# SARE "General Subject" Ruleset for SpamAssassin - File 0 # Version: 01.03.13 # Created: 2004-09-13 # Modified: 2006-11-14 # Usage instructions and documentation are found in 70_sare_genlsubj0.cf #@@# Revision History: Full Revision History stored in 70_sare_genlsubj.log #@@# 01.03.12: Dec 27 2005 #@@# Minor score updates based on additional mass-check #@@# Archived from file 0: SARE_SUB_MED_USE #@@# Archived from file 0: SARE_SUB_VIRUSQ #@@# Modified "rule has been moved" meta flags #@@# Moved file 0 to file 1: SARE_SUB_GRANT #@@# Moved file 0 to file 1: SARE_SUB_MSG_SUBJ #@@# Moved file 0 to file 1: SARE_SUB_PORN_WORD08 #@@# Moved file 0 to file 1: SARE_SUB_RE_V #@@# Moved file 0 to file 2: SARE_SUB_LEGAL_ORDIN #@@# Moved file 0 to file 2: SARE_SUB_ORIG_SOFT #@@# Moved file 0 to file 3: SARE_SUB_LINES_CREDIT, after splitting from SARE_SUB_NEW_CREDIT #@@# 01.03.13: Nov 14 2006 #@@# Fixed name typo of meta rule; old: __SARE_SUB_FRMO_PAYPAL new: __SARE_SUB_FROM_PAYPAL # License: Artistic - see http://www.rulesemporium.com/license.txt # Current Maintainer: Bob Menschel - genlsubj@rulesemporium.com # Current Home: http://www.rulesemporium.com/rules/70_sare_genlsubj0.cf # # Usage: This family of files, 70_sare_genlsubj*.cf, contain rules that test the Subject header of rules. # # File 0: 70_sare_genlsubj0.cf -- These are subject rules that hit at least 10 spam and no ham. # While SARE cannot guarantee they never will hit ham, they have not hit ham in any SARE mass-check, against tens of thousands of ham. # This is a rules file we expect any/all email systems using SpamAssassin to benefit from. # # File 1: 70_sare_genlsubj1.cf -- These are subject rules that meet one of the follow criteria: # a) Rules that do, or in the past have hit ham during SARE mass-check tests # b) Rules that hit no ham and currently do not hit more than 10 spam in any single mass-check run. # If the rules hit ham, they hit at last 10 spam to each 1 ham. # With few exceptions these rules score significantly less than the rules in file 0. # Systems which are very sensitive to false positives and/or need to be very careful about resource use may want to exclude this ruleset, # pick and choose among its rules, or lower their scores. # Systems that use this file 1 should ALSO use file 0. # # File 2: 70_sare_genlsubj2.cf -- These subject rules hit no spam at this time, but they are considered "safe" rules that should never hit ham. # These are primarily obfuscation rules, which should never hit non-obfuscated words. # Systems which are very sensitive to SpamAssassin overhead may want to exclude this ruleset file to avoid its regex overhead, # but systems with plenty of resources that want to be aggressive against spam may benefit from this ruleset file. # # File 3: 70_sare_genlsubj3.cf -- These are subject rules that hit a significant amount of ham during SARE mass-check tests. # Systems which are very sensitive to false positives or to SA resource usage should NOT install this ruleset. # # File 4: 70_sare_genlsubj4.cf -- These are subject rules that hit over 100 ham during SARE mass-check tests, but still hit enough spam # to be worth while to aggressively anti-spam systems. # Again, systems which are very sensitive to false positives or to SA resource usage should NOT install this ruleset. # # eng: 70_sare_genlsubj_eng.cf -- These are subject rules which work well within the English language, but are liable to cause false # positives in other languages. They include rules which test for letter combinations and encoded subject headers. Systems that # receive ham in languages other than English should NOT use this file. # # x30: 70_sare_genlsubj_x30.cf -- These are subject rules which have been incorporated into SpamAssassin 3.0.x, # or which duplicate or greatly overlap 3.0.x rules. # Systems which have installed SpamAssassin 3.0.x should therefore NOT use this file. # # arc: 70_sare_genlsubj_arc.cf -- These are subject rules that once were published in other files, but which have since lost all value. # They either hit too much ham (without hitting enough spam to make it worth while), or they don't hit any spam. # SARE regularly runs mass-checks on these rules to see if any of them are worth reviving, but # we expect that nobody will be running these rules in any production system. # # Rules to be wary of: # # Financial and investment companies will want to lower some scores in the Business section. # Credit, mortgage, and similar companies will want to lower some scores in the Credit section. # Schools will want to lower some scores in the Education section. # Insurance companies will want to lower some scores in the Insurance section. # Marketing companies and services will want to lower some scores in the Marketing section. # Medical professionals and companies will want to lower some scores in the Medical section. # Real estate companies may want to lower some scores in the Real Estate section. # Software companies may want to lower scores in the Software section ######## ###################### ################################################## # Rule definitions to avoid --lint errors on archived/moved rules. ######## ###################### ################################################## meta __SARE_SUB_FALSE __FROM_AOL_COM && !__FROM_AOL_COM meta SARE_SUB_MSGSUB __SARE_SUB_FALSE meta SARE_SUB_INC_ONLINE __SARE_SUB_FALSE meta SARE_SUB_6_FIG_INC __SARE_SUB_FALSE meta SARE_SUB_GAPPY_5 __SARE_SUB_FALSE meta SARE_SUB_GAPPY_6 __SARE_SUB_FALSE meta SARE_SUB_DBL_MEDICTN __SARE_SUB_FALSE meta SARE_SUB_LOSE_OB __SARE_SUB_FALSE meta SARE_SUB_HARD_OB __SARE_SUB_FALSE meta SARE_SUB_BOOST __SARE_SUB_FALSE meta SARE_SUB_DOWNLOAD_OB __SARE_SUB_FALSE meta SARE_SUB_MEDICAL_NEWS __SARE_SUB_FALSE meta SARE_SUB_CASINO_OB __SARE_SUB_FALSE meta SARE_SUB_PORN_WORD05 __SARE_SUB_FALSE meta SARE_SUB_PORN_WORD11 __SARE_SUB_FALSE meta SARE_SUB_FIRE_BOSS __SARE_SUB_FALSE meta SARE_SUB_GET_PAID __SARE_SUB_FALSE meta SARE_SUB_SMART_PRICE __SARE_SUB_FALSE meta SARE_SUB_DOLLARS __SARE_SUB_FALSE meta SARE_SUB_DASH_ONLY __SARE_SUB_FALSE meta SARE_SUB_YOUR_LISTING __SARE_SUB_FALSE meta SARE_SUB_PENIS_OB __SARE_SUB_FALSE meta SARE_SUB_PERS_KNOW __SARE_SUB_FALSE meta SARE_SUB_INEXPEN __SARE_SUB_FALSE meta SARE_SUB_BUY_OB __SARE_SUB_FALSE meta SARE_SUB_SEX_EXP_GAP __SARE_SUB_FALSE meta SARE_SUB_ASSIST __SARE_SUB_FALSE meta SARE_SUB_PROTECT_FAM __SARE_SUB_FALSE meta SARE_SUB_IMPROVE __SARE_SUB_FALSE meta SARE_SUB_SYSTEMWORKS __SARE_SUB_FALSE meta SARE_SUB_WP_OFFICE __SARE_SUB_FALSE meta SARE_SUB_ATTRACT __SARE_SUB_FALSE meta SARE_SUB_BETTER_OB2 __SARE_SUB_FALSE meta SARE_SUB_MORTGAGE_OB __SARE_SUB_FALSE meta SARE_SUB_DBL_PHARM __SARE_SUB_FALSE meta SARE_SUB_ORIG_SOFT_OB __SARE_SUB_FALSE meta SARE_SUB_BUY_OB1 __SARE_SUB_FALSE meta SARE_SUB_CHEAP_OB __SARE_SUB_FALSE meta SARE_SUB_ONLINE_OB __SARE_SUB_FALSE meta SARE_SUB_LOSE_PCT1 __SARE_SUB_FALSE meta SARE_SUB_LOSE_PCT2 __SARE_SUB_FALSE meta SARE_SUB_WHILE_U_CAN __SARE_SUB_FALSE meta SARE_SUB_COMMA_FIRST __SARE_SUB_FALSE meta SARE_SUB_FORECLOSURE __SARE_SUB_FALSE meta SARE_SUB_INET_PHARM __SARE_SUB_FALSE meta SARE_SUB_AM_MED_DICT __SARE_SUB_FALSE meta SARE_SUB_BUY_CHEAP __SARE_SUB_FALSE meta SARE_SUB_LINES_CREDIT __SARE_SUB_FALSE meta SARE_SUB_GRANT __SARE_SUB_FALSE meta SARE_SUB_PORN_WORD08 __SARE_SUB_FALSE meta SARE_SUB_MED_USE __SARE_SUB_FALSE meta SARE_SUB_VIRUSQ __SARE_SUB_FALSE meta SARE_SUB_GRANT __SARE_SUB_FALSE meta SARE_SUB_MSG_SUBJ __SARE_SUB_FALSE meta SARE_SUB_PORN_WORD08 __SARE_SUB_FALSE meta SARE_SUB_RE_V __SARE_SUB_FALSE meta SARE_SUB_LEGAL_ORDIN __SARE_SUB_FALSE meta SARE_SUB_ORIG_SOFT __SARE_SUB_FALSE ######## ###################### ################################################## # Category: __rules used by primary rules below ######## ###################### ################################################## # Attempt to identify simple subject obfuscation by character insertion header __SARE_SUB_OBFU_ASTER Subject =~ /[a-zA-Z0]\*[a-zA-Z]/ header __SARE_SUB_OBFU_CARAT Subject =~ /[a-zA-Z0]\^[a-zA-Z]/ header __SARE_SUB_OBFU_COLON Subject =~ /[a-zA-Z0]:[a-zA-Z]/ header __SARE_SUB_OBFU_COMMA Subject =~ /[a-zA-Z0],[a-zA-Z]/ header __SARE_SUB_OBFU_SLASH Subject =~ /[a-zA-Z0]\/[a-zA-Z]/ header __SARE_SUB_OBFU_LQUOT Subject =~ /[a-zA-Z0]`[a-zA-Z]/ header __SARE_SUB_OBFU_PERIOD Subject =~ /[a-zA-Z0]\.[a-zA-Z]/ header __SARE_SUB_OBFU_2PER Subject =~ /[a-zA-Z0]\.\.[a-zA-Z]/ header __SARE_SUB_OBFU_PIPE Subject =~ /[a-zA-Z0]\|[a-zA-Z]/ header __SARE_SUB_OBFU_PLUS Subject =~ /[a-zA-Z0]\+[a-zA-Z]/ header __SARE_SUB_OBFU_QUOTE Subject =~ /[a-zA-Z0]"[a-zA-Z]/ header __SARE_SUB_OBFU_SCOLON Subject =~ /[a-zA-Z0];[a-zA-Z]/ header __SARE_SUB_OBFU_USCORE Subject =~ /[a-zA-Z0]_[a-zA-Z]/ header __SARE_SUB_OBFU_HTTP Subject =~ m*http://*i header SUBJECT_DIET Subject =~ /\bLose .*(?:pounds|lbs|weight)/i #distrib SUBJECT_DIET Copied from 3.0.2 to enable following meta tests in mass-checks ######## ###################### ################################################## # Category: Adult/Porn ######## ###################### ################################################## ######## ###################### ################################################## # Category: Black market items, services, activities, scams, frauds ######## ###################### ################################################## header SARE_SUB_FREE_PPV Subject =~ /(?:(?:f.?r.?e.?e+|pay(?:ing)?.for(?:.your)?|unlimited).?(?:PPV|p[a\@]y.?per.?view)|(?:PPV|p[a\@]y.?per.?view).{0,30}free|ppv\'s)/i describe SARE_SUB_FREE_PPV Spammer subject - black market or scam score SARE_SUB_FREE_PPV 1.572 #counts SARE_SUB_FREE_PPV 0s/0h of 233831 corpus (95086s/138745h RM) 12/15/05 #max SARE_SUB_FREE_PPV 155s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_FREE_PPV 1s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_FREE_PPV 4s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_FREE_PPV 7s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_FREE_PPV 1s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_FREE_PPV 2s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_FREE_PPV 14s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_FREE_PPV 0s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_FREE_PPV 4s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #counts SARE_SUB_FREE_PPV 0s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #max SARE_SUB_FREE_PPV 1s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 header __SARE_SUB_INC_ONLINE Subject =~ /income online/i header __SARE_SUB_6_FIG_INC Subject =~ /(?:\d|six|seven) Figure Income/i meta SARE_SUB_INC_ONLINE2 __SARE_SUB_INC_ONLINE && __SARE_SUB_6_FIG_INC describe SARE_SUB_INC_ONLINE2 Subject contains apparent spammer phrasing score SARE_SUB_INC_ONLINE2 1.666 #stype SARE_SUB_INC_ONLINE2 spamg #counts SARE_SUB_INC_ONLINE2 0s/0h of 233831 corpus (95086s/138745h RM) 12/15/05 #max SARE_SUB_INC_ONLINE2 63s/0h of 400345 corpus (178117s/222228h RM) 03/31/05 #counts SARE_SUB_INC_ONLINE2 1s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_INC_ONLINE2 0s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_INC_ONLINE2 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_INC_ONLINE2 0s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #max SARE_SUB_INC_ONLINE2 1s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_SUB_INC_ONLINE2 0s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_INC_ONLINE2 24s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 header SARE_SUB_NAME_STAR Subject =~ /Name\W*A\W*Star/i describe SARE_SUB_NAME_STAR Spammer subject - black market or scam score SARE_SUB_NAME_STAR 1.666 #stype SARE_SUB_NAME_STAR spamp #counts SARE_SUB_NAME_STAR 78s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #counts SARE_SUB_NAME_STAR 5s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_NAME_STAR 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_NAME_STAR 3s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_NAME_STAR 1s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_NAME_STAR 1s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_NAME_STAR 23s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_NAME_STAR 0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_SUB_NAME_STAR 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_REPRESENT_REQ Subject =~ /Representative (?:Required|Needed)/i describe SARE_SUB_REPRESENT_REQ Possible phishing subject score SARE_SUB_REPRESENT_REQ 1.666 #counts SARE_SUB_REPRESENT_REQ 119s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_REPRESENT_REQ 158s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_REPRESENT_REQ 16s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_REPRESENT_REQ 27s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #counts SARE_SUB_REPRESENT_REQ 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_REPRESENT_REQ 0s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #max SARE_SUB_REPRESENT_REQ 2s/0h of 5648 corpus (1019s/4629h ft) 06/04/05 #counts SARE_SUB_REPRESENT_REQ 0s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 header SARE_SUB_SINCERE Subject =~ /(?:sincere (?:associate|demand|request)|be sincere\?|please be sincere)/i describe SARE_SUB_SINCERE Spam topic found in subject score SARE_SUB_SINCERE 1.111 #stype SARE_SUB_SINCERE spamp #hist SARE_SUB_SINCERE Bob Menschel, May 14 2005 #counts SARE_SUB_SINCERE 1s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_SINCERE 30s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #counts SARE_SUB_SINCERE 1s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #counts SARE_SUB_SINCERE 1s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #counts SARE_SUB_SINCERE 0s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #counts SARE_SUB_SINCERE 0s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #max SARE_SUB_SINCERE 1s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 ######## ###################### ################################################## # Category: Credit, debt, lending, mortgage, borrowing, investment, financing ######## ###################### ################################################## header SARE_SUB_NEW_CREDIT Subject =~ /(?:(?:all|any)\W*(?:credit.(?:accepted|.{0,30}loan)|loan.{1,30}credit)|\b(?:easy|EZ)\W*(credit|home\W*loan|mortgage)|(?:best|get.{0,30}|right)\W*creditvcard|get\W*cash\W*out|(?:home|m.?[o0].?r.?t.?g.?[a\@].?g.?e)\W*loan.{1,30}credit|(?:new|your.{0,30})\W*credit\W*line)/i describe SARE_SUB_NEW_CREDIT Spammer subject - credit or money score SARE_SUB_NEW_CREDIT 1.666 #hist SARE_SUB_NEW_CREDIT Split SARE_SUB_LINES_CREDIT Sep 17 2005 #counts SARE_SUB_NEW_CREDIT 255s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #counts SARE_SUB_NEW_CREDIT 10s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_NEW_CREDIT 13s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_NEW_CREDIT 53s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_NEW_CREDIT 7s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_NEW_CREDIT 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_NEW_CREDIT 11s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_NEW_CREDIT 1s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_NEW_CREDIT 22s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_NEW_CREDIT 83s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_WIPE_CLEAN Subject =~ /\bwiped? clean/i describe SARE_SUB_WIPE_CLEAN Subject will wipe something clean score SARE_SUB_WIPE_CLEAN 0.683 #counts SARE_SUB_WIPE_CLEAN 2s/0h of 619677 corpus (318875s/300802h RM) 09/11/05 #max SARE_SUB_WIPE_CLEAN 14s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_WIPE_CLEAN 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_WIPE_CLEAN 4s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_WIPE_CLEAN 4s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #counts SARE_SUB_WIPE_CLEAN 0s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_WIPE_CLEAN 5s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Gambling, Lotto, Sweepstakes, Winnings, Losses ######## ###################### ################################################## header SARE_SUB_CASINO_BONUS Subject =~ /bonus.+casino/i describe SARE_SUB_CASINO_BONUS Spammer subject - casinos score SARE_SUB_CASINO_BONUS 1.666 #hist SARE_SUB_CASION_BONUS Created by Bob Menschel, July 24 2004, from suggestion by Loren Wilton #counts SARE_SUB_CASINO_BONUS 0s/0h of 233831 corpus (95086s/138745h RM) 12/15/05 #max SARE_SUB_CASINO_BONUS 780s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_CASINO_BONUS 1s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_CASINO_BONUS 71s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_CASINO_BONUS 55s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_CASINO_BONUS 63s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_CASINO_BONUS 24s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_CASINO_BONUS 47s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_CASINO_BONUS 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Insurance ######## ###################### ################################################## header SARE_SUB_TERM_LIFE Subject =~ /Term\W*Life/i describe SARE_SUB_TERM_LIFE Spammer subject - insurance score SARE_SUB_TERM_LIFE 1.666 #counts SARE_SUB_TERM_LIFE 123s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_TERM_LIFE 378s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_TERM_LIFE 1s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_TERM_LIFE 3s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #counts SARE_SUB_TERM_LIFE 36s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_TERM_LIFE 3s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_TERM_LIFE 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_TERM_LIFE 21s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_TERM_LIFE 1s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_TERM_LIFE 20s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_TERM_LIFE 25s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 ######## ###################### ################################################## # Category: Marketing, Pricing, Selling, Buying ######## ###################### ################################################## header SARE_SUB_INCOME Subject =~ /(?:incredible income|income opportunity)/i describe SARE_SUB_INCOME Subject contains common spammer phrasing score SARE_SUB_INCOME 0.683 #hist SARE_SUB_INCOME RM_spc_income #counts SARE_SUB_INCOME 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_INCOME 15s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_INCOME 1s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_INCOME 1s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_INCOME 0s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_INCOME 0s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_INCOME 6s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 header SARE_SUB_OEMS Subject =~ m'(?:\b(?:c[o0]rel|n[o0]rt[o0]n|ad[o0]be|m[i1]cr[o0]s[o0]ft|symanntec|macr[o0]med[i1]a)\b.*){3}'i describe SARE_SUB_OEMS Spammer subject - multiple software vendors score SARE_SUB_OEMS 1.666 #hist SARE_SUB_OEMS Robert Brooks, Feb 22 2005 #counts SARE_SUB_OEMS 44s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_OEMS 122s/0h of 291031 corpus (121442s/169589h RM) 04/22/05 #counts SARE_SUB_OEMS 4s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_OEMS 5s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_OEMS 21s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_OEMS 37s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #counts SARE_SUB_OEMS 30s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_OEMS 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 ######## ###################### ################################################## # Category: Medical ######## ###################### ################################################## header SARE_SUB_24HOUR_SALE Subject =~ /24 hour sale online/i describe SARE_SUB_24HOUR_SALE Common spammer subject header -- sales score SARE_SUB_24HOUR_SALE 0.733 #hist SARE_SUB_24HOUR_SALE Created by Bob Menschel Apr 28 2004 #counts SARE_SUB_24HOUR_SALE 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_24HOUR_SALE 26s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_24HOUR_SALE 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_24HOUR_SALE 3s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04 #counts SARE_SUB_24HOUR_SALE 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_24HOUR_SALE 2s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_24HOUR_SALE 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_24HOUR_SALE 1s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_BUY_MEDS subject =~ /(?:b[uv]y|p.?[uv].?r.?c.?h.?[a\@].?s.?e|get)\W*(?:[a\@]ll\W*)(?:y[o0\@][uv]r\W*)?(?:c.?h.?e.?[a\@].?p\W*)?(?:[a\@].?[l|].?p.?r.?[a\@].?z.?[o0\@].?[l|]|B.?[o0\@].?n.?t.?r.?i.?[l|]|c.?i.?[a\@].?[l|].?i.?s|C.?[o0\@].?d.?e.?i.?n.?e|D.?i.?d.?r.?e.?x|d.?i.?e.?t|F.?[l|].?e.?x.?e.?r.?i.?[l|]|g.?e.?n.?e.?r.?i.?c|h.?g.?h|H.?y.?d.?r.?[o0\@].?c.?[o0\@].?d.?[o0\@].?n.?e|[l|].?e.?v.?i.?t.?r.?[a\@]|m.?e.?d.?(?:i.?c.?[a\@].?t.?i.?[o0\@].?n.?)?s|M.?[uv].?s.?c.?[l|].?e.?R.?e.?[l|].?[a\@].?x.?[a\@].?n.?t.?s?|p.?[a\@].?i.?n|P.?[a\@].?x.?i.?[l|]|P.?h.?e.?n.?t.?e.?r.?m.?i.?n.?e|P.?r.?e.?s.?c.?r.?i.?p.?t.?i.?[o0\@].?n.?s?|P.?r.?[o0\@].?z.?[a\@].?c|S.?i.?[l|].?d.?e.?n.?[a\@].?f.?i.?[l|]|S.?k.?e.?[l|].?[a\@].?x.?i.?n|s.?[l|].?e.?e.?p.?i.?n.?g|s.?[o0\@].?m.?[a\@]|T.?r.?[a\@].?m.?[a\@].?d.?[o0\@].?[l|]|v.?[a\@].?[l|].?i.?[uv].?m|v.?i.?[a\@].?g.?r.?[a\@]|V.?i.?c.?[o0\@].?d.?i.?n|V.?i.?[o0\@].?x.?x|x.?[a\@].?n.?[a\@].?x|Z.?[o0\@].?[l|].?[o0\@].?f.?t)\b/i describe SARE_SUB_BUY_MEDS Spammer subject - medical score SARE_SUB_BUY_MEDS 1.588 #hist SARE_SUB_BUY_MEDS Created by Bob Menschel April 24 2004 #counts SARE_SUB_BUY_MEDS 2s/0h of 280564 corpus (109285s/171279h RM) 05/03/05 #max SARE_SUB_BUY_MEDS 127s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_BUY_MEDS 1s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_BUY_MEDS 1s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_BUY_MEDS 8s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #max SARE_SUB_BUY_MEDS 26s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_BUY_MEDS 1s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_BUY_MEDS 31s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_BUY_MEDS 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_FORGET_DOC subject =~ /(?:forget|skip|(?:why go|no visit|no need to go) to) the doctor/i describe SARE_SUB_FORGET_DOC Spammer subject - medical score SARE_SUB_FORGET_DOC 1.227 #hist SARE_SUB_FORGET_DOC Created by Bob Menschel Oct 03 2004 #counts SARE_SUB_FORGET_DOC 0s/0h of 619677 corpus (318875s/300802h RM) 09/11/05 #max SARE_SUB_FORGET_DOC 82s/0h of 115424 corpus (81069s/34355h RM) 01/16/05 #counts SARE_SUB_FORGET_DOC 1s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_FORGET_DOC 17s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_FORGET_DOC 21s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_FORGET_DOC 1s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_FORGET_DOC 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_FORGET_DOC 9s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_FORGET_DOC 0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_SUB_FORGET_DOC 7s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_FREE_PRES Subject =~ /(?!free pres[es])free pres./i describe SARE_SUB_FREE_PRES subject has likely spammer phrase or word score SARE_SUB_FREE_PRES 1.339 #ham SARE_SUB_FREE_PRES "free press" www.freepress.net, free presentation #hist SARE_SUB_FREE_PRES From 88_FVGT_subject.cf FS_FREE_PRES May 1 2004 #hist SARE_SUB_FREE_PRES Added exclusion for free presentation, June 25 2005 #counts SARE_SUB_FREE_PRES 4s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_FREE_PRES 99s/0h of 115449 corpus (94274s/21175h RM) 05/01/04 #counts SARE_SUB_FREE_PRES 1s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_FREE_PRES 19s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_FREE_PRES 2s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_FREE_PRES 1s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_FREE_PRES 8s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_FREE_PRES 2s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_SUB_FREE_PRES 12s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_GIVE_SMILE Subject =~ /Give her something to smile about/i describe SARE_SUB_GIVE_SMILE Common spammer subject score SARE_SUB_GIVE_SMILE 0.994 #hist SARE_SUB_GIVE_SMILE Created by Bob Menschel Nov 07 2004 #counts SARE_SUB_GIVE_SMILE 19s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #counts SARE_SUB_GIVE_SMILE 1s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_GIVE_SMILE 3s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_GIVE_SMILE 9s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_GIVE_SMILE 1s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_GIVE_SMILE 1s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_GIVE_SMILE 26s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_GIVE_SMILE 0s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_GIVE_SMILE 9s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 header SARE_SUB_MALE_MUSCLE Subject =~ /Male muscle/i describe SARE_SUB_MALE_MUSCLE Spammer subject - medical score SARE_SUB_MALE_MUSCLE 0.822 #counts SARE_SUB_MALE_MUSCLE 14s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_MALE_MUSCLE 15s/0h of 61007 corpus (36343s/24664h RM) 08/27/04 #counts SARE_SUB_MALE_MUSCLE 1s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_MALE_MUSCLE 3s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_MALE_MUSCLE 2s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_MALE_MUSCLE 2s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_MALE_MUSCLE 21s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_MALE_MUSCLE 0s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_MALE_MUSCLE 4s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 header SARE_SUB_MEDS_LEO Subject =~ /(?!medications?)\b(?:m|rn|\/V\\|\/\\\/\\]).?(?:[e3\*\xC8-\xCB\xE8-\xEB]).?(?:[d\xD0]).?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]).?(?:[c\*\xC7\xE7\xA2\xA9]).?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\).?(?:[t\+]).?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]).?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]).?(?:[n\xD1\xF1]|\|\\\|).?(?:[s5\$\xA7])?/i describe SARE_SUB_MEDS_LEO obfuscated subject header score SARE_SUB_MEDS_LEO 2.222 #hist SARE_SUB_MEDS_LEO Bob Menschel, Sept 11, 2005 #counts SARE_SUB_MEDS_LEO 332s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_MEDS_LEO 1414s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_MEDS_LEO 4s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_MEDS_LEO 12s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_MEDS_LEO 32s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_MEDS_LEO 5s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_MEDS_LEO 165s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_MEDS_LEO 44s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 header SARE_SUB_NO_RX Subject =~ /(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\W_]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95) (?:(?:[p\xDE]|\xCE\xA1|\xCF\x81|\xD0\xA0|\xD1\x80)[\W_]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93)[\W_]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\W_]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)[\W_]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93) )?(?:[p\xDE]|\xCE\xA1|\xCF\x81|\xD0\xA0|\xD1\x80)[\W_]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93)[\W_]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)[\W_]?(?:[s5\$\xA7]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F)[\W_]?(?:[c\*\xC7\xE7\xA2\xA9]|\xC4[\x86-\x8D]|\xD0\xA1|\xD1\x81)[\W_]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93)[\W_]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\W_]?(?:[p\xDE]|\xCE\xA1|\xCF\x81|\xD0\xA0|\xD1\x80)[\W_]?(?:[t\+]|\xC5[\xA2-\xA7]|\xCE\xA4|\xCF\x84|\xD0\xA2|\xD1\x82)[\W_]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\W_]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)[\W_]?(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\W_]?(?:[s5\$\xA7]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F)? (?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\W_]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)[\W_]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)[\W_]?(?:[d\xD0]|\xC4[\x8E-\x91])[\W_]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)[\W_]?(?:[d\xD0]|\xC4[\x8E-\x91])/i score SARE_SUB_NO_RX 1.666 describe SARE_SUB_NO_RX no prescription needed #hist SARE_SUB_NO_RX Created by Bob Menschel Aug 7 2004 #counts SARE_SUB_NO_RX 186s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_NO_RX 291s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_NO_RX 14s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_NO_RX 5s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_NO_RX 8s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_NO_RX 30s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_NO_RX 86s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_NO_RX 88s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_NO_RX 11s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_NO_RX 3s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_NO_RX 29s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_NUM_PILLS Subject =~ /\d.pills/i describe SARE_SUB_NUM_PILLS Common spammer subject header -- medical score SARE_SUB_NUM_PILLS 1.111 #stype SARE_SUB_NUM_PILLS spamp #hist SARE_SUB_NUM_PILLS Created by Bob Menschel Apr 28 2004 #counts SARE_SUB_NUM_PILLS 5s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_NUM_PILLS 37s/0h of 400345 corpus (178117s/222228h RM) 03/31/05 #counts SARE_SUB_NUM_PILLS 10s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_NUM_PILLS 4s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_NUM_PILLS 9s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04 #counts SARE_SUB_NUM_PILLS 6s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_NUM_PILLS 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_NUM_PILLS 3s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_NUM_PILLS 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_ONLINE_DRUG Subject =~ /Online drugs/i describe SARE_SUB_ONLINE_DRUG Common spammer subject score SARE_SUB_ONLINE_DRUG 1.666 #hist SARE_SUB_ONLINE_DRUG Created by Bob Menschel Apr 07 2004 #counts SARE_SUB_ONLINE_DRUG 17s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_ONLINE_DRUG 315s/0h of 400345 corpus (178117s/222228h RM) 03/31/05 #counts SARE_SUB_ONLINE_DRUG 5s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_ONLINE_DRUG 31s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_ONLINE_DRUG 14s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_ONLINE_DRUG 18s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04 #counts SARE_SUB_ONLINE_DRUG 5s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_ONLINE_DRUG 0s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_ONLINE_DRUG 13s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_PHARM_LEO Subject =~ /(?!pharmac(?:y|ies))\b(?:[p\xDE]).?h.?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\).?(?:[r\xAE]).?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\)?(?:m|rn|\/V\\|\/\\\/\\]).?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\)?(?:[c\*\xC7\xE7\xA2\xA9])(?:(?:[y\xA5\xDD\xFD])|(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]).?(?:[e3\*\xC8-\xCB\xE8-\xEB]).?(?:[s5\$\xA7]))/i describe SARE_SUB_PHARM_LEO obfuscated subject header score SARE_SUB_PHARM_LEO 2.222 #hist SARE_SUB_PHARM_LEO Bob Menschel, Sept 11, 2005 #counts SARE_SUB_PHARM_LEO 1397s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #counts SARE_SUB_PHARM_LEO 6s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_PHARM_LEO 24s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_PHARM_LEO 77s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PHARM_LEO 8s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_PHARM_LEO 244s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PHARM_LEO 63s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 header SARE_SUB_PHARM_LEO2 Subject =~ /(?!Pharmaceuticals?)\b(?:[p\xDE]).?h.?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\).?(?:[r\xAE]).?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\)?(?:m|rn|\/V\\|\/\\\/\\]).?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\).?(?:[c\*\xC7\xE7\xA2\xA9]).?(?:[e3\*\xC8-\xCB\xE8-\xEB]).?(?:[uv\*\xB5\xD9-\xDC\xF9-\xFC]).?(?:[t\+]).?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]).?(?:[c\*\xC7\xE7\xA2\xA9]).?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\).?(?:[l1I\|\xA3]).?(?:[s5\$\xA7])?/i describe SARE_SUB_PHARM_LEO2 obfuscated subject header score SARE_SUB_PHARM_LEO2 2.222 #hist SARE_SUB_PHARM_LEO2 Bob Menschel, Sept 11, 2005 #counts SARE_SUB_PHARM_LEO2 402s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PHARM_LEO2 1233s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PHARM_LEO2 52s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_PHARM_LEO2 20s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_PHARM_LEO2 13s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PHARM_LEO2 0s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_SUB_PHARM_LEO2 224s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PHARM_LEO2 130s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 header SARE_SUB_REFILL_RX Subject =~ /\b(?:refill rx|rx refill)\b/i describe SARE_SUB_REFILL_RX Common spammer subject - medical score SARE_SUB_REFILL_RX 0.922 #hist SARE_SUB_REFILL_RX Created by Bob Menschel Sep 10 2004 #counts SARE_SUB_REFILL_RX 2s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_REFILL_RX 23s/0h of 400345 corpus (178117s/222228h RM) 03/31/05 #counts SARE_SUB_REFILL_RX 0s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_REFILL_RX 0s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_REFILL_RX 33s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_REFILL_RX 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_RENEW_VITAL Subject =~ /(?:feel|improve|increase|renew).*vitality/i describe SARE_SUB_RENEW_VITAL Common spammer subject score SARE_SUB_RENEW_VITAL 1.111 #stype SARE_SUB_RENEW_VITAL spamp #hist SARE_SUB_RENEW_VITAL Created by Bob Menschel Nov 20 2004 #counts SARE_SUB_RENEW_VITAL 9s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_RENEW_VITAL 15s/0h of 102867 corpus (66500s/36367h RM) 12/07/04 #counts SARE_SUB_RENEW_VITAL 3s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_RENEW_VITAL 1s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_SUB_RENEW_VITAL 3s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_RENEW_VITAL 2s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_RENEW_VITAL 6s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_RENEW_VITAL 12s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_RENEW_VITAL 3s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_RENEW_VITAL 5s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 ######## ###################### ################################################## # Category: Real Estate ######## ###################### ################################################## ######## ###################### ################################################## # Category: Religious, including religious scams ######## ###################### ################################################## ######## ###################### ################################################## # Category: Software ######## ###################### ################################################## ######## ###################### ################################################## # Category: Spamming ######## ###################### ################################################## ######## ###################### ################################################## # Category: Generic words and phrases ######## ###################### ################################################## header SARE_SUB_CHEAP Subject =~ /^Cheap(?:est)\s\w/i describe SARE_SUB_CHEAP Subject matches common spam pattern score SARE_SUB_CHEAP 1.666 #hist SARE_SUB_CHEAP LW_CHEAP_SUB, Aug 16 2004, Loren Wilton #counts SARE_SUB_CHEAP 11s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_CHEAP 124s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_CHEAP 1s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_CHEAP 42s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #counts SARE_SUB_CHEAP 1s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_CHEAP 25s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_CHEAP 0s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_CHEAP 3s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_LIKE_YOU Subject =~ /(?:(?:singles(?: just)?|(?:looking(?: for)?|(?:need|surprise)) someone|who might) like you|like you (?:have )?never seen)/i describe SARE_SUB_LIKE_YOU subject has likely spammer phrase or word score SARE_SUB_LIKE_YOU 0.789 #counts SARE_SUB_LIKE_YOU 17s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_LIKE_YOU 26s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_LIKE_YOU 14s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #counts SARE_SUB_LIKE_YOU 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_LIKE_YOU 2s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_LIKE_YOU 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_PAYMENT Subject =~ /(?:payment|report) .{0,35}\b[PN]\d{7,25}\s*$/i describe SARE_SUB_PAYMENT Subject matches common spam pattern score SARE_SUB_PAYMENT 1.111 #stype SARE_SUB_PAYMENT spamp #hist SARE_SUB_PAYMENT LW_PMNT_SUB, Aug 16 2004, Loren Wilton #counts SARE_SUB_PAYMENT 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PAYMENT 19s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PAYMENT 5s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PAYMENT 26s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_PAYMENT 6s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PAYMENT 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_PAYMENT 8s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_PAYMENT 0s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_PAYMENT 17s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Technical spamsign ######## ###################### ################################################## # EOF # SARE "General Subject" Ruleset for SpamAssassin - File 1 # Version: 01.03.12 # Created: 2004-09-13 # Modified: 2005-12-27 # Usage instructions and documentation are found in 70_sare_genlsubj0.cf #@@# Revision History: Full Revision History stored in 70_sare_genlsubj.log #@@# 01.03.12: Dec 27 2005 #@@# Minor score updates based on additional mass-check #@@# Archived from file 1: SARE_SUB_2PIPES #@@# Modified SARE_SUB_WINNING_NOT to avoid PayPal FPs #@@# Moved file 0 to file 1: SARE_SUB_GRANT #@@# Moved file 0 to file 1: SARE_SUB_MSG_SUBJ #@@# Moved file 0 to file 1: SARE_SUB_PORN_WORD08 #@@# Moved file 0 to file 1: SARE_SUB_RE_V #@@# Moved file 0 to file 2: SARE_SUB_SEX_EXP_GAP #@@# Moved file 1 to file 2: SARE_HEAD_ORG_ELITEACT #@@# Moved file 1 to file 2: SARE_SUB_FREE_BANG #@@# Moved file 1 to file 2: SARE_SUB_YOUR_WOMAN #@@# Moved file 1 to file 3: SARE_SUB_ALL_LEAD #@@# Moved file 1 to file 3: SARE_SUB_ASSIST #@@# Moved file 1 to file 3: SARE_SUB_CONFIDENTIAL #@@# Moved file 1 to file 3: SARE_SUB_DOLLARS #@@# Moved file 1 to file 3: SARE_SUB_FORECLOSURE #@@# Moved file 1 to file 3: SARE_SUB_FOREVER #@@# Moved file 1 to file 3: SARE_SUB_FREE_SAMPLE #@@# Moved file 1 to file 3: SARE_SUB_MORTGAGE #@@# Moved file 1 to file 3: SARE_SUB_PORN_WORD10 #@@# Moved file 1 to file 3: SARE_SUB_SEXY #@@# Moved file 1 to file 3: SARE_SUB_YOUNGER #@@# Moved file 1 to file 4: SARE_SUB_NOW_TIME #@@# Moved file 2 to file 1: SARE_SUB_REPAIR_BILLS #@@# Moved file 3 to file 1: SARE_SUB_SURVEY ######## ###################### ################################################## # Rule definitions to avoid --lint errors on archived/moved rules. ######## ###################### ################################################## meta __SARE_SUB_FALSE __FROM_AOL_COM && !__FROM_AOL_COM meta SARE_SUB_2UNDERSCORES __SARE_SUB_FALSE meta SARE_SUB_ACCT_UPD __SARE_SUB_FALSE meta SARE_SUB_ADV_SEARCH __SARE_SUB_FALSE meta SARE_SUB_CHANGE_LIFE __SARE_SUB_FALSE meta SARE_SUB_CHARGE_OB __SARE_SUB_FALSE meta SARE_SUB_COMM_MAILERS __SARE_SUB_FALSE meta SARE_SUB_EBAY_OB __SARE_SUB_FALSE meta SARE_SUB_EXPIRED __SARE_SUB_FALSE meta SARE_SUB_GAPPY_3 __SARE_SUB_FALSE meta SARE_SUB_GAPPY_4 __SARE_SUB_FALSE meta SARE_SUB_LEAD_PUNCT __SARE_SUB_FALSE meta SARE_SUB_LONG_SUBJ_140 __SARE_SUB_FALSE meta SARE_SUB_LONG_SUBJ_170 __SARE_SUB_FALSE meta SARE_SUB_LOTS_PUNC_21 __SARE_SUB_FALSE meta SARE_SUB_LOTS_PUNC_26 __SARE_SUB_FALSE meta SARE_SUB_MENS_HEALTH __SARE_SUB_FALSE meta SARE_SUB_PERFECTLY __SARE_SUB_FALSE meta SARE_SUB_RAND_UC __SARE_SUB_FALSE meta SARE_SUB_STRETCH_MARK __SARE_SUB_FALSE meta SARE_SUB_TAXES __SARE_SUB_FALSE meta SARE_SUB_DOWNLOAD_OB __SARE_SUB_FALSE meta SARE_SUB_PENIS_OB __SARE_SUB_FALSE meta SARE_SUB_ACTION_OB __SARE_SUB_FALSE meta SARE_SUB_BETTER_OB2 __SARE_SUB_FALSE meta SARE_SUB_BIGGER_OB __SARE_SUB_FALSE meta SARE_SUB_BOOST_OB __SARE_SUB_FALSE meta SARE_SUB_BREAKTHRU_OB __SARE_SUB_FALSE meta SARE_SUB_BUY_OB __SARE_SUB_FALSE meta SARE_SUB_CONSULTN_OB __SARE_SUB_FALSE meta SARE_SUB_HARD_OB __SARE_SUB_FALSE meta SARE_SUB_HOMEOWNER_OB __SARE_SUB_FALSE meta SARE_SUB_INKJET_OB __SARE_SUB_FALSE meta SARE_SUB_LOSE_OB __SARE_SUB_FALSE meta SARE_SUB_MOVE_OB __SARE_SUB_FALSE meta SARE_SUB_PHOTOS_OB __SARE_SUB_FALSE meta SARE_SUB_PHYSICIAN_OB __SARE_SUB_FALSE meta SARE_SUB_PLEASE_OB __SARE_SUB_FALSE meta SARE_SUB_REAL_OB __SARE_SUB_FALSE meta SARE_SUB_STRONG_OB __SARE_SUB_FALSE meta SARE_SUB_VIDEO_OB __SARE_SUB_FALSE meta SARE_SUB_YOUNGER_OB __SARE_SUB_FALSE meta SARE_SUB_SION_OB __SARE_SUB_FALSE meta SARE_SUB_TION_OB __SARE_SUB_FALSE meta SARE_SUB_AGING __SARE_SUB_FALSE meta SARE_SUB_BETTER_DEAL __SARE_SUB_FALSE meta SARE_SUB_BIGGER __SARE_SUB_FALSE meta SARE_SUB_BREAKTHRU __SARE_SUB_FALSE meta SARE_SUB_CALL_NOW __SARE_SUB_FALSE meta SARE_SUB_CAR_INSURANCE __SARE_SUB_FALSE meta SARE_SUB_CONSULTATION __SARE_SUB_FALSE meta SARE_SUB_DEBT __SARE_SUB_FALSE meta SARE_SUB_DEBTS_COURT __SARE_SUB_FALSE meta SARE_SUB_FOR_WOMEN __SARE_SUB_FALSE meta SARE_SUB_GROW_BUSINESS __SARE_SUB_FALSE meta SARE_SUB_INCHES __SARE_SUB_FALSE meta SARE_SUB_INKJET __SARE_SUB_FALSE meta SARE_SUB_INVESTORS __SARE_SUB_FALSE meta SARE_SUB_JOB __SARE_SUB_FALSE meta SARE_SUB_MEDICAL_NEWS __SARE_SUB_FALSE meta SARE_SUB_NEXT_DOOR __SARE_SUB_FALSE meta SARE_SUB_PAREN_NUM2 __SARE_SUB_FALSE meta SARE_SUB_PHYSICIAN __SARE_SUB_FALSE meta SARE_SUB_STRONG __SARE_SUB_FALSE meta SARE_SUB_TONER __SARE_SUB_FALSE meta SARE_SUB_WINNER __SARE_SUB_FALSE meta SARE_SUB_YOUR_WOMAN __SARE_SUB_FALSE meta SARE_SUB_MISC_1 __SARE_SUB_FALSE meta SARE_SUB_NEXT_DOOR __SARE_SUB_FALSE meta SARE_SUB_INVESTMENTS __SARE_SUB_FALSE meta SARE_SUB_AS_LOW_AS __SARE_SUB_FALSE meta SARE_SUB_AGING_OB __SARE_SUB_FALSE meta SARE_SUB_FOR_OB __SARE_SUB_FALSE meta SARE_SUB_CONFID_OB __SARE_SUB_FALSE meta SARE_SUB_ADV_DB __SARE_SUB_FALSE meta SARE_SUB_CARD_BILLED __SARE_SUB_FALSE meta SARE_SUB_HOT_PROFITS __SARE_SUB_FALSE meta SARE_SUB_PERS_KNOW __SARE_SUB_FALSE meta SARE_SUB_REPAIR_BILLS __SARE_SUB_FALSE meta SARE_SUB_SW_ON_CD __SARE_SUB_FALSE meta SARE_SUB_WP_OFFICE __SARE_SUB_FALSE meta SARE_SUB_YOUR_LISTING __SARE_SUB_FALSE meta SARE_SUB_BOOST __SARE_SUB_FALSE meta SARE_SUB_BULK_EMAIL __SARE_SUB_FALSE meta SARE_SUB_CURRENT_NEWS __SARE_SUB_FALSE meta SARE_SUB_MINUTES __SARE_SUB_FALSE meta SARE_HEAD_ORG_ELITEACT __SARE_SUB_FALSE meta SARE_SUB_FREE_BANG __SARE_SUB_FALSE meta SARE_SUB_YOUR_WOMAN __SARE_SUB_FALSE meta SARE_SUB_ALL_LEAD __SARE_SUB_FALSE meta SARE_SUB_ASSIST __SARE_SUB_FALSE meta SARE_SUB_CONFIDENTIAL __SARE_SUB_FALSE meta SARE_SUB_DOLLARS __SARE_SUB_FALSE meta SARE_SUB_FORECLOSURE __SARE_SUB_FALSE meta SARE_SUB_FOREVER __SARE_SUB_FALSE meta SARE_SUB_FREE_SAMPLE __SARE_SUB_FALSE meta SARE_SUB_MORTGAGE __SARE_SUB_FALSE meta SARE_SUB_PORN_WORD10 __SARE_SUB_FALSE meta SARE_SUB_SEXY __SARE_SUB_FALSE meta SARE_SUB_YOUNGER __SARE_SUB_FALSE meta SARE_SUB_NOW_TIME __SARE_SUB_FALSE ######## ###################### ################################################## # Category: __rules used by primary rules below ######## ###################### ################################################## # Attempt to identify simple subject obfuscation by character insertion header __SARE_SUB_OBFU_ASTER Subject =~ /[a-zA-Z0]\*[a-zA-Z]/ header __SARE_SUB_OBFU_CARAT Subject =~ /[a-zA-Z0]\^[a-zA-Z]/ header __SARE_SUB_OBFU_COLON Subject =~ /[a-zA-Z0]:[a-zA-Z]/ header __SARE_SUB_OBFU_COMMA Subject =~ /[a-zA-Z0],[a-zA-Z]/ header __SARE_SUB_OBFU_SLASH Subject =~ /[a-zA-Z0]\/[a-zA-Z]/ header __SARE_SUB_OBFU_LQUOT Subject =~ /[a-zA-Z0]`[a-zA-Z]/ header __SARE_SUB_OBFU_PERIOD Subject =~ /[a-zA-Z0]\.[a-zA-Z]/ header __SARE_SUB_OBFU_2PER Subject =~ /[a-zA-Z0]\.\.[a-zA-Z]/ header __SARE_SUB_OBFU_PIPE Subject =~ /[a-zA-Z0]\|[a-zA-Z]/ header __SARE_SUB_OBFU_PLUS Subject =~ /[a-zA-Z0]\+[a-zA-Z]/ header __SARE_SUB_OBFU_QUOTE Subject =~ /[a-zA-Z0]"[a-zA-Z]/ header __SARE_SUB_OBFU_SCOLON Subject =~ /[a-zA-Z0];[a-zA-Z]/ header __SARE_SUB_OBFU_USCORE Subject =~ /[a-zA-Z0]_[a-zA-Z]/ header __SARE_SUB_OBFU_HTTP Subject =~ m*http://*i ######## ###################### ################################################## # Category: Adult/Porn ######## ###################### ################################################## header SARE_SUB_PORN_WORD02 Subject =~ /puss(?:y|ies)/i describe SARE_SUB_PORN_WORD02 Adult spammer words score SARE_SUB_PORN_WORD02 0.778 #hist SARE_SUB_PORN_WORD02 Richard Gray, Feb 21 2005 #counts SARE_SUB_PORN_WORD02 110s/5h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PORN_WORD02 371s/4h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PORN_WORD02 18s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_PORN_WORD02 29s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PORN_WORD02 19s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_PORN_WORD02 18s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_PORN_WORD02 21s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_PORN_WORD02 45s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PORN_WORD02 1s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_PORN_WORD02 16s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_PORN_WORD02 0s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_PORN_WORD02 10s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_PORN_WORD05 Subject =~ /\bh(?:orn|onr|nro|nor|ron|rno)y\b/i describe SARE_SUB_PORN_WORD05 Adult spammer words score SARE_SUB_PORN_WORD05 0.889 #hist SARE_SUB_PORN_WORD05 Richard Gray, Feb 21 2005 #ham SARE_SUB_PORN_WORD05 verified (1) #counts SARE_SUB_PORN_WORD05 70s/2h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PORN_WORD05 344s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PORN_WORD05 10s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_PORN_WORD05 17s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_PORN_WORD05 19s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PORN_WORD05 12s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_PORN_WORD05 9s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_PORN_WORD05 15s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_PORN_WORD05 20s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PORN_WORD05 23s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 header SARE_SUB_PORN_WORD06 Subject =~ /f(?:ucke|ucek|ukce|ukec|ueck|uekc|cuek|cuke|ckue|ckeu|ceku|ceuk|kuce|kuec|kcue|kceu|kecu|keuc|euck|eukc|ecuk|ecku|ekcu|ekuc)d/i describe SARE_SUB_PORN_WORD06 Adult spammer words score SARE_SUB_PORN_WORD06 0.914 #ham SARE_SUB_PORN_WORD06 verified (1) #hist SARE_SUB_PORN_WORD06 Richard Gray, Feb 21 2005 #counts SARE_SUB_PORN_WORD06 102s/3h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PORN_WORD06 156s/13h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PORN_WORD06 38s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_PORN_WORD06 2s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_SUB_PORN_WORD06 3s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_PORN_WORD06 18s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PORN_WORD06 9s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_PORN_WORD06 4s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_PORN_WORD06 28s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PORN_WORD06 57s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 header SARE_SUB_PORN_WORD08 Subject =~ /\bMILF\b/i describe SARE_SUB_PORN_WORD08 Adult spammer words score SARE_SUB_PORN_WORD08 0.722 #hist SARE_SUB_PORN_WORD08 Richard Gray, Feb 21 2005 #ham SARE_SUB_PORN_WORD08 verified #counts SARE_SUB_PORN_WORD08 13s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PORN_WORD08 58s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PORN_WORD08 3s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_PORN_WORD08 1s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_PORN_WORD08 1s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_PORN_WORD08 4s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PORN_WORD08 3s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_PORN_WORD08 0s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_PORN_WORD08 1s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_PORN_WORD08 4s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PORN_WORD08 1s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_PORN_WORD08 8s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 header SARE_SUB_PORN_WORD11 Subject =~ /\bcum(?:shot)?\b/i describe SARE_SUB_PORN_WORD11 Adult spammer words score SARE_SUB_PORN_WORD11 0.996 #ham SARE_SUB_PORN_WORD11 verified (1), possible (several) #hist SARE_SUB_PORN_WORD11 Richard Gray, Feb 21 2005 #counts SARE_SUB_PORN_WORD11 384s/7h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PORN_WORD11 2339s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PORN_WORD11 18s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_PORN_WORD11 38s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_PORN_WORD11 70s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PORN_WORD11 9s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_PORN_WORD11 60s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_PORN_WORD11 35s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PORN_WORD11 18s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_PORN_WORD11 23s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 ######## ###################### ################################################## # Category: Black market items, services, activities, scams, frauds ######## ###################### ################################################## header SARE_SUB_FIRE_BOSS Subject =~ /Fire your boss/i describe SARE_SUB_FIRE_BOSS Spammer subject - black market or scam score SARE_SUB_FIRE_BOSS 0.711 #hist SARE_SUB_FIRE_BOSS From Loren Wilton, July 22 2004 #counts SARE_SUB_FIRE_BOSS 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_FIRE_BOSS 22s/0h of 60310 corpus (35337s/24973h RM) 08/10/04 #counts SARE_SUB_FIRE_BOSS 0s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_FIRE_BOSS 1s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_FIRE_BOSS 6s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_FIRE_BOSS 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_FIRE_BOSS 0s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #max SARE_SUB_FIRE_BOSS 2s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_GET_PAID Subject =~ /get paid/i describe SARE_SUB_GET_PAID Subject mentions getting paid for something score SARE_SUB_GET_PAID 0.899 #hist SARE_SUB_GET_PAID RM_spc_GetPaid #counts SARE_SUB_GET_PAID 190s/3h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_GET_PAID 338s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_GET_PAID 13s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_GET_PAID 62s/1h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_GET_PAID 11s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_GET_PAID 2s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_GET_PAID 4s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_GET_PAID 27s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_GET_PAID 167s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 header SARE_SUB_NAME_MILBEN From:name =~ /Military Benefits/i describe SARE_SUB_NAME_MILBEN Might be military benefits scam score SARE_SUB_NAME_MILBEN 0.961 #hist SARE_SUB_NAME_MILBEN Matt Yackley, Apr 15 2005 #counts SARE_SUB_NAME_MILBEN 31s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_NAME_MILBEN 49s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_NAME_MILBEN 30s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_NAME_MILBEN 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_NAME_MILBEN 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_NAME_MILBEN 1s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_NAME_MILBEN 11s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_NAME_MILBEN 35s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 header SARE_SUB_NEED_REPLY Subject =~ /(?:(?:(?:appreciate|a?waiting(?:\W*for)?)\W*your|request|urgent)\W*(?:answer|assist|PROPOSITION|reply|response)|(?:answer|assist|PROPOSITION|reply|response)\W*(?:needed|urgent))/i describe SARE_SUB_NEED_REPLY Spammer subject - black market or scam score SARE_SUB_NEED_REPLY 0.784 #ham SARE_SUB_NEED_REPLY verified (14) #hist SARE_SUB_NEED_REPLY Expanded by Bob Menschel, Sep 24 2004 #counts SARE_SUB_NEED_REPLY 284s/7h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_NEED_REPLY 665s/22h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_NEED_REPLY 1s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_NEED_REPLY 4s/1h of 11269 corpus (6578s/4691h CT) 06/11/05 #counts SARE_SUB_NEED_REPLY 16s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_NEED_REPLY 3s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_NEED_REPLY 34s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_NEED_REPLY 25s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #counts SARE_SUB_NEED_REPLY 7s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_NEED_REPLY 11s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 header __SARE_SUB_WINNING_NOT Subject =~ /(?:(?:Final|WINNING)(?:.award)?\s*NOTIFICATION|^NOTIFICATION\s*$|(?:auction|lucky).winning|notification.of.(?:an.instant|bequest|intent|unclaimed|multi.?item|promotion|winning)|notification.{1,30}final.notice|contrat.{1,30}winning.{1,30}promotion)/i header __SARE_SUB_WINNING_R1 Received =~ /from .{4,15}\.paypal.com/ header __SARE_SUB_WINNING_M1 Message-Id =~ /\@paypal\.com/ header __SARE_SUB_WINNING_PP Subject =~ /Notification of an Instant Payment/ meta SARE_SUB_WINNING_NOT __SARE_SUB_WINNING_NOT && !__SARE_SUB_WINNING_R1 && !__SARE_SUB_WINNING_M1 && !__SARE_SUB_WINNING_PP describe SARE_SUB_WINNING_NOT Spammer subject - black market or scam score SARE_SUB_WINNING_NOT 0.683 #ham SARE_SUB_WINNING_NOT eBay: Notification of an Instant Payment Received from [userid] #counts SARE_SUB_WINNING_NOT 575s/28h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_WINNING_NOT 1481s/28h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_WINNING_NOT 4s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_WINNING_NOT 4s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_WINNING_NOT 51s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_WINNING_NOT 3s/2h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_WINNING_NOT 15s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_WINNING_NOT 24s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_WINNING_NOT 24s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_WINNING_NOT 11s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_WINNING_NOT 31s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_WORTH_CASH Subject =~ /\b(?:Worth|Win|take|extra|earn|dollars|Short|need|claim|free|get|opinions?|surveys?)\b.{0,15}(?:fast)?(?:C[a\@]sh|M[0o]ney)\b/i describe SARE_SUB_WORTH_CASH Subject mentions something is worth cash score SARE_SUB_WORTH_CASH 0.835 #hist SARE_SUB_WORTH_CASH RM_spc_WorthCash #ham SARE_SUB_WORTH_CASH CasinoGames.com newsletter to subscriber; credit card rewards programs #ham SARE_SUB_WORTH_CASH exchange between NPO and contributor #counts SARE_SUB_WORTH_CASH 583/17h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_WORTH_CASH 682s/18h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_WORTH_CASH 26s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_WORTH_CASH 44s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_WORTH_CASH 244s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_WORTH_CASH 31s/3h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_WORTH_CASH 9s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_WORTH_CASH 73s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04 #counts SARE_SUB_WORTH_CASH 24s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_WORTH_CASH 138s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_WORTH_CASH 201s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 ######## ###################### ################################################## # Category: Credit, debt, lending, mortgage, borrowing, investment, financing ######## ###################### ################################################## header __SARE_SUB_ACCEPT_CC Subject =~ /(?!processing credit card)(?:(?:Accept(?:ing)?|Process.{0,20})\W*credit\W*c[aâ\@]rds?|credit\W*card\W*(chargebacks?|terminals?|vendor))/i header __SARE_SUB_FROM_PAYPAL From:addr =~ /service\@paypal\.com/ header __SARE_SUB_RECV_PAYPAL Received =~ /\bnix\.paypal\.com/ meta SARE_SUB_ACCEPT_CCARDS __SARE_SUB_ACCEPT_CC && !__SARE_SUB_FROM_PAYPAL && !__SARE_SUB_RECV_PAYPAL describe SARE_SUB_ACCEPT_CCARDS Spammer subject - credit or money score SARE_SUB_ACCEPT_CCARDS 0.484 #ham SARE_SUB_ACCEPT_CCARDS verified (1) -- paypal upgrade confirmation #hist SARE_SUB_ACCEPT_CCARDS Dec 24 2005 Modified to reduce paypal FPs #counts SARE_SUB_ACCEPT_CCARDS 45s/6h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_ACCEPT_CCARDS 54s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_ACCEPT_CCARDS 11s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_ACCEPT_CCARDS 3s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_ACCEPT_CCARDS 12s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_ACCEPT_CCARDS 2s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_ACCEPT_CCARDS 4s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_ACCEPT_CCARDS 0s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_ACCEPT_CCARDS 1s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 header SARE_SUB_FINAN_OBLIG Subject =~ /\b(?:financial|monetary) obligations/i describe SARE_SUB_FINAN_OBLIG Subject mentions financial obligations score SARE_SUB_FINAN_OBLIG 0.622 #counts SARE_SUB_FINAN_OBLIG 0s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_SUB_FINAN_OBLIG 9s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_FINAN_OBLIG 3s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #counts SARE_SUB_FINAN_OBLIG 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_FINAN_OBLIG 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_GRANT Subject =~ /(?:(?:cash|collect\W*your|dollar|free(?:dom)?|get\W*a|government|gov't|qualify\W*for\W*a|taxes\W*paid\W*for\W*these)\W*grants?|grant\W*money\W*for\W*you|grants.{1,30}paid\W*for\W*with\W*your\W*taxes)/i describe SARE_SUB_GRANT Spammer subject - credit or money score SARE_SUB_GRANT 1.072 #ham SARE_SUB_GRANT verified #counts SARE_SUB_GRANT 75s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_GRANT 85s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_GRANT 13s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_GRANT 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_GRANT 2s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_GRANT 4s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_GRANT 17s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_GRANT 1s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 header SARE_SUB_HIGH_RATES Subject =~ /\bhigh(?:er|est)?\b.{1,15}\brates\b/i describe SARE_SUB_HIGH_RATES subject has likely spammer phrase or word score SARE_SUB_HIGH_RATES 0.650 #ham SARE_SUB_HIGH_RATES high asthma rates #hist SARE_SUB_HIGH_RATES From 88_FVGT_subject.cf FS_HIGH_RATES May 1 2004 #hist SARE_SUB_HIGH_RATES Jan 2005: Moved from archive back to file 1 #hist SARE_SUB_HIGH_RATES Added bounds to avoid ham: Highway 61 Celebrates #counts SARE_SUB_HIGH_RATES 21s/1h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_HIGH_RATES 55s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_HIGH_RATES 4s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_HIGH_RATES 3s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_HIGH_RATES 5s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_HIGH_RATES 6s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_HIGH_RATES 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 header SARE_SUB_OTC Subject =~ /^[O0]TC:[A-Z]{4}/ describe SARE_SUB_OTC Appears to be OTC stock market spam score SARE_SUB_OTC 1.006 #hist SARE_SUB_OTC Created by Bob Menschel, April 15 2005; Dec 25 2005: added zero-TC #counts SARE_SUB_OTC 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_OTC 17s/0h of 291031 corpus (121442s/169589h RM) 04/22/05 #counts SARE_SUB_OTC 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_OTC 17s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_OTC 64s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_OTC 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 header SARE_SUB_POOR_CREDIT Subject =~ /(?!credit card (?:bill|declined))(?:(?:bad|poor|less\W*than\W*perfect|fix\W*your)\W*cr[eé]d[iï]t|cr[eé]d[iï]t.{1,20}declined|declined.{1,20}cr[eé]d[iï]t|cr[eé]d[iï]t\W*(?:bad|can\W*be\W*fix|card\W*(?:balances?|bills?|debt|elimination)|Counseling|profiles?|rating)|no\W*cr[eé]d[iï]t.check)/i describe SARE_SUB_POOR_CREDIT Spammer subject - credit or money score SARE_SUB_POOR_CREDIT 1.121 #ham SARE_SUB_POOR_CREDIT SFO credit rating upgraded from "negative" to "stable", January 31, 2005, in the San Francisco Examiner #counts SARE_SUB_POOR_CREDIT 253s/3h of 428457 corpus (182181s/246276h RM) 12/24/05 #counts SARE_SUB_POOR_CREDIT 2s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_POOR_CREDIT 68s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #max SARE_SUB_POOR_CREDIT 707s/9h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_POOR_CREDIT 21s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_POOR_CREDIT 5s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_POOR_CREDIT 9s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_POOR_CREDIT 26s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_POOR_CREDIT 1s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_POOR_CREDIT 48s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_POOR_CREDIT 68s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 header SARE_SUB_REFINANCE Subject =~ /re-?finance/i describe SARE_SUB_REFINANCE Spammer subject - credit or money score SARE_SUB_REFINANCE 1.666 #counts SARE_SUB_REFINANCE 378s/18h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_REFINANCE 924s/15h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_REFINANCE 5s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_REFINANCE 30s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_REFINANCE 207s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_REFINANCE 61s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_REFINANCE 74s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_REFINANCE 97s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_REFINANCE 205s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_REFINANCE 26s/1h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_REFINANCE 41s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 ######## ###################### ################################################## # Category: Gambling, Lotto, Sweepstakes, Winnings, Losses ######## ###################### ################################################## ######## ###################### ################################################## # Category: Insurance ######## ###################### ################################################## header __SARE_SUB_INSURANCE Subject =~ /(?:(?:aff[o0]rdable|cheap(?:est)?|free|good\W*news|l[o0]w\W*c[o0]st|(?:over)?pay(?:ing)?\W*t[o0][o0]\W*much|reduce|save|sell).{1,30}insurance|insurance.{1,30}(?:available|everyone|f[o0]r\W*less|leads|[o0]ffers|[o0]pti[o0]ns?|qu[o0]tes?)|(?:FYI:?|new|special|sub|update(?:\W*sub)?)\W*construction\W*insurance|new\W*insurnace\W*product)/i meta SARE_SUB_INSURANCE __SARE_SUB_INSURANCE && !SARE_SUB_CAR_INSURANCE describe SARE_SUB_INSURANCE Spammer subject - insurance score SARE_SUB_INSURANCE 0.902 #ham SARE_SUB_INSURANCE adv in subcribed opt-in newsletter (1, same ham as SARE_SUB_CAR_INSURANCE) #hist SARE_SUB_INSURANCE Converted to meta to avoid overlap with SARE_SUB_CAR_INSURANCE, Apr 22 2005 #note SARE_SUB_INSURANCE "insurance coverage" hits too much ham #note SARE_SUB_INSURANCE "term life" covered by SARE_SUB_TERM_LIFE #counts SARE_SUB_INSURANCE 270s/5h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_INSURANCE 511s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_INSURANCE 4s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #counts SARE_SUB_INSURANCE 44s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_INSURANCE 1s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_INSURANCE 2s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_INSURANCE 31s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_INSURANCE 2s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_INSURANCE 52s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_INSURANCE 59s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_PROTECT_FAM Subject =~ /(?:Protect\W*your\W*famil(?:y|ies)|protect(?:ion)?(?:\W*for)?\W*your\W*(?:vehicle|car)|secure\W*your\W*future|protect.{1,10}from.{1,10}repair\W*bills?|extended\W*warranty\W*protection)/i describe SARE_SUB_PROTECT_FAM Spammer subject - insurance score SARE_SUB_PROTECT_FAM 1.272 #ham SARE_SUB_PROTECT_FAM verified (1) #counts SARE_SUB_PROTECT_FAM 79s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PROTECT_FAM 117s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PROTECT_FAM 9s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_PROTECT_FAM 20s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PROTECT_FAM 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_PROTECT_FAM 6s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_PROTECT_FAM 1s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PROTECT_FAM 20s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_PROTECT_FAM 63s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 header SARE_SUB_REPAIR_BILLS Subject =~ /(?:large\W*repair\W*bills|(?:(?:costly|major)\W*auto|m[o0]ney\W*for|pay(?:ing)?\W*for|save\b.{1,30}\bon)\W*repairs?)/i describe SARE_SUB_REPAIR_BILLS Spammer subject - insurance score SARE_SUB_REPAIR_BILLS 0.950 #hist SARE_SUB_REPAIR_BILLS Created by Bob Menschel Mar 22 2004 #counts SARE_SUB_REPAIR_BILLS 2s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_REPAIR_BILLS 58s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_REPAIR_BILLS 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_REPAIR_BILLS 8s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_REPAIR_BILLS 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_REPAIR_BILLS 4s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_REPAIR_BILLS 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Marketing, Pricing, Selling, Buying ######## ###################### ################################################## header SARE_SUB_ANIM_LOGO Subject =~ /(?!flash.*dimage)(?:(?:Animated|custom|flash|high[- ]impact|impressive|special|unique).{1,15}(?:image|Logo)|Logo Animation)/i describe SARE_SUB_ANIM_LOGO Common spammer subject score SARE_SUB_ANIM_LOGO 0.862 #hist SARE_SUB_ANIM_LOGO RM_spc_AnimatedLogo #hist SARE_SUB_ANIM_LOGO June 1 2004: Added some additional test words #ham SARE_SUB_ANIM_LOGO From shirt company: Special Offer: Logo Polos Just $9.95 With Your Embroidered Logo! #counts SARE_SUB_ANIM_LOGO 107s/2h of 428457 corpus (182181s/246276h RM) 12/24/05 #counts SARE_SUB_ANIM_LOGO 13s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_ANIM_LOGO 3s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_ANIM_LOGO 24s/3h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_ANIM_LOGO 2s/1h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_ANIM_LOGO 63s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_ANIM_LOGO 2s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_ANIM_LOGO 6s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_ANIM_LOGO 7s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 ######## ###################### ################################################## # Category: Medical ######## ###################### ################################################## header SARE_SUB_DROOGS Subject =~ m'\b(?:\\/ALUUM|\\/llGRA|ALPRAZZ0LAM|AMBllEN|CAALlS|L0RAAZEPAM|LEVlTRRA|MER1DllA|TRAMAD0OL|XANA)\b'i describe SARE_SUB_DROOGS otherwise missed drug-word subjects score SARE_SUB_DROOGS 1.666 #hist SARE_SUB_DROOGS Loren Wilton, Aug 2005 #counts SARE_SUB_DROOGS 1s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_DROOGS 148s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_DROOGS 3s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_DROOGS 0s/0h of 7296 corpus (1614s/5682h ft) 08/05/05 #counts SARE_SUB_DROOGS 0s/0h of 10552 corpus (5785s/4767h CT) 08/04/05 #counts SARE_SUB_DROOGS 2s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_DROOGS 148s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 header SARE_SUB_IMPROVE Subject =~ /(?:improve|maximize).{1,30}(?:cell\W*phone|cholesterol|credit|desire|English|hair|health|home|kisser|love\W*life|memory|performance|possibilities|self\W*image|sex(?:\W*life|ual\W*(?:endurance|health))|signal|sleep|stamina|stock\W*market|vision)/i describe SARE_SUB_IMPROVE Spammer subject - medical score SARE_SUB_IMPROVE 0.641 #ham SARE_SUB_IMPROVE tech list: Improve sleep code of (software module), newspaper headline #counts SARE_SUB_IMPROVE 129s/16h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_IMPROVE 165s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_IMPROVE 6s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_IMPROVE 12s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_IMPROVE 15s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_IMPROVE 1s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_IMPROVE 7s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_IMPROVE 16s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_IMPROVE 75s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_IMPROVE 15s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_IMPROVE 38s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header __SARE_SUB_INET_PHARM Subject =~ /(?!Pharmacy selection)(?:(?:American|best|(?:by|from)\W*(?:a\W*_?US|cheap|cyber|discreet|\e-|FDA|free|generic|genuine|Internet|low\W*cost|new|off\W*shore|on\W*line(?:.{1,5}USA)?|overnight|perfect|smart|super|US\W*doctors\W*US)|(?:discreet|no\W*doctor).{1,30})\W*Pharmacy|Pharmacy.{1,30}(?:deals|sale|online|prices?|related\W*drugs|selection|verification)|your\W*pharmacy\W*order)/i describe __SARE_SUB_INET_PHARM Common spammer subject header -- Medical #hist __SARE_SUB_INET_PHARM Created by Bob Menschel Apr 09 2004 #hist __SARE_SUB_INET_PHARM Merged SARE_SUB_PHARM_ONLINE from From 88_FVGT_subject.cf FS_PHARMAC_OLINE into this rule July 24 2004 #ham __SARE_SUB_INET_PHARM "Pharmacy selection" in email discussing employee's health benefits #ham __SARE_SUB_INET_PHARM Decision matrix for UIC/Pharmacy redesign selection header __SARE_SUB_INET_CHEM Subject =~ /\b(?:chemist[- ]?(?:site|store)|e-chemist|internet chemist|medicaments?|chemist.*(?:bargains?|cures?|medi(?:cals?|s|z)|prices?|reduces?|selection|spend(?:ing)?|tablets)|(?:bargains?|cures?|medi(?:cals?|s|z)|prices?|reduces?|selection|spend(?:ing)?|tablets).*chemist)\b/i describe __SARE_SUB_INET_CHEM Common spammer subject header -- Medical #hist __SARE_SUB_INET_CHEM Created by Bob Menschel August 07 2005 meta SARE_SUB_INET_PHARM ( __SARE_SUB_INET_PHARM || __SARE_SUB_INET_CHEM ) && !ONLINE_PHARMACY describe SARE_SUB_INET_PHARM Common spammer subject header -- Medical score SARE_SUB_INET_PHARM 1.666 #ham SARE_SUB_INET_PHARM Subject: Welcome to Wal-Mart Pharmacy online access #overlap SARE_SUB_INET_PHARM SARE rule overlaps distribution rule, but does not duplicate it. #overlap SARE_SUB_INET_PHARM SARE rule matches a lot of spam not matched by distribution rule. #overlap SARE_SUB_INET_PHARM It is very possible for the SARE rule to hit ham, but not the distribution rule. #hist SARE_SUB_INET_PHARM Created Aug 10 2004 by Bob Menschel to avoid double-scoring on overlap #hist SARE_SUB_INET_PHARM Added __SARE_SUB_INET_CHEM #counts SARE_SUB_INET_PHARM 66s/1h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_INET_PHARM 484s/0h of 291031 corpus (121442s/169589h RM) 04/22/05 #counts SARE_SUB_INET_PHARM 3s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_INET_PHARM 8s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_SUB_INET_PHARM 11s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_INET_PHARM 95s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_INET_PHARM 3s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_INET_PHARM 52s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #max SARE_SUB_INET_PHARM 109s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_INET_PHARM 36s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_INET_PHARM 73s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 header SARE_SUB_MEDICAL_NEWS Subject =~ /(?:medical\W*(?:announcement|breakthrough|discover|info|innovation|marvel|miracle|news|post|update)|(?:news|notice).{1,3}medical)/i describe SARE_SUB_MEDICAL_NEWS Spammer subject - medical score SARE_SUB_MEDICAL_NEWS 0.756 #hist SARE_SUB_MEDICAL_NEWS Created by Bob Menschel Apr 05 2004 #counts SARE_SUB_MEDICAL_NEWS 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_MEDICAL_NEWS 91s/2h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_MEDICAL_NEWS 3s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_MEDICAL_NEWS 11s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_MEDICAL_NEWS 0s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_MEDICAL_NEWS 45s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_MEDICAL_NEWS 1s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_SUB_MEDICAL_NEWS 0s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_MEDICAL_NEWS 1s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_MEDS Subject =~ /(?:meds (?:che[a\@]p|fr[o0]m C[a\@]n[a\@]d[a\@]|[o0]n[l1|][i1|]ne|[o0]n the net|sh[i1|]p|.*(?:[a\@]ppr[o0]ved|che[a\@]p|c[o0]st|de[a\@][l1|]|de[l1|][i1|]ver|d[i1|]screet|d[i1|]sc[o0]unt|expens[i1|]ve|f[a\@]st|f[i1|]nd|f[i1|]ngert[i1|]ps|get|gre[a\@]t|[i1\|]nternet|[l1|][o0][o0]k[i1|]ng|[l1|][o0]w.*(?:c[o0]st|pr[i1|]ce)|need|[o0]bt[a\@][i1|]n|[o0]n[l1|][i1|]ne|[o0]rder|[o0]vern[i1|]ght|percent|p[o0]pu[l1|][a\@]r|purch[a\@]se|qu[i1|]ck|rx|s[a\@]v(?:e|ing)|se[l1|]ecti[o0]n|ship|s[o0][l1|]d|s[o0]urce|speci[a\@][l1|]|v[a\@][l1|]ue|wh[o0][l1|]es[a\@][l1|]e))|(?:[a\@]ppr[o0]ved|che[a\@]p|c[o0]st|de[a\@][l1|]|de[l1|]iver|discreet|disc[o0]unt|expensive|f[a\@]st|find|fingertips|get|gre[a\@]t|[i1\|]nternet|[l1|][o0][o0]k[i1|]ng|[l1|][o0]w.*(?:c[o0]st|pr[i1|]ce)|need|[o0]bt[a\@][i1|]n|[o0]n[l1|][i1|]ne|[o0]rder|[o0]vern[i1|]ght|percent|p[o0]pu[l1|][a\@]r|purch[a\@]se|qu[i1|]ck|rx|s[a\@]v(?:e|[i1|]ng)|se[l1|]ect[i1|][o0]n|sh[i1|]p|s[o0][l1|]d|s[o0]urce|spec[i1|][a\@][l1|]|v[a\@][l1|]ue|wh[o0][l1|]es[a\@][l1|]e).*meds|e-meds)/i describe SARE_SUB_MEDS Common spammer subject header -- Medical score SARE_SUB_MEDS 1.666 #ham SARE_SUB_MEDS verified (1) #hist SARE_SUB_MEDS Created by Bob Menschel Jan 22 2005 #counts SARE_SUB_MEDS 232s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_MEDS 867s/1h of 117867 corpus (81073s/36794h RM) 01/23/05 #counts SARE_SUB_MEDS 12s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_MEDS 73s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_MEDS 10s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_MEDS 117s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_MEDS 136s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_MEDS 16s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_MEDS 51s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_MEDS 144s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_MEDS 29s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_MEDS 302s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 header SARE_SUB_PENIS Subject =~ /\bpenis\b/i describe SARE_SUB_PENIS subject has likely spammer phrase or word score SARE_SUB_PENIS 1.666 #ham SARE_SUB_PENIS confirmed (1), questionable (1) #counts SARE_SUB_PENIS 347s/2h of 428457 corpus (182181s/246276h RM) 12/24/05 #counts SARE_SUB_PENIS 19s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_PENIS 24s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_PENIS 138s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PENIS 6s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_PENIS 44s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_PENIS 112s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PENIS 4s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_PENIS 30s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_RE_V Subject =~ /^Re:\sV\W/ describe SARE_SUB_RE_V common Leo subject header sign score SARE_SUB_RE_V 0.689 #ham SARE_SUB_RE_V Subject: Re: V.P. Cheney #hist SARE_SUB_RE_V Bob Menschel, Sept 11, 2005 #counts SARE_SUB_RE_V 7s/1h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_RE_V 416s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_RE_V 4s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_RE_V 2s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_RE_V 0s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_SUB_RE_V 9s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_RE_V 26s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 header SARE_SUB_SMART_PRICE Subject =~ /(?:best|Smart|specials?).?(?:Prices|prcies)/i describe SARE_SUB_SMART_PRICE Common spammer subject header -- Medical score SARE_SUB_SMART_PRICE 0.784 #hist SARE_SUB_SMART_PRICE Created by Bob Menschel Apr 09 2004 #hist SARE_SUB_SMART_PRICE Added special prices and "prcies" Apr 28 2004 #hist SARE_SUB_SMART_PRICE Added "best" prices Jan 22 2005 #counts SARE_SUB_SMART_PRICE 103s/6h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_SMART_PRICE 217s/0h of 117867 corpus (81073s/36794h RM) 01/23/05 #counts SARE_SUB_SMART_PRICE 3s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_SMART_PRICE 3s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_SUB_SMART_PRICE 10s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_SMART_PRICE 70s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_SMART_PRICE 7s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_SMART_PRICE 10s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_SMART_PRICE 53s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04 #counts SARE_SUB_SMART_PRICE 78s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_SMART_PRICE 14s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_SMART_PRICE 35s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 header SARE_SUB_WEIGHTLOSS Subject =~ /weightloss/i describe SARE_SUB_WEIGHTLOSS mentions weight loss as one word score SARE_SUB_WEIGHTLOSS 0.689 #hist SARE_SUB_WEIGHTLOSS RM_swm_weightloss #v300 SARE_SUB_WEIGHTLOSS adds to 3.0 body rule DIET_1 #counts SARE_SUB_WEIGHTLOSS 1s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_WEIGHTLOSS 1721s/1h of 69717 corpus (42681s/27036h RM) 09/26/04 #counts SARE_SUB_WEIGHTLOSS 2s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_WEIGHTLOSS 3s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_WEIGHTLOSS 68s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_WEIGHTLOSS 18s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_WEIGHTLOSS 144s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04 #counts SARE_SUB_WEIGHTLOSS 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Politial ######## ###################### ################################################## header SARE_SUB_EMILYS_LIST Subject =~ /EMILY's LIst/i describe SARE_SUB_EMILYS_LIST Political spammer score SARE_SUB_EMILYS_LIST 0.555 #stype SARE_SUB_EMILYS_LIST spamp #hist SARE_SUB_EMILYS_LIST Created by Bob Menschel Oct 01 2004 #counts SARE_SUB_EMILYS_LIST 3s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_EMILYS_LIST 6s/0h of 238420 corpus (112480s/125940h RM) 02/28/05 #counts SARE_SUB_EMILYS_LIST 0s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_EMILYS_LIST 0s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_EMILYS_LIST 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Real Estate ######## ###################### ################################################## header SARE_SUB_HOMEOWNER Subject =~ /homeowner/i describe SARE_SUB_HOMEOWNER Spammer subject - real estate score SARE_SUB_HOMEOWNER 0.679 #ham SARE_SUB_HOMEOWNER confirmed (2) #counts SARE_SUB_HOMEOWNER 135s/11h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_HOMEOWNER 283s/16h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_HOMEOWNER 11s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_HOMEOWNER 24s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_HOMEOWNER 46s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_HOMEOWNER 15s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_HOMEOWNER 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_HOMEOWNER 12s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_HOMEOWNER 27s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_HOMEOWNER 31s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_HOMEOWNER 49s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 header SARE_SUB_TIMESHARE Subject =~ /timeshare/i describe SARE_SUB_TIMESHARE Spammer subject - real estate score SARE_SUB_TIMESHARE 1.111 #ham SARE_SUB_TIMESHARE confirmed #hist SARE_SUB_TIMESHARE Jan 2005: Moved from archive back to file 1 #counts SARE_SUB_TIMESHARE 69s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #counts SARE_SUB_TIMESHARE 13s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_TIMESHARE 2s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_TIMESHARE 16s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_TIMESHARE 30s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_TIMESHARE 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_TIMESHARE 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Software ######## ###################### ################################################## header SARE_SUB_CHEAP_SW Subject =~ /(?:(?:bargain|bucks|C.?h.?e.?a.?p|discount|expensive|p.?r.?i.?c.?e|s.?a.?v.?e|special\W*offer|spend).{1,30}software|s.?o.?f.?t.?w.?a.?r.?e.{1,30}(?:\%.off|at\W*only|bargain|bucks|c.?h.?e.?a.?p|deal|loww?.c.?o.?s.?t|price))/i describe SARE_SUB_CHEAP_SW Spammer subject - software score SARE_SUB_CHEAP_SW 1.408 #hist SARE_SUB_CHEAP_SW Created by Bob Menschel Apr 09 2004 #counts SARE_SUB_CHEAP_SW 814s/9h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_CHEAP_SW 930s/12h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_CHEAP_SW 38s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_CHEAP_SW 51s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_CHEAP_SW 408s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_CHEAP_SW 5s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_CHEAP_SW 314s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_CHEAP_SW 26s/2h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_CHEAP_SW 226s/1h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_CHEAP_SW 186s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_CHEAP_SW 221s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 header SARE_SUB_SWTYPES Subject =~ /(?:hate\W*typing|it\W*types|never\W*type|no\W*typing\W*required|Talk\W*It\W*Type\W*It|voice\W*recognition)/i describe SARE_SUB_SWTYPES subject has a spammer subject - Software score SARE_SUB_SWTYPES 1.144 #note SARE_SUB_SWTYPES beware: "attachment type" in virus bounce subject headings. #counts SARE_SUB_SWTYPES 67s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_SWTYPES 86s/4h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_SWTYPES 13s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_SWTYPES 12s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_SWTYPES 4s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_SWTYPES 0s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_SWTYPES 10s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_SWTYPES 16s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_SYSTEMWORKS Subject =~ /(?:get|sav(?:e|ing)).{1,30}system\W*works/i describe SARE_SUB_SYSTEMWORKS subject has a spammer subject - Software score SARE_SUB_SYSTEMWORKS 0.739 #counts SARE_SUB_SYSTEMWORKS 5s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_SYSTEMWORKS 12s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_SYSTEMWORKS 1s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_SYSTEMWORKS 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_SYSTEMWORKS 1s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_SYSTEMWORKS 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_SYSTEMWORKS 18s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_SYSTEMWORKS 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Spamming and Spammers ######## ###################### ################################################## header SARE_SUB_INET_CONN Subject =~ /(?:internet\W*connection\W*problem|(?:frequent|slow)\W*internet\W*connection)/i describe SARE_SUB_INET_CONN Spammer subject - spamming score SARE_SUB_INET_CONN 0.722 #counts SARE_SUB_INET_CONN 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_INET_CONN 22s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_INET_CONN 0s/5h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_INET_CONN 0s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_INET_CONN 4s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_INET_CONN 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_INET_CONN 3s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_INET_CONN 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_INET_CONN 1s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Generic words and phrases ######## ###################### ################################################## header SARE_SUB_ATTRACT Subject =~ /^Attract the /i describe SARE_SUB_ATTRACT Subject matches common spam pattern score SARE_SUB_ATTRACT 0.878 #hist SARE_SUB_ATTRACT LW_ATTR_SUB, Aug 16 2004, Loren Wilton #overlap SARE_SUB_ATTRACT strong overlap with FREE_PORN, SEDUCTION #counts SARE_SUB_ATTRACT 1s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_ATTRACT 50s/0h of 61007 corpus (36343s/24664h RM) 08/27/04 #counts SARE_SUB_ATTRACT 1s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_ATTRACT 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_ATTRACT 6s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_ATTRACT 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_ATTRACT 2s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_GOOD_DAY Subject =~ /\bgood day\b/i describe SARE_SUB_GOOD_DAY Contains spammer phrasing score SARE_SUB_GOOD_DAY 0.679 #ham SARE_SUB_GOOD_DAY Today Is Not a Good Day for War, from Nuclear Age Peace Foundation #hist SARE_SUB_GOOD_DAY Created by Bob Menschel Aug 29 2004 #counts SARE_SUB_GOOD_DAY 301s/5h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_GOOD_DAY 471s/7h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_GOOD_DAY 4s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_GOOD_DAY 16s/9h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_GOOD_DAY 8s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_GOOD_DAY 13s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_GOOD_DAY 34s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_GOOD_DAY 14s/2h of 40676 corpus (35385s/5291h MY) 12/25/05 #counts SARE_SUB_GOOD_DAY 0s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_GOOD_DAY 2s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_GOOD_DAY 0s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #max SARE_SUB_GOOD_DAY 1s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_LET Subject =~ /^Let (?:us|your|the banks?) /i describe SARE_SUB_LET Subject matches common spam pattern score SARE_SUB_LET 0.720 #ham SARE_SUB_LET Let your headings reset numbers (web page creation instruction) #hist SARE_SUB_LET LW_LET_SUB, Aug 16 2004, Loren Wilton #counts SARE_SUB_LET 124s/8h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_LET 209s/4h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_LET 24s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_LET 31s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_LET 1s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #max SARE_SUB_LET 5s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_SUB_LET 27s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_LET 59s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 header SARE_SUB_MSG_SUBJ Subject =~ /(?!message\n)^\W*(?:message\W+(?:subject|notification)|(?:new\W+)?(?:private\W+)?message)\W*$/i describe SARE_SUB_MSG_SUBJ subject is generic/default spammer subject score SARE_SUB_MSG_SUBJ 0.922 #stype SARE_SUB_MSG_SUBJ spamp #hist SARE_SUB_MSG_SUBJ Created by Bob Menschel Aug 10 2004, enhanced Aug 12 2004 #counts SARE_SUB_MSG_SUBJ 85s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_MSG_SUBJ 216s/0h of 280564 corpus (109285s/171279h RM) 05/03/05 #counts SARE_SUB_MSG_SUBJ 2s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_MSG_SUBJ 11s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_MSG_SUBJ 10s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_MSG_SUBJ 27s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #counts SARE_SUB_MSG_SUBJ 2s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_MSG_SUBJ 6s/1h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_MSG_SUBJ 28s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_MONEY Subject =~ /(?:(?:)(?:save|make)[ -].{0,30}money[ -](?:in|on|with)|(?:easy|free|grant|saving|with our|worth|(?:claim|keep) your) money|money machine|(?:money|earn).+secret|secret.+(?:money|earn))/i describe SARE_SUB_MONEY subject has likely spammer phrase or word score SARE_SUB_MONEY 0.623 #ham SARE_SUB_MONEY business email #hist SARE_SUB_MONEY Bob Menschel added some alternatives, Aug 28 2004, Sep 28 #counts SARE_SUB_MONEY 218s/29h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_MONEY 291s/13h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_MONEY 12s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_MONEY 43s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_MONEY 5s/1h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_MONEY 3s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_MONEY 72s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #counts SARE_SUB_MONEY 21s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 header SARE_SUB_NO Subject =~ /^no (?:appoint|more |need|pres|prior|stress home)/i describe SARE_SUB_NO Subject matches common spam pattern score SARE_SUB_NO 0.669 #hist SARE_SUB_NO LW_NO_SUB, Aug 16 2004, Loren Wilton #counts SARE_SUB_NO 108s/12h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_NO 236s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_NO 1s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_NO 11s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_NO 35s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_NO 24s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_NO 5s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_NO 43s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_NO 61s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_NO 13s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_NO 58s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_PERFECT Subject =~ /\bperfect\W*(?:body|chart|credit|gift|home|loan|match|mate|pharmacy|soft\W*ware|solution|source|summer|time|tool|travel|valentine)/i describe SARE_SUB_PERFECT subject has likely spammer phrase or word score SARE_SUB_PERFECT 0.725 #ham SARE_SUB_PERFECT "perfect valentine" and "perfect match" #counts SARE_SUB_PERFECT 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PERFECT 278s/3h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PERFECT 53s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_PERFECT 8s/1h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_PERFECT 0s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_PERFECT 13s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_PROVEN Subject =~ /\bproven\b/i describe SARE_SUB_PROVEN subject has likely spammer phrase or word score SARE_SUB_PROVEN 0.618 #ham SARE_SUB_PROVEN confirmed (2) #counts SARE_SUB_PROVEN 144s/28h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PROVEN 176s/6h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PROVEN 2s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_PROVEN 5s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_PROVEN 9s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_PROVEN 80s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PROVEN 25s/1h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_PROVEN 9s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_PROVEN 20s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_PROVEN 43s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PROVEN 27s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_PROVEN 30s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_SURVEY Subject =~ /(?:campaign|Fill\W*out|questions|rated.{1,30}by\W*a|short|simple|tak(e|ing)|womens)\W*survey|survey\W*(?:opportunity|says)/ describe SARE_SUB_SURVEY subject has likely spammer phrase or word score SARE_SUB_SURVEY 0.878 #ham SARE_SUB_SURVEY From valid survey company: A short survey about your investments #counts SARE_SUB_SURVEY 16s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_SURVEY 91s/2h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_SURVEY 5s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_SURVEY 14s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_SURVEY 2s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_SURVEY 21s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #counts SARE_SUB_SURVEY 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_SURVEY 1s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 header SARE_SUB_WHILE_U_CAN Subject =~ /While (?:U|You) Can/i describe SARE_SUB_WHILE_U_CAN Subject contains apparent spammer phrasing score SARE_SUB_WHILE_U_CAN 0.900 #ham SARE_SUB_WHILE_U_CAN verified (1) #hist SARE_SUB_WHILE_U_CAN Created by Bob Menschel Sep 4 2004 #counts SARE_SUB_WHILE_U_CAN 103s/1h of 428457 corpus (182181s/246276h RM) 12/24/05 #counts SARE_SUB_WHILE_U_CAN 3s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_WHILE_U_CAN 0s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_WHILE_U_CAN 1s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_WHILE_U_CAN 18s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_WHILE_U_CAN 23s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_WHILE_U_CAN 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Technical spamsign ######## ###################### ################################################## header SARE_SUB_CASH_CHAR Subject =~ /[a-zA-Z]\$[a-zA-Z]/ describe SARE_SUB_CASH_CHAR Subject has letter then $ then letter score SARE_SUB_CASH_CHAR 0.747 #ham SARE_SUB_CASH_CHAR WAR$HEEP #counts SARE_SUB_CASH_CHAR 1050s/12h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_CASH_CHAR 1878s/4h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_CASH_CHAR 29s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_CASH_CHAR 111s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_CASH_CHAR 83s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_CASH_CHAR 9s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_CASH_CHAR 49s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_CASH_CHAR 82s/28h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_CASH_CHAR 0s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_CASH_CHAR 20s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_COMMA_FIRST Subject =~ /^,/ describe SARE_SUB_COMMA_FIRST Subject starts with a Comma. score SARE_SUB_COMMA_FIRST 1.330 #ham SARE_SUB_COMMA_FIRST verified (1) #counts SARE_SUB_COMMA_FIRST 332s/1h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_COMMA_FIRST 598s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_COMMA_FIRST 6s/1h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_COMMA_FIRST 11s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_COMMA_FIRST 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_COMMA_FIRST 68s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #counts SARE_SUB_COMMA_FIRST 0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_SUB_COMMA_FIRST 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_DASH_ONLY Subject =~ /^\s*-\s*$/ describe SARE_SUB_DASH_ONLY one non-alphanum in subject; no words score SARE_SUB_DASH_ONLY 2.500 #stype SARE_SUB_DASH_ONLY spamg #hist SARE_SUB_DASH_ONLY Created by Bob Menschel May 31 2004 #counts SARE_SUB_DASH_ONLY 2s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_DASH_ONLY 19s/0h of 67058 corpus (41838s/25220h RM) 09/04/04 #counts SARE_SUB_DASH_ONLY 6s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_DASH_ONLY 0s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_DASH_ONLY 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_DDCC Subject =~ /^\d\d\s+-\s+[A-Z]{2}\s/ describe SARE_SUB_DDCC subject has obvious spamsign score SARE_SUB_DDCC 1.111 #stype SARE_SUB_DDCC spamp #hist SARE_SUB_DDCC Created by Bob Menschel Aug 12 2004 #counts SARE_SUB_DDCC 0s/0h of 196667 corpus (96194s/100473h RM) 02/21/05 #max SARE_SUB_DDCC 41s/0h of 69842 corpus (42682s/27160h RM) 09/26/04 #counts SARE_SUB_DDCC 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_DDCC 8s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_DDCC 0s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_DDCC 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_MCFWD Subject =~ /FwD:/ describe SARE_SUB_MCFWD apparent spam/virus sign in subject score SARE_SUB_MCFWD 1.111 #stype SARE_SUB_MCFWD spamp #hist SARE_SUB_MCFWD Created by Bob Menschel May 27 2004 #counts SARE_SUB_MCFWD 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_MCFWD 10s/0h of 92315 corpus (67942s/24373h RM) 07/24/04 #counts SARE_SUB_MCFWD 1s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_MCFWD 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_MCFWD 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_PCT_LETTER Subject =~ /%[A-Z]\b/i describe SARE_SUB_PCT_LETTER subject has random-text spamsign score SARE_SUB_PCT_LETTER 0.784 #hist SARE_SUB_PCT_LETTER Feb 2005: added bound, forcing match to solo letter. #counts SARE_SUB_PCT_LETTER 689s/9h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PCT_LETTER 1407s/27h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PCT_LETTER 8s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_PCT_LETTER 62s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_PCT_LETTER 49s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PCT_LETTER 6s/10h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PCT_LETTER 1s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_PCT_LETTER 43s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_PCT_LETTER 9s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_PCT_LETTER 69s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 # EOF # SARE "General Subject" Ruleset for SpamAssassin - File 2 # Version: 01.03.12 # Created: 2004-09-13 # Modified: 2005-12-27 # Usage instructions and documentation are found in 70_sare_genlsubj0.cf #@@# Revision History: Full Revision History stored in 70_sare_genlsubj.log #@@# 01.03.12: Dec 27 2005 #@@# Minor score updates based on additional mass-check #@@# Archived from file 2: SARE_SUB_ADV_DB #@@# Archived from file 2: SARE_SUB_CARD_BILLED #@@# Moved file 0 to file 2: SARE_SUB_LEGAL_ORDIN #@@# Moved file 0 to file 2: SARE_SUB_ORIG_SOFT #@@# Moved file 0 to file 2: SARE_SUB_SEX_EXP_GAP #@@# Moved file 1 to file 2: SARE_HEAD_ORG_ELITEACT #@@# Moved file 1 to file 2: SARE_SUB_FREE_BANG #@@# Moved file 1 to file 2: SARE_SUB_YOUR_WOMAN #@@# Moved file 2 to file 1: SARE_SUB_REPAIR_BILLS ######## ###################### ################################################## # Category: __rules used by primary rules below ######## ###################### ################################################## # Attempt to identify simple subject obfuscation by character insertion header __SARE_SUB_OBFU_ASTER Subject =~ /[a-zA-Z0]\*[a-zA-Z]/ header __SARE_SUB_OBFU_CARAT Subject =~ /[a-zA-Z0]\^[a-zA-Z]/ header __SARE_SUB_OBFU_COLON Subject =~ /[a-zA-Z0]:[a-zA-Z]/ header __SARE_SUB_OBFU_COMMA Subject =~ /[a-zA-Z0],[a-zA-Z]/ header __SARE_SUB_OBFU_SLASH Subject =~ /[a-zA-Z0]\/[a-zA-Z]/ header __SARE_SUB_OBFU_LQUOT Subject =~ /[a-zA-Z0]`[a-zA-Z]/ header __SARE_SUB_OBFU_PERIOD Subject =~ /[a-zA-Z0]\.[a-zA-Z]/ header __SARE_SUB_OBFU_2PER Subject =~ /[a-zA-Z0]\.\.[a-zA-Z]/ header __SARE_SUB_OBFU_PIPE Subject =~ /[a-zA-Z0]\|[a-zA-Z]/ header __SARE_SUB_OBFU_PLUS Subject =~ /[a-zA-Z0]\+[a-zA-Z]/ header __SARE_SUB_OBFU_QUOTE Subject =~ /[a-zA-Z0]"[a-zA-Z]/ header __SARE_SUB_OBFU_SCOLON Subject =~ /[a-zA-Z0];[a-zA-Z]/ header __SARE_SUB_OBFU_USCORE Subject =~ /[a-zA-Z0]_[a-zA-Z]/ header __SARE_SUB_OBFU_HTTP Subject =~ m*http://*i ######## ###################### ################################################## # Rule definitions to avoid --lint errors on archived/moved rules. ######## ###################### ################################################## meta __SARE_SUB_FALSE __FROM_AOL_COM && !__FROM_AOL_COM meta SARE_SUB_CARTRIDGE_OB __SARE_SUB_FALSE meta SARE_SUB_EXCL_OB __SARE_SUB_FALSE meta SARE_SUB_GAPPY_7 __SARE_SUB_FALSE meta SARE_SUB_GAPPY_8 __SARE_SUB_FALSE meta SARE_SUB_PASSION_OB __SARE_SUB_FALSE meta SARE_SUB_PRINTER_OB __SARE_SUB_FALSE meta SARE_SUB_PROVEN_OB __SARE_SUB_FALSE meta SARE_SUB_TONER_OB __SARE_SUB_FALSE meta SARE_SUB_ADV_DB __SARE_SUB_FALSE meta SARE_SUB_CARD_BILLED __SARE_SUB_FALSE ######## ###################### ################################################## # Category: Adult/Porn ######## ###################### ################################################## header SARE_SUB_SEX_EXP_GAP Subject =~ m'sexually - explicit'i describe SARE_SUB_SEX_EXP_GAP CANSPAM variation score SARE_SUB_SEX_EXP_GAP 1.666 #stype SARE_SUB_SEX_EXP_GAP spamg #counts SARE_SUB_SEX_EXP_GAP 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_SEX_EXP_GAP 6s/0h of 196667 corpus (96194s/100473h RM) 02/21/05 #counts SARE_SUB_SEX_EXP_GAP 0s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_SEX_EXP_GAP 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #counts SARE_SUB_SEX_EXP_GAP 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Black market items, services, activities, scams, frauds ######## ###################### ################################################## ######## ###################### ################################################## # Category: Credit, debt, lending, mortgage, borrowing, investment, financing ######## ###################### ################################################## header SARE_SUB_VISA_CARD Subject =~ /Visa\W*(?:card\W*easy|approve\W*all)/i describe SARE_SUB_VISA_CARD Spammer subject - credit or money score SARE_SUB_VISA_CARD 0.277 #hist SARE_SUB_VISA_CARD Created by Bob Menschel Mar 30 2004 #counts SARE_SUB_VISA_CARD 0s/0h of 238420 corpus (112480s/125940h RM) 02/28/05 #max SARE_SUB_VISA_CARD 4s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_VISA_CARD 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_VISA_CARD 1s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_VISA_CARD 0s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_VISA_CARD 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Insurance ######## ###################### ################################################## ######## ###################### ################################################## # Category: Marketing, Pricing, Selling, Buying ######## ###################### ################################################## header SARE_SUB_FREE_BANG Subject =~ /\bFree\!/i describe SARE_SUB_FREE_BANG Spammer subject - marketing score SARE_SUB_FREE_BANG 0.700 #stype SARE_SUB_FREE_BANG max:1.0 #ham SARE_SUB_FREE_BANG Dell, Visicom Media #counts SARE_SUB_FREE_BANG 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_FREE_BANG 422s/21h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_FREE_BANG 32s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_FREE_BANG 47s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_FREE_BANG 0s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_FREE_BANG 16s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_FREE_BANG 0s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #max SARE_SUB_FREE_BANG 2s/1h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_SUB_FREE_BANG 0s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_FREE_BANG 133s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 header SARE_SUB_HOT_PROFITS Subject =~ /Hot Profits/i describe SARE_SUB_HOT_PROFITS Subject contains apparent spammer phrasing score SARE_SUB_HOT_PROFITS 0.389 #hist SARE_SUB_HOT_PROFITS Created by Bob Menschel May 31 2004 #counts SARE_SUB_HOT_PROFITS 0s/0h of 291031 corpus (121442s/169589h RM) 04/22/05 #max SARE_SUB_HOT_PROFITS 3s/0h of 58648 corpus (33783s/24865h RM) 08/03/04 #counts SARE_SUB_HOT_PROFITS 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_HOT_PROFITS 2s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_HOT_PROFITS 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_HOT_PROFITS 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_HOT_PROFITS 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_HOT_PROFITS 1s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Medical ######## ###################### ################################################## header __SARE_SUB_LOSE_PCT Subject =~ /lose.{1,20}(?:\d+\%.{1,25}weight|weight.{1,40}\d+\%)/i meta SARE_SUB_LOSE_PCT1 __SARE_SUB_LOSE_PCT && !SUBJECT_DIET describe SARE_SUB_LOSE_PCT1 Common spammer subject header -- Medical score SARE_SUB_LOSE_PCT1 1.666 #hist SARE_SUB_LOSE_PCT1 Created by Bob Menschel from suggested by Loren Wilton, July 24 2004 #hist SARE_SUB_LOSE_PCT1 Bugzilla entry 3863, Oct 03 2004 #v300 SARE_SUB_LOSE_PCT1 Strong overlap with 3.0 subject rule SUBJECT_DIET, though SUBJECT_DIET does not test for "%" #counts SARE_SUB_LOSE_PCT1 0s/0h of 115424 corpus (81069s/34355h RM) 01/16/05 #counts SARE_SUB_LOSE_PCT1 0s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_LOSE_PCT1 150s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #alone SARE_SUB_LOSE_PCT1 106s/0h of 196667 corpus (96194s/100473h RM) 02/21/05 #counts SARE_SUB_LOSE_PCT1 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_LOSE_PCT1 24s/0h of 16895 corpus (14482s/2413h MY) 07/26/04 #counts SARE_SUB_LOSE_PCT1 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 meta SARE_SUB_LOSE_PCT2 __SARE_SUB_LOSE_PCT && SUBJECT_DIET describe SARE_SUB_LOSE_PCT2 Common spammer subject header -- Medical score SARE_SUB_LOSE_PCT2 0.311 0.943 1.607 1.400 #adds to SARE_SUB_LOSE_PCT2 score SUBJECT_DIET 1.355 0.723 0.059 0.266 to result in 1.666 #hist SARE_SUB_LOSE_PCT2 Created by Bob Menschel to avoid over-scoring overlap with new 3.0 rule #v300 SARE_SUB_LOSE_PCT2 Strong overlap with 3.0 subject rule SUBJECT_DIET, though SUBJECT_DIET does not test for "%" #counts SARE_SUB_LOSE_PCT2 0s/0h of 280564 corpus (109285s/171279h RM) 05/03/05 #alone SARE_SUB_LOSE_PCT2 1679s/0h of 115424 corpus (81069s/34355h RM) 01/16/05 #counts SARE_SUB_LOSE_PCT2 114s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #counts SARE_SUB_LOSE_PCT2 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_LOSE_PCT2 51s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_LOSE_PCT2 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Religious, including religious scams ######## ###################### ################################################## header SARE_SUB_LEGAL_ORDIN Subject =~ /(?:(?:LEGAL|online)\W*ORDINATION|proceed\W*with.{1,30}ordination)/i describe SARE_SUB_LEGAL_ORDIN Spammer subject - religion score SARE_SUB_LEGAL_ORDIN 0.700 #counts SARE_SUB_LEGAL_ORDIN 0s/0h of 280564 corpus (109285s/171279h RM) 05/03/05 #max SARE_SUB_LEGAL_ORDIN 15s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_LEGAL_ORDIN 0s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_LEGAL_ORDIN 2s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_LEGAL_ORDIN 0s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_LEGAL_ORDIN 9s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_LEGAL_ORDIN 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Software ######## ###################### ################################################## header SARE_SUB_ORIG_SOFT Subject =~ /\boriginal softwares?\b/i describe SARE_SUB_ORIG_SOFT subject has a spammer subject - Software score SARE_SUB_ORIG_SOFT 1.078 #hist SARE_SUB_ORIG_SOFT Created by Bob Menschel Jul 31 2004 #hist SARE_SUB_ORIG_SOFT Bound \b Jan 27 2005 to avoid overlap with SARE_SUB_ORIG_SOFT_OB #counts SARE_SUB_ORIG_SOFT 0s/0h of 196667 corpus (96194s/100473h RM) 02/21/05 #max SARE_SUB_ORIG_SOFT 65s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_ORIG_SOFT 14s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_ORIG_SOFT 19s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_ORIG_SOFT 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_ORIG_SOFT 10s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_ORIG_SOFT 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_SW_ON_CD Subject =~ /software\W*(?:on\W*)CD/i describe SARE_SUB_SW_ON_CD Spammer subject - software score SARE_SUB_SW_ON_CD 0.628 #hist SARE_SUB_SW_ON_CD Created by Bob Menschel Apr 09 2004 #counts SARE_SUB_SW_ON_CD 0s/0h of 196665 corpus (96196s/100469h RM) 02/21/05 #max SARE_SUB_SW_ON_CD 7s/0h of 92315 corpus (67942s/24373h RM) 07/24/04 #counts SARE_SUB_SW_ON_CD 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_SW_ON_CD 3s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_SW_ON_CD 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_SW_ON_CD 3s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_SW_ON_CD 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_WP_OFFICE Subject =~ /(?:\%|Sav(?:e|ing)).{1,30}(?:Corel|WordPerfect).{1,30}Office/i describe SARE_SUB_WP_OFFICE Spammer subject - software score SARE_SUB_WP_OFFICE 0.777 #counts SARE_SUB_WP_OFFICE 0s/0h of 280564 corpus (109285s/171279h RM) 05/03/05 #max SARE_SUB_WP_OFFICE 22s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_WP_OFFICE 0s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_WP_OFFICE 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_WP_OFFICE 18s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_WP_OFFICE 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Spamming and Spammers ######## ###################### ################################################## header SARE_HEAD_ORG_ELITEACT Organization =~ /Elite Activity/i describe SARE_HEAD_ORG_ELITEACT Spam sign in Organization header score SARE_HEAD_ORG_ELITEACT 0.111 #hist SARE_HEAD_ORG_ELITEACT Bob Menschel, Feb 27 2005 #counts SARE_HEAD_ORG_ELITEACT 0s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_HEAD_ORG_ELITEACT 2s/0h of 400644 corpus (178197s/222447h RM) 04/02/05 #counts SARE_HEAD_ORG_ELITEACT 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_HEAD_ORG_ELITEACT 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 ######## ###################### ################################################## # Category: Generic words and phrases ######## ###################### ################################################## header SARE_SUB_PERS_KNOW Subject =~ /Person you know/i describe SARE_SUB_PERS_KNOW common spammer phrasing score SARE_SUB_PERS_KNOW 0.711 #hist SARE_SUB_PERS_KNOW Created by Bob Menschel Oct 25 2004 #counts SARE_SUB_PERS_KNOW 0s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_PERS_KNOW 20s/0h of 196667 corpus (96194s/100473h RM) 02/21/05 #counts SARE_SUB_PERS_KNOW 4s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_PERS_KNOW 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_PERS_KNOW 2s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_PERS_KNOW 0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_SUB_PERS_KNOW 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_YOUR_LISTING Subject =~ /^\s*your listing (?:at|on) /i describe SARE_SUB_YOUR_LISTING subject has a spammer subject - Listings score SARE_SUB_YOUR_LISTING 0.617 #hist SARE_SUB_YOUR_LISTING Created by Bob Menschel Jul 31 2004 #counts SARE_SUB_YOUR_LISTING 0s/0h of 238420 corpus (112480s/125940h RM) 02/28/05 #max SARE_SUB_YOUR_LISTING 10s/0h of 114228 corpus (81069s/33159h RM) 01/15/05 #counts SARE_SUB_YOUR_LISTING 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_YOUR_LISTING 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_YOUR_LISTING 0s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_YOUR_LISTING 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_YOUR_WOMAN Subject =~ /Your woman/i describe SARE_SUB_YOUR_WOMAN subject has likely spammer phrase or word score SARE_SUB_YOUR_WOMAN 1.666 #ham SARE_SUB_YOUR_WOMAN verified (1) #counts SARE_SUB_YOUR_WOMAN 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_YOUR_WOMAN 194s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_YOUR_WOMAN 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_YOUR_WOMAN 5s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_YOUR_WOMAN 3s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_YOUR_WOMAN 0s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_YOUR_WOMAN 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Technical rules ######## ###################### ################################################## # EOF # SARE "General Subject" Ruleset for SpamAssassin - File 3 # Version: 01.03.12 # Created: 2004-09-13 # Modified: 2005-12-27 # Usage instructions and documentation are found in 70_sare_genlsubj0.cf #@@# Revision History: Full Revision History stored in 70_sare_genlsubj.log #@@# 01.03.12: Dec 27 2005 #@@# Minor score updates based on additional mass-check #@@# Archived from file 3: SARE_SUB_SPECIAL_BANG #@@# Archived from file 3: SARE_SUB_TONER #@@# Moved file 0 to file 3: SARE_SUB_LINES_CREDIT, after splitting from SARE_SUB_NEW_CREDIT #@@# Moved file 1 to file 3: SARE_SUB_ALL_LEAD #@@# Moved file 1 to file 3: SARE_SUB_ASSIST #@@# Moved file 1 to file 3: SARE_SUB_CONFIDENTIAL #@@# Moved file 1 to file 3: SARE_SUB_DOLLARS #@@# Moved file 1 to file 3: SARE_SUB_FORECLOSURE #@@# Moved file 1 to file 3: SARE_SUB_FOREVER #@@# Moved file 1 to file 3: SARE_SUB_FREE_SAMPLE #@@# Moved file 1 to file 3: SARE_SUB_MORTGAGE #@@# Moved file 1 to file 3: SARE_SUB_PORN_WORD10 #@@# Moved file 1 to file 3: SARE_SUB_SEXY #@@# Moved file 1 to file 3: SARE_SUB_YOUNGER #@@# Moved file 3 to file 1: SARE_SUB_SURVEY #@@# Moved file 3 to file 4: SARE_SUB_BIGGER #@@# Moved file 3 to file 4: SARE_SUB_BULK_EMAIL #@@# Moved file 3 to file 4: SARE_SUB_GROW_BUSINESS ######## ###################### ################################################## # Rule definitions to avoid --lint errors on archived/moved rules. ######## ###################### ################################################## meta __SARE_SUB_FALSE __FROM_AOL_COM && !__FROM_AOL_COM meta SARE_SUB_WEBMASTER2 __SARE_SUB_FALSE meta SARE_SUB_LAST_CHANCE __SARE_SUB_FALSE meta SARE_SUB_THOU_CLI __SARE_SUB_FALSE meta SARE_SUB_BETTER __SARE_SUB_FALSE meta SARE_SUB_BRKING_NEWS __SARE_SUB_FALSE meta SARE_SUB_CHRISTIAN __SARE_SUB_FALSE meta SARE_SUB_COMMA_LEAD __SARE_SUB_FALSE meta SARE_SUB_FREE __SARE_SUB_FALSE meta SARE_SUB_SAVE_UP_TO __SARE_SUB_FALSE meta SARE_SUB_WIN __SARE_SUB_FALSE meta SARE_SUB_KICKBACK __SARE_SUB_FALSE meta SARE_SUB_DEBTS_COURT __SARE_SUB_FALSE meta SARE_SUB_ACQUISITION __SARE_SUB_FALSE meta SARE_SUB_FOR_WOMEN __SARE_SUB_FALSE meta SARE_SUB_AGING __SARE_SUB_FALSE meta SARE_SUB_CALL_NOW __SARE_SUB_FALSE meta SARE_SUB_EXCITING_NEW __SARE_SUB_FALSE meta SARE_SUB_LETTERS_NUMS __SARE_SUB_FALSE meta SARE_SUB_WEBMASTER __SARE_SUB_FALSE meta SARE_SUB_BETTER_OB1 __SARE_SUB_FALSE meta SARE_SUB_FREE_BANG __SARE_SUB_FALSE meta SARE_SUB_MEDICAL_NEWS __SARE_SUB_FALSE meta SARE_SUB_PERFECT __SARE_SUB_FALSE meta SARE_SUB_YOUR_WOMAN __SARE_SUB_FALSE meta SARE_SUB_BE_HERE __SARE_SUB_FALSE meta SARE_SUB_COPYDVD __SARE_SUB_FALSE meta SARE_SUB_INKJET __SARE_SUB_FALSE meta SARE_SUB_LOOKING_FOR __SARE_SUB_FALSE meta SARE_SUB_PHYSICIAN __SARE_SUB_FALSE meta SARE_SUB_PRICES_CAP __SARE_SUB_FALSE meta SARE_SUB_PROFILE __SARE_SUB_FALSE meta SARE_SUB_SAVE_PCT __SARE_SUB_FALSE meta SARE_SUB_STRONG __SARE_SUB_FALSE meta SARE_SUB_WINNER __SARE_SUB_FALSE meta SARE_SUB_TONER __SARE_SUB_FALSE meta SARE_SUB_SPECIAL_BANG __SARE_SUB_FALSE meta SARE_SUB_BIGGER __SARE_SUB_FALSE meta SARE_SUB_GROW_BUSINESS __SARE_SUB_FALSE meta SARE_SUB_BULK_EMAIL __SARE_SUB_FALSE ######## ###################### ################################################## # Category: __rules used by primary rules below ######## ###################### ################################################## # Attempt to identify simple subject obfuscation by character insertion header __SARE_SUB_OBFU_ASTER Subject =~ /[a-zA-Z0]\*[a-zA-Z]/ header __SARE_SUB_OBFU_CARAT Subject =~ /[a-zA-Z0]\^[a-zA-Z]/ header __SARE_SUB_OBFU_COLON Subject =~ /[a-zA-Z0]:[a-zA-Z]/ header __SARE_SUB_OBFU_COMMA Subject =~ /[a-zA-Z0],[a-zA-Z]/ header __SARE_SUB_OBFU_SLASH Subject =~ /[a-zA-Z0]\/[a-zA-Z]/ header __SARE_SUB_OBFU_LQUOT Subject =~ /[a-zA-Z0]`[a-zA-Z]/ header __SARE_SUB_OBFU_PERIOD Subject =~ /[a-zA-Z0]\.[a-zA-Z]/ header __SARE_SUB_OBFU_2PER Subject =~ /[a-zA-Z0]\.\.[a-zA-Z]/ header __SARE_SUB_OBFU_PIPE Subject =~ /[a-zA-Z0]\|[a-zA-Z]/ header __SARE_SUB_OBFU_PLUS Subject =~ /[a-zA-Z0]\+[a-zA-Z]/ header __SARE_SUB_OBFU_QUOTE Subject =~ /[a-zA-Z0]"[a-zA-Z]/ header __SARE_SUB_OBFU_SCOLON Subject =~ /[a-zA-Z0];[a-zA-Z]/ header __SARE_SUB_OBFU_USCORE Subject =~ /[a-zA-Z0]_[a-zA-Z]/ header __SARE_SUB_OBFU_HTTP Subject =~ m*http://*i ######## ###################### ################################################## # Category: Adult/Porn ######## ###################### ################################################## header SARE_SUB_NEXT_DOOR Subject =~ /n(?:ex|xe)t door/i describe SARE_SUB_NEXT_DOOR Adult spammer phrasing score SARE_SUB_NEXT_DOOR 0.102 #ham SARE_SUB_NEXT_DOOR confirmed (2) #hist SARE_SUB_NEXT_DOOR Richard Gray, Feb 21 2005 #counts SARE_SUB_NEXT_DOOR 6s/3h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_NEXT_DOOR 59s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_NEXT_DOOR 3s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_NEXT_DOOR 1s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_NEXT_DOOR 1s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_NEXT_DOOR 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_NEXT_DOOR 4s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_NEXT_DOOR 0s/2h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_NEXT_DOOR 10s/2h of 49034 corpus (44877s/4157h MY) 06/11/05 header SARE_SUB_PORN_WORD10 Subject =~ /\b(?:hstoett|o(?:the|teh|het|hte|eht|eth)r|stpuid|stupid|disgusting|shy|married|brand new|dirty|average|amateur|amatuer|amtauer|real|beautiful|hot|sexy|sxey|n(?:ast|ats|tas|tsa|sta|sat)y|wet|cute).{1,3}(?:(?:step|grand)?[\-_]?(?:mo|om)ms?|house[\-_]?wi[fvr]es?|(?:cow)?girls?|moms?|w(?:om[ae]|o[ae]m|[ae]om|[ae]mo|m[ae]o|mo[ae])n|neigbhour|neighbour|neighbuor|(?:teen|tnee)(?:ager|agre|arge)?s?|s(?:lu|ul)ts?|bitehcs|bitches)\b/i describe SARE_SUB_PORN_WORD10 Adult spammer words score SARE_SUB_PORN_WORD10 0.190 #ham SARE_SUB_PORN_WORD10 verified (many) #hist SARE_SUB_PORN_WORD10 Richard Gray, Feb 21 2005 #hist SARE_SUB_PORN_WORD10 Bob Menschel, Jun 12 2005 -- Added word boundaries #counts SARE_SUB_PORN_WORD10 77s/31h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PORN_WORD10 499s/3h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PORN_WORD10 9s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_PORN_WORD10 4s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_PORN_WORD10 14s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #counts SARE_SUB_PORN_WORD10 26s/20h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PORN_WORD10 17s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_PORN_WORD10 18s/10h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_PORN_WORD10 25s/10h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_PORN_WORD10 34s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PORN_WORD10 27s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_PORN_WORD10 95s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 ######## ###################### ################################################## # Category: Black market items, services, activities, scams, frauds ######## ###################### ################################################## header SARE_SUB_ASSIST Subject =~ /^\s*Assistance\s*$/i describe SARE_SUB_ASSIST Subject contains spammer subject - fraud/scam score SARE_SUB_ASSIST 0.139 #ham SARE_SUB_ASSIST verified (1) #hist SARE_SUB_ASSIST Created by Bob Menschel Jul 23 2004 #counts SARE_SUB_ASSIST 5s/1h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_ASSIST 26s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_ASSIST 0s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_ASSIST 1s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_ASSIST 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_ASSIST 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Credit, debt, lending, mortgage, borrowing, investment, financing ######## ###################### ################################################## header SARE_SUB_DEBT Subject =~ /\bdebt\b/i describe SARE_SUB_DEBT Spammer subject - credit or money score SARE_SUB_DEBT 0.662 #ham SARE_SUB_DEBT "Asians on Tsunami Relief: Drop the Debt" and related, social issues newsletters #counts SARE_SUB_DEBT 427s/28h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_DEBT 829s/55h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_DEBT 1s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_DEBT 19s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_DEBT 24s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_DEBT 63s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_DEBT 5s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_DEBT 7s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_DEBT 73s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_DEBT 6s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_DEBT 30s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_DEBT 216s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_INVESTMENTS Subject =~ /(?:(?:invest(?:ing|ments?|or)|promotion|stock\W*market).(?:alert|assistance|bulletin|data|forecast|funds|insight|knowledge|like|member|news|opp|option|profile|program|proposal|rewards|surprise|update|workshop)|(?:\$\d+.{0,10}|better.{0,30}|business|easy|fund.{0,30}|joint|make\W*an|proven|real\W*estate|secrets?.{0,30}|secured|smart|stock|time\W*to|your|zero)\W*invest(?:ing|ments?)|help.{1,10}invest)/i describe SARE_SUB_INVESTMENTS Spammer subject - credit or money score SARE_SUB_INVESTMENTS 0.632 #ham SARE_SUB_INVESTMENTS "A short survey about your investments" from valid survey company, to survey member #counts SARE_SUB_INVESTMENTS 290s/44h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_INVESTMENTS 355s/12h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_INVESTMENTS 3s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_INVESTMENTS 55s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_INVESTMENTS 3s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_INVESTMENTS 28s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_INVESTMENTS 19s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_INVESTMENTS 28s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_INVESTMENTS 5s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_INVESTMENTS 38s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_INVESTMENTS 2s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_SUB_INVESTMENTS 4s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 header SARE_SUB_INVESTORS Subject =~ /investors/i describe SARE_SUB_INVESTORS Spammer subject - credit or money score SARE_SUB_INVESTORS 0.473 #ham SARE_SUB_INVESTORS Washington Post newsletter #counts SARE_SUB_INVESTORS 246s/51h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_INVESTORS 1024s/21h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_INVESTORS 10s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_INVESTORS 9s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_INVESTORS 27s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_INVESTORS 54s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_INVESTORS 4s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_INVESTORS 46s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_INVESTORS 54s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #counts SARE_SUB_INVESTORS 20s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 header SARE_SUB_LINES_CREDIT Subject =~ /lines?\W*of\W*credit/i describe SARE_SUB_LINES_CREDIT Spammer subject - credit or money score SARE_SUB_LINES_CREDIT 0.222 #ham SARE_SUB_LINES_CREDIT email from BofA to customers #counts SARE_SUB_LINES_CREDIT 55s/13h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_LINES_CREDIT 74s/8h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_LINES_CREDIT 9s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_LINES_CREDIT 0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_LINES_CREDIT 0s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_SUB_LINES_CREDIT 1s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_LINES_CREDIT 1s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 header SARE_SUB_MORTGAGE Subject =~ /(?:(?:\%|2nd|best|competitive|easy|EZ|fixed|for\W*your|great|home|instant|loans\W*and|lowest|\bno|online|rate|second)..?mortgage|mortgages?\W*(?:broker|gone|hunt|interest|lead|loan|notif(?:ication|y)|quote|r.?[a\@].?t.?e.?s?|refinanc(?:e|ing)|shopping|too\W*high|verification)|mortgage.{1,30}reduced|(?:\$\d|compete|find|pay(ing|ment)|qualify|search|shopping).{1,30}mortgage)/i describe SARE_SUB_MORTGAGE Spammer subject - credit or money score SARE_SUB_MORTGAGE 0.367 #hist SARE_SUB_MORTGAGE removed "mortgage manager", used in email from user's bank #ham SARE_SUB_MORTGAGE Mortgage Rates #counts SARE_SUB_MORTGAGE 196s/65h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_MORTGAGE 813s/24h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_MORTGAGE 6s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_MORTGAGE 18s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_MORTGAGE 73s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_MORTGAGE 12s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_MORTGAGE 32s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_MORTGAGE 64s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_MORTGAGE 152s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_MORTGAGE 17s/3h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_MORTGAGE 31s/3h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 ######## ###################### ################################################## # Category: Gambling, Lotto, Sweepstakes, Winnings, Losses ######## ###################### ################################################## header SARE_SUB_CASINO Subject =~ /\bc[a\@]sin[o0]/i describe SARE_SUB_CASINO Spammer subject - gambling score SARE_SUB_CASINO 0.555 #stype SARE_SUB_CASINO max:0.555 #hist SARE_SUB_CASINO score max set to 0.555 to keep in line with other rules with similar hit rates #counts SARE_SUB_CASINO 131s/14h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_CASINO 163s/26h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_CASINO 4s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_CASINO 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_CASINO 147s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_CASINO 1s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_CASINO 1s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_CASINO 53s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_CASINO 75s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_CASINO 21s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_CASINO 80s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 ######## ###################### ################################################## # Category: Insurance ######## ###################### ################################################## header SARE_SUB_CAR_INSURANCE Subject =~ /(?:car|auto(?:mobile)?) insurance/i describe SARE_SUB_CAR_INSURANCE Spammer subject - insurance score SARE_SUB_CAR_INSURANCE 0.625 #ham SARE_SUB_CAR_INSURANCE adv in subcribed opt-in newsletter (1) #counts SARE_SUB_CAR_INSURANCE 151s/17h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_CAR_INSURANCE 266s/25h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_CAR_INSURANCE 1s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_CAR_INSURANCE 0s/1h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_CAR_INSURANCE 41s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_CAR_INSURANCE 3s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_CAR_INSURANCE 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_CAR_INSURANCE 2s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_CAR_INSURANCE 4s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_CAR_INSURANCE 38s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_CAR_INSURANCE 45s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 ######## ###################### ################################################## # Category: Marketing, Pricing, Selling, Buying ######## ###################### ################################################## header SARE_SUB_AS_LOW_AS Subject =~ /as low as/i describe SARE_SUB_AS_LOW_AS Subject contains apparent spammer phrasing score SARE_SUB_AS_LOW_AS 0.115 #hist SARE_SUB_AS_LOW_AS RM_spc_AsLowAs #counts SARE_SUB_AS_LOW_AS 8s/36h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_AS_LOW_AS 226s/12h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_AS_LOW_AS 1s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_AS_LOW_AS 19s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_AS_LOW_AS 3s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_AS_LOW_AS 31s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_AS_LOW_AS 164s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_AS_LOW_AS 16s/1h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_AS_LOW_AS 19s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04 #counts SARE_SUB_AS_LOW_AS 1s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_AS_LOW_AS 7s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_BETTER_DEAL Subject =~ /better deal/i describe SARE_SUB_BETTER_DEAL common spammer phrasing score SARE_SUB_BETTER_DEAL 0.458 #hist SARE_SUB_BETTER_DEAL Created by Bob Menschel Apr 04 2004 #ham SARE_SUB_BETTER_DEAL Washington Post email newsletter #counts SARE_SUB_BETTER_DEAL 23s/3h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_BETTER_DEAL 10s/1h of 102867 corpus (66500s/36367h RM) 12/07/04 #counts SARE_SUB_BETTER_DEAL 4s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_BETTER_DEAL 5s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_BETTER_DEAL 8s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_BETTER_DEAL 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_BETTER_DEAL 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_CURRENT_NEWS Subject =~ /^(?:\[[^\]]+\])\s*Current News\s*$/i describe SARE_SUB_CURRENT_NEWS Spammer phrasing - Marketing score SARE_SUB_CURRENT_NEWS 0.555 #stype SARE_SUB_CURRENT_NEWS spamp #hist SARE_SUB_CURRENT_NEWS Bob Menschel, June 18 2005 #counts SARE_SUB_CURRENT_NEWS 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_CURRENT_NEWS 5s/0h of 314117 corpus (149011s/165106h RM) 06/19/05 #counts SARE_SUB_CURRENT_NEWS 1s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_CURRENT_NEWS 0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_CURRENT_NEWS 0s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 ######## ###################### ################################################## # Category: Medical ######## ###################### ################################################## header SARE_SUB_CONSULTATION Subject =~ /\bconsultations?\b/i describe SARE_SUB_CONSULTATION Spammer subject - medical score SARE_SUB_CONSULTATION 0.297 #ham SARE_SUB_CONSULTATION Job.com CareerTools #counts SARE_SUB_CONSULTATION 27s/19h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_CONSULTATION 334s/48h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_CONSULTATION 5s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_CONSULTATION 24s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_CONSULTATION 50s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_CONSULTATION 7s/6h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_CONSULTATION 26s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_CONSULTATION 37s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_CONSULTATION 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_CONSULTATION 4s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 header SARE_SUB_FREE_SAMPLE Subject =~ /\bf.?r.?e.?e.?\s+s.?a.?m.?p.?l.?e/i describe SARE_SUB_FREE_SAMPLE Common spammer subject header -- Medical score SARE_SUB_FREE_SAMPLE 0.422 #ham SARE_SUB_FREE_SAMPLE confirmed (1) #hist SARE_SUB_FREE_SAMPLE Created by Bob Menschel Aug 20 2004 #counts SARE_SUB_FREE_SAMPLE 40s/9h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_FREE_SAMPLE 35s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_FREE_SAMPLE 19s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_FREE_SAMPLE 1s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #max SARE_SUB_FREE_SAMPLE 10s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04 #counts SARE_SUB_FREE_SAMPLE 15s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #counts SARE_SUB_FREE_SAMPLE 1s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_FREE_SAMPLE 4s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_YOUNGER Subject =~ /\bYOUNGER\b/i describe SARE_SUB_YOUNGER Spammer subject - medical score SARE_SUB_YOUNGER 0.258 #ham SARE_SUB_YOUNGER confirmed (5) Some from AARP #counts SARE_SUB_YOUNGER 35s/21h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_YOUNGER 217s/13h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_YOUNGER 2s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_YOUNGER 4s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_YOUNGER 24s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_YOUNGER 2s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_YOUNGER 5s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_YOUNGER 10s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_YOUNGER 21s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_YOUNGER 9s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_YOUNGER 54s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 ######## ###################### ################################################## # Category: Real Estate ######## ###################### ################################################## header SARE_SUB_FORECLOSURE Subject =~ /Foreclosure/i describe SARE_SUB_FORECLOSURE Spammer subject - real estate score SARE_SUB_FORECLOSURE 0.470 #ham SARE_SUB_FORECLOSURE emails discussing a foreclosure #counts SARE_SUB_FORECLOSURE 93s/27h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_FORECLOSURE 280s/9h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_FORECLOSURE 32s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_FORECLOSURE 9s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_FORECLOSURE 1s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_FORECLOSURE 8s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_FORECLOSURE 57s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_FORECLOSURE 104s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_FORECLOSURE 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Software ######## ###################### ################################################## header SARE_SUB_DOWNLOAD Subject =~ /(?:downloadable\W*software|(?:available\W*for|cds\W*(?:and|or)|easy|free\W*to)\W*download|download(?:ing)\W*(?:(?:for\W*)?free|games|movies|music|now|software|under|video))/i describe SARE_SUB_DOWNLOAD Spammer subject - software score SARE_SUB_DOWNLOAD 0.182 #counts SARE_SUB_DOWNLOAD 76s/8h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_DOWNLOAD 101s/3h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_DOWNLOAD 4s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_DOWNLOAD 6s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_DOWNLOAD 15s/18h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_DOWNLOAD 14s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_DOWNLOAD 10s/1h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_DOWNLOAD 19s/1h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_DOWNLOAD 3s/2h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_DOWNLOAD 26s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_DOWNLOAD 0s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #max SARE_SUB_DOWNLOAD 1s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 ######## ###################### ################################################## # Category: Spamming and Spammers ######## ###################### ################################################## ######## ###################### ################################################## # Category: Generic words and phrases ######## ###################### ################################################## header SARE_SUB_ALL_LEAD Subject =~ /^All\s/ # no /i describe SARE_SUB_ALL_LEAD Subject matches common spam pattern score SARE_SUB_ALL_LEAD 0.199 #hist SARE_SUB_ALL_LEAD LW_ALL_SUB, Aug 16 2004, Loren Wilton #counts SARE_SUB_ALL_LEAD 134s/73h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_ALL_LEAD 613s/53h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_ALL_LEAD 22s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_ALL_LEAD 56s/1h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_ALL_LEAD 8s/1h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_ALL_LEAD 43s/2h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_ALL_LEAD 50s/2h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_ALL_LEAD 23s/2h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 header SARE_SUB_BOOST Subject =~ /(?:boost.{1,20}(?:(?:cable|PC).{1,10}speed|confidence|in\W*bed|(?:love|se.?x)\W*life|mileage|size|stamina)|(?:manhood|muscle|sex|super).{0,30}boost)/i describe SARE_SUB_BOOST subject has likely spammer phrase or word score SARE_SUB_BOOST 0.661 #ham SARE_SUB_BOOST boost your Mileage Plus balance (United Airlines), July 2005 #counts SARE_SUB_BOOST 42s/3h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_BOOST 244s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_BOOST 1s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_BOOST 3s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_BOOST 1s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_BOOST 2s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_BOOST 6s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_BOOST 17s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_BOOST 21s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_BOOST 0s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_BOOST 17s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_BREAKTHRU Subject =~ /Breakthrough/i describe SARE_SUB_BREAKTHRU subject has likely spammer phrase or word score SARE_SUB_BREAKTHRU 0.224 #counts SARE_SUB_BREAKTHRU 62s/26h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_BREAKTHRU 73s/37h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_BREAKTHRU 0s/1h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_BREAKTHRU 5s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #counts SARE_SUB_BREAKTHRU 29s/1h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_BREAKTHRU 5s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_BREAKTHRU 13s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_BREAKTHRU 15s/3h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_BREAKTHRU 39s/3h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_BREAKTHRU 5s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_BREAKTHRU 8s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 header SARE_SUB_CARTRIDGE Subject =~/Cartridge/i describe SARE_SUB_CARTRIDGE subject has likely spammer phrase or word score SARE_SUB_CARTRIDGE 0.312 #counts SARE_SUB_CARTRIDGE 131s/29h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_CARTRIDGE 276s/36h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_CARTRIDGE 1s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_CARTRIDGE 1s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_CARTRIDGE 4s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_CARTRIDGE 50s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_CARTRIDGE 1s/1h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_CARTRIDGE 2s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_CARTRIDGE 29s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_CARTRIDGE 94s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_CARTRIDGE 3s/8h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 header SARE_SUB_CONFIDENTIAL Subject =~ /(?:confidential.+\b(?:assist|assured|brand|business|delivery|discreet|embarrass|info|med(?:icine)?|offer|opportunity|orders|prescription|shopping|stock)|(?:assistance|business|mutual|priv(?:at)?e|relationship|strict?ly|urgent).+confiden[tc]ial|\bconfidant\b|can i confide|Fwd: Confidential)/i describe SARE_SUB_CONFIDENTIAL subject has likely spammer phrase or word score SARE_SUB_CONFIDENTIAL 0.538 #hist SARE_SUB_CONFIDENTIAL SARE_SUB_CONFID_P and SARE_SUB_CONF_INFO merged and renamed July 24 2004 #ham SARE_SUB_CONFIDENTIAL organization's emails flagged: "- confidential" #counts SARE_SUB_CONFIDENTIAL 75s/10h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_CONFIDENTIAL 163s/6h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_CONFIDENTIAL 2s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_CONFIDENTIAL 3s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_CONFIDENTIAL 0s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_CONFIDENTIAL 1s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_CONFIDENTIAL 0s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #max SARE_SUB_CONFIDENTIAL 1s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 #counts SARE_SUB_CONFIDENTIAL 11s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_CONFIDENTIAL 0s/1h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_CONFIDENTIAL 8s/1h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_FIND_YOUR Subject =~ /find your/i describe SARE_SUB_FIND_YOUR subject has likely spammer phrase or word score SARE_SUB_FIND_YOUR 0.722 #ham SARE_SUB_FIND_YOUR WebMD: Find Your Ideal Weight, July 2004 #counts SARE_SUB_FIND_YOUR 132s/8h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_FIND_YOUR 244s/14h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_FIND_YOUR 3s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_FIND_YOUR 4s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_FIND_YOUR 43s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_FIND_YOUR 1s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #max SARE_SUB_FIND_YOUR 8s/2h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_SUB_FIND_YOUR 8s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_FIND_YOUR 77s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_FIND_YOUR 111s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_FIND_YOUR 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_FIND_YOUR 3s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 header SARE_SUB_FOREVER Subject =~ /for\W*?ever\b/i describe SARE_SUB_FOREVER subject has likely spammer phrase or word score SARE_SUB_FOREVER 0.170 #counts SARE_SUB_FOREVER 120s/12h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_FOREVER 227s/13h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_FOREVER 2s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_FOREVER 29s/55h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_FOREVER 1s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_FOREVER 29s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_FOREVER 38s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_FOREVER 50s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_FOREVER 15s/10h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_FOREVER 5s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_SUB_FOREVER 8s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_GETRID Subject =~ /\bget rid of\b/i describe SARE_SUB_GETRID subject has likely spammer phrase or word score SARE_SUB_GETRID 0.556 #counts SARE_SUB_GETRID 172s/7h of 428457 corpus (182181s/246276h RM) 12/24/05 #counts SARE_SUB_GETRID 5s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_GETRID 6s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_GETRID 15s/13h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_GETRID 6s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_GETRID 64s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_GETRID 9s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_GETRID 32s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_GETRID 2s/7h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 header SARE_SUB_INCHES Subject =~ /(?:(?:\d.*|add?|enlarge|gain|in.?crease|lose|more|shed)(?:ed|s)?\b.{1,30}\binch(?:es)?\b|inches\W*added)/i describe SARE_SUB_INCHES subject has likely spammer phrase or word score SARE_SUB_INCHES 0.221 #ham SARE_SUB_INCHES price of a "7 inch saw blade", "42 inch plasma TV" #counts SARE_SUB_INCHES 56s/33h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_INCHES 94s/26h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_INCHES 3s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_INCHES 6s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_INCHES 33s/6h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_INCHES 27s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_INCHES 21s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_INCHES 44s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_INCHES 4s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_INCHES 24s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_INCHES 0s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #max SARE_SUB_INCHES 32s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 header SARE_SUB_INEXPEN Subject =~ /Inexpensive [xvp]./i describe SARE_SUB_INEXPEN Subject matches common spam pattern score SARE_SUB_INEXPEN 0.739 #hist SARE_SUB_INEXPEN LW_INEX_SUB, Aug 16 2004, Loren Wilton #counts SARE_SUB_INEXPEN 17s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_INEXPEN 94s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_INEXPEN 1s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_INEXPEN 6s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_INEXPEN 1s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_INEXPEN 2s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_INEXPEN 5s/0h of 18198 corpus (15674s/2524h JH) 08/16/04 #counts SARE_SUB_INEXPEN 4s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_INEXPEN 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_INEXPEN 10s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_INEXPEN 2s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_INEXPEN 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_JOB Subject =~ /(?:(?:dead\W*end|does\W*your|dream|find\W*people|get\W*(?:a|the)(?:\W*better)?|(?:keep|quit)\W*(?:your|their)(?:\W*day)?|real|run\W*your|that\W*great|wanna|with\W*a\W*new|(?:yo)?ur\W*(?:current|full\W*time))\W*job|good\W*jobs|global\W*job\W*vacancy|success\W*job\W*story|job\W*(?:confirmation|feel\W*like|journal|opportunity|you\W*want)|joboffer)/i describe SARE_SUB_JOB subject has likely spammer phrase or word score SARE_SUB_JOB 0.271 #counts SARE_SUB_JOB 24s/18h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_JOB 86s/41h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_JOB 16s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_JOB 4s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_JOB 7s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_JOB 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_JOB 23s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_JOB 38s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_JOB 9s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_JOB 17s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_MINUTES Subject =~ /\d.?minutes/i describe SARE_SUB_MINUTES subject has likely spammer phrase or word score SARE_SUB_MINUTES 0.405 #ham SARE_SUB_MINUTES confirmed #counts SARE_SUB_MINUTES 294s/65h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_MINUTES 509s/67h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_MINUTES 12s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_MINUTES 5s/2h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_MINUTES 23s/2h of 11269 corpus (6578s/4691h CT) 06/11/05 #counts SARE_SUB_MINUTES 114s/12h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_MINUTES 12s/2h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_MINUTES 61s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_MINUTES 65s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_MINUTES 80s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_MINUTES 50s/2h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 header SARE_SUB_SEXY Subject =~ /\bsexy\b/i describe SARE_SUB_SEXY subject has likely spammer phrase or word score SARE_SUB_SEXY 0.266 #counts SARE_SUB_SEXY 113s/56h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_SEXY 435s/17h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_SEXY 21s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_SEXY 10s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_SEXY 15s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_SEXY 28s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_SEXY 9s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_SEXY 40s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_SEXY 47s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #counts SARE_SUB_SEXY 10s/1h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 header SARE_SUB_TAKE Subject =~ /^take (?:a (?:chance|look|moment|step|trip|vacation)|advant|cont|once|the)./i describe SARE_SUB_TAKE Subject matches common spam pattern score SARE_SUB_TAKE 0.652 #hist SARE_SUB_TAKE LW_TAKES_SUB, Aug 16 2004, Loren Wilton #counts SARE_SUB_TAKE 219s/37h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_TAKE 383s/18h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_TAKE 4s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_SUB_TAKE 8s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_TAKE 41s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_TAKE 1s/1h of 9833 corpus (4917s/4916h FT) 12/25/05 #max SARE_SUB_TAKE 2s/1h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_SUB_TAKE 43s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_TAKE 81s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_TAKE 7s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_TAKE 18s/0h of 18198 corpus (15674s/2524h JH) 08/16/04 ######## ###################### ################################################## # Category: Technical Rules ######## ###################### ################################################## header SARE_SUB_DOLLARS Subject =~ /^\s*(?:\w+ )?(?:\w+: )?\$\d+\s*$/ describe SARE_SUB_DOLLARS Short dollar amount subject score SARE_SUB_DOLLARS 0.365 #ham SARE_SUB_DOLLARS confirmed (2) #hist SARE_SUB_DOLLARS Created by Bob Menschel Jul 17 2004 #hist SARE_SUB_DOLLARS Added optional Make to front of string Jul 19 2004 #hist SARE_SUB_DOLLARS Added optional Account: to front of string Aug 1 2004 #hist SARE_SUB_DOLLARS Generalized to 0/1/2 words Aug 10 2004 #hist SARE_SUB_DOLLARS Bugzilla submission 3645, Jul 28 2004 #counts SARE_SUB_DOLLARS 4s/6h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_DOLLARS 1503s/0h of 70699 corpus (43133s/27566h RM) 10/02/04 #counts SARE_SUB_DOLLARS 1s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_DOLLARS 36s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_DOLLARS 75s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_DOLLARS 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_DOLLARS 65s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_DOLLARS 5s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 header SARE_SUB_LEAD_CHAR2 Subject =~ m'^[-<>=]{2}.*' describe SARE_SUB_LEAD_CHAR2 Subject starts with spamsign characters score SARE_SUB_LEAD_CHAR2 0.723 #ham SARE_SUB_LEAD_CHAR2 from firstplacesoftware.com #hist SARE_SUB_LEAD_CHAR2 Created by Bob Menschel May 18 2004 #counts SARE_SUB_LEAD_CHAR2 719s/22h of 428457 corpus (182181s/246276h RM) 12/24/05 #counts SARE_SUB_LEAD_CHAR2 27s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_LEAD_CHAR2 4s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_LEAD_CHAR2 18s/0h of 18153 corpus (15872s/2281h MY) 05/20/04 #counts SARE_SUB_LEAD_CHAR2 3s/1h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_LEAD_CHAR2 0s/1h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_LEAD_CHAR2 2s/3h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_PAREN_NUM2 Subject =~ /^\s*[<[]\d{1,3}[>\]].*[<[]\d{1,3}[>\]]/ describe SARE_SUB_PAREN_NUM2 subject has [00]subject[00] or <> or {} score SARE_SUB_PAREN_NUM2 0.278 #ham SARE_SUB_PAREN_NUM2 confirmed (1) #hist SARE_SUB_PAREN_NUM2 Created by Bob Menschel Aug 27 2004 #counts SARE_SUB_PAREN_NUM2 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PAREN_NUM2 125s/1h of 118869 corpus (71079s/47790h RM) 02/06/05 #counts SARE_SUB_PAREN_NUM2 5s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_PAREN_NUM2 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_PAREN_NUM2 12s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_PAREN_NUM2 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 # EOF