#Redefine some scores score FROM_HAS_UNDERLINE_NUMS 2.599 2.428 2.235 2.088 score FROM_HAS_MIXED_NUMS 0.937 0.967 0.806 0.832 header __CATCHER_HIT exists:X-RBL-TEXT header CATCHER_HIT __CATCHER_HIT && !CATCHER_SPAMMARK describe CATCHER_HIT Message has hit in POP3Catcher's non-spam RBL-zones score CATCHER_HIT 3.0 header CATCHER_SPAMMARK exists:X-Spam-Mark describe CATCHER_SPAMMARK Message has been marked by POP3Catcher as SPAM score CATCHER_SPAMMARK 10.0 # idea from Robert Menschel header FROM_HAS_MIXED_NUMS3 From:addr =~ /^[a-z]+\d+[a-z]+\d+[a-z]+\w*\@/i describe FROM_HAS_MIXED_NUMS3 From: contains numbers mixed in with letters score FROM_HAS_MIXED_NUMS3 1.884 1.883 1.620 1.619 header RCVD_NUMERIC_HELO Received =~ /helo[= ]\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/i describe RCVD_NUMERIC_HELO Received: contains a numeric HELO score RCVD_NUMERIC_HELO 0.747 rawbody __OBFUSCATING_COMMENT_A /\w(?:]*>)+\w/ rawbody __OBFUSCATING_COMMENT_B /[^\s>](?:]*>)+[^\s<]/ meta OBFUSCATING_COMMENT2 ((__OBFUSCATING_COMMENT_A && HTML_MESSAGE) || (__OBFUSCATING_COMMENT_B && MIME_HTML_ONLY)) describe OBFUSCATING_COMMENT2 HTML comments which obfuscate text score OBFUSCATING_COMMENT2 4.400 4.300 3.784 3.698 meta NIGERIAN_BODY1 ( __NIGERIAN_BODY_1 + __NIGERIAN_BODY_2 + __NIGERIAN_BODY_3 + __NIGERIAN_BODY_5 + __NIGERIAN_BODY_6 + __NIGERIAN_BODY_7 + __NIGERIAN_BODY_8 + __NIGERIAN_BODY_9 + __NIGERIAN_BODY_10 + __NIGERIAN_BODY_11 + __NIGERIAN_BODY_12 + __NIGERIAN_BODY_13 + __NIGERIAN_BODY_14 + __NIGERIAN_BODY_15 + __NIGERIAN_BODY_16 + __NIGERIAN_BODY_17 + __NIGERIAN_BODY_18 + __NIGERIAN_BODY_19 + __NIGERIAN_BODY_20 + __NIGERIAN_BODY_21 + __NIGERIAN_BODY_22 + __NIGERIAN_BODY_25 + __NIGERIAN_BODY_26 + __NIGERIAN_BODY_27 + __NIGERIAN_BODY_28 + __NIGERIAN_BODY_29 + __NIGERIAN_BODY_30 + __NIGERIAN_BODY_31 + __NIGERIAN_BODY_32 + __NIGERIAN_BODY_33 + __NIGERIAN_BODY_34 + __NIGERIAN_BODY_35 + __NIGERIAN_BODY_36 + __NIGERIAN_BODY_37 + __NIGERIAN_BODY_38 + __NIGERIAN_BODY_39 + __NIGERIAN_BODY_40 + __NIGERIAN_BODY_41 + __NIGERIAN_BODY_42 + __NIGERIAN_BODY_43 + __NIGERIAN_BODY_44 + __NIGERIAN_BODY_45 + __NIGERIAN_BODY_46 ) > 1 describe NIGERIAN_BODY1 Message body looks like a Nigerian spam message 1+ meta NIGERIAN_BODY2 ( __NIGERIAN_BODY_1 + __NIGERIAN_BODY_2 + __NIGERIAN_BODY_3 + __NIGERIAN_BODY_5 + __NIGERIAN_BODY_6 + __NIGERIAN_BODY_7 + __NIGERIAN_BODY_8 + __NIGERIAN_BODY_9 + __NIGERIAN_BODY_10 + __NIGERIAN_BODY_11 + __NIGERIAN_BODY_12 + __NIGERIAN_BODY_13 + __NIGERIAN_BODY_14 + __NIGERIAN_BODY_15 + __NIGERIAN_BODY_16 + __NIGERIAN_BODY_17 + __NIGERIAN_BODY_18 + __NIGERIAN_BODY_19 + __NIGERIAN_BODY_20 + __NIGERIAN_BODY_21 + __NIGERIAN_BODY_22 + __NIGERIAN_BODY_25 + __NIGERIAN_BODY_26 + __NIGERIAN_BODY_27 + __NIGERIAN_BODY_28 + __NIGERIAN_BODY_29 + __NIGERIAN_BODY_30 + __NIGERIAN_BODY_31 + __NIGERIAN_BODY_32 + __NIGERIAN_BODY_33 + __NIGERIAN_BODY_34 + __NIGERIAN_BODY_35 + __NIGERIAN_BODY_36 + __NIGERIAN_BODY_37 + __NIGERIAN_BODY_38 + __NIGERIAN_BODY_39 + __NIGERIAN_BODY_40 + __NIGERIAN_BODY_41 + __NIGERIAN_BODY_42 + __NIGERIAN_BODY_43 + __NIGERIAN_BODY_44 + __NIGERIAN_BODY_45 + __NIGERIAN_BODY_46 ) > 2 describe NIGERIAN_BODY2 Message body looks like a Nigerian spam message 2+ meta NIGERIAN_BODY3 ( __NIGERIAN_BODY_1 + __NIGERIAN_BODY_2 + __NIGERIAN_BODY_3 + __NIGERIAN_BODY_5 + __NIGERIAN_BODY_6 + __NIGERIAN_BODY_7 + __NIGERIAN_BODY_8 + __NIGERIAN_BODY_9 + __NIGERIAN_BODY_10 + __NIGERIAN_BODY_11 + __NIGERIAN_BODY_12 + __NIGERIAN_BODY_13 + __NIGERIAN_BODY_14 + __NIGERIAN_BODY_15 + __NIGERIAN_BODY_16 + __NIGERIAN_BODY_17 + __NIGERIAN_BODY_18 + __NIGERIAN_BODY_19 + __NIGERIAN_BODY_20 + __NIGERIAN_BODY_21 + __NIGERIAN_BODY_22 + __NIGERIAN_BODY_25 + __NIGERIAN_BODY_26 + __NIGERIAN_BODY_27 + __NIGERIAN_BODY_28 + __NIGERIAN_BODY_29 + __NIGERIAN_BODY_30 + __NIGERIAN_BODY_31 + __NIGERIAN_BODY_32 + __NIGERIAN_BODY_33 + __NIGERIAN_BODY_34 + __NIGERIAN_BODY_35 + __NIGERIAN_BODY_36 + __NIGERIAN_BODY_37 + __NIGERIAN_BODY_38 + __NIGERIAN_BODY_39 + __NIGERIAN_BODY_40 + __NIGERIAN_BODY_41 + __NIGERIAN_BODY_42 + __NIGERIAN_BODY_43 + __NIGERIAN_BODY_44 + __NIGERIAN_BODY_45 + __NIGERIAN_BODY_46 ) > 3 describe NIGERIAN_BODY3 Message body looks like a Nigerian spam message 3+ meta NIGERIAN_BODY4 ( __NIGERIAN_BODY_1 + __NIGERIAN_BODY_2 + __NIGERIAN_BODY_3 + __NIGERIAN_BODY_5 + __NIGERIAN_BODY_6 + __NIGERIAN_BODY_7 + __NIGERIAN_BODY_8 + __NIGERIAN_BODY_9 + __NIGERIAN_BODY_10 + __NIGERIAN_BODY_11 + __NIGERIAN_BODY_12 + __NIGERIAN_BODY_13 + __NIGERIAN_BODY_14 + __NIGERIAN_BODY_15 + __NIGERIAN_BODY_16 + __NIGERIAN_BODY_17 + __NIGERIAN_BODY_18 + __NIGERIAN_BODY_19 + __NIGERIAN_BODY_20 + __NIGERIAN_BODY_21 + __NIGERIAN_BODY_22 + __NIGERIAN_BODY_25 + __NIGERIAN_BODY_26 + __NIGERIAN_BODY_27 + __NIGERIAN_BODY_28 + __NIGERIAN_BODY_29 + __NIGERIAN_BODY_30 + __NIGERIAN_BODY_31 + __NIGERIAN_BODY_32 + __NIGERIAN_BODY_33 + __NIGERIAN_BODY_34 + __NIGERIAN_BODY_35 + __NIGERIAN_BODY_36 + __NIGERIAN_BODY_37 + __NIGERIAN_BODY_38 + __NIGERIAN_BODY_39 + __NIGERIAN_BODY_40 + __NIGERIAN_BODY_41 + __NIGERIAN_BODY_42 + __NIGERIAN_BODY_43 + __NIGERIAN_BODY_44 + __NIGERIAN_BODY_45 + __NIGERIAN_BODY_46 ) > 4 describe NIGERIAN_BODY4 Message body looks like a Nigerian spam message 4+ score NIGERIAN_BODY1 2.900 2.800 2.494 2.408 score NIGERIAN_BODY2 2.900 2.800 2.494 2.408 score NIGERIAN_BODY3 2.900 2.800 2.494 2.408 score NIGERIAN_BODY4 2.900 2.800 2.494 2.408 body REMOVE_REMOVAL_1WORD /remov\S{0,64}remov/i describe REMOVE_REMOVAL_1WORD List removal information body REMOVE_REMOVAL_2WORD /remov\S{0,16}\s+\S{0,16}remov/i describe REMOVE_REMOVAL_2WORD List removal information body __REMOVE_REMOVAL_NEAR /remov(?:e|al).{0,16}remov(?:e|al)/i meta REMOVE_REMOVAL_NEAR (__REMOVE_REMOVAL_NEAR && !REMOVE_REMOVAL_1WORD && !REMOVE_REMOVAL_2WORD) describe REMOVE_REMOVAL_NEAR List removal information score REMOVE_REMOVAL_1WORD 2.471 1.360 2.125 1.170 score REMOVE_REMOVAL_2WORD 1.101 0.501 0.947 0.431 score REMOVE_REMOVAL_NEAR 2.699 1.848 2.321 1.589 body WALAA /instructions and walaa\b/i describe WALAA lliterate spammer cannot spell 'voila' score WALAA 2.900 2.800 2.494 2.408 body LOSEWEIGHT /\blo+se.{1,10}\d+.{1,3}(?:lb|pound|kg|kilo)/i describe LOSEWEIGHT Describes weight loss score LOSEWEIGHT 2.900 2.800 2.494 2.408 body LOSEBODYFAT /(?:Body Fat Loss|Loss of body fat|lose.{1,10}body fat)/i describe LOSEBODYFAT Describes body fat loss score LOSEBODYFAT 4.400 4.300 3.784 3.698 body RAVAGESOFAGING /ravages of aging/i describe RAVAGESOFAGING Describes the ravages of aging score RAVAGESOFAGING 2.900 2.800 2.494 2.408 body GENERIC_VIAGRA /Generic Viagra/ describe GENERIC_VIAGRA Mentions Generic Viagra score GENERIC_VIAGRA 4.400 4.300 3.784 3.698 body BETTERMEMORY /Better Memory/i describe BETTERMEMORY Describes "better memory" score BETTERMEMORY 0.993 0.701 0.854 0.603 body __MAIL15_URL /www\.mail15\.com/i body __MAIL15_UNSUB /mailto:unsubscribe@mail15\.com\?subject=unsubscribe/ header __NEW_MAIL Subject =~ /new mail/ meta __MAIL15_SUBJ __NEW_MAIL && SUBJ_HAS_UNIQ_ID && SUBJ_HAS_SPACES meta MAIL15_SPAM __MAIL15_URL && __MAIL15_SUBJ describe MAIL15_SPAM Spam from mail15 score MAIL15_SPAM 10 header MAILMX Received =~ /with MailMXPro/ describe MAILMX Received contains MailMXPro sign score MAILMX 10