# SpamAssassin rules file
#
# Please don't modify this file as your changes will be overwritten with
# the next update. Use @@LOCAL_RULES_DIR@@/local.cf instead.
# See 'perldoc Mail::SpamAssassin::Conf' for details.
#
# <@LICENSE>
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to you under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at:
# 
#     http://www.apache.org/licenses/LICENSE-2.0
# 
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# </@LICENSE>
#
###########################################################################

require_version @@VERSION@@

##{ APOSTROPHE_FROM

header		APOSTROPHE_FROM	From:addr =~ /'/
describe	APOSTROPHE_FROM	From address contains an apostrophe
##} APOSTROPHE_FROM

##{ AXB_HELO_HOME_UN

header          AXB_HELO_HOME_UN        X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\w+\.(lan|home) /i
describe        AXB_HELO_HOME_UN        HELO from home  - untrusted
##} AXB_HELO_HOME_UN

##{ AXB_XMID_1212

header          AXB_XMID_1212                   Message-Id =~ /^<[0-9]{12}\.[0-9]{12}\@/
describe        AXB_XMID_1212                   Barbera Fingerprint
##} AXB_XMID_1212

##{ AXB_XMID_1510

header          AXB_XMID_1510                   Message-Id =~ /<[0-9A-F]{15}\.[0-9A-F]{10}\@/
describe        AXB_XMID_1510                   Brunello Fingerprint
##} AXB_XMID_1510

##{ AXB_XMID_OEGOESNULL

header          AXB_XMID_OEGOESNULL             Message-ID =~ /^<[0-9-a-f]{12}\$[0-9-a-f]{8}\$[0]{8}\@/
describe        AXB_XMID_OEGOESNULL             Amarone Fingerprint
##} AXB_XMID_OEGOESNULL

##{ AXB_XM_SENDMAIL_NOT

header          AXB_XM_SENDMAIL_NOT             Received =~ /\([123456790]{1,2}\.[0-9]{1,2}\.[0-9]{1}\/[0-9]{1,2}\.[0-9]{2}\.[0-9]{1}\)/
describe        AXB_XM_SENDMAIL_NOT             Nebbiolo fingerprint
##} AXB_XM_SENDMAIL_NOT

##{ AXB_XR_STULDAP

header  AXB_XR_STULDAP     Received =~ /\(8\.12\.3 da nor stuldap\/8\.12\.3\)/
##} AXB_XR_STULDAP

##{ BANKING_LAWS

body		BANKING_LAWS	/banking laws/i
describe	BANKING_LAWS	Talks about banking laws
##} BANKING_LAWS

##{ BASE64_LENGTH_78_79 ifplugin Mail::SpamAssassin::Plugin::MIMEEval

ifplugin Mail::SpamAssassin::Plugin::MIMEEval
body BASE64_LENGTH_78_79	eval:check_base64_length('78','79')
endif
##} BASE64_LENGTH_78_79 ifplugin Mail::SpamAssassin::Plugin::MIMEEval

##{ BASE64_LENGTH_79_INF ifplugin Mail::SpamAssassin::Plugin::MIMEEval

ifplugin Mail::SpamAssassin::Plugin::MIMEEval
body BASE64_LENGTH_79_INF	eval:check_base64_length('79')
endif
##} BASE64_LENGTH_79_INF ifplugin Mail::SpamAssassin::Plugin::MIMEEval

##{ BUG6152_INVALID_DATE_TZ_ABSURD

header BUG6152_INVALID_DATE_TZ_ABSURD   Date =~ /[-+](?!(?:0\d|1[0-4])(?:[03]0|[14]5))\d{4}/
##} BUG6152_INVALID_DATE_TZ_ABSURD

##{ CORRUPT_FROM_LINE_IN_HDRS

meta CORRUPT_FROM_LINE_IN_HDRS (MISSING_HEADERS && __BODY_STARTS_WITH_FROM_LINE && MISSING_DATE && NO_RELAYS)
describe CORRUPT_FROM_LINE_IN_HDRS Informational: message is corrupt, with a From line in its headers
tflags CORRUPT_FROM_LINE_IN_HDRS userconf publish
#score CORRUPT_FROM_LINE_IN_HDRS 0.001
##} CORRUPT_FROM_LINE_IN_HDRS

##{ CTYPE_001C_A

meta CTYPE_001C_A  (0)      # obsolete
##} CTYPE_001C_A

##{ CTYPE_001C_B

header CTYPE_001C_B Content-Type =~ /multipart.{0,200}boundary=\"----=_NextPart_000_0000_01C[0-9A-F]{5}\.[0-9A-F]{7}0\"/
##} CTYPE_001C_B

##{ CTYPE_8SPACE_GIF ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader CTYPE_8SPACE_GIF Content-Type:raw =~ /^image\/gif;\n {8}name=\".+?\"$/s
describe CTYPE_8SPACE_GIF   Stock spam image part 'Content-Type' found (8 spc)
endif
##} CTYPE_8SPACE_GIF ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ CURR_PRICE

body CURR_PRICE         /\bCurrent Price:/
##} CURR_PRICE

##{ DATE_DOTS

header          DATE_DOTS               Date =~ /\d\d\.\d\d\.\d\d/
describe        DATE_DOTS               Periods in date header
##} DATE_DOTS

##{ DATE_IN_FUTURE_96_Q ifplugin Mail::SpamAssassin::Plugin::HeaderEval

ifplugin Mail::SpamAssassin::Plugin::HeaderEval
header	 DATE_IN_FUTURE_96_Q	eval:check_for_shifted_date('96', '2920')
describe DATE_IN_FUTURE_96_Q	Date: is 4 days to 4 months after Received: date
endif
##} DATE_IN_FUTURE_96_Q ifplugin Mail::SpamAssassin::Plugin::HeaderEval

##{ DATE_IN_FUTURE_Q_PLUS ifplugin Mail::SpamAssassin::Plugin::HeaderEval

ifplugin Mail::SpamAssassin::Plugin::HeaderEval
header	 DATE_IN_FUTURE_Q_PLUS	eval:check_for_shifted_date('2920', 'undef')
describe DATE_IN_FUTURE_Q_PLUS	Date: is over 4 months after Received: date
endif
##} DATE_IN_FUTURE_Q_PLUS ifplugin Mail::SpamAssassin::Plugin::HeaderEval

##{ DEAR_BENEFICIARY

body           DEAR_BENEFICIARY         /^\s?(?:Dear\s|At+(?:ention|n):?\s?)Beneficiary\b/i
describe       DEAR_BENEFICIARY         Dear Beneficiary:
#score          DEAR_BENEFICIARY         2.0
##} DEAR_BENEFICIARY

##{ DEAR_EMAIL

body	 DEAR_EMAIL	/^\s*Dear\b.{0,70}\w\@\w/i
describe DEAR_EMAIL	Message contains Dear email address
##} DEAR_EMAIL

##{ DEAR_WINNER

body DEAR_WINNER /\bdear.{1,20}winner/i
##} DEAR_WINNER

##{ DOS_ANAL_SPAM_MAILER

header DOS_ANAL_SPAM_MAILER	X-mailer =~ /^[A-Z][a-z]{6}e \d\.\d{2}$/
describe DOS_ANAL_SPAM_MAILER	X-mailer pattern common to anal porn site spam
tflags DOS_ANAL_SPAM_MAILER	publish
##} DOS_ANAL_SPAM_MAILER

##{ DOS_FIX_MY_URI

meta DOS_FIX_MY_URI             __MIMEOLE_1106 && __DOS_HAS_ANY_URI && __DOS_SINGLE_EXT_RELAY && __DOS_HI && __DOS_LINK
describe DOS_FIX_MY_URI         Looks like a "fix my obfu'd URI please" spam
##} DOS_FIX_MY_URI

##{ DOS_HIGHBIT_HDRS_BODY

meta DOS_HIGHBIT_HDRS_BODY      __FROM_NEEDS_MIME && __SUBJECT_ENCODED_B64 && __FROM_ENCODED_B64 && __SUBJECT_NEEDS_MIME && __HIGHBITS
describe DOS_HIGHBIT_HDRS_BODY  Headers need encoding and body is highbit
##} DOS_HIGHBIT_HDRS_BODY

##{ DOS_HIGH_BAT_TO_MX

meta DOS_HIGH_BAT_TO_MX		__DOS_DIRECT_TO_MX && __HIGHBITS && __LAST_UNTRUSTED_RELAY_NO_AUTH && __THEBAT_MUA
describe DOS_HIGH_BAT_TO_MX	The Bat! Direct to MX with High Bits
##} DOS_HIGH_BAT_TO_MX

##{ DOS_LET_GO_JOB

meta DOS_LET_GO_JOB	__DOS_LET_GO_JOB && __DOS_MY_OLD_JOB && __DOS_I_DRIVE_A && __DOS_TAKING_HOME
describe DOS_LET_GO_JOB	Let go from their job and now makes lots of dough!
##} DOS_LET_GO_JOB

##{ DOS_OE_TO_MX

meta DOS_OE_TO_MX		__OE_MUA && __DOS_DIRECT_TO_MX && !DOS_OE_TO_MX_IMAGE
describe DOS_OE_TO_MX		Delivered direct to MX with OE headers
##} DOS_OE_TO_MX

##{ DOS_OE_TO_MX_IMAGE

meta DOS_OE_TO_MX_IMAGE		__OE_MUA && __DOS_DIRECT_TO_MX && __ANY_IMAGE_ATTACH
describe DOS_OE_TO_MX_IMAGE	Direct to MX with OE headers and an image
##} DOS_OE_TO_MX_IMAGE

##{ DOS_OUTLOOK_TO_MX

meta DOS_OUTLOOK_TO_MX		__ANY_OUTLOOK_MUA && !__OE_MUA && __DOS_DIRECT_TO_MX && !T_DOS_OUTLOOK_TO_MX_IMAGE
describe DOS_OUTLOOK_TO_MX	Delivered direct to MX with Outlook headers
##} DOS_OUTLOOK_TO_MX

##{ DOS_RCVD_IP_TWICE_C

header DOS_RCVD_IP_TWICE_C	X-Spam-Relays-External =~ /^\s*\[ ip=(?!127)([\d.]+) [^\[]*\bhelo=(?:![\d.]{7,15}!)? [^\[]*\[ ip=\1 [^\]]*\]\s*$/
describe DOS_RCVD_IP_TWICE_C	Received from the same IP twice in a row (only one external relay; empty or IP helo)
##} DOS_RCVD_IP_TWICE_C

##{ DOS_STOCK_BAT

meta		DOS_STOCK_BAT		__THEBAT_MUA && (__DOS_BODY_STOCK || __DOS_BODY_TICKER) && (__DOS_REF_TODAY || __DOS_REF_NEXT_WK_DAY || __DOS_REF_2_WK_DAYS)
describe	DOS_STOCK_BAT		Probable pump and dump stock spam
##} DOS_STOCK_BAT

##{ DOS_STOCK_BAT2

meta		DOS_STOCK_BAT2		DOS_STOCK_BAT && (__DOS_FIN_ADVANTAGE + __DOS_STRONG_CF + __DOS_STEADY_COURSE > 2)
##} DOS_STOCK_BAT2

##{ DOS_URI_ASTERISK

uri DOS_URI_ASTERISK    m{^[Hh][Tt]{2}[Pp][Ss]?://[^/:]+(?:\*[A-Za-z0-9-]*\.|\*)[A-Za-z]{2,3}(?:\.[A-Za-z]{2})?(?:$|:|/)}
describe DOS_URI_ASTERISK       Found an asterisk in a URI
##} DOS_URI_ASTERISK

##{ DOS_YOUR_PLACE

meta	DOS_YOUR_PLACE	(__DOS_COMING_TO_YOUR_PLACE && __DOS_MEET_EACH_OTHER && (__DOS_DROP_ME_A_LINE || __DOS_CORRESPOND_EMAIL || __DOS_EMAIL_DIRECTLY || __DOS_I_AM_25 || __DOS_WRITE_ME_AT || __DOS_PERSONAL_EMAIL))
describe	DOS_YOUR_PLACE		Russian dating spam
##} DOS_YOUR_PLACE

##{ DRUGS_HDIA

header DRUGS_HDIA	Subject =~ /\bhoodia\b/i
##} DRUGS_HDIA

##{ DRUGS_STOCK_MIMEOLE

meta DRUGS_STOCK_MIMEOLE (__MIMEOLE_1106 && __MAILER_OL_5510)
describe DRUGS_STOCK_MIMEOLE Stock-spam forged headers found (5510)
##} DRUGS_STOCK_MIMEOLE

##{ DYN_RDNS_AND_INLINE_IMAGE

meta DYN_RDNS_AND_INLINE_IMAGE     (RDNS_DYNAMIC && __ANY_IMAGE_ATTACH)
describe DYN_RDNS_AND_INLINE_IMAGE Contains image, and was sent by dynamic rDNS
##} DYN_RDNS_AND_INLINE_IMAGE

##{ DYN_RDNS_SHORT_HELO_HTML

meta DYN_RDNS_SHORT_HELO_HTML      (__HELO_NO_DOMAIN && RDNS_DYNAMIC && HTML_MESSAGE)
describe DYN_RDNS_SHORT_HELO_HTML  Sent by dynamic rDNS, short HELO, and HTML
##} DYN_RDNS_SHORT_HELO_HTML

##{ DYN_RDNS_SHORT_HELO_IMAGE

meta DYN_RDNS_SHORT_HELO_IMAGE       (__HELO_NO_DOMAIN && RDNS_DYNAMIC && __ANY_IMAGE_ATTACH)
describe DYN_RDNS_SHORT_HELO_IMAGE    Short HELO string, dynamic rDNS, inline image
##} DYN_RDNS_SHORT_HELO_IMAGE

##{ FAKE_REPLY_C

meta     FAKE_REPLY_C		(__SUBJ_RE && __MISSING_REF && __NO_INR_YES_REF)
##} FAKE_REPLY_C

##{ FB_ADD_INCHES

body     FB_ADD_INCHES          /(?:add|gain) inches/i
describe FB_ADD_INCHES          Add / Gain inches
##} FB_ADD_INCHES

##{ FB_ALMOST_SEX

body     FB_ALMOST_SEX          /\b[b-z]sex+\b/i
describe FB_ALMOST_SEX          It's almost sex, but not!
##} FB_ALMOST_SEX

##{ FB_ANA_TRIM

body     FB_ANA_TRIM            /Ana[^a-z]trim/i
describe FB_ANA_TRIM            Broken AnaTrim phrase.
##} FB_ANA_TRIM

##{ FB_ANUI

body     FB_ANUI                /A[-_\.]U[-_\.]N[-_\.]I/i
describe FB_ANUI                Phrase: A_U_N_I
##} FB_ANUI

##{ FB_BILLI0N

body      FB_BILLI0N            /[BM][I1]LL[I1]0N/i
describe  FB_BILLI0N            Phrase: [BM]Illi0n
##} FB_BILLI0N

##{ FB_C0MPANY

body     FB_C0MPANY             /c0mpany/i
describe FB_C0MPANY             Phrase: C0mpany
##} FB_C0MPANY

##{ FB_CAN_LONGER

body     FB_CAN_LONGER          /can last longer/i
describe FB_CAN_LONGER          Phrase: can last longer
##} FB_CAN_LONGER

##{ FB_CIALIS_LEO3

body     FB_CIALIS_LEO3         /(?!CIALIS)\bC\s?[a-z]?\s?[Iitl1\\\/]\s?[a-z]?\s?[Aa]\s?[a-z]?\s?[LIl1\\\/]\s?[a-z]?\s?[ilIt1\\\/]\s?[a-z]?\s?[Ss]\b/
describe FB_CIALIS_LEO3         Uses a mis-spelled version of cialis.
##} FB_CIALIS_LEO3

##{ FB_DOUBLE_0WORDS

body     FB_DOUBLE_0WORDS       /\b[a-z]{1,5}0[a-z]{3,9}\s[a-z]{1,5}0[a-z]{3,9}\b/i
describe FB_DOUBLE_0WORDS       Looks like double 0 words
##} FB_DOUBLE_0WORDS

##{ FB_EMAIL_HIER

body     FB_EMAIL_HIER          /email hier/i
describe FB_EMAIL_HIER          Phrase: email hier
##} FB_EMAIL_HIER

##{ FB_EXTRA_INCHES

body     FB_EXTRA_INCHES        /extra inches/
describe FB_EXTRA_INCHES        Phrase: extra inches
##} FB_EXTRA_INCHES

##{ FB_FAKE_NUMBERS

body     FB_FAKE_NUMBERS        /\$\d\d?O\s*[MBT]/i
describe FB_FAKE_NUMBERS        Looks like numbers with O's insted of 0's
##} FB_FAKE_NUMBERS

##{ FB_FAKE_NUMS4

body     FB_FAKE_NUMS4          /(?:\b|\b\d)\d,?\d,?OO(?:\b|\d\b)/
describe FB_FAKE_NUMS4          Looks like fake numbers (4)
##} FB_FAKE_NUMS4

##{ FB_FHARMACY

body     FB_FHARMACY            /Fharmacy/i
describe FB_FHARMACY            Phrase: Farmacy
##} FB_FHARMACY

##{ FB_FORWARD_LOOK

body     FB_FORWARD_LOOK        /(?!forward look)f[o0]rward l[0o][0o]k/i
describe FB_FORWARD_LOOK        Phrase: forward look with 0's
##} FB_FORWARD_LOOK

##{ FB_GAPPY_ADDRESS

body     FB_GAPPY_ADDRESS       /(?:[a-z] ){8}, (?:[a-z0-9] ){4}/i
describe FB_GAPPY_ADDRESS       Too much spacing in Address
##} FB_GAPPY_ADDRESS

##{ FB_GET_MEDS

body     FB_GET_MEDS            /(?:place f[o0]r|[0o]rder|get\s?(?:y[o0]ur)?|online|quality).{1,7}med[isz][^a]/i
describe FB_GET_MEDS            Looks like trying to sell meds
##} FB_GET_MEDS

##{ FB_GVR

body     FB_GVR                 /(?:pef-rx|vigrex-ds|gsc-100|vp-rx|gv-promax|phentermine|adipex|xenical)/i
describe FB_GVR                 Looks like generic viagra
##} FB_GVR

##{ FB_HEY_BRO_COMMA

body     FB_HEY_BRO_COMMA       /Hey bro, /
describe FB_HEY_BRO_COMMA       Phrase hey bro,
##} FB_HEY_BRO_COMMA

##{ FB_HG_H_CAP

body     FB_HG_H_CAP            /\bHGH\b/
describe FB_HG_H_CAP            Phrase: HGH
##} FB_HG_H_CAP

##{ FB_HOMELOAN

body     FB_HOMELOAN            /\$\d{3},\d{3} home loan/i
describe FB_HOMELOAN            Phrase $x home loan
##} FB_HOMELOAN

##{ FB_IMPRESS_GIRL

body     FB_IMPRESS_GIRL        /\bimpress .{0,5}girl\b/
describe FB_IMPRESS_GIRL        Phrase: impress ... girl
##} FB_IMPRESS_GIRL

##{ FB_INCREASE_YOUR

body     FB_INCREASE_YOUR       /Increase your energy/i
describe FB_INCREASE_YOUR       Phrase: Increase your energy
##} FB_INCREASE_YOUR

##{ FB_INDEPEND_RWD

body     FB_INDEPEND_RWD        /independent reward/i
describe FB_INDEPEND_RWD        Phrase: independent reward
##} FB_INDEPEND_RWD

##{ FB_L0AN

body     FB_L0AN                /\bl0ans?\b/i
describe FB_L0AN                Phrase: L0an
##} FB_L0AN

##{ FB_LETTERS_21B

body     FB_LETTERS_21B         /-- [a-z]{21}/
describe FB_LETTERS_21B         Special people leave special signs!
##} FB_LETTERS_21B

##{ FB_LOSE_WEIGHT_CAP

body     FB_LOSE_WEIGHT_CAP     /LOSE WEIGHT/
describe FB_LOSE_WEIGHT_CAP     Phrase: LOSE WEIGHT
##} FB_LOSE_WEIGHT_CAP

##{ FB_LOWER_PAYM

body     FB_LOWER_PAYM          /lower your monthly payments/i
describe FB_LOWER_PAYM          Phrase: lower your monthly payments
##} FB_LOWER_PAYM

##{ FB_MORE_SIZE

body     FB_MORE_SIZE           /\bmore size\b/
describe FB_MORE_SIZE           Phrase: more size
##} FB_MORE_SIZE

##{ FB_NOT_PHONE_NUM1

body     FB_NOT_PHONE_NUM1      /(?!\d{3})8(?:66|77|88|[0o][0o])[-\.\s\)]{1,3}[OIL0-9]{3}[-\.\s]/i
describe FB_NOT_PHONE_NUM1      Looks like a fake phone number (1)
##} FB_NOT_PHONE_NUM1

##{ FB_NOT_PHONE_NUM3

body     FB_NOT_PHONE_NUM3      /8(?:66|77|88|[0o][0o])[-\.\s\)]{1,3}[OIL0-9]{3}[-\.\s]{1,3}(?!\d{4})[OIL0-9]{4}/i
describe FB_NOT_PHONE_NUM3      Looks like a fake phone number (3)
##} FB_NOT_PHONE_NUM3

##{ FB_NOT_SCHOOL

body     FB_NOT_SCHOOL          /(?!school)[\$s5]ch[o0][o0][il1\|]/i
describe FB_NOT_SCHOOL          Looks like school but it's not!
##} FB_NOT_SCHOOL

##{ FB_NO_SCRIP_NEEDED

body     FB_NO_SCRIP_NEEDED     /No.{1,10}P(?:er|re)scr[i1]pt[i1][o0]n (?:needed|requ[1i]re)/i
describe FB_NO_SCRIP_NEEDED     Phrase: no prescription needed.
##} FB_NO_SCRIP_NEEDED

##{ FB_NUMYO

body     FB_NUMYO               /1[0-9][\s\.]?y[\s\.]?o[\s\.]?\b/i
describe FB_NUMYO               Speaks of teenager.
##} FB_NUMYO

##{ FB_NUMYO2

body     FB_NUMYO2              /2[0-9][\s\.]?y[\s\.]?o[\s\.]?\b/i
describe FB_NUMYO2              Speaks of 20+ year old.
##} FB_NUMYO2

##{ FB_ODD_SPACED_MONEY

body     FB_ODD_SPACED_MONEY    /\$\d\s,\s\d\d/
describe FB_ODD_SPACED_MONEY    Looks like money but has odd spacing.
##} FB_ODD_SPACED_MONEY

##{ FB_ONIINE

body     FB_ONIINE              /oniine/i
describe FB_ONIINE              Mis-spelled online
##} FB_ONIINE

##{ FB_P1LL

body     FB_P1LL                /\bp1ll/i
describe FB_P1LL                Phrase: p1ll
##} FB_P1LL

##{ FB_PENIS_GROWTH

body     FB_PENIS_GROWTH        /pen[i1]s grow(?:th)?/i
describe FB_PENIS_GROWTH        Phrase: penis growth
##} FB_PENIS_GROWTH

##{ FB_PIPEDOLLAR

body     FB_PIPEDOLLAR          /(?!dollar)d[o0][1|li][1|li]ar/i
describe FB_PIPEDOLLAR          Phrase: Dollar, with pipes or 0's.
##} FB_PIPEDOLLAR

##{ FB_PIPE_ILLION

body     FB_PIPE_ILLION         /(?!illion)i[l|][l|][i|][o0]n/i
describe FB_PIPE_ILLION         Looks like illion, but it's not
##} FB_PIPE_ILLION

##{ FB_PROLONGED_HARD

body     FB_PROLONGED_HARD      /(?:prolonged|increased) hardness/i
describe FB_PROLONGED_HARD      Talks about prolonged hardness
##} FB_PROLONGED_HARD

##{ FB_QUALITY_REPLICA

body     FB_QUALITY_REPLICA     /quality replica/i
describe FB_QUALITY_REPLICA     Phrase: quality replica
##} FB_QUALITY_REPLICA

##{ FB_REF_CODE_SPACE

body     FB_REF_CODE_SPACE      /r e f c o d e/i
describe FB_REF_CODE_SPACE      Refcode with spacing
##} FB_REF_CODE_SPACE

##{ FB_REPLICA_ROLEX

body     FB_REPLICA_ROLEX       /replica rolex/i
describe FB_REPLICA_ROLEX       Phrase: Replica Rolex
##} FB_REPLICA_ROLEX

##{ FB_REPLIC_CAP

body     FB_REPLIC_CAP          /REPLICAS?\b/
describe FB_REPLIC_CAP          Phrase: REPLICA
##} FB_REPLIC_CAP

##{ FB_RE_FI

body     FB_RE_FI               /\bre[^a-z]fi\b/
describe FB_RE_FI               Looks like refi.
##} FB_RE_FI

##{ FB_ROLLER_IS_T

body     FB_ROLLER_IS_T         /Roller is th/i
describe FB_ROLLER_IS_T         Phrase: Roller is th
##} FB_ROLLER_IS_T

##{ FB_ROLX

body     FB_ROLX                /\brolx\b/i
describe FB_ROLX                Phrase: rolx
##} FB_ROLX

##{ FB_SAVE_PERSC

body     FB_SAVE_PERSC          /sav(?:e|ing).{1,45}p[re][re]scr[i1]pt[i1][o0]n/i
describe FB_SAVE_PERSC          Phrase: save ... prescription.
##} FB_SAVE_PERSC

##{ FB_SOFTTABS

body     FB_SOFTTABS            /\bsoft\s?t?abs\b/i
describe FB_SOFTTABS            Phrase: Softabs
##} FB_SOFTTABS

##{ FB_SPACED_FREE

body     FB_SPACED_FREE         /F R E E/i
describe FB_SPACED_FREE         Phrase: F R E E
##} FB_SPACED_FREE

##{ FB_SPACED_PHN_3B

body     FB_SPACED_PHN_3B       /\d\d\d--\d\d\d--?\d\d\d\d/
describe FB_SPACED_PHN_3B       Phone number with -- spacing. (B)
##} FB_SPACED_PHN_3B

##{ FB_SPACEY_ZIP

body     FB_SPACEY_ZIP          /\s\d\s\d\s\d\s\d\s\d\s-\s\d\s\d\s\d\s\d/
describe FB_SPACEY_ZIP          Looks like a  s p a c e d zipcode.
##} FB_SPACEY_ZIP

##{ FB_SPUR_M

body     FB_SPUR_M              /\bSPUR-M\b/i
describe FB_SPUR_M              Phrase: SPUR-M
##} FB_SPUR_M

##{ FB_SSEX

body     FB_SSEX                /\bssex\b/
describe FB_SSEX                Phrase: ssex
##} FB_SSEX

##{ FB_STOCK_EXPLODE

body     FB_STOCK_EXPLODE        /st[0o]ck\b.{4,10}expl[o0]de/i
describe FB_STOCK_EXPLODE       Looks like stocks exploding.
##} FB_STOCK_EXPLODE

##{ FB_SYMBLO

body     FB_SYMBLO              /\bSymblo\b/i
describe FB_SYMBLO              Mis-spelled symbol.
##} FB_SYMBLO

##{ FB_THIS_ADVERT

body     FB_THIS_ADVERT         /this advertiser/i
describe FB_THIS_ADVERT         Phrase: this advertiser
##} FB_THIS_ADVERT

##{ FB_THOUS_PERSONAL

body     FB_THOUS_PERSONAL      /thousand personal/i
describe FB_THOUS_PERSONAL      Phrase: thousand personal
##} FB_THOUS_PERSONAL

##{ FB_TO_STOP_DISTRO

body     FB_TO_STOP_DISTRO      /To (?:(?:stop further|longer get) distribution|stop (?:receiving )?announcements)/i
describe FB_TO_STOP_DISTRO      Phrase: to stop further distribution
##} FB_TO_STOP_DISTRO

##{ FB_ULTRA_ALLURE

body     FB_ULTRA_ALLURE        /Ultra Allure/i
describe FB_ULTRA_ALLURE        Phrase: Ultra Allure
##} FB_ULTRA_ALLURE

##{ FB_UNLOCK_YOUR_G

body     FB_UNLOCK_YOUR_G       /lock ?(?:to ?)? your girlfriend/i
describe FB_UNLOCK_YOUR_G       Phrase: lock to your girlfriend
##} FB_UNLOCK_YOUR_G

##{ FB_UNRESOLV_PROV

body     FB_UNRESOLV_PROV       /\{PROV_\d_\d\}/
describe FB_UNRESOLV_PROV       Pattern Replacement PROV_D
##} FB_UNRESOLV_PROV

##{ FB_YOURSELF_MASTER

body     FB_YOURSELF_MASTER     /yourself master/i
describe FB_YOURSELF_MASTER     Phrase: yourself master
##} FB_YOURSELF_MASTER

##{ FB_YOUR_REFI

body     FB_YOUR_REFI           /Your refi/i
describe FB_YOUR_REFI           Phrase: Your refi
##} FB_YOUR_REFI

##{ FH_BAD_OEV1441

header   FH_BAD_OEV1441         X-Mailer =~ /^Microsoft Outlook Express 6\.00\.2800\.1441$/
describe FH_BAD_OEV1441         Bad X-Mailer version
##} FH_BAD_OEV1441

##{ FH_DATE_IS_19XX

header   FH_DATE_IS_19XX        Date =~ /19[789][0-9]/ [if-unset: 2006]
describe FH_DATE_IS_19XX        The date is not 19xx.
##} FH_DATE_IS_19XX

##{ FH_FAKE_RCVD_LINE

header   FH_FAKE_RCVD_LINE      Received =~ /from\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s*by\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3};\s*[SMTWF].{2},\s*\d{1,2}\s*[JFMASOND].{2,5}\s*\d{4}\s*\d{2}:\d{2}:\d{2}\s*[-+]\d{4}/
describe FH_FAKE_RCVD_LINE      RCVD line looks faked (A)
##} FH_FAKE_RCVD_LINE

##{ FH_FAKE_RCVD_LINE_B

header   FH_FAKE_RCVD_LINE_B    Received =~ /from\s*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s*by\s*[a-z0-9.]{4,24}\.[a-z0-9.]{4,36}\.(?:com|net|org|biz);\s*[SMTWF].{2},\s*\d{1,2}\s*[JFMASOND].{2,5}\s*\d{4}\s*\d{2}:\d{2}:\d{2}\s*[-+]\d{4}/i
describe FH_FAKE_RCVD_LINE_B    RCVD line looks faked (B)
##} FH_FAKE_RCVD_LINE_B

##{ FH_FROMEML_NOTLD

header   FH_FROMEML_NOTLD       From:addr !~ /\./ [if-unset: foo@bar.com]
describe FH_FROMEML_NOTLD       E-mail address doesn't have TLD (.com, etc.)
##} FH_FROMEML_NOTLD

##{ FH_FROM_CASH

header   FH_FROM_CASH           From:name =~ /\bcash\b/i
describe FH_FROM_CASH           From name has "cash"
##} FH_FROM_CASH

##{ FH_FROM_GET_NAME

header   FH_FROM_GET_NAME       From:name =~ /\bGet\b/i
describe FH_FROM_GET_NAME       From name says Get
##} FH_FROM_GET_NAME

##{ FH_FROM_GIVEAWAY

header   FH_FROM_GIVEAWAY       From =~ /Giveaway/i
describe FH_FROM_GIVEAWAY       From name is giveaway.
##} FH_FROM_GIVEAWAY

##{ FH_FROM_HOODIA

header   FH_FROM_HOODIA         From =~ /Hoodia/i
describe FH_FROM_HOODIA         From has Hoodia!!?
##} FH_FROM_HOODIA

##{ FH_HAS_XAIMC

header   FH_HAS_XAIMC           exists:X-AIMC-AUTH
describe FH_HAS_XAIMC           Has X-AIMC-AUTH header
##} FH_HAS_XAIMC

##{ FH_HAS_XID

header   FH_HAS_XID             exists:X-ID
describe FH_HAS_XID             Has X-ID
##} FH_HAS_XID

##{ FH_HELO_ALMOST_IP

header   FH_HELO_ALMOST_IP      X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+[a-z][-.]\d{1,3}[-.]\d{1,3}[-.]\d{1,3}[-.][a-z][^ ]+ /i
describe FH_HELO_ALMOST_IP      Helo is almost an IP addr.
##} FH_HELO_ALMOST_IP

##{ FH_HELO_ENDS_DOT

header   FH_HELO_ENDS_DOT       X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+\. by=/
describe FH_HELO_ENDS_DOT       Helo ends with a dot.
##} FH_HELO_ENDS_DOT

##{ FH_HELO_EQ_610HEX

header   FH_HELO_EQ_610HEX      X-Spam-Relays-External =~ /^[^\]]+ helo=-?[A-F0-9]{6,10} /
describe FH_HELO_EQ_610HEX      Helo is 6-10 hex chr's.
##} FH_HELO_EQ_610HEX

##{ FH_HELO_EQ_CHARTER

header   FH_HELO_EQ_CHARTER     X-Spam-Relays-External =~ /^[^\]]+ helo=\d{2,3}-\d{1,3}-\d{1,3}-\d{1,3}.{5,20}\.charter\.com /i
describe FH_HELO_EQ_CHARTER     Helo is d-d-d-d charter.com
##} FH_HELO_EQ_CHARTER

##{ FH_HELO_EQ_D_D_D_D

header   FH_HELO_EQ_D_D_D_D     X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]{0,15}\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3}/
describe FH_HELO_EQ_D_D_D_D     Helo is d-d-d-d
##} FH_HELO_EQ_D_D_D_D

##{ FH_HELO_GMAILSMTP

header   FH_HELO_GMAILSMTP      Received =~ /HELO gmail-smtp-in/
describe FH_HELO_GMAILSMTP      Faked helo of gmail-smtp-in
##} FH_HELO_GMAILSMTP

##{ FH_HOST_EQ_DYNAMICIP

header   FH_HOST_EQ_DYNAMICIP   X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]{0,25}[dD][yY][nN][aA][mM][iI][cC][iI][pP][^ ]{5,25} helo=/
describe FH_HOST_EQ_DYNAMICIP   Host is dynamicip
##} FH_HOST_EQ_DYNAMICIP

##{ FH_HOST_EQ_PACBELL_D

header   FH_HOST_EQ_PACBELL_D   X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.dsl\.\w{2,10}\.pacbell\.net /
describe FH_HOST_EQ_PACBELL_D   Host is pacbell.net dsl
##} FH_HOST_EQ_PACBELL_D

##{ FH_HOST_EQ_VERIZON_P

header   FH_HOST_EQ_VERIZON_P   X-Spam-Relays-External =~ /^[^\]]+ rdns=pool-\d.{5,30}\.verizon\.net/
describe FH_HOST_EQ_VERIZON_P   Host is pool-.+verizon.net
##} FH_HOST_EQ_VERIZON_P

##{ FH_HOST_IN_ADDRARPA

header   FH_HOST_IN_ADDRARPA    X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]{0,25}\.in-addr\.arpa /
describe FH_HOST_IN_ADDRARPA    HOST dns says "in-addr.arpa"
##} FH_HOST_IN_ADDRARPA

##{ FH_MSGID_000000

header   FH_MSGID_000000        MESSAGEID =~ /\$00000000\@/
describe FH_MSGID_000000        Special MSGID
##} FH_MSGID_000000

##{ FH_MSGID_01C67

header   FH_MSGID_01C67         Message-ID =~ /^<000001c[67]/
describe FH_MSGID_01C67         Special MSGID
##} FH_MSGID_01C67

##{ FH_MSGID_01C70XXX

header   FH_MSGID_01C70XXX      MESSAGEID =~ /^<01c70[a-f][a-f0-9]{2}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[a-zA-Z0-9-]+>$/
describe FH_MSGID_01C70XXX      MESSAGE ID seen often!!!
##} FH_MSGID_01C70XXX

##{ FH_MSGID_REPLACE

header   FH_MSGID_REPLACE       MESSAGEID =~ /^<%MSGID/
describe FH_MSGID_REPLACE       Broken Replace Template
##} FH_MSGID_REPLACE

##{ FH_MSGID_XXBLAH

header   FH_MSGID_XXBLAH        MESSAGEID =~ /6c822ecf/
describe FH_MSGID_XXBLAH        Common sign in msg-id's 12/21/2006
##} FH_MSGID_XXBLAH

##{ FH_MSGID_XXX

header   FH_MSGID_XXX           MESSAGEID =~ /\@xxx/i
describe FH_MSGID_XXX           Message-Id = @xxx
##} FH_MSGID_XXX

##{ FH_RE_NEW_DDD

header   FH_RE_NEW_DDD          Subject =~ /^Re: new\s?\d{0,3}$/i
describe FH_RE_NEW_DDD          Subject is Re: new \d\d\d
##} FH_RE_NEW_DDD

##{ FH_XMAIL_REPLACE

header   FH_XMAIL_REPLACE       X-Mailer =~ /%XMAILER/
describe FH_XMAIL_REPLACE       Broken Replace Template
##} FH_XMAIL_REPLACE

##{ FILL_THIS_FORM_FRAUD_PHISH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  describe FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
  meta     FILL_THIS_FORM_FRAUD_PHISH (T_FILL_THIS_FORM || T_FILL_THIS_FORM_SHORT) && __FILL_THIS_FORM_FRAUD_PHISH
#  score    FILL_THIS_FORM_FRAUD_PHISH 1.50
endif
##} FILL_THIS_FORM_FRAUD_PHISH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FILL_THIS_FORM_LOAN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  describe FILL_THIS_FORM_LOAN Answer loan question(s)
  meta     FILL_THIS_FORM_LOAN T_FILL_THIS_FORM && __FILL_THIS_FORM_LOAN
#  score    FILL_THIS_FORM_LOAN 0.50
endif
##} FILL_THIS_FORM_LOAN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FILL_THIS_FORM_LONG ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     FILL_THIS_FORM_LONG /(?:<FF_LNNO>?<FF_YOUR><FF_ALL><FF_SUFFIX>(?:<FF_BLANK2>|<ANDOR>)){5,}/i
  describe FILL_THIS_FORM_LONG    Fill in a form with personal information
#  score    FILL_THIS_FORM_LONG    1.00
endif
##} FILL_THIS_FORM_LONG ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FM_DOESNT_SAY_STOCK

meta     FM_DOESNT_SAY_STOCK    (__FB_S_SYMBOL && __FM_MY_PRICE && !__FB_S_STOCK && !__FS_S_TRADE)
describe FM_DOESNT_SAY_STOCK    It's a stock spam but doesn't say stock
##} FM_DOESNT_SAY_STOCK

##{ FM_FAKE_53COM_SPOOF

meta     FM_FAKE_53COM_SPOOF    (__FH_FRM_53 && !__FH_MSG_53 && !__FH_RCV_53)
describe FM_FAKE_53COM_SPOOF    Spoof mail from 53.com?
##} FM_FAKE_53COM_SPOOF

##{ FM_FAKE_HELO_HOTMAIL

meta     FM_FAKE_HELO_HOTMAIL   (__HOTMAILCOM && !__HOST_HOTMAIL)
describe FM_FAKE_HELO_HOTMAIL   Looks like a fake hotmail.com helo.
##} FM_FAKE_HELO_HOTMAIL

##{ FM_FAKE_HELO_VERIZON

meta     FM_FAKE_HELO_VERIZON   (__FHELO_VERIZON && !__FHOST_VERIZON)
describe FM_FAKE_HELO_VERIZON   Looks like a fake verizon.net helo.
##} FM_FAKE_HELO_VERIZON

##{ FM_FRM_RN_L_BRACK

meta     FM_FRM_RN_L_BRACK      (__FROM_RIGH_BRACK && !__FROM_LEFT_BRACK && !__FROM_ISO_2022_JP)
describe FM_FRM_RN_L_BRACK      From name has > but not <
##} FM_FRM_RN_L_BRACK

##{ FM_IS_IT_OUR_ACCOUNT

meta     FM_IS_IT_OUR_ACCOUNT   (__YOUR_ACCOUNT && __MANY_RECIPS)
describe FM_IS_IT_OUR_ACCOUNT   Is it our account?
##} FM_IS_IT_OUR_ACCOUNT

##{ FM_LIKE_STOCKS

meta     FM_LIKE_STOCKS         (__FM_STOCK_WORDS && !__FB_S_STOCK && __FB_S_SYMBOL)
describe FM_LIKE_STOCKS         It looks like a duck, it's a duck!
##} FM_LIKE_STOCKS

##{ FM_LOTTO_YOU_WON

meta     FM_LOTTO_YOU_WON       (__FM_LARGE_MONEY && __FM_NAT_LOTTERY && __YOU_WON_SOMTIN)
describe FM_LOTTO_YOU_WON       Talks about lotto and you won!
##} FM_LOTTO_YOU_WON

##{ FM_LUX_GIFTS_REDUCED

meta     FM_LUX_GIFTS_REDUCED   (__FB_LUX_GIFTS && __FB_NUM_PERCNT)
describe FM_LUX_GIFTS_REDUCED   Luxury Gifts with dd%
##} FM_LUX_GIFTS_REDUCED

##{ FM_MANY_DRUG_WORDS

meta     FM_MANY_DRUG_WORDS     (__VA_WORD && __CS_WORD && __VM_WORD)
describe FM_MANY_DRUG_WORDS     Lot's of almost drug words
##} FM_MANY_DRUG_WORDS

##{ FM_MORTGAGE5PLUS

meta     FM_MORTGAGE5PLUS       (__FM_MORTGAGE5PLUS && !__FM_MORTGAGE6PLUS)
describe FM_MORTGAGE5PLUS       Looks like a mortgage spam (5+)
##} FM_MORTGAGE5PLUS

##{ FM_MORTGAGE6PLUS

meta     FM_MORTGAGE6PLUS       (__FM_MORTGAGE6PLUS)
describe FM_MORTGAGE6PLUS       Looks like a mortgage spam (6+)
##} FM_MORTGAGE6PLUS

##{ FM_MULTI_LUX_GIFTS

meta     FM_MULTI_LUX_GIFTS     ((__FB_BRAND_NAME + __FB_TIMEPIECE + __FB_WALLETS + __FB_HANDBAGS + __FB_DESIGNER + __FB_LUX_GIFTS + __FB_NUM_PERCNT + __FB_INK_PEN) > 3)
describe FM_MULTI_LUX_GIFTS     Talks about variety of luxury gifts
##} FM_MULTI_LUX_GIFTS

##{ FM_PHN_NODNS

meta     FM_PHN_NODNS           (FB_SPACED_PHN_3B && RDNS_NONE)
describe FM_PHN_NODNS           Phone spacing + no dns
##} FM_PHN_NODNS

##{ FM_RATSIGN_1106

meta     FM_RATSIGN_1106        (__MSGID_VGA && __DATE_700)
describe FM_RATSIGN_1106        Fingerprint seen in lots of spam. 11/2006
##} FM_RATSIGN_1106

##{ FM_RE_HELLO_SPAM

meta     FM_RE_HELLO_SPAM       (__FH_MSGID_01C7 && __FH_HAS_XMSMAIL && __FH_HAS_XPRIORITY && __FS_SUBJ_RE)
describe FM_RE_HELLO_SPAM       Re: Hello / hi
##} FM_RE_HELLO_SPAM

##{ FM_ROLEX_ADS

meta     FM_ROLEX_ADS           (__FB_ROLEX_MEN && __FB_ROLEX_WMEN && __FB_OMEGA && __FB_GLASHUTE)
describe FM_ROLEX_ADS           Looks like Rolex spams.
##} FM_ROLEX_ADS

##{ FM_SCHOOLING

meta     FM_SCHOOLING           ((__BACHELORS + __MASTERS + __MBA + __PHD) > 2)
describe FM_SCHOOLING           Meta Combo Phrase for Schooling (2)
##} FM_SCHOOLING

##{ FM_SCHOOL_DIPLOMA

meta     FM_SCHOOL_DIPLOMA      (FM_SCHOOLING && __DIPLOMA)
describe FM_SCHOOL_DIPLOMA      Meta for Schooling + Diploma.
##} FM_SCHOOL_DIPLOMA

##{ FM_SCHOOL_TYPES

meta     FM_SCHOOL_TYPES        (__FB_BA && __FB_BCs && __FB_MA && __FB_MBA)
describe FM_SCHOOL_TYPES        Meta Combo Phrase for Schooling
##} FM_SCHOOL_TYPES

##{ FM_SEX_HELODDDD

meta     FM_SEX_HELODDDD        (__SEX_WRDS && FH_HELO_EQ_D_D_D_D)
describe FM_SEX_HELODDDD        Sex words + helo = dddd
##} FM_SEX_HELODDDD

##{ FM_SUBJ_APPROVE

meta     FM_SUBJ_APPROVE        (__EXCLAIM_SUBJ && __SUBJ_APPROVE)
describe FM_SUBJ_APPROVE        Subject has Approve and !
##} FM_SUBJ_APPROVE

##{ FM_TRUE_LOV_ALL_N

meta     FM_TRUE_LOV_ALL_N      (__FB_P_TRUELOVE && __FB_P_ALLNIGHT)
describe FM_TRUE_LOV_ALL_N      True Love all Night!
##} FM_TRUE_LOV_ALL_N

##{ FM_VEGAS_CASINO

meta     FM_VEGAS_CASINO        ((__FROM_VEGAS + __SUBJ_3DIGIT + __SUBJ_VEGAS + __FB_GAME) > 2)
describe FM_VEGAS_CASINO        Looks like vega casino spam
##} FM_VEGAS_CASINO

##{ FM_XMAIL_F_OUT

header   FM_XMAIL_F_OUT         X-Mailer =~ /Microsoft Outlook Express V6.00.2900.2180/
describe FM_XMAIL_F_OUT         Looks like Fake Outlook?
##} FM_XMAIL_F_OUT

##{ FORGED_TBIRD_IMG_ARROW

meta       FORGED_TBIRD_IMG_ARROW  __FORGED_TBIRD_IMG && __TO_NO_ARROWS_R && !__TO_UNDISCLOSED
describe   FORGED_TBIRD_IMG_ARROW  Likely forged Thunderbird image spam
#score      FORGED_TBIRD_IMG_ARROW  0.8
##} FORGED_TBIRD_IMG_ARROW

##{ FORGED_TBIRD_IMG_SIZE ifplugin Mail::SpamAssassin::Plugin::ImageInfo

ifplugin Mail::SpamAssassin::Plugin::ImageInfo
  meta       FORGED_TBIRD_IMG_SIZE   __FORGED_TBIRD_IMG && __ONE_IMG && __IMG_LE_300K
  describe   FORGED_TBIRD_IMG_SIZE   Likely forged Thunderbird image spam
#  score      FORGED_TBIRD_IMG_SIZE   0.8
endif
##} FORGED_TBIRD_IMG_SIZE ifplugin Mail::SpamAssassin::Plugin::ImageInfo

##{ FORGED_TBIRD_IMG_TO_MX

meta       FORGED_TBIRD_IMG_TO_MX  __FORGED_TBIRD_IMG && __DOS_DIRECT_TO_MX
describe   FORGED_TBIRD_IMG_TO_MX  Likely forged Thunderbird image spam
#score      FORGED_TBIRD_IMG_TO_MX  2.5
##} FORGED_TBIRD_IMG_TO_MX

##{ FORM_FRAUD_3

meta     FORM_FRAUD_3  (T_FILL_THIS_FORM || T_FILL_THIS_FORM_SHORT) && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AFR_UNION + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH +  __BARRISTER + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER + __FEES + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + T_LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRUNK_BOX +  __UN + __UNCLAIMED + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 3)
#score    FORM_FRAUD_3  1.00
describe FORM_FRAUD_3  Fill a form and several fraud phrases
##} FORM_FRAUD_3

##{ FORM_FRAUD_5

meta     FORM_FRAUD_5  (T_FILL_THIS_FORM || T_FILL_THIS_FORM_SHORT) && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AFR_UNION + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH +  __BARRISTER + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER + __FEES + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + T_LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRUNK_BOX +  __UN + __UNCLAIMED + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 5)
#score    FORM_FRAUD_5  1.00
describe FORM_FRAUD_5  Fill a form and many fraud phrases
##} FORM_FRAUD_5

##{ FROM_41_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
  meta         FROM_41_FREEMAIL         (NSL_ORIG_FROM_41 || NSL_RCVD_FROM_41) && (FREEMAIL_FROM || FREEMAIL_REPLYTO)
  describe     FROM_41_FREEMAIL         Sent from Africa + freemail provider
#  score        FROM_41_FREEMAIL         0.25
endif
##} FROM_41_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ FROM_MISSP_DYNIP

meta           FROM_MISSP_DYNIP      __FROM_RUNON && RDNS_DYNAMIC
describe       FROM_MISSP_DYNIP      From misspaced + dynamic rDNS
#score          FROM_MISSP_DYNIP      2.0
##} FROM_MISSP_DYNIP

##{ FROM_MISSP_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
  meta         FROM_MISSP_FREEMAIL   __FROM_RUNON && (FREEMAIL_FROM || FREEMAIL_REPLYTO)
  describe     FROM_MISSP_FREEMAIL   From misspaced + freemail provider
#  score        FROM_MISSP_FREEMAIL   2.0
endif
##} FROM_MISSP_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ FROM_MISSP_MSFT

meta           FROM_MISSP_MSFT       __FROM_RUNON && (__ANY_OUTLOOK_MUA || __HAS_MIMEOLE || __MIMEOLE_MS)
describe       FROM_MISSP_MSFT       From misspaced + supposed Microsoft tool
#score          FROM_MISSP_MSFT       3.5
##} FROM_MISSP_MSFT

##{ FRT_ADOBE2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_ADOBE2             /<inter W0><post P2>\b(?!adobe)<A><D><O><B><E>\b/i
describe FRT_ADOBE2             ReplaceTags: Adobe
endif
##} FRT_ADOBE2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_APPROV ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_APPROV             /<inter sP2><post P2>\b(?!approv)<A><P><P><R><O><V>/i
describe FRT_APPROV             ReplaceTags: Approve
endif
##} FRT_APPROV ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_BIGGERMEM1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_BIGGERMEM1         /<inter SP2><post P2>(?:<B><IX><GX><GX><E><R>|<L><A><R><GX><E><R>).{1,8}(?:<P><E><N><IX><SX>|<B><R><E><A><SX><TX>|<M><E><M><B><E><R>)/i
describe FRT_BIGGERMEM1         ReplaceTags: Bigger / Larger, Penis / Member
endif
##} FRT_BIGGERMEM1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_DIPLOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_DIPLOMA            /<inter SP2><post P2>\b(?!diploma)<D><IX><P><L><O><M><A>/i
describe FRT_DIPLOMA            ReplaceTags: Diploma
endif
##} FRT_DIPLOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_DISCOUNT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_DISCOUNT           /<inter SP2><post P2>\b(?!discount)<D><IX><SX><C><O><U><N><TX>/i
describe FRT_DISCOUNT           ReplaceTags: Discount
endif
##} FRT_DISCOUNT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_DOLLAR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_DOLLAR             /<inter SP2><post P2>\b(?!dollar)<D><O><L><L><A><R>/i
describe FRT_DOLLAR             ReplaceTags: Dollar
endif
##} FRT_DOLLAR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_ESTABLISH2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_ESTABLISH2         /<inter W0><post P2>\b(?!estabi?lish)<E><SX><TX><A><B><L><IX><SX><H>/i
describe FRT_ESTABLISH2         ReplaceTags: Establish (2)
endif
##} FRT_ESTABLISH2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_FUCK2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_FUCK2              /<inter W0><post P2>\b(?!fuck)<F><U><C><K>/i
describe FRT_FUCK2              ReplaceTags: Fuck (2)
endif
##} FRT_FUCK2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_GUARANTEE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_GUARANTEE1         /<inter SP2><post P2>(?!guarantee)<GX><U><A><R><A><N><TX><E><E>/i
describe FRT_GUARANTEE1         ReplaceTags: Guarantee (1)
endif
##} FRT_GUARANTEE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_INVESTOR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_INVESTOR           /<inter SP2><post P2>\b(?!investor)<IX><N><V><E><SX><TX><O><R>/i
describe FRT_INVESTOR           ReplaceTags: Investor
endif
##} FRT_INVESTOR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_LEVITRA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_LEVITRA            /<inter W0><post P2>(?!levitra)<L><E><V><IX><TX><R><A>/i
describe FRT_LEVITRA            ReplaceTags: Levitra
endif
##} FRT_LEVITRA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_MEETING ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_MEETING            /<inter SP2><post P2>\b(?!meeting)<M><E><E><TX><IX><N><GX>\b/i
describe FRT_MEETING            ReplaceTags: Meeting
endif
##} FRT_MEETING ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_OFFER2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_OFFER2             /<inter W0><post P2>\b(?!offer)<O><F><F><E><R>/i
describe FRT_OFFER2             ReplaceTags: Offer (2)
endif
##} FRT_OFFER2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_OPPORTUN2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_OPPORTUN2          /<inter W0><post P2>(?!opportun)<O><P><P><O><R><TX><U><N>/i
describe FRT_OPPORTUN2          ReplaceTags: Oppertun (2)
endif
##} FRT_OPPORTUN2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_PENIS1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_PENIS1             /<inter SP2><post P2>\b(?!pen\s?is)(?!penny[ ']?s)<P><E><N><IX><SX>\b/i
describe FRT_PENIS1             ReplaceTags: Penis
endif
##} FRT_PENIS1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_PRICE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_PRICE              /<inter SP2><post P2>\b(?!price)<P><R><IX><C><E>\b/i
describe FRT_PRICE              ReplaceTags: Price
endif
##} FRT_PRICE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_REFINANCE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_REFINANCE1         /<inter SP2><post P2>\b(?!refinanc)<R><E><F><IX><N><A><N><C>/i
describe FRT_REFINANCE1         ReplaceTags: Refinance (1)
endif
##} FRT_REFINANCE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_ROLEX ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_ROLEX              /<inter SP2><post P2>\b(?!rolex)<R><O><L><E><X>/i
describe FRT_ROLEX              ReplaceTags: Rolex
endif
##} FRT_ROLEX ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_SEXUAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_SEXUAL             /<inter SP2><post P2>\b(?!sexual)<SX><E><X><U><A><L>/i
describe FRT_SEXUAL             ReplaceTags: Sexual
endif
##} FRT_SEXUAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_SOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_SOMA               /<post P2>\b(?!soma|500mg)<SX><O><M><A>\b/i
describe FRT_SOMA               ReplaceTags: Soma
endif
##} FRT_SOMA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_SOMA2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_SOMA2              /<inter SP2><post P2>\b(?!soma|500? ?mg)<SX><O><M><A>\b/i
describe FRT_SOMA2              ReplaceTags: Soma (2)
endif
##} FRT_SOMA2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_STRONG1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_STRONG1            /<inter SP2><post P2>\b(?!stro\s?ng)<SX><TX><R><O><N><GX>\b/i
describe FRT_STRONG1            ReplaceTags: Strong (1)
endif
##} FRT_STRONG1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_STRONG2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_STRONG2            /<inter W0><post P2>\b(?!strong)<SX><TX><R><O><N><GX>\b/i
describe FRT_STRONG2            ReplaceTags: Strong (2)
endif
##} FRT_STRONG2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_SYMBOL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_SYMBOL             /<inter SP2><post P2>\b(?!symbol)<SX><Y><M><B><O><L>/i
describe FRT_SYMBOL             ReplaceTags: Symbol
endif
##} FRT_SYMBOL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_TODAY2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_TODAY2             /<inter W0><post P2>\b(?!today)<TX><O><D><A><Y>/i
describe FRT_TODAY2             ReplaceTags: Today (2)
endif
##} FRT_TODAY2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_VALIUM1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_VALIUM1 /<inter W0><post P2>\b(?!valium|verifiquem)<V><A><L><I><U><M>\b/i
describe FRT_VALIUM1            ReplaceTags: Valium
endif
##} FRT_VALIUM1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_VALIUM2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FRT_VALIUM2 /<inter SP2><post P2>\b(?!valium)<V><A><L><I><U><M>\b/i
describe FRT_VALIUM2            ReplaceTags: Valium (2)
endif
##} FRT_VALIUM2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_WEIGHT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_WEIGHT2            /<inter W0><post P2>\b(?!weight)<WX><E><IX><GX><H><TX>/i
describe FRT_WEIGHT2            ReplaceTags: Weight (2)
endif
##} FRT_WEIGHT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_XANAX1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_XANAX1             /<inter W0><post P2>\b(?!xanax)<X><A><N><A><X>\b/i
describe FRT_XANAX1             ReplaceTags: Xanax (1)
endif
##} FRT_XANAX1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FRT_XANAX2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     FRT_XANAX2             /<inter SP2><post P2>\b(?!xanax)<X><A><N><A><X>\b/i
describe FRT_XANAX2             ReplaceTags: Xanax (2)
endif
##} FRT_XANAX2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FR_3TAG_3TAG

rawbody  FR_3TAG_3TAG           m'<[abcefghijklmnoqstuvwxz]{3}></[abcefghijklmnoqstuvwxz]{3}>'i
describe FR_3TAG_3TAG           Looks like 3 <e> small tags.
##} FR_3TAG_3TAG

##{ FR_ALMOST_VIAG2

rawbody  FR_ALMOST_VIAG2        /[^a-z](?!viagra)v?ia.?g.?ra/i
describe FR_ALMOST_VIAG2        Almost looks like viagra.
##} FR_ALMOST_VIAG2

##{ FR_CANTSEETEXT

rawbody  FR_CANTSEETEXT         /class="?cantseetext/i
describe FR_CANTSEETEXT         Phrase class=cantseetext
##} FR_CANTSEETEXT

##{ FR_MIDER

rawbody  FR_MIDER               m'http[^ ]{5,30}/gall?/'
describe FR_MIDER               Sign often seen in spams
##} FR_MIDER

##{ FR_TITLE_CONS_6

rawbody  FR_TITLE_CONS_6        m'<title>.{0,4}[bcdfgjklmnpqrstvwxyz]{6}.{0,25}</title>'i
describe FR_TITLE_CONS_6        Title Attribute has 6 non-vowels.
##} FR_TITLE_CONS_6

##{ FR_TITLE_NUMS

rawbody  FR_TITLE_NUMS          m'<title>\d+</title>'i
describe FR_TITLE_NUMS          HTML Title is only numbers
##} FR_TITLE_NUMS

##{ FSL_FAKE_GMAIL_RCVD

header	FSL_FAKE_GMAIL_RCVD	X-Spam-Relays-External =~ /gmail-smtp-in\.l\.google\.com/
#score	FSL_FAKE_GMAIL_RCVD	0.001
##} FSL_FAKE_GMAIL_RCVD

##{ FSL_FAKE_HOTMAIL_RVCD

header	FSL_FAKE_HOTMAIL_RVCD	X-Spam-Relays-External =~ /mx[1234]\.hotmail\.com/
##} FSL_FAKE_HOTMAIL_RVCD

##{ FSL_GEO_ABUSE

uri FSL_GEO_ABUSE /\/geocities\.com\/\S+$/
#score FSL_GEO_ABUSE 3.0
##} FSL_GEO_ABUSE

##{ FSL_HELO_BARE_IP_1

header  FSL_HELO_BARE_IP_1      X-Spam-Relays-External =~ /^[^\]]+ helo=\d+\.\d+\.\d+\.\d+ /i
#score   FSL_HELO_BARE_IP_1      0.001
##} FSL_HELO_BARE_IP_1

##{ FSL_HELO_DEVICE

header	FSL_HELO_DEVICE		X-Spam-Relays-External =~ /\bhelo=(?:(?:dsl)?device|speedtouch)\.lan\b/i
#score	FSL_HELO_DEVICE		0.001
##} FSL_HELO_DEVICE

##{ FSL_HELO_NON_FQDN_1

header  FSL_HELO_NON_FQDN_1     X-Spam-Relays-External =~ /^[^\]]+ helo=[a-zA-Z0-9-_]+ /i
#score   FSL_HELO_NON_FQDN_1     0.001
##} FSL_HELO_NON_FQDN_1

##{ FSL_HELO_SETUP

header	FSL_HELO_SETUP		X-Spam-Relays-External =~ /\bhelo=\S+\.setup\b/i
#score	FSL_HELO_SETUP		0.001
##} FSL_HELO_SETUP

##{ FSL_INTERIA_ABUSE

uri FSL_INTERIA_ABUSE /\/\S+\.(?:w|eu|fm)\.interia\.pl/
#score FSL_INTERIA_ABUSE 15.0 
##} FSL_INTERIA_ABUSE

##{ FSL_LSPACES_ABUSE

uri FSL_LSPACES_ABUSE /cid\-\S+\.spaces\.live\.com/
#score FSL_LSPACES_ABUSE 15.0
##} FSL_LSPACES_ABUSE

##{ FSL_YG_ABUSE

uri FSL_YG_ABUSE /\/groups\.yahoo\.com\/group\/\S+\/message\/1$/
#score FSL_YG_ABUSE 15.0
##} FSL_YG_ABUSE

##{ FS_ABIGGER

header   FS_ABIGGER     Subject =~ /a bigger/i
describe FS_ABIGGER     Subject has "a bigger"
##} FS_ABIGGER

##{ FS_APPROVE_YOU

header   FS_APPROVE_YOU         Subject =~ /approve you/i
describe FS_APPROVE_YOU         Subject says approve you
##} FS_APPROVE_YOU

##{ FS_AT_NO_COST

header   FS_AT_NO_COST          Subject =~ /\bat no cost/i
describe FS_AT_NO_COST          Subject says "At No Cost"
##} FS_AT_NO_COST

##{ FS_CHEAP_CAP

header   FS_CHEAP_CAP           Subject =~ /CHEAP/
describe FS_CHEAP_CAP           Phrase: Cheap in Caps in Subject.
##} FS_CHEAP_CAP

##{ FS_DOLLAR_BONUS

header   FS_DOLLAR_BONUS        Subject =~ /\$\d\d\d?\.?\d?\d? bonus/i
describe FS_DOLLAR_BONUS        Subject talks about money bonus!
##} FS_DOLLAR_BONUS

##{ FS_EJACULA

header   FS_EJACULA             Subject =~ /ejaculat(?:[io01][o0i1]n|e)/i
describe FS_EJACULA             Phrase: ejaculation in subject.
##} FS_EJACULA

##{ FS_ERECTION

header   FS_ERECTION            Subject =~ / erection /i
describe FS_ERECTION            Phrase: erection in subject.
##} FS_ERECTION

##{ FS_HUGECOCK

header   FS_HUGECOCK            Subject =~ /(?:huge|tiny|small) (?:c[o0]ck|d[i1]ck|p[e3]n[1i]s)/i
describe FS_HUGECOCK            Phrase: Huge Cock
##} FS_HUGECOCK

##{ FS_LARGE_PERCENT2

header   FS_LARGE_PERCENT2      Subject =~ /(?!100%)\d[0-9oi][0-9oi]%/i
describe FS_LARGE_PERCENT2      Larger than 100% in subj.
##} FS_LARGE_PERCENT2

##{ FS_LOW_RATES

header   FS_LOW_RATES           Subject =~ / low rates/i
describe FS_LOW_RATES           Subject says low rates
##} FS_LOW_RATES

##{ FS_MORE_CONFIDENT

header   FS_MORE_CONFIDENT      Subject =~ /more confident/i
describe FS_MORE_CONFIDENT      Subject says More Confident
##} FS_MORE_CONFIDENT

##{ FS_NEW_SOFT_UPLOAD

header   FS_NEW_SOFT_UPLOAD     Subject =~ /^New software uploaded by/
describe FS_NEW_SOFT_UPLOAD     Subj starts with New software uploaded
##} FS_NEW_SOFT_UPLOAD

##{ FS_NEW_XXX

header   FS_NEW_XXX             Subject =~ /^Re: news? [a-z]{1,5}$/
describe FS_NEW_XXX             Subject looks like Fharmacy spams.
##} FS_NEW_XXX

##{ FS_NO_SCRIP

header   FS_NO_SCRIP            Subject =~ /n[o0O] p[reRE][erER]scr[i1I]pt[i1I][o0O]n/i
describe FS_NO_SCRIP            Subject almost says No prescription
##} FS_NO_SCRIP

##{ FS_NUDE

header   FS_NUDE                Subject =~ /\bnude\b/i
describe FS_NUDE                Subject says Nude
##} FS_NUDE

##{ FS_OBFU_PRMCY

header   FS_OBFU_PRMCY          Subject =~ /\b(?!(?:pharmacy|primacy))p[ph]{0,4}\S{1,3}r\S{0,2}m\S{0,3}c\S{0,2}y\b/i
describe FS_OBFU_PRMCY          what could this word be?
##} FS_OBFU_PRMCY

##{ FS_PERSCRIPTION

header   FS_PERSCRIPTION        Subject =~ /perscr[i1]pt[i1][o0]n/i
describe FS_PERSCRIPTION        Subject mis-spelled prescription
##} FS_PERSCRIPTION

##{ FS_PHARMASUB2

header   FS_PHARMASUB2          Subject =~ /PH[A-Za-z]{2,7}MA/
describe FS_PHARMASUB2          Looks like Phramacy subject.
##} FS_PHARMASUB2

##{ FS_RAMROD

header   FS_RAMROD              Subject =~ /ramrod/i
describe FS_RAMROD              Subject says Ramrod
##} FS_RAMROD

##{ FS_REPLICA

header   FS_REPLICA             Subject =~ /replica/i
describe FS_REPLICA             Subject says "replica"
##} FS_REPLICA

##{ FS_REPLICAWATCH

header   FS_REPLICAWATCH        Subject =~ /replica watch/i
describe FS_REPLICAWATCH        Subject says Replica watch
##} FS_REPLICAWATCH

##{ FS_RE_APPROV

header   FS_RE_APPROV           Subject =~ /re approved/i
describe FS_RE_APPROV           Phrase: re approved
##} FS_RE_APPROV

##{ FS_START_DOYOU2

header   FS_START_DOYOU2        Subject =~ /^Do you (?:dream|have|want|love|like|wanna)/i
describe FS_START_DOYOU2        Subject starts with Do you dream,have,want,love, etc.
##} FS_START_DOYOU2

##{ FS_START_LOSE

header   FS_START_LOSE          Subject =~ /^Lose /i
describe FS_START_LOSE          Subject starts with Lose
##} FS_START_LOSE

##{ FS_TEEN_BAD

header   FS_TEEN_BAD            Subject =~ /teen.{1,15}(?:pussy|sex|slut|ass|fuck|rape)/i
describe FS_TEEN_BAD            Subject says something bad about teens
##} FS_TEEN_BAD

##{ FS_TIP_DDD

header   FS_TIP_DDD             Subject =~ /(?:tip|good) \d\d\d?\d?/i
describe FS_TIP_DDD             Phrase: subject = tip ddd
##} FS_TIP_DDD

##{ FS_WEIGHT_LOSS

header   FS_WEIGHT_LOSS         Subject =~ /weight loss/i
describe FS_WEIGHT_LOSS         Subject says Weight Loss
##} FS_WEIGHT_LOSS

##{ FS_WILL_HELP

header   FS_WILL_HELP           Subject =~ /will help/
describe FS_WILL_HELP           Subject says will help
##} FS_WILL_HELP

##{ FS_WITH_SMALL

header   FS_WITH_SMALL          Subject =~ /with (?:\w+\s)?(?:small|short)/i
describe FS_WITH_SMALL          Subject says With ... small
##} FS_WITH_SMALL

##{ FUZZY_MERIDIA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body FUZZY_MERIDIA	/<inter W3><post P2>\b(?!meridia)<M><E><R><I><D><I><A>\b/i
endif
##} FUZZY_MERIDIA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ FU_COMMON_SUBS2

uri      FU_COMMON_SUBS2        m'/(?:[2w]m|7d|b|ee|lj|j|o|u)/[,.]?$'
describe FU_COMMON_SUBS2        Sub-dir seen often in spam (2).
##} FU_COMMON_SUBS2

##{ FU_ENDS_NUMS_DOTS_CLK

uri      FU_ENDS_NUMS_DOTS_CLK  m'(?:clk|uns)/\d+\.\d+\.\d+'i
describe FU_ENDS_NUMS_DOTS_CLK  Ends with clk/d+.d+.d+
##} FU_ENDS_NUMS_DOTS_CLK

##{ FU_END_ET

uri      FU_END_ET              m'/et/$'i
describe FU_END_ET              ET Phone Home?
##} FU_END_ET

##{ FU_HOODIA

uri      FU_HOODIA              /hoodia/i
describe FU_HOODIA              URL has hoodia in it.
##} FU_HOODIA

##{ FU_LONG_QUERY3

uri      FU_LONG_QUERY3         m'[A-F0-9]{30}\.aspx'
describe FU_LONG_QUERY3         URL has a long file name with .aspx extension.
##} FU_LONG_QUERY3

##{ FU_MIDER

uri      FU_MIDER               m'/gall?/'
describe FU_MIDER               URL has /gal/
##} FU_MIDER

##{ FU_UKGEOCITIES

uri      FU_UKGEOCITIES         /\b[a-z]{2}\.geocities\.com/i
describe FU_UKGEOCITIES         URL with [a-z]{2}.geocities.com
##} FU_UKGEOCITIES

##{ FU_URI_TRACKER_T

uri      FU_URI_TRACKER_T       m'/[yi]/(?:sp|et|vm|xl2)/'i
describe FU_URI_TRACKER_T       URI style tracker (T)
##} FU_URI_TRACKER_T

##{ GEO_QUERY_STRING

uri	GEO_QUERY_STRING	/^http:\/\/(?:\w{2,4}\.)?geocities\.com(?::\d*)?\/.+?\/\?/i
##} GEO_QUERY_STRING

##{ HDR_ORDER_FTSDMCXX_001C

meta HDR_ORDER_FTSDMCXX_001C  (__HDR_ORDER_FTSDMCXXXX && __MID_START_001C)
describe HDR_ORDER_FTSDMCXX_001C  Header order similar to spam (FTSDMCXX/MID variant)
##} HDR_ORDER_FTSDMCXX_001C

##{ HDR_ORDER_FTSDMCXX_BAT

meta HDR_ORDER_FTSDMCXX_BAT   (__HDR_ORDER_FTSDMCXXXX && __BAT_BOUNDARY)
describe HDR_ORDER_FTSDMCXX_BAT   Header order similar to spam (FTSDMCXX/boundary variant)
##} HDR_ORDER_FTSDMCXX_BAT

##{ HEADER_COUNT_SUBJECT ifplugin Mail::SpamAssassin::Plugin::HeaderEval

ifplugin Mail::SpamAssassin::Plugin::HeaderEval
header HEADER_COUNT_SUBJECT	eval:check_header_count_range('Subject','2','999')
describe HEADER_COUNT_SUBJECT	Multiple Subject headers found
endif
##} HEADER_COUNT_SUBJECT ifplugin Mail::SpamAssassin::Plugin::HeaderEval

##{ HELO_FRIEND

header HELO_FRIEND  X-Spam-Relays-External =~ /^[^\]]+ helo=friend /i
##} HELO_FRIEND

##{ HELO_LH_HOME

header HELO_LH_HOME X-Spam-Relays-External =~ /^[^\]]+ helo=\S+\.(?:home|lan) /i
##} HELO_LH_HOME

##{ HELO_LH_LD

header HELO_LH_LD   X-Spam-Relays-External =~ /^[^\]]+ helo=localhost\.localdomain /i
##} HELO_LH_LD

##{ HELO_LOCALHOST

header HELO_LOCALHOST   X-Spam-Relays-External =~ /^[^\]]+ helo=localhost /i
##} HELO_LOCALHOST

##{ HELO_NO_DOMAIN

meta     HELO_NO_DOMAIN	__HELO_NO_DOMAIN && !HELO_LOCALHOST
describe HELO_NO_DOMAIN	Relay reports its domain incorrectly
##} HELO_NO_DOMAIN

##{ HELO_OEM

header HELO_OEM  X-Spam-Relays-External =~ /^[^\]]+ helo=(?:pc|oem\S*) /i
##} HELO_OEM

##{ HK_FAKENAME_EBAY

meta		HK_FAKENAME_EBAY	__HK_NAME_EBAY && !__HK_HELO_EBAY
describe	HK_FAKENAME_EBAY	From name mentions eBay, but not relayed from there
##} HK_FAKENAME_EBAY

##{ HK_FAKENAME_MICROSOFT

meta		HK_FAKENAME_MICROSOFT	__HK_NAME_MICROSOFT && !__HK_HELO_MICROSOFT
describe	HK_FAKENAME_MICROSOFT	From name mentions Microsoft, but not relayed from there
##} HK_FAKENAME_MICROSOFT

##{ HK_LOTTO

meta		HK_LOTTO		__HK_LOTTO_1 || __HK_LOTTO_2 || __HK_LOTTO_JACKPOT || __HK_LOTTO_STAATS || __HK_LOTTO_BALLOT
##} HK_LOTTO

##{ HK_NAME_DRUGS

header		HK_NAME_DRUGS		From:name =~ /(viagra|cialis)/mi
describe	HK_NAME_DRUGS		From name contains drugs
##} HK_NAME_DRUGS

##{ HK_NAME_FREE

header		HK_NAME_FREE		From:name =~ /\b(?:get)?free(?!\.fr)\b/mi
describe	HK_NAME_FREE		From name mentions free stuff
##} HK_NAME_FREE

##{ HK_RANDOM_ENVFROM

header		HK_RANDOM_ENVFROM	EnvelopeFrom =~ /^(?!(?:mail|bounce)[_.-]|[^@]*(?:[+=^~\#]|mcgr|kpmg|nlpbr|ndqv|lcgc|cplpr|-mailer@)|[^@]{20})[^@]*(?:[bcdfgjklmnpqrtvwxz]{5}|[aeiouy]{5}|([a-z]{1,2})(?:\1){3})/mi
describe	HK_RANDOM_ENVFROM	Envelope sender username looks random
##} HK_RANDOM_ENVFROM

##{ HK_RANDOM_FROM

header		HK_RANDOM_FROM		From:addr =~ /^(?!(?:mail|bounce)[_.-]|[^@]*(?:[+=^~\#]|mcgr|kpmg|nlpbr|ndqv|lcgc|cplpr|-mailer@)|[^@]{26}|.*?@.{0,20}\bcmp-info\.com$)[^@]*(?:[bcdfgjklmnpqrtvwxz]{5}|[aeiouy]{5}|([a-z]{1,2})(?:\1){3})/mi
describe	HK_RANDOM_FROM		From username looks random
##} HK_RANDOM_FROM

##{ HK_SCAM_N2

body		HK_SCAM_N2		/\bnext of kin\b/i
##} HK_SCAM_N2

##{ HS_BOBAX_MID_2

header HS_BOBAX_MID_2 Message-Id =~ /^<\dIX\d{3}EJXVWDA\d{3}\@[a-z\-]+\.[a-z]+>/
describe HS_BOBAX_MID_2 Bobax? Message-Id: <0IX000EJXVWDA000@example.com>
##} HS_BOBAX_MID_2

##{ HS_BODY_UPLOADED_SOFTWARE

body HS_BODY_UPLOADED_SOFTWARE /^\w+ has uploaded some new software/
describe HS_BODY_UPLOADED_SOFTWARE Somebody has uploaded some new software for you
##} HS_BODY_UPLOADED_SOFTWARE

##{ HS_DRUG_DOLLAR_1

body HS_DRUG_DOLLAR_1 m'^[a-z]+[glrt][a-z]?[eir][a-z]?[asx](?: -|:)? \$[\d.]+$'i
describe HS_DRUG_DOLLAR_1 Contains a drug and price-like pattern.
##} HS_DRUG_DOLLAR_1

##{ HS_DRUG_DOLLAR_2

body HS_DRUG_DOLLAR_2 m'^[a-z]+[lmor][a-z]?[aex][a-z]?[mx](?: -|:)? \$[\d.]+$'i
describe HS_DRUG_DOLLAR_2 Contains a drug and price-like pattern.
##} HS_DRUG_DOLLAR_2

##{ HS_DRUG_DOLLAR_3

body HS_DRUG_DOLLAR_3 m'^[a-z]+[dino][a-z]?[aimu][a-z]?[amx](?: -|:)? \$[\d.]+$'i
describe HS_DRUG_DOLLAR_3 Contains a drug and price-like pattern.
##} HS_DRUG_DOLLAR_3

##{ HS_DRUG_DOLLAR_MANY

meta HS_DRUG_DOLLAR_MANY HS_DRUG_DOLLAR_1 + HS_DRUG_DOLLAR_2 + HS_DRUG_DOLLAR_3 >= 2
describe HS_DRUG_DOLLAR_MANY Contains several drug and dollar-like patterns.
##} HS_DRUG_DOLLAR_MANY

##{ HS_FORGED_OE_FW

meta HS_FORGED_OE_FW __HS_SUBJ_UC_FW && __OE_MUA
describe HS_FORGED_OE_FW Outlook does not prefix forwards with "FW:"
##} HS_FORGED_OE_FW

##{ HS_GETMEOFF

uri HS_GETMEOFF m'/get(?:me)?off\.php(?:$|[\#?])'
describe HS_GETMEOFF Links to common unsubscribe script: 'getmeoff.php'
##} HS_GETMEOFF

##{ HS_INDEX_PARAM

uri HS_INDEX_PARAM m'^https?:/*([^/]*/)+(?:index.(?:cgi|html?|php)|default.(?:asp|jsp))?\?(?!(?-i:[A-Z][a-z]{2,}){2,}$)\w+={0,2}$'i
describe HS_INDEX_PARAM Link contains a common tracker pattern.
##} HS_INDEX_PARAM

##{ HS_MEETUP_FOR_SEX

body HS_MEETUP_FOR_SEX m'(?:meet ?up|see eachother|get together) for (?:some )?(?:action|sex)'i
describe HS_MEETUP_FOR_SEX Talks about meeting up for sex.
##} HS_MEETUP_FOR_SEX

##{ HS_SUBJ_NEW_SOFTWARE

header HS_SUBJ_NEW_SOFTWARE Subject =~ /^New software uploaded by/
describe HS_SUBJ_NEW_SOFTWARE Subject starts with 'New software uploaded by'
##} HS_SUBJ_NEW_SOFTWARE

##{ HS_SUBJ_ONLINE_PHARMACEUTICAL

header HS_SUBJ_ONLINE_PHARMACEUTICAL Subject =~ /\bOnline Pharmaceutical/i
describe HS_SUBJ_ONLINE_PHARMACEUTICAL Subject contains the phrase 'Online pharmaceutical'
##} HS_SUBJ_ONLINE_PHARMACEUTICAL

##{ HS_VPXL

body HS_VPXL /\bVPXL\b/i
describe HS_VPXL Contains VPXL, yet the recommended dose is only 2 tablets.
##} HS_VPXL

##{ HTTPS_HTTP_MISMATCH ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch

ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch
body  HTTPS_HTTP_MISMATCH eval:check_https_http_mismatch('1','10')
endif
##} HTTPS_HTTP_MISMATCH ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch

##{ IMG_DIRECT_TO_MX

meta       IMG_DIRECT_TO_MX        __DOS_DIRECT_TO_MX && __JPEG_ATTACH && __ONE_IMG && __IMG_LE_300K
#score      IMG_DIRECT_TO_MX        0.20
##} IMG_DIRECT_TO_MX

##{ JM_I_FEEL_LUCKY

uri JM_I_FEEL_LUCKY         /(?:\&|\?)btnI=ec(?:$|\&)/
tflags JM_I_FEEL_LUCKY  publish     # low hitrate, but always a good sign
##} JM_I_FEEL_LUCKY

##{ JM_RCVD_QMAILV1

header JM_RCVD_QMAILV1     Received =~ /by \S+ \(Qmailv1\) with ESMTP/
##} JM_RCVD_QMAILV1

##{ JM_SOUGHT_FRAUD_1

meta JM_SOUGHT_FRAUD_1   (__SEEK_FRAUD_NN_XIN || __SEEK_FRAUD_YM7Q1U || __SEEK_FRAUD_HMVYSR || __SEEK_FRAUD_2811F9)
#score JM_SOUGHT_FRAUD_1  3.0
describe JM_SOUGHT_FRAUD_1  Body contains frequently-spammed text patterns
##} JM_SOUGHT_FRAUD_1

##{ JM_SOUGHT_FRAUD_2

meta JM_SOUGHT_FRAUD_2   (__SEEK_FRAUD_ORMRPQ || __SEEK_FRAUD__70JEL || __SEEK_FRAUD_DKBMSM || __SEEK_FRAUD_LX2RCD || __SEEK_FRAUD_9_SYQR || __SEEK_FRAUD_3ZGAWE || __SEEK_FRAUD_XABL7X || __SEEK_FRAUD_CTSHG_ || __SEEK_FRAUD_JJQFVB || __SEEK_FRAUD_8DOXAD || __SEEK_FRAUD_ZHCQFW || __SEEK_FRAUD_4IGE4U || __SEEK_FRAUD_FREOKD || __SEEK_FRAUD_QZ_MDM || __SEEK_FRAUD_US_OFW || __SEEK_FRAUD_BXYWIK || __SEEK_FRAUD_BGO5Z1 || __SEEK_FRAUD_ZR4ER1 || __SEEK_FRAUD_CHLODJ || __SEEK_FRAUD_F6XEM3 || __SEEK_FRAUD_FOSRJQ || __SEEK_FRAUD_FF96JI || __SEEK_FRAUD_E0LMNE || __SEEK_FRAUD_IGL8BZ || __SEEK_FRAUD_NVO_LV || __SEEK_FRAUD_LTKAUK || __SEEK_FRAUD_V1ULWA || __SEEK_FRAUD_OPAU37 || __SEEK_FRAUD_SBLZOX || __SEEK_FRAUD_RGFON2 || __SEEK_FRAUD_F9YLOI || __SEEK_FRAUD__IA9KC)
#score JM_SOUGHT_FRAUD_2  3.0
describe JM_SOUGHT_FRAUD_2  Body contains frequently-spammed text patterns
##} JM_SOUGHT_FRAUD_2

##{ JM_SOUGHT_FRAUD_3

meta JM_SOUGHT_FRAUD_3   (__SEEK_FRAUD_IQFKX9 || __SEEK_FRAUD_SGFSMN || __SEEK_FRAUD_UCYLRJ || __SEEK_FRAUD_38GETZ || __SEEK_FRAUD_FHIQQL || __SEEK_FRAUD_0LP0QC || __SEEK_FRAUD_YGHQXE || __SEEK_FRAUD_EH1G11 || __SEEK_FRAUD_MY06YR || __SEEK_FRAUD_7XOY_V || __SEEK_FRAUD_LPT60S || __SEEK_FRAUD_AKYCPN || __SEEK_FRAUD_L5CHVT || __SEEK_FRAUD_BLDS9E || __SEEK_FRAUD_POQX46 || __SEEK_FRAUD_VXEHN_ || __SEEK_FRAUD_QJ58__ || __SEEK_FRAUD_GVP80_ || __SEEK_FRAUD_6HPM5A || __SEEK_FRAUD_EV4LPC || __SEEK_FRAUD_5_1_MB || __SEEK_FRAUD_HHL9OS || __SEEK_FRAUD_C0N_NJ || __SEEK_FRAUD_49FI4O || __SEEK_FRAUD_Z1DQSM || __SEEK_FRAUD_AAKMFF || __SEEK_FRAUD_MIIG_C || __SEEK_FRAUD_BRNKW7 || __SEEK_FRAUD_ZMFYMV || __SEEK_FRAUD_KDGYCE || __SEEK_FRAUD_ZHS0WA || __SEEK_FRAUD_TWEN6R || __SEEK_FRAUD_OUQ7_6 || __SEEK_FRAUD_J2YHWJ || __SEEK_FRAUD_LMLJQE || __SEEK_FRAUD_VXUYZK || __SEEK_FRAUD_IILB8R || __SEEK_FRAUD_EZFEDE || __SEEK_FRAUD_5MCR_O || __SEEK_FRAUD__EVXD7 || __SEEK_FRAUD_WQ3MYL || __SEEK_FRAUD_SJNU8J || __SEEK_FRAUD_PUJ_IF || __SEEK_FRAUD_S3AFMN || __SEEK_FRAUD_XADCD3 || __SEEK_FRAUD_E2ESY7 || __SEEK_FRAUD_DSHZQA || __SEEK_FRAUD_9JV2FO || __SEEK_FRAUD_PKVKI1 || __SEEK_FRAUD_HPCAW3 || __SEEK_FRAUD_VKUVK9 || __SEEK_FRAUD_PZKR_K || __SEEK_FRAUD_LC7TDH || __SEEK_FRAUD_VJNKV_ || __SEEK_FRAUD_Y6P5MJ || __SEEK_FRAUD_MGGP27 || __SEEK_FRAUD_NM1G_Z || __SEEK_FRAUD_PNYKVG || __SEEK_FRAUD_SYXC7L || __SEEK_FRAUD_X7EJQN || __SEEK_FRAUD_GZBMOF || __SEEK_FRAUD_OWE2LK || __SEEK_FRAUD_DJ79KN || __SEEK_FRAUD_3_8NUB || __SEEK_FRAUD_MO8JUB || __SEEK_FRAUD_TFGP0H || __SEEK_FRAUD_SJUAFZ || __SEEK_FRAUD_UJZKNM || __SEEK_FRAUD_XD3U8U || __SEEK_FRAUD_EO5_QW || __SEEK_FRAUD_RZZRJV || __SEEK_FRAUD_5NJERT || __SEEK_FRAUD_C7BE4W || __SEEK_FRAUD_L4OF4_ || __SEEK_FRAUD_UYQ1XG || __SEEK_FRAUD_ADBSR1 || __SEEK_FRAUD_5L07LP || __SEEK_FRAUD_NNZJNQ || __SEEK_FRAUD_NH9TNM || __SEEK_FRAUD_C5OQZD || __SEEK_FRAUD_XVM0G_ || __SEEK_FRAUD_G9KM9V || __SEEK_FRAUD_QHM0YN || __SEEK_FRAUD_MNSFWO || __SEEK_FRAUD_C62CWS || __SEEK_FRAUD_JK6E_X || __SEEK_FRAUD_S4QI3T || __SEEK_FRAUD_DLIZ7K || __SEEK_FRAUD_ZKHUET || __SEEK_FRAUD_UCAUVI || __SEEK_FRAUD_DNFIPA || __SEEK_FRAUD__EFA_O || __SEEK_FRAUD_DIIRM8 || __SEEK_FRAUD_N2TUPL || __SEEK_FRAUD_CKPXGA || __SEEK_FRAUD_HLTNBY || __SEEK_FRAUD_SKFND8 || __SEEK_FRAUD_TY7ECD || __SEEK_FRAUD_58TQIN || __SEEK_FRAUD__2H_ZF || __SEEK_FRAUD_H613HT || __SEEK_FRAUD_OXQL3J || __SEEK_FRAUD__4GEGC || __SEEK_FRAUD__HJ2Y5 || __SEEK_FRAUD_OEAWVL || __SEEK_FRAUD_ZLALWU || __SEEK_FRAUD_KS6HHB || __SEEK_FRAUD_QKMOJL || __SEEK_FRAUD_QHAHKB || __SEEK_FRAUD_EWZZ2M || __SEEK_FRAUD_215XVW || __SEEK_FRAUD_4KBBOJ || __SEEK_FRAUD_CRYRVO || __SEEK_FRAUD_JGB6V7 || __SEEK_FRAUD_MQI_VX || __SEEK_FRAUD_GQ_III || __SEEK_FRAUD_JDNTHW || __SEEK_FRAUD__QPNON || __SEEK_FRAUD_52TF6W || __SEEK_FRAUD__K6QXJ || __SEEK_FRAUD_TMN_LY || __SEEK_FRAUD_3BWYGW || __SEEK_FRAUD_TSWC8H || __SEEK_FRAUD_XDHW_C || __SEEK_FRAUD_KFEOGR || __SEEK_FRAUD_DCYEFP || __SEEK_FRAUD_H6IXQ5 || __SEEK_FRAUD_P_7YRN || __SEEK_FRAUD_VEFRJP || __SEEK_FRAUD_XNIO3Q || __SEEK_FRAUD_GTSAAF || __SEEK_FRAUD_L17Y6V || __SEEK_FRAUD_4VSYVD || __SEEK_FRAUD_FCD7Z9 || __SEEK_FRAUD_BZFTQQ || __SEEK_FRAUD_VRGLL3 || __SEEK_FRAUD_0BVEZG || __SEEK_FRAUD_UG4GV7 || __SEEK_FRAUD__OXXSN || __SEEK_FRAUD_LP_GQ9 || __SEEK_FRAUD_55WLGY || __SEEK_FRAUD_WI_PXU || __SEEK_FRAUD_5MEKF1 || __SEEK_FRAUD_E3KTBE || __SEEK_FRAUD_IMVAPT || __SEEK_FRAUD_QMDFLB || __SEEK_FRAUD_TKRYFP || __SEEK_FRAUD_8D5ZCH || __SEEK_FRAUD_YA_RGO || __SEEK_FRAUD_PRKDOF || __SEEK_FRAUD_W1_1AT || __SEEK_FRAUD_A1M2V4 || __SEEK_FRAUD_Q2NVM5 || __SEEK_FRAUD_NPQMIG || __SEEK_FRAUD_W_G8_H || __SEEK_FRAUD_KNJYYF || __SEEK_FRAUD_YKISUY || __SEEK_FRAUD_M_UYU5 || __SEEK_FRAUD_VSMRB_ || __SEEK_FRAUD_QJAXD2 || __SEEK_FRAUD_OIVTUG || __SEEK_FRAUD_7ORNIB || __SEEK_FRAUD_T6QSEI || __SEEK_FRAUD_7CQUW3 || __SEEK_FRAUD_JIUMW4 || __SEEK_FRAUD_B3XJII || __SEEK_FRAUD__ERENB || __SEEK_FRAUD_2BERS9 || __SEEK_FRAUD_XVL5QC || __SEEK_FRAUD_GVTOJY || __SEEK_FRAUD_A0U_YJ || __SEEK_FRAUD_1LS8UW || __SEEK_FRAUD_1OMKY9 || __SEEK_FRAUD_FYI5WN || __SEEK_FRAUD_EGCOZC || __SEEK_FRAUD_BTTJ73 || __SEEK_FRAUD_VEGVH5 || __SEEK_FRAUD_7GJKBJ || __SEEK_FRAUD_QOVRZI || __SEEK_FRAUD_QO85UJ || __SEEK_FRAUD_VTLF_0 || __SEEK_FRAUD_JTNNU1 || __SEEK_FRAUD_80CUEU || __SEEK_FRAUD_CTKQAR || __SEEK_FRAUD_LQICIN || __SEEK_FRAUD_BQVFV6 || __SEEK_FRAUD_VBA2NT || __SEEK_FRAUD_SIYSH8 || __SEEK_FRAUD_WKGUZG || __SEEK_FRAUD_GFJSHQ || __SEEK_FRAUD_0WHPB1 || __SEEK_FRAUD_UZSYRC || __SEEK_FRAUD_JU0DNT || __SEEK_FRAUD_D8N5AK || __SEEK_FRAUD_7A8HJM || __SEEK_FRAUD_CDBI1H || __SEEK_FRAUD_H3ZTPW || __SEEK_FRAUD_IYEOHL || __SEEK_FRAUD_PZEJXH || __SEEK_FRAUD_FG5MFR || __SEEK_FRAUD_ADHMPP || __SEEK_FRAUD_OLAWLX || __SEEK_FRAUD_PBQQJA || __SEEK_FRAUD_DZ9GWP || __SEEK_FRAUD_OXOGET || __SEEK_FRAUD_RGERLR || __SEEK_FRAUD_W5LM6_ || __SEEK_FRAUD_LKDOVS || __SEEK_FRAUD_U6L6T8 || __SEEK_FRAUD_NAWNBX || __SEEK_FRAUD_KBGNWU || __SEEK_FRAUD_JJPKAG || __SEEK_FRAUD_D_Z7NM || __SEEK_FRAUD_EPEJ1_ || __SEEK_FRAUD_IZKPNF || __SEEK_FRAUD_8BDNKT || __SEEK_FRAUD_EWAGO3 || __SEEK_FRAUD_MGLOG8 || __SEEK_FRAUD_6GPS4I || __SEEK_FRAUD_MWUIJQ || __SEEK_FRAUD_DI5SMP || __SEEK_FRAUD_VSTK_A || __SEEK_FRAUD_XY_KVM || __SEEK_FRAUD_0WTPZI || __SEEK_FRAUD_37UB9O || __SEEK_FRAUD_P12VMN || __SEEK_FRAUD__HWY23 || __SEEK_FRAUD_VDWAJV || __SEEK_FRAUD_GXGKLM || __SEEK_FRAUD_ZXHWD2 || __SEEK_FRAUD_JFMEJI || __SEEK_FRAUD_SH1EZL || __SEEK_FRAUD_HDNKBH || __SEEK_FRAUD_EOLLNZ || __SEEK_FRAUD_C0HOHT || __SEEK_FRAUD_ICOZAX || __SEEK_FRAUD_0ENSZN || __SEEK_FRAUD_K1VSVZ || __SEEK_FRAUD_YGYYT6 || __SEEK_FRAUD_T2PQH_ || __SEEK_FRAUD_IQZZGV || __SEEK_FRAUD_UJSOEL || __SEEK_FRAUD_HDZKRN || __SEEK_FRAUD_ID2SB5 || __SEEK_FRAUD_MTD5KL || __SEEK_FRAUD_C4M8O6 || __SEEK_FRAUD_JHK5YJ || __SEEK_FRAUD_J1WFB_ || __SEEK_FRAUD_6B2FK_ || __SEEK_FRAUD_GAPHBK || __SEEK_FRAUD_X1MGO6 || __SEEK_FRAUD_4VJJ1V || __SEEK_FRAUD_HTRHIY || __SEEK_FRAUD_E_N5XO || __SEEK_FRAUD_YRCV_U || __SEEK_FRAUD_KFUGGV || __SEEK_FRAUD_ALY_4Z || __SEEK_FRAUD_AACTU_ || __SEEK_FRAUD_VHSUC0 || __SEEK_FRAUD_NAXE2Z || __SEEK_FRAUD_XDJEQN || __SEEK_FRAUD_IIRQDN || __SEEK_FRAUD_BYTJGW || __SEEK_FRAUD_AAV9Q9 || __SEEK_FRAUD_TJFLBX || __SEEK_FRAUD_UPIS0F || __SEEK_FRAUD_Y7F2UL || __SEEK_FRAUD_ORCHU5 || __SEEK_FRAUD_JJPV6X || __SEEK_FRAUD_SVZDZ7 || __SEEK_FRAUD_IP2GBI || __SEEK_FRAUD_6ZXIA1 || __SEEK_FRAUD_JJXYC_ || __SEEK_FRAUD_NVFQGO || __SEEK_FRAUD_SVVXNA || __SEEK_FRAUD_E2US_V || __SEEK_FRAUD_DI9349 || __SEEK_FRAUD_QC6HVM || __SEEK_FRAUD_5EKBBQ || __SEEK_FRAUD_BKRS5B || __SEEK_FRAUD_FFM0SF || __SEEK_FRAUD_DAZ554 || __SEEK_FRAUD_DVQ_OH || __SEEK_FRAUD_FNYQLN || __SEEK_FRAUD_EONOG2 || __SEEK_FRAUD_B5_Q5F || __SEEK_FRAUD_8SR3L_ || __SEEK_FRAUD_RBAJV0 || __SEEK_FRAUD_DI_QRB || __SEEK_FRAUD_VMIDLD || __SEEK_FRAUD_SGH_BE || __SEEK_FRAUD_7PX0OU || __SEEK_FRAUD_MXYWF1 || __SEEK_FRAUD_EGRZ5T || __SEEK_FRAUD_2TBGCP || __SEEK_FRAUD_NSEQAC || __SEEK_FRAUD_VT5WCB || __SEEK_FRAUD_FSYFC_ || __SEEK_FRAUD_WQPH_R || __SEEK_FRAUD_WZIO9H || __SEEK_FRAUD_FKRVOS || __SEEK_FRAUD_ASW4ZD || __SEEK_FRAUD_SBFKHU || __SEEK_FRAUD_N87C1L || __SEEK_FRAUD_M03WB9 || __SEEK_FRAUD_KS9QN4 || __SEEK_FRAUD_SVSS9Y || __SEEK_FRAUD_TELOJY || __SEEK_FRAUD_GMP0SY || __SEEK_FRAUD_FOYA9K || __SEEK_FRAUD_3UF3BG || __SEEK_FRAUD_UGZFFW || __SEEK_FRAUD_WH7YUM || __SEEK_FRAUD_VD8CIS || __SEEK_FRAUD_WGBS3F || __SEEK_FRAUD_HHX2H4 || __SEEK_FRAUD_W7O0I7 || __SEEK_FRAUD_RC7YZH || __SEEK_FRAUD_5IZEAX || __SEEK_FRAUD_UK1HZY || __SEEK_FRAUD_CJCVEY || __SEEK_FRAUD_X2_BM9 || __SEEK_FRAUD_C80D_M || __SEEK_FRAUD_6GGFLT || __SEEK_FRAUD_F6ZEVO || __SEEK_FRAUD_FLVC7O || __SEEK_FRAUD_GSL5YK || __SEEK_FRAUD_O6PUI_ || __SEEK_FRAUD_BDDXSD || __SEEK_FRAUD_HLICNI || __SEEK_FRAUD_0EY1BH || __SEEK_FRAUD_ZN9EIN || __SEEK_FRAUD_MVBG8Z || __SEEK_FRAUD_DVBIVZ || __SEEK_FRAUD_6ZE0ZK || __SEEK_FRAUD_W1PLKY || __SEEK_FRAUD_SPR5JQ || __SEEK_FRAUD_M1HR35 || __SEEK_FRAUD_RBMZ20 || __SEEK_FRAUD_G4RKKF || __SEEK_FRAUD_FOT6IF || __SEEK_FRAUD_JRCNZ0 || __SEEK_FRAUD_19NM0A || __SEEK_FRAUD_5CTGDY || __SEEK_FRAUD__BXKBH || __SEEK_FRAUD_MCEI6K || __SEEK_FRAUD_KK4QB4 || __SEEK_FRAUD_KJCQBN || __SEEK_FRAUD_6LGTFG || __SEEK_FRAUD__TYKI7 || __SEEK_FRAUD_6EGJH6 || __SEEK_FRAUD_BAO5S3 || __SEEK_FRAUD_C_HP37 || __SEEK_FRAUD_QSWUVB || __SEEK_FRAUD_BS6HNM || __SEEK_FRAUD_IOCGDV || __SEEK_FRAUD_VHRO4H || __SEEK_FRAUD_YOHVL0 || __SEEK_FRAUD_ZM7VH9 || __SEEK_FRAUD_N9N9UF || __SEEK_FRAUD_LLMGBZ || __SEEK_FRAUD_YK2OQP || __SEEK_FRAUD_VEQPGW || __SEEK_FRAUD_0MX8JO || __SEEK_FRAUD_Y2SCUB || __SEEK_FRAUD_JAORYH || __SEEK_FRAUD_IGWSWV || __SEEK_FRAUD_1SKLLZ || __SEEK_FRAUD_PIVB38 || __SEEK_FRAUD_GHC0LN || __SEEK_FRAUD_0_6JSL || __SEEK_FRAUD__STWOQ || __SEEK_FRAUD_UTTB3I || __SEEK_FRAUD_9CQAIU || __SEEK_FRAUD_A62E_H || __SEEK_FRAUD_PLCEL_ || __SEEK_FRAUD_RG_9_1 || __SEEK_FRAUD_YDE9VC || __SEEK_FRAUD_CBZELO || __SEEK_FRAUD_EBEFON || __SEEK_FRAUD_PUSLFS || __SEEK_FRAUD_F6LCUO || __SEEK_FRAUD__NM8A8 || __SEEK_FRAUD_AWGSAH || __SEEK_FRAUD_5GX3N3 || __SEEK_FRAUD_ZR_YCL || __SEEK_FRAUD_PCELPI || __SEEK_FRAUD_KY9RF_ || __SEEK_FRAUD_RS93A_ || __SEEK_FRAUD_C3MJRM || __SEEK_FRAUD_LEF13W || __SEEK_FRAUD_XWTJ0S || __SEEK_FRAUD_BT6SO9 || __SEEK_FRAUD_YLQNKK || __SEEK_FRAUD_YFJVJR || __SEEK_FRAUD_KUYQIU || __SEEK_FRAUD_BAD6QS || __SEEK_FRAUD_KCMQLR || __SEEK_FRAUD_RZ_T71 || __SEEK_FRAUD_BTLJ32 || __SEEK_FRAUD_BFBYW8 || __SEEK_FRAUD_KOZWIB || __SEEK_FRAUD__V554S || __SEEK_FRAUD_HXGV4J || __SEEK_FRAUD_QE_VRV || __SEEK_FRAUD_L7_UPP || __SEEK_FRAUD_U1BBLW || __SEEK_FRAUD_E5T6LD || __SEEK_FRAUD_BY5FQK || __SEEK_FRAUD_OIF5AH || __SEEK_FRAUD_TTO7PC || __SEEK_FRAUD_OWPH93 || __SEEK_FRAUD_GS_B3U || __SEEK_FRAUD_IYSIY2 || __SEEK_FRAUD_YFLVQ4 || __SEEK_FRAUD_PYUIPE || __SEEK_FRAUD_LD1SHS || __SEEK_FRAUD_C5J9EE || __SEEK_FRAUD_VQF_LH || __SEEK_FRAUD__VLBMG || __SEEK_FRAUD_G9OOWK || __SEEK_FRAUD_QQD_PZ || __SEEK_FRAUD_RC8A1P || __SEEK_FRAUD_6VUONK || __SEEK_FRAUD_Y1JN21 || __SEEK_FRAUD_ULTF0J || __SEEK_FRAUD_9Q29S6 || __SEEK_FRAUD_JGKWCZ || __SEEK_FRAUD_AFUQZ_ || __SEEK_FRAUD_WMTNKJ || __SEEK_FRAUD_SYHCNJ || __SEEK_FRAUD_WC53DT || __SEEK_FRAUD_SZOTOL || __SEEK_FRAUD_J8PIFZ || __SEEK_FRAUD_PB4GGX || __SEEK_FRAUD_AEA51B || __SEEK_FRAUD_GY4RJE || __SEEK_FRAUD_TIC3QK || __SEEK_FRAUD__EU_I1 || __SEEK_FRAUD_8A1Q6M || __SEEK_FRAUD__KZVBM || __SEEK_FRAUD_NH1RHX || __SEEK_FRAUD_A5PM6O || __SEEK_FRAUD_F_KZOZ || __SEEK_FRAUD__DBLB0 || __SEEK_FRAUD_2U5_KL || __SEEK_FRAUD_O8ZW84 || __SEEK_FRAUD_XD5HNK || __SEEK_FRAUD_RZIRDL || __SEEK_FRAUD_OBTMVR || __SEEK_FRAUD_XBF8EX || __SEEK_FRAUD_XUO6FU || __SEEK_FRAUD_3HKWCI || __SEEK_FRAUD_HD6XPT || __SEEK_FRAUD_WMBI4K || __SEEK_FRAUD_6M8QNI || __SEEK_FRAUD_3JFT7Y || __SEEK_FRAUD_AUJ56H || __SEEK_FRAUD_EINBZL || __SEEK_FRAUD_NV1HR9 || __SEEK_FRAUD_TWWILQ || __SEEK_FRAUD_SUOVUP || __SEEK_FRAUD_M8D59N || __SEEK_FRAUD_H9SGSE || __SEEK_FRAUD_RF_UQZ || __SEEK_FRAUD_L9OWQX || __SEEK_FRAUD_5DEVYO || __SEEK_FRAUD_9KCDA8 || __SEEK_FRAUD_WJGJCF || __SEEK_FRAUD_LRYT7Y || __SEEK_FRAUD_TGFQKQ || __SEEK_FRAUD_WJXZ7I || __SEEK_FRAUD_8GOL16 || __SEEK_FRAUD_OL815K || __SEEK_FRAUD_BSX___ || __SEEK_FRAUD_S_M1GN || __SEEK_FRAUD_QA6UJG || __SEEK_FRAUD_ZF7LPG || __SEEK_FRAUD_JQSWAX || __SEEK_FRAUD_HPPPJP || __SEEK_FRAUD_NAUNZC || __SEEK_FRAUD_A56GDH || __SEEK_FRAUD_FBIJMC || __SEEK_FRAUD_D_URQY || __SEEK_FRAUD_PUAWHE || __SEEK_FRAUD_S1FKEV || __SEEK_FRAUD_I3HLDY || __SEEK_FRAUD_JW7I0T || __SEEK_FRAUD_N5_IR_ || __SEEK_FRAUD_3NIFMV || __SEEK_FRAUD_VBQ9JO || __SEEK_FRAUD_JOSDVP || __SEEK_FRAUD_4ONVKC || __SEEK_FRAUD_ZPBBGF || __SEEK_FRAUD_JMRRW7 || __SEEK_FRAUD_D4FWIB || __SEEK_FRAUD_UXEWFD || __SEEK_FRAUD_JUZL6H || __SEEK_FRAUD_F4SHTD || __SEEK_FRAUD_CQN7_5 || __SEEK_FRAUD_461FL0 || __SEEK_FRAUD_ZBR4PG || __SEEK_FRAUD_5CUOT8 || __SEEK_FRAUD_VEPGLD || __SEEK_FRAUD_CEUKKB || __SEEK_FRAUD_RIVPNL || __SEEK_FRAUD_HPKGEO || __SEEK_FRAUD_DNXWDS || __SEEK_FRAUD_GWBK_T || __SEEK_FRAUD_J45GYN || __SEEK_FRAUD_0UXRAU || __SEEK_FRAUD_F_FKHM || __SEEK_FRAUD_ZLXKPY || __SEEK_FRAUD_ZEZMCP || __SEEK_FRAUD__XXFBM || __SEEK_FRAUD_ZZ3WKA || __SEEK_FRAUD_BL1D9Y || __SEEK_FRAUD_QLBPGU || __SEEK_FRAUD_HDWVMD || __SEEK_FRAUD_EJM0XB || __SEEK_FRAUD_NQE_UB || __SEEK_FRAUD_7UXDY2 || __SEEK_FRAUD_8P0LT0 || __SEEK_FRAUD_P8Y20W || __SEEK_FRAUD_DZ5V2U || __SEEK_FRAUD_KCVY4L || __SEEK_FRAUD_UFCQVP || __SEEK_FRAUD_TIWDAE || __SEEK_FRAUD_QLUR_M || __SEEK_FRAUD_NMDNZN || __SEEK_FRAUD_3HU72N || __SEEK_FRAUD_D3X77R || __SEEK_FRAUD_FSJX4M || __SEEK_FRAUD_4WFQ9X || __SEEK_FRAUD_VJC0WF || __SEEK_FRAUD_F8IRSJ || __SEEK_FRAUD_0CUBFG || __SEEK_FRAUD_YT4HMB || __SEEK_FRAUD_GKVMSG || __SEEK_FRAUD_RO2TAX || __SEEK_FRAUD_EURZ3M || __SEEK_FRAUD_JYA5BT || __SEEK_FRAUD_VNIWHY || __SEEK_FRAUD_N3QXOP || __SEEK_FRAUD_DWEVNF || __SEEK_FRAUD_BPL3YK || __SEEK_FRAUD_4ZVC1C || __SEEK_FRAUD_F8EW0T || __SEEK_FRAUD_KUGLJT || __SEEK_FRAUD_JLSUKM || __SEEK_FRAUD_AGOTOV || __SEEK_FRAUD_45WI8I || __SEEK_FRAUD_LZEFMN || __SEEK_FRAUD_PR7DT3 || __SEEK_FRAUD_TUOYBL || __SEEK_FRAUD_WVDTCK || __SEEK_FRAUD_IUQ6A9 || __SEEK_FRAUD_YOWELS || __SEEK_FRAUD_VDYTU_ || __SEEK_FRAUD_QLJWTR || __SEEK_FRAUD_LYNJ8F || __SEEK_FRAUD_UVV3P5 || __SEEK_FRAUD_R2403I || __SEEK_FRAUD_RIMLAO || __SEEK_FRAUD_M_NLGB || __SEEK_FRAUD_HWMBYB || __SEEK_FRAUD_RG9CYN || __SEEK_FRAUD_QGS7RU || __SEEK_FRAUD_7ERN1P || __SEEK_FRAUD_OWB6Z2 || __SEEK_FRAUD_X1E2EB || __SEEK_FRAUD_0QGAHF || __SEEK_FRAUD_GVW9EM || __SEEK_FRAUD_K7QFW9 || __SEEK_FRAUD_IX6ZJO || __SEEK_FRAUD_A0GXKY || __SEEK_FRAUD_XKNJTL || __SEEK_FRAUD_K8ZMXX || __SEEK_FRAUD_OLKRDH || __SEEK_FRAUD_L6ICNJ || __SEEK_FRAUD_PSPGBR || __SEEK_FRAUD_EOVKVR || __SEEK_FRAUD_8JIBO6 || __SEEK_FRAUD_AI_1WI || __SEEK_FRAUD__MMCUC || __SEEK_FRAUD_KT_TR7 || __SEEK_FRAUD_RAQSMO || __SEEK_FRAUD_TCYHCF || __SEEK_FRAUD_3GQDHJ || __SEEK_FRAUD_6OYTMK || __SEEK_FRAUD__6TXBR || __SEEK_FRAUD_Q4PFFF || __SEEK_FRAUD_XTT7BO || __SEEK_FRAUD__IYMST || __SEEK_FRAUD_PDDLNK || __SEEK_FRAUD_7H66PN || __SEEK_FRAUD__Q0H7E || __SEEK_FRAUD_V4_LC8 || __SEEK_FRAUD_DUMWEJ || __SEEK_FRAUD_XOG2QH || __SEEK_FRAUD_LGU9SH || __SEEK_FRAUD_1DJSNK)
#score JM_SOUGHT_FRAUD_3  3.0
describe JM_SOUGHT_FRAUD_3  Body contains frequently-spammed text patterns
##} JM_SOUGHT_FRAUD_3

##{ JM_TORA_XM

meta JM_TORA_XM     (__MAILER_OL_6626 && __MOLE_2962 && __NAKED_TO)
##} JM_TORA_XM

##{ KAM_LOTTO1

meta            KAM_LOTTO1      (__KAM_LOTTO1 + __KAM_LOTTO2 + __KAM_LOTTO3 + __KAM_LOTTO4 + __KAM_LOTTO5 + __KAM_LOTTO6 + __KAM_LOTTO7 >= 3)
describe        KAM_LOTTO1      Likely to be a e-Lotto Scam Email
#score           KAM_LOTTO1      0.5
##} KAM_LOTTO1

##{ KAM_LOTTO2

meta            KAM_LOTTO2      (__KAM_LOTTO1 + __KAM_LOTTO2 + __KAM_LOTTO3 + __KAM_LOTTO4 + __KAM_LOTTO5 + __KAM_LOTTO6 + __KAM_LOTTO7 >= 4)
describe        KAM_LOTTO2      Highly Likely to be a e-Lotto Scam Email
#score           KAM_LOTTO2      1.0
##} KAM_LOTTO2

##{ KAM_STOCKOTC

meta KAM_STOCKOTC       (0)
tflags KAM_STOCKOTC     publish
##} KAM_STOCKOTC

##{ KAM_STOCKTIP15

meta KAM_STOCKTIP15     (0)
tflags KAM_STOCKTIP15   publish
##} KAM_STOCKTIP15

##{ KAM_STOCKTIP20

meta KAM_STOCKTIP20     (0)
tflags KAM_STOCKTIP20   publish
##} KAM_STOCKTIP20

##{ KAM_STOCKTIP21

meta KAM_STOCKTIP21     (0)
tflags KAM_STOCKTIP21   publish
##} KAM_STOCKTIP21

##{ KAM_STOCKTIP4

meta KAM_STOCKTIP4      (0)
tflags KAM_STOCKTIP4    publish
##} KAM_STOCKTIP4

##{ KAM_STOCKTIP6

meta KAM_STOCKTIP6      (0)
tflags KAM_STOCKTIP6    publish
##} KAM_STOCKTIP6

##{ KB_DATE_CONTAINS_TAB

header   KB_DATE_CONTAINS_TAB  Date:raw =~ /^\t/
##} KB_DATE_CONTAINS_TAB

##{ KB_FAKED_THE_BAT

meta     KB_FAKED_THE_BAT      (__THEBAT_MUA && KB_DATE_CONTAINS_TAB)
##} KB_FAKED_THE_BAT

##{ KB_RATWARE_BOUNDARY

meta   KB_RATWARE_BOUNDARY   __RATWARE_BOUND_A || __RATWARE_BOUND_B
##} KB_RATWARE_BOUNDARY

##{ KB_RATWARE_MSGID

meta   KB_RATWARE_MSGID        (__KB_MSGID_OUTLOOK_888 && __ANY_OUTLOOK_MUA)
##} KB_RATWARE_MSGID

##{ KB_RATWARE_OUTLOOK_08

header  KB_RATWARE_OUTLOOK_08  ALL =~ /^Message-Id: <....([0-9a-f]{8})\$[0-9a-f]{8}\$.{100,400}boundary="----=_NextPart_000_...._\1\./msi  # "
##} KB_RATWARE_OUTLOOK_08

##{ KB_RATWARE_OUTLOOK_12

header  KB_RATWARE_OUTLOOK_12  ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{4})[0-9a-f]{4}\$.{100,400}boundary="----=_NextPart_000_...._\1\.\2/msi  # "
##} KB_RATWARE_OUTLOOK_12

##{ KB_RATWARE_OUTLOOK_16

header  KB_RATWARE_OUTLOOK_16  ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{8})\$.{100,400}boundary="----=_NextPart_000_...._\1\.\2/msi  # "
##} KB_RATWARE_OUTLOOK_16

##{ KB_RATWARE_OUTLOOK_MID

header  KB_RATWARE_OUTLOOK_MID  ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{8})\$[0-9a-f]{8}\@.{100,400}boundary="----=_NextPart_000_...._\1\.\2"/msi
##} KB_RATWARE_OUTLOOK_MID

##{ KHOP_SC_CIDR16

header   KHOP_SC_CIDR16  Received =~ /(?-xism:\b(?:1(?:09\.184|78\.93)|59\.9[23]|222\.253|94\.179)(?:\.[012]?[0-9]{1,2}){2}\b)/
describe KHOP_SC_CIDR16  Relay listed in SpamCop top 12 IP/16 CIDRs
#score    KHOP_SC_CIDR16  0.6 0.5 0.9 0.75
##} KHOP_SC_CIDR16

##{ KHOP_SC_CIDR16 if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )

if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
#  score  KHOP_SC_CIDR16 	(0.8)	# RCVD_IN_PBL
endif
##} KHOP_SC_CIDR16 if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )

##{ KHOP_SC_CIDR24

header   KHOP_SC_CIDR24  Received =~ /(?-xism:\b(?:2(?:1(?:1\.60\.219|3\.87\.76)|21\.143\.49)|111\.224\.250|81\.192\.199|93\.91\.196)\.[012]?[0-9]{1,2}\b)/
describe KHOP_SC_CIDR24  Relay listed in SpamCop top 12 IP/24 CIDRs
#score    KHOP_SC_CIDR24  0.9 0.8 1.3 1.2
##} KHOP_SC_CIDR24

##{ KHOP_SC_CIDR24 if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )

if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
#  score  KHOP_SC_CIDR24 	(0.9)	# RCVD_IN_PBL
endif
##} KHOP_SC_CIDR24 if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )

##{ KHOP_SC_TOP200

header   KHOP_SC_TOP200  Received =~ /(?-xism:\b(?:2(?:0(?:2\.(?:1(?:6(?:4\.52\.100|5\.199\.27)|5(?:2\.42|4\.81)\.242|29\.196\.210|42\.153\.21)|4(?:3\.18(?:2\.178|1\.7)|1\.92\.146)|7(?:4\.171\.214|5\.62\.10)|53\.(?:80\.203|79\.74)|62\.122\.118|39\.48\.221|87\.47\.130)|0\.(?:(?:95\.162\.20|54\.72\.3)0|8(?:0\.140\.61|7\.116\.58)|3(?:5\.38\.129|3\.214\.2)|234\.200\.93|49\.183\.202|74\.158\.135|6\.193\.89)|1\.(?:2(?:2(?:0\.232\.61|8\.3\.2)|34\.147\.213|51\.76\.132)|116\.36\.98)|8\.(?:101\.(?:55\.162|61\.60)|46\.105\.195|70\.160\.8)|3\.1(?:76\.142\.137|99\.72\.228)|9\.(?:216\.227\.33|94\.196\.170)|7\.(?:248\.35\.244|57\.90\.161))|1(?:7\.(?:1(?:9(?:8\.160\.218|9\.231\.249)|50\.4(?:1\.16|5\.)5|74\.229\.221|69\.219\.20)|64\.104\.107|76\.2\.129)|1\.(?:2(?:4(?:7\.239\.239|1\.111\.3)|34\.93\.154|02\.2\.97)|(?:105\.37\.5|43\.80\.24)8|60\.219\.183)|2\.(?:1(?:7(?:5\.53\.118|9\.75\.114)|54\.58\.90)|63\.221\.10)|3\.2(?:51\.1(?:34\.138|69\.132)|26\.144\.65)|8\.(?:248\.11\.69|38\.12\.246)|6\.230\.133\.69|9\.95\.129\.206|0\.5\.68\.20)|2(?:2\.(?:124\.198\.131|237\.78\.177)|0\.22(?:7\.154\.244|5\.226\.70)|1\.143\.49\.246))|1(?:9(?:0\.(?:1(?:5(?:6\.232\.132|8\.228\.179|9\.90\.201)|46\.1\.28)|2(?:10\.28\.193|08\.36\.90)|9(?:6\.68\.17|2\.26\.)9|4\.44\.237)|5\.(?:2(?:4\.(?:209\.14|93\.252)|30\.140\.18|2\.107\.1)|1(?:89\.46\.253|28\.56\.20)|95\.223\.25|88\.93\.92)|6\.(?:2(?:20\.57\.60|8\.240\.2)|12\.22(?:6\.220|8\.119))|4\.(?:126\.204\.31|63\.136\.18)|3\.(?:106\.64\.36|227\.98\.4))|2(?:2\.(?:1(?:83\.212\.113|69\.125\.35|55\.1\.174)|252\.234\.74|55\.106\.18)|1\.(?:1\.(?:37\.14[567]|18\.242)|5(?:2\.155\.13|8\.193\.)3)|5\.(?:2(?:35\.128\.246|12\.67\.102)|60\.164\.[25])|3\.(?:237\.123\.193|49\.45\.154)|4\.124\.4(?:3\.32|4\.10)|\.191\.88\.50)|1(?:6\.(?:50\.1(?:54\.130|75\.101)|118\.107\.[34])|0\.(?:139\.148\.109|45\.144\.227)|4\.14(?:3\.230\.162|1\.5\.3)|3\.1(?:62\.70\.74|9\.94\.2)|1\.224\.250\.13[025]|8\.102\.131\.130|5\.133\.151\.85|9\.226\.23\.8)|8(?:6\.2(?:4\.(?:1[6789]|2[0123])\.3|8\.228\.1)|9\.182\.132\.168)|57\.100\.228\.178|40\.111\.153\.4)|6(?:1\.(?:1(?:2\.62\.234|7\.76\.197)|9(?:7\.32\.104|\.6\.245)|4\.104\.38)|2\.(?:14(?:9\.(?:166\.45|226\.69)|2\.11\.3)|77\.221\.54|38\.54\.81)|6\.(?:2(?:3(?:1\.167\.70|5\.160\.11)|42\.21\.64)|46\.179\.10)|0\.25(?:0\.102\.209|4\.104\.18)|4\.76\.123\.98)|8(?:0\.(?:93\.12(?:5\.186|4\.1)|82\.181\.20|237\.31\.1)|5\.(?:11(?:8\.193\.158|3\.203\.82)|235\.164\.166)|3\.1(?:70\.123\.102|3\.218\.106|6\.167\.14)|(?:9\.121\.245\.19|7\.204\.24\.10)0|4\.22\.63\.74)|9(?:1\.121\.1(?:5(?:0\.6|8\.7)|71\.3)0|3\.(?:91\.196\.9[19]|62\.200\.26)|5\.1(?:70\.208\.114|54\.240\.98)|4\.(?:153\.224\.26|23\.37\.55))|7(?:7\.(?:73\.139\.(?:2(?:43)?|3)|246\.179\.13|36\.153\.21)|(?:9\.174\.66\.7|8\.97\.11\.3)5|5\.126\.213\.58)|5(?:8\.(?:6(?:8\.66\.25[012]|9\.225\.234)|248\.4\.67)|9\.163\.26\.211))\b)/
describe KHOP_SC_TOP200  Relay listed in SpamCop top 200 spammer IPs
#score    KHOP_SC_TOP200  3.4 3.2 3.7 3.5
##} KHOP_SC_TOP200

##{ KHOP_SC_TOP200 if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )

if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
#  score  KHOP_SC_TOP200 	 4.6	# RCVD_IN_BL_SPAMCOP_NET + RCVD_IN_XBL++
endif
##} KHOP_SC_TOP200 if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )

##{ KHOP_SC_TOP_CIDR16

header   KHOP_SC_TOP_CIDR16  Received =~ /(?-xism:\b(?:1(?:2(?:3\.2[37]|1\.247)|90\.24)|92\.(?:47|80))(?:\.[012]?[0-9]{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16  Relay listed in SpamCop top 6 IP/16 CIDRs
#score    KHOP_SC_TOP_CIDR16  0.9 0.8 1.3 1.2
##} KHOP_SC_TOP_CIDR16

##{ KHOP_SC_TOP_CIDR16 if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )

if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
#  score  KHOP_SC_TOP_CIDR16	(0.9)	# RCVD_IN_PBL
endif
##} KHOP_SC_TOP_CIDR16 if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )

##{ KHOP_SC_TOP_CIDR8

header   KHOP_SC_TOP_CIDR8  Received =~ /(?-xism:\b(?:9[25]|190|201)(?:\.[012]?[0-9]{1,2}){3}\b)/
describe KHOP_SC_TOP_CIDR8  Relay listed in SpamCop top 4 IP/8 CIDRs
#score    KHOP_SC_TOP_CIDR8  0.5 0.4 0.8 0.6
##} KHOP_SC_TOP_CIDR8

##{ KHOP_SC_TOP_CIDR8 if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )

if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
#  score  KHOP_SC_TOP_CIDR8	(0.2)	# RCVD_IN_PBL
endif
##} KHOP_SC_TOP_CIDR8 if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )

##{ LIVEFILESTORE

uri  LIVEFILESTORE       m~livefilestore.com/~
##} LIVEFILESTORE

##{ LONG_TERM_PRICE

body LONG_TERM_PRICE  /long\W+term\W+(target|projected)(\W+price)?/i
##} LONG_TERM_PRICE

##{ LOOPHOLE_1

body		LOOPHOLE_1	/loop-?hole in the banking/i
describe	LOOPHOLE_1	A loop hole in the banking laws?
##} LOOPHOLE_1

##{ LOTTERY_1

meta LOTTERY_1      (__DBLCLAIM && __CASHPRZ)
##} LOTTERY_1

##{ LOTTERY_PH_004470

meta LOTTERY_PH_004470  (__AFF_004470_NUMBER && __AFF_LOTTERY)
##} LOTTERY_PH_004470

##{ LOTTO_AGENT

body     LOTTO_AGENT      /\b(?:claim(?:s|ing)?(?:\sprocessing)?|fiducia\w+|reimbursement|prize\stransfer|(?:international|foreign)\sremittance|payment|immunity|grants?)\s?(?:agent|manager|officer|secretary)/i
describe LOTTO_AGENT      Claims Agent
#score    LOTTO_AGENT      0.50
##} LOTTO_AGENT

##{ L_SPAM_TOOL_13

header L_SPAM_TOOL_13   Date =~ /\s[+-]\d(?![2358]45)\d[124-9]\d$/
##} L_SPAM_TOOL_13

##{ MANY_GOOG_PROXY

meta           MANY_GOOG_PROXY     __FEEDPROXY > 4
describe       MANY_GOOG_PROXY     Many Google feedproxy URIs
##} MANY_GOOG_PROXY

##{ MANY_SPAN_IN_TEXT

meta           MANY_SPAN_IN_TEXT   (__SPAN_BEG_TEXT > 4) && (__SPAN_END_TEXT > 4)
describe       MANY_SPAN_IN_TEXT   Many <SPAN> tags embedded within text
##} MANY_SPAN_IN_TEXT

##{ MID_DEGREES

header MID_DEGREES  Message-ID =~ /^<\d{14}\.[A-F0-9]{10}\@[A-Z0-9]+>$/
##} MID_DEGREES

##{ MIME_BOUND_EQ_REL

header MIME_BOUND_EQ_REL    Content-Type =~ /boundary="=====================_\d+==\.REL"/s
##} MIME_BOUND_EQ_REL

##{ MIME_PHP_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  meta        MIME_PHP_NO_TEXT  (T_MIME_NO_TEXT && __XM_PHP)
#  score       MIME_PHP_NO_TEXT  2.00
  describe    MIME_PHP_NO_TEXT  No text body parts, X-Mailer: PHP
endif
##} MIME_PHP_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ MONEY_FRAUD_8

meta     MONEY_FRAUD_8 T_LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AFR_UNION + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH +  __BARRISTER + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER + __FEES + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + T_LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS +  __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRUNK_BOX +  __UN + __UNCLAIMED + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 8)
#score    MONEY_FRAUD_8 1.50
describe MONEY_FRAUD_8 Lots of money and very many fraud phrases
##} MONEY_FRAUD_8

##{ MONEY_FROM_MISSP

meta     MONEY_FROM_MISSP   T_LOTS_OF_MONEY && T_FROM_MISSPACED
describe MONEY_FROM_MISSP   Lots of money and misspaced From
#score    MONEY_FROM_MISSP   1.5
##} MONEY_FROM_MISSP

##{ MSOE_MID_WRONG_CASE

meta MSOE_MID_WRONG_CASE  (__XM_OUTLOOK_EXPRESS && __MSOE_MID_WRONG_CASE && !__MIMEOLE_1106)
##} MSOE_MID_WRONG_CASE

##{ NSL_ORIG_FROM_41

header          NSL_ORIG_FROM_41        X-Originating-IP =~ /^(?:.+\[)?41\./
describe        NSL_ORIG_FROM_41        Originates from 41.0.0.0/8
#score           NSL_ORIG_FROM_41        0.20
##} NSL_ORIG_FROM_41

##{ NSL_RCVD_FROM_41

header          NSL_RCVD_FROM_41        Received =~ /\[41\./
describe        NSL_RCVD_FROM_41        Received from 41.0.0.0/8
#score           NSL_RCVD_FROM_41        0.10
##} NSL_RCVD_FROM_41

##{ NSL_RCVD_FROM_USER

header         NSL_RCVD_FROM_USER       Received =~ /from User [\[\(]/
describe       NSL_RCVD_FROM_USER       Received from User
##} NSL_RCVD_FROM_USER

##{ NSL_RCVD_HELO_USER

header         NSL_RCVD_HELO_USER       Received =~ /helo[= ]user\)/i
describe       NSL_RCVD_HELO_USER       Received from HELO User
##} NSL_RCVD_HELO_USER

##{ NULL_IN_BODY

full NULL_IN_BODY	/\x00/
describe NULL_IN_BODY   Message has NUL (ASCII 0) byte in message
##} NULL_IN_BODY

##{ PART_CID_STOCK ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
meta PART_CID_STOCK      (__ANY_IMAGE_ATTACH&&__PART_STOCK_CID&&!__PART_STOCK_CL&&!__PART_STOCK_CD_F)
describe PART_CID_STOCK  Has a spammy image attachment (by Content-ID)
endif
##} PART_CID_STOCK ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ PART_CID_STOCK_LESS ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
meta PART_CID_STOCK_LESS (__ANY_IMAGE_ATTACH&&__PART_CID_STOCK_LESS)
describe PART_CID_STOCK_LESS Has a spammy image attachment (by Content-ID, more specific)
endif
##} PART_CID_STOCK_LESS ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ RCVD_BAD_ID

header RCVD_BAD_ID      Received =~ /\bid\s+[a-zA-Z0-9_+\/\\,-]+(?:[!"\#\$\%&'()*:<=>?\@\[\]^\`{|}~]|;\S)/
##} RCVD_BAD_ID

##{ RCVD_FORGED_WROTE

header RCVD_FORGED_WROTE    Received =~ / by \S+ with esmtp \([^a-z ]{6,} [^a-z ]{3,}\) id/
describe RCVD_FORGED_WROTE  Forged 'Received' header found ('wrote:' spam)
##} RCVD_FORGED_WROTE

##{ RCVD_FORGED_WROTE2

header RCVD_FORGED_WROTE2 Received =~ /from [0-9.]+ \(HELO \S+[A-Za-z]+\) by (\S+) with esmtp \(\S+\s\S+\) id \S{6}-\S{6}-\S\S for \S+@\1;/s
##} RCVD_FORGED_WROTE2

##{ RCVD_IN_BRBL_LASTEXT ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_BRBL_LASTEXT   eval:check_rbl('brbl-lastexternal','bb.barracudacentral.org')
tflags RCVD_IN_BRBL_LASTEXT   net
endif
##} RCVD_IN_BRBL_LASTEXT ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_CSS

header RCVD_IN_CSS              eval:check_rbl_sub('zen', '127.0.0.3')
describe RCVD_IN_CSS            Received via a relay in Spamhaus CSS
tflags RCVD_IN_CSS              net
##} RCVD_IN_CSS

##{ RCVD_IN_DNSWL_HI ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header	RCVD_IN_DNSWL_HI	eval:check_rbl_sub('dnswl-firsttrusted', '127.0.\d+.3')
describe RCVD_IN_DNSWL_HI	Sender listed at http://www.dnswl.org/, high trust
tflags RCVD_IN_DNSWL_HI		nice net
endif
##} RCVD_IN_DNSWL_HI ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_DNSWL_LOW ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header	RCVD_IN_DNSWL_LOW	eval:check_rbl_sub('dnswl-firsttrusted', '127.0.\d+.1')
describe RCVD_IN_DNSWL_LOW	Sender listed at http://www.dnswl.org/, low trust
tflags RCVD_IN_DNSWL_LOW	nice net
endif
##} RCVD_IN_DNSWL_LOW ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_DNSWL_MED ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header	RCVD_IN_DNSWL_MED	eval:check_rbl_sub('dnswl-firsttrusted', '127.0.\d+.2')
describe RCVD_IN_DNSWL_MED	Sender listed at http://www.dnswl.org/, medium trust
tflags RCVD_IN_DNSWL_MED	nice net
endif
##} RCVD_IN_DNSWL_MED ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_DNSWL_NONE ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header	RCVD_IN_DNSWL_NONE	eval:check_rbl_sub('dnswl-firsttrusted', '127.0.\d+.0')
describe RCVD_IN_DNSWL_NONE	Sender listed at http://www.dnswl.org/, low trust
tflags RCVD_IN_DNSWL_NONE	nice net
endif
##} RCVD_IN_DNSWL_NONE ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_DK ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_DK			eval:check_rbl_sub('iadb-firsttrusted', '^127.2.255.3$')
describe RCVD_IN_IADB_DK		IADB: Sender publishes Domain Keys record
tflags RCVD_IN_IADB_DK			net nice
endif
##} RCVD_IN_IADB_DK ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_DOPTIN		eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.10$')
describe RCVD_IN_IADB_DOPTIN		IADB: All mailing list mail is confirmed opt-in
tflags RCVD_IN_IADB_DOPTIN		net nice
endif
##} RCVD_IN_IADB_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_DOPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_DOPTIN_GT50		eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.9$')
describe RCVD_IN_IADB_DOPTIN_GT50	IADB: Confirmed opt-in used more than 50% of the time
tflags RCVD_IN_IADB_DOPTIN_GT50		net nice
endif
##} RCVD_IN_IADB_DOPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_DOPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_DOPTIN_LT50		eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.8$')
describe RCVD_IN_IADB_DOPTIN_LT50	IADB: Confirmed opt-in used less than 50% of the time
tflags RCVD_IN_IADB_DOPTIN_LT50		net nice
endif
##} RCVD_IN_IADB_DOPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_EDDB ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_EDDB		eval:check_rbl_sub('iadb-firsttrusted', '^127.0.2.1$')
describe RCVD_IN_IADB_EDDB		IADB: Participates in Email Deliverability Database
tflags RCVD_IN_IADB_EDDB		net nice
endif
##} RCVD_IN_IADB_EDDB ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_EPIA ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_EPIA		eval:check_rbl_sub('iadb-firsttrusted', '^127.0.2.2$')
describe RCVD_IN_IADB_EPIA		IADB: Member of Email Processing Industry Alliance
tflags RCVD_IN_IADB_EPIA		net nice
endif
##} RCVD_IN_IADB_EPIA ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_GOODMAIL ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_GOODMAIL		eval:check_rbl_sub('iadb-firsttrusted', '^127.2.255.103$')
describe RCVD_IN_IADB_GOODMAIL		IADB: Sender has been certified by GoodMail
tflags RCVD_IN_IADB_GOODMAIL 		net nice
endif
##} RCVD_IN_IADB_GOODMAIL ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_LISTED ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_LISTED		eval:check_rbl_sub('iadb-firsttrusted', '^127.0.0.[12]$')
describe RCVD_IN_IADB_LISTED		Participates in the IADB system
tflags RCVD_IN_IADB_LISTED		net nice
endif
##} RCVD_IN_IADB_LISTED ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_LOOSE ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_LOOSE		eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.4$')
describe RCVD_IN_IADB_LOOSE		IADB: Adds relationship addrs w/out opt-in
tflags RCVD_IN_IADB_LOOSE		net nice
endif
##} RCVD_IN_IADB_LOOSE ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_MI_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_MI_CPEAR		eval:check_rbl_sub('iadb-firsttrusted', '^127.101.1.10$')
describe RCVD_IN_IADB_MI_CPEAR		IADB: Complies with Michigan's CPEAR law
tflags RCVD_IN_IADB_MI_CPEAR		net nice
endif
##} RCVD_IN_IADB_MI_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_MI_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_MI_CPR_30		eval:check_rbl_sub('iadb-firsttrusted', '^127.101.101.10$')
describe RCVD_IN_IADB_MI_CPR_30		IADB: Checked lists against Michigan's CPR within 30 days
tflags RCVD_IN_IADB_MI_CPR_30		net nice
endif
##} RCVD_IN_IADB_MI_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_MI_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_MI_CPR_MAT		eval:check_rbl_sub('iadb-firsttrusted', '^127.101.201.10$')
describe RCVD_IN_IADB_MI_CPR_MAT	IADB: Sends no material under Michigan's CPR
tflags RCVD_IN_IADB_MI_CPR_MAT		net nice
endif
##} RCVD_IN_IADB_MI_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_ML_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_ML_DOPTIN		eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.100$')
describe RCVD_IN_IADB_ML_DOPTIN		IADB: Mailing list email only, confirmed opt-in
tflags RCVD_IN_IADB_ML_DOPTIN		net nice
endif
##} RCVD_IN_IADB_ML_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_NOCONTROL ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_NOCONTROL		eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.0$')
describe RCVD_IN_IADB_NOCONTROL		IADB: Has absolutely no mailing controls in place
tflags RCVD_IN_IADB_NOCONTROL		net nice
endif
##} RCVD_IN_IADB_NOCONTROL ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_OOO ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_OOO			eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.200$')
describe RCVD_IN_IADB_OOO		IADB: One-to-one/transactional email only
tflags RCVD_IN_IADB_OOO			net nice
endif
##} RCVD_IN_IADB_OOO ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_OPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_OPTIN		eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.7$')
describe RCVD_IN_IADB_OPTIN		IADB: All mailing list mail is opt-in
tflags RCVD_IN_IADB_OPTIN		net nice
endif
##} RCVD_IN_IADB_OPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_OPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_OPTIN_GT50		eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.6$')
describe RCVD_IN_IADB_OPTIN_GT50	IADB: Opt-in used more than 50% of the time
tflags RCVD_IN_IADB_OPTIN_GT50		net nice
endif
##} RCVD_IN_IADB_OPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_OPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_OPTIN_LT50		eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.5$')
describe RCVD_IN_IADB_OPTIN_LT50	IADB: Opt-in used less than 50% of the time
tflags RCVD_IN_IADB_OPTIN_LT50		net nice
endif
##} RCVD_IN_IADB_OPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_OPTOUTONLY ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_OPTOUTONLY		eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.1$')
describe RCVD_IN_IADB_OPTOUTONLY 	IADB: Scrapes addresses, pure opt-out only
tflags RCVD_IN_IADB_OPTOUTONLY		net nice
endif
##} RCVD_IN_IADB_OPTOUTONLY ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_RDNS ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_RDNS		eval:check_rbl_sub('iadb-firsttrusted', '^127.2.255.4$')
describe RCVD_IN_IADB_RDNS		IADB: Sender has reverse DNS record
tflags RCVD_IN_IADB_RDNS		net nice
endif
##} RCVD_IN_IADB_RDNS ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_SENDERID ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_SENDERID		eval:check_rbl_sub('iadb-firsttrusted', '^127.2.255.2$')
describe RCVD_IN_IADB_SENDERID		IADB: Sender publishes Sender ID record
tflags RCVD_IN_IADB_SENDERID		net nice
endif
##} RCVD_IN_IADB_SENDERID ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_SPF ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_SPF			eval:check_rbl_sub('iadb-firsttrusted', '^127.2.255.1$')
describe RCVD_IN_IADB_SPF		IADB: Sender publishes SPF record
tflags RCVD_IN_IADB_SPF			net nice
endif
##} RCVD_IN_IADB_SPF ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_UNVERIFIED_1 ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_UNVERIFIED_1	eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.2$')
describe RCVD_IN_IADB_UNVERIFIED_1	IADB: Accepts unverified sign-ups
tflags RCVD_IN_IADB_UNVERIFIED_1	net nice
endif
##} RCVD_IN_IADB_UNVERIFIED_1 ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_UNVERIFIED_2 ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_UNVERIFIED_2	eval:check_rbl_sub('iadb-firsttrusted', '^127.3.100.3$')
describe RCVD_IN_IADB_UNVERIFIED_2	IADB: Accepts unverified sign-ups, gives chance to opt out
tflags RCVD_IN_IADB_UNVERIFIED_2	net nice
endif
##} RCVD_IN_IADB_UNVERIFIED_2 ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_UT_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_UT_CPEAR		eval:check_rbl_sub('iadb-firsttrusted', '^127.101.2.10$')
describe RCVD_IN_IADB_UT_CPEAR		IADB: Complies with Utah's CPEAR law
tflags RCVD_IN_IADB_UT_CPEAR		net nice
endif
##} RCVD_IN_IADB_UT_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_UT_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_UT_CPR_30		eval:check_rbl_sub('iadb-firsttrusted', '^127.101.102.10$')
describe RCVD_IN_IADB_UT_CPR_30		IADB: Checked lists against Utah's CPR within 30 days
tflags RCVD_IN_IADB_UT_CPR_30		net nice
endif
##} RCVD_IN_IADB_UT_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_IADB_UT_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header RCVD_IN_IADB_UT_CPR_MAT		eval:check_rbl_sub('iadb-firsttrusted', '^127.101.202.10$')
describe RCVD_IN_IADB_UT_CPR_MAT	IADB: Sends no material under Utah's CPR
tflags RCVD_IN_IADB_UT_CPR_MAT		net nice
endif
##} RCVD_IN_IADB_UT_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval

##{ RCVD_IN_PSBL

header   RCVD_IN_PSBL  eval:check_rbl('psbl-lastexternal', 'psbl.surriel.com.')
describe RCVD_IN_PSBL  Received via a relay in PSBL
tflags   RCVD_IN_PSBL  net
##} RCVD_IN_PSBL

##{ RCVD_IN_RP_CERTIFIED

header RCVD_IN_RP_CERTIFIED     eval:check_rbl_txt('ssc-firsttrusted', 'sa-trusted.bondedsender.org.')
describe RCVD_IN_RP_CERTIFIED   Sender is in Return Path Certified (trusted relay)
tflags RCVD_IN_RP_CERTIFIED     net nice
##} RCVD_IN_RP_CERTIFIED

##{ RCVD_IN_RP_RNBL

header RCVD_IN_RP_RNBL         eval:check_rbl('rnbl-lastexternal','bl.score.senderscore.com.')
describe RCVD_IN_RP_RNBL       Relay in RNBL, https://senderscore.org/blacklistlookup/
tflags RCVD_IN_RP_RNBL         net
##} RCVD_IN_RP_RNBL

##{ RCVD_IN_RP_SAFE

header RCVD_IN_RP_SAFE     eval:check_rbl_txt('ssc-firsttrusted','sa-accredit.habeas.com.')
describe RCVD_IN_RP_SAFE   Sender is in Return Path Safe (trusted relay)
tflags RCVD_IN_RP_SAFE     net nice
##} RCVD_IN_RP_SAFE

##{ RCVD_MAIL_COM

header RCVD_MAIL_COM        Received =~ /[\s\(\[](?:post|mail)\.com[\s\)\]]/is
describe RCVD_MAIL_COM      Forged Received header (contains post.com or mail.com)
##} RCVD_MAIL_COM

##{ RDNS_LOCALHOST

header         RDNS_LOCALHOST  X-Spam-Relays-External =~ /^\[ ip=(?!127)\d+\.\d+\.\d+\.\d+ rdns=localhost(?:\.localdomain)? /i
describe       RDNS_LOCALHOST  Sender's public rDNS is "localhost"
##} RDNS_LOCALHOST

##{ REPLYTO_WITHOUT_TO_CC

meta REPLYTO_WITHOUT_TO_CC     (__REPLYTO_EXISTS && !__TOCC_EXISTS)
##} REPLYTO_WITHOUT_TO_CC

##{ S25R_1

describe S25R_1 S25R: Bottom of rDNS has num, non-num, num
meta	 S25R_1 __LAST_EXTERNAL_RELAY_NO_AUTH && __S25R_1 && !(__DOS_RELAYED_EXT||__S25R_2||__S25R_3||__S25R_4||__S25R_5||__S25R_6 || __NOT_SPOOFED || __GREYLISTED)
##} S25R_1

##{ S25R_6

describe S25R_6 S25R: rDNS looks dynamic or customer-facing
meta	 S25R_6 __LAST_EXTERNAL_RELAY_NO_AUTH && __S25R_6 && !(__S25R_1||__S25R_2||__S25R_3||__S25R_4||__S25R_5 || __NOT_SPOOFED || __GREYLISTED)
##} S25R_6

##{ SANE_04e8bf28eb445199a7f11b943c44d209

body SANE_04e8bf28eb445199a7f11b943c44d209 /replica watches/
describe SANE_04e8bf28eb445199a7f11b943c44d209 Email.Spam.Gen3177.Sanesecurity.08051611
#score SANE_04e8bf28eb445199a7f11b943c44d209 0.01
##} SANE_04e8bf28eb445199a7f11b943c44d209

##{ SANE_1c4f3286fa4aed6424ced88bfaf8b09c

body SANE_1c4f3286fa4aed6424ced88bfaf8b09c /innerhalb von 2\-3 Tagen/
#score SANE_1c4f3286fa4aed6424ced88bfaf8b09c 0.01
describe SANE_1c4f3286fa4aed6424ced88bfaf8b09c Email.Spam.Gen3234.Sanesecurity.08052309
##} SANE_1c4f3286fa4aed6424ced88bfaf8b09c

##{ SANE_2b173a7fb7518c75ac8a2d294d773fd8

body SANE_2b173a7fb7518c75ac8a2d294d773fd8 /High Quality Watches/
#score SANE_2b173a7fb7518c75ac8a2d294d773fd8 0.01
describe SANE_2b173a7fb7518c75ac8a2d294d773fd8 Email.Spam.Sanesecurity.Url_2496
##} SANE_2b173a7fb7518c75ac8a2d294d773fd8

##{ SANE_3b92eda751c992f230f215fb7eb36844

body SANE_3b92eda751c992f230f215fb7eb36844 /Replica Watches/
describe SANE_3b92eda751c992f230f215fb7eb36844 Email.Spam.Gen158.Sanesecurity.07012700
#score SANE_3b92eda751c992f230f215fb7eb36844 0.01
##} SANE_3b92eda751c992f230f215fb7eb36844

##{ SANE_4ef8302546bf270a19baf98508afacc4

body SANE_4ef8302546bf270a19baf98508afacc4 /replica watch/
#score SANE_4ef8302546bf270a19baf98508afacc4 0.01
describe SANE_4ef8302546bf270a19baf98508afacc4 Email.Spam.Gen1941.Sanesecurity.07112519
##} SANE_4ef8302546bf270a19baf98508afacc4

##{ SANE_7429530a7398f43f1f1b795f9420714e

body SANE_7429530a7398f43f1f1b795f9420714e /MSN Featured Offers/
describe SANE_7429530a7398f43f1f1b795f9420714e Email.Spam.Gen2507.Sanesecurity.08021303
#score SANE_7429530a7398f43f1f1b795f9420714e 0.01
##} SANE_7429530a7398f43f1f1b795f9420714e

##{ SANE_75491b468ec2e117e50f9842d32abfab

body SANE_75491b468ec2e117e50f9842d32abfab /Also we have so much soft for MACINTOSH\!\!\!/
#score SANE_75491b468ec2e117e50f9842d32abfab 0.01
describe SANE_75491b468ec2e117e50f9842d32abfab Email.Spam.Gen1361.Sanesecurity.07100500
##} SANE_75491b468ec2e117e50f9842d32abfab

##{ SANE_91eb43f705d25c804374a746d7519660

body SANE_91eb43f705d25c804374a746d7519660 /online casino/
describe SANE_91eb43f705d25c804374a746d7519660 Email.Malware.Sanesecurity.07011300
#score SANE_91eb43f705d25c804374a746d7519660 0.01
##} SANE_91eb43f705d25c804374a746d7519660

##{ SANE_d0d2b0f6373bf91253d66dd74c594b87

body SANE_d0d2b0f6373bf91253d66dd74c594b87 /Luxury Watches/
#score SANE_d0d2b0f6373bf91253d66dd74c594b87 0.01
describe SANE_d0d2b0f6373bf91253d66dd74c594b87 Email.Spam.Sanesecurity.Url_2499
##} SANE_d0d2b0f6373bf91253d66dd74c594b87

##{ SB_GIF_AND_NO_URIS

meta SB_GIF_AND_NO_URIS (__GIF_ATTACH&&!__HAS_ANY_URI&&!__HAS_ANY_EMAIL)
##} SB_GIF_AND_NO_URIS

##{ SHORT_HELO_AND_INLINE_IMAGE

meta SHORT_HELO_AND_INLINE_IMAGE     (__HELO_NO_DOMAIN && __ANY_IMAGE_ATTACH)
describe SHORT_HELO_AND_INLINE_IMAGE    Short HELO string, with inline image
##} SHORT_HELO_AND_INLINE_IMAGE

##{ SHORT_TERM_PRICE

body SHORT_TERM_PRICE /short\W+term\W+(target|projected)(\W+price)?/i
##} SHORT_TERM_PRICE

##{ SPAMMY_XMAILER

meta SPAMMY_XMAILER (__XM_OL_28001441||__XM_OL_48072300||__XM_OL_28004682||__XM_OL_10_0_4115||__XM_OL_4_72_2106_4)
describe SPAMMY_XMAILER X-Mailer string is common in spam and not in ham
##} SPAMMY_XMAILER

##{ STOCK_IMG_CTYPE

meta STOCK_IMG_CTYPE (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__CTYPE_ONETAB_GIF&&__HTML_IMG_ONLY)
describe STOCK_IMG_CTYPE  Stock spam image part, with distinctive Content-Type header
##} STOCK_IMG_CTYPE

##{ STOCK_IMG_HDR_FROM

meta STOCK_IMG_HDR_FROM  (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__TVD_FW_GRAPHIC_ID1&&__HTML_IMG_ONLY)
describe STOCK_IMG_HDR_FROM Stock spam image part, with distinctive From line
##} STOCK_IMG_HDR_FROM

##{ STOCK_IMG_HTML

meta STOCK_IMG_HTML  (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__PART_STOCK_CID&&__HTML_IMG_ONLY)
describe STOCK_IMG_HTML   Stock spam image part, with distinctive HTML
##} STOCK_IMG_HTML

##{ STOCK_IMG_OUTLOOK

meta STOCK_IMG_OUTLOOK  (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__XM_MS_IN_GENERAL&&__HTML_LENGTH_1536_2048)
describe STOCK_IMG_OUTLOOK  Stock spam image part, with Outlook-like features
##} STOCK_IMG_OUTLOOK

##{ STOCK_PRICES

meta STOCK_PRICES (SHORT_TERM_PRICE && LONG_TERM_PRICE)
##} STOCK_PRICES

##{ STOX_AND_PRICE

meta STOX_AND_PRICE     CURR_PRICE && STOX_REPLY_TYPE
##} STOX_AND_PRICE

##{ STOX_REPLY_TYPE

header STOX_REPLY_TYPE  Content-Type =~ /text\/plain; .* reply-type=original/
##} STOX_REPLY_TYPE

##{ STOX_REPLY_TYPE_WITHOUT_QUOTES

meta STOX_REPLY_TYPE_WITHOUT_QUOTES (STOX_REPLY_TYPE && !(__HS_SUBJ_RE_FW || __HS_QUOTE))
##} STOX_REPLY_TYPE_WITHOUT_QUOTES

##{ STYLE_GIBBERISH

rawbody        STYLE_GIBBERISH          /<style[^>]{0,30}>(?:\s{0,80}[^\s:;<]){150}/im
##} STYLE_GIBBERISH

##{ SUBJECT_NEEDS_ENCODING

meta SUBJECT_NEEDS_ENCODING    (!__SUBJECT_ENCODED_B64 && !__SUBJECT_ENCODED_QP) && __SUBJECT_NEEDS_MIME
##} SUBJECT_NEEDS_ENCODING

##{ TAB_IN_FROM

header		TAB_IN_FROM		From:raw =~ /^\t/s
describe	TAB_IN_FROM		From starts with a tab
##} TAB_IN_FROM

##{ TBIRD_SUSP_MIME_BDRY

meta           TBIRD_SUSP_MIME_BDRY  __MUA_TBIRD && __TB_MIME_BDRY_NO_Z
describe       TBIRD_SUSP_MIME_BDRY  Unlikely Thunderbird MIME boundary
##} TBIRD_SUSP_MIME_BDRY

##{ THEBAT_UNREG

header  THEBAT_UNREG  X-Mailer =~ /^The Bat! .{0,20} UNREG$/
##} THEBAT_UNREG

##{ TINY_FLOAT

rawbody        TINY_FLOAT         /\bstyle\s*=\s*"[^"]{0,40}?(?:(?:FONT-SIZE\s*:\s+\dpx|FLOAT\s*:\s+(?:right|left))(?:;\s+)?(?:(?!(?:FONT-SIZE|FLOAT))\w+:\s+\w+;?\s*)*){2}/i
describe       TINY_FLOAT           Has small-font floating HTML elements - text obfuscation?
#score          TINY_FLOAT           2.00
##} TINY_FLOAT

##{ TO_NO_BRKTS_DYNIP

meta       TO_NO_BRKTS_DYNIP       __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && RDNS_DYNAMIC
#score      TO_NO_BRKTS_DYNIP       0.20
##} TO_NO_BRKTS_DYNIP

##{ TT_MSGID_TRUNC

header TT_MSGID_TRUNC   Message-Id =~ /^\s*<?[^<>\s]+\[\d+$/
describe TT_MSGID_TRUNC Scora: Message-Id ends after left-bracket + digits
##} TT_MSGID_TRUNC

##{ TT_OBSCURED_VALIUM

meta TT_OBSCURED_VALIUM         ( __TT_BROKEN_VALIUM || __TT_OBSCURED_VALIUM ) && ! __TT_VALIUM
describe TT_OBSCURED_VALIUM     Scora: obscured "VALIUM" in subject
##} TT_OBSCURED_VALIUM

##{ TT_OBSCURED_VIAGRA

meta TT_OBSCURED_VIAGRA         ( __TT_BROKEN_VIAGRA || __TT_OBSCURED_VIAGRA ) && ! __TT_VIAGRA
describe TT_OBSCURED_VIAGRA     Scora: obscured "VIAGRA" in subject
##} TT_OBSCURED_VIAGRA

##{ TVD_ACT_193

body TVD_ACT_193		/\bact of (?:193|nineteen thirty)/i
##} TVD_ACT_193

##{ TVD_APPROVED

body TVD_APPROVED		/you.{1,2}re .{0,20}approved/i
##} TVD_APPROVED

##{ TVD_DEAR_HOMEOWNER

body TVD_DEAR_HOMEOWNER		/^dear homeowner/i
##} TVD_DEAR_HOMEOWNER

##{ TVD_EB_PHISH

meta TVD_EB_PHISH	__FROM_EBAY && NORMAL_HTTP_TO_IP
##} TVD_EB_PHISH

##{ TVD_ENVFROM_APOST

header TVD_ENVFROM_APOST	EnvelopeFrom =~ /\'/
##} TVD_ENVFROM_APOST

##{ TVD_FINGER_02

header TVD_FINGER_02	Content-Type =~ /^text\/plain(?:; (?:format=flowed|charset="Windows-1252"|reply-type=original)){3}/i
##} TVD_FINGER_02

##{ TVD_FLOAT_GENERAL

rawbody TVD_FLOAT_GENERAL	/\bstyle\s*=\s*"[^"]*\bfloat\s*:\s*[a-z]+\s*">\s*[a-zA-Z]+\s*</i
##} TVD_FLOAT_GENERAL

##{ TVD_FUZZY_DEGREE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body TVD_FUZZY_DEGREE	/<inter W1><post P1>\b(?!degree)<D><E><G><R><E><E>\b/i
endif
##} TVD_FUZZY_DEGREE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ TVD_FUZZY_FINANCE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body TVD_FUZZY_FINANCE	/(?!finance)<F><I><N><A><N><C><E>/i
endif
##} TVD_FUZZY_FINANCE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ TVD_FUZZY_FIXED_RATE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body TVD_FUZZY_FIXED_RATE	/<inter W2><post P2>(?!fixed rate)<F><I><X><E><D>\s+<R><A><T><E>/i
endif
##} TVD_FUZZY_FIXED_RATE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ TVD_FUZZY_MICROCAP ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body TVD_FUZZY_MICROCAP	/<inter W2><post P2>(?!microcap)(?!micro-cap)<M><I><C><R><O>-?<C><A><P>/i
endif
##} TVD_FUZZY_MICROCAP ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ TVD_FUZZY_PHARMACEUTICAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body TVD_FUZZY_PHARMACEUTICAL	/<inter W2><post P2>(?!pharmaceutical)<P><H><A><R><M><A><C><E><U><T><I><C><A><L>/i
endif
##} TVD_FUZZY_PHARMACEUTICAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ TVD_FUZZY_SYMBOL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body TVD_FUZZY_SYMBOL	/<inter W2><post P2>(?!symbol)<S><Y><M><B><O><L>/i
endif
##} TVD_FUZZY_SYMBOL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ TVD_FW_GRAPHIC_NAME_LONG ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader TVD_FW_GRAPHIC_NAME_LONG	Content-Type =~ /\bname="[a-z]{8,}\.gif/
endif
##} TVD_FW_GRAPHIC_NAME_LONG ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ TVD_FW_GRAPHIC_NAME_MID ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader TVD_FW_GRAPHIC_NAME_MID	Content-Type =~ /\bname="[a-z]{6,7}\.gif/
endif
##} TVD_FW_GRAPHIC_NAME_MID ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ TVD_INCREASE_SIZE

body TVD_INCREASE_SIZE		/\bsize of .{1,20}(?:penis|dick|manhood)/i
##} TVD_INCREASE_SIZE

##{ TVD_LINK_SAVE

body TVD_LINK_SAVE		/\blink to save\b/i
##} TVD_LINK_SAVE

##{ TVD_PCT_OFF

header TVD_PCT_OFF Subject =~ /(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\S* \d+% OFF/
##} TVD_PCT_OFF

##{ TVD_PH_BODY_ACCOUNTS_PRE

body TVD_PH_BODY_ACCOUNTS_PRE	/\baccounts? (?:[a-z_,-]+ )+?(?:record[a-z]*|suspen[a-z]+|notif(?:y|ication)|updated|verifications?|credited)\b/i
##} TVD_PH_BODY_ACCOUNTS_PRE

##{ TVD_PH_REC

body TVD_PH_REC		/\byour .{0,40}account .{0,40}record/i
describe TVD_PH_REC	Message has a phrase standard for phishing mails
##} TVD_PH_REC

##{ TVD_PH_SEC

body TVD_PH_SEC		/\byour .{0,40}account .{0,40}security/i
describe TVD_PH_SEC	Message has a phrase standard for phishing mails
##} TVD_PH_SEC

##{ TVD_PH_SUBJ_ACCOUNTS_POST

header TVD_PH_SUBJ_ACCOUNTS_POST	Subject =~ /\b(?:(?:re-?)?activat[a-z]*|secure|verify|restore|flagged|limited|unusual|update|report|notif(?:y|ication)|suspen(?:d|ded|sion)|co(?:n|m)firm[a-z]*) (?:[a-z_,-]+ )*?accounts?\b/i
##} TVD_PH_SUBJ_ACCOUNTS_POST

##{ TVD_PH_SUBJ_SEC_MEASURES

header TVD_PH_SUBJ_SEC_MEASURES		Subject =~ /\bsecurity (?:[a-z_,-]+ )*?measures?\b/i
##} TVD_PH_SUBJ_SEC_MEASURES

##{ TVD_PH_SUBJ_URGENT

header TVD_PH_SUBJ_URGENT		Subject =~ /^urgent(?:[\s\W]*$|.{1,40}(?:alert|response|assistance|proposal|reply|warning|noti(?:ce|fication)|greeting|matter))/i
##} TVD_PH_SUBJ_URGENT

##{ TVD_PP_PHISH

meta TVD_PP_PHISH	__FROM_PAYPAL && NORMAL_HTTP_TO_IP
##} TVD_PP_PHISH

##{ TVD_QUAL_MEDS

body TVD_QUAL_MEDS		/\bquality med(?:ication)?s\b/i
##} TVD_QUAL_MEDS

##{ TVD_RATWARE_CB

header TVD_RATWARE_CB		Content-Type =~ /\bboundary\b.{1,40}qzsoft_directmail_seperator/i
##} TVD_RATWARE_CB

##{ TVD_RATWARE_CB_2

header TVD_RATWARE_CB_2		Content-Type =~ /\bboundary\s*=\s*"?-+\d+=+\.MRA/
##} TVD_RATWARE_CB_2

##{ TVD_RATWARE_MSGID_02

header TVD_RATWARE_MSGID_02	Message-ID =~ /^[^<]*<[a-z]+\@/
##} TVD_RATWARE_MSGID_02

##{ TVD_RCVD_IP

header TVD_RCVD_IP  Received =~ /^from\s+(?:\d+[^0-9a-zA-Z\s]){3}\d+[.\s]/
##} TVD_RCVD_IP

##{ TVD_RCVD_IP4

header TVD_RCVD_IP4 Received =~ /^from\s+(?:\d+\.){3}\d+\s/
##} TVD_RCVD_IP4

##{ TVD_RCVD_SINGLE

header TVD_RCVD_SINGLE Received =~ /^from\s+(?!localhost)[^\s.a-z0-9-]+\s/
##} TVD_RCVD_SINGLE

##{ TVD_RCVD_SPACE_BRACKET

header TVD_RCVD_SPACE_BRACKET Received =~ /\(\[(?!UNIX:)[^\[\]]*\s/
##} TVD_RCVD_SPACE_BRACKET

##{ TVD_SECTION

body TVD_SECTION		/\bSection (?:27A|21B)/i
##} TVD_SECTION

##{ TVD_SILLY_URI_OBFU

body TVD_SILLY_URI_OBFU		m!https?://[a-z0-9-]+\.[a-z0-9-]*\.?[^a-z0-9.:/\s"'\@?\)>-]+[a-z0-9.-]*[a-z]{3}(?:\s|$)!i
##} TVD_SILLY_URI_OBFU

##{ TVD_SPACED_SUBJECT_WORD3

header TVD_SPACED_SUBJECT_WORD3	Subject =~ /^(?:(?:Re|Fw)[^:]{0,5}: )?[A-Z]+[a-z]+[A-Z]+$/
##} TVD_SPACED_SUBJECT_WORD3

##{ TVD_STOCK1 ifplugin Mail::SpamAssassin::Plugin::BodyEval

ifplugin Mail::SpamAssassin::Plugin::BodyEval
body TVD_STOCK1    eval:check_stock_info('2')
endif
##} TVD_STOCK1 ifplugin Mail::SpamAssassin::Plugin::BodyEval

##{ TVD_SUBJ_ACC_NUM

header	TVD_SUBJ_ACC_NUM	Subject =~ /\b[a-zA-Z]+ [\#\s]{1,4}\d+[A-Z]+/
describe TVD_SUBJ_ACC_NUM	Subject has spammy looking monetary reference
##} TVD_SUBJ_ACC_NUM

##{ TVD_SUBJ_FINGER_03

header TVD_SUBJ_FINGER_03	Subject =~ /^\s*\*\s+(?:\w+\W+)+\*\s*$/
##} TVD_SUBJ_FINGER_03

##{ TVD_SUBJ_OWE

header TVD_SUBJ_OWE Subject =~ /^\s*(?:\w+\s+)+you\s+(?:\w+\s+)*(?:owe|indebted)\s+(?:\w+\s+)+an\s*other/i
##} TVD_SUBJ_OWE

##{ TVD_SUBJ_WIPE_DEBT

header TVD_SUBJ_WIPE_DEBT	Subject =~ /(?:wipe out|remove|get (?:rid|out) of|eradicate) .{0,20}(?:owe|debt|obligation)/i
##} TVD_SUBJ_WIPE_DEBT

##{ TVD_VISIT_PHARMA

body TVD_VISIT_PHARMA		/Online Ph.rmacy/i
##} TVD_VISIT_PHARMA

##{ TVD_VIS_HIDDEN

rawbody TVD_VIS_HIDDEN /<TEXTAREA[^>]+style\s*=\s*"visibility:\s*hidden\b/i
##} TVD_VIS_HIDDEN

##{ TWO_IPS_RCVD

meta	 TWO_IPS_RCVD	__TWO_IPS_RCVD && !ALL_TRUSTED
describe TWO_IPS_RCVD	Received: Relay identifies itself as wrong IP
##} TWO_IPS_RCVD

##{ T_AXB_MIME_IMG830 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader      T_AXB_MIME_IMG830                 Content-ID =~ /^<[0-9a-f]{30}\@/
describe        T_AXB_MIME_IMG830                 Valpolicella Fingerprint
endif
##} T_AXB_MIME_IMG830 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_AXB_PDF_FUZZY1_OEM1 ifplugin Mail::SpamAssassin::Plugin::PDFInfo

ifplugin Mail::SpamAssassin::Plugin::PDFInfo
body            T_AXB_PDF_FUZZY1_OEM1             eval:pdf_match_fuzzy_md5('2BDA96267AD8ED27FD583669CC76C4F7')
describe        T_AXB_PDF_FUZZY1_OEM1             Fuzzy MD5 Match 2BDA96267AD8ED27FD583669CC76C4F7
#score           T_AXB_PDF_FUZZY1_OEM1             5.0
endif
##} T_AXB_PDF_FUZZY1_OEM1 ifplugin Mail::SpamAssassin::Plugin::PDFInfo

##{ T_AXB_PDF_FUZZY1_OEM2 ifplugin Mail::SpamAssassin::Plugin::PDFInfo

ifplugin Mail::SpamAssassin::Plugin::PDFInfo
body            T_AXB_PDF_FUZZY1_OEM2             eval:pdf_match_fuzzy_md5('CE46CE748DD314A742F7AEA05575F379')
describe        T_AXB_PDF_FUZZY1_OEM2             Fuzzy MD5 Match CE46CE748DD314A742F7AEA05575F379
#score           T_AXB_PDF_FUZZY1_OEM2             5.0
endif
##} T_AXB_PDF_FUZZY1_OEM2 ifplugin Mail::SpamAssassin::Plugin::PDFInfo

##{ T_DKIM_INVALID ifplugin Mail::SpamAssassin::Plugin::DKIM

ifplugin Mail::SpamAssassin::Plugin::DKIM
  meta	   T_DKIM_INVALID	__DKIM_EXISTS && !DKIM_VALID
  describe T_DKIM_INVALID	DKIM-Signature header exists but is not valid
endif
##} T_DKIM_INVALID ifplugin Mail::SpamAssassin::Plugin::DKIM

##{ T_DOS_OUTLOOK_TO_MX_IMAGE

meta T_DOS_OUTLOOK_TO_MX_IMAGE		__ANY_OUTLOOK_MUA && !__OE_MUA && __DOS_DIRECT_TO_MX && __ANY_IMAGE_ATTACH
describe T_DOS_OUTLOOK_TO_MX_IMAGE	Direct to MX with Outlook headers and an image
##} T_DOS_OUTLOOK_TO_MX_IMAGE

##{ T_DOS_ZIP_HARDCORE ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader    T_DOS_ZIP_HARDCORE        Content-Type =~ /^application\/zip;\sname="hardcore\.zip"$/
  describe      T_DOS_ZIP_HARDCORE        hardcore.zip file attached; quite certainly a virus
#  score         T_DOS_ZIP_HARDCORE        2.5
endif
##} T_DOS_ZIP_HARDCORE ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_DSCL4_PNG ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
  mimeheader T_DSCL4_PNG    Content-Type =~ /name\=\"DS[CL]\d{4,5}\.(?:png|PNG)\"/
  describe   T_DSCL4_PNG		Digital camera filename is PNG
#  score      T_DSCL4_PNG		0.9 # 1.6->0.9 20091019 no recent hits
endif
##} T_DSCL4_PNG ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {

##{ T_EMRCP

body     T_EMRCP            /\bExcess Maximum Return Capital Profit\b/i
describe T_EMRCP            "Excess Maximum Return Capital Profit" Fidelity scam
##} T_EMRCP

##{ T_FILL_THIS_FORM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  meta     T_FILL_THIS_FORM    (FILL_THIS_FORM_LONG || __FILL_THIS_FORM_PARTIAL > 4 || __FILL_THIS_FORM_PARTIAL_RAW > 4)
  describe T_FILL_THIS_FORM    Fill in a form with personal information
#  score    T_FILL_THIS_FORM    1.00
endif
##} T_FILL_THIS_FORM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FILL_THIS_FORM_SHORT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  meta     T_FILL_THIS_FORM_SHORT !T_FILL_THIS_FORM && (__FILL_THIS_FORM_SHORT || __FILL_THIS_FORM_PARTIAL > 2 || __FILL_THIS_FORM_PARTIAL_RAW > 2)
  describe T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
#  score    T_FILL_THIS_FORM_SHORT 0.25
endif
##} T_FILL_THIS_FORM_SHORT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FREEMAIL_DOC_PDF ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
  meta         T_FREEMAIL_DOC_PDF     (__DOC_ATTACH || __PDF_ATTACH) && (FREEMAIL_FROM || FREEMAIL_REPLYTO)
  describe     T_FREEMAIL_DOC_PDF     MS document or PDF attachment, from freemail
#  score        T_FREEMAIL_DOC_PDF     1.0
endif
##} T_FREEMAIL_DOC_PDF ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ T_FREEMAIL_RVW_ATTCH ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
  meta         T_FREEMAIL_RVW_ATTCH   (__PLS_REVIEW || __DLND_ATTACH) && T_FREEMAIL_DOC_PDF
  describe     T_FREEMAIL_RVW_ATTCH   Please review attached document, from freemail
#  score        T_FREEMAIL_RVW_ATTCH   1.0
endif
##} T_FREEMAIL_RVW_ATTCH ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ T_FRM_SILVER_GOLD ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
meta     T_FRM_SILVER_GOLD        (__FRT_SILVER && __FRT_GOLD)
describe T_FRM_SILVER_GOLD        ReplaceTags: Silver & Gold
endif
##} T_FRM_SILVER_GOLD ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FROM_MISSPACED

header         T_FROM_MISSPACED        From =~ /^\s*"[^"]*"</
describe       T_FROM_MISSPACED        From: missing whitespace
##} T_FROM_MISSPACED

##{ T_FRT_ABSOLUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_ABSOLUT            /<inter SP2><post P2>\b(?!absolutely)<A><B><SX><O><L><U><TX><E><L><Y>/i
describe T_FRT_ABSOLUT            ReplaceTags: Absolutely
endif
##} T_FRT_ABSOLUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_ADULT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_ADULT2             /<inter W0><post P2>\b(?!adult)<A><D><UX><L><TX>/i
describe T_FRT_ADULT2             ReplaceTags: Adult
endif
##} T_FRT_ADULT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_BEFORE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_BEFORE             /<inter SP2><post P2>\b(?!before)<B><E><F><O><R><E>\b/i
describe T_FRT_BEFORE             ReplaceTags: Before
endif
##} T_FRT_BEFORE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_BELOW2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_BELOW2             /<inter W0><post P2>\b(?!below)<B><E><L><O><WX>\b/i
describe T_FRT_BELOW2             ReplaceTags: Below (2)
endif
##} T_FRT_BELOW2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_CANSPAM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_CANSPAM            /<inter SP2><post P2>\b(?!CAN<SP>SPAM)<C><A><N><SP><SX><P><A><M>/i
describe T_FRT_CANSPAM            ReplaceTags: Can Spam
endif
##} T_FRT_CANSPAM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_CLICK ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_CLICK              /<post P2>\b(?!click)<C><L><IX><C><K>\b/i
describe T_FRT_CLICK              ReplaceTags: Click
endif
##} T_FRT_CLICK ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_COCK ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_COCK               /<inter SP2><post P2>\b(?![cs]ock)<C><O><C><K>/i
describe T_FRT_COCK               ReplaceTags: Cock
endif
##} T_FRT_COCK ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_CONTACT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_CONTACT            /<inter SP2><post P2>\b(?!contr?act)<C><O><N><TX><A><C><TX>/i
describe T_FRT_CONTACT            ReplaceTags: Contact
endif
##} T_FRT_CONTACT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_ERECTION ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_ERECTION           /<inter SP2><post P2>(?!erection)<E><R><E><C><TX><IX><O><N>/i
describe T_FRT_ERECTION           ReplaceTags: Erection
endif
##} T_FRT_ERECTION ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_ESTABLISH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_ESTABLISH          /<inter SP2><post P2>\b(?!estabi?lish)<E><SX><TX><A><B><L><IX><SX><H>/i
describe T_FRT_ESTABLISH          ReplaceTags: Establish
endif
##} T_FRT_ESTABLISH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_EXPERIENCE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_EXPERIENCE         /<inter SP2><post P2>\b(?!experience)<E><X><P><E><R><IX><E><N><C><E>\b/i
describe T_FRT_EXPERIENCE         ReplaceTags: Experience
endif
##} T_FRT_EXPERIENCE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_FOLLOW1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_FOLLOW1            /<inter SP2><post P2>\b(?!follow)<F><O><L><L><O><WX>/i
describe T_FRT_FOLLOW1            ReplaceTags: Follow
endif
##} T_FRT_FOLLOW1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_FOLLOW2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_FOLLOW2            /<inter W0><post P2>\b(?!follow)<F><O><L><L><O><WX>/i
describe T_FRT_FOLLOW2            ReplaceTags: Follow (2)
endif
##} T_FRT_FOLLOW2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_FREE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_FREE               /<inter SP2><post P2>\b(?!free)<F><R><E><E>\b/i
describe T_FRT_FREE               ReplaceTags: Free
endif
##} T_FRT_FREE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_FRIEND ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_FRIEND             /<inter SP2><post P2>\b(?!friend)<F><R><IX><E><N><D>/i
describe T_FRT_FRIEND             ReplaceTags: Friend
endif
##} T_FRT_FRIEND ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_FUCK1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_FUCK1              /<inter SP2><post P2>\b(?!fuck)<F><U><C><K>/i
describe T_FRT_FUCK1              ReplaceTags: Fuck (1)
endif
##} T_FRT_FUCK1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_HEALTH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_HEALTH             /<inter SP2><post P2>\b(?!health)<H><E><A><L><TX><H>\b/i
describe T_FRT_HEALTH             ReplaceTags: Health
endif
##} T_FRT_HEALTH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_HOUR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_HOUR               /<inter SP2><post P2>\b(?!hour)<H><O><U><R>\b/i
describe T_FRT_HOUR               ReplaceTags: Hour
endif
##} T_FRT_HOUR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_INCOME ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_INCOME             /<inter SP2><post P2>\b(?!income)<IX><N><C><O><M><E>\b/i
describe T_FRT_INCOME             ReplaceTags: Income
endif
##} T_FRT_INCOME ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_INTEREST ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_INTEREST           /<inter SP2><post P2>\b(?!interest)<IX><N><TX><E><R><E><SX><TX>\b/i
describe T_FRT_INTEREST           ReplaceTags: Interest
endif
##} T_FRT_INTEREST ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_LITTLE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_LITTLE             /<inter SP2><post P2>\b(?!little)<L><IX><TX><TX><L><E>/i
describe T_FRT_LITTLE             ReplaceTags: Little
endif
##} T_FRT_LITTLE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_LOLITA1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_LOLITA1            /<inter SP2><post P2>\b(?!lolita)<L><O><L><IX><TX><A>/i
describe T_FRT_LOLITA1            ReplaceTags: Lolita (1)
endif
##} T_FRT_LOLITA1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_OPPORTUN1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_OPPORTUN1          /<inter SP2><post P2>(?!opportun)<O><P><P><O><R><TX><U><N>/i
describe T_FRT_OPPORTUN1          ReplaceTags: Oppertun (1)
endif
##} T_FRT_OPPORTUN1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_PACKAGE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_PACKAGE            /<inter SP2><post P2>\b(?!package)<P><A><C><K><A><GX><E>/i
describe T_FRT_PACKAGE            ReplaceTags: Package
endif
##} T_FRT_PACKAGE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_PAYMENT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_PAYMENT            /<inter W0>\b(?!payment)<P><A><Y><M><E><N><TX>/i
describe T_FRT_PAYMENT            ReplaceTags: Payment
endif
##} T_FRT_PAYMENT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_PHARMAC ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_PHARMAC            /<inter W0><post P2>(?!pharma[c\@])<P><H><A><R><M><A><C>/i
describe T_FRT_PHARMAC            ReplaceTags: Pharmac
endif
##} T_FRT_PHARMAC ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_POSSIBLE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_POSSIBLE           /<inter SP2><post P2>\b(?!possible)<P><O><SX><SX><IX><B><L><E>\b/i
describe T_FRT_POSSIBLE           ReplaceTags: Possible
endif
##} T_FRT_POSSIBLE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_PROFILE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_PROFILE1           /<inter SP2><post P2>\b(?!profile)<P><R><O><F><IX><L><E>/i
describe T_FRT_PROFILE1           ReplaceTags: Profile (1)
endif
##} T_FRT_PROFILE1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_PROFILE2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_PROFILE2           /<inter W0><post P2>\b(?!profile)<P><R><O><F><IX><L><E>/i
describe T_FRT_PROFILE2           ReplaceTags: Profile (2)
endif
##} T_FRT_PROFILE2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_PROFIT1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_PROFIT1            /<inter SP2><post P2>\b(?!profit)<P><R><O><F><IX><TX>/i
describe T_FRT_PROFIT1            ReplaceTags: Profit (1)
endif
##} T_FRT_PROFIT1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_PROFIT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_PROFIT2            /<inter W0><post P2>\b(?!profit)<P><R><O><F><IX><TX>/i
describe T_FRT_PROFIT2            ReplaceTags: Profit (2)
endif
##} T_FRT_PROFIT2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_PUSSY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_PUSSY              /<inter SP2><post P2>\b(?!pussy)<P><U><SX><SX><Y>/i
describe T_FRT_PUSSY              ReplaceTags: Pussy
endif
##} T_FRT_PUSSY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_SLUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_SLUT               /<inter SP2><post P2>\b(?!slut)<SX><L><U><TX>/
describe T_FRT_SLUT               ReplaceTags: Slut
endif
##} T_FRT_SLUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_STOCK1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_STOCK1             /<inter SP2><post P2>\b(?!stock)<SX><TX><O><C><K>/i
describe T_FRT_STOCK1             ReplaceTags: Stock (1)
endif
##} T_FRT_STOCK1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_STOCK2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_STOCK2             /<inter W0><post P2>\b(?!stor?ck)<SX><TX><O><C><K>/i
describe T_FRT_STOCK2             ReplaceTags: Stock (2)
endif
##} T_FRT_STOCK2 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FRT_VIRGIN1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     T_FRT_VIRGIN1            /<inter SP2><post P2>(?!virgin)<V><IX><R><GX><IX><N><SX>?\b/i
describe T_FRT_VIRGIN1            ReplaceTags: Virgin (1)
endif
##} T_FRT_VIRGIN1 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FSL_FAKE_HOTMAIL_RCVD

#score	T_FSL_FAKE_HOTMAIL_RCVD	0.001
##} T_FSL_FAKE_HOTMAIL_RCVD

##{ T_FUZZY_OPTOUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body           T_FUZZY_OPTOUT             /\b(?!opt.?out)<O><P><T>.?<O><U><T>\b/i
  describe       T_FUZZY_OPTOUT             Obfuscated opt-out text
endif
##} T_FUZZY_OPTOUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_FUZZY_SPRM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_FUZZY_SPRM	/<inter W1><post P2><S><P><U><R><M>/i
endif
##} T_FUZZY_SPRM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_HK_NAME_DR ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta		T_HK_NAME_DR		__HK_NAME_DR && !FREEMAIL_FROM
endif
##} T_HK_NAME_DR ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ T_HK_NAME_FM_DR ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta		T_HK_NAME_FM_DR		__HK_NAME_DR && FREEMAIL_FROM
endif
##} T_HK_NAME_FM_DR ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ T_HK_NAME_FM_FROM ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta		T_HK_NAME_FM_FROM		__HK_NAME_FROM && FREEMAIL_FROM
endif
##} T_HK_NAME_FM_FROM ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ T_HK_NAME_FM_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta		T_HK_NAME_FM_MR_MRS	__HK_NAME_MR_MRS && FREEMAIL_FROM
endif
##} T_HK_NAME_FM_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ T_HK_NAME_FROM ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta		T_HK_NAME_FROM		__HK_NAME_FROM && !FREEMAIL_FROM
endif
##} T_HK_NAME_FROM ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ T_HK_NAME_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta		T_HK_NAME_MR_MRS		__HK_NAME_MR_MRS && !FREEMAIL_FROM
endif
##} T_HK_NAME_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ T_HK_SPAMMY_FILENAME ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
meta		T_HK_SPAMMY_FILENAME	__HK_SPAMMY_CTFN || __HK_SPAMMY_CDFN
endif
##} T_HK_SPAMMY_FILENAME ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   T_HTML_ATTACH    Content-Type =~ m,text/html;.+\.html?\b,i
  describe     T_HTML_ATTACH    HTML attachment to bypass scanning?
endif
##} T_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_IMAGE_MISMATCH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # { ifplugin Mail::SpamAssassin::Plugin::ImageInfo

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
  ifplugin Mail::SpamAssassin::Plugin::ImageInfo
    meta	T_IMAGE_MISMATCH	(__GIF_ATTACH && !__GIF_EXISTS) || (__PNG_ATTACH && !__PNG_EXISTS) || (__JPEG_ATTACH && !__JPEG_EXISTS)
    describe	T_IMAGE_MISMATCH	Contains wrong image format for MIME header
endif
endif
##} T_IMAGE_MISMATCH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # { ifplugin Mail::SpamAssassin::Plugin::ImageInfo

##{ T_KHOP_FOREIGN_CLICK

describe T_KHOP_FOREIGN_CLICK	Click here link in French or Spanish
##} T_KHOP_FOREIGN_CLICK

##{ T_KHOP_FOREIGN_CLICK if !plugin(Mail::SpamAssassin::Plugin::URIDetail)

if !plugin(Mail::SpamAssassin::Plugin::URIDetail)
  rawbody    T_KHOP_FOREIGN_CLICK	m{\bhref=[^>]{9,199}>[^<]{0,80}(?:<(?!/a\b)[^>]{0,299}>[^<]{0,80}){0,9}[^<]{0,80}\b(?:cliquez\Wici\b|clic aqu[^<.,a ])}si
endif
##} T_KHOP_FOREIGN_CLICK if !plugin(Mail::SpamAssassin::Plugin::URIDetail)

##{ T_LFUZ_PWRMALE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_LFUZ_PWRMALE       /<inter W1><post P2><P><O><W><E><R><M><A><L><E>/i
endif
##} T_LFUZ_PWRMALE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_LOTS_OF_MONEY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  meta     T_LOTS_OF_MONEY    (__LOTSA_MONEY_00 || __LOTSA_MONEY_01 || __LOTSA_MONEY_02 || __LOTSA_MONEY_03 || __LOTSA_MONEY_04 || __LOTSA_MONEY_05)
  describe T_LOTS_OF_MONEY    Huge... sums of money
#  score    T_LOTS_OF_MONEY    0.01
endif
##} T_LOTS_OF_MONEY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_LOTTO_AGENT_FM

header   T_LOTTO_AGENT_FM   From =~ /(?:claim(?:s|ing)?(?:\sprocessing)?|fiducia\w+|dispatch|reimbursement|prize\stransfer|(?:international|foreign)\sremittance)[\s_]?(?:agent|manager|officer|secretary)/i
describe T_LOTTO_AGENT_FM   Claims Agent
#score    T_LOTTO_AGENT_FM   0.50
##} T_LOTTO_AGENT_FM

##{ T_LOTTO_AGENT_RPLY

header   T_LOTTO_AGENT_RPLY Reply-To =~ /(?:claim(?:s|ing)?(?:\sprocessing)?|fiducia\w+|dispatch|reimbursement|prize\stransfer|(?:international|foreign)\sremittance)[\s_]?(?:agent|manager|officer|secretary)/i
describe T_LOTTO_AGENT_RPLY Claims Agent
#score    T_LOTTO_AGENT_RPLY 0.50
##} T_LOTTO_AGENT_RPLY

##{ T_LOTTO_DEPT

body     T_LOTTO_DEPT       /\b(?:claim(?:s|ing)?(?:\sprocessing)?|fiducia\w+|reimbursement|(?:international|foreign)\s(?:remittance|settlement)|payment|award)\s?(?:department|dept|unit|group|committee|bureau)/i
describe T_LOTTO_DEPT       Claims Department
#score    T_LOTTO_DEPT       0.50
##} T_LOTTO_DEPT

##{ T_LOTTO_URI

uri      T_LOTTO_URI       /(?:claim(?:s|ing)?(?:[-_]?processing)?|fiducia\w+|reimbursement|(?:international|foreign)?[-_]?remittance|award)[-_]?(?:department|dept|unit|group|committee|office|agent|manager|secretary)/i
describe T_LOTTO_URI       Claims Department
#score    T_LOTTO_URI       0.50
##} T_LOTTO_URI

##{ T_MIME_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  meta        T_MIME_NO_TEXT  (__CTYPE_MULTIPART_ANY && !__ANY_TEXT_ATTACH)
#  score       T_MIME_NO_TEXT  1.00
  describe    T_MIME_NO_TEXT  No text body parts
endif
##} T_MIME_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_MONEY_PERCENT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  meta     T_MONEY_PERCENT    T_LOTS_OF_MONEY && (__PCT_FOR_YOU || __PCT_OF_PMTS)
  describe T_MONEY_PERCENT    X% of a lot of money for you
endif
##} T_MONEY_PERCENT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_OBFU_ATTACH_MISSP ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  meta         T_OBFU_ATTACH_MISSP   __FROM_RUNON && (T_OBFU_HTML_ATTACH || T_OBFU_TEXT_ATTACH || T_OBFU_DOC_ATTACH || T_OBFU_PDF_ATTACH)
  describe     T_OBFU_ATTACH_MISSP   Obfuscated attachment type and misspaced From
endif
##} T_OBFU_ATTACH_MISSP ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_OBFU_DOC_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   T_OBFU_DOC_ATTACH     Content-Type =~ m,application/octet-stream;.+\.(?:doc|rtf)\b,i
  describe     T_OBFU_DOC_ATTACH     MS Document attachment with generic MIME type
#  score        T_OBFU_DOC_ATTACH     0.25
endif
##} T_OBFU_DOC_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_OBFU_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   T_OBFU_HTML_ATTACH    Content-Type =~ m,application/octet-stream;.+\.html?\b,i
  describe     T_OBFU_HTML_ATTACH    HTML attachment with non-text MIME type
endif
##} T_OBFU_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_OBFU_PDF_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   T_OBFU_PDF_ATTACH     Content-Type =~ m,application/octet-stream;.+\.pdf\b,i
  describe     T_OBFU_PDF_ATTACH     PDF attachment with generic MIME type
#  score        T_OBFU_PDF_ATTACH     0.25
endif
##} T_OBFU_PDF_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_OBFU_TEXT_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   T_OBFU_TEXT_ATTACH    Content-Type =~ m,application/octet-stream;.+\.txt\b,i
  describe     T_OBFU_TEXT_ATTACH    Text attachment with non-text MIME type
endif
##} T_OBFU_TEXT_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_RP_MATCHES_RCVD if version >= 3.003000 ifplugin Mail::SpamAssassin::Plugin::WLBLEval

if version >= 3.003000
ifplugin Mail::SpamAssassin::Plugin::WLBLEval
header   T_RP_MATCHES_RCVD  eval:check_mailfrom_matches_rcvd()
describe T_RP_MATCHES_RCVD  Envelope sender domain matches handover relay domain
tflags   T_RP_MATCHES_RCVD  nice
endif
endif
##} T_RP_MATCHES_RCVD if version >= 3.003000 ifplugin Mail::SpamAssassin::Plugin::WLBLEval

##{ T_SURBL_MULTI1 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
meta T_SURBL_MULTI1   ((URIBL_JP_SURBL + URIBL_SC_SURBL + URIBL_AB_SURBL + URIBL_OB_SURBL + URIBL_WS_SURBL) > 1)
endif
##} T_SURBL_MULTI1 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

##{ T_SURBL_MULTI2 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
meta T_SURBL_MULTI2   ((URIBL_JP_SURBL + URIBL_SC_SURBL + URIBL_AB_SURBL + URIBL_OB_SURBL + URIBL_WS_SURBL) > 2)
endif
##} T_SURBL_MULTI2 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

##{ T_SURBL_MULTI3 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
meta T_SURBL_MULTI3   ((URIBL_JP_SURBL + URIBL_SC_SURBL + URIBL_AB_SURBL + URIBL_OB_SURBL + URIBL_WS_SURBL) > 3)
endif
##} T_SURBL_MULTI3 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

##{ T_SURBL_MULTI4 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
meta T_SURBL_MULTI4   ((URIBL_JP_SURBL + URIBL_SC_SURBL + URIBL_AB_SURBL + URIBL_OB_SURBL + URIBL_WS_SURBL) > 4)
endif
##} T_SURBL_MULTI4 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

##{ T_TO_NO_BRKTS_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail

ifplugin Mail::SpamAssassin::Plugin::FreeMail
  meta       T_TO_NO_BRKTS_FREEMAIL    __TO_NO_ARROWS_R && (FREEMAIL_FROM || FREEMAIL_REPLYTO)
#  score      T_TO_NO_BRKTS_FREEMAIL    0.20
endif
##} T_TO_NO_BRKTS_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail

##{ T_TVD_FUZZY_SECTOR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_TVD_FUZZY_SECTOR	/(?!sector)<S><E><C><T><O><R>/i
endif
##} T_TVD_FUZZY_SECTOR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_TVD_FUZZY_SECURITIES ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body T_TVD_FUZZY_SECURITIES	/<inter W2><post P2>(?!securities)<S><E><C><U><R><I><T><I><E><S>/i
endif
##} T_TVD_FUZZY_SECURITIES ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ T_TVD_FW_GRAPHIC_ID2 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader T_TVD_FW_GRAPHIC_ID2	Content-Id =~ /<(?:[0-9A-F]{8}\.){3}[0-9A-F]{8}/
endif
##} T_TVD_FW_GRAPHIC_ID2 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

##{ T_TVD_MIME_EPI ifplugin Mail::SpamAssassin::Plugin::MIMEEval

ifplugin Mail::SpamAssassin::Plugin::MIMEEval
body T_TVD_MIME_EPI		eval:check_msg_parse_flags('mime_epilogue_exists')
endif
##} T_TVD_MIME_EPI ifplugin Mail::SpamAssassin::Plugin::MIMEEval

##{ T_TVD_MIME_NO_HEADERS ifplugin Mail::SpamAssassin::Plugin::MIMEEval

ifplugin Mail::SpamAssassin::Plugin::MIMEEval
body T_TVD_MIME_NO_HEADERS	eval:check_msg_parse_flags('missing_mime_headers')
endif
##} T_TVD_MIME_NO_HEADERS ifplugin Mail::SpamAssassin::Plugin::MIMEEval

##{ T_URIBL_BLACK_OVERLAP ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
meta T_URIBL_BLACK_OVERLAP (URIBL_BLACK && (URIBL_AB_SURBL || URIBL_JP_SURBL || URIBL_OB_SURBL || URIBL_WS_SURBL || URIBL_SC_SURBL))
endif
##} T_URIBL_BLACK_OVERLAP ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

##{ URIBL_RHS_DOB ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
urirhssub URIBL_RHS_DOB         dob.sibl.support-intelligence.net  A   2
body URIBL_RHS_DOB              eval:check_uridnsbl('URIBL_RHS_DOB')
describe URIBL_RHS_DOB          Contains an URI of a new domain (Day Old Bread)
tflags URIBL_RHS_DOB            net
endif
##} URIBL_RHS_DOB ifplugin Mail::SpamAssassin::Plugin::URIDNSBL

##{ URI_OBFU_WWW ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body          URI_OBFU_WWW  /(?<!http:\/\/)\b_*w{2,3}(?!\.[-\w]+\.(?:com|net|org|biz|info))[^[:alnum:]]{1,3}(?:<D><O><T>+[^[:alnum:]]{1,3})?[[:alnum:]][-\w]{1,20}[[:alnum:]](?!\.[[:alnum:]])[^[:alnum:]]{1,3}(?:<D><O><T>+[^[:alnum:]]{1,3})?(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g|b\s?i\s?z|i\s?n\s?f\s?o)_*\b/i
describe      URI_OBFU_WWW  Obfuscated URI
endif
##} URI_OBFU_WWW ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

##{ VANITY

meta VANITY		(__KNOWN_VANITY && (__NO_COST + __INFORM_YOU + __INNERCIRCLE + __SHMUCK + __EXECS_PROS + __PUB_DEADLINE + __REGISTRY + __NOMINATION + __BIOGRAPHY + __ACCOLADES + __RECOGNITION + __DISTINGUISHED + __EXCELLENCE + __ACHIEVEMENT + __CBNVANITY > 3)) || (__BESTOFAWARD && (__SBCAVANITY || __USCAVANITY))
describe VANITY Vanity or fake awards
#score VANITY 2.3
##} VANITY

##{ XMAILER_MIMEOLE_OL_015D5

meta XMAILER_MIMEOLE_OL_015D5  (__XM_OL_015D5 && __MO_OL_015D5)
##} XMAILER_MIMEOLE_OL_015D5

##{ XMAILER_MIMEOLE_OL_07794

meta XMAILER_MIMEOLE_OL_07794  (__XM_OL_07794 && __MO_OL_07794)
##} XMAILER_MIMEOLE_OL_07794

##{ XMAILER_MIMEOLE_OL_09BB4

meta XMAILER_MIMEOLE_OL_09BB4  (__XM_OL_09BB4 && __MO_OL_09BB4)
##} XMAILER_MIMEOLE_OL_09BB4

##{ XMAILER_MIMEOLE_OL_1ECD5

meta XMAILER_MIMEOLE_OL_1ECD5  (__XM_OL_1ECD5 && __MO_OL_1ECD5)
##} XMAILER_MIMEOLE_OL_1ECD5

##{ XMAILER_MIMEOLE_OL_20C99

meta XMAILER_MIMEOLE_OL_20C99  (__XM_OL_20C99 && __MO_OL_20C99)
##} XMAILER_MIMEOLE_OL_20C99

##{ XMAILER_MIMEOLE_OL_22B61

meta XMAILER_MIMEOLE_OL_22B61  (__XM_OL_22B61 && __MO_OL_22B61)
##} XMAILER_MIMEOLE_OL_22B61

##{ XMAILER_MIMEOLE_OL_25340

meta XMAILER_MIMEOLE_OL_25340  (__XM_OL_25340 && __MO_OL_25340)
##} XMAILER_MIMEOLE_OL_25340

##{ XMAILER_MIMEOLE_OL_32D97

meta XMAILER_MIMEOLE_OL_32D97  (__XM_OL_32D97 && __MO_OL_32D97)
##} XMAILER_MIMEOLE_OL_32D97

##{ XMAILER_MIMEOLE_OL_3857F

meta XMAILER_MIMEOLE_OL_3857F  (__XM_OL_3857F && __MO_OL_3857F)
##} XMAILER_MIMEOLE_OL_3857F

##{ XMAILER_MIMEOLE_OL_3AC1D

meta XMAILER_MIMEOLE_OL_3AC1D  (__XM_OL_3AC1D && __MO_OL_3AC1D)
##} XMAILER_MIMEOLE_OL_3AC1D

##{ XMAILER_MIMEOLE_OL_3D61D

meta XMAILER_MIMEOLE_OL_3D61D  (__XM_OL_3D61D && __MO_OL_3D61D)
##} XMAILER_MIMEOLE_OL_3D61D

##{ XMAILER_MIMEOLE_OL_465CD

meta XMAILER_MIMEOLE_OL_465CD  (__XM_OL_465CD && __MO_OL_465CD)
##} XMAILER_MIMEOLE_OL_465CD

##{ XMAILER_MIMEOLE_OL_4B815

meta XMAILER_MIMEOLE_OL_4B815  (__XM_OL_4B815 && __MO_OL_4B815)
##} XMAILER_MIMEOLE_OL_4B815

##{ XMAILER_MIMEOLE_OL_4BF4C

meta XMAILER_MIMEOLE_OL_4BF4C  (__XM_OL_4BF4C && __MO_OL_4BF4C)
##} XMAILER_MIMEOLE_OL_4BF4C

##{ XMAILER_MIMEOLE_OL_4EEDB

meta XMAILER_MIMEOLE_OL_4EEDB  (__XM_OL_4EEDB && __MO_OL_4EEDB)
##} XMAILER_MIMEOLE_OL_4EEDB

##{ XMAILER_MIMEOLE_OL_4F240

meta XMAILER_MIMEOLE_OL_4F240  (__XM_OL_4F240 && __MO_OL_4F240)
##} XMAILER_MIMEOLE_OL_4F240

##{ XMAILER_MIMEOLE_OL_58CB5

meta XMAILER_MIMEOLE_OL_58CB5  (__XM_OL_58CB5 && __MO_OL_58CB5)
##} XMAILER_MIMEOLE_OL_58CB5

##{ XMAILER_MIMEOLE_OL_5B79A

meta XMAILER_MIMEOLE_OL_5B79A  (__XM_OL_5B79A && __MO_OL_5B79A)
##} XMAILER_MIMEOLE_OL_5B79A

##{ XMAILER_MIMEOLE_OL_6554A

meta XMAILER_MIMEOLE_OL_6554A  (__XM_OL_6554A && __MO_OL_6554A)
##} XMAILER_MIMEOLE_OL_6554A

##{ XMAILER_MIMEOLE_OL_72641

meta XMAILER_MIMEOLE_OL_72641  (__XM_OL_72641 && __MO_OL_72641)
##} XMAILER_MIMEOLE_OL_72641

##{ XMAILER_MIMEOLE_OL_7533E

meta XMAILER_MIMEOLE_OL_7533E  (__XM_OL_7533E && __MO_OL_7533E)
##} XMAILER_MIMEOLE_OL_7533E

##{ XMAILER_MIMEOLE_OL_812FF

meta XMAILER_MIMEOLE_OL_812FF  (__XM_OL_812FF && __MO_OL_812FF)
##} XMAILER_MIMEOLE_OL_812FF

##{ XMAILER_MIMEOLE_OL_83BF7

meta XMAILER_MIMEOLE_OL_83BF7  (__XM_OL_83BF7 && __MO_OL_83BF7)
##} XMAILER_MIMEOLE_OL_83BF7

##{ XMAILER_MIMEOLE_OL_8627E

meta XMAILER_MIMEOLE_OL_8627E  (__XM_OL_8627E && __MO_OL_8627E)
##} XMAILER_MIMEOLE_OL_8627E

##{ XMAILER_MIMEOLE_OL_8E893

meta XMAILER_MIMEOLE_OL_8E893  (__XM_OL_8E893 && __MO_OL_8E893)
##} XMAILER_MIMEOLE_OL_8E893

##{ XMAILER_MIMEOLE_OL_91287

meta XMAILER_MIMEOLE_OL_91287  (__XM_OL_91287 && __MO_OL_91287)
##} XMAILER_MIMEOLE_OL_91287

##{ XMAILER_MIMEOLE_OL_9B90B

meta XMAILER_MIMEOLE_OL_9B90B  (__XM_OL_9B90B && __MO_OL_9B90B)
##} XMAILER_MIMEOLE_OL_9B90B

##{ XMAILER_MIMEOLE_OL_A50F8

meta XMAILER_MIMEOLE_OL_A50F8  (__XM_OL_A50F8 && __MO_OL_A50F8)
##} XMAILER_MIMEOLE_OL_A50F8

##{ XMAILER_MIMEOLE_OL_A842E

meta XMAILER_MIMEOLE_OL_A842E  (__XM_OL_A842E && __MO_OL_A842E)
##} XMAILER_MIMEOLE_OL_A842E

##{ XMAILER_MIMEOLE_OL_ADFF7

meta XMAILER_MIMEOLE_OL_ADFF7  (__XM_OL_ADFF7 && __MO_OL_ADFF7)
##} XMAILER_MIMEOLE_OL_ADFF7

##{ XMAILER_MIMEOLE_OL_B30D1

meta XMAILER_MIMEOLE_OL_B30D1  (__XM_OL_B30D1 && __MO_OL_B30D1)
##} XMAILER_MIMEOLE_OL_B30D1

##{ XMAILER_MIMEOLE_OL_B4B40

meta XMAILER_MIMEOLE_OL_B4B40  (__XM_OL_B4B40 && __MO_OL_B4B40)
##} XMAILER_MIMEOLE_OL_B4B40

##{ XMAILER_MIMEOLE_OL_B9B11

meta XMAILER_MIMEOLE_OL_B9B11  (__XM_OL_B9B11 && __MO_OL_B9B11)
##} XMAILER_MIMEOLE_OL_B9B11

##{ XMAILER_MIMEOLE_OL_BC7E6

meta XMAILER_MIMEOLE_OL_BC7E6  (__XM_OL_BC7E6 && __MO_OL_BC7E6)
##} XMAILER_MIMEOLE_OL_BC7E6

##{ XMAILER_MIMEOLE_OL_C65FA

meta XMAILER_MIMEOLE_OL_C65FA  (__XM_OL_C65FA && __MO_OL_C65FA)
##} XMAILER_MIMEOLE_OL_C65FA

##{ XMAILER_MIMEOLE_OL_CAC8F

meta XMAILER_MIMEOLE_OL_CAC8F  (__XM_OL_CAC8F && __MO_OL_CAC8F)
##} XMAILER_MIMEOLE_OL_CAC8F

##{ XMAILER_MIMEOLE_OL_CF0C0

meta XMAILER_MIMEOLE_OL_CF0C0  (__XM_OL_CF0C0 && __MO_OL_CF0C0)
##} XMAILER_MIMEOLE_OL_CF0C0

##{ XMAILER_MIMEOLE_OL_EF20B

meta XMAILER_MIMEOLE_OL_EF20B  (__XM_OL_EF20B && __MO_OL_EF20B)
##} XMAILER_MIMEOLE_OL_EF20B

##{ XMAILER_MIMEOLE_OL_EF222

meta XMAILER_MIMEOLE_OL_EF222  (__XM_OL_EF222 && __MO_OL_EF222)
##} XMAILER_MIMEOLE_OL_EF222

##{ XMAILER_MIMEOLE_OL_F3B05

meta XMAILER_MIMEOLE_OL_F3B05  (__XM_OL_F3B05 && __MO_OL_F3B05)
##} XMAILER_MIMEOLE_OL_F3B05

##{ XMAILER_MIMEOLE_OL_F475E

meta XMAILER_MIMEOLE_OL_F475E  (__XM_OL_F475E && __MO_OL_F475E)
##} XMAILER_MIMEOLE_OL_F475E

##{ XMAILER_MIMEOLE_OL_F6D01

meta XMAILER_MIMEOLE_OL_F6D01  (__XM_OL_F6D01 && __MO_OL_F6D01)
##} XMAILER_MIMEOLE_OL_F6D01

##{ XMAILER_MIMEOLE_OL_FF5C8

meta XMAILER_MIMEOLE_OL_FF5C8  (__XM_OL_FF5C8 && __MO_OL_FF5C8)
##} XMAILER_MIMEOLE_OL_FF5C8

##{ X_MAILER_CME_6543_MSN

header X_MAILER_CME_6543_MSN	X-Mailer =~ /^CME-V6\.5\.4\.3; MSN\s*$/
##} X_MAILER_CME_6543_MSN

##{ ifplugin Mail::SpamAssassin::Plugin::ReplaceTags_sandbox

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
replace_rules __FRT_GOLD
replace_rules __FRT_SILVER
replace_inter W0 \w?
replace_inter SP2 [\s\d_*\$\%(),.:;?!}{\[\]|\/?^\#~\xa1`'+-]?
replace_tag   GX  [gk6]
replace_tag   IX  [ilt|!1y?\xcc\xcd\xce\xcf\xec\xed\xee\xef]
replace_tag   SX  [sz5\xa6\xa7]
replace_tag   TX  [t|]
replace_tag   UX [u\xb5\xd9\xda\xdb\xdc\xfc\xfb\xfa\xf9\xfd]
replace_tag   WX  (?:[wv]|vv)
replace_rules T_FRT_ABSOLUT
replace_rules FRT_ADOBE2
replace_rules T_FRT_ADULT2
replace_rules FRT_APPROV
replace_rules T_FRT_BEFORE
replace_rules T_FRT_BELOW2
replace_rules FRT_BIGGERMEM1
replace_rules T_FRT_CANSPAM
replace_rules T_FRT_CLICK
replace_rules T_FRT_COCK
replace_rules T_FRT_CONTACT
replace_rules FRT_DIPLOMA
replace_rules FRT_DISCOUNT
replace_rules FRT_DOLLAR
replace_rules T_FRT_ERECTION
replace_rules T_FRT_ESTABLISH
replace_rules FRT_ESTABLISH2
replace_rules T_FRT_EXPERIENCE
replace_rules T_FRT_FOLLOW1
replace_rules T_FRT_FOLLOW2
replace_rules T_FRT_FREE
replace_rules T_FRT_FRIEND
replace_rules T_FRT_FUCK1
replace_rules FRT_FUCK2
replace_rules FRT_GUARANTEE1
replace_rules T_FRT_HEALTH
replace_rules T_FRT_HOUR
replace_rules T_FRT_INCOME
replace_rules T_FRT_INTEREST
replace_rules FRT_INVESTOR
replace_rules FRT_LEVITRA
replace_rules T_FRT_LITTLE
replace_rules T_FRT_LOLITA1
replace_rules FRT_MEETING
replace_rules FRT_OFFER2
replace_rules T_FRT_OPPORTUN1
replace_rules FRT_OPPORTUN2
replace_rules T_FRT_PACKAGE
replace_rules T_FRT_PAYMENT
replace_rules FRT_PENIS1
replace_rules T_FRT_PHARMAC
replace_rules T_FRT_POSSIBLE
replace_rules FRT_PRICE
replace_rules T_FRT_PROFILE1
replace_rules T_FRT_PROFILE2
replace_rules T_FRT_PROFIT1
replace_rules T_FRT_PROFIT2
replace_rules T_FRT_PUSSY
replace_rules FRT_REFINANCE1
replace_rules FRT_ROLEX
replace_rules FRT_SEXUAL
replace_rules T_FRT_SLUT
replace_rules FRT_SOMA
replace_rules FRT_SOMA2
replace_rules T_FRT_STOCK1
replace_rules T_FRT_STOCK2
replace_rules FRT_STRONG1
replace_rules FRT_STRONG2
replace_rules FRT_SYMBOL
replace_rules FRT_TODAY2
replace_rules FRT_VALIUM1
replace_rules FRT_VALIUM2
replace_rules T_FRT_VIRGIN1
replace_rules FRT_WEIGHT2
replace_rules FRT_XANAX1
replace_rules FRT_XANAX2
replace_rules T_FUZZY_SPRM
replace_rules FUZZY_MERIDIA
replace_rules TVD_FUZZY_PHARMACEUTICAL
replace_rules TVD_FUZZY_SYMBOL
replace_rules T_TVD_FUZZY_SECURITIES
replace_rules TVD_FUZZY_FINANCE
replace_rules TVD_FUZZY_FIXED_RATE
replace_rules TVD_FUZZY_MICROCAP
replace_rules T_TVD_FUZZY_SECTOR
replace_rules TVD_FUZZY_DEGREE
  replace_tag FF_LNNO   (?:(?:\d+[)}\]:.,]+|\W?\(\d+\)|\W?\{\d+\}|\[\d+\]|\*{1,5}|\#{1,5}|[A-K][)}\]:.,])\s?)
  replace_tag FF_YOUR   (?:a?\s?copy\sof\s)?(?:your[\s,:]{1,5})?(?:present\s|c[uo]rrent\s|full\s?|complete\s|direct\s|private\s|valid\s|personal\s){0,3}
  replace_tag ANDOR     (?:\s?[\/&+,]\s?|\sor\s|\sand\s)
  replace_tag NUMBER    (?:num(?:ber)?s?|nos?\.|no\b|\#s?|nbrs?\.?)
  replace_tag FF_SUFFIX (?:\sin\s(?:full|words))?:?(?:\s?[({][^)}]{1,30}[)}])?
  replace_tag FF_BLANK1 (?:[\s:;]{0,4}(?:(?:[-=_.,:;*]|&\#\d+;){3,80}\s?){1,})
  replace_tag FF_BLANK2 (?:[\s\W]{0,3}(?:[-=_.,:;*]|&\#\d+;){1,80}\s?)
  replace_tag FF_A1 (?:(?:ad+res+e?|countr?y|st?ates?|city|province|ter+itory|(?:zip|postal)(?:\s?code)?)<ANDOR>?){1,3}(?:\sof\s(?:residence|birth|employment|citizenship|origin))?
  replace_tag FF_A2 (?:(?:contact|e-?mail|full|house|home|resident[ia]+l|business|mailing|work|office|delivery|ship+ing|post(?:al)?)<ANDOR>?){0,3}\s?(?:ad+res+(?:es)?|location)(?:\sline)?(?:\s[0-9])?
  replace_tag FF_N1 (?:company|first|last|all|business|legal|ben[ei]ficiary)?\s?names?(?:<ANDOR>ad+res+)?
  replace_tag FF_P1 (?:(?:(?:business|contact|fax|voice|cel+(?:ular)?|house|home|mobile|office|tel+e?(?:\s?phone)?|phone)(?:\sphone)?<ANDOR>?){1,3}(?:\s<NUMBER>)?<ANDOR>?){1,3}
  replace_tag FF_M1 (?:(?:age|marital\s?statu[se]|sex|gender|male\sor\sfemale|(?:date\sof\s)?birth|religion|nationality|email|next\sof\skin)<ANDOR>?){1,3}
  replace_tag FF_L1 (?:(?:previous\s)?work(?:ing)\s?experience|employment|position|profession|occup[ae]tion(?:\/position)?|(?:monthly|annual)?\s?income|annual\sturn\s?over|purpose\sof\sl(?:oa|ao)n|l(?:oa|ao)n\sduration|(?:l(?:oa|ao)n\s|the\s)?amount(?:\sneed(ed)?|\sdesired)?(?:\s(?:as|of)\sloan)?)
  replace_tag FF_F1 (?:(?:bank|beneficiary|billing|acc(?:oun)?t|a\/c|rout(?:ing)?|swift|receiver|user)<ANDOR>?){1,3}\s(?:(?:name|ad+res+(?:es)?|location|code|details|<NUMBER>)<ANDOR>?){1,3}
  replace_tag FF_F2 (?:(?:(?:international\s)?driver'?s?\sli[sc]+(:?en[sc]e)?|pass\s?port|[ia]d(?:entification|entity)(?:\s(?:card|<NUMBER>|papers?))?|id\scard)<ANDOR>?){1,3}(?:\s<NUMBER>)?
  replace_tag FF_F3 (?:picture|(?:e-?mail\s)?password|e-?mai?l\sid|test\squestion|answer|amount\swon|(?:inheritance\s)?funds?\svalue|amount\s[\w\s]{0,30}lost[\w\s]{0,15})
  replace_tag FF_F4 (?:log[-\s]?in|(?:e-?mail\s)?user)\s?names?
  replace_tag FF_F5 (?:reference|batch|winning)\s?<NUMBER>
  replace_tag FF_ALL (?:<FF_A1>|<FF_A2>|<FF_N1>|<FF_P1>|<FF_M1>|<FF_L1>|<FF_F1>|<FF_F2>|<FF_F3>|<FF_F4>|<FF_F5>)
  replace_rules   FILL_THIS_FORM_LONG
  replace_rules   __FILL_THIS_FORM_PARTIAL
  replace_rules   __FILL_THIS_FORM_PARTIAL_RAW
  replace_rules   __FILL_THIS_FORM_SHORT
  replace_rules   __FILL_THIS_FORM_LOAN
  replace_rules   __FILL_THIS_FORM_FRAUD_PHISH
  replace_tag  CURRENCY   [\(\[]?(?:\bUS[D\$]{0,2}|\$(?:US)?|usd|GBP|=[Aa][34]|\xa3|&\#16[34];|(?i:pounds\ssterling)|\xa4|EUR|[Ee]uros?|(?i:eur)\sde|CHF)[\]\)]?
  replace_tag  GB_UK      \b(?:U\.?K\.?|(?:Great\s)?Brit(?:ain|ish)|G\.?B\.?)\b
  replace_rules   __LOTSA_MONEY_00 __LOTSA_MONEY_01 __LOTSA_MONEY_02 __LOTSA_MONEY_03 __LOTSA_MONEY_04
  replace_tag  PERCENT      \b(?:\d\d|ten|[a-z]+teen|(?:twen|thir|fou?r)ty(?:-?[a-z]+)?)\s?(?:%|percent)
  replace_rules  __PCT_FOR_YOU_1 __PCT_FOR_YOU_2 __PCT_FOR_YOU_3 __PCT_OF_PMTS
  replace_rules  T_FUZZY_OPTOUT
replace_rules URI_OBFU_WWW
replace_rules T_LFUZ_PWRMALE
endif
##} ifplugin Mail::SpamAssassin::Plugin::ReplaceTags_sandbox

##{ ifplugin Mail::SpamAssassin::Plugin::URIDetail_sandbox

ifplugin Mail::SpamAssassin::Plugin::URIDetail
  uri_detail T_KHOP_FOREIGN_CLICK	text =~ /\b(?:cliquez\Wici\b|clic aqu[^<.,a ])/i
endif
##} ifplugin Mail::SpamAssassin::Plugin::URIDetail_sandbox

##{ redirector_pattern_sandbox

redirector_pattern      /^http\:\/\/sun\.com\/cgi\-bin\/go\.cgi\?dest\=(.*)$/i
redirector_pattern      /^http\:\/\/www\.att\.net\/s\/context\.dll\?redirecturl\=(.*)$/i
redirector_pattern m'/(?:index.php)?\?.*(?<=[?&])URL=(.*?)(?:$|[&\#])'i
redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/url\?.*?(?<=[?&])q=(.*?)(?:$|[&\#])'i
redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/search\?.*?(?<=[?&])q=[^&]*?(?<=%20|..[=+\s])(?:site|inurl):(.*?)(?:$|%20|[\s+&\#])'i
redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/search\?.*?(?<=[?&])q=[^&]*?(?<=%20|..[=+\s])(?:"|%22)(.*?)(?:$|%22|["\s+&\#])'i
redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/translate\?.*?(?<=[?&])u=(.*?)(?:$|[&\#])'i
redirector_pattern m'^http:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/pagead/iclk\?.*?(?<=[?&])adurl=(.*?)(?:$|[&\#])'i
redirector_pattern m'^http:/*(?:\w+\.)?aol\.com/redir\.adp\?.*(?<=[?&])_url=(.*?)(?:$|[&\#])'i
redirector_pattern m'^https?/*(?:\w+\.)?facebook\.com/l/;(.*)'i
##} redirector_pattern_sandbox


body __ACCOLADES	/\baccolades?\b/i

body __ACHIEVEMENT	/\bbenchmark of achievement\b/i

body __AFF_004470_NUMBER  /(?:\+|00|011)\W{0,3}44\W{0,3}0?\W{0,3}70/

body __AFF_LOTTERY        /(?:lottery|winner)/i

meta     __AFRICAN_STATE  (__NIGERIA || __IVORY_COAST || __BURKINA_FASO || __GHANA)

body     __AFR_UNION      /\bafrican\sunion\b/i

body     __AGREED_RATIO   /\b(?:agreed|sharing)\s(?:ratios?|percent\w+)\b/i

body     __AM_DYING       /\bam\s(?:\S+\s)?dying\b/i

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __ANY_IMAGE_ATTACH Content-Type =~ /image\/(?:gif|jpeg|png)/
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader  __ANY_TEXT_ATTACH Content-Type =~ /text\/\w+/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __ANY_TEXT_ATTACH_DOC     Content-Type =~ /text\/\w+/i
endif

body     __APPROVALFVGT         /approval/i

body     __ATM_CARD       /\b(?:your|the|this)\s(?:atm|debit)(?:\smaster|swift)?\scard/i

body     __BACHELORS            /Bachelor/i

body     __BACK_SCRATCH   /\bmutual+y?\sbenefi(?:t|cial)\b/i

body     __BANK_DRAFT     /\bbank\sdraft/i

body     __BARRISTER      /\b(?:barrister|solicitor at law|barr\.)/i

body __BESTOFAWARD	/\bBest of \w+ Award/

body     __BIGDOLLARSFVGT       /\$\d{2,3},\d{3}/

body __BIOGRAPHY	/\b(?:biography|biographies|biographical)\b/i

body __BODY_STARTS_WITH_FROM_LINE /^From \S+ \S\S\S \S\S\S .. ..:..:.. \S+\s+\S+\: /s

body     __BURKINA_FASO   /\bburkina\s?faso\b/i

body __CASHPRZ      /cash prize of/

body __CBNVANITY	/\bContinental Broadcasting Network\b/

body     __CHARITY        /\bcharit(?:y|[ai]ble)\b/i

body     __COMPENSATION   /\b(?:compensat(?:e|ion)|recompensed?)\b/i

body     __CONTACT_ATTY   /\bcontact\smy\s(?:barrister|attou?rney)\b/i

body     __CONTACT_YOU    /\bcontacting\syou\b/i

body     __COURIER        /\bcourier\s(?:company|service)\b/i

body     __CS_WORD              /\bC[A-Za-z]{2,4}IS\b/

header  __CTYPE_MULTIPART_ANY Content-Type =~ /multipart\/\w+/i

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __CTYPE_ONETAB_GIF Content-Type:raw =~ /^image\/gif;\n\tname=\".+?\"$/s
endif

header   __DATE_700             Date =~ /-0700/

body __DBLCLAIM     /avoid double claiming/

body     __DEAD_PARENT    /\bmy\s(?:deceased|dead)\s(?:father|mother)/i

body     __DEAL           /\b(?:business|financial|this|the|mutual|die(?:se)?|cette)\s(?:deal|transa[ck]tion|proposal|offer|venture|suggestion|partnership)/i

body     __DECEASED       /\b(?:the|my|der)\s(?:deceased|late|verstorbenen)\b/i

body     __DESTROY_ME     /\b(?:destroy|hunt)\sm[ey]\b/i

body     __DIED_IN        /\bdied\sin\b/i

body     __DIPLOMA              /diploma/i

body     __DIPLOMATIC     /\bdiplomatic\b/i

body __DISTINGUISHED	/\bdistinguished\b/i

header	 __DKIM_EXISTS	exists:DKIM-Signature

if !plugin(Mail::SpamAssassin::Plugin::SPF)
if !plugin(Mail::SpamAssassin::Plugin::DKIM)
   header __DKIM_EXISTS        exists:DKIM-Signature
endif
endif

body           __DLND_ATTACH      /\bdownload\sthe\sattach(?:ed|ment)\b/i

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  meta         __DOC_ATTACH       (__DOC_ATTACH_MT || __DOC_ATTACH_FN1 || __DOC_ATTACH_FN2)
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   __DOC_ATTACH_FN1   Content-Type =~ /="[^"]+\.(?:docx?|rtf)"/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   __DOC_ATTACH_FN2   Content-Disposition =~ /="[^"]+\.(?:docx?|rtf)"/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   __DOC_ATTACH_MT    Content-Type =~ m,\bapplication/(?:msword|rtf|vnd\.ms-word|vnd\.openxmlformats-officedocument\.wordprocessingml\.document)\b,i
endif

body     __DORMANT_ACCT   /\b(?:dormant|abandoned|left\s?over)\s(?:account|fund|transaction|sum)/i

body	__DOS_BODY_FRI	/\bfri(?:day)?\b/i

body	__DOS_BODY_MON	/\bmon(?:day)?\b/i

body	__DOS_BODY_SAT	/\bsat(?:day)?\b/i

body		__DOS_BODY_STOCK	/\bstock\b/i

body	__DOS_BODY_SUN	/\bsun(?:day)?\b/i

body	__DOS_BODY_THU	/\bthu(?:r(?:s(?:day)?)?)?\b/i

body		__DOS_BODY_TICKER	/\b[A-Z]{4}\.(?:OB|PK)\b/

body	__DOS_BODY_TUE	/\btue(?:s(?:day)?)?\b/i

body	__DOS_BODY_WED	/\bwed(?:nesday)?\b/i

body	__DOS_COMING_TO_YOUR_PLACE	/I (?:am|might(?: be)?) c[a-z]?o[a-z]?m[a-z]?(?:i[a-z]?n[a-z]?g[a-z]{0,2}|e down) to y[!a-z]{2,4}r (?:city|place[a-z]{0,2}|co[a-z]?u[a-z]?n[a-z]?t[a-z]?ry) in (?:f[a-z]?e[a-z]?w|\d{1,2}) (?:day|week)s/

body	__DOS_CORRESPOND_EMAIL		/correspond with me using my email/

meta __DOS_DIRECT_TO_MX		__DOS_SINGLE_EXT_RELAY && !__DOS_HAS_LIST_ID && !__DOS_HAS_LIST_UNSUB && !__DOS_HAS_MAILING_LIST && !__DOS_RELAYED_EXT

body	__DOS_DROP_ME_A_LINE		/Drop me a line at/

body	__DOS_EMAIL_DIRECTLY		/(?:Email m[a-z]?e|address) direc(?:tl|lt)y at/

body		__DOS_FIN_ADVANTAGE	/\bfinancial advantage/i

uri __DOS_HAS_ANY_URI		/./

header __DOS_HAS_LIST_ID	exists:List-ID

header __DOS_HAS_LIST_UNSUB	exists:List-Unsubscribe

header __DOS_HAS_MAILING_LIST	exists:Mailing-List

body __DOS_HI                   /^Hi,$/

body	__DOS_I_AM_25			/I a.?m 25/

body __DOS_I_DRIVE_A	/I drive a/

body __DOS_LET_GO_JOB	/I was (?:let go|fired|layed off|dismissed) from a job I h(?:el|a)d for (?:2\d years|\d{3} months)/

body __DOS_LINK                 /\blink\b/

body	__DOS_MEET_EACH_OTHER		/(?:meet each other|[Mm]ay ?be we can meet)/

body __DOS_MY_OLD_JOB	/my old job/

body	__DOS_PERSONAL_EMAIL		/personal email at/

header	__DOS_RCVD_FRI	Received =~ / Fri, /

header	__DOS_RCVD_MON	Received =~ / Mon, /

header	__DOS_RCVD_SAT	Received =~ / Sat, /

header	__DOS_RCVD_SUN	Received =~ / Sun, /

header	__DOS_RCVD_THU	Received =~ / Thu, /

header	__DOS_RCVD_TUE	Received =~ / Tue, /

header	__DOS_RCVD_WED	Received =~ / Wed, /

meta	__DOS_REF_2_WK_DAYS	(__DOS_RCVD_MON && __DOS_BODY_WED) || (__DOS_RCVD_TUE && __DOS_BODY_THU) || (__DOS_RCVD_WED && __DOS_BODY_FRI) || (__DOS_RCVD_THU && __DOS_BODY_MON) || (__DOS_RCVD_FRI && __DOS_BODY_TUE) || (__DOS_RCVD_SAT && __DOS_BODY_TUE) || (__DOS_RCVD_SUN && __DOS_BODY_TUE)

meta	__DOS_REF_NEXT_WK_DAY	(__DOS_RCVD_MON && __DOS_BODY_TUE) || (__DOS_RCVD_TUE && __DOS_BODY_WED) || (__DOS_RCVD_WED && __DOS_BODY_THU) || (__DOS_RCVD_THU && __DOS_BODY_FRI) || (__DOS_RCVD_FRI && __DOS_BODY_MON) || (__DOS_RCVD_SAT && __DOS_BODY_MON) || (__DOS_RCVD_SUN && __DOS_BODY_MON)

meta	__DOS_REF_TODAY		(__DOS_RCVD_MON && __DOS_BODY_MON) || (__DOS_RCVD_TUE && __DOS_BODY_TUE) || (__DOS_RCVD_WED && __DOS_BODY_WED) || (__DOS_RCVD_THU && __DOS_BODY_THU) || (__DOS_RCVD_FRI && __DOS_BODY_FRI) || (__DOS_RCVD_SAT && __DOS_BODY_SAT) || (__DOS_RCVD_SUN && __DOS_BODY_SUN)

header __DOS_RELAYED_EXT	ALL-EXTERNAL =~ /(?:^|\n)[Rr][eE][cC][eE][iI][vV][eE][dD]:\s.+\n[Rr][eE][cC][eE][iI][vV][eE][dD]:\s/s

header __DOS_SINGLE_EXT_RELAY   X-Spam-Relays-External =~ /^\[ [^\]]+ \]$/

body		__DOS_STEADY_COURSE	/\bsteady (?:and increasing )?course\b/i

body		__DOS_STRONG_CF		/\bstrong cash flow/i

body __DOS_TAKING_HOME	/Taking home \d (?:digit level|figures) in \d{1,2} months/

body	__DOS_WRITE_ME_AT		/[Ww].?r.?i.?t.?e me at/

body __DPHPVANITY	/\bDistinguished Professionals Hardcover Publication\b/

body     __EARLY_DEMISE   /\buntimely\sdeath\b/i

body __EXCELLENCE	/\b(?:demonstrated|commitment to) excellence\b/i

header   __EXCLAIM_SUBJ         Subject =~ /\!/

body __EXECS_PROS	/\bexecutives? (?:and|&) professionals?\b/i

body     __EX_CUSTOMER    /\b(?:dead|deceased|late|verstorbenen)\s(?:client|customer|account|investor|kunde)/i

body     __FB_BA                /\bBA\b/

body     __FB_BCs               /\bBSc\b/

body     __FB_BRAND_NAME        /brand name/i

body     __FB_CONGRADS          /Congratulations/i

body     __FB_DESIGNER          /designer/i

body     __FB_GAME              /game/i

body     __FB_GLASHUTE          /Glashute/

body     __FB_HANDBAGS          /handbags/i

body     __FB_HOTTEST           /hottest/i

body     __FB_INK_PEN           /ink pen/i

body     __FB_LOTTERY           /lottery/i

body     __FB_LUX_GIFTS         /Luxury (?:\w+\s)?Gifts/i

body     __FB_MA                /\bMA\b/

body     __FB_MBA               /\bMBA\b/

body     __FB_NATIONAL          /national/i

body     __FB_NUM_PERCNT        /\d\s?\%/

body     __FB_OMEGA             /Omega/i

body     __FB_PICK              /\bpick\b/i

body     __FB_PROJECTED         /projected/i

body     __FB_P_ALLNIGHT        /all night!/i

body     __FB_P_TRUELOVE        /true love/i

body     __FB_ROLEX_MEN         /Rolex Men/i

body     __FB_ROLEX_WMEN        /Rolex Lady/i

body     __FB_S_PRICE           /Pri{1,2}c[a-z]?e/i

body     __FB_S_STOCK           /Stock/i

body     __FB_S_SYMBOL          /Symb?o?l?:\s?[A-Z_,\.-]{4,8}/i

body     __FB_TIMEPIECE         /timepiece/i

body     __FB_WALLETS           /wallets/i

rawbody        __FEEDPROXY         m;http://feedproxy\.google\.com/;
tflags         __FEEDPROXY         multiple

body     __FEES           /\b(?:security|safe\w*|courier|registration|pay|paid|up-?front|processing|delivery|transfer)[\s\w]{1,15}\s(?:fee|charge)s?\b/i 

header   __FHELO_VERIZON        X-Spam-Relays-External =~ /^[^\]]+ helo=[^ ]+verizon\.net /i

header   __FHOST_VERIZON        X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+verizon\.net /i

header   __FH_FRM_53            From =~ /\@53\.com/i

header   __FH_HAS_XMSMAIL       exists:X-MSMail-Priority

header   __FH_HAS_XPRIORITY     exists:X-Priority

header   __FH_MSGID_01C7        MESSAGEID =~ /^<0{1,5}1c7/

header   __FH_MSG_53            MESSAGEID =~ /\@53\.com/i

header   __FH_RCV_53            Received =~ /\.53\.com/i

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __FILL_THIS_FORM_FRAUD_PHISH /<FF_YOUR>(?:<FF_F1>|<FF_F2>|<FF_F3>|<FF_F4>|<FF_F5>)<FF_SUFFIX>(?:<FF_BLANK1>|<FF_BLANK2>$)/i
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __FILL_THIS_FORM_LOAN /<FF_YOUR><FF_L1><FF_SUFFIX>(?:<FF_BLANK1>|<FF_BLANK2>$)/i
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __FILL_THIS_FORM_PARTIAL /^\s*<FF_LNNO>?<FF_YOUR>(?:<FF_ALL><ANDOR>?){1,3}<FF_SUFFIX>(?:<FF_BLANK1>|(?:[-=_.,:;*\s]|=20){1,4}$)/im
  tflags   __FILL_THIS_FORM_PARTIAL multiple
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  rawbody  __FILL_THIS_FORM_PARTIAL_RAW /^\s*<FF_LNNO>?<FF_YOUR>(?:<FF_ALL><ANDOR>?){1,3}<FF_SUFFIX>(?:<FF_BLANK1>|(?:[-=_.,:;*\s]|=20|&nbsp;|<\/\w+>){0,4}$)/im
  tflags   __FILL_THIS_FORM_PARTIAL_RAW multiple
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __FILL_THIS_FORM_SHORT /(?:<FF_LNNO>?<FF_YOUR><FF_ALL><FF_SUFFIX>(?:<FF_BLANK2>|<ANDOR>)){3,}/i
endif

body     __FIXED_RATEFVGT       /fixed rate/i

meta     __FM_LARGE_MONEY       (__F_LARGE_MONEY || __F_LARGE_MONEY_2)

meta     __FM_MORTGAGE5PLUS     ((__PREAPPROVEDFVGT + __FIXED_RATEFVGT + __YOUR_CREDITFVGT + __HOMELOANFVGT + __APPROVALFVGT + __BIGDOLLARSFVGT + __LOANURIFVGT + __MORTURIFVGT) > 4)

meta     __FM_MORTGAGE6PLUS     ((__PREAPPROVEDFVGT + __FIXED_RATEFVGT + __YOUR_CREDITFVGT + __HOMELOANFVGT + __APPROVALFVGT + __BIGDOLLARSFVGT + __LOANURIFVGT + __MORTURIFVGT) > 5)

meta     __FM_MY_PRICE          (__FB_S_PRICE || FRT_PRICE)

meta     __FM_NAT_LOTTERY       (__FB_NATIONAL && __FB_LOTTERY)

meta     __FM_STOCK_WORDS       (__FB_HOTTEST || __FB_PICK || __FB_PROJECTED)

meta       __FORGED_TBIRD_IMG      __MUA_TBIRD && __JPEG_ATTACH && __MIME_BDRY_0D0D
describe   __FORGED_TBIRD_IMG      Possibly forged Thunderbird image spam

body     __FOUND_YOU      /\b(?:I|we)\sfound\syour?\b/i

body     __FRAUD          /\b(?:de)?fraud/i

body __FRAUD_IOV	/\b(?:no risks?|risk-? *free|free of risks?|100% safe|v.llig Risikofrei ist)\b/i

body __FRAUD_PTX	/\b(?:ass?ass?inat(?:ed|ion)|murder(?:e?d)?|poison(?:e?d)?|kill(?:ed|ing)\b[^.]{0,99}\b(?:war veterans|rebels?))\b/i

body __FRAUD_XWW	/\b(?:honest(?:ly)?\sco(?:-?operat(?:e|ion)|llaborat(?:e|ion))|ehrliche\szusammenarbeit)\b/i

header __FROM_EBAY	From:addr =~ /\@ebay\.com$/i

header   __FROM_ISO_2022_JP     From:raw =~ /=\?ISO-2022-JP\?/

header   __FROM_LEFT_BRACK      From:name =~ /</

header __FROM_PAYPAL	From:addr =~ /\@paypal\.com$/i

header   __FROM_RIGH_BRACK      From:name =~ />/

header         __FROM_RUNON          From =~ /\S+<\w+/

header   __FROM_VEGAS           From =~ /Vegas/i

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     __FRT_GOLD             /<inter SP2><post P2>\b(?!gold)<G><O><L><D>\b/i
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
body     __FRT_SILVER           /<inter SP2><post P2>\b(?!s[il][li]ver)<S><I><L><V><E><R>\b/i
endif

header   __FS_SUBJ_RE           Subject =~ /^Re: /

header   __FS_S_TRADE           Subject =~ /\btrade\b/i

body     __F_LARGE_MONEY        /\d\d\d,\d\d\d/

body     __F_LARGE_MONEY_2      /\d\d?\s?(?:thousand|(?:m|b|tr)illion)/i

body     __GHANA          /\bghana\b/i

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __GIF_ATTACH Content-Type =~ /^image\/gif\b/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
  ifplugin Mail::SpamAssassin::Plugin::ImageInfo
    body	__GIF_EXISTS	eval:image_count('gif',1)
endif
endif

header	 __GREYLISTED	ALL =~ /(?:^|\n)X-(?:Scam-Grey|Greylist(?:ing)?):\s+delay(?:ed)? (?:for )?\d+(?: ?s(?:ec(?:ond)?s?)?|:\d\d)/im

body __HAS_ANY_EMAIL /\w@\S+\.\w/

uri __HAS_ANY_URI   /./

header __HDR_ORDER_FTSDMCXXXX ALL =~ /\nFrom: .{1,80}?\nTo: .{1,80}?\nSubject: .{1,200}?\nDate: .{1,40}?\nMIME-Version: .{1,40}?\nContent-Type: .{1,120}?\nX-Priority: .{1,40}?\nX-MSMail-Priority: .{1,40}?\nX-Mailer: .{1,80}?\nX-MimeOLE:/s

header __HELO_NO_DOMAIN   X-Spam-Relays-External =~ /^[^\]]+ helo=[^\.]+ /

header		__HK_HELO_EBAY		X-Spam-Relays-External =~ / helo=[^ ]+\.(?:ebay|emarsys)\b/

header		__HK_HELO_MICROSOFT	X-Spam-Relays-External =~ / helo=\S+\.(?:microsoft(?:email)?|msn)\.com /

body		__HK_LOTTO_1		/\b(?:(?:inter)?national|foundation|mercato|univers|euro ?million|e-?mail|euro-pw|bill ?gates|swiss|prestige|cristal|am.ricaine|coca.?cola|fiduciary|department) ?lot(?:eri[ej]|t(?:ery|o))/i

body		__HK_LOTTO_2		/\blot(?:eri[ej]|t(?:ery|o)) ?(?:(?:inter)?national|foundation|mercato|univers|euro ?million|e-?mail|euro-pw|bill ?gates|swiss|prestige|cristal|am.ricaine|coca.?cola|fiduciary|department)/i

body		__HK_LOTTO_BALLOT	/\b(?:promotional|on.?line|computer|internet|e-?mail|fran.aise) (?:ballot|draw|sweepstake)/i

body		__HK_LOTTO_JACKPOT	/\bmega jackpot\b/i

body		__HK_LOTTO_STAATS	/\bstaatsloteri/i

ifplugin Mail::SpamAssassin::Plugin::FreeMail
header		__HK_NAME_DR		From:name =~ /^DR\b/mi
endif

header		__HK_NAME_EBAY		From:name =~ /\bebay\b/i

ifplugin Mail::SpamAssassin::Plugin::FreeMail
header		__HK_NAME_FROM		From:name =~ /^FROM\b/mi
endif

header		__HK_NAME_MICROSOFT	From:name =~ /(microsoft|\bmsn\b)/i

ifplugin Mail::SpamAssassin::Plugin::FreeMail
header		__HK_NAME_MR_MRS	From:name =~ /^M(?:RS?|ISS)\b/mi
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader	__HK_SPAMMY_CDFN	Content-Disposition =~ /name=.*?(?:lot(?:eri[ej]|t(?:ery|o))|award|prize|winn(?:er|ing)|microsoft|congrat|urgent)/mi
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader	__HK_SPAMMY_CTFN	Content-Type =~ /name=.*?(?:lot(?:eri[ej]|t(?:ery|o))|award|prize|winn(?:er|ing)|microsoft|congrat|urgent)/mi
endif

body     __HOMELOANFVGT         /home loan/i

header   __HOST_HOTMAIL         X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.hotmail\.com /

header   __HOTMAILCOM           X-Spam-Relays-External =~ /^[^\]]+ helo=hotmail\.com /i

rawbody __HS_QUOTE /^> /

header __HS_SUBJ_RE_FW Subject =~ /^(?i:re|fw):/

header __HS_SUBJ_UC_FW Subject =~ /^FW:/

body     __HUSH_HUSH      /\b(?:confiden[tc]i[ae]l(?:ity)?|private|secre(?:te?|cy)|sensitive|concealed|obscured|discre(?:et|tion)|vertraulich(?:en)?|geheim)\b/i

ifplugin Mail::SpamAssassin::Plugin::ImageInfo
  body       __IMG_LE_300K           eval:pixel_coverage('all',62500,300000)
endif

body __INFORM_YOU	/\b(?:pleased?|pleasure) to inform you\b/

body     __INHERIT_PMT    /\binheritance\spayment\s/i

body __INNERCIRCLE	/\bInner Circle\b/

body     __INTL_BANK      /\b(?:international\s(?:\w+\s)?bank|banque\sinternationale)\b/i

body     __INVEST_MONEY   /\binvest\sthis\smoney\b/i

body     __IS_LEGAL       /\b(?:this\s(?:deal|offer|transaction|proposal|exchange|arrangement)|it)?\sis\s(?:(?:guaranteed|completely|absolutely|perfectly|100%|very)\s)?(?:legal|hitch-free)\b/i

body     __IVORY_COAST    /\b(?:Cote\s?D.Ivoire|Ivory\s?Coast)\b/i

body     __I_INHERIT      /\bI\s[a-z\s]{0,30}inherited\b/i

body     __I_WILL_YOU     /\bwill(?:ed)?\s(?:[a-z\s]{0,20}\s(?:fortune|money)\s)?to\syou\b/i

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader __JPEG_ATTACH           Content-Type =~ /image\/jpeg/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
  ifplugin Mail::SpamAssassin::Plugin::ImageInfo
    body	__JPEG_EXISTS	eval:image_count('jpeg',1)
endif
endif

body            __KAM_LOTTO1    /(e-?mail address (have emerged a winner|has won|attached to (ticket|reference)|was one of the ten winners)|random selection in our computerized email selection system)/is       

body            __KAM_LOTTO2    /((ticket|serial|lucky) number|secret pin ?code|batch number|reference number|promotion date)/is

body            __KAM_LOTTO3    /(won|claim|cash prize|pounds? sterling)/is

body            __KAM_LOTTO4    /(claims (officer|agent)|lottery coordinator|fiduciary (officer|agent)|fiduaciary claims)/is

body            __KAM_LOTTO5    /(freelotto group|Royal Heritage Lottery|UK National (Online)? Lottery|U\.?K\.? Grand Promotions|Lottery Department UK|Euromillion Loteria|Luckyday International Lottery|International Lottery)/is

body            __KAM_LOTTO6    /(Dear Lucky Winner|Winning Notification|Attention:Winner|Dear Winner)/is

header          __KAM_LOTTO7    Subject =~ /(Your Lucky Day|(Attention:|ONLINE) WINNER)/i

header __KB_MSGID_OUTLOOK_888  Message-Id =~ /^<[0-9a-f]{8}(?:\$[0-9a-f]{8}){2}\@/

if ! plugin (Mail::SpamAssassin::Plugin::OpenPGP)
  body     __KHOP_PGP_I1	/-----BEGIN PGP (?:SIGNATURE|MESSAGE|PUBLIC|PRIVATE)(?:, PART [0-9]{1,4}\/[0-9]{1,4}| KEY BLOCK)?-----/
  tflags   __KHOP_PGP_I1	nice
endif

if ! plugin (Mail::SpamAssassin::Plugin::OpenPGP)
  body     __KHOP_PGP_I2	/-----END PGP/
  tflags   __KHOP_PGP_I2	nice
endif

meta __KNOWN_VANITY	__PRINCETONPRE || __WHOSWHO || __DPHPVANITY

uri      __LOANURIFVGT          /\bloa.?ns?\b/i

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __LOTSA_MONEY_00   /<CURRENCY>\s?\d[\dO][,\.][\dO]{3}(?:(?!\d)|\b)/
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __LOTSA_MONEY_01   /(?:(?i:sum\sof\s)[\(\[]?|<CURRENCY>\s?)\s?\d[\d.,\sO]{5,20}[\dO]/
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __LOTSA_MONEY_02   /\d[\d.,\sO]{5,20}[\dO][\)\]\(]?\s?(?:<CURRENCY>|Pounds|(?i:dollars?|bucks))\b/
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __LOTSA_MONEY_03   /(?:(?i:sum\sof\s)[\(\[]?|<CURRENCY>\s?)\d(?:[\d.,\sO]{0,5})?[\)\]]?\s?(?i:M(?i:il)?\b|mil+(?i:io|<O>)n|hund?[re]+a?[dt]|thousand|tausend)/
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __LOTSA_MONEY_04   /(?:\d[\d\.]{0,4}M|million(?!s)|mill<O>n|hund?rea?d(?!s)[^\.]{1,25}thousand(?!s)|cents?[^\.]{1,25}mille|hundert[^\.]{1,30}tausend|ientos?[^\.]{1,20}mil)[^\.\$]{0,50}(?:(?:U\.?\s?S\.?\s?(?:A\.?\s?)?|united\s?states?|canad(?:ian|a)\s)?dollars?|bucks|USD|GBP|<GB_UK>\spounds?|(?:<GB_UK>\s)?pounds?\ssterling|pounds(?!\sof)|(?:d'\s?)?euros?|francs?)\b/i
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __LOTSA_MONEY_05   /(?:(?:sum|value|amount)\sof\s)\d[\d.,\sO]{7,20}[\dO\.][\)\]\(\s]{0,3}(?:pounds?|dollars?|euros?|bucks)\b/i
endif

meta     __LOTTO_ADMITS     __LOTTO_ADMITS_1 || __LOTTO_ADMITS_2 || __LOTTO_ADMITS_3

body     __LOTTO_ADMITS_1 /\b(?:on-?line|e-?mail|ballot|(?:inter)?national|state|(?:UK|euro)[- ]?(?:mil+ions?|PW)|Canada|Microsoft|MSN|internet|mega|jackpot|Royal Heritage|foundation|mercato|univers|staatsloterij|bill\s?gates|swiss|this)(?:\s\w+)?\s?(?:lot(?:to|tery|eri[ea])|sweepstake)/i

body     __LOTTO_ADMITS_2 /\b(?:free)?(?:lot(?:to|tery|erie)|sweepstakes)\s(?:(?:inter)?na[tz]ional|department|bureau|group|award)/i

uri      __LOTTO_ADMITS_3 /lottery/i

body     __LOTTO_RELATED    /\b(?:lott(?:o|ery)|sweepstakes)\s(?:prize|draw(?:s|ing)?|(?:ge)?win(?:n?er|n?ing)?|jackpot|award|fund|com+it+e+|com+is+ion|guild|promotion|program|day|online|company|(?:in)?corporat|agent|co[-,]?ordinator|team)/i

body     __LOTTO_WINNINGS   /(?:claim|transfert?(?:\s\w+)?|virement|zahlung)\s(?:your|of|the|this|de|ihrer)\s(?:win+ings?|money|(?:cash\s)?prize|award|f[ou]nds?|grant|gewinne)/i

body     __LOTTO_WIN_01     /\bwin+ing\s(?:prize|number|notification|draw|check|cheque|details|information)/i

body     __LUCKY_WINNER   /\b(?:lucky|gl.cklich(?:en)?)\s(?:ge)?win+ers?\b/i

body     __LUCRATIVE      /\blucrative\b/i

header __MAILER_OL_5510 X-Mailer =~ /^Microsoft Office Outlook, Build 11.0.5510$/

header __MAILER_OL_6626 X-Mailer =~ /^Microsoft Outlook, Build 10\.0\.6626$/

header   __MANY_RECIPS          ToCc =~ /(?:\@[^@]{5,30}){3}/

body     __MASTERS              /Masters/i

body     __MBA                  /MBA/i

header __MID_START_001C   Message-ID =~ /^<000001c/

body     __MILLIONS       /\bmillions\sof\s(?:dollar|euro|pound)/i

header __MIMEOLE_1106   X-MimeOLE =~ /^Produced By Microsoft MimeOLE V6.00.2800.1106$/

header     __MIME_BDRY_0D0D        Content-Type =~ /boundary="-{12}(?:0[1-9]){12}/

header   __MISSING_REF		References =~ /^UNSET$/ [if-unset: UNSET]

header __MOLE_2962  X-MimeOLE =~ /^Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2962$/

uri      __MORTURIFVGT          /\bmor.?t\b/i

header __MO_OL_015D5  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2905/

header __MO_OL_07794  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1437/

header __MO_OL_09BB4  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.72\.3155\.0/

header __MO_OL_1ECD5  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1081/

header __MO_OL_20C99  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.72\.3338\.1/

header __MO_OL_22B61  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1158/

header __MO_OL_25340  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4963\.1700/

header __MO_OL_32D97  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V9\.0\.2416/

header __MO_OL_3857F  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1409/

header __MO_OL_3AC1D  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.00\.2919\.6700/

header __MO_OL_3D61D  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.71\.2244\.8/

header __MO_OL_465CD  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1506/

header __MO_OL_4B815  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.71\.2730\.2/

header __MO_OL_4BF4C  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4522\.1200/

header __MO_OL_4EEDB  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4963\.1700/

header __MO_OL_4F240  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1158/

header __MO_OL_58CB5  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4133\.2400/

header __MO_OL_5B79A  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.3790\.1830/

header __MO_OL_6554A  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2905/

header __MO_OL_72641  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1441/

header __MO_OL_7533E  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4963\.1700/

header __MO_OL_812FF  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4927\.1200/

header __MO_OL_83BF7  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.72\.3110\.3/

header __MO_OL_8627E  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1437/

header __MO_OL_8E893  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V10\.0\.2616/

header __MO_OL_91287  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.2300/

header __MO_OL_9B90B  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.1700/

header __MO_OL_A50F8  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4922\.1500/

header __MO_OL_A842E  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1441/

header __MO_OL_ADFF7  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1158/

header __MO_OL_B30D1  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.2300/

header __MO_OL_B4B40  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4133\.2400/

header __MO_OL_B9B11  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2462\.0000/

header __MO_OL_BC7E6  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4927\.1200/

header __MO_OL_C65FA  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.1700/

header __MO_OL_CAC8F  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V4\.71\.1712\.3/

header __MO_OL_CF0C0  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4807\.2300/

header __MO_OL_EF20B  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2180/

header __MO_OL_EF222  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2873/

header __MO_OL_F3B05  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2800\.1437/

header __MO_OL_F475E  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2741\.2600/

header __MO_OL_F6D01  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V5\.50\.4522\.1200/

header __MO_OL_FF5C8  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2741\.2600/

header   __MSGID_VGA            Message-ID =~ /^<000001c[67]/

header __MSOE_MID_WRONG_CASE   ALL =~ /\nMessage-Id: /

header     __MUA_TBIRD             User-Agent =~ /Thunderbird/

body     __MY_FORTUNE     /\b(?:my|his|her)\s(?:fortune|heritage)\b/i

header __NAKED_TO   To =~ /^[^\s<>]+\@[^\s<>]+$/

body     __NEXT_OF_KIN    /\bnext[-\s]of[-\s]kin\b/i

body     __NIGERIA        /\bnigeria\b/i

body __NOMINATION	/\b(?:nominated|nomination)\b/i

body     __NOT_DEAD_YET   /\bwill\sinherit\b/i

body     __NOT_SCAM       /\bnot\sa\sscam\b/i

if !plugin(Mail::SpamAssassin::Plugin::SPF)
if !plugin(Mail::SpamAssassin::Plugin::DKIM)
   meta   __NOT_SPOOFED       ALL_TRUSTED || __DKIM_EXISTS
endif
endif

if !plugin(Mail::SpamAssassin::Plugin::SPF)
 ifplugin Mail::SpamAssassin::Plugin::DKIM
    meta   __NOT_SPOOFED	ALL_TRUSTED || DKIM_VALID
endif
endif

ifplugin Mail::SpamAssassin::Plugin::SPF
if !plugin(Mail::SpamAssassin::Plugin::DKIM)
   meta   __NOT_SPOOFED	ALL_TRUSTED || SPF_PASS
endif
endif

ifplugin Mail::SpamAssassin::Plugin::SPF
 ifplugin Mail::SpamAssassin::Plugin::DKIM
   meta   __NOT_SPOOFED	ALL_TRUSTED || SPF_PASS || DKIM_VALID
endif
endif

body __NO_COST		/\b(?:no costs?|cost-? *free|free of costs?|no fees?|neither cost nor obligation)\b/i

meta     __NO_INR_YES_REF	(__XM_GNUS || __XM_MSOE5 || __XM_MSOE6 || __XM_MOZ4 || __XM_SKYRI || __XM_WWWMAIL || __UA_GNUS || __UA_KNODE || __UA_MUTT || __UA_PAN || __UA_XNEWS)

ifplugin Mail::SpamAssassin::Plugin::ImageInfo
  body       __ONE_IMG               eval:image_count('all',1,1)
endif

body     __OUR_BEHALF     /\bon\s(?:my|our)\sbehalf\b/i

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __PART_CID_STOCK_LESS    Content-ID =~ /^<00[a-f0-9]{10}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[A-Za-z]+>$/
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __PART_STOCK_CD_F Content-Disposition =~ /filename/
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __PART_STOCK_CID Content-ID =~ /^<[a-f0-9]{12}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[^\s\.]+>$/
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __PART_STOCK_CL Content-Location =~ /./
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  meta     __PCT_FOR_YOU    __PCT_FOR_YOU_1 || __PCT_FOR_YOU_2 || __PCT_FOR_YOU_3
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __PCT_FOR_YOU_1  /<PERCENT>[\s)]{0,3}(?:of\s[\w\s]{0,35}?)?(?:for|to|as)\syour?/i
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __PCT_FOR_YOU_2  /\b(?:give|offer)\syou\s<PERCENT>/i
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __PCT_FOR_YOU_3  /\byour?\s(?!can)[\w\s]{6,20}?(?:(?:share|entitle|assist|comp[ea]nsate|reward|renumerate|deduct|account|tage)[\w\s]{1,25}?)?\s(?<!by\s)(?<!up\sto\s)<PERCENT>/i
endif

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
  body     __PCT_OF_PMTS    /<PERCENT>[\s)]+(?:of\s[\w\s]{0,35}?)?of\s(?:the\s)?(?:payments?|remittances?|chec(?:k|que)s?)/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  meta         __PDF_ATTACH       (__PDF_ATTACH_MT || __PDF_ATTACH_FN1 || __PDF_ATTACH_FN2)
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   __PDF_ATTACH_FN1   Content-Type =~ /="[^"]+\.pdf"/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   __PDF_ATTACH_FN2   Content-Disposition =~ /="[^"]+\.pdf"/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   __PDF_ATTACH_MT    Content-Type =~ m,\bapplication/pdf\b,i
endif

if ! plugin (Mail::SpamAssassin::Plugin::OpenPGP)
  meta     __PGP_INLINE	( __KHOP_PGP_I1 && __KHOP_PGP_I2 )
  tflags   __PGP_INLINE	nice noautolearn
endif

if ! plugin (Mail::SpamAssassin::Plugin::OpenPGP)
  header   __PGP_SIGNED	Content-Type =~ /multipart\/signed;.*\/pgp-signature/s
  tflags   __PGP_SIGNED	nice noautolearn
endif

body     __PHD                  /PhD/i

body           __PLS_REVIEW       /\b(?:please|kindly)\s(?:(?:re)?view|see)(?:\s\w+)?\sattach(?:ed|ment)\b/i

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
  ifplugin Mail::SpamAssassin::Plugin::ImageInfo
    mimeheader	__PNG_ATTACH	Content-Type =~ /^image\/png\b/i
endif
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
  ifplugin Mail::SpamAssassin::Plugin::ImageInfo
    body	__PNG_EXISTS	eval:image_count('png',1)
endif
endif

body     __PREAPPROVEDFVGT      /pre-approved/i

body __PRINCETONPRE	/\bPrinceton Premier/

body __PUB_DEADLINE	/\bpublication deadlines?\b/i

body     __RANDOM_PICK    /\b(?:random(?:ly)?\s(?:\w+\s)?(?:select(?:ion|ed)|pick(?:ed)?|computer)|(?:select|pick)ed\s(?:at\s)?random(?:ly)?)\b/i

header __RATWARE_BOUND_A  ALL =~ /^Message-Id: <....([0-9a-f]{8})\$[0-9a-f]{8}\$.{10,400}boundary="----=_NextPart_000_...._\1\./msi # "

header __RATWARE_BOUND_B  ALL =~ /boundary="----=_NextPart_000_...._([0-9a-f]{8})\..{10,400}^Message-Id: <....\1\$[0-9a-f]{8}\$/msi # "

ifplugin Mail::SpamAssassin::Plugin::HeaderEval
header __RCVD_IN_2WEEKS        eval:received_within_months('0', '0.46')
describe __RCVD_IN_2WEEKS      Received: within the past 2 weeks
endif

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header __RCVD_IN_BRBL   eval:check_rbl('brbl','bb.barracudacentral.org')
tflags __RCVD_IN_BRBL   net
endif

ifplugin Mail::SpamAssassin::Plugin::DNSEval
header	__RCVD_IN_DNSWL		eval:check_rbl('dnswl-firsttrusted', 'list.dnswl.org.')
tflags	__RCVD_IN_DNSWL		nice net
endif

body __RECOGNITION	/\brecognition\b/i

body __REGISTRY	/\bregistry\b/i

header __REPLYTO_EXISTS             exists:Reply-To

header __S25R_1 X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\d[^0-9. ]+\d\S*\./

header __S25R_2 X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\d{5}/

header __S25R_3 X-Spam-Relays-External =~ /^[^\]]+ rdns=(?:[^. ]+\.)?\d[^. ]*\.[^. ]+\.\S+\.[a-z]/

header __S25R_4 X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\d\.[^. ]*\d-\d/

header __S25R_5 X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\d\.[^. ]*\d\.[^. ]+\.\S+\./

header __S25R_6 X-Spam-Relays-External =~ /^[^\]]+ rdns=(?:dhcp|dialup|ppp|[achrsvx]?dsl)[^. ]*\d/

body __SBCAVANITY	/\bSmall Business Commerce Association/

body     __SCAM           /\bscam(?:m?e[dr])?s?\b/i

body __SEEK_FRAUD_0BVEZG  /You will provide him with the following information/

body __SEEK_FRAUD_0CUBFG  / banking law and guidelines here stipulates that /

body __SEEK_FRAUD_0ENSZN  / within the next ten official working days/

body __SEEK_FRAUD_0EY1BH  / United Kingdom\. I got your contact through /

body __SEEK_FRAUD_0LP0QC  /I have reasoned very professionally and I /

body __SEEK_FRAUD_0MX8JO  /like you to accept this token with .ood .aith as this is /

body __SEEK_FRAUD_0QGAHF  / Address where you want the payment center to send your ATM CARD: /

body __SEEK_FRAUD_0UXRAU  /So keep it secret till they are all apprehended\./

body __SEEK_FRAUD_0WHPB1  /we have resolved in finding a solution to /

body __SEEK_FRAUD_0WTPZI  /We are here serving you with these programs\.:-/

body __SEEK_FRAUD_0_6JSL  / all arrangements and . .ill give you more information on /

body __SEEK_FRAUD_19NM0A  /All participants were selected through our Microsoft computer ballot system drawn from /

body __SEEK_FRAUD_1DJSNK  /There is no risk at all as all the paperwork for this transaction will be done by /

body __SEEK_FRAUD_1LS8UW  /I want you to know that I have had everything planned out so that we /

body __SEEK_FRAUD_1OMKY9  / to be merciful to me and accept my soul/

body __SEEK_FRAUD_1SKLLZ  /after the war another notification was sent.and /

body __SEEK_FRAUD_215XVW  / part of our security protocol to avoid /

body __SEEK_FRAUD_2811F9  /Provide us with degree you are interested in\./

body __SEEK_FRAUD_2BERS9  /\. I will also issue a .etter .f .uthori/

body __SEEK_FRAUD_2TBGCP  /Do not destroy my career because you do not approve of my proposal\./

body __SEEK_FRAUD_2U5_KL  /m assuring you that all will be well at the end of the day/

body __SEEK_FRAUD_37UB9O  /lessed is the hand that giveth\. I took this decision because I/

body __SEEK_FRAUD_38GETZ  / he must have been in contact with you in the past or simply you were /

body __SEEK_FRAUD_3BWYGW  / accomplished family man, who made enough fortune before his untimely death\. /

body __SEEK_FRAUD_3GQDHJ  /of 8,600,000\.00GBP \(Eight Million, Six Hundred Thousand British Pounds\) in the codicil and /

body __SEEK_FRAUD_3HKWCI  / and all attempts to trace his next of kin w/

body __SEEK_FRAUD_3HU72N  / adopt a legalized method and the attorney will prepare all the necessary/

body __SEEK_FRAUD_3JFT7Y  /9414,Batch Number: 573881545-NL\/2008 and Ticket/

body __SEEK_FRAUD_3NIFMV  /confidential until you claim your prize\./

body __SEEK_FRAUD_3UF3BG  /I believe when God gives me a .econd chance to come to this world I /

body __SEEK_FRAUD_3ZGAWE  / telephone communication in this regard /

body __SEEK_FRAUD_3_8NUB  /Tel\+34-658-654-308, Fax:\+34911414351 E-mail:/

body __SEEK_FRAUD_45WI8I  / was the informer to the double claimer about the /

body __SEEK_FRAUD_461FL0  /indly accept my apology for sending unsolicited mail to you/

body __SEEK_FRAUD_49FI4O  /ants to serve the Lord must serve him in /

body __SEEK_FRAUD_4IGE4U  /or security reasons, you are advised to keep your /

body __SEEK_FRAUD_4KBBOJ  /ow are you today\? Hope all is well with you and /

body __SEEK_FRAUD_4ONVKC  / internet E-mail draw is held periodically and is organized to encourage the use of the Internet /

body __SEEK_FRAUD_4VJJ1V  / all his supposed next of kin.{0,5} relation died along/

body __SEEK_FRAUD_4VSYVD  / and the management just .rote me as the /

body __SEEK_FRAUD_4WFQ9X  /I therefore reckon that you can receive this fund as you are qualified by your name /

body __SEEK_FRAUD_4ZVC1C  /s a result of your visiting various websites we/

body __SEEK_FRAUD_52TF6W  /o avoid unnecessary delays and complications, please/

body __SEEK_FRAUD_55WLGY  /dvantage of you and they will dry you up until you have nothing\./

body __SEEK_FRAUD_58TQIN  /Remember, all prize money must be claimed /

body __SEEK_FRAUD_5CTGDY  / during a rescue operation, and it was agreed by /

body __SEEK_FRAUD_5CUOT8  / file was forwarded to my office by the auditors as unclaimed fund, we wish to use this medium to inform you that for the time being/

body __SEEK_FRAUD_5DEVYO  /here the deceased had an account .alued at /

body __SEEK_FRAUD_5EKBBQ  /he needed to make an urgent investment requiring cash payments/

body __SEEK_FRAUD_5GX3N3  / is still lying in my bank and no one will ever/

body __SEEK_FRAUD_5IZEAX  / you as the next of kin and have them release the deposit to you/

body __SEEK_FRAUD_5L07LP  /s\. By virtue of my closeness to the deceased and his immediate family, I am very much aware of my client/

body __SEEK_FRAUD_5MCR_O  / provide you with more details and relevant documents/

body __SEEK_FRAUD_5MEKF1  / and my doctors have told me that I have /

body __SEEK_FRAUD_5NJERT  / well and always extend the good work to others\./

body __SEEK_FRAUD_5_1_MB  /orward to us your contact information as it is stated below:/

body __SEEK_FRAUD_6B2FK_  /We will get your self a verifiable degree of:/

body __SEEK_FRAUD_6EGJH6  / the way I am going to instruct herein\./

body __SEEK_FRAUD_6GGFLT  /Though I know that a transaction of this magnitude will make .n/

body __SEEK_FRAUD_6GPS4I  /nd he also confided in me the last time he was .. my..f/

body __SEEK_FRAUD_6HPM5A  /You don\'t need to worry for anything because this transaction is 100 risk free, the boxes are coming with a diplomatic agent who will accompany the boxes to your house or office there in your country\./

body __SEEK_FRAUD_6LGTFG  / your assistance to receive this .oney into your bank/

body __SEEK_FRAUD_6M8QNI  / draws was conducted by a random selection of email addresses/

body __SEEK_FRAUD_6OYTMK  / to enable us open up communication with you regarding the release of your fund immediately\./

body __SEEK_FRAUD_6VUONK  /to avoid any further delay and remember to pay the/

body __SEEK_FRAUD_6ZE0ZK  / for the paper works, take note of that\./

body __SEEK_FRAUD_6ZXIA1  /that will utilize this money the way I am going to instruct here in\./

body __SEEK_FRAUD_7A8HJM  / to your postal Address in your country /

body __SEEK_FRAUD_7CQUW3  /som of the Lord\. Exodus 14 VS 14 says that /

body __SEEK_FRAUD_7ERN1P  / Remittance Manager Zenith Bank Of Nigeria\./

body __SEEK_FRAUD_7GJKBJ  /from what I have inherited from my late husband to /

body __SEEK_FRAUD_7H66PN  /, making a loss for both the double claimer and the real ..n/

body __SEEK_FRAUD_7ORNIB  /Please, again, note I am a family man. I ha/

body __SEEK_FRAUD_7PX0OU  /ome money in various currencies was discovered /

body __SEEK_FRAUD_7UXDY2  /our Winnings Certificate and all other relevant .ocuments\/.aperwork /

body __SEEK_FRAUD_7XOY_V  / papers will be processed in your acceptance\./

body __SEEK_FRAUD_80CUEU  /hat my health has deteriorated so badly, I can/

body __SEEK_FRAUD_8A1Q6M  /You may not understand why this mail came to you\./

body __SEEK_FRAUD_8BDNKT  / client\'s next-of-kin will be provided\. /

body __SEEK_FRAUD_8D5ZCH  /Full names: Address: Telephone and fax numbers: Age: Marital Status: Occupation: A copy of your identity:/

body __SEEK_FRAUD_8DOXAD  /I once again try to notify you as my earlier .etter /

body __SEEK_FRAUD_8GOL16  / a notice to contact the next of kin, or the /

body __SEEK_FRAUD_8JIBO6  /citizens in the communities where they have /

body __SEEK_FRAUD_8P0LT0  /CHUBB INSURANCE COMPANY OF EUROPE S\.A\. 106 FENCHURCH STREET, LONDON EC3M 5NB UK\./

body __SEEK_FRAUD_8SR3L_  / wife and children\. I send you this mail ..t/

body __SEEK_FRAUD_9CQAIU  / your country\. Though, I do not know to what exten. you are familiar with /

body __SEEK_FRAUD_9JV2FO  / had planned to invoke the abandoned property decree of/

body __SEEK_FRAUD_9KCDA8  / will mention later .as prompted me to reach out for help/

body __SEEK_FRAUD_9Q29S6  / stopped further payment through bank to bank transfer/

body __SEEK_FRAUD_9_SYQR  / request that you kindly forward to .. your /

body __SEEK_FRAUD_A0GXKY  /UNITED NATIONS COMPENSATION AWARD PROGRAM/

body __SEEK_FRAUD_A0U_YJ  / for the collection of this international .ertifi/

body __SEEK_FRAUD_A1M2V4  /s Road London WC1X 8TH Fax: \+44-700-596-1494/

body __SEEK_FRAUD_A56GDH  /FORGIVE MY INDIGNATION IF THIS MESSAGE COMES TO YOU AS A SURPRISE AND MAY OFFEND YOUR PERSONALITY FOR CONTACTING YOU WITHOUT YOUR PRIOR CONSENT AND WRITING THROUGH THIS CHANNEL\.I GOT YOUR CONTACT FROM A PROFESSIONAL DATABASE FOUND ON THE INTERNET WHILE SEARCHING FOR A RELIABLE AND HONEST PERSON THAT WILL ASSIST ME TO SAFE GUARDA0 UND INTO AN ACCOUNT OVERSEA\. I WAS DIVINE LYINSPIRED TO PICK YOUR NAME AMONG ALL OTHER NAMES FOUND IN THE DATABASE\./

body __SEEK_FRAUD_A5PM6O  / the necessary document that will back you up/

body __SEEK_FRAUD_A62E_H  / set up a new Bank .{0,40}, even an empty a.c/

body __SEEK_FRAUD_AACTU_  / the money around various opportunities and made attractive margins for our first /

body __SEEK_FRAUD_AAKMFF  /or get a child outside my matrimonial home/

body __SEEK_FRAUD_AAV9Q9  / discovered that the account holder died /

body __SEEK_FRAUD_ADBSR1  /proper to present you as the next of kin of my deceased client/

body __SEEK_FRAUD_ADHMPP  / AFTER I WAS CONVINCED IN MY MIND THAT YOUR NAME.{0,20} COULD BE USED AS THE .E/

body __SEEK_FRAUD_AEA51B  /This is the one truth I have learned from my private banking clients\. Do not betray my confidence\./

body __SEEK_FRAUD_AFUQZ_  / category and therefore attracted a cash award of/

body __SEEK_FRAUD_AGOTOV  /I wish to seek your assistance for the transfer of US\$25M depository made by a foreign investor /

body __SEEK_FRAUD_AI_1WI  / branch so that my .ead office can order the transfer .. /

body __SEEK_FRAUD_AKYCPN  /t want them to know about this development\./

body __SEEK_FRAUD_ALY_4Z  /cil and last testament of the deceased\. \(Name now withheld since this is our second letter to you\)\./

body __SEEK_FRAUD_ASW4ZD  / will let you know how far I have gone with the arrangement\. I will secure the .iplomatic immunity/

body __SEEK_FRAUD_AUJ56H  / I am writing following an opp.rtunity in /

body __SEEK_FRAUD_AWGSAH  /this money has been kept somewhere outside Baghdad for some/

body __SEEK_FRAUD_B3XJII  / does not know the original contents of the boxes\. What .{0,3} declared to them as the contents is Sensitive Photographic Film Material. /

body __SEEK_FRAUD_B5_Q5F  / and whereby you are not interested; please indicate in your reply so that I can seek for the assistance of someone else\./

body __SEEK_FRAUD_BAD6QS  / to locate any of his extended relatives whom shall be claimants\/beneficiaries of his abandoned /

body __SEEK_FRAUD_BAO5S3  /PLEASE NOTE YOU ARE TO SEND THE FOLLOWING INFORMATION TO CLAIM YOUR PRIZE: 1\.Full Name:\.\.\. 2\.Address:\.\.\. 3\.Phone:\.\.\. 4\.Country:\.\.\. 5\.Sex\/Gender:\.\.\./

body __SEEK_FRAUD_BDDXSD  /f my offer is of no appeal to you, delete this message and forget I ever contacted you/

body __SEEK_FRAUD_BFBYW8  /from you, call me on my confidential Tel: \+870-764107753/

body __SEEK_FRAUD_BGO5Z1  / activities and to help the poor and the needy/

body __SEEK_FRAUD_BKRS5B  / Delivery Department for immediate disp..c/

body __SEEK_FRAUD_BL1D9Y  /The Microsoft Internet E-mail lottery Awards is sponsored by .{0,40} and a consortium of software promotion companies\. /

body __SEEK_FRAUD_BLDS9E  / am delighted to inform you that the contract panel/

body __SEEK_FRAUD_BPL3YK  /ddresses of individuals and companies from all /

body __SEEK_FRAUD_BQVFV6  /around me always\. I don.t want them to know about this development/

body __SEEK_FRAUD_BRNKW7  /f this business proposition offends your moral /

body __SEEK_FRAUD_BS6HNM  / Delivery Post\) with the details given below:/

body __SEEK_FRAUD_BSX___  / you at this stage is for you to provide me with your /

body __SEEK_FRAUD_BT6SO9  / you do not need to buy ticket to enter for /

body __SEEK_FRAUD_BTLJ32  /departments and authorities for necessary approvals for the release of/

body __SEEK_FRAUD_BTTJ73  /For further Information about your Winnings.{0,3}ontact your Lottery Claims /

body __SEEK_FRAUD_BXYWIK  /On behalf of the Trustees and Executor of the .state of /

body __SEEK_FRAUD_BY5FQK  / World Fund Discovery Management And Payment Bureau /

body __SEEK_FRAUD_BYTJGW  / from a human resource profile database .. /

body __SEEK_FRAUD_BZFTQQ  /I was always hostile to people and only focus/

body __SEEK_FRAUD_C0HOHT  / assets to my immediate and extended family /

body __SEEK_FRAUD_C0N_NJ  / in the Codicil and last testament to his WILL/

body __SEEK_FRAUD_C3MJRM  /confidential from the public until your claim /

body __SEEK_FRAUD_C4M8O6  /\. I want you and the church to always pray for me bec/

body __SEEK_FRAUD_C5J9EE  /from you, call me on my confidential .el: \+870-764107753/

body __SEEK_FRAUD_C5OQZD  /hough what disturbs me most is my stroke/

body __SEEK_FRAUD_C62CWS  /as I want this to be one of the last good deeds I d/

body __SEEK_FRAUD_C7BE4W  /It is understandable that you might be a/

body __SEEK_FRAUD_C80D_M  / experience to obtain a fully verifiable /

body __SEEK_FRAUD_CBZELO  / we plan on using diplomatic means .. ship/

body __SEEK_FRAUD_CDBI1H  /e a second chance to come to this world I would live my life/

body __SEEK_FRAUD_CEUKKB  /ou are eligible to receive a tax refund of /

body __SEEK_FRAUD_CHLODJ  / to enable us seeing this deal through\. I guarantee /

body __SEEK_FRAUD_CJCVEY  /electronic balloting System without the winner applying/

body __SEEK_FRAUD_CKPXGA  /rovide either an existing bank account or /

body __SEEK_FRAUD_CQN7_5  / your country\'s airport\. I hope you understand me\./

body __SEEK_FRAUD_CRYRVO  / hence I know where I am going\. I know /

body __SEEK_FRAUD_CTKQAR  / as soon as our Delivery Team confirms your/

body __SEEK_FRAUD_CTSHG_  / your letter of acceptance; your current /

body __SEEK_FRAUD_C_HP37  / like you to acknowledge the receipt of this e-mail as soon as possible /

body __SEEK_FRAUD_D3X77R  /due to one reason or the other best known to you\./

body __SEEK_FRAUD_D4FWIB  /r to quote your Qualification .umber. \(/

body __SEEK_FRAUD_D8N5AK  /This Email is to inform you that you emerged a winner of the sum of \$2,500,000\.00USD with the following numbers attached Ref/

body __SEEK_FRAUD_DAZ554  /after shall be referred to as my client, died /

body __SEEK_FRAUD_DCYEFP  / you are nationals of the same country\. /

body __SEEK_FRAUD_DI5SMP  /maintained\. The Bible made us to understand that /

body __SEEK_FRAUD_DI9349  /I am the only one who knows of this situation/

body __SEEK_FRAUD_DIIRM8  /With God all things are possible\. As soon as I /

body __SEEK_FRAUD_DI_QRB  /If this proposal is acceptable by you, I expect that you will not take undue advantage of the trust I .ill bestow in you/

body __SEEK_FRAUD_DJ79KN  /I await your prompt response\. Yours in Service/

body __SEEK_FRAUD_DKBMSM  /\. Just leave your NAME \& TEL\. PHONE \# \(with country-code\) on the voicemail and one of our staff members will get back to you promptly\! /

body __SEEK_FRAUD_DLIZ7K  /Now that my health has deteriorated so badly,/

body __SEEK_FRAUD_DNFIPA  /What you have to do now, is to contact .{0,20} Delivery Department for /

body __SEEK_FRAUD_DNXWDS  / has discovered a huge number of double claims due to ..n/

body __SEEK_FRAUD_DSHZQA  / will come to you as a surprise, Please /

body __SEEK_FRAUD_DUMWEJ  / in for claims on your behalf and secure the necessary /

body __SEEK_FRAUD_DVBIVZ  /e spun the money around various opportunities and made /

body __SEEK_FRAUD_DVQ_OH  /business endeavour by furnishing me with the following/

body __SEEK_FRAUD_DWEVNF  /ou for being part of our promotional lottery program/

body __SEEK_FRAUD_DZ5V2U  /fter you have been made the next of kin, the attorney will /

body __SEEK_FRAUD_DZ9GWP  / BUT ALL HAS PROVED ABORTIVE AS NO ONE HAS /

body __SEEK_FRAUD_D_URQY  /MY HIGHEST CONSIDERATIONS AND REGARDS AS I AWAIT YOUR URGENT RESPONSE\./

body __SEEK_FRAUD_D_Z7NM  /Congratulations\! Thank you for being a user of the World/

body __SEEK_FRAUD_E0LMNE  / to enable us seeing this .eal through\./

body __SEEK_FRAUD_E2ESY7  / contacted him and he explained everything to me\./

body __SEEK_FRAUD_E2US_V  /t is therefore upon this discovery that I /

body __SEEK_FRAUD_E3KTBE  / confidential business proposition for you/

body __SEEK_FRAUD_E5T6LD  /So I decided to travel down to United Kingdom with all my co/

body __SEEK_FRAUD_EBEFON  /, as you know we are being attacked by insurgents everyday and car bombs\./

body __SEEK_FRAUD_EGCOZC  /\. I have a business proposal in the tune of /

body __SEEK_FRAUD_EGRZ5T  /trying to get my payment all to no avail\./

body __SEEK_FRAUD_EH1G11  / until his death was a member of the Helicopter Society and the Institute of Electronic \& Electrical Engineers\./

body __SEEK_FRAUD_EINBZL  / have been agreed upon and have been signed/

body __SEEK_FRAUD_EJM0XB  / with him at the plane crash leaving nobody behind .o/

body __SEEK_FRAUD_EO5_QW  / that the proceeds of this account valued a/

body __SEEK_FRAUD_EOLLNZ  /\(Name now withheld since this is our second letter to you\)\. We contacted you b/

body __SEEK_FRAUD_EONOG2  / my branch in which I am the manager made /

body __SEEK_FRAUD_EOVKVR  / a healthy lifestyle\. I do not smoke .{0,20} drink alcohol\. /

body __SEEK_FRAUD_EPEJ1_  /our online draws which was played on the year 20..\./

body __SEEK_FRAUD_EURZ3M  /I wish you all the best and may the good Lord bless you abundantly/

body __SEEK_FRAUD_EV4LPC  /\.com and make sure you call me on this telephone number \+44-762-413-2116 immediately you forward your information so that even if am not on seat,i can go and check my email for immediate action\./

body __SEEK_FRAUD_EWAGO3  /y confidential, whatever your decision, while I await your prompt response\./

body __SEEK_FRAUD_EWZZ2M  /mbassy in Ivory Coast for nine years before he died .n the /

body __SEEK_FRAUD_EZFEDE  /: Telephone\/Fax number: Nationality: Age: Occupation:/

body __SEEK_FRAUD_E_N5XO  /Now you can get verifiable degree in 4-5 weeks /

body __SEEK_FRAUD_F4SHTD  / have never met you but my mind tells me to do this,/

body __SEEK_FRAUD_F6LCUO  /e are ready to compensate you with good percentage of the funds, No strings attached, /

body __SEEK_FRAUD_F6XEM3  / earlier letter was returned undelivered/

body __SEEK_FRAUD_F6ZEVO  / is not mandatory nor will I in any manner compel you to hono/

body __SEEK_FRAUD_F8EW0T  / keep this proposal as a top secret and delete i/

body __SEEK_FRAUD_F8IRSJ  /at the High Court Probate Division for the release of this sum of money to you\./

body __SEEK_FRAUD_F9YLOI  / necessary documents at our .igh court probate division/

body __SEEK_FRAUD_FBIJMC  /He took me to the paying bank for the claim of my Compensation payment\./

body __SEEK_FRAUD_FCD7Z9  / was able to get the package out to a safe /

body __SEEK_FRAUD_FF96JI  / endeavor to get back to me as soon as possible to enable me conclude my job/

body __SEEK_FRAUD_FFM0SF  / considering the fact that I sourced your /

body __SEEK_FRAUD_FG5MFR  /Do not betray my confidence\. If we can be of one accord, we should /

body __SEEK_FRAUD_FHIQQL  / to confiscate the funds after the expiration of the period given /

body __SEEK_FRAUD_FKRVOS  /they refused and kept the money to themselves\./

body __SEEK_FRAUD_FLVC7O  /mail address emerged as one of the online Winning emails in the /

body __SEEK_FRAUD_FNYQLN  /He informed us that he had a financial portfolio .. /

body __SEEK_FRAUD_FOSRJQ  / due to the death of all the members of his .amily /

body __SEEK_FRAUD_FOT6IF  / effort to our unfinished transfer of fund into your account/

body __SEEK_FRAUD_FOYA9K  /his is the one truth I have learned from my private banking clients. .o not betray my confidence\./

body __SEEK_FRAUD_FREOKD  /I hereby attempt to reach you again by .his .ame email address /

body __SEEK_FRAUD_FSJX4M  /I await your \"Acceptance Letter\"\.\.\.\(..\/..\/..\)/

body __SEEK_FRAUD_FSYFC_  / selected among the lucky recipients to /

body __SEEK_FRAUD_FYI5WN  /with those liars that will be turning you around asking for different kind of money to /

body __SEEK_FRAUD_F_FKHM  /Your particulars was mentioned by one of the Syndicates who was arrested as one of their victims of the operations,/

body __SEEK_FRAUD_F_KZOZ  / we have taken with our lives in this hell/

body __SEEK_FRAUD_G4RKKF  / I want to inform you that I have successfully transferred the /

body __SEEK_FRAUD_G9KM9V  /did not declare any next of kin in his official papers including the paper/

body __SEEK_FRAUD_G9OOWK  /pon this discovery we now seek your permission to have/

body __SEEK_FRAUD_GAPHBK  /e online, among the millions that subscribe/

body __SEEK_FRAUD_GFJSHQ  / or rather issue a letter of authorization to somebody to receive it on my behalf /

body __SEEK_FRAUD_GHC0LN  / and subsequent disbursement since nobody /

body __SEEK_FRAUD_GKVMSG  /r will not get into the hands of some corrupt /

body __SEEK_FRAUD_GMP0SY  / shall share in ratio of ..\% for you and ..\% for /

body __SEEK_FRAUD_GQ_III  / you as the Next of Kin to the Deceased since /

body __SEEK_FRAUD_GSL5YK  /Before his death we were both born again Christian\. Since his death I decided not to re/

body __SEEK_FRAUD_GS_B3U  /Kindly acknowledge receipt of this message in acceptance of our/

body __SEEK_FRAUD_GTSAAF  / while in the US, trying to get my payment /

body __SEEK_FRAUD_GVP80_  /Please you must know that the united nation want you to pay 50\% of this total amount \(\$10\.1 million dollars\) to any motherless babies home there in your country\./

body __SEEK_FRAUD_GVTOJY  /propagating the word of God and to endeavor that the house of God is /

body __SEEK_FRAUD_GVW9EM  / saw your email as one of the beneficiaries who have not yet received/

body __SEEK_FRAUD_GWBK_T  /According to the number of applicants at hand, .{0,3}4 Beneficiaries has been paid, /

body __SEEK_FRAUD_GXGKLM  / as long as you will remain honest to me till the end /

body __SEEK_FRAUD_GY4RJE  /I would like to intimate you with certain facts that I believe would .e/

body __SEEK_FRAUD_GZBMOF  / contacting you and telling you that your fund is with them/

body __SEEK_FRAUD_H3ZTPW  /I have willed and given .{0,40} assets to my immediate and .xtended family /

body __SEEK_FRAUD_H613HT  / secured way of getting the package out .. /

body __SEEK_FRAUD_H6IXQ5  /After the death of my client his bankers contacted me/

body __SEEK_FRAUD_H9SGSE  / of his abandoned .{0,20} and all such efforts have been to no avail\./

body __SEEK_FRAUD_HD6XPT  / because of the investment projects which myself /

body __SEEK_FRAUD_HDNKBH  /o accept my sincere apologies if my mail does not meet your personal .thics/

body __SEEK_FRAUD_HDWVMD  /indicate your interest by responding to this /

body __SEEK_FRAUD_HDZKRN  / in any ATM machine in any part of the world/

body __SEEK_FRAUD_HHL9OS  /r immunity agent there in your country to stand and receive this total amount of \$10\.1 million dollars by cash immunity delivery to your country which you are to meet with the diplomats on their arrival there in your country international airport to enable them take the clearance on face to face clearing with the customs at the airport to enable them move it to your doorstep without any inspection by the government agent as it has been directed by the united nation and .ritish government\./

body __SEEK_FRAUD_HHX2H4  /fficially inform you that it has come to our notice and we have thoroughly /

body __SEEK_FRAUD_HLICNI  /mail because your package is been registered on a Special Order\./

body __SEEK_FRAUD_HLTNBY  /Against this backdrop, my suggestion .. .o/

body __SEEK_FRAUD_HMVYSR  /Outside US: \+1\.718\.989\.5746 \"Just leave your NAME \& PHONE NO\. \(with CountryCode\)\" in the voicemail\./

body __SEEK_FRAUD_HPCAW3  / sent a routine notification to his forwarding address but /

body __SEEK_FRAUD_HPKGEO  /reject this offer, please and please destroy this message as any .eakage of this information will be too bad /

body __SEEK_FRAUD_HPPPJP  /ANDREW A\. MCELWEE,JR\. DIRECT TEL: \+44-701-114-8096 EMAIL: andrewmcelwee/

body __SEEK_FRAUD_HTRHIY  / successfully transferred into your account, we /

body __SEEK_FRAUD_HWMBYB  / that failed due to Government problems /

body __SEEK_FRAUD_HXGV4J  /this project, while the rest will be for us and for/

body __SEEK_FRAUD_I3HLDY  /m one of those that took part in the Compensation in /

body __SEEK_FRAUD_ICOZAX  /I have willed and given most of my propert/

body __SEEK_FRAUD_ID2SB5  /Please note that your lucky winning number/

body __SEEK_FRAUD_IGL8BZ  / part of our precautionary measure to avoid /

body __SEEK_FRAUD_IGWSWV  / need your urgent assistance in transferring the sum of /

body __SEEK_FRAUD_IILB8R  /I hereby inform you that the united nation and British government has choosing you as their immunity agent there in your country to stand and receive this total amount of \$10\.1 million dollars by cash immunity delivery to your country which you are to meet with the diplomats on their arrival there in your country international airport to enable them take the clearance on face to face clearing with the customs at the airport to enable them move it to your doorstep without any inspection by the government agent as it has been directed by the united nation and British government\./

body __SEEK_FRAUD_IIRQDN  /Upon maturity several notices was sent to him, even ..r/

body __SEEK_FRAUD_IMVAPT  /Sgt Marvin Oliver Telephone: \+44-762-413-2116/

body __SEEK_FRAUD_IOCGDV  / avoid any form of query from the Monetary Authority of your country\./

body __SEEK_FRAUD_IP2GBI  / \(2\) Address where you want the payment cent.. to send your ATM CARD/

body __SEEK_FRAUD_IQFKX9  / was a very dedicated Christian who loved to /

body __SEEK_FRAUD_IQZZGV  /l addresses, from Asia, Australia, New Zealand, Europe, North and South America, Middle East and Africa, as .art of our International Promotions Program\./

body __SEEK_FRAUD_IUQ6A9  /r to quote these numbers below for verification by the company\. R..: /

body __SEEK_FRAUD_IX6ZJO  /I am one of those that took part in the United Nations Compensation program in /

body __SEEK_FRAUD_IYEOHL  /e advantage of the trust I have bestowed .n you/

body __SEEK_FRAUD_IYSIY2  /NB: If you are willing to assist me, including the information/

body __SEEK_FRAUD_IZKPNF  / Once again congratulations\. Your email address has brought to you this expected luck/

body __SEEK_FRAUD_J1WFB_  / the Head of Operations in Mevas Bank, Hong Kong. I have /

body __SEEK_FRAUD_J2YHWJ  /f this proposal is acceptable by you, do not/

body __SEEK_FRAUD_J45GYN  /Other victims who have not been contacted can submit their application as well for scrutiny and possible consideration/

body __SEEK_FRAUD_J8PIFZ  /usiness as that was the only thing I cared for\. But .ow I regret all th.s/

body __SEEK_FRAUD_JAORYH  /FULL NAME: DELIVERY ADDRESS: PHONE NUMBER/

body __SEEK_FRAUD_JDNTHW  / once asked members of my family to close one of my accounts and /

body __SEEK_FRAUD_JFMEJI  /Insurance premium and Clearance Certificate Fee/

body __SEEK_FRAUD_JGB6V7  / the funds will revert to the ownership of the /

body __SEEK_FRAUD_JGKWCZ  /anel was primarily delegated to investigate /

body __SEEK_FRAUD_JHK5YJ  /I have distributed money to some charity .rgani.ations in /

body __SEEK_FRAUD_JIUMW4  /I intend to give 30\% of the total funds as compensation for your assistance/

body __SEEK_FRAUD_JJPKAG  /9414,Batch Number: 573881545-NL\/200. and Ticket/

body __SEEK_FRAUD_JJPV6X  /complications, please remember to .uote your reference and /

body __SEEK_FRAUD_JJQFVB  /I know within me that nothing ventured is /

body __SEEK_FRAUD_JJXYC_  / to themselves\. Hence, I do not trust them anymore, as they seem not to be conten.ed with what I have left for them\./

body __SEEK_FRAUD_JK6E_X  /Everything concerning this transaction shall be /

body __SEEK_FRAUD_JLSUKM  / funds belonging to Saddam Hussein\'s family /

body __SEEK_FRAUD_JMRRW7  /he diplomat does not know the original contents of the boxes\. What /

body __SEEK_FRAUD_JOSDVP  / an American soldier, I am serving in the military /

body __SEEK_FRAUD_JQSWAX  /I am seeking your assistance to evacuate the sum of/

body __SEEK_FRAUD_JRCNZ0  / who was capable of assisting me in this great venture/

body __SEEK_FRAUD_JTNNU1  / trusted me to hand over the package to his /

body __SEEK_FRAUD_JU0DNT  /\. Though, I do not know to what extent you are familiar with events\./

body __SEEK_FRAUD_JUZL6H  /I will need you to assist me in executing a business project /

body __SEEK_FRAUD_JW7I0T  /are hereby strongly advised once more to keep your winnings strictly/

body __SEEK_FRAUD_JYA5BT  /This will be executed under a legitimate arrangement that will protect you from many breach of the law\./

body __SEEK_FRAUD_K1VSVZ  /which you will use in collecting the funds\. Please endeavor to quote .our Qualification numbers \(N-222-6.47,/

body __SEEK_FRAUD_K7QFW9  /, trying to get my payment but all was to no avail\./

body __SEEK_FRAUD_K8ZMXX  / this letter will definitely come to you as a huge surprise, but I implore you to take the time to go through it carefully as/

body __SEEK_FRAUD_KBGNWU  /My name is Maria\. I am looking for a new friend\. Write me at : /

body __SEEK_FRAUD_KCMQLR  /carefully worked out by us for the \(Seven million five hundred/

body __SEEK_FRAUD_KCVY4L  / will secure the Diplomatic .mmunity .learance .ertificate/

body __SEEK_FRAUD_KDGYCE  / apology\. I must use this opportunity to /

body __SEEK_FRAUD_KFEOGR  / that the proceeds of this Bank Account valued at /

body __SEEK_FRAUD_KFUGGV  / guarantees the successful execution of this transaction\./

body __SEEK_FRAUD_KJCQBN  /our identity such as, international .assport or driver/

body __SEEK_FRAUD_KK4QB4  / sealed with synthetic nylon seal and padded with machine/

body __SEEK_FRAUD_KNJYYF  /econd chance to come to this world I .{0,40} a different way from how I have .ived /

body __SEEK_FRAUD_KOZWIB  /funds in your favour, before the transfer can be made to you\. And we/

body __SEEK_FRAUD_KS6HHB  /not with your fund, they are only making money o.. /

body __SEEK_FRAUD_KS9QN4  /Note that as soon as our Delivery Team confirm/

body __SEEK_FRAUD_KT_TR7  / of that particular winning, making a loss for both/

body __SEEK_FRAUD_KUGLJT  /American medical doctor who died in a raid here in /

body __SEEK_FRAUD_KUYQIU  / as far as I can be assured that my share will be safe in your care .ntil . complete my service here/

body __SEEK_FRAUD_KY9RF_  / because the cancer stage has gotten to a /

body __SEEK_FRAUD_L17Y6V  /hich I have there to .harity organization/

body __SEEK_FRAUD_L4OF4_  /o obtain the necessary documents and letter of probate.administration in your favo/

body __SEEK_FRAUD_L5CHVT  / to inform you that you have won a prize money of /

body __SEEK_FRAUD_L6ICNJ  /, in conjunction with the foundation for the promotion of software products, \(F\.P\.S\.\) held /

body __SEEK_FRAUD_L7_UPP  /If per adventure, you deem it fit to be part of this great promising venture, please /

body __SEEK_FRAUD_L9OWQX  /ill bestow in you\. I await your urgent response\./

body __SEEK_FRAUD_LC7TDH  /man on earth because I have received my /

body __SEEK_FRAUD_LD1SHS  /from a deceased account, though I know a transaction of this magnitude/

body __SEEK_FRAUD_LEF13W  / is hitch-free and that you should not entertain any /

body __SEEK_FRAUD_LGU9SH  /Any claim not made by this date will be .e/

body __SEEK_FRAUD_LKDOVS  /I PERSONALLY HAVE WATCHED WITH KEEN INTEREST TO SEE THE .E/

body __SEEK_FRAUD_LLMGBZ  /As soon as your details are received, our delivery team will give you the nec..s/

body __SEEK_FRAUD_LMLJQE  /kindly forward to us your letter of acceptance. your /

body __SEEK_FRAUD_LPT60S  / your Embassy to locate any of my client/

body __SEEK_FRAUD_LP_GQ9  /The above figure was given to me as my share/

body __SEEK_FRAUD_LQICIN  /last testament of the deceased\.\(Name now withheld/

body __SEEK_FRAUD_LRYT7Y  / that will prove you the present beneficiary of th/

body __SEEK_FRAUD_LTKAUK  /ourt probate division for the release of th/

body __SEEK_FRAUD_LX2RCD  / and a forwarding address to enable .. file /

body __SEEK_FRAUD_LYNJ8F  / was conducted from an exclusive list of /

body __SEEK_FRAUD_LZEFMN  /the double claimer and the real .{0,20}, as it is taken that the real/

body __SEEK_FRAUD_M03WB9  / discovered from his contract employers, /

body __SEEK_FRAUD_M1HR35  / that will use this fund for orphanages, widows,/

body __SEEK_FRAUD_M8D59N  / his extended relatives whom shall be claimant.\//

body __SEEK_FRAUD_MCEI6K  / from public notice until your claim has been /

body __SEEK_FRAUD_MGGP27  /implore you to exercise the utmost indulgence to keep this matter /

body __SEEK_FRAUD_MGLOG8  /election process was carried ou. through /

body __SEEK_FRAUD_MIIG_C  / years, and his WILL is now ready for execution\. According to him this money is to /

body __SEEK_FRAUD_MNSFWO  /o obtain the necessary documents and letter of probate\/administration in your favo/

body __SEEK_FRAUD_MO8JUB  / through our SWIFT CARD PAYMENT CENT.. in Europe,/

body __SEEK_FRAUD_MQI_VX  /Hence, I do .ot trust them anymore, as they seem not to be .onten.ed with what I have left for them\./

body __SEEK_FRAUD_MTD5KL  / under listed information as soon as possible/

body __SEEK_FRAUD_MVBG8Z  / about his death, we have been expecting .is /

body __SEEK_FRAUD_MWUIJQ  / confidential till your claims is processed and your /

body __SEEK_FRAUD_MXYWF1  / the Internet to locate any member of his family /

body __SEEK_FRAUD_MY06YR  /the lord will fight my case and I shall hold my peace/

body __SEEK_FRAUD_M_NLGB  / Address where you want the payment centre to send your ATM CARD\./

body __SEEK_FRAUD_M_UYU5  / and no one is informed of this communication/

body __SEEK_FRAUD_N2TUPL  / including the paper work of his bank deposit/

body __SEEK_FRAUD_N3QXOP  / secure the necessary approval and letter /

body __SEEK_FRAUD_N5_IR_  /claims due to winners informing close friends relatives and third parties/

body __SEEK_FRAUD_N87C1L  /nd also please do update me with any new development\./

body __SEEK_FRAUD_N9N9UF  / to us as soon as possible because if you fail to respond until the expiry date/

body __SEEK_FRAUD_NAUNZC  /CHUBB PERSONAL INSURANCE CASH ACCUMULATION MASTERPIECE POLICYHOLDER OWNERSHIP\./

body __SEEK_FRAUD_NAWNBX  / part of our International Promotions .rogram/

body __SEEK_FRAUD_NAXE2Z  / in accordance with the enabling act of Parliament/

body __SEEK_FRAUD_NH1RHX  /winners are assured of the utmost standards of confidentiality,.?and press anonymity until the end of /

body __SEEK_FRAUD_NH9TNM  / the Internet, to locate any member of his family/

body __SEEK_FRAUD_NM1G_Z  / you because you bear the surname identity /

body __SEEK_FRAUD_NMDNZN  / and since then my father took me so special/

body __SEEK_FRAUD_NNZJNQ  /qualified by your name identity\. All the legal papers /

body __SEEK_FRAUD_NN_XIN  /If you are looking for a fast and effective way to get a diploma,\(non accredited\) this is the best way out for you\./

body __SEEK_FRAUD_NPQMIG  / in all his official documents, including his Bank/

body __SEEK_FRAUD_NQE_UB  /he UNITED NATIONS have agreed to compensate them with the sum of US\$/

body __SEEK_FRAUD_NSEQAC  /if you will not work with me let me know and let me move on with my life but do not /

body __SEEK_FRAUD_NV1HR9  /My dear friend I will like you to contact /

body __SEEK_FRAUD_NVFQGO  /your package over there and know when it will get to your /

body __SEEK_FRAUD_NVO_LV  / left behind by my client before it is confiscated or /

body __SEEK_FRAUD_O6PUI_  /I ask that you do not destroy my chance, if you will not work with me /

body __SEEK_FRAUD_O8ZW84  / legitimate arrangement that will protect you and I from any breach of the law/

body __SEEK_FRAUD_OBTMVR  / have been transferred to your nominated bank account we shall /

body __SEEK_FRAUD_OEAWVL  / and corporate bodies that are listed online/

body __SEEK_FRAUD_OIF5AH  / in an ATM MACHINE in any part of the world, but the maximum /

body __SEEK_FRAUD_OIVTUG  /e does not know the real contents of the package/

body __SEEK_FRAUD_OL815K  / declared to them as the contents is Sensitive Photographic Film Materials for security reasons\./

body __SEEK_FRAUD_OLAWLX  / ANY EXPENSES THAT MIGHT BE INCURRED IN THE PROCESS OF /

body __SEEK_FRAUD_OLKRDH  /my Doctor told me that I would not last for the next three months due to /

body __SEEK_FRAUD_OPAU37  /d over-invoiced payment as the effect has eaten deep into the economy of our /

body __SEEK_FRAUD_ORCHU5  /Now you will easily get legal degree in only 4-5 weeks /

body __SEEK_FRAUD_ORMRPQ  /Is your lack of a degree holding you back from career advancement\? Are you having difficulty finding employment in your field of interest because you don/

body __SEEK_FRAUD_OUQ7_6  / had planned to invoke the abandoned property .{0,40} to confiscate the funds after the expiration of /

body __SEEK_FRAUD_OWB6Z2  / apart from this office of the presidency\. On this regards. do not hesitate to contact me for more details and direction. /

body __SEEK_FRAUD_OWE2LK  /BARRISTER TEDDY WILLIAMS ESQ\.PRINCIPAL PARTNERS: Barrister Aidan Walsh\.Esq Markus Wolfgang,Smith Esq /

body __SEEK_FRAUD_OWPH93  /2\. Direct telephone, fax and Mobile numbers\./

body __SEEK_FRAUD_OXOGET  / DOES NOT ALLOW SUCH .{0,40} YEARS, BECAUSE /

body __SEEK_FRAUD_OXQL3J  / proved unsuccessful\. After several unsuccessful attempts, I decided to /

body __SEEK_FRAUD_P12VMN  /ed all forms of medical treatment, and right now I have only about a few months to live, according to medical experts/

body __SEEK_FRAUD_P8Y20W  /This Lottery was promoted and sponsored by /

body __SEEK_FRAUD_PB4GGX  /ing the money and property left behind by /

body __SEEK_FRAUD_PBQQJA  / AS THE WHOLE REQUIRED ARRANGEMENT HAS BEEN /

body __SEEK_FRAUD_PCELPI  /Like I said, I require only a solemn confidentiality/

body __SEEK_FRAUD_PDDLNK  /sure that this fund is not wasted or end/

body __SEEK_FRAUD_PIVB38  /e sickness\. Having known my condition I decided to /

body __SEEK_FRAUD_PKVKI1  /I send you this mail not without a measure of fear as to /

body __SEEK_FRAUD_PLCEL_  / to avoid double claiming and unwarranted abuse of this program\. Please be warned/

body __SEEK_FRAUD_PNYKVG  / I therefore seek your consent to present you as the Next.of..in .. the .eceased /

body __SEEK_FRAUD_POQX46  /1\. Full Name and address 2\. Direct cell\/home telephone number 3\. Identification, either your id-card, driver\'s license or international passport\./

body __SEEK_FRAUD_PR7DT3  / Oceania as part of our .nternational .romotions .rogram/

body __SEEK_FRAUD_PRKDOF  /\) in his domiciliary bank account in a commercial bank here in London\./

body __SEEK_FRAUD_PSPGBR  /\) and send me the following information for documentation purpose:/

body __SEEK_FRAUD_PUAWHE  /MY NAME IS ANDREW A\. MCELWEE, JR\. CHIEF OPERATING OFFICER, PERSONAL INSURANCE DEPARTMENT OF THE CHUBB INSURANCE COMPANY OF EUROPE S\.A\. I AM WRITING IN RESPECT OF A FOREIGN CLIENT \[MASTERPIECE POLICYHOLDER\] OF THE ABOVE NAMED INSURANCE COMPANY \[ENGR\.WILLIAM F\. ABRAHAMSON OF AMERICA\] WHO PERISHED IN THE U\.S 9\/11\/2001,TERRORIST ATTACK WITH OTHER PASSENGERS ABOARD AS YOU ARE AWARE OF THIS FACT OR CAN CONFIRM IT YOURSELF\./

body __SEEK_FRAUD_PUJ_IF  / your acceptance of this deal, we request that you/

body __SEEK_FRAUD_PUSLFS  /Can I trust you\? When you receive this letter, kindly send .. /

body __SEEK_FRAUD_PYUIPE  /customer who died along side with his entire family, and ever/

body __SEEK_FRAUD_PZEJXH  / with absolute confidentiality and sincerity\./

body __SEEK_FRAUD_PZKR_K  /ever is contacting us through emails are fake/

body __SEEK_FRAUD_P_7YRN  /I shall assemble all the necessary Legal Documents that will be used to back up our claim\. /

body __SEEK_FRAUD_Q2NVM5  /s can be paid to you\. We shall both share the funds\. 40\% for me and 55\% to you, while 5\% should be for Expenses or your Government may require as Tax\./

body __SEEK_FRAUD_Q4PFFF  / law and guideline here stipulates that if such money .emain/

body __SEEK_FRAUD_QA6UJG  / delivery department with the email address given above and ensure to fill the /

body __SEEK_FRAUD_QC6HVM  / cannot release the funds from his account unless someone applies for/

body __SEEK_FRAUD_QE_VRV  / to locate any member of his family but /

body __SEEK_FRAUD_QGS7RU  / Pacific, which is the instruction given by our president, ALAHAJI USMAN AMIR YARADUA \(GCFR\) Federal Republic of Nigeria\./

body __SEEK_FRAUD_QHAHKB  / and to conceal this kind of money became a .roblem for me/

body __SEEK_FRAUD_QHM0YN  /ed by an advanced automated random computer/

body __SEEK_FRAUD_QJ58__  /Forward you next response to this email address: /

body __SEEK_FRAUD_QJAXD2  / a promotional program aimed at encouraging internet users; /

body __SEEK_FRAUD_QKMOJL  / have secured from the probate an order of mandamus to/

body __SEEK_FRAUD_QLBPGU  /I Hoped that you will not expose or betray this trust and confident that . am about to /

body __SEEK_FRAUD_QLJWTR  /e congratulate you over your success in the following official publication of results of the E-mail electronic online /

body __SEEK_FRAUD_QLUR_M  /I did not declare money to them please\. If they call you and ask you the contents please tell them the same/

body __SEEK_FRAUD_QMDFLB  /fter going through some old files in the records/

body __SEEK_FRAUD_QO85UJ  /ank and the interest is being rolled over with the principal sum at the end of each year\. /

body __SEEK_FRAUD_QOVRZI  / acknowledge receipt of this message in acceptance of our mutual business endeavo/

body __SEEK_FRAUD_QQD_PZ  /rant\/Donation for your own personal, educational, and business development\./

body __SEEK_FRAUD_QSWUVB  / computer draw system and extracted from over .0..00/

body __SEEK_FRAUD_QZ_MDM  / All the legal papers will be processed .n/

body __SEEK_FRAUD_R2403I  / health and because of the presence of my /

body __SEEK_FRAUD_RAQSMO  /about their winning and also sharing their pin numbers\./

body __SEEK_FRAUD_RBAJV0  /I will appreciate your early reply for commencement of business\. Contact me for acknowledgment /

body __SEEK_FRAUD_RBMZ20  / As this is a TWO-man business deal transaction\./

body __SEEK_FRAUD_RC7YZH  /e are going to send your contract part payment of /

body __SEEK_FRAUD_RC8A1P  /tand as a next of kin to the deceased in which all documentations/

body __SEEK_FRAUD_RF_UQZ  / to the ownership of the Hong Kong Government if nobody applies to claim the fund/

body __SEEK_FRAUD_RG9CYN  / have been shot, wounded and survived two .uicide/

body __SEEK_FRAUD_RGERLR  / I WILL VISIT YOUR COUNTRY FOR DISBURSEMENT .. /

body __SEEK_FRAUD_RGFON2  /Leave your msg, with your full name and number /

body __SEEK_FRAUD_RG_9_1  / this deposit and dispatched it to charity organization/

body __SEEK_FRAUD_RIMLAO  / of the victims are from the United States/

body __SEEK_FRAUD_RIVPNL  / I am seeking your kind .ssistance to move the sum of /

body __SEEK_FRAUD_RO2TAX  /n his bio-data form, he listed no next of kin\./

body __SEEK_FRAUD_RS93A_  / details and more information about myself and the funds\./

body __SEEK_FRAUD_RZIRDL  /You have to contact him directly on this /

body __SEEK_FRAUD_RZZRJV  / apprehensive because you do not know me/

body __SEEK_FRAUD_RZ_T71  /compensating you with thirty percent of the total funds on final/

body __SEEK_FRAUD_S1FKEV  /Note: kindly reply to this email address for security reasons: andrewmcelwee/

body __SEEK_FRAUD_S3AFMN  / therefore reckoned that you could receive these funds as you are/

body __SEEK_FRAUD_S4QI3T  / respect the integrity of the information you come by as a result of this /

body __SEEK_FRAUD_SBFKHU  /n this regards, do not hesitate to contact me for more details and direction,/

body __SEEK_FRAUD_SBLZOX  /o you via our accredited shipping company /

body __SEEK_FRAUD_SGFSMN  / msg, with your full name and contact number so we can call you back\./

body __SEEK_FRAUD_SGH_BE  / a different way from how I have lived it\./

body __SEEK_FRAUD_SH1EZL  / as one of the final recipients of a cash Grant\/Donation /

body __SEEK_FRAUD_SIYSH8  / to always pray for me because the lord is my /

body __SEEK_FRAUD_SJNU8J  /After these several unsuccessful attempts/

body __SEEK_FRAUD_SJUAFZ  / this transaction would be most profitable for both of us/

body __SEEK_FRAUD_SKFND8  / and Ticket Number: PP3502 \/8707-01 on /

body __SEEK_FRAUD_SPR5JQ  / as part of our international promotions program which is conducted annually/

body __SEEK_FRAUD_SUOVUP  / this business with utmost .onfidentiality/

body __SEEK_FRAUD_SVSS9Y  / Package that is registered with us for ship..n. .. /

body __SEEK_FRAUD_SVVXNA  / you will be given your donation pin number/

body __SEEK_FRAUD_SVZDZ7  / be executed under legitimate arrangement that will protect .o/

body __SEEK_FRAUD_SYHCNJ  / should you contact me via official channels;/

body __SEEK_FRAUD_SYXC7L  / proposition offends your moral values, do accept my apology\. /

body __SEEK_FRAUD_SZOTOL  / you are a highly respected personality, considering the fact .hat I .o/

body __SEEK_FRAUD_S_M1GN  /So I decided to travel down to Nigeria with all my .o/

body __SEEK_FRAUD_T2PQH_  /Please kindly accept my apology for sending /

body __SEEK_FRAUD_T6QSEI  /I need your full co-operation to make this /

body __SEEK_FRAUD_TCYHCF  /I therefore made further investigation and discovered that /

body __SEEK_FRAUD_TELOJY  /These requirements will enable us file letter of claim to the appropriate/

body __SEEK_FRAUD_TFGP0H  / you have not received your payment due to your lack of co-operation and not fulfilling the /

body __SEEK_FRAUD_TGFQKQ  /, an attorney at law\. I discovered your email ..d/

body __SEEK_FRAUD_TIC3QK  / We provide a concept that will allow anyone with sufficient work /

body __SEEK_FRAUD_TIWDAE  / fund\. Please assure me that you will act accordingly as /

body __SEEK_FRAUD_TJFLBX  / an unfinished transaction or international /

body __SEEK_FRAUD_TKRYFP  /For privacy and confidentiality reply using my fax: \+44-700-596-1494 or email:/

body __SEEK_FRAUD_TMN_LY  /operation to enable us see this transaction through\. This will be executed under /

body __SEEK_FRAUD_TSWC8H  / recorded\. My late client was an influential wealthy businessman, an oil m/

body __SEEK_FRAUD_TTO7PC  /amily member so as to enable you put up /

body __SEEK_FRAUD_TUOYBL  / the funds be released to me, but that w..l/

body __SEEK_FRAUD_TWEN6R  / benefit from the diplomatic immunity payment\. This panel was primarily delegated .. /

body __SEEK_FRAUD_TWWILQ  / that because of impostors, we hereby issued you our code of conduct,/

body __SEEK_FRAUD_TY7ECD  /his and other reasons .{0,40} prompted me to reach out for/

body __SEEK_FRAUD_U1BBLW  /Best Regards John Wood\. Reply to Email: infojwllp\@aol\.com /

body __SEEK_FRAUD_U6L6T8  / did not hear from you since that time\./

body __SEEK_FRAUD_UCAUVI  /ttorney to provide his next of kin who should inherit his f/

body __SEEK_FRAUD_UCYLRJ  / adopted a resolution and I was mandated to provide his next of kin for the payment of this money within .{0,40}orking days or forfeit the money .. /

body __SEEK_FRAUD_UFCQVP  / learnt that all his supposed next of kin/

body __SEEK_FRAUD_UG4GV7  / are sealed with .ynthetic nylon seal and padded with machine\./

body __SEEK_FRAUD_UGZFFW  / bank and no one will ever come forward to claim it\. What bothers me /

body __SEEK_FRAUD_UJSOEL  / online version were selected .andomly from /

body __SEEK_FRAUD_UJZKNM  /I will like you to provide immediately your full .ame/

body __SEEK_FRAUD_UK1HZY  /d to donate from what I have .nherited from my late .usband .o/

body __SEEK_FRAUD_ULTF0J  / profile is still reflecting in our central computer/

body __SEEK_FRAUD_UPIS0F  /office that no one except me knew of his /

body __SEEK_FRAUD_US_OFW  /hilanthropy earned him numerous awards during his life/

body __SEEK_FRAUD_UTTB3I  /l you to stop dealing with those people, they are /

body __SEEK_FRAUD_UVV3P5  / I have never been married and have no children. /

body __SEEK_FRAUD_UXEWFD  / one working day \(24 hours\) for your package to arrive .t/

body __SEEK_FRAUD_UYQ1XG  /the surname identity and therefore can present you /

body __SEEK_FRAUD_UZSYRC  / came to our bank to engage in business discussions with our .rivate .anking /

body __SEEK_FRAUD_V1ULWA  /married for eleven years without a child\./

body __SEEK_FRAUD_V4_LC8  /buse of this program by some unscrupulous elements\./

body __SEEK_FRAUD_VBA2NT  /ith the help of a British contact working /

body __SEEK_FRAUD_VBQ9JO  /this, these friends try to claim the lottery on behalf of the real/

body __SEEK_FRAUD_VD8CIS  /amily to close one of my accounts and distribute the money/

body __SEEK_FRAUD_VDWAJV  / be released to you by any of our payment offices in /

body __SEEK_FRAUD_VDYTU_  / and therefore, we can present you as the .e/

body __SEEK_FRAUD_VEFRJP  /ed with my late client or that you might provide clue to my search, I therefore, decided to contact with these facts before me/

body __SEEK_FRAUD_VEGVH5  /ash Grant\/Donation for your own personal, education/

body __SEEK_FRAUD_VEPGLD  / who will accompany the boxes to your house address\. All you need to do now is to send .o/

body __SEEK_FRAUD_VEQPGW  /he dynamics of my industry dictates that I make this move\. Such opportunities only come on/

body __SEEK_FRAUD_VHRO4H  / due to the high priority of your package we had to inform you /

body __SEEK_FRAUD_VHSUC0  /Though I am very rich, I was never generous,/

body __SEEK_FRAUD_VJC0WF  /I wish to notify you that you were listed as a beneficiary to an Inheritance totaling a sum /

body __SEEK_FRAUD_VJNKV_  /so that the proceeds of this account can be /

body __SEEK_FRAUD_VKUVK9  / stop any further communication with anybody or office/

body __SEEK_FRAUD_VMIDLD  /This money cannot be approved to a local bank account holder, but can only be approved to a foreigner\. If you will stand as next of kin to the fund, it will be shared /

body __SEEK_FRAUD_VNIWHY  / occupy certain offices and oversee certain portfolios. /

body __SEEK_FRAUD_VQF_LH  /laim as the next of kin to the deceased as indicated on our banking/

body __SEEK_FRAUD_VRGLL3  /ow I regret all th.{0,3} as I now know that there is more to life than just wanting to have or make all the .oney in the world\./

body __SEEK_FRAUD_VSMRB_  /http:\/\/news\.bbc\.co\.uk\/2\/hi\/middle_east\/2988455\.stm/

body __SEEK_FRAUD_VSTK_A  /ould live my life a different way from how I have .ived it\./

body __SEEK_FRAUD_VT5WCB  /\. Since his death I decided not to remarry/

body __SEEK_FRAUD_VTLF_0  / to contact me for your Confirmable Bank Draft of /

body __SEEK_FRAUD_VXEHN_  /As soon as i receive the requested information and confirm your readiness to handle this matter, i will process your immunity cash funds proof of ownership certificate and your cash funds delivery approvals form \"D\" and forward them to you for your own view and record, then i will advise you with the date and time the diplomats will arrive your country\./

body __SEEK_FRAUD_VXUYZK  / at the age of 80 years, and his WILL is now ready for execution\...c/

body __SEEK_FRAUD_W1PLKY  /The package is registered with us for mailing by /

body __SEEK_FRAUD_W1_1AT  /eason for sending this mail is very fundamental to the doctrine of human privileges and right\. My name is Barrister John Wood a legal practitioner based in /

body __SEEK_FRAUD_W5LM6_  /HAS BEEN WITH .{0,40} FOR A VERY LONG TIME/

body __SEEK_FRAUD_W7O0I7  / 4-5 weeks on base of your professional experience/

body __SEEK_FRAUD_WC53DT  /I do not want you contacting me through .{0,40} want you contacting me through my official .{0,20}Contact me only through /

body __SEEK_FRAUD_WGBS3F  / with the help of our Intelligence Monitoring Network/

body __SEEK_FRAUD_WH7YUM  /I do solicit for your assistance in effecting this transaction/

body __SEEK_FRAUD_WI_PXU  /have been waiting for you since to contact me for your ..n/

body __SEEK_FRAUD_WJGJCF  / 4-5 weeks with the help of your professional career /

body __SEEK_FRAUD_WJXZ7I  /Email slow, clunky, unreliable\? Switch to Yahoo\!Xtra Mail, New Zealand\'s new email address\./

body __SEEK_FRAUD_WKGUZG  /ttorney at law\. A deceased client of mine/

body __SEEK_FRAUD_WMBI4K  /used by unbelievers\. I don\'t want a situation where this money will be used in /

body __SEEK_FRAUD_WMTNKJ  / that any double claim discovered by the /

body __SEEK_FRAUD_WQ3MYL  / his WILL\. He left the sum of Thirty Million, One Hundred Thousand Dollars \(USD\$30,..0..00..0/

body __SEEK_FRAUD_WQPH_R  /it is not a Drug Money or meant to sponsor Terroris. a.t/

body __SEEK_FRAUD_WVDTCK  /mail address was entered during the .{0,40} selection Draw and ha/

body __SEEK_FRAUD_WZIO9H  /I have evaluated the risks and the only risk I have here is /

body __SEEK_FRAUD_W_G8_H  /, we sent a reminder and finally we discovered from his contract /

body __SEEK_FRAUD_X1E2EB  / to come over and claim his money because we can/

body __SEEK_FRAUD_X1MGO6  /e hundred Thousand United States .ollars\) /

body __SEEK_FRAUD_X2_BM9  / am inviting you for a business deal where this ..n/

body __SEEK_FRAUD_X7EJQN  / as the next-of-kin and beneficiary of my /

body __SEEK_FRAUD_XABL7X  /I am not afraid of death hence I know .h/

body __SEEK_FRAUD_XADCD3  / are only taking advantage of you and they will dry you up until you have /

body __SEEK_FRAUD_XBF8EX  / and promote computer literacy worldwide/

body __SEEK_FRAUD_XD3U8U  / disbursement according to .he percentage/

body __SEEK_FRAUD_XD5HNK  / so that the attorney can commence his job/

body __SEEK_FRAUD_XDHW_C  / so that you can be paid the funds left in his bank account/

body __SEEK_FRAUD_XDJEQN  / another notification was sent.{0,20} no response came from/

body __SEEK_FRAUD_XKNJTL  /the payment under CASE FILE 54AC003 and that is why I decided to email you to stop dealing with those people\./

body __SEEK_FRAUD_XNIO3Q  / required arrangements have been made for the /

body __SEEK_FRAUD_XOG2QH  / you should not entertain any atom of fear a. /

body __SEEK_FRAUD_XTT7BO  / Christians\. Since his death I decided not to re-marry/

body __SEEK_FRAUD_XUO6FU  /Our European agent will immediately commence /

body __SEEK_FRAUD_XVL5QC  / this, I don\'t want you to feel sorry for me, because, I .elieve everyone will /

body __SEEK_FRAUD_XVM0G_  /ill make any one apprehensive and worried, but I/

body __SEEK_FRAUD_XWTJ0S  /, while I await your prompt response\. Please contact me at once /

body __SEEK_FRAUD_XY_KVM  / will be safe in your care until I complete my service here/

body __SEEK_FRAUD_Y1JN21  /ou are hereby warned not to communicate or duplicate this message to /

body __SEEK_FRAUD_Y2SCUB  / with any other person\(s\) or office\(s\)/

body __SEEK_FRAUD_Y6P5MJ  / contacting us through emails are fake\./

body __SEEK_FRAUD_Y7F2UL  /A deceased client of mine, that shares the same last name as your/

body __SEEK_FRAUD_YA_RGO  /Please get in touch with me by email with the information below to enable us discuss further\./

body __SEEK_FRAUD_YDE9VC  / be discovered hence we want to move this money to you for safe..e/

body __SEEK_FRAUD_YFJVJR  / Economic and Financial Crimes Commission /

body __SEEK_FRAUD_YFLVQ4  /We discovered an abandoned sum of \(Seven million five hundred/

body __SEEK_FRAUD_YGHQXE  /ed to him by one of his numerous friends abroad who wished you good/

body __SEEK_FRAUD_YGYYT6  / understand that blessed is the hand that give/

body __SEEK_FRAUD_YK2OQP  /cessary payment procedure so that you can effect the payment for the /

body __SEEK_FRAUD_YKISUY  / foreign partner that made me to contact you/

body __SEEK_FRAUD_YLQNKK  / let us know by contacting the card payment .enter/

body __SEEK_FRAUD_YM7Q1U  /Our staff will get back to you in next few days\!/

body __SEEK_FRAUD_YOHVL0  / package, we may refer the package to the .{0,20} Commission for Welfare .. /

body __SEEK_FRAUD_YOWELS  / treat this business with ..most .onfidentiality/

body __SEEK_FRAUD_YRCV_U  /Please always be prayerful all through your /

body __SEEK_FRAUD_YT4HMB  /life\. Any delay in your reply will give me room in sourcing /

body __SEEK_FRAUD_Z1DQSM  /your acceptance\. In your acceptance of this deal, /

body __SEEK_FRAUD_ZBR4PG  /I have packaged a financial transaction that will benefit .o/

body __SEEK_FRAUD_ZEZMCP  / as they seem not to be contended with what I have left for them/

body __SEEK_FRAUD_ZF7LPG  /e form as well to enable a successful reconfirmation/

body __SEEK_FRAUD_ZHCQFW  / after a brief illness that lasted for only /

body __SEEK_FRAUD_ZHS0WA  / in the Tube explosion between King\'s Cross-and Russell Square in London\./

body __SEEK_FRAUD_ZKHUET  /This is to officially inform you that we have verified your contract /

body __SEEK_FRAUD_ZLALWU  / per transaction\. So, if you like to receive your fund this way,/

body __SEEK_FRAUD_ZLXKPY  /ervice is already on trace of the other criminals\./

body __SEEK_FRAUD_ZM7VH9  / personally sealed your Bank Draft .{0,20}email contact in the /

body __SEEK_FRAUD_ZMFYMV  /Furthermore, should there be any change .. /

body __SEEK_FRAUD_ZN9EIN  /andomly from World Wide Web sites through .omputer /

body __SEEK_FRAUD_ZPBBGF  / declared to them as the contents is Sensitive Photographic Film Materials for .ecurity .easons\./

body __SEEK_FRAUD_ZR4ER1  /r to observe utmost discretion in all matters concerning this ..s/

body __SEEK_FRAUD_ZR_YCL  / proceeding for confiscation of .{0,40} in line with existing laws .. the /

body __SEEK_FRAUD_ZXHWD2  /ontact your Lottery Claims Officer with the following contact /

body __SEEK_FRAUD_ZZ3WKA  / believe he has because He is a merciful God\./

body __SEEK_FRAUD__2H_ZF  /I have not particularly lived my life so well,/

body __SEEK_FRAUD__4GEGC  /Please contact me at once to indicate your /

body __SEEK_FRAUD__6TXBR  /It will interest you to know that we have discovered an outstanding unpaid\/unclaimed sum of money in favo/

body __SEEK_FRAUD__70JEL  / even though you are qualified\? If you are looking for a /

body __SEEK_FRAUD__BXKBH  /church or better still a .hristian individual that will utilize this money the way I am going to instruct h/

body __SEEK_FRAUD__DBLB0  /addresses were assigned to different ticket numbers for representation/

body __SEEK_FRAUD__EFA_O  /yet to receive their payments and . saw you/

body __SEEK_FRAUD__ERENB  /Confirm the receipt of this message and send the requirements to me immediately /

body __SEEK_FRAUD__EU_I1  / the plane crash leaving nobody behind for /

body __SEEK_FRAUD__EVXD7  / will put you in place as the next of .in/

body __SEEK_FRAUD__HJ2Y5  /\% to you, while 5\% should be for .xpenses or /

body __SEEK_FRAUD__HWY23  / If you are interested I will send you the full details, my job is to find a good partner that we can trust and that will assist us\./

body __SEEK_FRAUD__IA9KC  /his may sound strange and unbelievable to you, but /

body __SEEK_FRAUD__IYMST  / problem, and as you may know, we have arranged .o/

body __SEEK_FRAUD__K6QXJ  /To make arrangement for me to come over to your country .. /

body __SEEK_FRAUD__KZVBM  /further advised to maintain the strictest level of confidentiality until the end of proceedings to circumvent problems associated with fraudulent claims\./

body __SEEK_FRAUD__MMCUC  /nybody under the age of 18 is automatically disqualified\./

body __SEEK_FRAUD__NM8A8  /keeping pending the completion of our assignment here\./

body __SEEK_FRAUD__OXXSN  / to stop dealing with some non-officials in the bank as this is an illegal act and will have to stop if you so wish to receive your payment immediately\./

body __SEEK_FRAUD__Q0H7E  / have summed up courage to contact you\./

body __SEEK_FRAUD__QPNON  / presence of my husband\'s relatives around me/

body __SEEK_FRAUD__STWOQ  / years ago and they refused to pay me, I had paid over /

body __SEEK_FRAUD__TYKI7  /here are practically no risk involved in this/

body __SEEK_FRAUD__V554S  /s\/next of kin to the deceased\. And It may interest you to/

body __SEEK_FRAUD__VLBMG  /nited States dollars\) to be released in your favour as the/

body __SEEK_FRAUD__XXFBM  / that you will not expose or betray this trust and confident that .{0,40} you for the mutual benefit of /

header	 __SENDER_BOT	ALL =~ /(?:not?\W?repl[yi]|bounce|daemon|subscri|report|\b(?:root|news|nobody|agent|(?:post)?master|manag|send(?:er|ing)?|out|bot\b))[^@ >]{0,5}s?@\w/i

meta     __SEX_WRDS             (__WORD_SEX || __WORD_CUM || __WORD_SPERM || __WORD_SLUTS || __WORD_RAPED)

body     __SHARE_IT       /\b(?:(?:share|receive)\sth(?:e|is)\s(?:proceeds|funds?|money|balance|account)|partager (?:avec vous|ratio))\b/i

body __SHMUCK		/\b(?:accomplished|distinguished|exceptional|talented|calibre of) +(?:professionals?|individuals?)\b/i

rawbody        __SPAN_BEG_TEXT     /[a-z]{2}<(?i:span)\s/
tflags         __SPAN_BEG_TEXT     multiple

rawbody        __SPAN_END_TEXT     /[^;>]<\/(?i:span)>[a-z]{3}/
tflags         __SPAN_END_TEXT     multiple

header   __SUBJ_3DIGIT          Subject =~ /\b\d{3}[^0-9]/

header   __SUBJ_APPROVE         Subject =~ /Approve/i

header   __SUBJ_RE		Subject =~ /^R[eE]:/

header   __SUBJ_VEGAS           Subject =~ /(?:Vegas|Casino)/i

body     __SUM_OF_FUND      /\bsum\sof\s(?:amount|fund)/i

body     __SURVIVORS      /\b(?:widow|son|daughter|husband|wife|brother|sister|attorney)\s(?:of|to)\s(?:the\s)?late\s\w+\b/i

header         __TB_MIME_BDRY_NO_Z   Content-Type =~ /boundary="-{8,}(?:[1-9]){16}/

body     __THEY_INHERIT   /\binherit\sth(?:e|is)\smoney\b/i

header     __TO_NO_ARROWS_R        To !~ /(?:>$|>,)/

header     __TO_UNDISCLOSED        To =~ /(?:undisclosed-recipients|destinataires inconnus):/i

body     __TRUNK_BOX      /\b(?:(?:trunk|metallic|proof|security|consignment)\sbox(?:es)?|sealed\ssafe)\b/i

body     __TRUSTED_CHECK  /\b(?:cashier'?s?|certified)\sche(?:ck|que)/i

header __TT_BROKEN_VALIUM       Subject =~ /V[:^."%()*\[\\]?A[:^."%()*\[\\]?L[:^."%()*\[\\]?I[:^."%()*\[\\]?U[:^."%()*\[\\]?M/i

header __TT_BROKEN_VIAGRA       Subject =~ /V[:^."%()*\[\\]?I[:^."%()*\[\\]?A[:^."%()*\[\\]?G[:^."%()*\[\\]?R[:^."%()*\[\\]?A/i

header __TT_OBSCURED_VALIUM     Subject =~ /(v|V|\\\/)(a|A|\(a\)|4|@)(l|L|\|)(i|I|1|\xef|\|)(u|U|\(u\))(m|M)/

header __TT_OBSCURED_VIAGRA     Subject =~ /(v|V|\\\/)(i|I|1|\xef|\|)(a|A|\(a\)|4|@)(g|G)(r|R)(a|A|\(a\)|4|@)/

header __TT_VALIUM              Subject =~ /VALIUM/i

header __TT_VIAGRA              Subject =~ /VIAGRA/i

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __TVD_FW_GRAPHIC_ID1	Content-Id =~ /<[0-9a-f]{12}(?:\$[0-9a-f]{8}){2}\@/
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEEval
mimeheader __TVD_MIME_ATT_AOPDF	Content-Type =~ /^application\/octet-stream.*\.pdf/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEEval
mimeheader __TVD_MIME_ATT_AP	Content-Type =~ /^application\/pdf/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEEval
mimeheader __TVD_MIME_ATT_TP	Content-Type =~ /^text\/plain/i
endif

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __TVD_OUTLOOK_IMG	Content-Id =~ /<image\d+\.(?:gif|jpe?g|png)\@/
endif

header	 __TWO_IPS_RCVD	Received =~ /[\[\(\s]((?!(?:10|127|169\.254|172\.(?:1[6-9]|2[0-9]|3[01])|192\.168)\.)(?:[12]?\d\d?\.){3}[12]?\d\d?)[\[\(\s][^\[\n;,]{0,99}\[(?!\1)\d/

header   __UA_GNUS		User-Agent =~ /^Gnus/

header   __UA_KNODE		User-Agent =~ /^KNode/

header   __UA_MUTT		User-Agent =~ /^Mutt/

header   __UA_PAN		User-Agent =~ /^Pan/

header   __UA_XNEWS		User-Agent =~ /^Xnews/

body     __UN             /\bunited\snations?\b/i

body     __UNCLAIMED      /\bunclaimed\s(?:assets?|accounts?|mon(?:ey|ies)|balance|funds?|prizes?|rewards?|payments?)\b/i

body __USCAVANITY	/\bUS Commerce Association/

body     __VA_WORD              /\bV[A-Za-z]{2,4}RA\b/

body     __VM_WORD              /\bV[A-Za-z]{2,5}UM\b/

body __WHOSWHO		/\bWho.s Who\b/

body     __WIDOW          /\bwidow(?:e[rd])'?s?\b/i

body     __WILL_LEGAL     /\b(?:codicil|last\stestament|probate|executor|intestate)\b/i

body     __WIRE_XFR       /\b(?:wire|telegraph(?:ic)?|bank)\s?transfer/i

body     __WORD_CUM             /\bcum\b/i

body     __WORD_RAPED           /\braped?\b/i

body     __WORD_SEX             /\bsex(?:iest|y)?\b/i

body     __WORD_SLUTS           /\bsluts?\b/i

body     __WORD_SPERM           /\bsperm\b/i

meta     __XFER_MONEY     (__WIRE_XFR || __TRUSTED_CHECK || __BANK_DRAFT)

header   __XM_GNUS		X-Mailer =~ /^Gnus v/

header   __XM_MOZ4		X-Mailer =~ /^Mozilla 4/

header   __XM_MSOE5		X-Mailer =~ /^Microsoft Outlook Express 5/

header   __XM_MSOE6		X-Mailer =~ /^Microsoft Outlook Express 6/

header __XM_MS_IN_GENERAL     X-Mailer =~ /\bMSCRM\b|Microsoft (?:CDO|Outlook|Office Outlook)\b/

header __XM_OL_015D5  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OL_07794  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_09BB4  X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.72\.3155\.0/

header __XM_OL_10_0_4115    X-Mailer =~ /^Microsoft Outlook, Build 10.0.4115$/

header __XM_OL_1ECD5  X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1081/

header __XM_OL_20C99  X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.72\.3338\.1/

header __XM_OL_22B61  X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1158/

header __XM_OL_25340  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_28001441    X-Mailer =~ /^Microsoft Outlook Express 6.00.2800.1441$/

header __XM_OL_28004682    X-Mailer =~ /^Microsoft Outlook Express 6.00.2800.4682$/

header __XM_OL_32D97  X-Mailer =~ /Microsoft\ Outlook\ IMO\,\ Build\ 9\.0\.2416\ \(9\.0\.2910\.0\)/

header __XM_OL_3857F  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_3AC1D  X-Mailer =~ /Microsoft\ Outlook\ Express\ 5\.00\.2919\.6700/

header __XM_OL_3D61D  X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.71\.2244\.8/

header __XM_OL_465CD  X-Mailer =~ /Microsoft\ Outlook\,\ Build\ 10\.0\.3416/

header __XM_OL_48072300    X-Mailer =~ /^Microsoft Outlook Express 5.50.4807.2300$/

header __XM_OL_4B815  X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.71\.2730\.2/

header __XM_OL_4BF4C  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OL_4EEDB  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OL_4F240  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_4_72_2106_4  X-Mailer =~ /^Microsoft Outlook Express 4.72.2106.4$/

header __XM_OL_58CB5  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_5B79A  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OL_6554A  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_72641  X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1441/

header __XM_OL_7533E  X-Mailer =~ /Microsoft\ Outlook\ Express\ 5\.50\.4963\.1700/

header __XM_OL_812FF  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_83BF7  X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.72\.3110\.3/

header __XM_OL_8627E  X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1437/

header __XM_OL_8E893  X-Mailer =~ /Microsoft\ Outlook\,\ Build\ 10\.0\.2616/

header __XM_OL_91287  X-Mailer =~ /Microsoft\ Outlook\ Express\ 5\.50\.4807\.2300/

header __XM_OL_9B90B  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OL_A50F8  X-Mailer =~ /Microsoft\ Outlook\ Express\ 5\.50\.4922\.1500/

header __XM_OL_A842E  X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1158/

header __XM_OL_ADFF7  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OL_B30D1  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OL_B4B40  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OL_B9B11  X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2462\.0000/

header __XM_OL_BC7E6  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OL_C65FA  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_CAC8F  X-Mailer =~ /Microsoft\ Outlook\ Express\ 4\.71\.1712\.3/

header __XM_OL_CF0C0  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_EF20B  X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2800\.1478/

header __XM_OL_EF222  X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2900\.2873/

header __XM_OL_F3B05  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OL_F475E  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_F6D01  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.6353/

header __XM_OL_FF5C8  X-Mailer =~ /Microsoft\ Office\ Outlook\,\ Build\ 11\.0\.5510/

header __XM_OUTLOOK_EXPRESS    X-Mailer =~ /^Microsoft Outlook Express \d/

header  __XM_PHP  X-Mailer =~ /^PHP\s?v?\/?\d\./

header   __XM_SKYRI		X-Mailer =~ /^SKYRiXgreen/

header   __XM_WWWMAIL		X-Mailer =~ /^WWW-Mail \d/

body     __YOUR_ACCOUNT         /your account/i

body     __YOUR_CREDITFVGT      /your credit/i

body     __YOUR_FUND      /\b(?:your|ihr)\s(?:unpaid\s|nicht\sausbezahlten\s)?(?:fund|geld)\b/i

body     __YOUR_PERM      /\byour\spermission\b/i

body     __YOUR_PROFIT    /\byour?\sprofit/i

body     __YOU_ASSIST     /\byour\sassistance\b/i

body     __YOU_HAVE_WON         /you(?: \w+)? won/i

body     __YOU_INHERIT    /\byour\s[a-z\s]{0,30}inherit+ance\b/i

meta     __YOU_WON       __YOU_WON_01 || __YOU_WON_02 || __YOU_WON_03

body     __YOU_WON_01    /\byou(?:r|'re|'ve|'ll|\shave|\sdid)?\s(?:e-?mail\s)?(?:\w+\s){0,2}(?:a\s)?w[io]n+(?:er|ing)?(?!'t)\b/i

body     __YOU_WON_02    /\bw[io]n\s(?:(?:for|by)\s)?your?\b/i

body     __YOU_WON_03    /\b(?:your?|win+ing|win+ers?|beneficiaries|participants?|individuals?)(?:\s[-a-z\s]{4,30}?)?\s(?:w(?:ere|as)|ha(?:ve|s) be(?:en)?)\s(?:randomly\s(?:selected|cho+sen|cho+sing|picked)|(?:selected|cho+sen|cho+sing|picked)\s(?:[a-z\s]{2,40}?\srandom|randomly|online|lottery|computer\s(?:ballot|wahlgang)))/i 

meta     __YOU_WON_SOMTIN       (__YOU_HAVE_WON || __FB_CONGRADS)
