB_AGING 0.033 #ham SARE_SUB_AGING Mayo clinic e-newsletter, medical mailing lists #counts SARE_SUB_AGING 13s/51h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_AGING 15s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_AGING 38s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_AGING 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_AGING 7s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_AGING 3s/1h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_AGING 0s/1h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_CONSULTATION Subject =~ /\bconsultations?\b/i describe SARE_SUB_CONSULTATION Spammer subject - medical score SARE_SUB_CONSULTATION 0.043 #ham SARE_SUB_CONSULTATION Job.com CareerTools #counts SARE_SUB_CONSULTATION 20s/71h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_CONSULTATION 45s/46h of 280895 corpus (109565s/171330h RM) 05/03/05 #counts SARE_SUB_CONSULTATION 33s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_CONSULTATION 37s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_CONSULTATION 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_CONSULTATION 4s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_CONSULTATION 2s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_CONSULTATION 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_CONSULTATION 1s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_MEDICAL_NEWS Subject =~ /(?:medical\W*(?:announcement|breakthrough|discover|info|innovation|marvel|miracle|news|post|update)|(?:news|notice).{1,3}medical)/i describe SARE_SUB_MEDICAL_NEWS Spammer subject - medical score SARE_SUB_MEDICAL_NEWS 0.628 #hist SARE_SUB_MEDICAL_NEWS Created by Bob Menschel Apr 05 2004 #counts SARE_SUB_MEDICAL_NEWS 10s/1h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_MEDICAL_NEWS 86s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_MEDICAL_NEWS 3s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_MEDICAL_NEWS 11s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_MEDICAL_NEWS 12s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_MEDICAL_NEWS 45s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_MEDICAL_NEWS 1s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_PHYSICIAN Subject =~ /\bphysicians?\b/i describe SARE_SUB_PHYSICIAN Spammer subject - medical score SARE_SUB_PHYSICIAN 0.093 #hist SARE_SUB_PHYSICIAN 04/23/2004 #ham SARE_SUB_PHYSICIAN washingtonpost.com: Chinese Pressure Dissident Physician, Jul 16 2004 #counts SARE_SUB_PHYSICIAN 2s/11h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_PHYSICIAN 7s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_PHYSICIAN 15s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_PHYSICIAN 16s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_PHYSICIAN 1s/1h of 11269 corpus (6578s/4691h CT) 06/11/05 #counts SARE_SUB_PHYSICIAN 0s/2h of 5906 corpus (1036s/4870h ft) 06/11/05 ######## ###################### ################################################## # Category: Software ######## ###################### ################################################## header SARE_SUB_DOWNLOAD Subject =~ /(?:downloadable\W*software|(?:available\W*for|cds\W*(?:and|or)|easy|free\W*to)\W*download|download(?:ing)\W*(?:(?:for\W*)?free|games|movies|music|now|software|under|video))/i describe SARE_SUB_DOWNLOAD Spammer subject - software score SARE_SUB_DOWNLOAD 0.174 #counts SARE_SUB_DOWNLOAD 39s/12h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_DOWNLOAD 6s/1h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_DOWNLOAD 19s/1h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_DOWNLOAD 3s/2h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_DOWNLOAD 26s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_DOWNLOAD 1s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_DOWNLOAD 2s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_DOWNLOAD 1s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 ######## ###################### ################################################## # Category: Generic words and phrases ######## ###################### ################################################## header SARE_SUB_BE_HERE Subject =~ /be here/i describe SARE_SUB_BE_HERE subject has likely spammer phrase or word score SARE_SUB_BE_HERE 0.153 #counts SARE_SUB_BE_HERE 0s/1h of 281078 corpus (109729s/171349h RM) 05/05/05 #max SARE_SUB_BE_HERE 10s/0h of 92315 corpus (67942s/24373h RM) 07/24/04 #counts SARE_SUB_BE_HERE 11s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_BE_HERE 0s/2h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_BE_HERE 0s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_BE_HERE 1s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_BETTER_OB1 Subject =~ /(?!BETTER)b.?e.?t.?t.?e.?r/i describe SARE_SUB_BETTER_OB1 subject has obfuscated spammer topic score SARE_SUB_BETTER_OB1 0.146 #note SARE_SUB_BETTER_OB1 Not consolidated with SARE_SUB_BETTER_OB2 because of ham hits on this rule #stype SARE_SUB_BETTER_OB1 max:0.1 #ham SARE_SUB_BETTER_OB1 misspelled: bettter (14) #counts SARE_SUB_BETTER_OB1 41s/15h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_BETTER_OB1 48s/14h of 92315 corpus (67942s/24373h RM) 07/24/04 #counts SARE_SUB_BETTER_OB1 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_BETTER_OB1 8s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_BETTER_OB1 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_BETTER_OB1 1s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_BETTER_OB1 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_BIGGER Subject =~ /bigger/i describe SARE_SUB_BIGGER subject has likely spammer phrase or word score SARE_SUB_BIGGER 0.648 #ham SARE_SUB_BIGGER About.com Health #counts SARE_SUB_BIGGER 135s/10h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_BIGGER 19s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_BIGGER 44s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_BIGGER 21s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_BIGGER 24s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_BIGGER 9s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_BREAKTHRU Subject =~ /Breakthrough/i describe SARE_SUB_BREAKTHRU subject has likely spammer phrase or word score SARE_SUB_BREAKTHRU 0.291 #counts SARE_SUB_BREAKTHRU 91s/21h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_BREAKTHRU 30s/3h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_BREAKTHRU 39s/3h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_BREAKTHRU 5s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_BREAKTHRU 8s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_BREAKTHRU 5s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_CALL_NOW Subject =~ /call.{1,28}now/i describe SARE_SUB_CALL_NOW subject has likely spammer phrase or word score SARE_SUB_CALL_NOW 0.078 #hist SARE_SUB_CALL_NOW From 88_FVGT_subject.cf FS_CALL_NOW May 1 2004 #counts SARE_SUB_CALL_NOW 6s/4h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_CALL_NOW 7s/7h of 280895 corpus (109565s/171330h RM) 05/03/05 #counts SARE_SUB_CALL_NOW 1s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_CALL_NOW 8s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_CALL_NOW 0s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_CALL_NOW 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 header SARE_SUB_CARTRIDGE Subject =~/Cartridge/i describe SARE_SUB_CARTRIDGE subject has likely spammer phrase or word score SARE_SUB_CARTRIDGE 0.203 #counts SARE_SUB_CARTRIDGE 50s/31h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_CARTRIDGE 102s/28h of 238420 corpus (112480s/125940h RM) 02/28/05 #counts SARE_SUB_CARTRIDGE 94s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_CARTRIDGE 3s/8h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_CARTRIDGE 3s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_CARTRIDGE 3s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_CARTRIDGE 0s/1h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_EXCITING_NEW Subject =~ /exciting\W*(and\W*prosperous|business\W*opportunity|new)/i describe SARE_SUB_EXCITING_NEW subject has likely spammer phrase or word score SARE_SUB_EXCITING_NEW 0.111 #ham SARE_SUB_EXCITING_NEW confirmed (2) #hist SARE_SUB_EXCITING_NEW Created by Bob Menschel Apr 05 2004 #counts SARE_SUB_EXCITING_NEW 9s/2h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_EXCITING_NEW 16s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_EXCITING_NEW 0s/1h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_EXCITING_NEW 3s/1h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_EXCITING_NEW 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_EXCITING_NEW 3s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_EXCITING_NEW 0s/1h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_FIND_YOUR Subject =~ /find your/i describe SARE_SUB_FIND_YOUR subject has likely spammer phrase or word score SARE_SUB_FIND_YOUR 0.676 #ham SARE_SUB_FIND_YOUR WebMD: Find Your Ideal Weight, July 2004 #counts SARE_SUB_FIND_YOUR 57s/5h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_FIND_YOUR 111s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_FIND_YOUR 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_FIND_YOUR 3s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_FIND_YOUR 1s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_FIND_YOUR 3s/2h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_GETRID Subject =~ /\bget rid of\b/i describe SARE_SUB_GETRID subject has likely spammer phrase or word score SARE_SUB_GETRID 0.318 #counts SARE_SUB_GETRID 24s/3h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_GETRID 4s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_GETRID 32s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_GETRID 2s/7h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 header SARE_SUB_INCHES Subject =~ /(?:(?:\d.*|add?|enlarge|gain|in.?crease|lose|more|shed)(?:ed|s)?\b.{1,30}\binch(?:es)?\b|inches\W*added)/i describe SARE_SUB_INCHES subject has likely spammer phrase or word score SARE_SUB_INCHES 0.260 #ham SARE_SUB_INCHES price of a "7 inch saw blade", "42 inch plasma TV" #counts SARE_SUB_INCHES 46s/19h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_INCHES 52s/14h of 291031 corpus (121442s/169589h RM) 04/22/05 #counts SARE_SUB_INCHES 34s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_INCHES 44s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_INCHES 4s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_INCHES 24s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_INCHES 5s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_INEXPEN Subject =~ /Inexpensive [xvp]./i describe SARE_SUB_INEXPEN Subject matches common spam pattern score SARE_SUB_INEXPEN 0.194 #hist SARE_SUB_INEXPEN LW_INEX_SUB, Aug 16 2004, Loren Wilton #counts SARE_SUB_INEXPEN 0s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_INEXPEN 94s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_INEXPEN 2s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_INEXPEN 5s/0h of 18198 corpus (15674s/2524h JH) 08/16/04 #counts SARE_SUB_INEXPEN 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_INEXPEN 10s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_INEXPEN 0s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_INEXPEN 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_INKJET Subject =~/Inkjet/i describe SARE_SUB_INKJET subject has likely spammer phrase or word score SARE_SUB_INKJET 0.115 #counts SARE_SUB_INKJET 23s/11h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_INKJET 71s/2h of 238420 corpus (112480s/125940h RM) 02/28/05 #counts SARE_SUB_INKJET 5s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_INKJET 5s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_INKJET 3s/3h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_INKJET 8s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_INKJET 0s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_JOB Subject =~ /(?:(?:dead\W*end|does\W*your|dream|find\W*people|get\W*(?:a|the)(?:\W*better)?|(?:keep|quit)\W*(?:your|their)(?:\W*day)?|real|run\W*your|that\W*great|wanna|with\W*a\W*new|(?:yo)?ur\W*(?:current|full\W*time))\W*job|good\W*jobs|global\W*job\W*vacancy|success\W*job\W*story|job\W*(?:confirmation|feel\W*like|journal|opportunity|you\W*want)|joboffer)/i describe SARE_SUB_JOB subject has likely spammer phrase or word score SARE_SUB_JOB 0.104 #counts SARE_SUB_JOB 31s/23h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_JOB 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_JOB 23s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_JOB 13s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_JOB 17s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_JOB 0s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_JOB 3s/1h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_LOOKING_FOR Subject =~ /(?!looking for help)(?:(?:they\W*are|We(?:\W*a|')re|wives|y[o0\@]u(?:(?:\W*a|')[rv]e(?:\W*been)?))\W*l[o0\@][o0\@]king\W*f[o0\@]r|l[o0\@][o0\@]king\W*f[o0\@]r.{0,30}(?:career|c[o0\@]nsultants|cust[o0\@]mers|empl[o0\@]yees|entrepreneur|free\W*lunch|help|h[o0\@]nest|investment|loan|l[o0\@]ve|med(?:s|icati[o0\@]ns)|m[o0\@]rtgage|pe[o0\@]ple|perfect|sex|s[o0\@]me[o0\@]ne|work|y[o0\@]u))\b/i describe SARE_SUB_LOOKING_FOR subject has likely spammer phrase or word score SARE_SUB_LOOKING_FOR 0.231 #ham SARE_SUB_LOOKING_FOR "Looking for artist for CD artwork", "Looking for someone", "looking for a flash needs some help" #counts SARE_SUB_LOOKING_FOR 117s/36h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_LOOKING_FOR 82s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_LOOKING_FOR 12s/17h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_LOOKING_FOR 33s/17h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_LOOKING_FOR 18s/1h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_PERFECT Subject =~ /\bperfect\W*(?:body|chart|credit|gift|home|loan|match|mate|pharmacy|soft\W*ware|solution|source|summer|time|tool|travel|valentine)/i describe SARE_SUB_PERFECT subject has likely spammer phrase or word score SARE_SUB_PERFECT 0.659 #ham SARE_SUB_PERFECT "perfect valentine" and "perfect match" #counts SARE_SUB_PERFECT 112s/8h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_PERFECT 53s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_PERFECT 8s/1h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_PERFECT 13s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_PRICES_CAP Subject =~ /PRICES/ describe SARE_SUB_PRICES_CAP subject has likely spammer phrase or word score SARE_SUB_PRICES_CAP 0.050 #hist SARE_SUB_PRICES_CAP From 88_FVGT_subject.cf FS_PRICES May 1 2004 #counts SARE_SUB_PRICES_CAP 8s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_PRICES_CAP 20s/8h of 238420 corpus (112480s/125940h RM) 02/28/05 #counts SARE_SUB_PRICES_CAP 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_PRICES_CAP 3s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_PRICES_CAP 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_PRICES_CAP 8s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_PRICES_CAP 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_PRICES_CAP 0s/1h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_PROFILE Subject =~ /(?:your profile.{1,30}need|(?:cholesterol|company|featured|financial|I saw your|new|saw you|special|stock(?:\W*market)?|Your Personal)\W*profile|profiled?\W*compan(?:y|ies))/i describe SARE_SUB_PROFILE subject has likely spammer phrase or word score SARE_SUB_PROFILE 0.674 #ham SARE_SUB_PROFILE "company profile" in commercial non-spam to potential business customer #note SARE_SUB_PROFILE "Investment Profile" matched by SARE_SUB_INVESTMENTS #note SARE_SUB_PROFILE "Credit Profile" matched by SARE_SUB_POOR_CREDIT #counts SARE_SUB_PROFILE 72s/4h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_PROFILE 22s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_PROFILE 10s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_PROFILE 3s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_PROFILE 4s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_SPECIAL_BANG Subject =~ /Special\!/i describe SARE_SUB_SPECIAL_BANG subject has likely spammer phrase or word score SARE_SUB_SPECIAL_BANG 0.278 #counts SARE_SUB_SPECIAL_BANG 10s/2h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_SPECIAL_BANG 39s/1h of 91714 corpus (74113s/17601h RM) 01/24/04 #counts SARE_SUB_SPECIAL_BANG 3s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_SPECIAL_BANG 4s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_SPECIAL_BANG 2s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_SPECIAL_BANG 3s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_SPECIAL_BANG 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_STRONG Subject =~ /\bstrong\b/i describe SARE_SUB_STRONG subject has likely spammer phrase or word score SARE_SUB_STRONG 0.116 #ham SARE_SUB_STRONG ... NEEDS AN ANSWER....OR A STRONG ROPE #counts SARE_SUB_STRONG 61s/39h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_STRONG 64s/32h of 238420 corpus (112480s/125940h RM) 02/28/05 #counts SARE_SUB_STRONG 26s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_STRONG 26s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_STRONG 12s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_STRONG 3s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_STRONG 0s/3h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_SURVEY Subject =~ /(?:campaign|Fill\W*out|questions|rated.{1,30}by\W*a|short|simple|tak(e|ing)|womens)\W*survey|survey\W*(?:opportunity|says)/ describe SARE_SUB_SURVEY subject has likely spammer phrase or word score SARE_SUB_SURVEY 0.444 #ham SARE_SUB_SURVEY From valid survey company: A short survey about your investments #counts SARE_SUB_SURVEY 12s/3h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_SURVEY 14s/1h of 238420 corpus (112480s/125940h RM) 02/28/05 #counts SARE_SUB_SURVEY 17s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_SURVEY 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_SURVEY 1s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_SURVEY 3s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_TAKE Subject =~ /^take (?:a (?:chance|look|moment|step|trip|vacation)|advant|cont|once|the)./i describe SARE_SUB_TAKE Subject matches common spam pattern score SARE_SUB_TAKE 0.537 #hist SARE_SUB_TAKE LW_TAKES_SUB, Aug 16 2004, Loren Wilton #counts SARE_SUB_TAKE 51s/13h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_TAKE 73s/5h of 238420 corpus (112480s/125940h RM) 02/28/05 #counts SARE_SUB_TAKE 81s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_TAKE 7s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_TAKE 18s/0h of 18198 corpus (15674s/2524h JH) 08/16/04 #counts SARE_SUB_TAKE 5s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_TAKE 8s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_TAKE 1s/1h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_TONER Subject =~ /\btoner\b/i describe SARE_SUB_TONER subject has likely spammer phrase or word score SARE_SUB_TONER 0.456 #counts SARE_SUB_TONER 22s/4h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_TONER 28s/4h of 280895 corpus (109565s/171330h RM) 05/03/05 #counts SARE_SUB_TONER 17s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_TONER 0s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_TONER 2s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_TONER 3s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_WEBMASTER Subject =~ /(?:webmaster(?:[,:\@\?]| - |.(?:\$\d|are\W*you||database))|(?:(?:hi|success)\W*|--\W*)webmaster)/i describe SARE_SUB_WEBMASTER subject has likely spammer phrase or word score SARE_SUB_WEBMASTER 0.016 #stype SARE_SUB_WEBMASTER max:0.2 #counts SARE_SUB_WEBMASTER 12s/82h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_WEBMASTER 22s/40h of 238420 corpus (112480s/125940h RM) 02/28/05 #counts SARE_SUB_WEBMASTER 7s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_WEBMASTER 5s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_WEBMASTER 0s/1h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_WINNER Subject =~ /winner/i describe SARE_SUB_WINNER subject has likely spammer phrase or word score SARE_SUB_WINNER 0.368 #hist SARE_SUB_WINNER From 88_FVGT_subject.cf FS_WINNER May 1 2004 #counts SARE_SUB_WINNER 361s/69h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_WINNER 135s/1h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_WINNER 141s/1h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_WINNER 14s/4h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_WINNER 21s/4h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_WINNER 5s/2h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_WINNER 1s/1h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_YOUR_WOMAN Subject =~ /Your woman/i describe SARE_SUB_YOUR_WOMAN subject has likely spammer phrase or word score SARE_SUB_YOUR_WOMAN 0.736 #ham SARE_SUB_YOUR_WOMAN verified (1) #counts SARE_SUB_YOUR_WOMAN 60s/1h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_YOUR_WOMAN 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_YOUR_WOMAN 5s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_YOUR_WOMAN 3s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_YOUR_WOMAN 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Technical Rules ######## ###################### ################################################## header SARE_SUB_LEAD_CHAR2 Subject =~ m'^[-<>=]{2}.*' describe SARE_SUB_LEAD_CHAR2 Subject starts with spamsign characters score SARE_SUB_LEAD_CHAR2 0.367 #ham SARE_SUB_LEAD_CHAR2 from firstplacesoftware.com #hist SARE_SUB_LEAD_CHAR2 Created by Bob Menschel May 18 2004 #counts SARE_SUB_LEAD_CHAR2 187s/10h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_LEAD_CHAR2 8s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_LEAD_CHAR2 18s/0h of 18153 corpus (15872s/2281h MY) 05/20/04 #counts SARE_SUB_LEAD_CHAR2 3s/1h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_LEAD_CHAR2 1s/3h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_LEAD_CHAR2 2s/3h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_LETTERS_NUMS Subject =~ /[a-z]{1,5}[0-9]{1,5}[a-z]{1,5}[0-9]{1,5}[a-z]{1,5}[0-9]{1,5}/ describe SARE_SUB_LETTERS_NUMS Subject has multiple mixed letters and numbers score SARE_SUB_LETTERS_NUMS 0.029 #ham SARE_SUB_LETTERS_NUMS mailing list removal confirmation email #counts SARE_SUB_LETTERS_NUMS 13s/49h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_LETTERS_NUMS 21s/86h of 238420 corpus (112480s/125940h RM) 02/28/05 #counts SARE_SUB_LETTERS_NUMS 10s/4h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_LETTERS_NUMS 2s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_LETTERS_NUMS 8s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_LETTERS_NUMS 3s/1h of 11269 corpus (6578s/4691h CT) 06/11/05 #counts SARE_SUB_LETTERS_NUMS 1s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_PAREN_NUM2 Subject =~ /^\s*[<[]\d{1,3}[>\]].*[<[]\d{1,3}[>\]]/ describe SARE_SUB_PAREN_NUM2 subject has [00]subject[00] or <> or {} score SARE_SUB_PAREN_NUM2 0.139 #ham SARE_SUB_PAREN_NUM2 confirmed (1) #hist SARE_SUB_PAREN_NUM2 Created by Bob Menschel Aug 27 2004 #counts SARE_SUB_PAREN_NUM2 0s/1h of 280895 corpus (109565s/171330h RM) 05/03/05 #max SARE_SUB_PAREN_NUM2 125s/1h of 118869 corpus (71079s/47790h RM) 02/06/05 #counts SARE_SUB_PAREN_NUM2 5s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_PAREN_NUM2 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_PAREN_NUM2 12s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_PAREN_NUM2 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 # EOF