# SARE "General Subject" Ruleset for SpamAssassin - File 1 # Version: 01.03.13 # Created: 2004-09-13 # Modified: 2006-11-14 # Usage instructions and documentation are found in 70_sare_genlsubj0.cf #@@# Revision History: Full Revision History stored in 70_sare_genlsubj.log #@@# 01.03.12: Dec 27 2005 #@@# Minor score updates based on additional mass-check #@@# Archived from file 1: SARE_SUB_2PIPES #@@# Modified SARE_SUB_WINNING_NOT to avoid PayPal FPs #@@# Moved file 0 to file 1: SARE_SUB_GRANT #@@# Moved file 0 to file 1: SARE_SUB_MSG_SUBJ #@@# Moved file 0 to file 1: SARE_SUB_PORN_WORD08 #@@# Moved file 0 to file 1: SARE_SUB_RE_V #@@# Moved file 0 to file 2: SARE_SUB_SEX_EXP_GAP #@@# Moved file 1 to file 2: SARE_HEAD_ORG_ELITEACT #@@# Moved file 1 to file 2: SARE_SUB_FREE_BANG #@@# Moved file 1 to file 2: SARE_SUB_YOUR_WOMAN #@@# Moved file 1 to file 3: SARE_SUB_ALL_LEAD #@@# Moved file 1 to file 3: SARE_SUB_ASSIST #@@# Moved file 1 to file 3: SARE_SUB_CONFIDENTIAL #@@# Moved file 1 to file 3: SARE_SUB_DOLLARS #@@# Moved file 1 to file 3: SARE_SUB_FORECLOSURE #@@# Moved file 1 to file 3: SARE_SUB_FOREVER #@@# Moved file 1 to file 3: SARE_SUB_FREE_SAMPLE #@@# Moved file 1 to file 3: SARE_SUB_MORTGAGE #@@# Moved file 1 to file 3: SARE_SUB_PORN_WORD10 #@@# Moved file 1 to file 3: SARE_SUB_SEXY #@@# Moved file 1 to file 3: SARE_SUB_YOUNGER #@@# Moved file 1 to file 4: SARE_SUB_NOW_TIME #@@# Moved file 2 to file 1: SARE_SUB_REPAIR_BILLS #@@# Moved file 3 to file 1: SARE_SUB_SURVEY #@@# 01.03.13: Nov 14 2006 #@@# Fixed name typo of meta rule; old: __SARE_SUB_FRMO_PAYPAL new: __SARE_SUB_FROM_PAYPAL ######## ###################### ################################################## # Rule definitions to avoid --lint errors on archived/moved rules. ######## ###################### ################################################## meta __SARE_SUB_FALSE __FROM_AOL_COM && !__FROM_AOL_COM meta SARE_SUB_2UNDERSCORES __SARE_SUB_FALSE meta SARE_SUB_ACCT_UPD __SARE_SUB_FALSE meta SARE_SUB_ADV_SEARCH __SARE_SUB_FALSE meta SARE_SUB_CHANGE_LIFE __SARE_SUB_FALSE meta SARE_SUB_CHARGE_OB __SARE_SUB_FALSE meta SARE_SUB_COMM_MAILERS __SARE_SUB_FALSE meta SARE_SUB_EBAY_OB __SARE_SUB_FALSE meta SARE_SUB_EXPIRED __SARE_SUB_FALSE meta SARE_SUB_GAPPY_3 __SARE_SUB_FALSE meta SARE_SUB_GAPPY_4 __SARE_SUB_FALSE meta SARE_SUB_LEAD_PUNCT __SARE_SUB_FALSE meta SARE_SUB_LONG_SUBJ_140 __SARE_SUB_FALSE meta SARE_SUB_LONG_SUBJ_170 __SARE_SUB_FALSE meta SARE_SUB_LOTS_PUNC_21 __SARE_SUB_FALSE meta SARE_SUB_LOTS_PUNC_26 __SARE_SUB_FALSE meta SARE_SUB_MENS_HEALTH __SARE_SUB_FALSE meta SARE_SUB_PERFECTLY __SARE_SUB_FALSE meta SARE_SUB_RAND_UC __SARE_SUB_FALSE meta SARE_SUB_STRETCH_MARK __SARE_SUB_FALSE meta SARE_SUB_TAXES __SARE_SUB_FALSE meta SARE_SUB_DOWNLOAD_OB __SARE_SUB_FALSE meta SARE_SUB_PENIS_OB __SARE_SUB_FALSE meta SARE_SUB_ACTION_OB __SARE_SUB_FALSE meta SARE_SUB_BETTER_OB2 __SARE_SUB_FALSE meta SARE_SUB_BIGGER_OB __SARE_SUB_FALSE meta SARE_SUB_BOOST_OB __SARE_SUB_FALSE meta SARE_SUB_BREAKTHRU_OB __SARE_SUB_FALSE meta SARE_SUB_BUY_OB __SARE_SUB_FALSE meta SARE_SUB_CONSULTN_OB __SARE_SUB_FALSE meta SARE_SUB_HARD_OB __SARE_SUB_FALSE meta SARE_SUB_HOMEOWNER_OB __SARE_SUB_FALSE meta SARE_SUB_INKJET_OB __SARE_SUB_FALSE meta SARE_SUB_LOSE_OB __SARE_SUB_FALSE meta SARE_SUB_MOVE_OB __SARE_SUB_FALSE meta SARE_SUB_PHOTOS_OB __SARE_SUB_FALSE meta SARE_SUB_PHYSICIAN_OB __SARE_SUB_FALSE meta SARE_SUB_PLEASE_OB __SARE_SUB_FALSE meta SARE_SUB_REAL_OB __SARE_SUB_FALSE meta SARE_SUB_STRONG_OB __SARE_SUB_FALSE meta SARE_SUB_VIDEO_OB __SARE_SUB_FALSE meta SARE_SUB_YOUNGER_OB __SARE_SUB_FALSE meta SARE_SUB_SION_OB __SARE_SUB_FALSE meta SARE_SUB_TION_OB __SARE_SUB_FALSE meta SARE_SUB_AGING __SARE_SUB_FALSE meta SARE_SUB_BETTER_DEAL __SARE_SUB_FALSE meta SARE_SUB_BIGGER __SARE_SUB_FALSE meta SARE_SUB_BREAKTHRU __SARE_SUB_FALSE meta SARE_SUB_CALL_NOW __SARE_SUB_FALSE meta SARE_SUB_CAR_INSURANCE __SARE_SUB_FALSE meta SARE_SUB_CONSULTATION __SARE_SUB_FALSE meta SARE_SUB_DEBT __SARE_SUB_FALSE meta SARE_SUB_DEBTS_COURT __SARE_SUB_FALSE meta SARE_SUB_FOR_WOMEN __SARE_SUB_FALSE meta SARE_SUB_GROW_BUSINESS __SARE_SUB_FALSE meta SARE_SUB_INCHES __SARE_SUB_FALSE meta SARE_SUB_INKJET __SARE_SUB_FALSE meta SARE_SUB_INVESTORS __SARE_SUB_FALSE meta SARE_SUB_JOB __SARE_SUB_FALSE meta SARE_SUB_MEDICAL_NEWS __SARE_SUB_FALSE meta SARE_SUB_NEXT_DOOR __SARE_SUB_FALSE meta SARE_SUB_PAREN_NUM2 __SARE_SUB_FALSE meta SARE_SUB_PHYSICIAN __SARE_SUB_FALSE meta SARE_SUB_STRONG __SARE_SUB_FALSE meta SARE_SUB_TONER __SARE_SUB_FALSE meta SARE_SUB_WINNER __SARE_SUB_FALSE meta SARE_SUB_YOUR_WOMAN __SARE_SUB_FALSE meta SARE_SUB_MISC_1 __SARE_SUB_FALSE meta SARE_SUB_NEXT_DOOR __SARE_SUB_FALSE meta SARE_SUB_INVESTMENTS __SARE_SUB_FALSE meta SARE_SUB_AS_LOW_AS __SARE_SUB_FALSE meta SARE_SUB_AGING_OB __SARE_SUB_FALSE meta SARE_SUB_FOR_OB __SARE_SUB_FALSE meta SARE_SUB_CONFID_OB __SARE_SUB_FALSE meta SARE_SUB_ADV_DB __SARE_SUB_FALSE meta SARE_SUB_CARD_BILLED __SARE_SUB_FALSE meta SARE_SUB_HOT_PROFITS __SARE_SUB_FALSE meta SARE_SUB_PERS_KNOW __SARE_SUB_FALSE meta SARE_SUB_REPAIR_BILLS __SARE_SUB_FALSE meta SARE_SUB_SW_ON_CD __SARE_SUB_FALSE meta SARE_SUB_WP_OFFICE __SARE_SUB_FALSE meta SARE_SUB_YOUR_LISTING __SARE_SUB_FALSE meta SARE_SUB_BOOST __SARE_SUB_FALSE meta SARE_SUB_BULK_EMAIL __SARE_SUB_FALSE meta SARE_SUB_CURRENT_NEWS __SARE_SUB_FALSE meta SARE_SUB_MINUTES __SARE_SUB_FALSE meta SARE_HEAD_ORG_ELITEACT __SARE_SUB_FALSE meta SARE_SUB_FREE_BANG __SARE_SUB_FALSE meta SARE_SUB_YOUR_WOMAN __SARE_SUB_FALSE meta SARE_SUB_ALL_LEAD __SARE_SUB_FALSE meta SARE_SUB_ASSIST __SARE_SUB_FALSE meta SARE_SUB_CONFIDENTIAL __SARE_SUB_FALSE meta SARE_SUB_DOLLARS __SARE_SUB_FALSE meta SARE_SUB_FORECLOSURE __SARE_SUB_FALSE meta SARE_SUB_FOREVER __SARE_SUB_FALSE meta SARE_SUB_FREE_SAMPLE __SARE_SUB_FALSE meta SARE_SUB_MORTGAGE __SARE_SUB_FALSE meta SARE_SUB_PORN_WORD10 __SARE_SUB_FALSE meta SARE_SUB_SEXY __SARE_SUB_FALSE meta SARE_SUB_YOUNGER __SARE_SUB_FALSE meta SARE_SUB_NOW_TIME __SARE_SUB_FALSE ######## ###################### ################################################## # Category: __rules used by primary rules below ######## ###################### ################################################## # Attempt to identify simple subject obfuscation by character insertion header __SARE_SUB_OBFU_ASTER Subject =~ /[a-zA-Z0]\*[a-zA-Z]/ header __SARE_SUB_OBFU_CARAT Subject =~ /[a-zA-Z0]\^[a-zA-Z]/ header __SARE_SUB_OBFU_COLON Subject =~ /[a-zA-Z0]:[a-zA-Z]/ header __SARE_SUB_OBFU_COMMA Subject =~ /[a-zA-Z0],[a-zA-Z]/ header __SARE_SUB_OBFU_SLASH Subject =~ /[a-zA-Z0]\/[a-zA-Z]/ header __SARE_SUB_OBFU_LQUOT Subject =~ /[a-zA-Z0]`[a-zA-Z]/ header __SARE_SUB_OBFU_PERIOD Subject =~ /[a-zA-Z0]\.[a-zA-Z]/ header __SARE_SUB_OBFU_2PER Subject =~ /[a-zA-Z0]\.\.[a-zA-Z]/ header __SARE_SUB_OBFU_PIPE Subject =~ /[a-zA-Z0]\|[a-zA-Z]/ header __SARE_SUB_OBFU_PLUS Subject =~ /[a-zA-Z0]\+[a-zA-Z]/ header __SARE_SUB_OBFU_QUOTE Subject =~ /[a-zA-Z0]"[a-zA-Z]/ header __SARE_SUB_OBFU_SCOLON Subject =~ /[a-zA-Z0];[a-zA-Z]/ header __SARE_SUB_OBFU_USCORE Subject =~ /[a-zA-Z0]_[a-zA-Z]/ header __SARE_SUB_OBFU_HTTP Subject =~ m*http://*i ######## ###################### ################################################## # Category: Adult/Porn ######## ###################### ################################################## header SARE_SUB_PORN_WORD02 Subject =~ /puss(?:y|ies)/i describe SARE_SUB_PORN_WORD02 Adult spammer words score SARE_SUB_PORN_WORD02 0.778 #hist SARE_SUB_PORN_WORD02 Richard Gray, Feb 21 2005 #counts SARE_SUB_PORN_WORD02 110s/5h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PORN_WORD02 371s/4h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PORN_WORD02 18s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_PORN_WORD02 29s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PORN_WORD02 19s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_PORN_WORD02 18s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_PORN_WORD02 21s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_PORN_WORD02 45s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PORN_WORD02 1s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_PORN_WORD02 16s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_PORN_WORD02 0s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_PORN_WORD02 10s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_PORN_WORD05 Subject =~ /\bh(?:orn|onr|nro|nor|ron|rno)y\b/i describe SARE_SUB_PORN_WORD05 Adult spammer words score SARE_SUB_PORN_WORD05 0.889 #hist SARE_SUB_PORN_WORD05 Richard Gray, Feb 21 2005 #ham SARE_SUB_PORN_WORD05 verified (1) #counts SARE_SUB_PORN_WORD05 70s/2h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PORN_WORD05 344s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PORN_WORD05 10s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_PORN_WORD05 17s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_PORN_WORD05 19s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PORN_WORD05 12s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_PORN_WORD05 9s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_PORN_WORD05 15s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_PORN_WORD05 20s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PORN_WORD05 23s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 header SARE_SUB_PORN_WORD06 Subject =~ /f(?:ucke|ucek|ukce|ukec|ueck|uekc|cuek|cuke|ckue|ckeu|ceku|ceuk|kuce|kuec|kcue|kceu|kecu|keuc|euck|eukc|ecuk|ecku|ekcu|ekuc)d/i describe SARE_SUB_PORN_WORD06 Adult spammer words score SARE_SUB_PORN_WORD06 0.914 #ham SARE_SUB_PORN_WORD06 verified (1) #hist SARE_SUB_PORN_WORD06 Richard Gray, Feb 21 2005 #counts SARE_SUB_PORN_WORD06 102s/3h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PORN_WORD06 156s/13h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PORN_WORD06 38s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_PORN_WORD06 2s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_SUB_PORN_WORD06 3s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_PORN_WORD06 18s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PORN_WORD06 9s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_PORN_WORD06 4s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_PORN_WORD06 28s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PORN_WORD06 57s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 header SARE_SUB_PORN_WORD08 Subject =~ /\bMILF\b/i describe SARE_SUB_PORN_WORD08 Adult spammer words score SARE_SUB_PORN_WORD08 0.722 #hist SARE_SUB_PORN_WORD08 Richard Gray, Feb 21 2005 #ham SARE_SUB_PORN_WORD08 verified #counts SARE_SUB_PORN_WORD08 13s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PORN_WORD08 58s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PORN_WORD08 3s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_PORN_WORD08 1s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_PORN_WORD08 1s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_PORN_WORD08 4s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PORN_WORD08 3s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_PORN_WORD08 0s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_PORN_WORD08 1s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_PORN_WORD08 4s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PORN_WORD08 1s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_PORN_WORD08 8s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 header SARE_SUB_PORN_WORD11 Subject =~ /\bcum(?:shot)?\b/i describe SARE_SUB_PORN_WORD11 Adult spammer words score SARE_SUB_PORN_WORD11 0.996 #ham SARE_SUB_PORN_WORD11 verified (1), possible (several) #hist SARE_SUB_PORN_WORD11 Richard Gray, Feb 21 2005 #counts SARE_SUB_PORN_WORD11 384s/7h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PORN_WORD11 2339s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PORN_WORD11 18s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_PORN_WORD11 38s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_PORN_WORD11 70s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PORN_WORD11 9s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_PORN_WORD11 60s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_PORN_WORD11 35s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PORN_WORD11 18s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_PORN_WORD11 23s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 ######## ###################### ################################################## # Category: Black market items, services, activities, scams, frauds ######## ###################### ################################################## header SARE_SUB_FIRE_BOSS Subject =~ /Fire your boss/i describe SARE_SUB_FIRE_BOSS Spammer subject - black market or scam score SARE_SUB_FIRE_BOSS 0.711 #hist SARE_SUB_FIRE_BOSS From Loren Wilton, July 22 2004 #counts SARE_SUB_FIRE_BOSS 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_FIRE_BOSS 22s/0h of 60310 corpus (35337s/24973h RM) 08/10/04 #counts SARE_SUB_FIRE_BOSS 0s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_FIRE_BOSS 1s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_FIRE_BOSS 6s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_FIRE_BOSS 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_FIRE_BOSS 0s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #max SARE_SUB_FIRE_BOSS 2s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_GET_PAID Subject =~ /get paid/i describe SARE_SUB_GET_PAID Subject mentions getting paid for something score SARE_SUB_GET_PAID 0.899 #hist SARE_SUB_GET_PAID RM_spc_GetPaid #counts SARE_SUB_GET_PAID 190s/3h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_GET_PAID 338s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_GET_PAID 13s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_GET_PAID 62s/1h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_GET_PAID 11s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_GET_PAID 2s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_GET_PAID 4s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_GET_PAID 27s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_GET_PAID 167s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 header SARE_SUB_NAME_MILBEN From:name =~ /Military Benefits/i describe SARE_SUB_NAME_MILBEN Might be military benefits scam score SARE_SUB_NAME_MILBEN 0.961 #hist SARE_SUB_NAME_MILBEN Matt Yackley, Apr 15 2005 #counts SARE_SUB_NAME_MILBEN 31s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_NAME_MILBEN 49s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_NAME_MILBEN 30s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_NAME_MILBEN 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_NAME_MILBEN 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_NAME_MILBEN 1s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_NAME_MILBEN 11s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_NAME_MILBEN 35s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 header SARE_SUB_NEED_REPLY Subject =~ /(?:(?:(?:appreciate|a?waiting(?:\W*for)?)\W*your|request|urgent)\W*(?:answer|assist|PROPOSITION|reply|response)|(?:answer|assist|PROPOSITION|reply|response)\W*(?:needed|urgent))/i describe SARE_SUB_NEED_REPLY Spammer subject - black market or scam score SARE_SUB_NEED_REPLY 0.784 #ham SARE_SUB_NEED_REPLY verified (14) #hist SARE_SUB_NEED_REPLY Expanded by Bob Menschel, Sep 24 2004 #counts SARE_SUB_NEED_REPLY 284s/7h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_NEED_REPLY 665s/22h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_NEED_REPLY 1s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_NEED_REPLY 4s/1h of 11269 corpus (6578s/4691h CT) 06/11/05 #counts SARE_SUB_NEED_REPLY 16s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_NEED_REPLY 3s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_NEED_REPLY 34s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_NEED_REPLY 25s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #counts SARE_SUB_NEED_REPLY 7s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_NEED_REPLY 11s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 header __SARE_SUB_WINNING_NOT Subject =~ /(?:(?:Final|WINNING)(?:.award)?\s*NOTIFICATION|^NOTIFICATION\s*$|(?:auction|lucky).winning|notification.of.(?:an.instant|bequest|intent|unclaimed|multi.?item|promotion|winning)|notification.{1,30}final.notice|contrat.{1,30}winning.{1,30}promotion)/i header __SARE_SUB_WINNING_R1 Received =~ /from .{4,15}\.paypal.com/ header __SARE_SUB_WINNING_M1 Message-Id =~ /\@paypal\.com/ header __SARE_SUB_WINNING_PP Subject =~ /Notification of an Instant Payment/ meta SARE_SUB_WINNING_NOT __SARE_SUB_WINNING_NOT && !__SARE_SUB_WINNING_R1 && !__SARE_SUB_WINNING_M1 && !__SARE_SUB_WINNING_PP describe SARE_SUB_WINNING_NOT Spammer subject - black market or scam score SARE_SUB_WINNING_NOT 0.683 #ham SARE_SUB_WINNING_NOT eBay: Notification of an Instant Payment Received from [userid] #counts SARE_SUB_WINNING_NOT 575s/28h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_WINNING_NOT 1481s/28h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_WINNING_NOT 4s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_WINNING_NOT 4s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_WINNING_NOT 51s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_WINNING_NOT 3s/2h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_WINNING_NOT 15s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_WINNING_NOT 24s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_WINNING_NOT 24s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_WINNING_NOT 11s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_WINNING_NOT 31s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_WORTH_CASH Subject =~ /\b(?:Worth|Win|take|extra|earn|dollars|Short|need|claim|free|get|opinions?|surveys?)\b.{0,15}(?:fast)?(?:C[a\@]sh|M[0o]ney)\b/i describe SARE_SUB_WORTH_CASH Subject mentions something is worth cash score SARE_SUB_WORTH_CASH 0.835 #hist SARE_SUB_WORTH_CASH RM_spc_WorthCash #ham SARE_SUB_WORTH_CASH CasinoGames.com newsletter to subscriber; credit card rewards programs #ham SARE_SUB_WORTH_CASH exchange between NPO and contributor #counts SARE_SUB_WORTH_CASH 583/17h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_WORTH_CASH 682s/18h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_WORTH_CASH 26s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_WORTH_CASH 44s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_WORTH_CASH 244s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_WORTH_CASH 31s/3h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_WORTH_CASH 9s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_WORTH_CASH 73s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04 #counts SARE_SUB_WORTH_CASH 24s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_WORTH_CASH 138s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_WORTH_CASH 201s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 ######## ###################### ################################################## # Category: Credit, debt, lending, mortgage, borrowing, investment, financing ######## ###################### ################################################## header __SARE_SUB_ACCEPT_CC Subject =~ /(?!processing credit card)(?:(?:Accept(?:ing)?|Process.{0,20})\W*credit\W*c[aâ\@]rds?|credit\W*card\W*(chargebacks?|terminals?|vendor))/i header __SARE_SUB_FROM_PAYPAL From:addr =~ /service\@paypal\.com/ header __SARE_SUB_RECV_PAYPAL Received =~ /\bnix\.paypal\.com/ meta SARE_SUB_ACCEPT_CCARDS __SARE_SUB_ACCEPT_CC && !__SARE_SUB_FROM_PAYPAL && !__SARE_SUB_RECV_PAYPAL describe SARE_SUB_ACCEPT_CCARDS Spammer subject - credit or money score SARE_SUB_ACCEPT_CCARDS 0.484 #ham SARE_SUB_ACCEPT_CCARDS verified (1) -- paypal upgrade confirmation #hist SARE_SUB_ACCEPT_CCARDS Dec 24 2005 Modified to reduce paypal FPs #counts SARE_SUB_ACCEPT_CCARDS 45s/6h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_ACCEPT_CCARDS 54s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_ACCEPT_CCARDS 11s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_ACCEPT_CCARDS 3s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_ACCEPT_CCARDS 12s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_SUB_ACCEPT_CCARDS 2s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_ACCEPT_CCARDS 4s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_ACCEPT_CCARDS 0s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_ACCEPT_CCARDS 1s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 header SARE_SUB_FINAN_OBLIG Subject =~ /\b(?:financial|monetary) obligations/i describe SARE_SUB_FINAN_OBLIG Subject mentions financial obligations score SARE_SUB_FINAN_OBLIG 0.622 #counts SARE_SUB_FINAN_OBLIG 0s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_SUB_FINAN_OBLIG 9s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_FINAN_OBLIG 3s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #counts SARE_SUB_FINAN_OBLIG 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_FINAN_OBLIG 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_GRANT Subject =~ /(?:(?:cash|collect\W*your|dollar|free(?:dom)?|get\W*a|government|gov't|qualify\W*for\W*a|taxes\W*paid\W*for\W*these)\W*grants?|grant\W*money\W*for\W*you|grants.{1,30}paid\W*for\W*with\W*your\W*taxes)/i describe SARE_SUB_GRANT Spammer subject - credit or money score SARE_SUB_GRANT 1.072 #ham SARE_SUB_GRANT verified #counts SARE_SUB_GRANT 75s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_GRANT 85s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_GRANT 13s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_GRANT 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_GRANT 2s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_GRANT 4s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_GRANT 17s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_GRANT 1s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 header SARE_SUB_HIGH_RATES Subject =~ /\bhigh(?:er|est)?\b.{1,15}\brates\b/i describe SARE_SUB_HIGH_RATES subject has likely spammer phrase or word score SARE_SUB_HIGH_RATES 0.650 #ham SARE_SUB_HIGH_RATES high asthma rates #hist SARE_SUB_HIGH_RATES From 88_FVGT_subject.cf FS_HIGH_RATES May 1 2004 #hist SARE_SUB_HIGH_RATES Jan 2005: Moved from archive back to file 1 #hist SARE_SUB_HIGH_RATES Added bounds to avoid ham: Highway 61 Celebrates #counts SARE_SUB_HIGH_RATES 21s/1h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_HIGH_RATES 55s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_HIGH_RATES 4s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_HIGH_RATES 3s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_HIGH_RATES 5s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_HIGH_RATES 6s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_HIGH_RATES 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 header SARE_SUB_OTC Subject =~ /^[O0]TC:[A-Z]{4}/ describe SARE_SUB_OTC Appears to be OTC stock market spam score SARE_SUB_OTC 1.006 #hist SARE_SUB_OTC Created by Bob Menschel, April 15 2005; Dec 25 2005: added zero-TC #counts SARE_SUB_OTC 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_OTC 17s/0h of 291031 corpus (121442s/169589h RM) 04/22/05 #counts SARE_SUB_OTC 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_OTC 17s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_OTC 64s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_OTC 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 header SARE_SUB_POOR_CREDIT Subject =~ /(?!credit card (?:bill|declined))(?:(?:bad|poor|less\W*than\W*perfect|fix\W*your)\W*cr[eé]d[iï]t|cr[eé]d[iï]t.{1,20}declined|declined.{1,20}cr[eé]d[iï]t|cr[eé]d[iï]t\W*(?:bad|can\W*be\W*fix|card\W*(?:balances?|bills?|debt|elimination)|Counseling|profiles?|rating)|no\W*cr[eé]d[iï]t.check)/i describe SARE_SUB_POOR_CREDIT Spammer subject - credit or money score SARE_SUB_POOR_CREDIT 1.121 #ham SARE_SUB_POOR_CREDIT SFO credit rating upgraded from "negative" to "stable", January 31, 2005, in the San Francisco Examiner #counts SARE_SUB_POOR_CREDIT 253s/3h of 428457 corpus (182181s/246276h RM) 12/24/05 #counts SARE_SUB_POOR_CREDIT 2s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_POOR_CREDIT 68s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #max SARE_SUB_POOR_CREDIT 707s/9h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_POOR_CREDIT 21s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_POOR_CREDIT 5s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_POOR_CREDIT 9s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_POOR_CREDIT 26s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_POOR_CREDIT 1s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_POOR_CREDIT 48s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_POOR_CREDIT 68s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 header SARE_SUB_REFINANCE Subject =~ /re-?finance/i describe SARE_SUB_REFINANCE Spammer subject - credit or money score SARE_SUB_REFINANCE 1.666 #counts SARE_SUB_REFINANCE 378s/18h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_REFINANCE 924s/15h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_REFINANCE 5s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_REFINANCE 30s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_REFINANCE 207s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_REFINANCE 61s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_REFINANCE 74s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_REFINANCE 97s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_REFINANCE 205s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_REFINANCE 26s/1h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_REFINANCE 41s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 ######## ###################### ################################################## # Category: Gambling, Lotto, Sweepstakes, Winnings, Losses ######## ###################### ################################################## ######## ###################### ################################################## # Category: Insurance ######## ###################### ################################################## header __SARE_SUB_INSURANCE Subject =~ /(?:(?:aff[o0]rdable|cheap(?:est)?|free|good\W*news|l[o0]w\W*c[o0]st|(?:over)?pay(?:ing)?\W*t[o0][o0]\W*much|reduce|save|sell).{1,30}insurance|insurance.{1,30}(?:available|everyone|f[o0]r\W*less|leads|[o0]ffers|[o0]pti[o0]ns?|qu[o0]tes?)|(?:FYI:?|new|special|sub|update(?:\W*sub)?)\W*construction\W*insurance|new\W*insurnace\W*product)/i meta SARE_SUB_INSURANCE __SARE_SUB_INSURANCE && !SARE_SUB_CAR_INSURANCE describe SARE_SUB_INSURANCE Spammer subject - insurance score SARE_SUB_INSURANCE 0.902 #ham SARE_SUB_INSURANCE adv in subcribed opt-in newsletter (1, same ham as SARE_SUB_CAR_INSURANCE) #hist SARE_SUB_INSURANCE Converted to meta to avoid overlap with SARE_SUB_CAR_INSURANCE, Apr 22 2005 #note SARE_SUB_INSURANCE "insurance coverage" hits too much ham #note SARE_SUB_INSURANCE "term life" covered by SARE_SUB_TERM_LIFE #counts SARE_SUB_INSURANCE 270s/5h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_INSURANCE 511s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_INSURANCE 4s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #counts SARE_SUB_INSURANCE 44s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_INSURANCE 1s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_INSURANCE 2s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_INSURANCE 31s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_INSURANCE 2s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_INSURANCE 52s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_INSURANCE 59s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_PROTECT_FAM Subject =~ /(?:Protect\W*your\W*famil(?:y|ies)|protect(?:ion)?(?:\W*for)?\W*your\W*(?:vehicle|car)|secure\W*your\W*future|protect.{1,10}from.{1,10}repair\W*bills?|extended\W*warranty\W*protection)/i describe SARE_SUB_PROTECT_FAM Spammer subject - insurance score SARE_SUB_PROTECT_FAM 1.272 #ham SARE_SUB_PROTECT_FAM verified (1) #counts SARE_SUB_PROTECT_FAM 79s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PROTECT_FAM 117s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PROTECT_FAM 9s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_PROTECT_FAM 20s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PROTECT_FAM 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_PROTECT_FAM 6s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_PROTECT_FAM 1s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PROTECT_FAM 20s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_PROTECT_FAM 63s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 header SARE_SUB_REPAIR_BILLS Subject =~ /(?:large\W*repair\W*bills|(?:(?:costly|major)\W*auto|m[o0]ney\W*for|pay(?:ing)?\W*for|save\b.{1,30}\bon)\W*repairs?)/i describe SARE_SUB_REPAIR_BILLS Spammer subject - insurance score SARE_SUB_REPAIR_BILLS 0.950 #hist SARE_SUB_REPAIR_BILLS Created by Bob Menschel Mar 22 2004 #counts SARE_SUB_REPAIR_BILLS 2s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_REPAIR_BILLS 58s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_REPAIR_BILLS 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_REPAIR_BILLS 8s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_REPAIR_BILLS 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_REPAIR_BILLS 4s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_REPAIR_BILLS 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Marketing, Pricing, Selling, Buying ######## ###################### ################################################## header SARE_SUB_ANIM_LOGO Subject =~ /(?!flash.*dimage)(?:(?:Animated|custom|flash|high[- ]impact|impressive|special|unique).{1,15}(?:image|Logo)|Logo Animation)/i describe SARE_SUB_ANIM_LOGO Common spammer subject score SARE_SUB_ANIM_LOGO 0.862 #hist SARE_SUB_ANIM_LOGO RM_spc_AnimatedLogo #hist SARE_SUB_ANIM_LOGO June 1 2004: Added some additional test words #ham SARE_SUB_ANIM_LOGO From shirt company: Special Offer: Logo Polos Just $9.95 With Your Embroidered Logo! #counts SARE_SUB_ANIM_LOGO 107s/2h of 428457 corpus (182181s/246276h RM) 12/24/05 #counts SARE_SUB_ANIM_LOGO 13s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_ANIM_LOGO 3s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_ANIM_LOGO 24s/3h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_ANIM_LOGO 2s/1h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_ANIM_LOGO 63s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_ANIM_LOGO 2s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_ANIM_LOGO 6s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_ANIM_LOGO 7s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 ######## ###################### ################################################## # Category: Medical ######## ###################### ################################################## header SARE_SUB_DROOGS Subject =~ m'\b(?:\\/ALUUM|\\/llGRA|ALPRAZZ0LAM|AMBllEN|CAALlS|L0RAAZEPAM|LEVlTRRA|MER1DllA|TRAMAD0OL|XANA)\b'i describe SARE_SUB_DROOGS otherwise missed drug-word subjects score SARE_SUB_DROOGS 1.666 #hist SARE_SUB_DROOGS Loren Wilton, Aug 2005 #counts SARE_SUB_DROOGS 1s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_DROOGS 148s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_DROOGS 3s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_DROOGS 0s/0h of 7296 corpus (1614s/5682h ft) 08/05/05 #counts SARE_SUB_DROOGS 0s/0h of 10552 corpus (5785s/4767h CT) 08/04/05 #counts SARE_SUB_DROOGS 2s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_DROOGS 148s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 header SARE_SUB_IMPROVE Subject =~ /(?:improve|maximize).{1,30}(?:cell\W*phone|cholesterol|credit|desire|English|hair|health|home|kisser|love\W*life|memory|performance|possibilities|self\W*image|sex(?:\W*life|ual\W*(?:endurance|health))|signal|sleep|stamina|stock\W*market|vision)/i describe SARE_SUB_IMPROVE Spammer subject - medical score SARE_SUB_IMPROVE 0.641 #ham SARE_SUB_IMPROVE tech list: Improve sleep code of (software module), newspaper headline #counts SARE_SUB_IMPROVE 129s/16h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_IMPROVE 165s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_IMPROVE 6s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_IMPROVE 12s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_IMPROVE 15s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_IMPROVE 1s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_IMPROVE 7s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_IMPROVE 16s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_IMPROVE 75s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_IMPROVE 15s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_IMPROVE 38s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header __SARE_SUB_INET_PHARM Subject =~ /(?!Pharmacy selection)(?:(?:American|best|(?:by|from)\W*(?:a\W*_?US|cheap|cyber|discreet|\e-|FDA|free|generic|genuine|Internet|low\W*cost|new|off\W*shore|on\W*line(?:.{1,5}USA)?|overnight|perfect|smart|super|US\W*doctors\W*US)|(?:discreet|no\W*doctor).{1,30})\W*Pharmacy|Pharmacy.{1,30}(?:deals|sale|online|prices?|related\W*drugs|selection|verification)|your\W*pharmacy\W*order)/i describe __SARE_SUB_INET_PHARM Common spammer subject header -- Medical #hist __SARE_SUB_INET_PHARM Created by Bob Menschel Apr 09 2004 #hist __SARE_SUB_INET_PHARM Merged SARE_SUB_PHARM_ONLINE from From 88_FVGT_subject.cf FS_PHARMAC_OLINE into this rule July 24 2004 #ham __SARE_SUB_INET_PHARM "Pharmacy selection" in email discussing employee's health benefits #ham __SARE_SUB_INET_PHARM Decision matrix for UIC/Pharmacy redesign selection header __SARE_SUB_INET_CHEM Subject =~ /\b(?:chemist[- ]?(?:site|store)|e-chemist|internet chemist|medicaments?|chemist.*(?:bargains?|cures?|medi(?:cals?|s|z)|prices?|reduces?|selection|spend(?:ing)?|tablets)|(?:bargains?|cures?|medi(?:cals?|s|z)|prices?|reduces?|selection|spend(?:ing)?|tablets).*chemist)\b/i describe __SARE_SUB_INET_CHEM Common spammer subject header -- Medical #hist __SARE_SUB_INET_CHEM Created by Bob Menschel August 07 2005 meta SARE_SUB_INET_PHARM ( __SARE_SUB_INET_PHARM || __SARE_SUB_INET_CHEM ) && !ONLINE_PHARMACY describe SARE_SUB_INET_PHARM Common spammer subject header -- Medical score SARE_SUB_INET_PHARM 1.666 #ham SARE_SUB_INET_PHARM Subject: Welcome to Wal-Mart Pharmacy online access #overlap SARE_SUB_INET_PHARM SARE rule overlaps distribution rule, but does not duplicate it. #overlap SARE_SUB_INET_PHARM SARE rule matches a lot of spam not matched by distribution rule. #overlap SARE_SUB_INET_PHARM It is very possible for the SARE rule to hit ham, but not the distribution rule. #hist SARE_SUB_INET_PHARM Created Aug 10 2004 by Bob Menschel to avoid double-scoring on overlap #hist SARE_SUB_INET_PHARM Added __SARE_SUB_INET_CHEM #counts SARE_SUB_INET_PHARM 66s/1h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_INET_PHARM 484s/0h of 291031 corpus (121442s/169589h RM) 04/22/05 #counts SARE_SUB_INET_PHARM 3s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_INET_PHARM 8s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_SUB_INET_PHARM 11s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_INET_PHARM 95s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_INET_PHARM 3s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_INET_PHARM 52s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #max SARE_SUB_INET_PHARM 109s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_INET_PHARM 36s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_INET_PHARM 73s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 header SARE_SUB_MEDICAL_NEWS Subject =~ /(?:medical\W*(?:announcement|breakthrough|discover|info|innovation|marvel|miracle|news|post|update)|(?:news|notice).{1,3}medical)/i describe SARE_SUB_MEDICAL_NEWS Spammer subject - medical score SARE_SUB_MEDICAL_NEWS 0.756 #hist SARE_SUB_MEDICAL_NEWS Created by Bob Menschel Apr 05 2004 #counts SARE_SUB_MEDICAL_NEWS 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_MEDICAL_NEWS 91s/2h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_MEDICAL_NEWS 3s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_MEDICAL_NEWS 11s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_MEDICAL_NEWS 0s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_MEDICAL_NEWS 45s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_MEDICAL_NEWS 1s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_SUB_MEDICAL_NEWS 0s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_MEDICAL_NEWS 1s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_MEDS Subject =~ /(?:meds (?:che[a\@]p|fr[o0]m C[a\@]n[a\@]d[a\@]|[o0]n[l1|][i1|]ne|[o0]n the net|sh[i1|]p|.*(?:[a\@]ppr[o0]ved|che[a\@]p|c[o0]st|de[a\@][l1|]|de[l1|][i1|]ver|d[i1|]screet|d[i1|]sc[o0]unt|expens[i1|]ve|f[a\@]st|f[i1|]nd|f[i1|]ngert[i1|]ps|get|gre[a\@]t|[i1\|]nternet|[l1|][o0][o0]k[i1|]ng|[l1|][o0]w.*(?:c[o0]st|pr[i1|]ce)|need|[o0]bt[a\@][i1|]n|[o0]n[l1|][i1|]ne|[o0]rder|[o0]vern[i1|]ght|percent|p[o0]pu[l1|][a\@]r|purch[a\@]se|qu[i1|]ck|rx|s[a\@]v(?:e|ing)|se[l1|]ecti[o0]n|ship|s[o0][l1|]d|s[o0]urce|speci[a\@][l1|]|v[a\@][l1|]ue|wh[o0][l1|]es[a\@][l1|]e))|(?:[a\@]ppr[o0]ved|che[a\@]p|c[o0]st|de[a\@][l1|]|de[l1|]iver|discreet|disc[o0]unt|expensive|f[a\@]st|find|fingertips|get|gre[a\@]t|[i1\|]nternet|[l1|][o0][o0]k[i1|]ng|[l1|][o0]w.*(?:c[o0]st|pr[i1|]ce)|need|[o0]bt[a\@][i1|]n|[o0]n[l1|][i1|]ne|[o0]rder|[o0]vern[i1|]ght|percent|p[o0]pu[l1|][a\@]r|purch[a\@]se|qu[i1|]ck|rx|s[a\@]v(?:e|[i1|]ng)|se[l1|]ect[i1|][o0]n|sh[i1|]p|s[o0][l1|]d|s[o0]urce|spec[i1|][a\@][l1|]|v[a\@][l1|]ue|wh[o0][l1|]es[a\@][l1|]e).*meds|e-meds)/i describe SARE_SUB_MEDS Common spammer subject header -- Medical score SARE_SUB_MEDS 1.666 #ham SARE_SUB_MEDS verified (1) #hist SARE_SUB_MEDS Created by Bob Menschel Jan 22 2005 #counts SARE_SUB_MEDS 232s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_MEDS 867s/1h of 117867 corpus (81073s/36794h RM) 01/23/05 #counts SARE_SUB_MEDS 12s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_MEDS 73s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_MEDS 10s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_MEDS 117s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_MEDS 136s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_MEDS 16s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_MEDS 51s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_MEDS 144s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_MEDS 29s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_MEDS 302s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 header SARE_SUB_PENIS Subject =~ /\bpenis\b/i describe SARE_SUB_PENIS subject has likely spammer phrase or word score SARE_SUB_PENIS 1.666 #ham SARE_SUB_PENIS confirmed (1), questionable (1) #counts SARE_SUB_PENIS 347s/2h of 428457 corpus (182181s/246276h RM) 12/24/05 #counts SARE_SUB_PENIS 19s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_PENIS 24s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_PENIS 138s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PENIS 6s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_PENIS 44s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_PENIS 112s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PENIS 4s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_PENIS 30s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_RE_V Subject =~ /^Re:\sV\W/ describe SARE_SUB_RE_V common Leo subject header sign score SARE_SUB_RE_V 0.689 #ham SARE_SUB_RE_V Subject: Re: V.P. Cheney #hist SARE_SUB_RE_V Bob Menschel, Sept 11, 2005 #counts SARE_SUB_RE_V 7s/1h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_RE_V 416s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_RE_V 4s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_RE_V 2s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_RE_V 0s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_SUB_RE_V 9s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_RE_V 26s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 header SARE_SUB_SMART_PRICE Subject =~ /(?:best|Smart|specials?).?(?:Prices|prcies)/i describe SARE_SUB_SMART_PRICE Common spammer subject header -- Medical score SARE_SUB_SMART_PRICE 0.784 #hist SARE_SUB_SMART_PRICE Created by Bob Menschel Apr 09 2004 #hist SARE_SUB_SMART_PRICE Added special prices and "prcies" Apr 28 2004 #hist SARE_SUB_SMART_PRICE Added "best" prices Jan 22 2005 #counts SARE_SUB_SMART_PRICE 103s/6h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_SMART_PRICE 217s/0h of 117867 corpus (81073s/36794h RM) 01/23/05 #counts SARE_SUB_SMART_PRICE 3s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_SMART_PRICE 3s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_SUB_SMART_PRICE 10s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_SMART_PRICE 70s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_SMART_PRICE 7s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_SMART_PRICE 10s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_SMART_PRICE 53s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04 #counts SARE_SUB_SMART_PRICE 78s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_SMART_PRICE 14s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_SMART_PRICE 35s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 header SARE_SUB_WEIGHTLOSS Subject =~ /weightloss/i describe SARE_SUB_WEIGHTLOSS mentions weight loss as one word score SARE_SUB_WEIGHTLOSS 0.689 #hist SARE_SUB_WEIGHTLOSS RM_swm_weightloss #v300 SARE_SUB_WEIGHTLOSS adds to 3.0 body rule DIET_1 #counts SARE_SUB_WEIGHTLOSS 1s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_WEIGHTLOSS 1721s/1h of 69717 corpus (42681s/27036h RM) 09/26/04 #counts SARE_SUB_WEIGHTLOSS 2s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_WEIGHTLOSS 3s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_WEIGHTLOSS 68s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_WEIGHTLOSS 18s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_WEIGHTLOSS 144s/0h of 38751 corpus (15270s/23481h JH-SA3.0rc1) 08/30/04 #counts SARE_SUB_WEIGHTLOSS 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Politial ######## ###################### ################################################## header SARE_SUB_EMILYS_LIST Subject =~ /EMILY's LIst/i describe SARE_SUB_EMILYS_LIST Political spammer score SARE_SUB_EMILYS_LIST 0.555 #stype SARE_SUB_EMILYS_LIST spamp #hist SARE_SUB_EMILYS_LIST Created by Bob Menschel Oct 01 2004 #counts SARE_SUB_EMILYS_LIST 3s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_EMILYS_LIST 6s/0h of 238420 corpus (112480s/125940h RM) 02/28/05 #counts SARE_SUB_EMILYS_LIST 0s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_EMILYS_LIST 0s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_EMILYS_LIST 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Real Estate ######## ###################### ################################################## header SARE_SUB_HOMEOWNER Subject =~ /homeowner/i describe SARE_SUB_HOMEOWNER Spammer subject - real estate score SARE_SUB_HOMEOWNER 0.679 #ham SARE_SUB_HOMEOWNER confirmed (2) #counts SARE_SUB_HOMEOWNER 135s/11h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_HOMEOWNER 283s/16h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_HOMEOWNER 11s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_HOMEOWNER 24s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_HOMEOWNER 46s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_HOMEOWNER 15s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_HOMEOWNER 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_HOMEOWNER 12s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_HOMEOWNER 27s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_HOMEOWNER 31s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_HOMEOWNER 49s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 header SARE_SUB_TIMESHARE Subject =~ /timeshare/i describe SARE_SUB_TIMESHARE Spammer subject - real estate score SARE_SUB_TIMESHARE 1.111 #ham SARE_SUB_TIMESHARE confirmed #hist SARE_SUB_TIMESHARE Jan 2005: Moved from archive back to file 1 #counts SARE_SUB_TIMESHARE 69s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #counts SARE_SUB_TIMESHARE 13s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_TIMESHARE 2s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_TIMESHARE 16s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_TIMESHARE 30s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_TIMESHARE 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_TIMESHARE 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Software ######## ###################### ################################################## header SARE_SUB_CHEAP_SW Subject =~ /(?:(?:bargain|bucks|C.?h.?e.?a.?p|discount|expensive|p.?r.?i.?c.?e|s.?a.?v.?e|special\W*offer|spend).{1,30}software|s.?o.?f.?t.?w.?a.?r.?e.{1,30}(?:\%.off|at\W*only|bargain|bucks|c.?h.?e.?a.?p|deal|loww?.c.?o.?s.?t|price))/i describe SARE_SUB_CHEAP_SW Spammer subject - software score SARE_SUB_CHEAP_SW 1.408 #hist SARE_SUB_CHEAP_SW Created by Bob Menschel Apr 09 2004 #counts SARE_SUB_CHEAP_SW 814s/9h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_CHEAP_SW 930s/12h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_CHEAP_SW 38s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_CHEAP_SW 51s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_CHEAP_SW 408s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_CHEAP_SW 5s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_CHEAP_SW 314s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_CHEAP_SW 26s/2h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_CHEAP_SW 226s/1h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_CHEAP_SW 186s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_CHEAP_SW 221s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 header SARE_SUB_SWTYPES Subject =~ /(?:hate\W*typing|it\W*types|never\W*type|no\W*typing\W*required|Talk\W*It\W*Type\W*It|voice\W*recognition)/i describe SARE_SUB_SWTYPES subject has a spammer subject - Software score SARE_SUB_SWTYPES 1.144 #note SARE_SUB_SWTYPES beware: "attachment type" in virus bounce subject headings. #counts SARE_SUB_SWTYPES 67s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_SWTYPES 86s/4h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_SWTYPES 13s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_SWTYPES 12s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_SWTYPES 4s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_SWTYPES 0s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_SWTYPES 10s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_SWTYPES 16s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_SYSTEMWORKS Subject =~ /(?:get|sav(?:e|ing)).{1,30}system\W*works/i describe SARE_SUB_SYSTEMWORKS subject has a spammer subject - Software score SARE_SUB_SYSTEMWORKS 0.739 #counts SARE_SUB_SYSTEMWORKS 5s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_SYSTEMWORKS 12s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_SYSTEMWORKS 1s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_SYSTEMWORKS 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_SYSTEMWORKS 1s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_SYSTEMWORKS 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_SYSTEMWORKS 18s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_SYSTEMWORKS 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Spamming and Spammers ######## ###################### ################################################## header SARE_SUB_INET_CONN Subject =~ /(?:internet\W*connection\W*problem|(?:frequent|slow)\W*internet\W*connection)/i describe SARE_SUB_INET_CONN Spammer subject - spamming score SARE_SUB_INET_CONN 0.722 #counts SARE_SUB_INET_CONN 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_INET_CONN 22s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_INET_CONN 0s/5h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_INET_CONN 0s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_INET_CONN 4s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_INET_CONN 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_INET_CONN 3s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_INET_CONN 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_INET_CONN 1s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Generic words and phrases ######## ###################### ################################################## header SARE_SUB_ATTRACT Subject =~ /^Attract the /i describe SARE_SUB_ATTRACT Subject matches common spam pattern score SARE_SUB_ATTRACT 0.878 #hist SARE_SUB_ATTRACT LW_ATTR_SUB, Aug 16 2004, Loren Wilton #overlap SARE_SUB_ATTRACT strong overlap with FREE_PORN, SEDUCTION #counts SARE_SUB_ATTRACT 1s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_ATTRACT 50s/0h of 61007 corpus (36343s/24664h RM) 08/27/04 #counts SARE_SUB_ATTRACT 1s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_ATTRACT 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_ATTRACT 6s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_ATTRACT 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_ATTRACT 2s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_GOOD_DAY Subject =~ /\bgood day\b/i describe SARE_SUB_GOOD_DAY Contains spammer phrasing score SARE_SUB_GOOD_DAY 0.679 #ham SARE_SUB_GOOD_DAY Today Is Not a Good Day for War, from Nuclear Age Peace Foundation #hist SARE_SUB_GOOD_DAY Created by Bob Menschel Aug 29 2004 #counts SARE_SUB_GOOD_DAY 301s/5h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_GOOD_DAY 471s/7h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_GOOD_DAY 4s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_GOOD_DAY 16s/9h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_GOOD_DAY 8s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_GOOD_DAY 13s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_GOOD_DAY 34s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_GOOD_DAY 14s/2h of 40676 corpus (35385s/5291h MY) 12/25/05 #counts SARE_SUB_GOOD_DAY 0s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_GOOD_DAY 2s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_SUB_GOOD_DAY 0s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #max SARE_SUB_GOOD_DAY 1s/0h of 5906 corpus (1036s/4870h ft) 06/11/05 header SARE_SUB_LET Subject =~ /^Let (?:us|your|the banks?) /i describe SARE_SUB_LET Subject matches common spam pattern score SARE_SUB_LET 0.720 #ham SARE_SUB_LET Let your headings reset numbers (web page creation instruction) #hist SARE_SUB_LET LW_LET_SUB, Aug 16 2004, Loren Wilton #counts SARE_SUB_LET 124s/8h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_LET 209s/4h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_LET 24s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_LET 31s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_LET 1s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #max SARE_SUB_LET 5s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_SUB_LET 27s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_LET 59s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 header SARE_SUB_MSG_SUBJ Subject =~ /(?!message\n)^\W*(?:message\W+(?:subject|notification)|(?:new\W+)?(?:private\W+)?message)\W*$/i describe SARE_SUB_MSG_SUBJ subject is generic/default spammer subject score SARE_SUB_MSG_SUBJ 0.922 #stype SARE_SUB_MSG_SUBJ spamp #hist SARE_SUB_MSG_SUBJ Created by Bob Menschel Aug 10 2004, enhanced Aug 12 2004 #counts SARE_SUB_MSG_SUBJ 85s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_MSG_SUBJ 216s/0h of 280564 corpus (109285s/171279h RM) 05/03/05 #counts SARE_SUB_MSG_SUBJ 2s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_MSG_SUBJ 11s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_MSG_SUBJ 10s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_MSG_SUBJ 27s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #counts SARE_SUB_MSG_SUBJ 2s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_MSG_SUBJ 6s/1h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_MSG_SUBJ 28s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_MONEY Subject =~ /(?:(?:)(?:save|make)[ -].{0,30}money[ -](?:in|on|with)|(?:easy|free|grant|saving|with our|worth|(?:claim|keep) your) money|money machine|(?:money|earn).+secret|secret.+(?:money|earn))/i describe SARE_SUB_MONEY subject has likely spammer phrase or word score SARE_SUB_MONEY 0.623 #ham SARE_SUB_MONEY business email #hist SARE_SUB_MONEY Bob Menschel added some alternatives, Aug 28 2004, Sep 28 #counts SARE_SUB_MONEY 218s/29h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_MONEY 291s/13h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_MONEY 12s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_MONEY 43s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_MONEY 5s/1h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_MONEY 3s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_MONEY 72s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #counts SARE_SUB_MONEY 21s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 header SARE_SUB_NO Subject =~ /^no (?:appoint|more |need|pres|prior|stress home)/i describe SARE_SUB_NO Subject matches common spam pattern score SARE_SUB_NO 0.669 #hist SARE_SUB_NO LW_NO_SUB, Aug 16 2004, Loren Wilton #counts SARE_SUB_NO 108s/12h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_NO 236s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_NO 1s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_NO 11s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_NO 35s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_NO 24s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_NO 5s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_NO 43s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_NO 61s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_NO 13s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_NO 58s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_PERFECT Subject =~ /\bperfect\W*(?:body|chart|credit|gift|home|loan|match|mate|pharmacy|soft\W*ware|solution|source|summer|time|tool|travel|valentine)/i describe SARE_SUB_PERFECT subject has likely spammer phrase or word score SARE_SUB_PERFECT 0.725 #ham SARE_SUB_PERFECT "perfect valentine" and "perfect match" #counts SARE_SUB_PERFECT 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PERFECT 278s/3h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PERFECT 53s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_PERFECT 8s/1h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_PERFECT 0s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_PERFECT 13s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 header SARE_SUB_PROVEN Subject =~ /\bproven\b/i describe SARE_SUB_PROVEN subject has likely spammer phrase or word score SARE_SUB_PROVEN 0.618 #ham SARE_SUB_PROVEN confirmed (2) #counts SARE_SUB_PROVEN 144s/28h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PROVEN 176s/6h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PROVEN 2s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_PROVEN 5s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_PROVEN 9s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_PROVEN 80s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PROVEN 25s/1h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_PROVEN 9s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_PROVEN 20s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_PROVEN 43s/0h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PROVEN 27s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_PROVEN 30s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_SURVEY Subject =~ /(?:campaign|Fill\W*out|questions|rated.{1,30}by\W*a|short|simple|tak(e|ing)|womens)\W*survey|survey\W*(?:opportunity|says)/ describe SARE_SUB_SURVEY subject has likely spammer phrase or word score SARE_SUB_SURVEY 0.878 #ham SARE_SUB_SURVEY From valid survey company: A short survey about your investments #counts SARE_SUB_SURVEY 16s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_SURVEY 91s/2h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_SURVEY 5s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_SUB_SURVEY 14s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_SURVEY 2s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_SURVEY 21s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #counts SARE_SUB_SURVEY 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_SUB_SURVEY 1s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 header SARE_SUB_WHILE_U_CAN Subject =~ /While (?:U|You) Can/i describe SARE_SUB_WHILE_U_CAN Subject contains apparent spammer phrasing score SARE_SUB_WHILE_U_CAN 0.900 #ham SARE_SUB_WHILE_U_CAN verified (1) #hist SARE_SUB_WHILE_U_CAN Created by Bob Menschel Sep 4 2004 #counts SARE_SUB_WHILE_U_CAN 103s/1h of 428457 corpus (182181s/246276h RM) 12/24/05 #counts SARE_SUB_WHILE_U_CAN 3s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_WHILE_U_CAN 0s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_WHILE_U_CAN 1s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_WHILE_U_CAN 18s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_WHILE_U_CAN 23s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_WHILE_U_CAN 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Technical spamsign ######## ###################### ################################################## header SARE_SUB_CASH_CHAR Subject =~ /[a-zA-Z]\$[a-zA-Z]/ describe SARE_SUB_CASH_CHAR Subject has letter then $ then letter score SARE_SUB_CASH_CHAR 0.747 #ham SARE_SUB_CASH_CHAR WAR$HEEP #counts SARE_SUB_CASH_CHAR 1050s/12h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_CASH_CHAR 1878s/4h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_CASH_CHAR 29s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_CASH_CHAR 111s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_CASH_CHAR 83s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_CASH_CHAR 9s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_CASH_CHAR 49s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_CASH_CHAR 82s/28h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_CASH_CHAR 0s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_CASH_CHAR 20s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 header SARE_SUB_COMMA_FIRST Subject =~ /^,/ describe SARE_SUB_COMMA_FIRST Subject starts with a Comma. score SARE_SUB_COMMA_FIRST 1.330 #ham SARE_SUB_COMMA_FIRST verified (1) #counts SARE_SUB_COMMA_FIRST 332s/1h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_COMMA_FIRST 598s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_COMMA_FIRST 6s/1h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_COMMA_FIRST 11s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #counts SARE_SUB_COMMA_FIRST 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_COMMA_FIRST 68s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #counts SARE_SUB_COMMA_FIRST 0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_SUB_COMMA_FIRST 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_DASH_ONLY Subject =~ /^\s*-\s*$/ describe SARE_SUB_DASH_ONLY one non-alphanum in subject; no words score SARE_SUB_DASH_ONLY 2.500 #stype SARE_SUB_DASH_ONLY spamg #hist SARE_SUB_DASH_ONLY Created by Bob Menschel May 31 2004 #counts SARE_SUB_DASH_ONLY 2s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_DASH_ONLY 19s/0h of 67058 corpus (41838s/25220h RM) 09/04/04 #counts SARE_SUB_DASH_ONLY 6s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_DASH_ONLY 0s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_DASH_ONLY 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_DDCC Subject =~ /^\d\d\s+-\s+[A-Z]{2}\s/ describe SARE_SUB_DDCC subject has obvious spamsign score SARE_SUB_DDCC 1.111 #stype SARE_SUB_DDCC spamp #hist SARE_SUB_DDCC Created by Bob Menschel Aug 12 2004 #counts SARE_SUB_DDCC 0s/0h of 196667 corpus (96194s/100473h RM) 02/21/05 #max SARE_SUB_DDCC 41s/0h of 69842 corpus (42682s/27160h RM) 09/26/04 #counts SARE_SUB_DDCC 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_DDCC 8s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_DDCC 0s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_DDCC 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_MCFWD Subject =~ /FwD:/ describe SARE_SUB_MCFWD apparent spam/virus sign in subject score SARE_SUB_MCFWD 1.111 #stype SARE_SUB_MCFWD spamp #hist SARE_SUB_MCFWD Created by Bob Menschel May 27 2004 #counts SARE_SUB_MCFWD 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_MCFWD 10s/0h of 92315 corpus (67942s/24373h RM) 07/24/04 #counts SARE_SUB_MCFWD 1s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #counts SARE_SUB_MCFWD 1s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_MCFWD 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_PCT_LETTER Subject =~ /%[A-Z]\b/i describe SARE_SUB_PCT_LETTER subject has random-text spamsign score SARE_SUB_PCT_LETTER 0.784 #hist SARE_SUB_PCT_LETTER Feb 2005: added bound, forcing match to solo letter. #counts SARE_SUB_PCT_LETTER 689s/9h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_PCT_LETTER 1407s/27h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_PCT_LETTER 8s/0h of 7659 corpus (6205s/1454h AxB) 12/25/05 #counts SARE_SUB_PCT_LETTER 62s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #counts SARE_SUB_PCT_LETTER 49s/0h of 74216 corpus (34905s/39311h DOC) 12/25/05 #counts SARE_SUB_PCT_LETTER 6s/10h of 40312 corpus (30637s/9675h ML) 12/25/05 #counts SARE_SUB_PCT_LETTER 1s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_PCT_LETTER 43s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_PCT_LETTER 9s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_PCT_LETTER 69s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 # EOF